[apurvvkumaria]

Summary

Deep Agents rebuild preflight built a local base image, then rejected that same image because the rebuild did not carry its operation-scoped trust proof into managed image preparation. This change uses the existing validated base-image builder and leases its exact ref and provenance only for that preparation window.

Changes

• Build the DCode rebuild base through ensureAgentBaseImage so it has current provenance, compatibility validation, and a content-addressed ref.
• Lease that exact local ref and provenance while the managed replacement image is prepared, then restore both trust and environment state.
• Add a regression test that verifies the trust lease is installed and removed around DCode replacement preflight.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This restores the documented managed DCode rebuild path and does not change its command, configuration, or output contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The lease requires the exact current-build ref and provenance. Existing negative resolver tests still reject arbitrary local overrides.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: rebuild-dcode-preflight.test.ts (16 passed); rebuild base-image helper tests (36 passed); base-image trust and resolution tests (43 passed).
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved DCode sandbox rebuild reliability by using verified trusted base images during preflight.
  • Ensured temporary base-image settings are restored after rebuild operations, including when preparation fails.
  • Preserved the original error details when a rebuild preparation step encounters a failure.
  • Added safeguards to prevent rebuilds from continuing when trusted base-image verification is incomplete.

• Tests

  • Added coverage for successful and failed rebuild scenarios, including cleanup and base-image setting restoration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f7342797-e2ca-423e-87a9-764cea8e4246

📥 Commits

Reviewing files that changed from the base of the PR and between d1a372b and a68c502.

📒 Files selected for processing (2)

• src/lib/actions/sandbox/rebuild-dcode-base-image-lease.test.ts
• test/helpers/rebuild-flow-harness.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/helpers/rebuild-flow-harness.ts

---

📝 Walkthrough

Walkthrough

DCode rebuild preflight now provisions base images through the trusted agent-image flow, validates the trusted override, pins it during rebuild operations, and restores it afterward. Tests and harnesses cover successful and failing preparation paths.

Changes

DCode trusted base-image flow

Layer / File(s)	Summary
Trusted base-image provisioning src/lib/actions/sandbox/rebuild-dcode-preflight.ts	Replaces temporary image construction with ensureAgentBaseImage, validates the trusted override reference, and stores the override with the pinned image state.
Operation pinning and restoration src/lib/actions/sandbox/rebuild-dcode-preflight.ts	Pins the trusted local override while the rebuild runs and restores it in the finally path.
Lease validation and harness support src/lib/actions/sandbox/rebuild-dcode-base-image-lease.test.ts, test/helpers/rebuild-flow-harness.ts	Adds success and failure tests and extends the harness with trusted override results, image inspection behavior, and pin/restore spies.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant rebuildSandbox
  participant withPinnedBaseImage
  participant prepareManagedDcodeRebuildImage
  participant TrustedAgentBaseImage
  rebuildSandbox->>withPinnedBaseImage: start DCode rebuild
  withPinnedBaseImage->>TrustedAgentBaseImage: pin trusted override
  withPinnedBaseImage->>prepareManagedDcodeRebuildImage: run with base image reference
  prepareManagedDcodeRebuildImage-->>withPinnedBaseImage: complete or throw
  withPinnedBaseImage->>TrustedAgentBaseImage: restore override
  withPinnedBaseImage-->>rebuildSandbox: return result or propagate error

Loading

Suggested labels: bug-fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: trusting the current DCode base during rebuild preflight.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-e2e-current-main

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit a68c502 in the codex/fix-e2e-curren... branch remains at 96%, unchanged from commit fdad045 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit a68c502 in the codex/fix-e2e-curren... branch remains at 80%, unchanged from commit fdad045 in the main branch.

Show a code coverage summary of the most impacted files.

File	main fdad045	codex/fix-e2e-curren... a68c502	+/-
src/lib/onboard...ndbox-create.ts	100%	33%	-67%
src/lib/actions...eway-cleanup.ts	77%	59%	-18%
src/lib/onboard...eway-cleanup.ts	66%	55%	-11%
src/lib/domain/...dbox/destroy.ts	91%	80%	-11%
src/lib/onboard...ndbox-create.ts	91%	83%	-8%
src/lib/actions...rable-config.ts	93%	86%	-7%
src/lib/inferen...er-lifecycle.ts	71%	65%	-6%
src/lib/onboard...-desktop-gpu.ts	83%	77%	-6%
src/lib/state/m...-acquisition.ts	89%	84%	-5%
src/lib/actions...de-preflight.ts	85%	90%	+5%

---

_{Updated July 22, 2026 05:38 UTC}

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/actions/sandbox/rebuild-dcode-preflight.test.ts (1)

238-246: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Prove the lease remains active through preparation.

These final mock-call assertions also pass if restoration happens before the replacement-image preparation. Have the preparation boundary observe the active override, then cover a failing preparation and verify cleanup afterward.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/sandbox/rebuild-dcode-preflight.test.ts` around lines 238 -
246, Strengthen the test around the preparation boundary by making the
preparation step observe that the trusted base-image override is still active.
Add a failing preparation scenario, assert the preparation sees the expected
override before restoration, and verify restoreTrustedAgentBaseImageOverrideSpy
is called afterward while preserving the existing pin assertions.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/actions/sandbox/rebuild-dcode-preflight.test.ts`:
- Around line 238-246: Strengthen the test around the preparation boundary by
making the preparation step observe that the trusted base-image override is
still active. Add a failing preparation scenario, assert the preparation sees
the expected override before restoration, and verify
restoreTrustedAgentBaseImageOverrideSpy is called afterward while preserving the
existing pin assertions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a673b478-02b2-4ef0-ad85-281e9aa132aa

📥 Commits

Reviewing files that changed from the base of the PR and between 6b29277 and d1a372b.

📒 Files selected for processing (3)

• src/lib/actions/sandbox/rebuild-dcode-preflight.test.ts
• src/lib/actions/sandbox/rebuild-dcode-preflight.ts
• test/helpers/rebuild-flow-harness.ts

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, state-backup-restore, upgrade-stale-sandbox

2 optional E2E recommendations

• sandbox-rebuild
• ubuntu-repo-cloud-langchain-deepagents-code

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.