…d) (#2495)

## ⚡ Interim PR — Unblocks #2306

This is an **interim extraction PR** that lands the foundational module
decomposition needed by #2306 (extract rebuild/recreate path +
canonicalize credential resolution). It is intentionally scoped to pure
code movement with no behavior changes.

Rebased onto current main. Supersedes #2087 and #2489.

---

## Summary

Steps 1–3 of the original extraction plan (authored by @ericksoa in
#2087):

- Extract `onboard-providers.ts` — provider metadata, CRUD, labels,
inference config
- Extract `onboard-ollama-proxy.ts` — proxy lifecycle, model
pull/validate
- Extract `onboard-inference-probes.ts` — endpoint validation probes
(OpenAI, Anthropic, Gemini)

Reduces `onboard.ts` by ~1,000 lines. All 3 new modules are under 400
lines. No behavior changes — all existing exports remain accessible via
re-exports and thin wrappers.

**Step 4 (dashboard extraction) was dropped** — main already landed
`dashboard-contract.ts`, `dashboard-health.ts`, and
`dashboard-recover.ts` (#2398) which supersede that extraction.

Steps 5–10 (gateway, preflight, messaging, policies, inference-setup,
sandbox) remain deferred per the original plan.

## Downstream: #2306

`#2306` (extract rebuild/recreate path + canonicalize credential
resolution) builds directly on top of this PR. It imports
`REMOTE_PROVIDER_CONFIG`, `upsertProvider`, and `ensureOllamaAuthProxy`
from the new extracted modules via onboard.ts re-exports. Merging this
PR first gives #2306 a clean module surface to build on.

## CodeRabbit comments

All 6 comments addressed:
- 1 resolved (deleted planning doc)
- 4 are valid improvements on **pre-existing code** that was moved as-is
— intentionally out of scope for a pure extraction PR, flagged as
follow-up material
- 1 is incorrect (`upsertMessagingProviders` was never exported on main)

## Rebase notes

- Ported all main-side refinements into the extracted modules (e.g.,
`startOllamaAuthProxy` now returns `boolean`, `getProbeAuthMode` always
returns `undefined`)
- Added type annotations for the CJS `require()` imports to satisfy
strict TypeScript
- Re-imported endpoint URL constants that `onboard.ts` still references
after extraction

## Test plan

- [x] `npx tsc -p tsconfig.src.json --noEmit` compiles cleanly
- [x] `npx tsc -p tsconfig.cli.json --noEmit` compiles cleanly
(pre-existing failures only, same as main)
- [x] Affected tests pass: gemini-probe-auth, credential-exposure,
wsl2-probe-timeout
- [x] CI: all 15 checks green
- [ ] Manual smoke test: `nemoclaw onboard` completes successfully

Co-authored-by: Aaron Erickson <aerickson@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Reorganized onboarding logic into modular utilities for improved code
maintainability and separation of concerns.
* Separated provider management, inference endpoint validation, and
Ollama proxy lifecycle into dedicated modules.

* **Tests**
  * Updated tests to reflect new code organization structure.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Aaron Erickson <aerickson@nvidia.com>

…d) (NVIDIA#2495)

## ⚡ Interim PR — Unblocks NVIDIA#2306

This is an **interim extraction PR** that lands the foundational module
decomposition needed by NVIDIA#2306 (extract rebuild/recreate path +
canonicalize credential resolution). It is intentionally scoped to pure
code movement with no behavior changes.

Rebased onto current main. Supersedes NVIDIA#2087 and NVIDIA#2489.

---

## Summary

Steps 1–3 of the original extraction plan (authored by @ericksoa in
NVIDIA#2087):

- Extract `onboard-providers.ts` — provider metadata, CRUD, labels,
inference config
- Extract `onboard-ollama-proxy.ts` — proxy lifecycle, model
pull/validate
- Extract `onboard-inference-probes.ts` — endpoint validation probes
(OpenAI, Anthropic, Gemini)

Reduces `onboard.ts` by ~1,000 lines. All 3 new modules are under 400
lines. No behavior changes — all existing exports remain accessible via
re-exports and thin wrappers.

**Step 4 (dashboard extraction) was dropped** — main already landed
`dashboard-contract.ts`, `dashboard-health.ts`, and
`dashboard-recover.ts` (NVIDIA#2398) which supersede that extraction.

Steps 5–10 (gateway, preflight, messaging, policies, inference-setup,
sandbox) remain deferred per the original plan.

## Downstream: NVIDIA#2306

`NVIDIA#2306` (extract rebuild/recreate path + canonicalize credential
resolution) builds directly on top of this PR. It imports
`REMOTE_PROVIDER_CONFIG`, `upsertProvider`, and `ensureOllamaAuthProxy`
from the new extracted modules via onboard.ts re-exports. Merging this
PR first gives NVIDIA#2306 a clean module surface to build on.

