Merge branch 'main' into fix/10085-config-get-doc-example

Author: cv

.agents/skills/nemoclaw-maintainer-fix-e2e-failures/references/review-and-merge.md

@@ -57,7 +57,7 @@ from an `origin/main` worktree. Remove the temporary worktree after the decision
 interrupted or denied run.
 
 Use one supported `kind`: `ambiguous-write`, `fork-workflow-approval`, `review`, `merge`, or
-`post-merge-e2e`. The executable scenarios in `test/maintainer-fix-e2e-policy.test.ts` define each
+`post-merge-e2e`. The executable scenarios in `test/automation/pull-requests/maintainer-fix-e2e-policy.test.ts` define each
 required state field.
 
 Perform only the entry returned in `allowedWrites`. An empty list denies the requested write.

.agents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md

@@ -169,7 +169,7 @@ Run the existing deterministic checks rather than inventing another route model:
 ```bash
 npm run docs:sync-agent-variants
 npm run docs
-npx vitest run test/check-docs-published-routes.test.ts test/check-docs-links.test.ts
+npx vitest run test/generation/check-docs-published-routes.test.ts test/generation/check-docs-links.test.ts
 git diff --check
 ```
 

.agents/skills/nemoclaw-maintainer-runtime-provider/references/implementation-and-review.md

@@ -54,7 +54,7 @@ npx vitest run --project cli \
   src/lib/onboard/runtime-provider/runtime-provider-contract.test.ts \
   src/lib/onboard/runtime-provider/activation.test.ts \
   src/lib/onboard/runtime-provider/<provider>.test.ts
-npx vitest run --project integration test/layer-import-boundaries.test.ts
+npx vitest run --project integration test/repository/layer-import-boundaries.test.ts
 npx vitest run --project e2e-support test/e2e/support/native-runtime-qualification.test.ts
 ```
 

.dsh/tools/infer_validation_for_changed_files/index.ts

@@ -58,8 +58,8 @@ export default async function infer_validation_for_changed_files(input: {
     }
     if (/agents\/langchain-deepagents-code\/Dockerfile|corporate-ca/.test(file)) {
       [
-        "test/corporate-ca-build-tls-anchor.test.ts",
-        "test/corporate-ca-dockerfile-decode.test.ts",
+        "test/security/corporate-ca-runtime-merge.test.ts",
+        "test/install/corporate-ca-dockerfile-decode.test.ts",
         "src/lib/onboard/corporate-ca-host-anchors.test.ts",
         "src/lib/onboard/dockerfile-patch-corporate-ca.test.ts",
       ].forEach((x) => tests.add(x));

.github/workflows/codebase-growth-guardrails.yaml

@@ -41,4 +41,4 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
-          npx vitest run --project integration test/growth-guardrails.test.ts
+          npx vitest run --project integration test/automation/pull-requests/growth-guardrails.test.ts

.github/workflows/e2e.yaml

@@ -313,7 +313,7 @@ jobs:
           case "${JOBS}:${TARGETS}" in
             :)
               matrix='[{"id":"ubuntu-policy-custom-missing-presets-negative","runner":"ubuntu-latest"},{"id":"ubuntu-repo-cloud-langchain-deepagents-code","runner":"ubuntu-latest"},{"id":"ubuntu-repo-cloud-openclaw","runner":"ubuntu-latest"},{"id":"ubuntu-repo-docker-post-reboot-recovery","runner":"ubuntu-latest"}]'
-              test_matrix='[{"id":"onboard-managed-image-buildless-e2e","file":"test/onboarding/onboard-managed-image-buildless-e2e.test.ts","project":"integration"},{"id":"vllm-docker-storage","file":"test/vllm-docker-storage.test.ts","project":"integration"}]'
+              test_matrix='[{"id":"onboard-managed-image-buildless-e2e","file":"test/onboarding/onboard-managed-image-buildless-e2e.test.ts","project":"integration"},{"id":"vllm-docker-storage","file":"test/platform/images/vllm-docker-storage.test.ts","project":"integration"}]'
               ;;
             inference-routing: | managed-image-protected-runtime: | native-runtime-qualification-producer: | :jetson-nvmap-gpu)
               matrix='[]'

.github/workflows/main.yaml

@@ -120,6 +120,9 @@ jobs:
       - name: Install test dependencies
         run: npm ci --ignore-scripts
 
+      - name: Build generated harness inputs
+        run: npm run build:policy-boundary && npm run catalog:compile
+
       - name: Audit the real patched OpenClaw distribution
         env:
           NEMOCLAW_REAL_OPENCLAW_DIST_HARNESS: "1"

.github/workflows/platform-vitest-main.yaml

@@ -75,7 +75,7 @@ jobs:
           npx vitest run --project cli \
             src/lib/onboard/preflight.test.ts \
             src/lib/onboard/preflight-ubuntu-2604.test.ts
-          npx vitest run --project integration test/platform.test.ts
+          npx vitest run --project integration test/e2e-runtime/platform.test.ts
           npx vitest run --project installer-integration \
             --testTimeout 30000 \
             test/installer-integration/install-preflight.test.ts

.github/workflows/pr-self-hosted.yaml

@@ -306,7 +306,7 @@ jobs:
         env:
           NEMOCLAW_RUN_GLIBC_PROBE_DOCKER_E2E: "1"
           NEMOCLAW_TEST_IMAGE: nemoclaw-production
-        run: npx vitest run --project integration test/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default
+        run: npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default
 
       - name: Run gateway isolation E2E tests
         run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-gateway-isolation.sh

.github/workflows/sandbox-images-and-e2e.yaml

@@ -548,7 +548,7 @@ jobs:
         env:
           NEMOCLAW_RUN_GLIBC_PROBE_DOCKER_E2E: "1"
           NEMOCLAW_TEST_IMAGE: nemoclaw-production
-        run: npx vitest run --project integration test/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default
+        run: npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default
 
       - name: Run gateway isolation E2E tests
         run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-gateway-isolation.sh