fix(onboard): accept managed runtime aliases

[deepujain]

Summary

Managed onboarding rejected the stock Slack runtime aliases before sandbox startup. The validator now accepts only canonical runtime alias triples whose environment key, anchored OpenShell resolver expression, and approved placeholder all identify the same credential environment variable.

Related Issue

Fixes #9397

Changes

• Recognize canonical entries only at messaging.plan.runtimeSetup.envAliases[*].
• Keep raw credentials, invalid environment names, malformed expressions, mismatched aliases, and placeholders at other paths rejected.
• Add focused positive coverage for both stock Slack aliases and denial coverage for each neighboring failure mode.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh is unchanged.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — vitest run --project cli src/lib/onboard/managed-startup-runtime-alias.test.ts src/lib/onboard/managed-startup-profile.test.ts (128 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Deepak Jain deepujain@gmail.com

Summary by CodeRabbit

• New Features

  • Added support for validating canonical messaging runtime environment aliases.
  • Valid aliases now support Slack bot and app credentials with matching placeholders.
  • Alias fields are accepted only in the expected runtime configuration paths.

• Bug Fixes

  • Invalid alias formats, mismatched placeholders, raw credentials, and misplaced credential-shaped data are now rejected.
  • Improved validation helps prevent incorrectly configured messaging runtime aliases.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 43d6f179-26b0-4dd4-9798-606dfaa5a46c

📥 Commits

Reviewing files that changed from the base of the PR and between 0ba97a8 and ae992f4.

📒 Files selected for processing (1)

• src/lib/onboard/managed-startup-runtime-alias.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/lib/onboard/managed-startup-runtime-alias.test.ts

Included review availability: Your plan includes up to 12 reviews per rolling hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The managed startup profile validator recognizes canonical runtime aliases under messaging.plan.runtimeSetup.envAliases. It validates alias fields and scopes credential-string exemptions to approved match and value fields. Tests cover accepted and rejected payloads.

Changes

Managed startup runtime aliases

Layer / File(s)	Summary
Canonical alias validation src/lib/onboard/managed-startup/profile.ts	The validator identifies canonical runtime alias paths, validates credential environment keys and matching placeholders, tracks alias indexes, and exempts only approved alias fields from credential-shaped string rejection.
Alias validation regression tests src/lib/onboard/managed-startup-runtime-alias.test.ts	Tests cover valid Slack aliases, malformed and mismatched alias data, raw credentials, and credential-shaped data outside the schema-owned path.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to ae992

This change enables canonical managed runtime aliases during onboarding and targeted tests pass, but required sensitive-path review and quality-gate attestations are still incomplete, so the PR is not merge-ready until those checks are completed or explicitly accepted.

Possibly related PRs

• NVIDIA/NemoClaw#9374: Both changes update managed startup validation for schema-owned messaging credential aliases and placeholders.

Suggested labels: area: integrations

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: accepting managed runtime aliases during onboarding.
Linked Issues check	✅ Passed	The changes implement canonical alias validation and add regression tests for accepted Slack aliases and denial cases required by issue #9397.
Out of Scope Changes check	✅ Passed	The changes are limited to managed startup profile validation and focused regression tests for runtime aliases.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

3 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• runtime alias at src/lib/onboard/managed-startup-runtime-alias.test.ts:33: primary classified it as established; the second opinion classified it as conflict.
• managed startup at src/lib/onboard/managed-startup-runtime-alias.test.ts:5: selected only by the second-opinion lane as established.
• canonical at src/lib/onboard/managed-startup/profile.ts:1068: selected only by the second-opinion lane as justified.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — runtime alias at src/lib/onboard/managed-startup-runtime-alias.test.ts:33: Retain `runtime alias` for manifest entries that map credential placeholders into runtime configuration.
• justified — schema-owned path at src/lib/onboard/managed-startup-runtime-alias.test.ts:65: Retain `schema-owned path` when distinguishing the permitted runtime alias location from rejected profile fields.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: managed-image-multiarch-startup, device-auth-health, onboard-repair, onboard-resume, openclaw-inference-switch, cloud-onboard, issue-4462-scope-upgrade-approval
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

2 optional E2E recommendations

• messaging-providers
• hermes-slack

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[jyaunches]

LOC Reduction / Codebase Simplicity Review

Why this blocks

managed-startup-runtime-alias.test.ts:12-22 copies both Slack alias definitions already owned by messaging/channels/slack/manifest.ts:16-31. The positive test at lines 45-49 therefore does not actually exercise the shipped stock Slack runtime aliases: it can remain green if the manifest changes, and its copied objects already omit the manifest's message field.

This leaves two owners for the accepted alias contract even though the new production validator is correctly generic.

Refactor direction

Derive the positive fixture from slackManifest.runtime.hermes.envAliases, then spread those same entries to construct the invalid variants. Remove the copied alias constants rather than maintaining a test-local mirror.

Expected result

The manifest remains the single alias owner, the positive test covers the real shipping contract, and the new validator stays generic with fewer fixture lines and no synchronization risk.

[deepujain]

Updated in ae992f4. The positive fixture now uses slackManifest.runtime.hermes.envAliases, and every invalid case is derived from the same shipping manifest entry. Focused regression: 8/8 passed; build, typecheck, and lint also passed.

Resolved at ae992f4: the test now derives its aliases from the shipping Slack manifest and removes the copied fixture authority.

[jyaunches]

LOC Reduction / Codebase Simplicity Review

Resolved at ae992f43d56ecb81d2c0d04887f284df79f47464.

managed-startup-runtime-alias.test.ts now imports the shipping slackManifest, passes its runtime aliases directly to the positive case, and derives every invalid variant from the same manifest entry. The copied Slack alias objects are gone, and the test is 11 lines smaller.

I found no new blocking LOC-reduction or codebase-simplicity issue in the updated complete diff. This closes only the prior simplicity review; it is not an approval or a correctness, security, or CI review.

[prekshivyas]

Sensitive-path review completed at this head: all nine security areas pass. The alias exemption remains limited to the exact schema path, canonical envKey, exact match, and recognized placeholder; raw credential values are still rejected. I found no code-level issues, and 128 focused tests passed locally. I’m holding approval only because PR review advisor (Nemotron 3 Ultra) is still failing.

[deepujain]

The rerun is complete at ae992f4: both Advisor lanes and the publish job now pass.

[prekshivyas]

Approved after the Nemotron infrastructure rerun completed successfully. The exact reviewed head is unchanged, all reported checks are now passing or intentionally skipped, and the sensitive-path review remains valid.