Repository navigation
fix(inference): Nemotron Bolt downloads fail with 401 from prerelease repos - #1751
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR switches fresh Nemotron Bolt downloads to public NVIDIA artifacts while preserving exact prerelease recipes for existing installations. Example: Rerun headless setup with a valid prerelease Bolt receipt recording 262144 context tokens.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open. The prior receipt-compatibility findings are addressed, and no additional actionable defect was found; required CI for the reviewed head is still running. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherThe model catalog supplies immutable artifact recipes to setup and runtime owners, which combine installed receipts with hardware checks to acquire, validate, and launch managed local inference. flowchart TD
A[Setup selection and hardware] --> B[Receipt-aware catalog resolution]
C[Installed receipt] --> B
B --> D[Strict artifact and profile validation]
D --> E[Acquisition or recovery]
D --> F[Managed llama-server launch]
Technical reviewBest possible solution: Land the focused public-pin and receipt-preservation repair once required CI passes for the reviewed head. Do we have a high-confidence way to reproduce the issue? Current main still pins the prerelease URLs, and the original merged feature records their anonymous HTTP 401 failures; this review did not execute downloads or target code. Is this the best way to solve the issue? The repair belongs in the existing catalog owner and preserves strict validation and installed profiles without a schema migration or unrelated runtime replacement. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 248e95c60a39. Provenance checked
TestingProof path: in-process harness. SecurityNone. EvidenceWhat I checked:
Likely related people:
Review metrics
Root-cause clusterRelationship: Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (2 earlier review cycles)Reviewed October 16, 2026, 6:16 PM ET / 22:16 UTC (Revision 3). |
RomneyDa
added
the
status: 🚢 actively landing
|
Suggested complete update of Bolt's dedicated runtime to upstream llama.cpp b11700, including the source/asset pins, required binary hashes, and the matching DLL assertion. This build includes public LiLiCorr support #30506 and Bolt support #30520. This directly replaces the runtime entry; it adds no prerelease-specific handling. The CUDA dependency entry stays unchanged because b11700 publishes the same CUDA ZIP (identical size and SHA-256). The new runtime ships I verified the downloaded runtime ZIP's size/SHA-256 and calculated the file hashes from its contents. The patch applies to PR head The local build of PR head diff --git a/src/OpenClaw.Shared/Inference/Catalog/LlamaRuntimeCatalog.NemotronBolt.cs b/src/OpenClaw.Shared/Inference/Catalog/LlamaRuntimeCatalog.NemotronBolt.cs
--- a/src/OpenClaw.Shared/Inference/Catalog/LlamaRuntimeCatalog.NemotronBolt.cs
+++ b/src/OpenClaw.Shared/Inference/Catalog/LlamaRuntimeCatalog.NemotronBolt.cs
@@ -4,13 +4,12 @@
public static partial class LlamaRuntimeCatalog
{
- // Bolt needs LiLiCorr decoding from support-lilicorr plus per-layer expert loading.
- // Pin the tested source and payload here while other models keep the stable runtime.
- // Base: https://github.com/frozenblade1224/llama.cpp/tree/a972392d7db3678954c66f06744e535519314009
+ // Bolt uses upstream LiLiCorr support for the public drafter tensor names.
+ // Keep its runtime pin independent from the stable runtime used by other models.
public const string NemotronBoltRuntimeFamily = "nemotron-bolt-lilicorr";
- public const string NemotronBoltSourceCommitSha = "b3e4f6ce7f22adb7f1b1eaa012db8367d45a574a";
- public const string NemotronBoltReleaseTag = "bolt-lilicorr-b3e4f6c";
- public const string NemotronBoltArm64RuntimeId = "bolt-lilicorr-b3e4f6c-cuda13-arm64";
+ public const string NemotronBoltSourceCommitSha = "23f7aabc16c72f6f707dba227251c35d7bd1ed96";
+ public const string NemotronBoltReleaseTag = "b11700";
+ public const string NemotronBoltArm64RuntimeId = "bolt-lilicorr-b11700-cuda13-arm64";
