fix(inference): admit private IPv6 host bridges (#13544) by deepujain · Pull Request #13582 · NVIDIA/NemoClaw

deepujain · 2026-10-21T04:56:15Z

Outcome

Express onboarding can abort with HTTP 403 when a Docker host alias resolves to a private IPv6 address such as fdc4:f303:9324::254. New local-inference profiles admit that address range while existing sandboxes keep their recorded permissions until the user reselects the local provider.

Reason

The host Ollama service and authentication proxy were healthy, but the generated provider policy admitted only private IPv4 addresses. A distinct immutable profile identity lets new selections use IPv6 without changing permissions attached to existing sandboxes.

Related issues

Fixes #13544.

Changes

Add fc00::/7 for host.openshell.internal and host.docker.internal. Preserve the selected host, port, paths, methods, executable permissions, and credential reference. Literal private IPv4 endpoints retain their /32 restriction.
Preserve recorded IPv4-only profiles for verification, resume, rebuild, and cleanup. OpenClaw and Hermes reselection use the existing ownership transaction, including rollback on publication failure.
Keep TC-INF-19 for a prepared WSL2 Docker Desktop host. It requires IPv6-only ULA resolution, authenticated sandbox chat, and explicit policy denials for public, link-local, and loopback IPv6. Lower-layer tests cover resolution classification and fixture behavior.
Keep the native-Docker WSL lane on its existing full E2E suite, with revision verification. Its Ubuntu Docker installation does not configure IPv6-only host aliases, so it cannot run the Docker Desktop proof. Shell-execution regression tests protect both full-suite success and failure propagation.
Clarify private IPv4 and IPv6 host-alias permissions in the troubleshooting guide. Include main's model-selection fix from fix(e2e): select Nemotron 3.5 Super VL for public NVIDIA targets #13583 so the E2E catalogue uses Super VL and its reviewed response-model mapping.

Verification

The new workflow regression ran against a5133fa before repair. Both native-Docker cases reproduced the defect: full-suite statuses 0 and 17 became 42 when the script invoked the unsupported IPv6 scenario. The same cases pass after repair and preserve their original statuses.

With Node 24.18.1 and NEMOCLAW_TEST_TIMEOUT=60000, this command passed all 82 tests across three suites:

node node_modules/vitest/vitest.mjs run --maxWorkers=1 --project integration test/automation/e2e/platform-vitest-main-workflow.test.ts --project e2e-support test/e2e/support/native-local-ipv6-evidence.test.ts test/e2e/support/onboard-timeout-contract.test.ts

Historical policy reproduction: both host-alias regression cases failed before the original fix because fdc4:f303:9324::254 was excluded. At 3743603, nine focused suites passed all 391 tests. Policy and selection code are unchanged by this workflow repair.
Historical E2E on a5133fa passed. The Advisor run on that head had no P0/P1 findings, but Require no Advisor blockers failed on six unresolved WSL E2E recommendations. Those results do not validate this updated commit. Fresh CI, image checks, automated reviews, and applicable E2E are pending.
WSL2 ARM Docker Desktop qualification has not run. No supported manual PR selector supplies that environment. The native-Docker WSL lane and Ubuntu catalogue runs do not establish that qualification.
On 32f7d712bd10a6ea7a476961acecd8b43a5f3690, normal commit hooks, pre-push publication validation, and CLI TypeScript checks passed. The diff contains no secrets, API keys, credentials, or unrelated dependency changes.

Review notes

Decision: accept the existing host-alias policy repair. Reason: the reported private IPv6 bridge falls outside the generated profile. Placement: profile generation and identity, existing selection owners, provider guidance, and the existing IPv6 live test. Validation plan: profile and selection tests, workflow and fixture contracts, publication checks, and WSL2 ARM Docker Desktop qualification. Existing permissions change only through explicit reselection.

The workflow review identified a valid mismatch between the native-Docker runner and the required IPv6-only network. The repair removes that incompatible invocation and its extra timeout and artifact handling. Every live IPv6 assertion remains intact. This preserves the existing workflow trust boundary and full-suite behavior. A new trusted qualification lane remains separate work; this decision neither clears the Advisor gate nor waives the missing live evidence.

Self-review of 32f7d712bd10a6ea7a476961acecd8b43a5f3690 covers the workflow repair, executable regression cases, test guidance, and timeout comment. Independent re-review is pending. The sensitive native-local policy, identity, selection, and rollback implementation is unchanged by this repair. The existing eight added live assertion points retain their recorded growth approval. No live assertion or growth record changes here. DGX Station validation is not applicable.

