feat(ci): promote Deep Agents Code managed image pointers by ericksoa · Pull Request #12371 · NVIDIA/NemoClaw

ericksoa · 2026-09-28T01:50:51Z

Outcome

Publish Deep Agents Code managed-image release and revision tags alongside OpenClaw and Hermes. Custom Dockerfiles can resolve a release and pin its complete image digest. Stock onboarding retains its existing digest resolution.

Reason

The workflow already builds, qualifies, attests, and stages Deep Agents Code on AMD64 and ARM64, but omits it from consumer tag promotion.

This replays Zac Wang's #11342 on an NVIDIA-owned branch because the required reviewed OpenShell SDK is unavailable to fork CI. Zac remains the author of the replay commit; a separate test-only commit adds release-alias regression coverage.

Related issues

Resolves #11341. Supersedes #11342 after this replacement merges.

Changes

Include Deep Agents Code in alias recording and final consumer tag promotion through the existing owner and exact-repository validation.
Extend the existing publication tests to cover the added revision pointer and a release pointer's ordering and exact bytes.
Document digest-pinned custom-image use. Preserve the existing cohort barrier, durable evidence, credentials, permissions, and partial-publication reconciliation.

Verification

40 focused tests passed: npx vitest run test/inference/managed/managed-image-publication-promotion.test.ts test/inference/managed/managed-image-publication-workflow.test.ts.
A deliberate test mutation omitted only the Deep Agents release alias. The previous revision test still passed; the new release test failed. The workflow was restored unchanged.
npm run docs passed with zero Fern errors and two warnings. Normal commit and publication checks passed.
Code CI passed, including all twelve CLI test groups.
Managed-image qualification passed, including all-agent Docker and rootless Podman activation.
Tested commit: 61ca6bc5ae8d02b36cc34209574a857ef250dac1; base: 3c668364eeb9b94dcd2e0a553382aa0e16e3745e. Both published commits are GitHub Verified.
No full E2E matrix or live release-tag publication is claimed. Public release-tag resolution and custom-image use follow the normal trusted release process recorded in Publish the complete Deep Agents Code managed image (ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox) like openclaw-sandbox and hermes-sandbox #11341.
The diff contains no secrets, credentials, dependency changes, Dockerfile changes, or runtime changes.

Review notes

Maintainer decision: Accept. The existing managed-image maintainers own the Linux AMD64/ARM64 publication lifecycle; Aaron Erickson is accountable for this delivery. The decision records scope, compatibility, security controls, and validation.

CodeRabbit reviewed the original change and the test follow-up without actionable findings. All nine current-commit Advisor reports were collected and their artifact digests and provenance verified. Seven reports are clear. The remaining authority finding contradicts fresh GitHub MEMBER/admin evidence, and the workflow-overview suggestion concerns unchanged text already present while main published Hermes consumer pointers. The stock OpenClaw-led catalog discovery owner remains unchanged. Complete review disposition. The raw Advisor failure is preserved; no candidate-owned code blocker remains.

Self-review covered the workflow, both publication test files, their fixture helper, and the quickstart. Every cohort is validated before staging; every shipped-agent reference is verified before consumer aliases move; alias readback must match the immutable cohort bytes.

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Summary by CodeRabbit

New Features
- Deep Agents Code sandbox images are now included in published releases, with release and revision tags available. Their published references are promoted alongside other shipped images, and the release-tagged image can be inspected and verified against its published digest.
Documentation
- The Deep Agents Code quickstart now recommends starting custom Dockerfiles from the published sandbox image and pinning it by digest for reproducible builds.

Extends the shipped-agent pointer set from (openclaw hermes) to include langchain-deepagents-code at both managed-images.yaml sites, so the promote lane records and moves :<revision> and :<release> consumer pointers for the Deep Agents Code image it already builds, validates, attests, and stages in the six-candidate cohort barrier (#11341). Stock Deep Agents Code onboarding already consumes this image buildless by exact digest, and SHIPPED_MANAGED_IMAGE_AGENTS already names the agent shipped; only the consumer pointers were missing, so downstream custom images (nemo-deepagents onboard --from) had nothing to FROM by name. This aligns the workflow's pointer set with the source contract's shipped-agent list. The publication tests now prove the Deep Agents Code pointer moves only after all cohort aliases stage and that a barrier failure moves no pointer for any agent. The quickstart documents starting custom images FROM the published image. Signed-off-by: Zac Wang <zacw@nvidia.com> (cherry picked from commit 532622e) Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

copy-pr-bot · 2026-09-28T01:50:54Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

coderabbitai · 2026-09-28T01:50:58Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8af3d304-334c-4981-bf5e-6753c87580a9

📥 Commits

Reviewing files that changed from the base of the PR and between 7ece0a3 and 61ca6bc.

