perf(e2e): consolidate Hermes credentialless rebuild

[apurvvkumaria]

Summary

The Hermes Discord lane currently performs a second full sandbox rebuild only to prove that stored inference credentials survive when host keys are absent. This change moves that assertion into the canonical rebuild-hermes operation and removes the duplicate Discord rebuild while retaining the lane's unique gateway, token-isolation, REST, placeholder, and cleanup coverage.

Related Issue

Part of #7144
Refs #7140

Changes

• Run the existing normal and stale-base Hermes rebuild operation without NVIDIA_INFERENCE_API_KEY, COMPATIBLE_API_KEY, or NVIDIA_API_KEY, while preserving the verified current-base reuse override.
• Prove that the rebuild succeeds from persisted provider state and does not report a missing provider credential.
• Remove only the redundant rebuild phase from hermes-discord; keep its native Discord Gateway rewrite, REST boundary, config schema, raw-token isolation, residue, and cleanup assertions.
• Preserve the live-test phase contract and compact finalization artifact numbering.

The #7493 telemetry recorded the removed Discord rebuild at about 153 seconds; the full lane reached an approximately 11.6 GiB Docker/BuildKit process peak. This removes one high-memory build exposure without claiming that the retained initial install cannot reach a similar peak, adding a retry, or weakening product behavior coverage.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This consolidates internal live E2E ownership without changing NemoClaw commands, supported behavior, configuration, or user workflows.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head review at 6b306be12 verified the child-process credential boundary, persisted-provider setup, base-reuse override, retained Discord assertions, and cleanup behavior.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Exact head 6b306be12 changes only internal live E2E ownership and its regression coverage; no user-facing documentation contract changes.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 52 focused E2E-support tests passed; semantic phase collection validated 125 tests across 82 files; Biome and test-title checks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not run because the change is confined to two live targets and one focused E2E-support contract.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Tests
  • Updated Hermes rebuild validation to run without host inference credentials.
  • Added checks confirming inference credentials are excluded from rebuild environments.
  • Added validation that rebuilds do not report missing provider credentials.
  • Expanded compatibility coverage to ensure unsupported credentials are not forwarded.
  • Removed outdated Discord credential-reuse test coverage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 71f2eeb2-31e4-4eb4-a87a-078e1028887d

📥 Commits

Reviewing files that changed from the base of the PR and between f6347bd and 6b306be.

📒 Files selected for processing (3)

• test/e2e/live/hermes-discord.test.ts
• test/e2e/live/rebuild-hermes.test.ts
• test/e2e/support/rebuild-hermes-env.test.ts

---

📝 Walkthrough

Walkthrough

Changes

Hermes rebuild validation

Layer / File(s)	Summary
Rebuild environment filtering test/e2e/support/rebuild-hermes-env.test.ts, test/e2e/live/rebuild-hermes.test.ts	Rebuild environment tests exclude unsupported inference and NVIDIA credential variables from forwarded child environment data.
Credential-free rebuild validation test/e2e/live/rebuild-hermes.test.ts	The live Hermes rebuild records the credential-free rebuild boundary and verifies verbose output does not report a missing provider credential.
Discord test scope cleanup test/e2e/live/hermes-discord.test.ts	The Hermes Discord test removes rebuild credential-reuse coverage, its assertion, and obsolete phase numbering.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: jyaunches, cjagwani, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: consolidating Hermes credentialless rebuild coverage and removing the redundant Discord rebuild path.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7144-hermes-credential-rebuild-consolidation

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 6b306be in the codex/7144-hermes-cr... branch remains at 96%, unchanged from commit dc07773 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 6b306be in the codex/7144-hermes-cr... branch remains at 80%, unchanged from commit f6347bd in the main branch.

Show a code coverage summary of the most impacted files.

File	main f6347bd	codex/7144-hermes-cr... 6b306be	+/-
src/lib/actions...-add-restart.ts	19%	10%	-9%
src/lib/actions...on-readiness.ts	100%	91%	-9%
src/lib/actions...x/mcp-bridge.ts	43%	36%	-7%
src/lib/actions...lution-probe.ts	93%	88%	-5%
src/lib/actions...e-validation.ts	84%	81%	-3%
src/lib/onboard...shboard-port.ts	93%	90%	-3%
src/lib/actions...dbox/destroy.ts	95%	93%	-2%
src/lib/onboard...eway-service.ts	82%	81%	-1%
src/lib/shields/index.ts	71%	72%	+1%
src/lib/platform.ts	84%	89%	+5%

---

_{Updated July 26, 2026 08:08 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, hermes-discord, rebuild-hermes, rebuild-hermes-stale-base

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Exact-head CI disposition for 6b306be128632b7726b3b1e2ee418cd05ddf043c:

• All eight CLI shards, aggregate CLI tests, static/build/type checks, plugin tests, installer integration, and the WeChat runtime audit passed in run 30193745448.
• The complete self-hosted image/sandbox suite passed in run 30193746678.
• CodeRabbit and both advisor lanes reported no actionable findings; there are no review threads.
• The sole primary failure is reviewed-npm-audit: npm returned incomplete metadata (summary and detail were empty) rather than a vulnerability report. The aggregate checks and E2E coordination failures are derivative.

This is the same shared registry failure affecting the adjacent runner-stability PRs and is unrelated to the three Hermes E2E files in this diff. I am not issuing another blind rerun; #7575 is the scoped controlled-retry follow-up.