fix(dcode): default to Ultra and suppress model picker

[ericksoa]

Summary

Make Nemotron 3 Ultra the NVIDIA Endpoints default for Deep Agents Code and prevent the upstream first-run model picker from overriding NemoClaw-managed configuration.

Related Issue

Fixes #6410

Changes

• Declare nvidia/nemotron-3-ultra-550b-a55b as the DCode-specific cloud default while preserving the shared Super default for OpenClaw and Hermes.
• Patch pinned deepagents-code==0.1.30 at its source boundary so managed sandboxes never launch upstream onboarding or its model picker.
• Make the live TUI check fail if any first-run or model-selection screen reappears.
• Add manifest validation, selection-precedence, patch-idempotence, exact-wheel, and TUI regression coverage.
• Document the DCode-specific default and rebuild guidance for existing sandboxes.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent source review found no blockers; the pinned package version and required upstream symbol are checked before the onboarding override is applied, and existing credential/policy boundaries are unchanged.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 94/94 focused CLI assertions and 137 passed with 1 skipped across DCode package, image, progressive-disclosure, and TUI integration tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: all required GitHub PR checks and the self-hosted amd64/arm64 image test matrix passed on exact head 91aa2095.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — 0 errors; only the two repository-suppressed pre-existing Fern warnings were reported.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Additional verification:

• Exact deepagents-code==0.1.30 wheel patched idempotently, compiled, and returned False from should_run_onboarding() even with the upstream debug-onboarding override enabled.
• npm run typecheck:cli
• npm run build:cli
• npm run source-shape:check
• npm run test-size:check
• git diff --check
• Required DCode cloud sandbox/TUI E2E passed on 91aa2095: https://github.com/NVIDIA/NemoClaw/actions/runs/28887469560
• Required cloud-onboard and inference-routing E2E passed on 91aa2095: https://github.com/NVIDIA/NemoClaw/actions/runs/28887469640

Advisor follow-up evidence:

• rg confirms exactly four canonical source/docs occurrences of nvidia/nemotron-3-ultra-550b-a55b: the Dockerfile fallback, DCode manifest default, quickstart, and inference guide. Tests load the real manifest and assert the Dockerfile value. OpenClaw and Hermes retain the shared Super fallback.
• The localized upstream onboarding override is intentional for pinned deepagents-code==0.1.30; the patch fails closed on version or source-shape drift and the direct-module suite proves idempotence and debug-override suppression.
• Treating a first-run/model-picker screen as exit 24 is an intentional regression gate for managed DCode. The required live DCode target passed the real patched sandbox and TUI path above.
• Broader provider-ID matrices and test-helper extraction are outside this DCode-specific fix; the changed manifest boundary has positive, type-invalid, and unsafe-string coverage.
• The two CodeRabbit findings were fixed on 91aa2095: the selector now uses the injected onboarding logger and the literal picker label uses inline-code formatting.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates Deep Agents Code to use a manifest default model, validate and propagate it through selection and setup flows, skip upstream onboarding in the managed package, and treat unexpected first-run model pickers as failures in startup checks and tests.

Changes

Default model propagation and startup handling

Layer / File(s)	Summary
Manifest default model and validation agents/langchain-deepagents-code/Dockerfile, agents/langchain-deepagents-code/manifest.yaml, src/lib/agent/definition-types.ts, src/lib/agent/manifest-readers.ts, src/lib/agent/defs.test.ts	Adds default_model to Deep Agents Code config, validates it when reading inference settings, and extends manifest tests for valid and invalid values.
Default model resolution and selection src/lib/inference/config.ts, src/lib/inference/config.test.ts, src/lib/onboard/nvidia-featured-model-selection.ts, src/lib/onboard/nvidia-featured-model-selection.test.ts, src/lib/onboard/setup-nim-flow.ts, src/lib/onboard/setup-nim-flow.test.ts	Adds a helper to resolve an agent default cloud model, threads it into featured-model session creation, and updates selection/setup tests for the new default-model flow.
Onboarding patch and first-run checks agents/langchain-deepagents-code/patch-managed-deepagents-code.py, test/langchain-deepagents-code-direct-module-patch.test.ts, test/deepagents-code-tui-startup-check.test.ts, test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh, test/langchain-deepagents-code-image.test.ts, test/langchain-deepagents-code-progressive-tool-disclosure.test.ts	Adds managed patching for onboarding.py, changes startup checks to detect first-run model pickers, and updates related image and fixture tests.
Docs and policy notes docs/get-started/quickstart-langchain-deepagents-code.mdx, docs/inference/inference-options.mdx	Updates Deep Agents Code setup and inference docs to describe the agent-specific default model and first-run behavior.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ManagedLauncher
  participant OnboardingModule
  participant SetupNimFlow
  participant NvidiaFeaturedModelSession

  User->>ManagedLauncher: launch dcode interactively
  ManagedLauncher->>OnboardingModule: should_run_onboarding(state_dir)
  OnboardingModule-->>ManagedLauncher: False
  ManagedLauncher->>SetupNimFlow: setupNim(agent)
  SetupNimFlow->>NvidiaFeaturedModelSession: createNvidiaFeaturedModelSession({ defaultModel })
  NvidiaFeaturedModelSession-->>ManagedLauncher: select model
  alt first-run picker appears
    ManagedLauncher-->>User: fail startup check
  else no picker
    ManagedLauncher-->>User: start TUI with configured model
  end

Loading

Suggested labels: area: inference, bug-fix

Suggested reviewers: jyaunches

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The default-model wiring and onboarding suppression directly satisfy #6410 by starting managed DCode on the configured model without the picker.
Out of Scope Changes check	✅ Passed	The docs, tests, and patch updates all support the same DCode default-model and first-run UX changes; no unrelated scope stands out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: DCode now defaults to Ultra and skips the model picker.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/6410-dcode-managed-model-default

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the fix/6410-dcode-manag... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/6410-dcode-manag... 91aa209	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the fix/6410-dcode-manag... branch is 75%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/6410-dcode-manag... 91aa209	+/-
src/lib/shields...nsition-lock.ts	—	85%	—
src/lib/onboard/preflight.ts	—	83%	—
src/lib/actions...all/run-plan.ts	—	81%	—
src/lib/state/o...oard-session.ts	—	80%	—
src/lib/actions...licy-channel.ts	—	79%	—
src/lib/state/sandbox.ts	—	75%	—
src/lib/onboard...er-gpu-patch.ts	—	69%	—
src/lib/policy/index.ts	—	66%	—
src/lib/shields/index.ts	—	61%	—
src/lib/onboard.ts	—	28%	—

