[cjagwani]

Summary

The sandbox image workflow now builds the Hermes production image once and reuses that exact image for its isolation probes. A dedicated producer performs the guarded local Buildx build and uploads one short-lived artifact; consumers load the artifact without rebuilding, authenticating to Docker Hub, or publishing it.

Related Issue

Part of #7451

Changes

• Build the Hermes production image in a 30-minute producer using canonical full-SHA-pinned Buildx actions, local loading, and an OS/architecture-scoped GitHub Actions cache.
• Preserve the bounded export swap, guarded build arguments, completed-image node-tar scan, installed-file checks, and Docker authentication cleanup.
• Save and upload one one-day hermes-isolation-image artifact.
• Load that artifact in a separate 90-minute secret-boundary/root-entrypoint consumer and the existing state-directory metadata consumer.
• Require exactly one producer setup/build/save/upload, the canonical artifact download action and mapping, and no consumer registry authentication or rebuild.
• Document the producer/consumer execution boundary in the internal E2E operator guide.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: runtime behavior is unchanged; the internal E2E operator guide was updated for the CI execution shape.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — exact-diff nine-category review confirmed Docker Hub credentials remain producer-only; consumers cannot authenticate or rebuild; canonical Buildx and download actions are exact-SHA pinned; the Buildx action remains load: true and fail-closed on any push value other than false; and cache, artifact, cardinality, secret-scope, and no-registry-write invariants have independent negative tests.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: test/e2e/README.md documents the single Hermes image producer, runner-scoped Buildx cache, local-only build, artifact reuse by both consumers, and retained probe budgets. Reviewed against WRITING.md and docs/CONTRIBUTING.md; npm run docs passed at 06261fd27.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every published commit appears as Verified in GitHub — both contributor commits are Verified; the signed maintainer refresh and repair commits will be checked immediately after the single normal push.
• Normal pre-commit and commit-msg hooks passed; npm run check:diff reproduced the diff-scoped pre-commit, commit-message, and pre-push gates on exact local head 06261fd27.
• Targeted behavior tests pass for the current change set — two focused E2E-support files passed 21/21; npm run test:changed -- --coverage=false passed the same 21/21 affected tests after the main refresh.
• Applicable broad gate passed — revision-specific GitHub CI, the sandbox-image branch workflow, and selected E2E evidence remain required before approval.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — command passed with 0 errors and two Fern warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

• CI Improvements
  • Shortened Hermes sandbox image build timeout and initialized Docker Buildx to speed up builds.
  • Switched Hermes production image building to a Buildx-based flow with cache support, local-only loading, and stricter build-argument validation.
  • Added save/upload of the Hermes isolation image and improved reuse in downstream tests, with updated build/test resource recording and cleanup.
• Bug Fixes
  • Tightened E2E workflow boundary validation for Hermes to prevent unintended registry writes, enforce correct secret scoping, and align producer/consumer expectations.
• Documentation
  • Updated the E2E README with the new CI execution shape and revised timeout budgets.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 43be0ca5-2da6-4542-8e73-9f5f26c35b54

📥 Commits

Reviewing files that changed from the base of the PR and between c2031f8 and 06261fd.

📒 Files selected for processing (2)

• test/e2e/README.md
• test/e2e/support/sandbox-images-workflow-boundary.test.ts

---

📝 Walkthrough

Walkthrough

Hermes CI now uses a validated, cached Docker Buildx production build, transfers the resulting isolation image between jobs, and runs downstream probes with updated time budgets and secret-scope assertions. Documentation and workflow-boundary tests describe and enforce the revised execution model.

Changes

Hermes build and test workflow

Layer / File(s)	Summary
Validated Buildx production build .github/workflows/..., tools/e2e/sandbox-images-workflow-boundary.mts, test/e2e/support/sandbox-images-workflow-boundary.test.ts	Hermes validates production build arguments, initializes Buildx, builds with GHA caching and local loading, and rejects registry writes or invalid Buildx configuration.
Isolation artifact reuse and probe validation .github/workflows/..., tools/e2e/sandbox-images-workflow-boundary.mts, test/e2e/support/*hermes*, test/e2e/README.md	The producer uploads the isolation image, the consumer downloads and loads it, and Hermes probes enforce updated timeouts, dependency placement, ordering, and secret scopes.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• NVIDIA/NemoClaw#6242: Updates the same Hermes sandbox image boundary contracts, workflow, and image reuse behavior.

