fix(ci): run reviewed control-plane E2E

[cv]

Summary

Controller-only internal PRs now automatically dispatch the selected exact-SHA E2E jobs instead of requiring a no-run exception. Internal changes that alter PR-controlled E2E execution or evidence code require an explicit maintainer/admin run-control-plane authorization, then use the normal dispatch, wait, evidence, and finish path so only verified results can clear E2E / PR Gate. Fork handling remains a no-secret exception.

Related Issue

Part of #6145

Changes

• Treat only .github/workflows/pr-e2e-gate.yaml and tools/e2e/pr-e2e-gate.mts as controller-only control-plane changes eligible for automatic internal dispatch.
• Replace the internal resolve-control-plane no-run waiver with exact-head/base run-control-plane authorization that requires maintain or admin and dispatches the selected jobs.
• Serialize automatic and manual coordination on the exact head SHA, preserve a retryable failure after authorized-start errors, and keep success exclusive to verified evidence.
• Expand command, workflow, risk-plan, lifecycle, authorization, retry, origin, and fix(ci): clarify E2E gate outcomes #6821 regression coverage; update contributor and maintainer E2E guidance.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer-directed scope; an independent implementation audit found no success bypass, identified two lifecycle races, and both were fixed and retested before submission.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/pr-risk-plan.test.ts test/pr-e2e-gate-command.test.ts test/pr-e2e-gate-workflow.test.ts test/pr-e2e-gate-exceptions.test.ts test/pr-e2e-gate.test.ts (154 passed)
• Applicable broad gate passed — local npm test did not complete: after eight minutes it remained on one idle integration worker with an orphaned persistent-log tail -F; the process was terminated and GitHub CI is required for the broad verdict.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• New Features

  • Added maintainer-authorized, exact-revision execution for control-plane E2E checks.
  • Added clearer fork exception resolution with validated evidence links and protected approvals.
  • Improved risk-based handling of E2E changes and credentialed test authorization.

• Bug Fixes

  • Prevented unauthorized or outdated control-plane and fork workflows from dispatching E2E jobs.
  • Improved cancellation and supersession handling when pull requests change.

• Documentation

  • Updated E2E gate guidance, authorization requirements, exception workflows, and manual recovery steps.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f1cca525-c606-448d-a89d-2406e5cf1c04

📥 Commits

Reviewing files that changed from the base of the PR and between 7b13829 and abc2d05.

📒 Files selected for processing (11)

• .agents/skills/nemoclaw-maintainer-day/MERGE-GATE.md
• .github/workflows/pr-e2e-gate.yaml
• test/e2e/README.md
• test/e2e/docs/README.md
• test/pr-e2e-gate-command.test.ts
• test/pr-e2e-gate-exceptions.test.ts
• test/pr-e2e-gate-workflow.test.ts
• test/pr-e2e-gate.test.ts
• test/pr-risk-plan.test.ts
• tools/advisors/risk-plan.mts
• tools/e2e/pr-e2e-gate.mts

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/e2e-gate-dispatch-results

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/e2e-gate-dispa... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main b85f5b2	codex/e2e-gate-dispa... abc2d05	+/-
src/lib/security/redact.ts	99%	95%	-4%
src/lib/security/redact-url.ts	98%	96%	-2%
src/lib/securit...ntial-filter.ts	98%	99%	+1%
src/lib/adapter...shell/client.ts	83%	85%	+2%
src/lib/runner.ts	72%	75%	+3%
src/lib/messagi...nes/template.ts	95%	100%	+5%
src/lib/messagi...ate-resolver.ts	95%	100%	+5%
src/lib/name-validation.ts	94%	100%	+6%
src/lib/messagi...ate-resolver.ts	76%	82%	+6%
src/lib/messagi...ink-base-url.ts	90%	100%	+10%

---

_{Updated July 14, 2026 04:35 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 blockers · 0 warnings · 0 optional suggestions
Status: PR review advisor failed: PR review advisor SDK execution failed: session: correctness-state-analysis omitted required analysis; turn: correctness-state-analysis: correctness-state-analysis omitted required analysis

Model lanes

• GPT-5.6 Terra (primary): Failed
• Nemotron 3 Ultra (non-blocking second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions

Nemotron is a non-blocking second opinion. Its prose, findings, and E2E guidance do not change the primary assessment above and remain in workflow artifacts only.

E2E guidance

Advisory only: coverage and selector recommendations are non-authoritative. E2E / PR Gate independently computes and dispatches trusted jobs without consuming this output.

Recommended coverage: cloud-onboard, credential-sanitization, security-posture
Recommended selectors: cloud-onboard, credential-sanitization, security-posture

• cloud-onboard — Selected from the trusted checked-in E2E coverage inventory.

• credential-sanitization — Selected from the trusted checked-in E2E coverage inventory.

• security-posture — Selected from the trusted checked-in E2E coverage inventory.

• cloud-onboard — Selected as a trusted checked-in E2E job.

• credential-sanitization — Selected as a trusted checked-in E2E job.

• security-posture — Selected as a trusted checked-in E2E job.

Workflow run details

This is an automated, non-authoritative review. Findings are inputs to maintainer adjudication. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

[cv]

Bootstrap validation for exact head abc2d050be58c32c6a860236742c7c1bedddb03c on base 7b1382924d29097e96aeecf34505c2e247d12c8d:

• CI / Pull Request passed.
• Selected E2E run 29306163329 passed cloud-onboard, credential-sanitization, and both OpenClaw/Hermes security-posture shards with plan hash f45359e56b544872f7d6aabbd1bcd337435d146cebad2c696dd96f640a22b411.
• The old-main one-time bootstrap resolver linked that run and cleared E2E / PR Gate. This PR removes the control-plane no-run resolver; future authorized control-plane runs must pass through verified evidence.
• The primary PR advisor lane failed its turn protocol with zero findings; the Nemotron lane completed at high confidence with zero blockers, warnings, or suggestions.