---

_{Updated July 07, 2026 18:08 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-6414.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor (Nemotron Ultra) — Changes requested

Merge posture: Do not merge yet
Primary next action: Fix PRA-1: Verify Dockerfile ARG, manifest default_model, and docs consistency for Nemotron 3 Ultra default; then add or justify PRA-T1.
Open items: 1 required · 5 warnings · 6 suggestions · 8 test follow-ups
Since last review: 0 prior items resolved · 4 still apply · 6 new items found

Action checklist

• PRA-1 Fix: Verify Dockerfile ARG, manifest default_model, and docs consistency for Nemotron 3 Ultra default in multiple
• PRA-2 Resolve or justify: Overlapping PRs feat(dcode): add backend-neutral OTLP observability #6340, fix(dcode): require Landlock enforcement #5812, fix(inference): contain shared gateway route conflicts #6338, docs: add deepagents doc variant #6344, feat(performance): add progressive disclosure tests and compositional routing acceptance #6341 create merge conflicts in multiple
• PRA-3 Resolve or justify: ONBOARDING_PATCH is a localized workaround for missing upstream managed-runtime hook in agents/langchain-deepagents-code/patch-managed-deepagents-code.py:868
• PRA-4 Resolve or justify: TUI startup check now fails (exit 24) on first-run model picker instead of skipping — behavior change in test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh:95
• PRA-5 Resolve or justify: Monolith growth in setup-nim-flow.test.ts — consider extracting DCode-specific test helpers in src/lib/onboard/setup-nim-flow.test.ts:57
• PRA-6 Resolve or justify: Manifest default_model validation uses isSafeModelId regex — verify it covers all valid model ID formats in src/lib/agent/manifest-readers.ts:205
• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation
• PRA-T3 Add or justify test follow-up: Runtime validation
• PRA-T4 Add or justify test follow-up: Runtime validation
• PRA-T5 Add or justify test follow-up: Runtime validation
• PRA-T6 Add or justify test follow-up: Add isSafeModelId edge-case tests for all provider catalog model ID formats
• PRA-T7 Add or justify test follow-up: Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched)
• PRA-T8 Add or justify test follow-up: Add consistency test for Dockerfile ARG, manifest default_model, and docs
• PRA-7 In-scope improvement: Add isSafeModelId edge-case tests for all provider catalog model ID formats in src/lib/validation.ts:189
• PRA-8 In-scope improvement: Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched) in test/deepagents-code-tui-startup-check.test.ts
• PRA-9 In-scope improvement: Add consistency test for Dockerfile ARG, manifest default_model, and docs in test/langchain-deepagents-code-image.test.ts
• PRA-10 In-scope improvement: Add explicit idempotence test for patch-managed-deepagents-code.py in agents/langchain-deepagents-code/patch-managed-deepagents-code.py:1150
• PRA-11 In-scope improvement: Provider status table inconsistent with DCode-specific default in docs/inference/inference-options.mdx:40
• PRA-12 In-scope improvement: Default model resolution order should be documented in src/lib/onboard/nvidia-featured-model-selection.ts:20

Findings index

ID	Severity	Category	Location	Required action
PRA-1	Required	acceptance	multiple	Run grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ to confirm all four locations match. Add a consistency test in a follow-up.
PRA-2	Resolve/justify	workflow	multiple	Coordinate with authors. Suggested rebase order: #6410 (this PR, establishes agent default model schema) → #6340 (adds observability) → #5812 (adds Landlock). Check GitHub PR UI for conflict indicators.
PRA-3	Resolve/justify	correctness	agents/langchain-deepagents-code/patch-managed-deepagents-code.py:868	Track upstream deepagents-code releases for a proper managed-runtime hook. When available, replace this patch. Ensure direct-module test continues to gate the behavior.
PRA-4	Resolve/justify	correctness	test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh:95	Verify this aligns with intended managed DCode behavior: the patched onboarding.py should prevent ANY first-run screen. Run TUI check against patched sandbox (expect exit 0) and unpatched upstream (expect exit 24).
PRA-5	Resolve/justify	architecture	src/lib/onboard/setup-nim-flow.test.ts:57	Extract createNvidiaFeaturedModelSession mocking and DCode agent fixture into a test helper module (e.g., test/support/dcode-onboarding-fixtures.ts). Keep setup-nim-flow.test.ts focused on core provider selection flow.
PRA-6	Resolve/justify	security	src/lib/agent/manifest-readers.ts:205	Confirm regex adequacy against NVIDIA Build (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), etc. If any provider uses characters outside this set, extend regex or add provider-specific validation.
PRA-7	Improvement	tests	src/lib/validation.ts:189	Add tests in src/lib/validation.test.ts covering NVIDIA (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), and any edge cases with colons, dots, slashes, dashes.
PRA-8	Improvement	tests	test/deepagents-code-tui-startup-check.test.ts	Add a CI job or local integration test that runs 10-deepagents-code-tui-startup.sh against a patched DCode sandbox (expect exit 0) and verifies the full Expect interaction.
PRA-9	Improvement	tests	test/langchain-deepagents-code-image.test.ts	Add a test that parses Dockerfile ARG NEMOCLAW_MODEL, manifest.yaml inference.default_model, and greps both doc files, asserting all four match.
PRA-10	Improvement	tests	agents/langchain-deepagents-code/patch-managed-deepagents-code.py:1150	Add a test that runs patch-managed-deepagents-code.py on a fixture, then runs it again, and verifies the package is unchanged and all markers present.
PRA-11	Improvement	docs	docs/inference/inference-options.mdx:40	Update the provider status table to clarify that Nemotron 3 Super is the shared default for OpenClaw and Hermes, while DCode uses Ultra.
PRA-12	Improvement	correctness	src/lib/onboard/nvidia-featured-model-selection.ts:20	Add a comment clarifying the priority order: requested > recovered > env > agent default > shared default.

🚨 Required before merge

Address these before merging unless a maintainer explicitly overrides the advisor with rationale.

