[yifeif-nv]

Background

Dev runs #1558 and #1581 reached healthy AWS and Nebius instances, then failed private-base metadata access before any PR entry point ran. Both instances were confirmed deleted. The access error hid the HTTP status, and a missing coordinator summary was published as a generic test failure.

Exit Criteria

• Verify private-base metadata access before requesting a VM.
• Preserve safe authentication diagnostics without printing credentials, private paths or response bodies.
• Report absent or invalid GPU result evidence as an infrastructure error after confirmed cleanup.

Implementation

The existing shared-base preflight now checks package access as well as token identity. HTTP failures retain their status and bounded, recognized scope/SSO/restriction indicators; network failures remain distinct.

For dependency-image-access-check on the shared base, a separate trusted step checks the dedicated reader against the same protected reference. It independently checks package metadata and a pinned registry manifest, so a metadata API failure does not hide whether registry reads work. Existing anonymous/public-token denial checks remain separate. The diagnostic allocates no VM and executes no image.

The owner validates family result evidence and exports an explicit failure class. The final Dev publisher uses error for infrastructure failures and failure for validated post-entry PR failures; unconfirmed cleanup remains pending. A missing receipt cannot produce a successful complete result.

Validation

• Workflow and image preparation regression: 346 passed.
• Image qualification/access regression: 249 passed.
• Ruff, actionlint and git diff --check: passed.
• Actual-shell controls cover missing, null, malformed and incomplete results, post-entry failures, cleanup uncertainty, preallocation access rejection and credential cleanup.
• The live reader diagnostic will run on Dev after merge; no additional GPU allocation is needed for it.

Notes For Future Readers

This change targets ci/developer. It changes neither model passing criteria nor retry counts. HTTP status and recognized indicators narrow the diagnosis; they do not by themselves prove a package ACL or token-scope defect. Shared-base runtime and GPU qualification remain separate evidence.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/TensorRT-Model-Connect/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 1d05c154-54ad-4038-9839-1489d8c931cd

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}