[rsliter]

Outcome

Authorize the exact self-contained bootstrap diagnostic template prepared in #12239 through the independent base-trusted allowlist. This PR changes only one digest and its comment; the shipped bootstrap and release pins are unchanged.

Reason

The prior prerequisite recorded an inert raw script digest. The protected parser compares a normalized operational-template digest. The candidate now keeps diagnostics with the executing bootstrap and covers reviewed-npm setup as well as root/plugin dependencies, so its exact normalized digest is 60aa3d473597638b50bc9ba637a86dee08aed5727c1d0297f72476c0c6690f2f.

Related issues

Refs #12192. Independent prerequisite for #12239 at 64b282d1b2e7f44563d10c86ed31e470e0c418d3.

Changes

• Replace the obsolete raw digest with the normalized digest independently extracted from the concrete candidate.
• Keep the existing accepted templates and release identities.
• Preserve separate authorization: fix(bootstrap): replace stale npm before installing Node #12239 contains no production allowlist change, and current main rejects its revised template.

Verification

Prerequisite: 683edb278ec65581caeb2a610544599d6b0b4032. Candidate data: 64b282d1b2e7f44563d10c86ed31e470e0c418d3.

• vitest run --project integration test/install/installer-hash-check.test.ts: 81 passed.
• Parser from this separate checkout accepts the exact candidate and emits the recorded digest for both Brev records.
• Current-main parser rejects the candidate. This prerequisite parser also rejects an unauthorized candidate-template mutation.
• Repository commit checks, growth checks, and secret scans passed. Current-head CI, growth, installer hashes, and self-hosted qualification passed. CodeRabbit completed with no actionable finding.

Review notes

Continues Rebecca Sliter's existing prerequisite without rewriting its history. Sensitive path: scripts/checks/extract-installer-pins.mts. Self-review confirmed the exact candidate preimage, normalized digest, unchanged shipped bootstrap, and independent trust boundary. The current-head Advisor completed all nine specialists. Eight were clear; Operability reported one duplicated P1. Its claim that the new digest authorizes the unchanged tail -3 script is a false positive, with this concrete disposition:

• The unchanged bootstrap in prerequisite commit 683edb278ec65581caeb2a610544599d6b0b4032 normalizes to 98c46cfee5bc38cd378a991a7c60573836a6c774008caf5c5dd7bc6a1910e1ce. Both the existing main parser and this prerequisite parser already accept it.
• The new 60aa3d473597638b50bc9ba637a86dee08aed5727c1d0297f72476c0c6690f2f digest belongs to the revised candidate bootstrap, whose inline diagnostic wrapper covers reviewed-npm, root, and plugin stages. Its 19 passing tests include early causal output, exact failure statuses, missing output, redaction, and cleanup.
• The prerequisite parser accepts that exact candidate; current main rejects it at the independent gate. An unauthorized template mutation remains rejected.

The finding conflates the unchanged prerequisite checkout with the downstream candidate. The code remains separated to preserve independent authorization. The Advisor aggregate remains red; this records the evidence-based disposition and does not claim a green Advisor result.

Merge requires explicit maintainer authorization. This PR enables diagnostic qualification; it does not repair or classify the underlying npm failure.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0340f5ee-a755-4694-8f35-19234c6c3599

📥 Commits

Reviewing files that changed from the base of the PR and between 6391e1a and 683edb2.

📒 Files selected for processing (1)

• scripts/checks/extract-installer-pins.mts

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The v0.0.116 trusted Brev template hash allowlist now uses the digest for the self-contained #12192 npm diagnostics template instead of the #12192 Advisor-repair template. Release pins remain unchanged.

Changes

Brev template pin

Layer / File(s)	Summary
Update trusted template digest scripts/checks/extract-installer-pins.mts	The allowlist comment and digest now refer to the self-contained #12192 npm diagnostics template. Release pins remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

Suggested reviewers: ericksoa

Merge Risk: ⚪ Minimal · up to 683ed

No actionable trust-record defect is established. The separate #12192 candidate source was not available to confirm its digest.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: correcting the bootstrap diagnostics trust hash.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 683edb2 in the codex/12192-bootstra... branch remains at 96%, unchanged from commit 63002cd in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 683edb2 in the codex/12192-bootstra... branch remains at 84%, unchanged from commit 63002cd in the main branch.

Show a line coverage summary of the most impacted files.

File	main 63002cd	codex/12192-bootstra... 683edb2	+/-
src/lib/actions...flight-phase.ts	98%	90%	-8%
src/lib/actions...up-authority.ts	73%	70%	-3%
src/lib/actions...backup-phase.ts	78%	76%	-2%
src/lib/onboard...eway-service.ts	85%	85%	0%
src/lib/state/sandbox.ts	92%	92%	0%
src/lib/actions...ridge-source.ts	80%	81%	+1%
src/lib/onboard...tate-capture.ts	90%	91%	+1%
src/lib/onboard...der/snapshot.ts	86%	87%	+1%
src/lib/actions...ld-mcp-phase.ts	84%	87%	+3%
src/lib/agent/s...store-reader.ts	86%	92%	+6%

---

_{Updated September 28, 2026 04:10 UTC}

[github-actions]

PR Review Advisor finished for commit 683edb2. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

[ericksoa]

Reviewed exact head 683edb2. The two-line independent trust update authorizes the diagnostic template in #12239 without changing the shipped bootstrap or release pins. CI, growth, installer hashes, and runtime qualification passed; 81 focused installer tests passed. The duplicated Advisor finding conflates the unchanged 98c46c template with the downstream 60aa3d template; the parser comparisons and disposition are recorded in this PR.