fix(mxc): address inference demo review feedback

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

Author: prekshivyas

crates/openshell-driver-mxc/examples/run-inference-test.ps1

@@ -5,7 +5,6 @@
 
 [CmdletBinding()]
 param(
-    [string] $ApiKey = $env:NV_API_KEY,
     [string] $WxcExecPath,
     [string] $GatewayPath,
     [string] $CliPath,
@@ -135,10 +134,11 @@ $failure = $null
 $oldGatewayConfig = $env:OPENSHELL_GATEWAY_CONFIG
 $oldComputeDriver = $env:OPENSHELL_COMPUTE_DRIVER
 $oldApiKey = $env:NV_API_KEY
+$apiKey = $env:NV_API_KEY
 
 try {
-    if ([string]::IsNullOrWhiteSpace($ApiKey)) {
-        throw "NV_API_KEY is missing. Set `$env:NV_API_KEY or pass -ApiKey; the key is forwarded with --env-from and is never written to disk."
+    if ([string]::IsNullOrWhiteSpace($apiKey)) {
+        throw "NV_API_KEY is missing. Set `$env:NV_API_KEY; the key is forwarded with --env-from and is never written to disk or placed in argv."
     }
     $gateway = Resolve-Executable $GatewayPath "openshell-gateway.exe" ""
     $cli = Resolve-Executable $CliPath "openshell.exe" ""
@@ -219,7 +219,7 @@ try {
     try {
         $gatewayProcess = Start-Process -FilePath $gateway -ArgumentList @("--disable-tls", "--db-url", "sqlite::memory:", "--port", "$Port", "--log-level", "info") -WorkingDirectory $here -PassThru -WindowStyle Hidden -RedirectStandardOutput $gwLog -RedirectStandardError $gwErrLog
     } finally {
-        $env:NV_API_KEY = $ApiKey
+        $env:NV_API_KEY = $apiKey
     }
     $deadline = (Get-Date).AddSeconds(30)
     while ((Get-Date) -lt $deadline -and -not (Test-Port $Port)) {
@@ -252,7 +252,7 @@ try {
             }
             $curlDetail = if (Test-Path -LiteralPath $errorPath) { ([System.IO.File]::ReadAllText($errorPath)).Trim() } else { "no curl diagnostic was produced" }
             $diagnostic = "sandbox was created, but cloud inference failed (HTTP $httpStatus): $apiDetail $curlDetail".Trim()
-            throw $diagnostic.Replace($ApiKey, "***REDACTED***")
+            throw $diagnostic.Replace($apiKey, "***REDACTED***")
         }
         Start-Sleep -Milliseconds 500
     }

crates/openshell-driver-mxc/tests/demo_examples.rs

@@ -39,7 +39,7 @@ fn read_example(name: &str) -> String {
 }
 
 #[test]
-fn shipped_inference_configs_follow_current_gateway_contract() {
+fn shipped_inference_configs_declare_required_mxc_settings() {
     for name in ["mxc-ollama.toml", "mxc-inference.toml"] {
         let source = read_example(name);
         let parsed: Value = toml::from_str(&source)
@@ -83,18 +83,18 @@ fn shipped_inference_configs_follow_current_gateway_contract() {
 
 #[test]
 fn shipped_inference_policies_are_narrow_and_valid_after_rendering() {
+    let share = if cfg!(windows) {
+        "C:/portable/demo"
+    } else {
+        "/portable/demo"
+    };
     let fixtures = [
-        (
-            "ollama.yaml",
-            "local_ollama",
-            "127.0.0.1",
-            "C:/portable/demo",
-        ),
+        ("ollama.yaml", "local_ollama", "127.0.0.1", share),
         (
             "inference.yaml",
             "nvidia_inference",
             "integrate.api.nvidia.com",
-            "C:/portable/demo",
+            share,
         ),
     ];
     for (name, rule_name, endpoint, share) in fixtures {
@@ -152,6 +152,8 @@ fn shipped_runners_supply_sandbox_scoped_workload_configuration() {
     let cloud = read_example("run-inference-test.ps1");
     assert!(cloud.contains("--env-from"));
     assert!(cloud.contains("NV_API_KEY"));
+    assert!(!cloud.contains("[string] $ApiKey"));
+    assert!(!cloud.contains("pass -ApiKey"));
     assert!(cloud.contains("nvidia/nemotron-3.5-lightning-30b-a3b"));
     assert!(!cloud.contains("nvidia/nvidia-nemotron-nano-9b-v2"));
 }

crates/openshell-gateway/tests/mxc_demo_configs.rs

@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+#[cfg(target_os = "windows")]
+#[test]
+fn shipped_mxc_inference_configs_pass_gateway_preflight() {
+    let examples =
+        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../openshell-driver-mxc/examples");
+
+    for name in ["mxc-ollama.toml", "mxc-inference.toml"] {
+        let path = examples.join(name);
+        let output = std::process::Command::new(env!("CARGO_BIN_EXE_openshell-gateway"))
+            .args(["config", "preflight", "--path"])
+            .arg(&path)
+            .output()
+            .unwrap_or_else(|error| panic!("failed to run gateway preflight for {name}: {error}"));
+
+        assert!(
+            output.status.success(),
+            "gateway preflight rejected {name}:\nstdout:\n{}\nstderr:\n{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+}