PRA-1 Required — Verify Dockerfile ARG, manifest default_model, and docs consistency for Nemotron 3 Ultra default

• Location: multiple
• Category: acceptance
• Problem: Three sources must agree on DCode default model: Dockerfile ARG NEMOCLAW_MODEL, manifest.yaml inference.default_model, and docs (quickstart.mdx, inference-options.mdx). All currently show nvidia/nemotron-3-ultra-550b-a55b but overlapping PRs may create drift.
• Impact: If any source diverges, users see conflicting defaults and onboarding may select wrong model
• Required action: Run grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ to confirm all four locations match. Add a consistency test in a follow-up.
• Expected follow-up: Fix before merge or get explicit maintainer override.
• Verification: grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ && echo 'All 4 locations present'
• Missing regression test: Add a test that asserts Dockerfile ARG, manifest default_model, quickstart.mdx, and inference-options.mdx all reference the same model ID
• Done when: The required change is committed and verification passes: grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ && echo 'All 4 locations present'.
• Evidence: Diff shows all three changed to Ultra: Dockerfile:12, manifest.yaml:64, quickstart.mdx:24-25, inference-options.mdx:40-41

Review findings by urgency: 1 required fix, 5 items to resolve/justify, 6 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-2 Resolve/justify — Overlapping PRs #6340, #5812, #6338, #6344, #6341 create merge conflicts

• Location: multiple
• Category: workflow
• Problem: PR feat(dcode): add backend-neutral OTLP observability #6340 (OTLP observability) touches Dockerfile, patch-managed-deepagents-code.py, quickstart, direct-module-patch test. PR fix(dcode): require Landlock enforcement #5812 (Landlock) touches manifest.yaml and agent defs. PR fix(inference): contain shared gateway route conflicts #6338 (gateway route conflicts) touches setup-nim-flow. PR docs: add deepagents doc variant #6344 (doc variant) touches same docs. PR feat(performance): add progressive disclosure tests and compositional routing acceptance #6341 (progressive disclosure tests) touches Dockerfile.
• Impact: Merge conflicts will block integration; rebasing order matters
• Recommended action: Coordinate with authors. Suggested rebase order: [Brev][DCode] Interactive TUI shows model picker despite managed config.toml having default model set #6410 (this PR, establishes agent default model schema) → feat(dcode): add backend-neutral OTLP observability #6340 (adds observability) → fix(dcode): require Landlock enforcement #5812 (adds Landlock). Check GitHub PR UI for conflict indicators.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Check GitHub PR UI for merge conflict indicators on each overlapping PR number
• Missing regression test: N/A - process coordination required
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Check GitHub PR UI for merge conflict indicators on each overlapping PR number.
• Evidence: driftEvidence.openPrOverlaps lists 5 PRs with sameFiles overlaps

PRA-3 Resolve/justify — ONBOARDING_PATCH is a localized workaround for missing upstream managed-runtime hook

• Location: agents/langchain-deepagents-code/patch-managed-deepagents-code.py:868
• Category: correctness
• Problem: Patch adds should_run_onboarding() returning false to skip upstream first-run onboarding/model picker. Source-of-truth review comment acknowledges upstream 0.1.30 lacks a single managed-runtime hook. Valid workaround but creates maintenance burden.
• Impact: Future upstream releases may break the patch; AST symbol gates will fail image build on drift
• Recommended action: Track upstream deepagents-code releases for a proper managed-runtime hook. When available, replace this patch. Ensure direct-module test continues to gate the behavior.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Check test/langchain-deepagents-code-direct-module-patch.test.ts line 683 for the should_run_onboarding() test that verifies it returns False
• Missing regression test: Existing test at direct-module-patch.test.ts:683 covers this; verify it runs in CI
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Check test/langchain-deepagents-code-direct-module-patch.test.ts line 683 for the should_run_onboarding() test that verifies it returns False.
• Evidence: patch-managed-deepagents-code.py:868-873 defines ONBOARDING_PATCH; direct-module-patch.test.ts:683 executes patched function

PRA-4 Resolve/justify — TUI startup check now fails (exit 24) on first-run model picker instead of skipping — behavior change

• Location: test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh:95
• Category: correctness
• Problem: Previously the Expect script skipped the onboarding name screen (send Escape) and continued to readiness. Now it treats 'Choose a Recommended Model' as a hard failure (exit 24). This is defense-in-depth ensuring the managed patch fully suppresses first-run screens.
• Impact: If the ONBOARDING_PATCH is incomplete (e.g., model picker appears before onboarding suppression), the sandbox fails visibly rather than silently allowing unmanaged model selection
• Recommended action: Verify this aligns with intended managed DCode behavior: the patched onboarding.py should prevent ANY first-run screen. Run TUI check against patched sandbox (expect exit 0) and unpatched upstream (expect exit 24).
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Run the TUI startup check against a patched DCode sandbox and verify exit 0; run against unpatched upstream and verify exit 24
• Missing regression test: Add a CI job or local integration test that runs 10-deepagents-code-tui-startup.sh against a patched DCode sandbox (expect exit 0) and verifies the full Expect interaction
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Run the TUI startup check against a patched DCode sandbox and verify exit 0; run against unpatched upstream and verify exit 24.
• Evidence: TUI_FIRST_RUN_PATTERN now includes 'choose a recommended model'; Expect script exits 24 on first_run match

PRA-5 Resolve/justify — Monolith growth in setup-nim-flow.test.ts — consider extracting DCode-specific test helpers

• Location: src/lib/onboard/setup-nim-flow.test.ts:57
• Category: architecture
• Problem: Monolith growth in setup-nim-flow.test.ts (+27 lines in previous review, +31 lines now) — consider extracting DCode-specific test helpers.
• Impact: Test file becoming harder to maintain; DCode fixtures mixed with core provider selection flow tests
• Recommended action: Extract createNvidiaFeaturedModelSession mocking and DCode agent fixture into a test helper module (e.g., test/support/dcode-onboarding-fixtures.ts). Keep setup-nim-flow.test.ts focused on core provider selection flow.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Review test file length and identify extractable fixtures
• Missing regression test: N/A - architecture improvement
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Review test file length and identify extractable fixtures.
• Evidence: setup-nim-flow.test.ts grew from 418 to 449 lines; new test 'passes the Deep Agents manifest default to NVIDIA model selection' adds DCode-specific fixture inline

PRA-6 Resolve/justify — Manifest default_model validation uses isSafeModelId regex — verify it covers all valid model ID formats

