fix(onboard): defer inference configuration for providerless agents

Dockerfile

@@ -591,10 +591,10 @@
 COPY nemoclaw-blueprint/scripts/*.js /usr/local/lib/nemoclaw/preloads/
 COPY --from=runtime-preload-builder /opt/nemoclaw-root/dist/lib/messaging/channels/ /usr/local/lib/nemoclaw/preloads-compiled-channels/
 COPY scripts/codex-acp-wrapper.sh /usr/local/bin/nemoclaw-codex-acp
-COPY scripts/generate-openclaw-config.mts /scripts/generate-openclaw-config.mts
-COPY scripts/validate-openclaw-tool-search.mts /scripts/validate-openclaw-tool-search.mts
+COPY scripts/generate-openclaw-config.mts /scripts/
+COPY scripts/validate-openclaw-tool-search.mts /scripts/
 COPY --from=managed-startup-runtime-builder /out/managed-startup-image-runtime.cjs /usr/local/lib/nemoclaw/managed-startup-image-runtime.cjs
-COPY src/lib/extra-agents-validation.ts src/lib/tool-disclosure.ts /src/lib/
+COPY src/lib/extra-agents-validation.ts src/lib/tool-disclosure.ts src/lib/providerless-inference.ts /src/lib/
 COPY nemoclaw-blueprint/openclaw-plugins/ /usr/local/share/nemoclaw/openclaw-plugins/
 COPY --from=mcp-tool-discovery-runtime /opt/mcp-tool-discovery-runtime/dist/ /usr/local/lib/nemoclaw/mcp-tool-discovery-runtime/
 
@@ -1492,9 +1492,9 @@
     && cp -r /opt/nemoclaw-blueprint/* /sandbox/.nemoclaw/blueprints/0.1.0/
 
 # Copy configuration inputs before the cached non-messaging plugin install.
-COPY scripts/generate-openclaw-config.mts /scripts/generate-openclaw-config.mts
-COPY scripts/validate-openclaw-tool-search.mts /scripts/validate-openclaw-tool-search.mts
-COPY src/lib/extra-agents-validation.ts src/lib/tool-disclosure.ts /src/lib/
+COPY scripts/generate-openclaw-config.mts /scripts/
+COPY scripts/validate-openclaw-tool-search.mts /scripts/
+COPY src/lib/extra-agents-validation.ts src/lib/tool-disclosure.ts src/lib/providerless-inference.ts /src/lib/
 COPY nemoclaw-blueprint/openclaw-plugins/ /usr/local/share/nemoclaw/openclaw-plugins/
 
 RUN chmod 755 /scripts/generate-openclaw-config.mts \
@@ -1568,10 +1568,10 @@
 # CHAT_UI_URL is a non-loopback address (Brev Launchable, remote deployments)
 # since terminal-based pairing is impossible in those contexts.
 # Default: "0" (device auth enabled for local deployments — secure by default).
 ARG NEMOCLAW_DISABLE_DEVICE_AUTH=0
 # Internal audit provenance for the opt-out above. Standard onboarding rewrites
 # this to managed-onboard; direct image builders retain operator provenance.
 ARG NEMOCLAW_DEVICE_AUTH_OPT_OUT_SOURCE=operator
 # Compatibility build arg for older custom Dockerfiles and rebuild tooling.
 # NemoClaw-managed images intentionally do not consume it; gateway auth tokens
 # are generated at container startup and are never baked into image layers.
@@ -1605,7 +1605,7 @@
 # NEMOCLAW_MESSAGING_PLAN_B64 intentionally remains ARG-only: Docker exposes it
 # to build RUN processes without retaining the full plan in the final image env.
 # Direct ARG interpolation into inline source is a code injection vector (C-2).
 ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_INFERENCE_PROVIDER_ID=${NEMOCLAW_INFERENCE_PROVIDER_ID} \
     NEMOCLAW_UPSTREAM_PROVIDER=${NEMOCLAW_UPSTREAM_PROVIDER} \
     NEMOCLAW_PRIMARY_MODEL_REF=${NEMOCLAW_PRIMARY_MODEL_REF} \

agents/hermes/Dockerfile

@@ -103,7 +103,7 @@
 COPY agents/hermes/managed_policy.py /opt/nemoclaw-hermes-config/managed_policy.py
 COPY agents/hermes/host/managed-tool-gateway-matrix.json /opt/nemoclaw-hermes-config/managed-tool-gateway-matrix.json
 COPY src/lib/hermes-managed-route.ts /src/lib/hermes-managed-route.ts
-COPY src/lib/tool-disclosure.ts /src/lib/tool-disclosure.ts
+COPY src/lib/tool-disclosure.ts src/lib/providerless-inference.ts /src/lib/
 COPY src/lib/messaging/ /src/lib/messaging/
 COPY scripts/lib/openclaw-npm-remediation.mts /scripts/lib/openclaw-npm-remediation.mts
 
