Repository navigation
build(fabric): pin Fabric main so OpenClaw starts in OpenShell sandboxes - #13698
Merged
Merged
Conversation
Fixes #13372 on `v1`; close it by hand after merge, since PRs into `v1` don't close issues. ## Failure With Fabric v0.5.0, OpenClaw can't start in an OpenShell sandbox: Fabric's adapter launches its Gateway through `setpriv`, which the sandbox refuses (NVIDIA/NeMo-Fabric#430). Fabric fixed that on `main` in NVIDIA/NeMo-Fabric#434, but hasn't released it, and `release/0.5` has no fixes after v0.5.0. Fabric v0.5.0 also pins Claude Agent SDK 0.2.120, which has a fixable Critical advisory (GHSA-h4mw-j7qp-8mwm). ## Decision Pin Fabric `main` at `67acf1cf` and use what it publishes, without patching it. NemoClaw has pinned unreleased Fabric commits before (`24f068c`, `6c08337`). - **Pins:** the image's `FABRIC_REVISION` and `FABRIC_SHA256`, and `nemo-fabric-core` (now 0.6.0) in three crates. `Cargo.lock` also moves three crates' Windows-only `windows-sys` from 0.61.2 to 0.52.0. - **Catalog:** regenerated. Only Claude's descriptor changes: a usage schema and the `max_buffer_size` setting. - **New `system_stats` section:** Fabric's invocation stats settings become a `fabric_agent` input like every other Fabric section, so none is dropped; the provider schema snapshot gains its block. - **OpenClaw:** Fabric `main` still supports only OpenClaw 2026.9.4, so the OpenClaw image pin stays. - **Docs:** the getting-started, Kubernetes, limits, and design notes no longer say OpenClaw can't start. The GTC DC OpenClaw template is marked not yet run, rather than failing. Docs links follow the new revision, and "Fabric v0.5.0 has no per-model API field" now says "the pinned Fabric": `main` still has none (#13320). - **`docs/build.md`:** the catalog regeneration command now passes `--adapter` for each adapter, which `catalog.py` requires. - **Live suites:** they still run Pi, the smallest agent image; the comment no longer waits on #13372. The dependency-upgrade test (`fabric_live::dependency_upgrade_survives_apply_process_exit`) had gone stale on `v1`, independently of Fabric. It now requests JSON output from `nemoclaw apply`, flattens the sandbox state into gateway binding fields, and builds the invocation binding with `fabric_binding`, as the dummy-agent live test does. One behavior change to note: Fabric `main`'s `fabric-agent-ctl invoke` requires its input to be one JSON value, such as `"Reply with exactly READY."`. v0.5.0 also accepted plain text. NemoClaw's docs and code already send JSON. Findings this doesn't fix, because they're in Fabric's v0.5.0 lock and still on `main`: certifi 2026.5.20, starlette 1.0.1, and aiohttp 3.14.3. ## Validation On a GB10 (Linux ARM64): - `cargo ci`: 1,611 unit tests and 156 lifecycle tests pass. - All 11 agent images build and qualify with `cargo images qualify`. - Docker, with the bundle from this branch and managed Ollama serving `qwen3:0.6b`: OpenClaw, Hermes, Deep Agents, OpenCode, and Pi start, and each answers a request through `fabric-agent-ctl` in its sandbox. Replan reports 32 resources unchanged, the exported configuration plans without changes, and destroy succeeds. - `cargo ci live-kind` (7 tests) and `cargo ci live-docker` (9 tests) pass with the live agent temporarily switched to OpenClaw, then reverted to Pi. - `fabric_live::dependency_upgrade_survives_apply_process_exit` passes with OpenClaw and an independent Ollama endpoint. - The Claude image has Claude Agent SDK 0.2.165. - `nemoclaw-build fern check` reports 0 errors. Not run here: `live-kind` on AMD64, the Brev, Spark, and hosted-parity live tests, and the GTC DC OpenClaw template on DGX Spark. Signed-off-by: Carlos Villela <cvillela@nvidia.com>
cv
enabled auto-merge (squash)
October 25, 2026 03:05
Contributor
|
v1 documentation preview: https://nvidia-preview-nemoclaw-v1-pr-13698.docs.buildwithfern.com/nemoclaw |
cv
disabled auto-merge
October 25, 2026 11:56
Fabric main starts another runtime once the previous one stops, so the reference test now expects a second start to succeed with a new runtime ID instead of runtime_exists. Fabric main's Pi adapter requires input types and cost for a model it doesn't ship, so the Kubernetes live and OIDC tests give Pi both, alongside its context window. CI's live-kind runs Pi and failed to start it without them. Validation: the image check group (lint, unit, reference, and proxy tests) and cargo ci live-kind with Pi pass on Linux ARM64. Signed-off-by: Carlos Villela <cvillela@nvidia.com>
1 task done
Fabric main starts another runtime in a sandbox after a stop, and refuses one only after a start with unknown effects. The fake gateway now does the same, and comments and docs no longer give Fabric's old one-runtime rule as the reason NemoClaw replaces sandboxes. A start whose reply was lost still can't be retried safely in the same sandbox (NVIDIA/NeMo-Fabric#487). The SDK already replaces the sandbox; docs/provider.md now tells direct OpenTofu users to do the same. Signed-off-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #13372 on
v1; close it by hand after merge, since PRs intov1don't close issues.Failure
With Fabric v0.5.0, OpenClaw can't start in an OpenShell sandbox: Fabric's adapter launches its Gateway through
setpriv, which the sandbox refuses (NVIDIA/NeMo-Fabric#430). Fabric fixed that onmainin NVIDIA/NeMo-Fabric#434, but hasn't released it, andrelease/0.5has no fixes after v0.5.0.Fabric v0.5.0 also pins Claude Agent SDK 0.2.120, which has a fixable Critical advisory (GHSA-h4mw-j7qp-8mwm).
