Repository navigation
refactor(sandbox): remove Shields from core - #10722
Merged
Merged
Conversation
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
|
Important Review skippedToo many files! This PR contains 604 files, which is 304 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (604)
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-10722.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit fff3bca in the TypeScript / code-coverage/cliThe overall line coverage in commit fff3bca in the Show a line coverage summary of the most impacted files.
Updated |
cv
approved these changes
Aug 31, 2026
ericksoa
marked this pull request as draft
August 31, 2026 23:14
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Restore the Hermes mutable cross-identity root before gateway import. Repair the stale image fixture and CodeQL annotations. Enable trusted BuildKit E2E prebuilds and pin the exact Pi candidate receipts. Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Preserve current advisor and Hermes E2E fixes while keeping the removal atomic. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Keep the newly landed Shields implementation and tests removed while retaining current E2E fixes. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Retire legacy Shields state only after an exact sandbox-identity proof. Verify rebuilt Hermes config through pinned descriptors before deleting upgrade state. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Exercise valid, read-only, and linked config fixtures. Clarify when legacy recovery artifacts block existing sandboxes. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Avoid a redundant agent-definition lookup after the recreated Hermes identity is already verified. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Bind DCode and Pi retirement to exact replacement identity and successful restore. Require complete generic post-restore verification before deleting legacy state. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Keep the atomic removal branch aligned with current main before final qualification. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Read replacement and staged fixtures through no-follow regular-file descriptors. Keep intentional stale-handle tests without filesystem race alerts. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Keep retired Shields commands and tests removed. Retain current external gateway and E2E pruning changes. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 22, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 23, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 24, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 24, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 24, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 25, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Sep 30, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 2, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 3, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 5, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 6, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 7, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 7, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 8, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 9, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 9, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 10, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 11, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 12, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 13, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 14, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 15, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
14 tasks
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 16, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 17, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 18, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
shanemcd-rebase-bot Bot
pushed a commit
to shanemcd/NemoClaw
that referenced
this pull request
Oct 19, 2026
…pts removed upstream Upstream removed the Shields/state-mutation subsystem (NVIDIA#10722), deleting scripts/state-dir-guard.py, runtime-state-mutation-{control,startup-gate}.py, runtime_state_mutation_hermes_publisher.py, and their state-lock-plan / runtime-state-mutation-publisher-v1.json manifests. The fork's hermes Dockerfile and start/vm entrypoints still COPY and invoke them at runtime, so a bare rebase dropped them and broke build-nemoclaw-hermes. Restore the six files from the pre-rebase fork HEAD so the hermes image keeps its state-guard posture.
wscurran
added
the
area: ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Removes Shields from NemoClaw core in one atomic change: the CLI, plugin, runtime-provider contract, policies, manifests, docs, tests, and compiled command surface no longer expose a Shields capability. Existing installations with legacy Shields state receive an explicit retirement notice and are routed through fail-closed rebuild, recreation, or destruction recovery before ordinary mutation.
Reason
NemoClaw should not own post-provisioning immutability as an inherent product concept. A future ecosystem product or composable blueprint can provide that capability on top of NemoClaw without coupling every supported agent and runtime provider to a built-in Shields state machine.
Related issues
Fixes #10696
Changes
shields up,shields down, andshields statuscommands, plugin status affordance,src/lib/shields, permissive-policy and state-lock-plan assets, runtime-providerstateMutationcontract, Hermes mutation publisher/controller/gate, and Shields-specific E2E and unit infrastructure.Verification
npm run validate:pr— passed on the published commit against the refreshed canonical comparison ref.npm run build:cliandnpm run typecheck:cli— passed.npm --prefix nemoclaw run buildandnpm --prefix nemoclaw run typecheck— passed.npm run validate:configs— 52/52 configuration files passed.npm run checks:repository— architecture, imports, project membership, source-shape, and growth checks passed.npm run test:e2e-phases:check— 132 semantic E2E phase tests across 87 files passed.npm --prefix tools/mcp-tool-discovery-runtime run bundle:reviewed:check— passed.npm run docs— passed with 0 errors and 2 unrelated existing Fern warnings.sandboxandgatewayidentities.gitleaksand the pre-commit private-key check passed; the diff contains no secrets, API keys, or credentials.Review notes
npm testandnpm run test:changedattempts were not green on this loaded macOS host. The observed failures included fixed-timeout/load behavior, a known invalid host-local gateway registry row, macOS/private/varnormalization, and a snapshot-sanitizer hardlink case that reproduced intermittently on cleanmain. A serial replay of the initially red changed set passed 301/308; its remaining seven failures are in unchanged files and reduce to that host registry plus one macOS temp/timing fixture. The implementation-owned gates and focused suites above pass, and clean PR CI remains authoritative.Signed-off-by: Aaron Erickson aerickson@nvidia.com