fix(policy): register shared network schema at runtime by cv · Pull Request #7532 · NVIDIA/NemoClaw

cv · 2026-07-25T20:27:17Z

Summary

After #6877 and #7194 merged, the runtime sandbox-policy compiler could not resolve the external network-policy schema. This PR registers and ships that schema so source and installed-package validation initialize again.

Changes

Load and register the canonical network-policy schema before AJV compiles the sandbox-policy schema.
Include the network-policy schema in the npm package allowlist.
Extend the installed-package contract to require the referenced schema.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: This restores the existing schema-validation and package contract. It changes no command, configuration, schema, default, output, or workflow.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex completed the nine-category review. The shipped schemas remain trusted local inputs, validation fails closed, and the diff changes no auth, network, secret, dependency, or crypto behavior.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: Reviewed package.json, src/lib/policy/sandbox-policy-validation.ts, and test/package-contract/openshell-policy-boundary.test.ts. Existing network-policy docs remain accurate. CLI build and typecheck passed; 36 focused policy tests, 48 configuration validations, 681 affected tests, and all 7 OpenShell policy package-contract tests passed.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: CLI build and typecheck; 36 focused policy tests; 48 configuration validations; npm run test:changed (681 tests); full 7-test OpenShell policy package contract.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable to this three-file integration repair.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

New Features
- Added the network policy schema to the published package.
- Sandbox policy validation now incorporates network policy rules for more complete validation.
Bug Fixes
- Improved validator initialization checks when required policy schemas are missing, unreadable, or invalid.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

coderabbitai · 2026-07-25T20:27:48Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 690c01ee-26f5-436e-92ce-8a9477ba04eb

📥 Commits

Reviewing files that changed from the base of the PR and between 2ac4a0d and b220070.

📒 Files selected for processing (3)

package.json
src/lib/policy/sandbox-policy-validation.ts
test/package-contract/openshell-policy-boundary.test.ts

📝 Walkthrough

Walkthrough

The package now includes network-policy.schema.json. Sandbox policy validator initialization loads and validates both schemas, registers the network schema with AJV, and compiles the sandbox schema. Packaging tests verify both schema files are present in the extracted artifact.

Changes

Policy schema packaging and validation

Layer / File(s)	Summary
Package network schema artifact `package.json`, `test/package-contract/openshell-policy-boundary.test.ts`	The npm package allowlist includes `schemas/network-policy.schema.json`, and the package contract checks that it is present after extraction.
Load and register network schema `src/lib/policy/sandbox-policy-validation.ts`	Validator initialization loads and root-validates both schemas, registers the network schema with AJV, and compiles the sandbox policy schema.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: laitingsheng, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: registering the shared network schema at runtime.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-runtime-network-schema

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-25T20:28:08Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b220070 in the codex/fix-runtime-ne... branch remains at 96%, unchanged from commit 2ac4a0d in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit b220070 in the codex/fix-runtime-ne... branch remains at 80%, unchanged from commit dbac677 in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` dbac677	`codex/fix-runtime-ne...` b220070	+/-
`src/lib/onboard/docker-cdi.ts`	80%	70%	-10%
`src/lib/actions.../status-text.ts`	47%	41%	-6%
`src/lib/shields/index.ts`	72%	67%	-5%
`src/lib/policy/index.ts`	58%	61%	+3%
`src/lib/actions...ocker-health.ts`	65%	82%	+17%
`src/lib/onboard...box-prebuild.ts`	74%	92%	+18%
`src/lib/policy/...ne-exclusion.ts`	0%	97%	+97%
`src/lib/policy/...y-validation.ts`	0%	100%	+100%
`src/commands/sa...licy/exclude.ts`	0%	100%	+100%
`src/commands/sa...licy/restore.ts`	0%	100%	+100%

_{Updated July 25, 2026 20:36 UTC}

github-actions · 2026-07-25T20:28:14Z

🌿 Preview your docs: https://nvidia-preview-pr-7532.docs.buildwithfern.com/nemoclaw

github-actions · 2026-07-25T20:30:55Z

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, inference-routing, network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

cv · 2026-07-25T20:56:12Z

Duplicate of #7531

fix(policy): register shared network schema at runtime

b220070

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

cv added the v0.0.96 Release target label Jul 25, 2026

cv self-assigned this Jul 25, 2026

cv requested a review from ericksoa July 25, 2026 20:32

coderabbitai Bot mentioned this pull request Jul 25, 2026

fix(policy): load shared network policy schema #7533

Closed

23 tasks

apurvvkumaria mentioned this pull request Jul 25, 2026

fix(policy): register shared network schema at runtime #7531

Merged

23 tasks

cv marked this as a duplicate of #7531 Jul 25, 2026

cv closed this Jul 25, 2026

cv requested a review from laitingsheng July 25, 2026 20:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(policy): register shared network schema at runtime#7532

fix(policy): register shared network schema at runtime#7532
cv wants to merge 1 commit into
mainfrom
codex/fix-runtime-network-schema

cv commented Jul 25, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 25, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 25, 2026

Uh oh!

github-actions Bot commented Jul 25, 2026 •

edited

Loading

Uh oh!

cv commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

cv commented Jul 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 25, 2026

Uh oh!

github-actions Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — Informational

Model lanes

E2E guidance

Uh oh!

cv commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cv commented Jul 25, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 25, 2026 •

edited

Loading

github-code-quality Bot commented Jul 25, 2026 •

edited

Loading

github-actions Bot commented Jul 25, 2026 •

edited

Loading