@@ -473,7 +473,7 @@
 # read-only.
 RUN find /opt/nemoclaw-hermes-config -type d -exec chmod 755 {} + \
     && find /opt/nemoclaw-hermes-config -type f -exec chmod 444 {} + \
-    && chmod 444 /src/lib/hermes-managed-route.ts /src/lib/tool-disclosure.ts \
+    && chmod 444 /src/lib/hermes-managed-route.ts /src/lib/tool-disclosure.ts /src/lib/providerless-inference.ts \
     && chmod 444 /scripts/lib/reviewed-npm-archive.mts /scripts/lib/bundled-npm-package.mts \
         /scripts/lib/openclaw-npm-remediation.mts \
         /scripts/patch-bundled-npm-brace-expansion.mts /scripts/lib/patch-bundled-npm-ip-address.mts \
@@ -686,7 +686,7 @@
 # Hermes v0.20.6 drops explicit auxiliary output limits on custom endpoints.
 # Preserve those limits on NemoClaw's managed inference route so session-title
 # generation cannot occupy Ollama's only inference slot until the context fills.
 ARG NEMOCLAW_HERMES_AUXILIARY_TOKEN_LIMIT_PATCHER_SHA256=d04ffc133e115caddd6a1243979e317a512a4ffd8b259ec2b053a5057c26ba93
 # hadolint ignore=DL4006
 RUN printf '%s  %s\n' \
         "$NEMOCLAW_HERMES_CRON_RUNTIME_PATCHER_SHA256" /opt/nemoclaw-hermes-config/patch-cron-execution-runtime.py \

agents/hermes/config/build-env.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { Buffer } from "node:buffer";
+import { hasProviderlessInferenceEnvironment } from "../../../src/lib/providerless-inference.ts";
 
 import { normalizeProviderPlaceholderForEnvKey } from "../../../src/lib/messaging/provider-placeholders.ts";
 import { readToolDisclosureEnv } from "../../../src/lib/tool-disclosure.ts";
@@ -13,7 +14,7 @@ export type HermesWebSearchProvider = "tavily";
 export const MIN_HERMES_CONTEXT_WINDOW = 64_000;
 
 export type HermesBuildSettings = {
-  model: string;
+  model: string | null;
   baseUrl: string;
   providerKey: string;
   upstreamProvider: string;
@@ -35,8 +36,9 @@ export type HermesBuildSettings = {
 
 /** Read and validate the environment consumed by the Hermes config generator. */
 export function readHermesBuildSettings(env: NodeJS.ProcessEnv): HermesBuildSettings {
-  const model = readRequiredEnv(env, "NEMOCLAW_MODEL");
-  const baseUrl = readRequiredEnv(env, "NEMOCLAW_INFERENCE_BASE_URL");
+  const providerless = hasProviderlessInferenceEnvironment(env);
+  const model = providerless ? null : readRequiredEnv(env, "NEMOCLAW_MODEL");
+  const baseUrl = providerless ? "" : readRequiredEnv(env, "NEMOCLAW_INFERENCE_BASE_URL");
 
   return {
     model,

agents/hermes/config/generate.ts

@@ -33,24 +33,29 @@ export function generateHermesConfig({
   log = console.log,
 }: GenerateHermesConfigOptions): GeneratedHermesConfig {
   const settings = readHermesBuildSettings(env);
-  discoverModelSpecificSetups(
-    "hermes",
-    {
-      model: settings.model,
-      providerKey: settings.providerKey,
-      inferenceApi: settings.inferenceApi,
-      baseUrl: settings.baseUrl,
-    },
-    { env, scriptDir },
-  );
+  if (settings.model !== null)
+    discoverModelSpecificSetups(
+      "hermes",
+      {
+        model: settings.model,
+        providerKey: settings.providerKey,
+        inferenceApi: settings.inferenceApi,
+        baseUrl: settings.baseUrl,
+      },
+      { env, scriptDir },
+    );
 
   const policy = buildHermesManagedPolicy(settings, env);
   const config = policy.config;
   const envLines = policy.env_lines;
   finalizeHermesPlatformToolsets(config, settings);
   const written = writeHermesConfigFiles(config, envLines, policy, homeDir);
 
-  log(`[config] Wrote ${written.configPath} (model=${settings.model}, provider=custom)`);
+  log(
+    settings.model === null
+      ? `[config] Wrote ${written.configPath} (inference not configured)`
+      : `[config] Wrote ${written.configPath} (model=${settings.model}, provider=custom)`,
+  );
   log(`[config] Wrote ${written.envPath} (${written.envEntryCount} entries)`);
   log(`[config] Wrote ${written.policyPath} (schema=${policy.schema_version})`);
 

agents/hermes/config/managed-policy.ts

@@ -152,7 +152,7 @@ type HermesManagedConfigBase = Record<string, unknown> & {
   };
 };
 
-export type HermesManagedConfig = HermesManagedConfigBase & HermesManagedRouting;
+export type HermesManagedConfig = HermesManagedConfigBase & Partial<HermesManagedRouting>;
 
 export type HermesManagedPolicyV1 = {
   schema_version: typeof HERMES_MANAGED_POLICY_SCHEMA_VERSION;
@@ -275,13 +275,14 @@ export function buildHermesManagedPolicy(
     platforms,
   };
 
