fix(e2e): repair release gate regressions

[cv]

Summary

Repairs three deterministic failures found during v0.0.81 release validation. Hermes restart-safe recreation now preserves OpenShell's native CDI GPU attachment, the Slack proof finds the reviewed package in canonical managed npm projects, and the OpenShell auth contract collects under Vitest's fixture parser.

Changes

• Preserve inspected Driver: cdi device IDs as Docker --device arguments during startup-command recreation, without selecting compatibility GPU mode or adding broader privileges.
• Discover @openclaw/slack one level below OpenClaw's managed npm projects only when the project manifest declares that dependency.
• Destructure the live auth-contract fixtures so Vitest 4.1.9 can collect the test while passing the same scenario inputs.
• Add regression coverage for the CDI clone arguments and managed Slack project discovery.
• Note for feat(gpu): prefer native OpenShell with compatibility fallback #6333: that PR moves the Docker clone code into split files but does not yet preserve CDI device requests; whichever PR rebases second must retain this contract.

The two rebuild-hermes-stale-base attempts ended with GitHub's hosted runner losing communication before Vitest exited or uploaded artifacts; the unchanged ordinary rebuild also lost a runner once and passed on retry. Jetson had no runner. Neither result has an evidence-backed repository change in this PR.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this restores existing GPU passthrough and release-proof contracts without changing commands, flags, configuration, defaults, or required user actions.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent diff review confirmed CDI propagation is startup-command-only, adds no broader GPU privileges, and Slack discovery is bounded to one manifest-gated directory level.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 67 Docker clone tests, 24 messaging-proof tests, live auth-contract collection to its intended availability skip, and 653 changed-scope tests passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Preserved native CDI GPU device attachments when recreating Docker containers, preventing GPU access from being lost during startup-command persistence.
  • Improved Slack integration discovery for installations managed through project-specific npm environments.

• Tests

  • Added coverage for CDI GPU preservation and Slack package discovery across valid, unrelated, and malformed project directories.
  • Updated gateway authentication scenarios for more reliable end-to-end validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: eda5c033-18f3-4c21-bff3-6dd1b0a7d227

📥 Commits

Reviewing files that changed from the base of the PR and between 8acb280 and 2ed6df6.

📒 Files selected for processing (5)

• src/lib/onboard/docker-gpu-patch.ts
• src/lib/onboard/docker-startup-command-patch.test.ts
• test/e2e/live/messaging-providers-slack-runtime-proof.ts
• test/e2e/live/openshell-gateway-auth-source-contract.test.ts
• test/e2e/support/messaging-providers-runtime-proofs.test.ts

---

📝 Walkthrough

Walkthrough

Docker startup-command recreation now preserves native CDI GPU requests. Slack runtime proof discovery now scans managed OpenClaw npm projects for Slack packages. A gateway auth contract test passes destructured fixtures explicitly.

Changes

Docker CDI preservation

Layer / File(s)	Summary
Preserve CDI device arguments src/lib/onboard/docker-gpu-patch.ts, src/lib/onboard/docker-startup-command-patch.test.ts	Docker CDI requests are typed and forwarded as deduplicated --device arguments during startup-command recreation, with tests covering CDI and non-GPU cases.

Managed Slack package discovery

Layer / File(s)	Summary
Add managed project discovery test/e2e/live/messaging-providers-slack-runtime-proof.ts	Slack runtime resolution scans managed npm project manifests and registers matching Slack package paths.
Validate managed project candidates test/e2e/support/messaging-providers-runtime-proofs.test.ts	A subprocess test validates discovery across valid, unrelated, and malformed project directories.

Gateway auth test contract

Layer / File(s)	Summary
Pass scenario fixtures explicitly test/e2e/live/openshell-gateway-auth-source-contract.test.ts	The scenario callback destructures fixtures and passes them explicitly to the contract runner.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DockerContainerInspect
  participant buildDockerGpuCloneRunArgs
  participant RecreatedDockerRun
  DockerContainerInspect->>buildDockerGpuCloneRunArgs: provide CDI DeviceRequests
  buildDockerGpuCloneRunArgs->>buildDockerGpuCloneRunArgs: extract DeviceIDs
  buildDockerGpuCloneRunArgs->>RecreatedDockerRun: append --device arguments

Loading

sequenceDiagram
  participant resolveOpenClawSlackApiLocation
  participant addManagedNpmProjectSlackCandidates
  participant ManagedNpmProjectPackageJson
  resolveOpenClawSlackApiLocation->>addManagedNpmProjectSlackCandidates: scan managed projects
  addManagedNpmProjectSlackCandidates->>ManagedNpmProjectPackageJson: read dependencies
  ManagedNpmProjectPackageJson-->>addManagedNpmProjectSlackCandidates: identify `@openclaw/slack`
  addManagedNpmProjectSlackCandidates-->>resolveOpenClawSlackApiLocation: register candidate path

Loading

Suggested labels: VDR, platform: container

Suggested reviewers: ericksoa, zyang-dev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the PR’s purpose of fixing release gate regressions, even though it’s broader than the individual code changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-release-e2e-failures

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/fix-release-e2... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 8acb280	codex/fix-release-e2... 2ed6df6	+/-
src/lib/actions...confirmation.ts	40%	20%	-20%
src/lib/actions...roy-presence.ts	77%	62%	-15%
src/lib/actions...oy-execution.ts	66%	58%	-8%
src/lib/security/redact.ts	100%	95%	-5%
src/lib/state/registry.ts	88%	85%	-3%
src/lib/shields/index.ts	67%	66%	-1%
src/lib/onboard...er-gpu-patch.ts	80%	81%	+1%
src/lib/actions...dbox/destroy.ts	71%	73%	+2%
src/lib/credentials/store.ts	57%	62%	+5%
src/lib/domain/...dbox/destroy.ts	95%	100%	+5%

---

_{Updated July 12, 2026 17:08 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

E2E Advisor Recommendation

Required E2E: onboard-repair, onboard-resume, hermes-gpu-startup, cloud-onboard
Optional E2E: messaging-providers

Dispatch hint: onboard-repair,onboard-resume,hermes-gpu-startup

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• onboard-repair (high): Required deterministic lifecycle-state validation floor: repair must converge sandbox metadata and live runtime after Docker recreation changes.
• onboard-resume (medium): Required deterministic lifecycle-state validation floor: resumed onboarding must converge after sandbox lifecycle and restart-persistence changes.
• hermes-gpu-startup (high): Directly validates the affected Hermes GPU-supervised startup and restart-persistence flow on a GPU runner, where CDI GPU attachment must survive container recreation.
• cloud-onboard (high): Changed onboard, trace timing, scorecard, or E2E workflow code can affect cloud onboard wall-clock behavior and should refresh the trusted cloud-onboard trace timing signal.

Optional E2E

• messaging-providers (high): Runs the modified installed Slack runtime proof against a real sandbox and provider flow, confirming managed npm-project discovery selects the reviewed Slack runtime.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/e2e.yaml
• jobs input: onboard-repair,onboard-resume,hermes-gpu-startup

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 required · 0 warnings · 0 optional suggestions
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.