Hardonian · Hardonian · May 17, 2026 · May 10, 2026 · May 10, 2026 · May 10, 2026
diff --git a/commit_message.txt b/commit_message.txt
@@ -0,0 +1,7 @@
+⚡ [performance] unblock event loop in waitForSandboxReady
+
+💡 **What:** Replaced the synchronous `sleep(delaySeconds)` with `await new Promise(...)` in `src/lib/onboard.ts` during container pod phase polling.
+🎯 **Why:** The synchronous sleep was blocking the Node.js event loop while waiting for the sandbox to be ready, severely impacting performance for any concurrent tasks.
+📊 **Measured Improvement:** The event loop went from being completely blocked for 29 ticks to 0 blocked ticks (fully asynchronous wait).
+
+Signed-off-by: Jules <161369871+google-labs-jules[bot]@users.noreply.github.com>
diff --git a/dco.txt b/dco.txt
@@ -0,0 +1 @@
+Signed-off-by: Jules <161369871+google-labs-jules[bot]@users.noreply.github.com>
diff --git a/docs/architecture/secret-redaction-doctrine.md b/docs/architecture/secret-redaction-doctrine.md
@@ -79,8 +79,8 @@ Additional high-confidence patterns for persistent content:
 
 ### Tier 1: Partial redaction (`redact()`)
 
-**Consumer:** `src/lib/runner.ts` (CLI subprocess output)  
-**Behavior:** Preserves first 4 characters, replaces remainder with `*` (capped at 20 asterisks).  
+**Consumer:** `src/lib/runner.ts` (CLI subprocess output)
+**Behavior:** Preserves first 4 characters, replaces remainder with `*` (capped at 20 asterisks).
 **Rationale:** Allows operators to identify which key is in use without exposing the full secret.
 
 ```text
@@ -92,8 +92,8 @@ URL handling: Replaces userinfo with `****`, redacts sensitive query parameters.
 
 ### Tier 2: Full redaction (`redactFull()`)
 
-**Consumer:** `src/lib/debug.ts` (diagnostic dump files)  
-**Behavior:** Replaces entire match with `<REDACTED>`. Also covers `KEY=value` patterns and `Bearer` tokens.  
+**Consumer:** `src/lib/debug.ts` (diagnostic dump files)
+**Behavior:** Replaces entire match with `<REDACTED>`. Also covers `KEY=value` patterns and `Bearer` tokens.
 **Rationale:** Diagnostic dumps may be shared with support; no partial exposure is acceptable.
 
 ```text
@@ -103,8 +103,8 @@ Output: NVIDIA_API_KEY=<REDACTED>
 
 ### Tier 3: Sensitive text redaction (`redactSensitiveText()`)
 
-**Consumer:** `src/lib/onboard-session.ts` (onboarding session logs)  
-**Behavior:** Full replacement + 240-character output truncation.  
+**Consumer:** `src/lib/onboard-session.ts` (onboarding session logs)
+**Behavior:** Full replacement + 240-character output truncation.
 **Rationale:** Onboarding logs may contain user-typed credentials; truncation prevents accumulation of sensitive context.
 
 ---

diff --git a/docs/architecture/security-policy-model.md b/docs/architecture/security-policy-model.md
@@ -28,7 +28,7 @@ Each gate emits a deterministic reason code on rejection. No silent fallthrough.
 
 ### NetworkPolicy
 
-**Status:** Implemented (sandbox egress)  
+**Status:** Implemented (sandbox egress)
 **Scope:** Controls which external endpoints the sandbox can reach.
 
 Defined in `nemoclaw-blueprint/policies/` as YAML presets. Each preset specifies allowed egress domains. The operator selects which presets apply during onboarding. Unlisted endpoints are denied (deny-by-default).
@@ -37,7 +37,7 @@ SSRF protection (`nemoclaw/src/blueprint/ssrf.ts`) supplements the network polic
 
 ### CommandExecutionPolicy
 
-**Status:** Implemented  
+**Status:** Implemented
 **Scope:** Governs how subprocess commands are executed.
 
 Hard constraints (not configurable — always enforced):
@@ -49,7 +49,7 @@ These constraints are structural (enforced in `src/lib/runner.ts`) and cannot be
 
 ### RemoteExecutionPolicy
 
-**Status:** Scaffolded (opt-in via `NEMOCLAW_REMOTE_EXECUTION=1`)  
+**Status:** Scaffolded (opt-in via `NEMOCLAW_REMOTE_EXECUTION=1`)
 **Scope:** Controls whether execution may cross trust boundaries to remote workers.
 
 Policy evaluation chain (implemented in `src/lib/control-plane/remote-execution.ts`):
@@ -62,7 +62,7 @@ Policy evaluation chain (implemented in `src/lib/control-plane/remote-execution.
 
 ### CredentialPolicy
 
-**Status:** Implemented  
+**Status:** Implemented
 **Scope:** Controls credential handling across persistence boundaries.
 
 Rules (enforced in `src/lib/security/credential-filter.ts`):
@@ -74,7 +74,7 @@ Rules (enforced in `src/lib/security/credential-filter.ts`):
 
 ### SecretRedactionPolicy
 
-**Status:** Implemented  
+**Status:** Implemented
 **Scope:** Controls how secrets appear in operator-visible outputs.
 