## CodeRabbit comments

All 6 comments addressed:
- 1 resolved (deleted planning doc)
- 4 are valid improvements on **pre-existing code** that was moved as-is
— intentionally out of scope for a pure extraction PR, flagged as
follow-up material
- 1 is incorrect (`upsertMessagingProviders` was never exported on main)

## Rebase notes

- Ported all main-side refinements into the extracted modules (e.g.,
`startOllamaAuthProxy` now returns `boolean`, `getProbeAuthMode` always
returns `undefined`)
- Added type annotations for the CJS `require()` imports to satisfy
strict TypeScript
- Re-imported endpoint URL constants that `onboard.ts` still references
after extraction

## Test plan

- [x] `npx tsc -p tsconfig.src.json --noEmit` compiles cleanly
- [x] `npx tsc -p tsconfig.cli.json --noEmit` compiles cleanly
(pre-existing failures only, same as main)
- [x] Affected tests pass: gemini-probe-auth, credential-exposure,
wsl2-probe-timeout
- [x] CI: all 15 checks green
- [ ] Manual smoke test: `nemoclaw onboard` completes successfully

Co-authored-by: Aaron Erickson <aerickson@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Reorganized onboarding logic into modular utilities for improved code
maintainability and separation of concerns.
* Separated provider management, inference endpoint validation, and
Ollama proxy lifecycle into dedicated modules.

* **Tests**
  * Updated tests to reflect new code organization structure.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Aaron Erickson <aerickson@nvidia.com>

…fixes (#3052)

## Summary

Adds `nemoclaw-maintainer-pr-comparator`: an autonomous skill that picks
the merge winner among competing PRs targeting the same issue. Runs Tier
0 plumbing gates → Tier 1 correctness checks → Tier 2 quality checks →
Tier 3 deterministic ranking. Degraded mode handles the case where no PR
passes gates.

## Why

When two contributors fix the same issue, deciding which to merge is
judgment-heavy. This skill makes that judgment deterministic,
explainable, and reusable across repos.

## What's clever (catches what CI can't)

- Reads each new test against the pre-fix code to verify the test would
have failed (catches smoke-test fakes)
- Parses issue body **and comments** for acceptance criteria (catches
"and don't break Y while you're at it")
- Refactor-vs-behavior scan flags hidden behavior changes inside what
looks like a rename
- Mocking-purity check catches tests that mock the unit under test
- Public-surface preservation flags content changes (not moves) in
flags/help/errors
- Workaround-vs-root-cause check flags symptom-suppressing try/catch
fixes without follow-up
- Behavior-coverage matrix recommends "merge A, cherry-pick B's tests
for criterion X" when no PR dominates
- Degraded mode picks closest-to-ready when neither passes gates instead
of giving up

## Validation

Backtested against 5 historical NemoClaw cases (#2681, #2947, #893,
#2636, refactor chain #2087/#2489/#2495). Initial v1: 4/5. After patches
(PR-state-OPEN gate, supersession detection, workaround-vs-root-cause
flag): 5/5.

## Skill structure (per Claude best-practices)

Slim SKILL.md (orchestration), tier checks in one-level-deep reference
files, output template extracted, five utility scripts for the
deterministic work, repo-specific assumptions in repo-policy.md for
cross-repo reuse.

```
.agents/skills/nemoclaw-maintainer-pr-comparator/
├── SKILL.md                        # orchestration only
├── repo-policy.md                  # configurable per-repo defaults
├── tiebreakers.md                  # Tier 3 + degraded mode
├── checks/
│   ├── tier-0-gates.md
│   ├── tier-1-correctness.md
│   └── tier-2-quality.md
├── templates/verdict.md
├── validation/backtest.md
└── scripts/
    ├── find-candidates.sh
    ├── collect-gates.sh
    ├── check-coderabbit-threads.sh   # GraphQL on reviewThreads.isResolved
    ├── parse-supersession.sh
    └── render-verdict.py
```

## Test plan

- [x] markdownlint clean
- [x] shellcheck clean
- [x] python compiles
- [x] Backtest 5/5 on historical cases
- [ ] Try the skill on a live duplicate-PR situation when one arises

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a user-invocable PR comparison skill to evaluate competing PRs,
run multi-tier gates, score/rank candidates, and output a recommended
merge verdict with evidence and trace.
* Added CLI helpers for candidate discovery, gate collection,
supersession detection, thread checks, and verdict rendering.

* **Documentation**
* New repo policy, tiered-check rubrics (Tier 0–3), verdict template,
and backtest/validation guides for ongoing tuning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->