Signed-off-by: Deepak Jain deepujain@gmail.com

Summary by CodeRabbit

New Features
- Native local connections now support private IPv6 unique-local addresses when resolved through approved host aliases.
- IPv4-only and dual-stack profiles are distinguished while preserving existing permissions and connection receipts.
- Native local provider switching now correctly handles profile changes and restores the previous connection if persistence fails.
Bug Fixes
- Public, link-local, loopback, and unsupported literal IPv6 endpoints remain blocked.
- Private IPv4 literal endpoints remain restricted to exact host addresses.
Documentation
- Added troubleshooting guidance for Docker Desktop WSL IPv6 resolution and native-local endpoint restrictions.

Give new host-alias profiles a dual-stack boundary and a distinct identity. Preserve recorded IPv4 permissions and use the existing selection transaction to replace them safely. Signed-off-by: Deepak Jain <deepujain@gmail.com>

copy-pr-bot · 2026-10-21T04:56:19Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

coderabbitai · 2026-10-21T04:56:23Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6009987e-759f-4310-813e-01541050f782

📥 Commits

Reviewing files that changed from the base of the PR and between a5133fa and 32f7d71.

📒 Files selected for processing: 3

.github/workflows/platform-vitest-main.yaml
test/automation/e2e/platform-vitest-main-workflow.test.ts
test/e2e/README.md

🚧 Files skipped from review as they are similar to previous changes: 1

test/e2e/README.md

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

The change adds IPv6 unique-local support to native-local profiles, updates profile identity and attachment switching, and adds WSL-specific IPv6 end-to-end coverage. It also adds a checkout revision check to the WSL workflow and updates related tests, budgets, and documentation.

Changes: Native-local IPv6 policy and validation

Layer / File(s)	Summary
Profile identity and address policy `.agents/references/provider-profile-inventory.md`, `src/lib/inference/native-local/contract.ts`, `src/lib/inference/native-local/profile.ts`, `src/lib/inference/native-local/profile.test.ts`, `src/lib/inference/native-local.test.ts`, `docs/reference/troubleshooting.mdx`	Versioned identities distinguish dual-stack profiles from legacy profiles. Hostname-based policies allow `fc00::/7` for dual-stack profiles. Tests cover IPv4 and IPv6 boundaries, legacy compatibility, and profile validation.
Identity-aware attachment switching `src/lib/actions/inference-set/native-local.ts`, `src/lib/actions/inference/native-local.ts`, `src/lib/actions/inference-set-openclaw-native-local.test.ts`, `test/helpers/inference-set-openclaw-native-local.ts`, `src/lib/inference/native-local.test.ts`	Native-local selection replaces retained attachments when their profile identity does not match the derived identity. Tests cover reselection, failed registry persistence, provider setup, and profile collisions.
WSL IPv6 end-to-end validation `test/e2e/fixtures/inference-routing-openclaw-native.ts`, `test/e2e/fixtures/native-local-ipv6-evidence.ts`, `test/e2e/support/native-local-ipv6-evidence.test.ts`, `test/e2e/live/openclaw-inference-switch.test.ts`, `test/e2e/support/openclaw-inference-switch-baseline.test.ts`, `test/e2e/mock-parity.json`, `test/e2e/support/inference-switch-workflow-boundary.test.ts`, `tools/e2e/target-catalogue.mts`, `test/e2e/README.md`	The WSL-only test checks ULA-only resolution, authenticated IPv6 inference, and HTTP 403 policy denials for public, link-local, and loopback IPv6 destinations.
WSL workflow and retained evidence `.github/workflows/platform-vitest-main.yaml`, `test/automation/e2e/platform-vitest-main-workflow.test.ts`, `ci/e2e-assertion-budget.json`, `ci/e2e-assertion-growth-exceptions.json`	The WSL workflow checks that the checkout revision matches `GITHUB_SHA`. Workflow tests and assertion budgets cover the added checks and live-test assertions.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant TCINF19 as TC-INF-19
  participant Sandbox
  participant OpenClawFixture as OpenClaw host fixture
  TCINF19->>Sandbox: Probe host.openshell.internal resolution
  Sandbox-->>TCINF19: Return resolved addresses
  TCINF19->>OpenClawFixture: Start IPv6 listener
  Sandbox->>OpenClawFixture: Send authenticated inference request
  OpenClawFixture-->>Sandbox: Return inference response
  TCINF19->>Sandbox: Request public, link-local, and loopback IPv6 destinations
  Sandbox-->>TCINF19: Return policy_denied with HTTP 403