• Location: src/lib/agent/manifest-readers.ts:205
• Category: security
• Problem: Manifest default_model validation uses isSafeModelId regex /^[A-Za-z0-9._:/-]+$/ — verify it covers all valid model ID formats from NVIDIA Build, OpenRouter, and other provider catalogs.
• Impact: If any provider uses characters outside this set (e.g., '@', '+', '=', ':'), valid model IDs will be rejected at manifest load
• Recommended action: Confirm regex adequacy against NVIDIA Build (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), etc. If any provider uses characters outside this set, extend regex or add provider-specific validation.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Test isSafeModelId against known provider model ID formats: nvidia/nemotron-3-ultra-550b-a55b, gpt-5.4, claude-sonnet-4-6, gemini-3.1-pro-preview, openrouter/auto, anthropic.claude-3-sonnet
• Missing regression test: Create src/lib/validation.test.ts with test cases for each provider's model ID format
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Test isSafeModelId against known provider model ID formats: nvidia/nemotron-3-ultra-550b-a55b, gpt-5.4, claude-sonnet-4-6, gemini-3.1-pro-preview, openrouter/auto, anthropic.claude-3-sonnet.
• Evidence: manifest-readers.ts:205 validates default_model via isSafeModelId(defaultModel.trim())

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-7 Improvement — Add isSafeModelId edge-case tests for all provider catalog model ID formats

• Location: src/lib/validation.ts:189
• Category: tests
• Problem: isSafeModelId edge-case tests missing for all provider catalog model ID formats.
• Impact: Regression risk if regex is tightened or provider adds new model ID format; no test coverage for valid formats
• Suggested action: Add tests in src/lib/validation.test.ts covering NVIDIA (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), and any edge cases with colons, dots, slashes, dashes.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check if src/lib/validation.test.ts exists and has isSafeModelId tests
• Missing regression test: Create src/lib/validation.test.ts with test cases for each provider's model ID format
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: validation.ts:189 exports isSafeModelId with regex /^[A-Za-z0-9._:/-]+$/; no test file exists

PRA-8 Improvement — Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched)

• Location: test/deepagents-code-tui-startup-check.test.ts
• Category: tests
• Problem: No real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched).
• Impact: Unit tests mock the Expect interaction but don't prove real sandbox behavior; regression could slip through if patch is incomplete
• Suggested action: Add a CI job or local integration test that runs 10-deepagents-code-tui-startup.sh against a patched DCode sandbox (expect exit 0) and verifies the full Expect interaction.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check if any CI job runs the TUI startup check against a real sandbox
• Missing regression test: Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched)
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: testDepth verdict is runtime_validation_recommended for Dockerfile, manifest, patcher, config.ts changes

PRA-9 Improvement — Add consistency test for Dockerfile ARG, manifest default_model, and docs

• Location: test/langchain-deepagents-code-image.test.ts
• Category: tests
• Problem: No consistency test for Dockerfile ARG, manifest default_model, and docs.
• Impact: Drift between the four sources won't be caught automatically; manual verification required
• Suggested action: Add a test that parses Dockerfile ARG NEMOCLAW_MODEL, manifest.yaml inference.default_model, and greps both doc files, asserting all four match.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check test/langchain-deepagents-code-image.test.ts for consistency test
• Missing regression test: Add consistency test for Dockerfile ARG, manifest default_model, and docs
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: test/langchain-deepagents-code-image.test.ts exists but no consistency test found in diff

PRA-10 Improvement — Add explicit idempotence test for patch-managed-deepagents-code.py

• Location: agents/langchain-deepagents-code/patch-managed-deepagents-code.py:1150
• Category: tests
• Problem: No explicit idempotence test for patch-managed-deepagents-code.py.
• Impact: Re-running patcher on already-patched package could silently corrupt or leave partial state
• Suggested action: Add a test that runs patch-managed-deepagents-code.py on a fixture, then runs it again, and verifies the package is unchanged and all markers present.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check direct-module-patch.test.ts for idempotence test (it does have one at line 1150 area)
• Missing regression test: Verify existing idempotence test covers re-running patcher on already-patched package
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: direct-module-patch.test.ts has 'patches every 0.1.30 mutation and credential boundary idempotently' test that runs patchFixture twice

PRA-11 Improvement — Provider status table inconsistent with DCode-specific default

• Location: docs/inference/inference-options.mdx:40
• Category: docs
• Problem: Documentation now states 'LangChain Deep Agents Code uses Nemotron 3 Ultra as its NVIDIA Endpoints default' but the provider status table still says 'Nemotron 3 Super remains the default when it is present' — potential inconsistency.
• Impact: Users reading the provider status table may think Nemotron 3 Super is still the default for DCode
• Suggested action: Update the provider status table to clarify that Nemotron 3 Super is the shared default for OpenClaw and Hermes, while DCode uses Ultra.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read docs/inference/inference-options.mdx lines 40-45 and the provider status table
• Missing regression test: N/A - documentation consistency
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: inference-options.mdx line 40: 'LangChain Deep Agents Code uses Nemotron 3 Ultra as its NVIDIA Endpoints default'; provider status table line ~25: 'Nemotron 3 Super remains the default when it is present'

PRA-12 Improvement — Default model resolution order should be documented

• Location: src/lib/onboard/nvidia-featured-model-selection.ts:20
• Category: correctness
• Problem: Default model resolution order: requestedModel → recoveredModel → envModel → defaultModel. The test shows agent default is used for both interactive and non-interactive, but envModel takes precedence over agent default in non-interactive mode. This seems correct but should be documented.
• Impact: Future maintainers may misunderstand precedence and introduce bugs
• Suggested action: Add a comment clarifying the priority order: requested > recovered > env > agent default > shared default.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read nvidia-featured-model-selection.ts select() method
• Missing regression test: N/A - code clarity
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: select() method: if (requestedModel) return requestedModel; if (recoveredModel) return recoveredModel; const configuredModel = envModel?.trim(); if (nonInteractive) return configuredModel || defaultModel;