private static readonly LlamaRuntimeVariant s_nemotronBoltArm64 = new(
NemotronBoltArm64RuntimeId,
@@ -19,12 +18,12 @@
Array.AsReadOnly(new[]
{
new PinnedArtifact(
- "llama-bolt-lilicorr-b3e4f6c-cuda13-arm64",
+ "llama-bolt-lilicorr-b11700-cuda13-arm64",
ArtifactRole.RuntimeBinary,
- new GitHubReleaseSource("joelagnel/llama.cpp", NemotronBoltReleaseTag, NemotronBoltSourceCommitSha),
- "llama-bolt-lilicorr-b3e4f6c-bin-win-cuda-13.4-arm64.zip",
- 46_836_189,
- new Sha256Digest("f2adf45fda36a336d2a539e418c6e26f51d50d6f7bb3c086c79771ea348a9ee5")),
+ new GitHubReleaseSource("ggml-org/llama.cpp", NemotronBoltReleaseTag, NemotronBoltSourceCommitSha),
+ "llama-b11700-bin-win-cuda-13.4-arm64.zip",
+ 146_943_791,
+ new Sha256Digest("8474f9edb24e917e5bf0c3824dd79bda5659483ee6adfcbf27197d05defb2783")),
new PinnedArtifact(
"cudart-b11320-cuda13-arm64",
ArtifactRole.RuntimeDependency,
@@ -41,15 +40,16 @@
RuntimeFile("cublas64_13.dll", 24_207_984, "49e8fa23d88ac0cbae27e200fc092b894dd55b4de5cb4293993986e29fb9b65a"),
RuntimeFile("cublasLt64_13.dll", 193_128_560, "daf579ae36bb3c85e2340c57a1994f634e07c6f55ef70dd4cdc26695de21c752"),
RuntimeFile("cudart64_13.dll", 606_832, "bd927ddf03823eeead7c8b261a8669d96764b89109311f4ab6accde8b7d97ec2"),
- RuntimeFile("ggml-base.dll", 606_720, "a8e7cfb6f5ad7b866d08b5c012cf9469a9b61456f62d76137db00f25031ce4f4"),
- RuntimeFile("ggml-cpu.dll", 667_136, "5e1fa7cd5d38f218714dd243e3f7079a01e11e7dd02c62490ab33eb5396b9b7a"),
- RuntimeFile("ggml-cuda.dll", 54_052_864, "edf5fe4a86c17b0b64e16f2d634686f929133cfce8802dc7ab726d710afae0a4"),
- RuntimeFile("ggml.dll", 49_664, "b2b8d88e1c1b9a95581a5690ddd5b1691099c2e6d5b7e1794185bac615a12c6d"),
- RuntimeFile("llama-common.dll", 8_754_688, "c3f9a2d9756a222f359b14b21c0464d1fb2ba19ae5d77ee3333515086e454a83"),
- RuntimeFile("llama-server-impl.dll", 3_414_016, "a2e42c8e93194fe67b463b708d7ec0e9f4c10fa2b4707b60126f50a07c463558"),
- RuntimeFile("llama-server.exe", 10_240, "33eea374c24f120b9eaf2303d646f67af41d2db4b37e589276f86340e6efb4ca"),
- RuntimeFile("llama.dll", 2_708_992, "a85d7984020e23437a0ea91adce0142b6b774925f3301c80dedd8b8961188bcd"),
- RuntimeFile("mtmd.dll", 2_408_448, "1d12a069d7cb94bcca9e1d4647108a9bee8d3cd45bdc87623884c23888094f5b"),
- RuntimeFile("vcomp140.dll", 367_160, "1a455c526e42d80d3aa3189e082500b6eb7837fcf8be0e9fbd1f26c92acdab71"),
+ RuntimeFile("ggml-base.dll", 667_136, "ad891be29b12d53c5e7f5b681b7ba9ebedb5101f04314d0cbd83795bcb460896"),
+ RuntimeFile("ggml-cpu.dll", 835_072, "e49583ceb5ad0c076f2b9905bac66eb1dd49d34fda14f0a4f4fd368fa2b9fef8"),
+ RuntimeFile("ggml-cuda.dll", 146_929_152, "e3c7a7b5a79cc71cb667957ad2e5b28644ea843344c217a31fde13ed22e1e8ae"),
+ RuntimeFile("ggml-rpc.dll", 215_040, "e7617fb63ae34218fbc15d4644057c4f44a3590afc21f8bfb4cabe6030996fc5"),
+ RuntimeFile("ggml.dll", 69_120, "cca7613b2124c1b2cd9e53663269cd64fbcb1b480a465872915130b967c50fec"),
+ RuntimeFile("llama-common.dll", 7_157_760, "b88408489b7445b4bba94cccf18d54b6f07618fae7a8a643c5db3d768f7fb5d6"),
+ RuntimeFile("llama-server-impl.dll", 8_471_040, "43ff8798b8bf397c6fd39cb47a0366a9a5fa0a72c17185e51261747451542349"),
+ RuntimeFile("llama-server.exe", 9_728, "acaea7451d287ee8812bc2f8175594cbb43008313450ecc22e6e2f4b69b6220d"),
+ RuntimeFile("llama.dll", 3_121_152, "bf1083da93ce656214a74cae8fdad3580ee96e0bd4e8b27e65c8b6b65c5d3005"),
+ RuntimeFile("mtmd.dll", 1_576_960, "4b34d7a35913a85a013b1050c143480c87c18aeb7f1421c0574447c2203270e4"),
+ RuntimeFile("libomp.dll", 764_928, "26caae17f29aaf2238f664375b663cd306d596bc9e36e780fa88356c51fe876a"),
}));
}
diff --git a/tests/OpenClaw.Shared.Tests/NemotronBoltRuntimeTests.cs b/tests/OpenClaw.Shared.Tests/NemotronBoltRuntimeTests.cs
--- a/tests/OpenClaw.Shared.Tests/NemotronBoltRuntimeTests.cs
+++ b/tests/OpenClaw.Shared.Tests/NemotronBoltRuntimeTests.cs
@@ -14,7 +14,7 @@
Assert.Equal(LlamaRuntimeCatalog.NemotronBoltArm64RuntimeId, runtime.Id);
Assert.Equal(RuntimeArchitecture.Arm64, runtime.Architecture);
- Assert.Contains(runtime.RequiredFiles, file => file.FileName == "vcomp140.dll");
+ Assert.Contains(runtime.RequiredFiles, file => file.FileName == "libomp.dll");