Suggested labels: integration: hermes, area: ci, area: e2e, platform: container, area: performance

Suggested reviewers: cv, prekshivyas, apurvvkumaria

Sequence Diagram(s)

sequenceDiagram
  participant ProducerJob
  participant Buildx
  participant ArtifactStore
  participant ConsumerJob
  participant HermesProbes
  ProducerJob->>Buildx: Validate and build local Hermes image
  Buildx-->>ProducerJob: Load Hermes image
  ProducerJob->>ArtifactStore: Upload isolation image tarball
  ConsumerJob->>ArtifactStore: Download isolation image
  ConsumerJob->>ConsumerJob: Load isolation image
  ConsumerJob->>HermesProbes: Run Hermes boundary probes

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: building the Hermes production image once and reusing it in E2E.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7451-hermes-image-reuse

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 06261fd in the codex/7451-hermes-im... branch remains at 96%, unchanged from commit 3e54a83 in the main branch.

---

_{Updated July 26, 2026 01:20 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 2 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 2 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

tools/e2e/sandbox-images-workflow-boundary.mts (2)

812-928: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

validateHermesImageReuse has grown into a large, multi-concern function.

This function now covers producer/consumer timeout budgets, Node-install exclusivity, probe ordering/budgets, artifact download/load contents, and producer save/upload/cleanup ordering — all in one function, matching the flagged high-complexity ranges. Splitting it into smaller helpers (e.g. one for budgets/Node exclusivity, one for probe ordering, one for artifact save/upload/download) would keep each piece easier to reason about and test in isolation.

As per coding guidelines, "Keep function complexity low; tracked complexity hotspots should not be expanded unnecessarily."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/sandbox-images-workflow-boundary.mts` around lines 812 - 928, Split
validateHermesImageReuse into focused helper functions for timeout and
Node-install rules, probe ordering and configuration, and artifact
download/load/save/upload validation. Keep validateHermesImageReuse as the
coordinating entry point, passing the shared errors and workflow/job data to
each helper while preserving all existing validation behavior and messages.

Source: Coding guidelines

---

392-425: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Complexity hotspot expanded with a large Hermes-specific branch.

This adds a substantial Hermes-only branch (validate-run equality check, Buildx pin check, and a 9-condition local-load contract check) directly inside the shared validateGuardedProductionBuild, which the line-range metadata already flags as high complexity. Consider extracting this into a dedicated validateHermesGuardedProductionBuild(errors, job, contract) helper so the shared function stays focused on the generic guarded-build contract.

As per coding guidelines, "Keep function complexity low; tracked complexity hotspots should not be expanded unnecessarily."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/sandbox-images-workflow-boundary.mts` around lines 392 - 425, The
shared validateGuardedProductionBuild flow has an oversized Hermes-specific
branch that increases its complexity. Extract the entire
build-hermes-sandbox-image validation, including validation-run, Buildx pinning,
and production-image action checks, into a dedicated
validateHermesGuardedProductionBuild(errors, job, contract) helper, then invoke
that helper from the shared function while preserving all existing validations
and error messages.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/e2e/sandbox-images-workflow-boundary.mts`:
- Around line 355-358: Update the buildActionWritesRegistry condition in the
step-processing logic to require record(step.with).push === true, so omitted or
false push values are treated as non-writing while only explicit pushes count as
registry writes.

---

Nitpick comments:
In `@tools/e2e/sandbox-images-workflow-boundary.mts`:
- Around line 812-928: Split validateHermesImageReuse into focused helper
functions for timeout and Node-install rules, probe ordering and configuration,
and artifact download/load/save/upload validation. Keep validateHermesImageReuse
as the coordinating entry point, passing the shared errors and workflow/job data
to each helper while preserving all existing validation behavior and messages.
- Around line 392-425: The shared validateGuardedProductionBuild flow has an
oversized Hermes-specific branch that increases its complexity. Extract the
entire build-hermes-sandbox-image validation, including validation-run, Buildx
pinning, and production-image action checks, into a dedicated
validateHermesGuardedProductionBuild(errors, job, contract) helper, then invoke
that helper from the shared function while preserving all existing validations
and error messages.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 469bf321-5e6f-4c64-a52c-a6db8ce7a1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 3a94d96 and c0ac9df.

📒 Files selected for processing (5)

• .github/workflows/sandbox-images-and-e2e.yaml
• test/e2e/README.md
• test/e2e/support/hermes-secret-boundary-workflow.test.ts
• test/e2e/support/sandbox-images-workflow-boundary.test.ts
• tools/e2e/sandbox-images-workflow-boundary.mts