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Add src/lib/validation.test.ts with isSafeModelId edge cases for all provider model ID formats. Runtime/sandbox/infrastructure paths need behavioral runtime validation: Dockerfile, manifest.yaml, patch-managed-deepagents-code.py, docs, definition-types.ts, manifest-readers.ts, config.ts.
• PRA-T2 Runtime validation — Add real sandbox integration test running TUI startup check against patched DCode sandbox (expect exit 0) and unpatched upstream (expect exit 24). Runtime/sandbox/infrastructure paths need behavioral runtime validation: Dockerfile, manifest.yaml, patch-managed-deepagents-code.py, docs, definition-types.ts, manifest-readers.ts, config.ts.
• PRA-T3 Runtime validation — Add consistency test asserting Dockerfile ARG, manifest default_model, quickstart.mdx, and inference-options.mdx all reference the same model ID. Runtime/sandbox/infrastructure paths need behavioral runtime validation: Dockerfile, manifest.yaml, patch-managed-deepagents-code.py, docs, definition-types.ts, manifest-readers.ts, config.ts.
• PRA-T4 Runtime validation — Add resolveAgentDefaultCloudModel test for invalid/unsafe manifest default_model falling back to shared default. Runtime/sandbox/infrastructure paths need behavioral runtime validation: Dockerfile, manifest.yaml, patch-managed-deepagents-code.py, docs, definition-types.ts, manifest-readers.ts, config.ts.
• PRA-T5 Runtime validation — Verify existing patch idempotence test covers re-running patcher on already-patched package. Runtime/sandbox/infrastructure paths need behavioral runtime validation: Dockerfile, manifest.yaml, patch-managed-deepagents-code.py, docs, definition-types.ts, manifest-readers.ts, config.ts.
• PRA-T6 Add isSafeModelId edge-case tests for all provider catalog model ID formats — Add tests in src/lib/validation.test.ts covering NVIDIA (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), and any edge cases with colons, dots, slashes, dashes.
• PRA-T7 Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched) — Add a CI job or local integration test that runs 10-deepagents-code-tui-startup.sh against a patched DCode sandbox (expect exit 0) and verifies the full Expect interaction.
• PRA-T8 Add consistency test for Dockerfile ARG, manifest default_model, and docs — Add a test that parses Dockerfile ARG NEMOCLAW_MODEL, manifest.yaml inference.default_model, and greps both doc files, asserting all four match.

Since last review details

Current findings, using the urgency labels above:

PRA-1 Required — Verify Dockerfile ARG, manifest default_model, and docs consistency for Nemotron 3 Ultra default

• Location: multiple
• Category: acceptance
• Problem: Three sources must agree on DCode default model: Dockerfile ARG NEMOCLAW_MODEL, manifest.yaml inference.default_model, and docs (quickstart.mdx, inference-options.mdx). All currently show nvidia/nemotron-3-ultra-550b-a55b but overlapping PRs may create drift.
• Impact: If any source diverges, users see conflicting defaults and onboarding may select wrong model
• Required action: Run grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ to confirm all four locations match. Add a consistency test in a follow-up.
• Expected follow-up: Fix before merge or get explicit maintainer override.
• Verification: grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ && echo 'All 4 locations present'
• Missing regression test: Add a test that asserts Dockerfile ARG, manifest default_model, quickstart.mdx, and inference-options.mdx all reference the same model ID
• Done when: The required change is committed and verification passes: grep -r 'nemotron-3-ultra-550b-a55b' agents/langchain-deepagents-code/ docs/ && echo 'All 4 locations present'.
• Evidence: Diff shows all three changed to Ultra: Dockerfile:12, manifest.yaml:64, quickstart.mdx:24-25, inference-options.mdx:40-41

PRA-2 Resolve/justify — Overlapping PRs #6340, #5812, #6338, #6344, #6341 create merge conflicts

• Location: multiple
• Category: workflow
• Problem: PR feat(dcode): add backend-neutral OTLP observability #6340 (OTLP observability) touches Dockerfile, patch-managed-deepagents-code.py, quickstart, direct-module-patch test. PR fix(dcode): require Landlock enforcement #5812 (Landlock) touches manifest.yaml and agent defs. PR fix(inference): contain shared gateway route conflicts #6338 (gateway route conflicts) touches setup-nim-flow. PR docs: add deepagents doc variant #6344 (doc variant) touches same docs. PR feat(performance): add progressive disclosure tests and compositional routing acceptance #6341 (progressive disclosure tests) touches Dockerfile.
• Impact: Merge conflicts will block integration; rebasing order matters
• Recommended action: Coordinate with authors. Suggested rebase order: [Brev][DCode] Interactive TUI shows model picker despite managed config.toml having default model set #6410 (this PR, establishes agent default model schema) → feat(dcode): add backend-neutral OTLP observability #6340 (adds observability) → fix(dcode): require Landlock enforcement #5812 (adds Landlock). Check GitHub PR UI for conflict indicators.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Check GitHub PR UI for merge conflict indicators on each overlapping PR number
• Missing regression test: N/A - process coordination required
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Check GitHub PR UI for merge conflict indicators on each overlapping PR number.
• Evidence: driftEvidence.openPrOverlaps lists 5 PRs with sameFiles overlaps

PRA-3 Resolve/justify — ONBOARDING_PATCH is a localized workaround for missing upstream managed-runtime hook

• Location: agents/langchain-deepagents-code/patch-managed-deepagents-code.py:868
• Category: correctness
• Problem: Patch adds should_run_onboarding() returning false to skip upstream first-run onboarding/model picker. Source-of-truth review comment acknowledges upstream 0.1.30 lacks a single managed-runtime hook. Valid workaround but creates maintenance burden.
• Impact: Future upstream releases may break the patch; AST symbol gates will fail image build on drift
• Recommended action: Track upstream deepagents-code releases for a proper managed-runtime hook. When available, replace this patch. Ensure direct-module test continues to gate the behavior.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Check test/langchain-deepagents-code-direct-module-patch.test.ts line 683 for the should_run_onboarding() test that verifies it returns False
• Missing regression test: Existing test at direct-module-patch.test.ts:683 covers this; verify it runs in CI
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Check test/langchain-deepagents-code-direct-module-patch.test.ts line 683 for the should_run_onboarding() test that verifies it returns False.
• Evidence: patch-managed-deepagents-code.py:868-873 defines ONBOARDING_PATCH; direct-module-patch.test.ts:683 executes patched function

PRA-4 Resolve/justify — TUI startup check now fails (exit 24) on first-run model picker instead of skipping — behavior change