Assert.NotNull(LlamaRuntimeCatalog.FindInstalled(runtime.Id));
Assert.DoesNotContain(runtime, LlamaRuntimeCatalog.Variants);
} |
|
@clawsweeper re-review Please review current head The installed-receipt compatibility finding is repaired at the catalog owner: fresh installs use the public NVIDIA pins, while existing prerelease receipts resolve their exact original target and drafter through the recorded source URL. All other receipt, profile, size, and SHA-256 checks remain strict. Fixed prerelease cases cover startup/restart, preflight and incomplete-runtime recovery, and mixed-draft rejection in CI. Maintainer scope is CI-only validation, with additional local tests and hardware proof explicitly waived. That proof-only waiver does not waive required CI or concrete correctness findings. Independent source review completed through P3 with no actionable findings and no target-code execution. The original contributor commit and credit are preserved. Exact-head CI: https://github.com/openclaw/openclaw-windows-node/actions/runs/38970504434. Core/CLI is green, and the previously failing UI test steps have passed; remaining capture/cleanup work is still running. |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
|
@clawsweeper re-review Please review head The remaining headless setup finding is fixed in Five added headless matrix cases omit that marker, including the reported valid prerelease 256K receipt with a 256K budget, public/prerelease 128K retention, and memory-pressure rejection. The shared fixed prerelease artifacts and incomplete-runtime recovery assertions remain in use. Current-head CI is running: https://github.com/openclaw/openclaw-windows-node/actions/runs/38973946826. The preceding head passed every required CI lane. Additional local tests, baseline execution, and hardware proof remain explicitly waived by the maintainer; correctness findings and current-head required CI are not waived. No runtime/dependency pins or verification rules were changed. |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
clawsweeper
Bot
removed
merge-risk: 🚨 compatibility
RomneyDa
removed
the
status: 🚢 actively landing
… repos Repin target and LiLiCorr draft to the public nvidia/ Hugging Face repos. Target bytes are unchanged; the public draft has a new size and SHA-256.
Replaces the joelagnel/llama.cpp b3e4f6c Bolt runtime with upstream ggml-org b11700, which includes public LiLiCorr (#30506) and Bolt (#30520) support. libomp.dll replaces vcomp140.dll and ggml-rpc.dll joins the required-file manifest; the CUDA dependency pin is unchanged. Co-authored-by: Ryan Underhill <38674843+RyanUnderhill@users.noreply.github.com>
larroy
added
P0
… repos (openclaw#1751) * fix(inference): Nemotron Bolt downloads fail with 401 from prerelease repos Repin target and LiLiCorr draft to the public nvidia/ Hugging Face repos. Target bytes are unchanged; the public draft has a new size and SHA-256. * fix(inference): preserve installed Bolt artifact receipts * fix(setup): retain installed Bolt recipes in headless preflight * fix(inference): pin Bolt runtime to upstream llama.cpp b11700 Replaces the joelagnel/llama.cpp b3e4f6c Bolt runtime with upstream ggml-org b11700, which includes public LiLiCorr (#30506) and Bolt (#30520) support. libomp.dll replaces vcomp140.dll and ggml-rpc.dll joins the required-file manifest; the CUDA dependency pin is unchanged. Co-authored-by: Ryan Underhill <38674843+RyanUnderhill@users.noreply.github.com> --------- Co-authored-by: Dallin Romney <dallinromney@gmail.com> Co-authored-by: Ryan Underhill <38674843+RyanUnderhill@users.noreply.github.com>
What Problem This Solves
Fixes: downloading the Nemotron 3.5 Bolt local model fails with HTTP 401 because the catalog pinned prerelease Hugging Face repos that are not publicly accessible.
User Impact
User impact: new Nemotron 3.5 Bolt installs download the target weights and LiLiCorr draft from public NVIDIA repos. Existing prerelease installations retain their verified artifacts, startup, restart, and recovery paths without a forced reinstall.