Suggested reviewers: prekshivyas

Merge Risk: ⚪ Minimal · up to 32f7d

No actionable issue remains in the reviewed changes. The PR is mergeable after normal checks; prepared-host WSL2 ARM qualification remains outstanding.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 53.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 17 files. (2 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the primary change: allowing private IPv6 host bridges for inference. It is concise and directly related to the pull request.
Linked Issues check		The PR meets the coding requirements in [`#13544`]. Native-local profiles allow `fc00::/7` for the approved host aliases and retain hostname, port, and endpoint restrictions. Literal private IPv4 profil…
Out of Scope Changes check		The changes remain within [`#13544`] and the PR's stated validation scope. Profile identity and selection changes implement the compatibility behavior. IPv6 fixtures, `TC-INF-19`, workflow guards, and c…

Full details: Linked Issues check

Explanation

The PR meets the coding requirements in [#13544]. Native-local profiles allow fc00::/7 for the approved host aliases and retain hostname, port, and endpoint restrictions. Literal private IPv4 profiles retain their /32 permissions. Distinct identities preserve existing IPv4-only attachments until explicit reselection. OpenClaw and Hermes switching retain transaction and rollback behavior. Automated tests cover policy boundaries, identity, attachment lifecycle, IPv6 evidence, and workflow status preservation. The live WSL2 ARM qualification remains unrun, but the available evidence does not show a coding requirement failure.

Full details: Out of Scope Changes check

Explanation

The changes remain within [#13544] and the PR's stated validation scope. Profile identity and selection changes implement the compatibility behavior. IPv6 fixtures, TC-INF-19, workflow guards, and catalogue updates validate the affected environment and prevent unsupported execution. Troubleshooting guidance documents the repaired policy. Assertion-budget and model-selection updates support the affected E2E catalogue. No unrelated production feature, dependency, secret, or credential change is shown.

Full details: Docstring Coverage

Explanation

Docstring coverage is 53.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 17 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-10-21T04:57:43Z

Code coverage overview

Languages: TypeScript

TypeScript / code-coverage/plugin

main 63002cd	fix/13544-native-loc... 32f7d71	+/-
96%	97%	+1%

View coverage of the 10 most impacted files.

File	main 63002cd	fix/13544-native-loc... 32f7d71	+/-
`nemoclaw/src/onboard/config.ts`	98%	96%	-2%
`nemoclaw/src/index.ts`	94%	93%	-1%
`nemoclaw/src/bl...print/runner.ts`	95%	95%	0%
`nemoclaw/src/bl...ime-identity.ts`	97%	97%	0%
`nemoclaw/src/bl...t-management.ts`	100%	100%	0%
`nemoclaw/src/co.../config-show.ts`	100%	100%	0%
`nemoclaw/src/commands/slash.ts`	100%	100%	0%
`nemoclaw/src/ru...time-context.ts`	100%	100%	0%
`nemoclaw/src/sh...er-boundary.cts`	100%	100%	0%
`nemoclaw/src/on...native-route.ts`	0%	100%	+100%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

_{Updated October 21, 2026 20:51 UTC}

deepujain · 2026-10-21T05:33:03Z

NemoClaw-E2E-Growth: approve 90b021fd5c15eac87cc230ec2310b4b81fcbf2e7ce50c08b31775232d1dbc38e

Add a WSL Docker scenario that rejects IPv4 fallback and verifies native chat admission plus IPv6 policy denials. Keep resolver parsing and fixture checks in the support lane, and bind the live assertion growth to its recorded maintainer approval. Signed-off-by: Deepak Jain <deepujain@gmail.com>

Model conditional registration in the baseline fixture mock so importing IPv6 coverage preserves the existing baseline checks. Exercise those checks on both WSL and ordinary Linux host identities. Signed-off-by: Deepak Jain <deepujain@gmail.com>

Run TC-INF-19 in the existing WSL live lane and retain artifacts for the tested revision when either live suite fails. Reject skipped IPv6 evidence and describe Ubuntu and WSL coverage separately. Move the IPv6 scenario allowance from the Ubuntu target to the WSL shard. Signed-off-by: Deepak Jain <deepujain@gmail.com>

Include the public NVIDIA model selection fix from #13583 so the inference-switch E2E uses Super VL instead of the retired model that returns HTTP 404. Preserve the private IPv6 policy repair and existing live assertions. Signed-off-by: Deepak Jain <deepujain@gmail.com>

Show that approved host aliases can resolve to an IPv6 unique-local address. Retain the address and endpoint restrictions, and distinguish DNS resolution from host-service reachability. Signed-off-by: Deepak Jain <deepujain@gmail.com>

github-actions · 2026-10-21T17:01:03Z

🌿 Preview your docs: https://nvidia-preview-pr-13582.docs.buildwithfern.com/nemoclaw

github-actions · 2026-10-21T17:26:25Z

PR Review Advisor finished for commit a5133fa. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

deepujain · 2026-10-21T18:52:03Z

Ready for review at a5133fa, fixing #13544.

New local-inference profiles allow approved Docker host aliases to resolve to private IPv6 addresses, including fdc4:f303:9324::254.