• Location: test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh:95
• Category: correctness
• Problem: Previously the Expect script skipped the onboarding name screen (send Escape) and continued to readiness. Now it treats 'Choose a Recommended Model' as a hard failure (exit 24). This is defense-in-depth ensuring the managed patch fully suppresses first-run screens.
• Impact: If the ONBOARDING_PATCH is incomplete (e.g., model picker appears before onboarding suppression), the sandbox fails visibly rather than silently allowing unmanaged model selection
• Recommended action: Verify this aligns with intended managed DCode behavior: the patched onboarding.py should prevent ANY first-run screen. Run TUI check against patched sandbox (expect exit 0) and unpatched upstream (expect exit 24).
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Run the TUI startup check against a patched DCode sandbox and verify exit 0; run against unpatched upstream and verify exit 24
• Missing regression test: Add a CI job or local integration test that runs 10-deepagents-code-tui-startup.sh against a patched DCode sandbox (expect exit 0) and verifies the full Expect interaction
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Run the TUI startup check against a patched DCode sandbox and verify exit 0; run against unpatched upstream and verify exit 24.
• Evidence: TUI_FIRST_RUN_PATTERN now includes 'choose a recommended model'; Expect script exits 24 on first_run match

PRA-5 Resolve/justify — Monolith growth in setup-nim-flow.test.ts — consider extracting DCode-specific test helpers

• Location: src/lib/onboard/setup-nim-flow.test.ts:57
• Category: architecture
• Problem: Monolith growth in setup-nim-flow.test.ts (+27 lines in previous review, +31 lines now) — consider extracting DCode-specific test helpers.
• Impact: Test file becoming harder to maintain; DCode fixtures mixed with core provider selection flow tests
• Recommended action: Extract createNvidiaFeaturedModelSession mocking and DCode agent fixture into a test helper module (e.g., test/support/dcode-onboarding-fixtures.ts). Keep setup-nim-flow.test.ts focused on core provider selection flow.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Review test file length and identify extractable fixtures
• Missing regression test: N/A - architecture improvement
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Review test file length and identify extractable fixtures.
• Evidence: setup-nim-flow.test.ts grew from 418 to 449 lines; new test 'passes the Deep Agents manifest default to NVIDIA model selection' adds DCode-specific fixture inline

PRA-6 Resolve/justify — Manifest default_model validation uses isSafeModelId regex — verify it covers all valid model ID formats

• Location: src/lib/agent/manifest-readers.ts:205
• Category: security
• Problem: Manifest default_model validation uses isSafeModelId regex /^[A-Za-z0-9._:/-]+$/ — verify it covers all valid model ID formats from NVIDIA Build, OpenRouter, and other provider catalogs.
• Impact: If any provider uses characters outside this set (e.g., '@', '+', '=', ':'), valid model IDs will be rejected at manifest load
• Recommended action: Confirm regex adequacy against NVIDIA Build (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), etc. If any provider uses characters outside this set, extend regex or add provider-specific validation.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Test isSafeModelId against known provider model ID formats: nvidia/nemotron-3-ultra-550b-a55b, gpt-5.4, claude-sonnet-4-6, gemini-3.1-pro-preview, openrouter/auto, anthropic.claude-3-sonnet
• Missing regression test: Create src/lib/validation.test.ts with test cases for each provider's model ID format
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Test isSafeModelId against known provider model ID formats: nvidia/nemotron-3-ultra-550b-a55b, gpt-5.4, claude-sonnet-4-6, gemini-3.1-pro-preview, openrouter/auto, anthropic.claude-3-sonnet.
• Evidence: manifest-readers.ts:205 validates default_model via isSafeModelId(defaultModel.trim())

PRA-7 Improvement — Add isSafeModelId edge-case tests for all provider catalog model ID formats

• Location: src/lib/validation.ts:189
• Category: tests
• Problem: isSafeModelId edge-case tests missing for all provider catalog model ID formats.
• Impact: Regression risk if regex is tightened or provider adds new model ID format; no test coverage for valid formats
• Suggested action: Add tests in src/lib/validation.test.ts covering NVIDIA (nvidia/nemotron-3-ultra-550b-a55b), OpenAI (gpt-5.4), Anthropic (claude-sonnet-4-6), Google (gemini-3.1-pro-preview), OpenRouter (openrouter/auto), Bedrock (anthropic.claude-3-sonnet), and any edge cases with colons, dots, slashes, dashes.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check if src/lib/validation.test.ts exists and has isSafeModelId tests
• Missing regression test: Create src/lib/validation.test.ts with test cases for each provider's model ID format
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: validation.ts:189 exports isSafeModelId with regex /^[A-Za-z0-9._:/-]+$/; no test file exists

PRA-8 Improvement — Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched)

• Location: test/deepagents-code-tui-startup-check.test.ts
• Category: tests
• Problem: No real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched).
• Impact: Unit tests mock the Expect interaction but don't prove real sandbox behavior; regression could slip through if patch is incomplete
• Suggested action: Add a CI job or local integration test that runs 10-deepagents-code-tui-startup.sh against a patched DCode sandbox (expect exit 0) and verifies the full Expect interaction.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check if any CI job runs the TUI startup check against a real sandbox
• Missing regression test: Add real sandbox integration test for TUI startup check (exit 0 on patched, exit 24 on unpatched)
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: testDepth verdict is runtime_validation_recommended for Dockerfile, manifest, patcher, config.ts changes

PRA-9 Improvement — Add consistency test for Dockerfile ARG, manifest default_model, and docs

• Location: test/langchain-deepagents-code-image.test.ts
• Category: tests
• Problem: No consistency test for Dockerfile ARG, manifest default_model, and docs.
• Impact: Drift between the four sources won't be caught automatically; manual verification required
• Suggested action: Add a test that parses Dockerfile ARG NEMOCLAW_MODEL, manifest.yaml inference.default_model, and greps both doc files, asserting all four match.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check test/langchain-deepagents-code-image.test.ts for consistency test
• Missing regression test: Add consistency test for Dockerfile ARG, manifest default_model, and docs
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: test/langchain-deepagents-code-image.test.ts exists but no consistency test found in diff

PRA-10 Improvement — Add explicit idempotence test for patch-managed-deepagents-code.py

• Location: agents/langchain-deepagents-code/patch-managed-deepagents-code.py:1150
• Category: tests
• Problem: No explicit idempotence test for patch-managed-deepagents-code.py.
• Impact: Re-running patcher on already-patched package could silently corrupt or leave partial state
• Suggested action: Add a test that runs patch-managed-deepagents-code.py on a fixture, then runs it again, and verifies the package is unchanged and all markers present.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check direct-module-patch.test.ts for idempotence test (it does have one at line 1150 area)
• Missing regression test: Verify existing idempotence test covers re-running patcher on already-patched package
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: direct-module-patch.test.ts has 'patches every 0.1.30 mutation and credential boundary idempotently' test that runs patchFixture twice

PRA-11 Improvement — Provider status table inconsistent with DCode-specific default