 Three redaction tiers (implemented in `src/lib/security/redact.ts`):
@@ -89,7 +89,7 @@ All tiers source patterns from `src/lib/security/secret-patterns.ts`.
 
 ### MemoryWritePolicy
 
-**Status:** Implemented  
+**Status:** Implemented
 **Scope:** Controls what content may be written to persistent workspace memory.
 
 Rules (enforced in `nemoclaw/src/security/secret-scanner.ts`):

diff --git a/docs/architecture/security-threat-model.md b/docs/architecture/security-threat-model.md
@@ -16,8 +16,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-001: Credential leakage via CLI output
 
-**Category:** Secret exposure  
-**Status:** Mitigated  
+**Category:** Secret exposure
+**Status:** Mitigated
 **Attack vector:** API keys, tokens, or passwords embedded in subprocess stdout/stderr leak to the operator terminal or diagnostic logs.
 
 **Enforcement:**
@@ -37,8 +37,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-002: Credential persistence in config files
 
-**Category:** Secret exposure  
-**Status:** Mitigated  
+**Category:** Secret exposure
+**Status:** Mitigated
 **Attack vector:** API keys baked into sandbox filesystem or local backup archives survive beyond their intended runtime scope.
 
 **Enforcement:**
@@ -57,8 +57,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-003: Credential leakage via URLs
 
-**Category:** Secret exposure  
-**Status:** Mitigated  
+**Category:** Secret exposure
+**Status:** Mitigated
 **Attack vector:** Tokens embedded in URL query parameters, userinfo, or path segments leak through logging or diagnostic output.
 
 **Enforcement:**
@@ -74,8 +74,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-004: Secret persistence in workspace memory writes
 
-**Category:** Secret exposure  
-**Status:** Mitigated  
+**Category:** Secret exposure
+**Status:** Mitigated
 **Attack vector:** An agent writes an API key or credential into a persistent memory file (MEMORY.md, workspace files, agent skills), where it survives across sessions.
 
 **Enforcement:**
@@ -93,8 +93,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-005: Command injection via shell interpretation
 
-**Category:** Command execution safety  
-**Status:** Mitigated  
+**Category:** Command execution safety
+**Status:** Mitigated
 **Attack vector:** An attacker crafts input containing shell metacharacters (`$(whoami)`, `&& rm -rf /`, backtick expansion) that are interpreted if commands are executed via shell.
 
 **Enforcement:**
@@ -111,8 +111,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-006: SSRF via DNS rebinding (TOCTOU)
 
-**Category:** Network safety  
-**Status:** Mitigated  
+**Category:** Network safety
+**Status:** Mitigated
 **Attack vector:** An attacker controls a DNS record that returns a public IP at validation time and a private/internal IP at connection time, bypassing the private-IP check.
 
 **Enforcement:**
@@ -131,8 +131,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-007: Malicious or compromised remote worker
 
-**Category:** Transport/trust boundary  
-**Status:** Scaffolded  
+**Category:** Transport/trust boundary
+**Status:** Scaffolded
 **Attack vector:** A remote worker endpoint returns forged execution results, manipulated telemetry, or exfiltrates command payloads.
 
 **Enforcement (current):**
@@ -151,8 +151,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-008: Forged telemetry injection
 
-**Category:** Observability integrity  
-**Status:** Partially mitigated  
+**Category:** Observability integrity
+**Status:** Partially mitigated
 **Attack vector:** An attacker injects fabricated telemetry data (fake GPU counts, false health status) to influence operational intelligence or mislead operators.
 
 **Enforcement (current):**
@@ -169,8 +169,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-009: Replay envelope tampering
 
-**Category:** Audit integrity  
-**Status:** Mitigated  
+**Category:** Audit integrity
+**Status:** Mitigated
 **Attack vector:** An attacker modifies exported replay envelopes (event payloads, sequence numbers, lineage references) to forge execution history.
 
 **Enforcement:**
@@ -186,8 +186,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-010: Remote execution without operator consent
 
-**Category:** Authorization boundary  
-**Status:** Mitigated  
+**Category:** Authorization boundary
+**Status:** Mitigated
 **Attack vector:** A local command silently dispatches execution to a remote worker without the operator being aware of the trust boundary crossing.
 
 **Enforcement:**
@@ -203,8 +203,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-011: Proofpack / export integrity compromise
 
-**Category:** Evidence integrity  
-**Status:** Partially mitigated  
+**Category:** Evidence integrity
+**Status:** Partially mitigated
 **Attack vector:** Exported evidence bundles (receipts, plans, telemetry) are modified after export, creating a false audit trail.
 
 **Enforcement (current):**
@@ -221,8 +221,8 @@ This document catalogs the security threats relevant to the NemoClaw governed ex
 
 ## THREAT-012: Unauthorized privilege escalation via trust conflation
 
-**Category:** Authorization boundary  
-**Status:** Mitigated  
+**Category:** Authorization boundary
+**Status:** Mitigated
 **Attack vector:** A worker with high trust (based on telemetry or self-reported claims) bypasses policy evaluation to execute unauthorized work.
 
 **Enforcement:**
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Signed-off-by: Jules <161369871+google-labs-jules[bot]@users.noreply.github.com>