CI, the container images, E2E, the Advisor and CodeRabbit are green on this head, all commits are verified and no review threads are open.

prekshivyas

Found one blocking workflow issue in commit a5133fa: the WSL job requires IPv6-only host-alias resolution without configuring that network prerequisite. Validation: 166 focused tests passed across six suites. WSL live execution was not run.

prekshivyas · 2026-10-21T20:16:27Z

+          uname -a > "`$E2E_ARTIFACT_DIR/platform.txt"
+          docker info --format '{{.OperatingSystem}} {{.Architecture}} {{.ServerVersion}}' > "`$E2E_ARTIFACT_DIR/docker.txt"
+          ipv6_status=0
+          npx vitest run --project e2e-live test/e2e/live/openclaw-inference-switch.test.ts -t '^TC-INF-19' --silent=false --reporter=default --reporter=junit --outputFile.junit=.e2e/wsl-ipv6/junit.xml || ipv6_status=`$?


[P1] Configure IPv6 networking before requiring IPv6-only proof

This job installs native Ubuntu docker.io, and Start-WslContainerRuntime only unmasks and starts docker.service. Neither the workflow nor that helper provisions an IPv6 ULA bridge or an IPv6-only mapping for host.openshell.internal. Native Docker therefore supplies an IPv4 bridge address, which the new TC-INF-19 assertion at openclaw-inference-switch.test.ts:1471 explicitly rejects. The mandatory JUnit check then fails the main-branch WSL job even when the policy fix works. Binding the fixture to :: does not change the alias resolution. Configure the required IPv6-only route before invoking this test, or use a runner that supplies it.

The native Docker runner does not provision IPv6-only host aliases. Keep its existing full suite and retain TC-INF-19 for a prepared host. Exercise the workflow shell with native Docker inputs and both full-suite results so an unsupported IPv6 invocation cannot hide the suite result. Signed-off-by: Deepak Jain <deepujain@gmail.com>

prekshivyas

Re-reviewed commit 32f7d71. The previous P1 is addressed: native-Docker WSL CI no longer invokes the incompatible IPv6-only scenario, and executable regression tests preserve full-suite success and failure exit codes. No additional actionable code findings.

Validation: 230 tests passed across eight focused suites covering profile compatibility, selection and rollback, IPv6 fixtures, and workflow behavior.

Approving the code review. CI and automated reviews are still running, and WSL2 ARM Docker Desktop qualification remains unverified. This approval does not waive required checks or establish that platform qualification.

fix(inference): admit private IPv6 host bridges (#13544)

3743603

Give new host-alias profiles a dual-stack boundary and a distinct identity. Preserve recorded IPv4 permissions and use the existing selection transaction to replace them safely. Signed-off-by: Deepak Jain <deepujain@gmail.com>

deepujain self-assigned this Oct 21, 2026

deepujain added 3 commits October 20, 2026 22:42

deepujain marked this pull request as ready for review October 21, 2026 14:02

deepujain added 2 commits October 21, 2026 08:24

deepujain requested review from prekshivyas and rsliter October 21, 2026 18:52

prekshivyas requested changes Oct 21, 2026

View reviewed changes

prekshivyas approved these changes Oct 21, 2026

View reviewed changes

prekshivyas merged commit 6669f70 into main Oct 21, 2026
102 of 104 checks passed

prekshivyas deleted the fix/13544-native-local-ipv6 branch October 21, 2026 21:16

github-actions Bot added the v0.0.138 Release target label Oct 21, 2026

Navigation Menu

Repository navigation

fix(inference): admit private IPv6 host bridges (#13544) - #13582

fix(inference): admit private IPv6 host bridges (#13544)#13582
prekshivyas merged 7 commits into
mainfrom
fix/13544-native-local-ipv6

deepujain commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

copy-pr-bot Bot commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Sequence Diagram(s)

Uh oh!

github-code-quality Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

deepujain commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

deepujain commented Oct 21, 2026

Uh oh!

prekshivyas left a comment

Uh oh!

prekshivyas Oct 21, 2026

Uh oh!

prekshivyas left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

deepujain commented Oct 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Reason

Related issues

Changes

Verification

Review notes

Summary by CodeRabbit

Uh oh!

copy-pr-bot Bot commented Oct 21, 2026

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sequence Diagram(s)

Uh oh!

github-code-quality Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code coverage overview

TypeScript / code-coverage/plugin

Uh oh!

deepujain commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

deepujain commented Oct 21, 2026

Uh oh!

prekshivyas left a comment

Choose a reason for hiding this comment

Uh oh!

prekshivyas Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

prekshivyas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

deepujain commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

github-code-quality Bot commented Oct 21, 2026 •

edited

Loading