• Location: docs/inference/inference-options.mdx:40
• Category: docs
• Problem: Documentation now states 'LangChain Deep Agents Code uses Nemotron 3 Ultra as its NVIDIA Endpoints default' but the provider status table still says 'Nemotron 3 Super remains the default when it is present' — potential inconsistency.
• Impact: Users reading the provider status table may think Nemotron 3 Super is still the default for DCode
• Suggested action: Update the provider status table to clarify that Nemotron 3 Super is the shared default for OpenClaw and Hermes, while DCode uses Ultra.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read docs/inference/inference-options.mdx lines 40-45 and the provider status table
• Missing regression test: N/A - documentation consistency
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: inference-options.mdx line 40: 'LangChain Deep Agents Code uses Nemotron 3 Ultra as its NVIDIA Endpoints default'; provider status table line ~25: 'Nemotron 3 Super remains the default when it is present'

PRA-12 Improvement — Default model resolution order should be documented

• Location: src/lib/onboard/nvidia-featured-model-selection.ts:20
• Category: correctness
• Problem: Default model resolution order: requestedModel → recoveredModel → envModel → defaultModel. The test shows agent default is used for both interactive and non-interactive, but envModel takes precedence over agent default in non-interactive mode. This seems correct but should be documented.
• Impact: Future maintainers may misunderstand precedence and introduce bugs
• Suggested action: Add a comment clarifying the priority order: requested > recovered > env > agent default > shared default.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read nvidia-featured-model-selection.ts select() method
• Missing regression test: N/A - code clarity
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: select() method: if (requestedModel) return requestedModel; if (recoveredModel) return recoveredModel; const configuredModel = envModel?.trim(); if (nonInteractive) return configuredModel || defaultModel;

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 3 test follow-ups
Since last review: 0 prior items resolved · 3 still apply · 0 new items found

Action checklist

• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation
• PRA-T3 Add or justify test follow-up: Runtime validation

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Build a DCode sandbox image from this patch and run interactive `dcode` in a PTY; assert it reaches a prompt-shaped ready state without matching `Your name (optional)`, `What should Deep Agents call you`, or `Choose a Recommended Model`.. Static and unit coverage is targeted and substantial, but the highest-risk behavior crosses Docker image construction, a patched third-party Python wheel, generated DCode config, OpenShell sandbox launch, and a real PTY TUI startup path. This keeps the prior runtime-validation follow-ups relevant even though no code finding is open.
• PRA-T2 Runtime validation — In the same built DCode image, run `dcode -n "prompt"` and `dcode --version`; assert both go through the managed launcher and read the generated NemoClaw config/managed inference route.. Static and unit coverage is targeted and substantial, but the highest-risk behavior crosses Docker image construction, a patched third-party Python wheel, generated DCode config, OpenShell sandbox launch, and a real PTY TUI startup path. This keeps the prior runtime-validation follow-ups relevant even though no code finding is open.
• PRA-T3 Runtime validation — Run fresh non-interactive NVIDIA Endpoints onboarding for DCode and for an agent without an agent-specific default; assert DCode records `nvidia/nemotron-3-ultra-550b-a55b` while OpenClaw or Hermes retain `nvidia/nemotron-3-super-120b-a12b`.. Static and unit coverage is targeted and substantial, but the highest-risk behavior crosses Docker image construction, a patched third-party Python wheel, generated DCode config, OpenShell sandbox launch, and a real PTY TUI startup path. This keeps the prior runtime-validation follow-ups relevant even though no code finding is open.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[github-actions]

E2E Advisor Recommendation

Required E2E: ubuntu-repo-cloud-langchain-deepagents-code, cloud-onboard, inference-routing
Optional E2E: onboard-resume, onboard-repair

Dispatch hint: jobs=cloud-onboard,inference-routing targets=ubuntu-repo-cloud-langchain-deepagents-code

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• ubuntu-repo-cloud-langchain-deepagents-code (high): Required because Deep Agents Code image, manifest inference defaults, managed upstream patching, and TUI startup checks changed. This live registry target exercises real hosted Deep Agents Code onboarding and the cloud-experimental Deep Agents checks, including fresh re-onboard, headless inference, secret boundary, Tavily opt-in, and the changed TUI startup script.
• cloud-onboard (high): Required because setup-nim and NVIDIA featured model selection changes can affect full hosted onboarding. This validates the public installer and hosted cloud onboarding path still creates a healthy sandbox with the expected security checks.
• inference-routing (medium): Required because src/lib/inference/config.ts and agent manifest inference parsing changed. This gives live confidence that inference.local routing remains functional after the new agent-specific cloud model default resolution.

Optional E2E

• onboard-resume (medium): Optional adjacent confidence: setup-nim model precedence now considers requested, recovered, environment, and agent defaults. The PR does not touch src/lib/onboard/machine resume orchestration, so the onboarding resume rule does not make this mandatory.
• onboard-repair (medium): Optional adjacent confidence for repair/recreate paths that may pass through provider selection, but the changed files are not the machine live-slice resume/repair state-machine code that would require this job.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/e2e.yaml
• jobs input: jobs=cloud-onboard,inference-routing targets=ubuntu-repo-cloud-langchain-deepagents-code

[github-actions]

E2E Target Recommendation

Required E2E targets: ubuntu-repo-cloud-langchain-deepagents-code
Optional E2E targets: ubuntu-repo-cloud-openclaw

Dispatch required E2E targets:

• gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-langchain-deepagents-code

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

• ubuntu-repo-cloud-langchain-deepagents-code: Changes affect the LangChain Deep Agents Code image, manifest inference default, upstream first-run onboarding patch, NVIDIA model selection during onboarding, and the Deep Agents Code TUI startup E2E check. This live-supported typed target onboards the Deep Agents Code agent with NVIDIA hosted inference and runs the registry target plus the deepagents cloud-experimental check scripts, including the changed TUI startup check.
  • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-langchain-deepagents-code

Optional E2E targets

• ubuntu-repo-cloud-openclaw: Optional guard for the shared NVIDIA onboarding/default-model path touched by the inference and setup-nim changes, verifying OpenClaw still uses the shared Nemotron 3 Super default while the Deep Agents Code target covers the agent-specific default.
  • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-openclaw

Relevant changed files

• agents/langchain-deepagents-code/Dockerfile
• agents/langchain-deepagents-code/manifest.yaml
• agents/langchain-deepagents-code/patch-managed-deepagents-code.py
• src/lib/agent/definition-types.ts
• src/lib/agent/manifest-readers.ts
• src/lib/inference/config.ts
• src/lib/onboard/nvidia-featured-model-selection.ts
• src/lib/onboard/setup-nim-flow.ts
• test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/get-started/quickstart-langchain-deepagents-code.mdx`:
- Line 199: The UI label in the quickstart docs is written as plain text instead
of inline code formatting. Update the affected sentence in the MDX content to
wrap the literal label in backticks, using the same formatting style already
used for other UI text in docs; locate it by the phrase “Choose a Recommended
Model”.

