fix(e2e): accept canonical controller check URLs

[apurvvkumaria]

Summary

GitHub may canonicalize a PR gate check details URL to the check own /runs/ URL even when the exact child-bound summary is persisted. The controller introduced by #7594 rejected that valid response, revoked authorization, and prevented the selected #7590 Hermes lanes from starting. This change accepts only the exact child URL or the exact canonical check URL while preserving every authorization identity check.

Related Issue

Part of #7140. Follow-up to #7593 and #7594; aligns the parent controller with the canonicalization behavior already protected by #7515.

Changes

• Accept the selected child Actions URL or the exact canonical /runs/ URL after the check ID, GitHub Actions app, PR head/base identity, status, title, and child-bound summary all validate.
• Continue rejecting foreign repositories, wrong check IDs, alternate schemes, query or fragment variants, and unrelated URLs.
• Cover both allowed URL forms after a lost PATCH response and prove a foreign canonical URL still revokes authorization before child cancellation.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: existing E2E operational documentation already states that GitHub may canonicalize details_url to /runs/; no user-facing command or workflow changes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent Codex Desktop code and security reviews verified the exact URL allowlist and the retained check ID, app, PR/head/base, status, plan, jobs, targets, and child-run summary binding; no findings remained.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes.
• Result: no-docs-needed
• Evidence: Exact head d4f53a19618b4d810494e2094c6aff6b9f6602cc changes only the E2E controller’s canonical check-URL validation and focused tests. test/e2e/README.md already documents direct-read recovery, exact persisted child binding, and GitHub canonicalization to /runs/<check-id>. Changed test text is behavior-oriented and introduces no issue references. No docs build was needed because no documentation source changed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: not applicable
• Station profile/scenario: not applicable
• Result: not applicable; scripts/prepare-dgx-station-host.sh is unchanged.
• Supporting evidence:

Verification

• PR description includes a Signed-off-by line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 19 PR-E2E files, 313 tests passed; the E2E workflow boundary added 39 passing tests.
• Applicable broad gate passed — CLI typecheck, source-shape, test-size, title-style, project isolation, Biome, and the complete changed-file hook set passed. Post-rebase focused validation passed 41 tests.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new doc pages only)

Failure evidence: controller run 30221481816 and child run 30221620499. The parent published the exact child-bound summary but GitHub returned the canonical check URL, so the old strict URL comparison revoked the otherwise valid authorization.

Self-hosting evidence: #7599 controller run 30224207359 checked out trusted base 2f66902b, rejected the canonical URL for check 89851619986, and could not cancel child run 30224558462 after GitHub returned HTTP 500. The orphan child then failed closed because trusted controller authorization had not been published. A same-revision retry is not supported after dispatch; the exact fix requires the repository's approved controller-bootstrap governance path.

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved pull request gate recovery when an authorization update response is lost, ensuring check details URLs are set correctly after retry behavior.
  • Updated gate check validation to accept both dispatched child run URLs and canonical controller check URLs.
• Tests
  • Expanded end-to-end coverage with parameterized published-details URL variants and scenarios where lost updates result in a foreign check URL.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates controller gate validation for canonical and child-run check URLs and expands E2E coverage for lost PATCH responses, including foreign check URLs.

Changes

Controller URL recovery

Layer / File(s)	Summary
Accept canonical controller check URLs tools/e2e/pr-e2e-gate.mts	Child authorization publication accepts either the dispatched child-run URL or the canonical controller check URL.
Cover published URL variants test/pr-e2e-gate-dispatch-recovery.test.ts	The recovery test covers exact child and canonical controller URL variants in PATCH handling and assertions.
Cover foreign URL after lost PATCH test/pr-e2e-gate-lifecycle.test.ts	The lifecycle test captures the failed PATCH payload and returns a foreign details URL during the subsequent GET.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• NVIDIA/NemoClaw issue 7593 — Overlaps the controller dispatch-reconciliation implementation and lifecycle test coverage.

Possibly related PRs

• NVIDIA/NemoClaw#7450 — Adjusts controller validation and E2E coverage for details URL variants.
• NVIDIA/NemoClaw#7529 — Broadens controller check authorization for child-run and canonical URLs.
• NVIDIA/NemoClaw#7594 — Adds reconciliation rules for uncertain dispatch and authorization outcomes.

Suggested labels: area: security

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: E2E now accepts canonical controller check URLs.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/controller-canonical-check-url

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit d4f53a1 in the codex/controller-can... branch remains at 96%, unchanged from commit 2f66902 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit d4f53a1 in the codex/controller-can... branch is 80%. The coverage in commit 968385b in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main 968385b	codex/controller-can... d4f53a1	+/-
src/lib/actions...-add-restart.ts	19%	10%	-9%
src/lib/actions...on-readiness.ts	100%	91%	-9%
src/lib/actions...x/mcp-bridge.ts	43%	36%	-7%
src/lib/actions...lution-probe.ts	93%	88%	-5%
src/lib/state/o...oint-migrate.ts	96%	92%	-4%
src/lib/actions...e-validation.ts	84%	81%	-3%
src/lib/onboard...shboard-port.ts	93%	90%	-3%
src/lib/actions...dbox/destroy.ts	95%	93%	-2%
src/lib/onboard...eway-service.ts	82%	81%	-1%
src/lib/shields/index.ts	71%	72%	+1%

---

_{Updated July 26, 2026 23:06 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[ericksoa]

Reviewed exact head d4f53a1. The production change retains exact check/app/PR/head/base/status/title/summary binding and additionally accepts only GitHub’s exact canonical URL for that same check ID. Accepting the circular E2E gate failure: the trusted pre-fix controller rejects precisely the canonical URL this PR corrects, while ordinary CI, security checks, and both advisors are green.