Bug Report

✨ [AI-generated issue]

Description

Problem Statement

The openshell-gateway-upgrade and rebuild-hermes-stale-base nightly E2E jobs failed because the test script test/e2e/test-openshell-gateway-upgrade.sh greps for the design-intent comment "Docker-on-Colima uses normal container ownership" in src/lib/onboard.ts, but commit 27ae4c3 refactored the onboard module into src/lib/onboard/sandbox-dockerfile-patch-flow.ts, moving the code there without preserving the comment. The grep finds nothing and the assertion fires:

onboard does not keep macOS Docker sandbox builds out of the VM rootfs compatibility path

Both jobs exit non-zero on this assertion (the gateway-upgrade job in its "Verify darwinVmCompat=false" step, the rebuild-hermes-stale-base job in its initial invariant check).

Proposed Design

Two changes:

1. Restore the design-intent comment in src/lib/onboard/sandbox-dockerfile-patch-flow.ts above the false argument for darwinVmCompat in the patchStagedDockerfile() call (line 148), so the grep target exists in the codebase.
2. Update the grep path in test/e2e/test-openshell-gateway-upgrade.sh (line 449) from src/lib/onboard.ts to src/lib/onboard/sandbox-dockerfile-patch-flow.ts.

Alternatives Considered

Replacing the grep-based assertion with a unit test that imports prepareSandboxDockerfilePatch and checks the darwinVmCompat argument was considered, but that is a larger scope change better suited for a follow-up; the grep assertion is the existing pattern used by other E2E invariant checks.

Category

test_failure

Reproduction Steps

1. Check out NemoClaw at commit a3ae21b6eed8399099fd390bd45ad43e78218258
2. Run grep -Fq "Docker-on-Colima uses normal container ownership" src/lib/onboard.ts — exits non-zero (file no longer exists)
3. Run the nightly E2E suite — openshell-gateway-upgrade and rebuild-hermes-stale-base jobs fail on the invariant assertion

Environment

• OS: GitHub Actions runner (Ubuntu 22.04)
• Node.js: v22.16+
• Docker: Docker-in-Docker (GitHub Actions)
• NemoClaw: main @ a3ae21b
• Other: Nightly E2E run 27386272836

Debug Output

N/A — CI job logs available at https://github.com/NVIDIA/NemoClaw/actions/runs/27386272836

Logs

+ grep -Fq 'Docker-on-Colima uses normal container ownership' src/lib/onboard.ts
grep: src/lib/onboard.ts: No such file or directory
FAIL: onboard does not keep macOS Docker sandbox builds out of the VM rootfs compatibility path

Checklist

• I confirmed this bug is reproducible (required)
• I searched existing issues and this is not a duplicate (required)

Suggested Labels

nightly-e2e, auto-diagnosed, test-failure, e2e

Suggested Labels (apply manually after triage)

nightly-e2e, auto-diagnosed, test-failure, e2e

Related PR: #5258