Why This Change Was Made
The target and draft artifacts are repinned from the prerelease
NVIDIA-Nemotron/repos to the publicnvidia/releases at fixed revisions:nvidia/NVIDIA-Nemotron-3.5-Bolt-74B-A9B-24GB-GGUF@e0fecb69NVIDIA-Nemotron-3.5-Bolt-74B-A9B-24GB.gguf91d63363…(unchanged)nvidia/NVIDIA-Nemotron-3.5-Bolt-74B-A9B-24GB-LiLiCorr-GGUF@182d2987NVIDIA-Nemotron-3.5-Bolt-74B-A9B-24GB-LiLiCorr.gguf080e1ea4…(new)The public target bytes are identical to the prerelease file. The public draft is a new build, so its size and hash are updated. The author's artifact inspection found GGUF metadata (
dflash, 5 blocks, 2 KV heads, head dim 128) matching the existing recipe and keys known to the pinned runtime (bolt-lilicorr-b3e4f6c).The maintainer repair retains the exact prerelease recipe for installed receipts. The existing catalog owner selects that recipe only when the stable model ID and original model source URL match. Startup, provider metadata, and setup inspection consume that selection. Both UI and headless
--configpreflight resolve the actual installed receipt without relying on UI-only hints. Full receipt validation still checks every runtime/model source, filename, length, checksum, additional artifact, and qualified profile. Fresh selection offers only the public pins. No receipt is silently migrated or loosened, and mixed prerelease/public draft receipts remain invalid.Evidence
Author-supplied acquisition evidence at original head
50a6a64a34b82a8484033fbf367f7b8fb7c1a014:401 Unauthorizedanonymously; both new URLs return206for a ranged GET starting withGGUF.080e1ea41c9562a7804dbf30c6fbd4d17e216c6b8ff666f88e6edb1816010194(matches pin).X-Linked-Size/X-Linked-ETag(LFS SHA-256) at the pinned revision.Maintainer repair head:
2e6fdb201bd8e3bee21212d4a89f5fce2d1e8f46. The original contributor commit is retained unchanged, with two additive signed repair commits. The first repair passed CI; ClawSweeper then identified that headless setup lacked the UI-only receipt marker. The follow-up removes that dependency and adds five headless receipt cases. Exact-head CI and all six Windows lanes now pass; the durable exact-head ClawSweeper review has no actionable findings (links and counts below).Change Type
Scope
winnodeRequired proof pools
windows-11-arm64: Bolt runs only on the ARM64 runtime; loading the new public draft with llama-server and running inference needs ARM64 NVIDIA hardware. Hardware proof is not run in this CI-only maintainer repair.Validation
Current repair at
2e6fdb201bd8e3bee21212d4a89f5fce2d1e8f46:git diff --cached --checkand unstaged-diff verification: passed before both signed commits.2e6fdb201bd8e3bee21212d4a89f5fce2d1e8f46.CI Gate, fast validation, proof-pool contracts, and all six Windows lanes passed: Core/CLI; Tray/setup/integration; UI/functional/accessibility; setup/connect E2E; revocation-recovery E2E; network-recovery E2E. No CI rerun or gate/assertion relaxation was used. Prior-head results below are historical evidence only.InstalledReceiptModelId, covering public/prerelease receipts, memory pressure, retained 128K, and the reported prerelease 256K configuration rerun. All 13 cases executed and passed in the current-head hosted CI, including all five headless cases../build.ps1, Shared/Tray/Connection/SetupEngine tests, base-fail/head-pass execution, and native hardware proof were deliberately not run, per the maintainer's explicit request to rely on CI. This proof-only waiver does not waive required CI or concrete correctness findings.Earlier repair
ba083d62, before the headless follow-up:CI Gateand all six Windows lanes, including UI capture and all E2E lanes.Author-reported validation at original head
50a6a64a, predating the maintainer repair:./build.ps1: all builds succeeded.dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj: Passed 4313, Failed 0, Skipped 36.dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj: Passed 4083, Failed 0.Real Behavior Proof
The following acquisition proof was supplied by the author for the original head and was not rerun during the maintainer repair:
50a6a64a34b82a8484033fbf367f7b8fb7c1a014.curl -Ion old and new resolve URLs;curl -L -r 0-3on both new URLs; fullcurl -Ldraft download plusGet-FileHash -Algorithm SHA256.206andGGUFmagic; draft hash and size match the pin.Security Impact
Yes, explain the risk and mitigation: fresh acquisition uses public NVIDIA Hugging Face repositories; artifacts remain pinned by immutable revision, size, and SHA-256. Installed prerelease recipes retain their exact original checks. Unknown or mixed receipts do not gain acceptance.Compatibility and Migration
Review Conversations