fix(connect): run probe-only recovery when absent authority cannot be created

[Dongni-Yang]

Summary

On Ubuntu 24.04, nemoclaw <name> connect --probe-only exits 1 with "no prior launch-readiness evidence can be accepted, but new launch-readiness authority could not be created" before running any preflight or recovery, whenever the launch-readiness authority and receipt are both securely absent and new authority creation fails (e.g. no per-user OS runtime authority in the current session).

That early exit contradicts the shipped contract in two places:

• Docs (docs/reference/commands.mdx): "A securely absent runtime authority and receipt let ordinary launch run the complete preflight without optimization if new authority creation fails, but connect --probe-only still exits nonzero because it could not publish launch-readiness evidence" — i.e. the preflight runs and only the publication fails.
• launchSandbox (src/lib/actions/sandbox/launch.ts): refuses only on decision.recoveryBlocked and runs the complete preflight for this same decision.

Change

• connectSandbox probe-only guard now exits early only when recoveryBlocked is set (a prior epoch might exist and could not be durably rotated). The securely-absent case (fenceFailed with recoveryBlocked === false) proceeds into the launch-readiness mutation gate.
• Safety is preserved: the gate independently re-verifies via checkLaunchReadinessMutationAuthority(null) that both stores are still missing before admitting the null-epoch recovery; any other state returns changed/unsafe and recovery does not run.
• After recovery, publication reports honestly: "Probe failed: complete probe and recovery succeeded, but final launch-readiness evidence could not be verified or published." (exit 1, per the documented Linux contract). Lifecycle callers with requireLaunchReadinessPublication: false now continue after recovery instead of failing before it.
• Rewrote the test that pinned the early exit (connect-flow.test.ts) to assert recovery runs, publication is attempted, and the misleading message is gone.

Why Refs, not Closes

The issue's Expected Result asks for exit 0. The documented contract deliberately keeps connect --probe-only nonzero on Linux when evidence cannot be published, because a missing per-user runtime authority is a deployment signal infrastructure must repair. This PR fixes the defective part — recovery not running and the misleading refusal — and keeps the documented exit code. If maintainers want exit 0 for the securely-absent case (mirroring #9282's treatment of platform-unsupported evidence), that is a small follow-up on top of this change.

With this fix, the reproduction now prints "Probe complete: … restored dashboard port forward." followed by the honest publication failure, instead of refusing to recover at all.

Refs #9280

Testing

• npx vitest run src/lib/actions/sandbox/connect-flow.test.ts (35 passed)
• npx vitest run test/cli/connect-recovery.test.ts (5 passed)
• sibling probe/readiness suites (93 passed), npm run typecheck:cli, oxlint, npm run format:check all clean

Signed-off-by: Dongni Yang dongniy@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved probe-only sandbox connection recovery when launch-readiness checks encounter fencing issues.
  • Recovery and sandbox setup now proceed in eligible cases, with failures reported as unavailable or unverifiable evidence.
  • Removed misleading authority-creation failure reporting.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: eb063045-b76c-4403-ba57-da53c8fdafef

📥 Commits

Reviewing files that changed from the base of the PR and between 8b9a28a and 82257e3.

📒 Files selected for processing (2)

• src/lib/actions/sandbox/connect-flow.test.ts
• src/lib/actions/sandbox/connect.ts

Included review availability: Your plan includes up to 12 reviews per rolling hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

Probe-only connections now proceed through recovery after non-blocking launch-readiness fence failures. The test verifies live-sandbox setup, evidence-publication attempts, and final unavailable or unverifiable evidence reporting.

Changes

Probe-only recovery

Layer / File(s)	Summary
Recovery fencing and evidence validation src/lib/actions/sandbox/connect.ts, src/lib/actions/sandbox/connect-flow.test.ts	Probe-only recovery stops only when a non-unsupported fence failure sets recoveryBlocked. Other fence failures continue through preflight, recovery, live-sandbox setup, and evidence publication. The test validates the final evidence error.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 82257

This PR adjusts probe-only recovery so securely absent launch-readiness state can proceed through recovery while preserving the documented publication failure behavior. No actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• NVIDIA/NemoClaw#9219: Related sandbox recovery and readiness behavior.
• NVIDIA/NemoClaw#9282: Related probe-only recovery fencing and evidence classification.

Suggested labels: v0.0.110

Suggested reviewers: cv, senthilr-nv, apurvvkumaria

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enabling probe-only recovery when authority creation fails.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/9280-probe-only-pristine-recovery

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 82257e3 in the fix/9280-probe-only-... branch remains at 96%, unchanged from commit 692d1fa in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 82257e3 in the fix/9280-probe-only-... branch is 83%. The coverage in commit 97761a4 in the main branch is 82%.

Show a code coverage summary of the most impacted files.

File	main 97761a4	fix/9280-probe-only-... 82257e3	+/-
src/lib/actions...er-lifecycle.ts	94%	85%	-9%
src/lib/actions...aged-profile.ts	88%	84%	-4%
src/lib/securit...ntial-filter.ts	88%	86%	-2%
src/lib/inferen...-preparation.ts	92%	94%	+2%
src/lib/onboard...ce-lifecycle.ts	89%	93%	+4%
src/lib/trace.ts	90%	94%	+4%
src/lib/state/m...ock-identity.ts	90%	94%	+4%
src/lib/messagi...ate-resolver.ts	96%	100%	+4%
src/lib/messagi...ate-resolver.ts	88%	94%	+6%
src/lib/inferen...m-docker-env.ts	66%	73%	+7%

---

_{Updated August 17, 2026 06:28 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — launch-readiness evidence at src/lib/actions/sandbox/connect.ts:1300: Keep the established term.
• established — durably rotated at src/lib/actions/sandbox/connect.ts:1289: Keep the established term.
• replace — prior epoch at src/lib/actions/sandbox/connect.ts:1288: Replace "prior epoch" with "old runtime epoch" to match the established command documentation.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: onboard-repair, onboard-resume
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[prekshivyas]

Reviewed latest PR commit 82257e3990820225717e10724e5c5e674fa1432f. The null-epoch mutation gate revalidates secure absence of both authority and the persistent receipt before recovery. The change preserves blocking behavior for recoveryBlocked, and the focused regression plus existing lease-store tests cover the stale-state race. Required CI passes. I found no blocking correctness or security finding.