In `@src/lib/onboard/setup-nim-flow.test.ts`:
- Around line 137-163: The NVIDIA catalog session setup in setupNimFlow is not
using the injected onboarding logger, so the featured-model banner can bypass
the intended output path. Update the createNvidiaFeaturedModelSession call in
setupNimFlow to pass the deps.log handler as writeLine, and adjust this test
around createNvidiaFeaturedModelSession to expect the full options object
including defaultModel and writeLine.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 06f06c34-4779-4a32-a973-942682f21ab8

📥 Commits

Reviewing files that changed from the base of the PR and between 6fa6f4b and b8abb1c.

📒 Files selected for processing (19)

• agents/langchain-deepagents-code/Dockerfile
• agents/langchain-deepagents-code/manifest.yaml
• agents/langchain-deepagents-code/patch-managed-deepagents-code.py
• docs/get-started/quickstart-langchain-deepagents-code.mdx
• docs/inference/inference-options.mdx
• src/lib/agent/definition-types.ts
• src/lib/agent/defs.test.ts
• src/lib/agent/manifest-readers.ts
• src/lib/inference/config.test.ts
• src/lib/inference/config.ts
• src/lib/onboard/nvidia-featured-model-selection.test.ts
• src/lib/onboard/nvidia-featured-model-selection.ts
• src/lib/onboard/setup-nim-flow.test.ts
• src/lib/onboard/setup-nim-flow.ts
• test/deepagents-code-tui-startup-check.test.ts
• test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh
• test/langchain-deepagents-code-direct-module-patch.test.ts
• test/langchain-deepagents-code-image.test.ts
• test/langchain-deepagents-code-progressive-tool-disclosure.test.ts

[wscurran]

✨
Related open issues:

• #6410 [Brev][DCode] Interactive TUI shows model picker despite managed config.toml having default model set

---

Related open issues:

• #6410 [Brev][DCode] Interactive TUI shows model picker despite managed config.toml having default model set

[github-actions]

E2E Target Results — ✅ All selected jobs passed

Run: 28886976151
Workflow ref: fix/6410-dcode-managed-model-default
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
live	✅ success

[github-actions]

E2E Target Results — ✅ All requested jobs passed

Run: 28886978375
Workflow ref: fix/6410-dcode-managed-model-default
Requested targets: (default — all supported)
Requested jobs: cloud-onboard,inference-routing
Summary: 2 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
cloud-onboard	✅ success
inference-routing	✅ success

[github-actions]

E2E Target Results — ✅ All requested jobs passed

Run: 28887469640
Workflow ref: fix/6410-dcode-managed-model-default
Requested targets: (default — all supported)
Requested jobs: cloud-onboard,inference-routing
Summary: 2 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
cloud-onboard	✅ success
inference-routing	✅ success

[github-actions]

E2E Target Results — ❌ Some jobs failed

Run: 28887469560
Workflow ref: fix/6410-dcode-managed-model-default
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job	Result
live	❌ failure

Failed jobs: live. Check run artifacts for logs.

[senthilr-nv]

Validation: DGX Spark (aarch64, NVIDIA GB10) + Brev (x86_64, no GPU)

Tested fresh onboard from branch fix/6410-dcode-managed-model-default on both topologies.

Results

Check	Spark (GPU)	Brev v0.0.75 (before fix)
Model picker suppressed	Pass — no interactive prompt	Fail — name + model picker both appear
Default model = Ultra	Pass — nvidia/nemotron-3-ultra-550b-a55b	N/A — defaults to Super 120B
Provider path	nvidia-prod (with NVIDIA_API_KEY only)	nvidia-prod
Inference works	Pass — answered correctly in 2.3s	N/A
First-run onboarding suppressed	Pass — no name/welcome prompt	Fail — "Welcome to Deep Agents Code" shown

Observation: full first-run onboarding suppressed

The patch suppresses not just the model picker but also the DCode first-run welcome/name prompt. Is that intentional for managed sandboxes, or should only the model selection step be bypassed?

Note on model string

With only NVIDIA_API_KEY (nvapi-...) set, the onboard correctly takes the build / nvidia-prod path → nvidia/nemotron-3-ultra-550b-a55b (matches PR description).

If NVIDIA_INFERENCE_API_KEY (sk-...) is also present, the onboard takes the hosted inference hub path → compatible-endpoint / nvidia/nvidia/nemotron-3-ultra. Both resolve to Ultra but use different model ID conventions (provider/namespace/model for the private hub). This is by-design per the code comment in providers.ts:31-34.

---

Tested on: NemoClaw source @ b8abb1c9c (this branch), deepagents-code 0.1.30, OpenShell 0.0.72

[cv]

Approved exact head 91aa209.

Evidence:

• Attached CI is terminal with 42 successes, 3 expected skips, and no active latest-head failure; superseded cancelled commit-lint and DCO runs each have successful replacements.
• Both commits are GitHub Verified, DCO is present, CodeRabbit is clear, and the primary advisor is merge_as_is with zero required findings.
• Security and correctness audit found the pinned upstream patch fail-closed on version and symbol drift and explicitly idempotent.
• Exact-head live evidence passed: cloud-onboard, inference-routing, and the DCode target. The first DCode attempt had its second inference request time out after a successful login-shell PONG; the failed-job rerun passed.

Nemotron PRA-1 is satisfied by direct verification: Dockerfile, manifest, and both docs agree on Ultra, while OpenClaw and Hermes retain Super, with focused tests covering the resolution path. Its remaining overlap, maintainability, and test-matrix items are sequencing or follow-up suggestions, not current defects; the real DCode target covers the patched TUI and launcher path, and an explicit patch idempotence test already exists.

[github-actions]

E2E Target Results — ✅ All selected jobs passed

Run: 28887469560
Workflow ref: fix/6410-dcode-managed-model-default
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
live	✅ success