📒 Files selected for processing (2)

test/helpers/managed-image-publication-barrier.ts
test/inference/managed/managed-image-publication-promotion.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Walkthrough

The managed-image workflow adds Deep Agents Code to consumer alias staging and root-pointer promotion. Tests cover pointer ordering and release-alias contents. The quickstart describes using the published image as a digest-pinned base for a custom Dockerfile.

Changes

Managed image publication

Layer / File(s)	Summary
Stage and promote Deep Agents Code pointers `.github/workflows/managed-images.yaml`, `test/inference/managed/managed-image-publication-workflow.test.ts`, `docs/get-started/quickstart-langchain-deepagents-code.mdx`	The workflow includes Deep Agents Code in alias staging and root-pointer promotion and accepts its exact repository reference. The workflow test expects Deep Agents Code in the shipped-agent lists. The quickstart describes using the published image as a digest-pinned base for a custom Dockerfile.
Validate revision and release aliases `test/helpers/managed-image-publication-barrier.ts`, `test/inference/managed/managed-image-publication-promotion.test.ts`	The promotion fixtures support release-tagged candidates and collect existing revision and release alias contents. Promotion tests check pointer ordering, release-alias inspection, and the alias bytes’ SHA-256 digest against the cohort digest.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature · Severity of issue fixed: Medium

Suggested reviewers: prekshivyas, cv

Merge Risk: ⚪ Minimal · up to 61ca6

No actionable issue is established for the Deep Agents Code image-pointer change; normal CI validation remains appropriate before merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR satisfies the coding requirements in issue `#11341`. `.github/workflows/managed-images.yaml` adds `langchain-deepagents-code` to both shipped-agent paths, supports revision and release aliases, a…
Out of Scope Changes check	✅ Passed	The changed files remain within issue `#11341`. The workflow implements managed-image pointer publication. The tests provide matching automated coverage and fixture support. The quickstart documents the…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Deep Agents Code managed-image pointer promotion to CI.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

ericksoa · 2026-09-28T01:51:12Z

@coderabbitai review

coderabbitai · 2026-09-28T01:51:22Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

github-actions · 2026-09-28T01:52:09Z

🌿 Preview your docs: https://nvidia-preview-pr-12371.docs.buildwithfern.com/nemoclaw

github-code-quality · 2026-09-28T01:52:16Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 61ca6bc in the feat/deepagents-mana... branch remains at 96%, unchanged from commit 63002cd in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 61ca6bc in the feat/deepagents-mana... branch remains at 84%, unchanged from commit 63002cd in the main branch.

Show a line coverage summary of the most impacted files.

File	`main` 63002cd	`feat/deepagents-mana...` 61ca6bc	+/-
`src/lib/actions...flight-phase.ts`	98%	90%	-8%
`src/lib/actions...up-authority.ts`	73%	70%	-3%
`src/lib/actions...backup-phase.ts`	78%	76%	-2%
`src/lib/onboard...eway-service.ts`	85%	85%	0%
`src/lib/state/sandbox.ts`	92%	92%	0%
`src/lib/actions...ridge-source.ts`	80%	81%	+1%
`src/lib/onboard...tate-capture.ts`	90%	91%	+1%
`src/lib/onboard...der/snapshot.ts`	86%	87%	+1%
`src/lib/actions...ld-mcp-phase.ts`	84%	87%	+3%
`src/lib/agent/s...store-reader.ts`	86%	92%	+6%

_{Updated September 28, 2026 02:41 UTC}

ericksoa · 2026-09-28T02:18:55Z

Review disposition for 7ece0a3. All nine Advisor artifacts were collected and their digests and commit/run provenance verified.

F-verification-mistake-proofing-cf7b1397cf4636b078ba: accepted. The existing promotion fixture needs a release-tag scenario. A narrow test-only follow-up adds matching tagged candidate input and checks Deep Agents release-alias order, persisted bytes, and durable release identity. The existing workflow implementation stays unchanged.
F-architecture-standard-work-67bfa2755c4e5470791a: excluded as new scope. Consolidating the runtime inventory and workflow-step lists is a separate architecture change. The current three-agent values match, and the executable promotion/barrier tests verify current behavior. The reduction specialist independently confirms that the two local lists serve distinct workflow-step responsibilities. No current publication defect is demonstrated by possible future divergence.
F-customer-value-behavior-84a7378a67af3a8038d0: scope was accepted by the maintainer direction and recorded in this PR. The explicit issue decision now also records ownership, lifecycle, compatibility, security, and validation: Publish the complete Deep Agents Code managed image (ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox) like openclaw-sandbox and hermes-sandbox #11341 (comment) . The author of that decision has ADMIN permission.

The other six specialists are clear. CodeRabbit reviewed all four original changed files without actionable findings; its docstring warning is advisory. The raw Advisor result remains unchanged. The test-only follow-up will receive fresh CI and automated review before merge.