Decision
Pin Fabric
mainat67acf1cfand use what it publishes, without patching it. NemoClaw has pinned unreleased Fabric commits before (24f068c,6c08337).FABRIC_REVISIONandFABRIC_SHA256, andnemo-fabric-core(now 0.6.0) in three crates.Cargo.lockalso moves three crates' Windows-onlywindows-sysfrom 0.61.2 to 0.52.0.max_buffer_sizesetting.system_statssection: Fabric's invocation stats settings become afabric_agentinput like every other Fabric section, so none is dropped; the provider schema snapshot gains its block.mainstill supports only OpenClaw 2026.9.4, so the OpenClaw image pin stays.mainstill has none (Per-model API selection for agents is unavailable #13320).docs/build.md: the catalog regeneration command now passes--adapterfor each adapter, whichcatalog.pyrequires.The dependency-upgrade test (
fabric_live::dependency_upgrade_survives_apply_process_exit) had gone stale onv1, independently of Fabric. It now requests JSON output fromnemoclaw apply, flattens the sandbox state into gateway binding fields, and builds the invocation binding withfabric_binding, as the dummy-agent live test does.One behavior change to note: Fabric
main'sfabric-agent-ctl invokerequires its input to be one JSON value, such as"Reply with exactly READY.". v0.5.0 also accepted plain text. NemoClaw's docs and code already send JSON.Fabric
mainalso changes when a sandbox can start a runtime (NVIDIA/NeMo-Fabric#393). After a stop, it starts another; it refuses only after a start with unknown effects. So a start whose reply was lost can't be retried safely in the same sandbox, because Fabric would start a second runtime. The SDK already replaces the sandbox whenever a plan would create an agent in an existing one, so generated deployments are unaffected.docs/provider.mdnow tells direct OpenTofu users to replace the sandbox themselves, and NVIDIA/NeMo-Fabric#487 asks Fabric for a safe retry. The fake gateway andimage/fabric/test_reference.pyfollowmain, and comments and docs no longer give Fabric's old rule as the reason NemoClaw replaces sandboxes.Fabric
mainrequiresinputandcostmodel extensions for a Pi model it doesn't know (NVIDIA/NeMo-Fabric#438), so the Pi model in the Kubernetes live tests gains them.Findings this doesn't fix, because they're in Fabric's v0.5.0 lock and still on
main: certifi 2026.5.20, starlette 1.0.1, and aiohttp 3.14.3.Validation
On a GB10 (Linux ARM64):
cargo ci: 1,611 unit tests and 156 lifecycle tests pass.cargo images qualify.qwen3:0.6b: OpenClaw, Hermes, Deep Agents, OpenCode, and Pi start, and each answers a request throughfabric-agent-ctlin its sandbox. Replan reports 32 resources unchanged, the exported configuration plans without changes, and destroy succeeds.cargo ci live-kind(7 tests) andcargo ci live-docker(9 tests) pass with the live agent temporarily switched to OpenClaw, then reverted to Pi.fabric_live::dependency_upgrade_survives_apply_process_exitpasses with OpenClaw and an independent Ollama endpoint.cargo ci live-kindpasses again with Pi, after the model extensions change.nemoclaw-build fern checkreports 0 errors.Not run here:
live-kindon AMD64, the Brev, Spark, and hosted-parity live tests, and the GTC DC OpenClaw template on DGX Spark.