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa · 2026-09-28T02:26:53Z

@coderabbitai review

coderabbitai · 2026-09-28T02:27:19Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

github-actions · 2026-09-28T02:47:46Z

PR Review Advisor finished for commit 61ca6bc. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

ericksoa · 2026-09-28T02:49:03Z

Final review disposition for 61ca6bc. All nine Advisor reports were collected and their artifact digests, commit identities, and run provenance verified. Seven reports are clear, including verification, security, and architecture. CodeRabbit reviewed the follow-up and reports no actionable findings.

F-customer-value-behavior-c21b4becc06b238e478e: false positive. The finding asserts that the Accept comment is from a CONTRIBUTOR. Fresh authenticated GitHub API reads identify the comment author as ericksoa with author_association MEMBER, and the repository permission endpoint returns admin. The accepted scope, accountable maintainer, lifecycle, security constraints, and validation are recorded here: Publish the complete Deep Agents Code managed image (ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox) like openclaw-sandbox and hermes-sandbox #11341 (comment) . No additional scope approval is missing.
F-documentation-standard-work-d22afbadfee37e7ca3aa: non-blocking clarification in unchanged text. The first 15 lines of the workflow are byte-for-byte identical to base 3c66836, which already published Hermes consumer pointers from both shipped-agent lists. The overview describes stock catalog discovery through the OpenClaw cohort pointer; that discovery owner remains unchanged. The edited comments at both publication loops explicitly describe all three shipped agents and partial-publication reconciliation, and the changed quickstart accurately describes the new custom-image aliases. Expanding the old overview is outside this narrow delivery and does not require another implementation revision.

The earlier release-tag evidence gap is fixed. Forty focused tests pass, including the new release alias ordering and byte-identity case. Deliberately omitting only the Deep Agents release alias leaves the prior revision test passing and makes the new test fail; the production workflow was restored unchanged.

The raw Advisor result remains failure and is not rewritten. No candidate-owned code blocker remains. Public release-tag resolution and downstream use remain the explicitly recorded normal release-process verification; no pre-merge live publication or full E2E matrix is claimed.

ericksoa · 2026-09-28T03:03:38Z

Maintainer approval for merge at 61ca6bc, under the explicit instruction to deliver this contribution after green CI.

Validation: 40 focused publication tests, documentation validation, required code CI, managed-image qualification on Docker and rootless Podman, and the repository's self-hosted PR qualification passed. Both commits are GitHub Verified. Zac Wang's contribution and authorship are retained; the follow-up adds only the release-tag regression and fixture support.

Code CI: https://github.com/NVIDIA/NemoClaw/actions/runs/36369830231
Images: https://github.com/NVIDIA/NemoClaw/actions/runs/36369830228
Self-hosted qualification: https://github.com/NVIDIA/NemoClaw/actions/runs/36371372700
Review disposition: #12371 (comment)
Accepted scope: #11341 (comment)

GitHub does not allow this account to submit an approval review on a PR it opened. The previously authorized admin merge records the maintainer decision for this owner replay after technical validation. This is not independent human approval. The Advisor's raw result is retained with the false-positive and unchanged-text dispositions above.

ericksoa mentioned this pull request Sep 28, 2026

Publish the complete Deep Agents Code managed image (ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox) like openclaw-sandbox and hermes-sandbox #11341

Closed

test(images): verify Deep Agents release pointer publication

61ca6bc

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa marked this pull request as ready for review September 28, 2026 02:50

ericksoa merged commit 792945c into main Sep 28, 2026
124 of 126 checks passed

ericksoa deleted the feat/deepagents-managed-image-pointers-11341 branch September 28, 2026 03:06

github-actions Bot added the v0.0.130 label Sep 28, 2026

ericksoa mentioned this pull request Sep 28, 2026

feat(ci): promote Deep Agents Code managed image pointers #11342

Closed

4 of 7 tasks

Conversation

ericksoa commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Reason

Related issues

Changes

Verification

Review notes

Summary by CodeRabbit

Uh oh!

copy-pr-bot Bot commented Sep 28, 2026

Uh oh!

coderabbitai Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

ericksoa commented Sep 28, 2026

Uh oh!

coderabbitai Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

github-code-quality Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

ericksoa commented Sep 28, 2026

Uh oh!

ericksoa commented Sep 28, 2026

Uh oh!

coderabbitai Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

ericksoa commented Sep 28, 2026

Uh oh!

ericksoa commented Sep 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ericksoa commented Sep 28, 2026 •

edited

Loading

coderabbitai Bot commented Sep 28, 2026 •

edited

Loading

coderabbitai Bot commented Sep 28, 2026 •

edited

Loading

github-code-quality Bot commented Sep 28, 2026 •

edited

Loading

coderabbitai Bot commented Sep 28, 2026 •

edited

Loading