-  applyHermesManagedRoute(config, {
-    model: settings.model,
-    baseUrl: settings.baseUrl,
-    upstreamProvider: settings.upstreamProvider,
-    inferenceApi: settings.inferenceApi,
-    contextWindow: settings.contextWindow,
-  });
+  if (settings.model !== null)
+    applyHermesManagedRoute(config, {
+      model: settings.model,
+      baseUrl: settings.baseUrl,
+      upstreamProvider: settings.upstreamProvider,
+      inferenceApi: settings.inferenceApi,
+      contextWindow: settings.contextWindow,
+    });
 
   const managedToolGatewayPresets = effectiveManagedToolGatewayPresets(settings);
   if (managedToolGatewayPresets.length > 0) {

agents/hermes/managed_policy.py

@@ -89,14 +89,17 @@ def load_managed_policy(path: Path = MANAGED_POLICY_PATH) -> dict:
         "managed policy managed_paths",
     )
     config = document["config"]
-    if policy_value(config, "model.api_key") != HERMES_PROXY_REWRITE_SENTINEL:
+    has_routing = any(
+        key in config for key in ("model", "providers", "custom_providers", "_nemoclaw_upstream")
+    )
+    if has_routing and policy_value(config, "model.api_key") != HERMES_PROXY_REWRITE_SENTINEL:
         raise ManagedPolicyError(
             "managed policy model.api_key must use the OpenShell proxy rewrite sentinel"
         )
     for managed_path in managed_paths:
         policy_value(config, managed_path)
     for key in dashboard["routing_keys"]:
-        if key not in config:
+        if has_routing and key not in config:
             raise ManagedPolicyError(f"managed policy config is missing {key}")
     return document
 

agents/hermes/seed-dashboard-config.py

@@ -37,8 +37,9 @@
     seed-dashboard-config.py [--merge-legacy] <managed-policy.json> <gateway-config.yaml> <dashboard-config.yaml> <gateway.env> <dashboard.env>
 
 Exits 0 on success or a benign no-op for a missing gateway config.
-Exits 1 when an existing config is invalid or unreadable, routing is absent, a
-reviewed policy is invalid, or a write fails. Emits ``[dashboard]`` lines on
+Providerless configuration may omit all routing keys. Partial routing remains invalid.
+Exits 1 when an existing config is invalid or unreadable, a reviewed policy is
+invalid, or a write fails. Emits ``[dashboard]`` lines on
 stderr to match the rest of the gateway startup contract.
 """
 
@@ -57,6 +58,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
 from managed_policy import (  # noqa: E402
+    HERMES_PROXY_REWRITE_SENTINEL,
     ManagedPolicyError,
     load_managed_policy,
     policy_value,
@@ -493,6 +495,9 @@ def _atomic_write_no_follow(
 
 
 def _normalized_routing(gateway: dict, routing_keys: list[str], policy: dict) -> dict:
+    # Only a providerless image policy permits completely absent routing.
+    if not any(key in gateway or key in policy["config"] for key in routing_keys):
+        return {}
     if any(key not in gateway for key in routing_keys):
         raise InvalidDashboardSeedDocumentError("gateway config has incomplete model routing")
     routing = {key: deepcopy(gateway[key]) for key in routing_keys}
@@ -516,7 +521,7 @@ def _normalized_routing(gateway: dict, routing_keys: list[str], policy: dict) ->
         or not custom_providers
     ):
         raise InvalidDashboardSeedDocumentError("gateway config has invalid model routing")
-    expected_api_key = policy_value(policy["config"], "model.api_key")
+    expected_api_key = HERMES_PROXY_REWRITE_SENTINEL
     credential_bearing_routes = [model, *providers.values(), *custom_providers]
     if not isinstance(expected_api_key, str) or any(
         not isinstance(route, dict) or route.get("api_key") != expected_api_key
@@ -792,6 +797,9 @@ def _seed_dashboard(argv: list[str], dashboard_fd: int | None) -> int:
         dashboard["web"] = dashboard_web
     else:
         dashboard.pop("web", None)
+    if not routing:
+        for key in policy["dashboard"]["routing_keys"]:
+            dashboard.pop(key, None)
     dashboard.update(routing)
     _merge_policy(dashboard, policy_sections)
 
@@ -808,7 +816,8 @@ def write_dashboard(handle: TextIO) -> None:
     ):
         return 1
 
-    print(f"[dashboard] seeded model routing and reviewed policy into {dst}", file=sys.stderr)
+    status = "model routing and reviewed policy" if routing else "reviewed policy (inference not configured)"
+    print(f"[dashboard] seeded {status} into {dst}", file=sys.stderr)
     return 0
 
 

ci/pi-agent-qualification-v1-linux-amd64.json

@@ -3,13 +3,13 @@
   "agent": "pi",
   "platform": "linux/amd64",
   "image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
-  "digest": "sha256:838dcc19764788aa7963183e14a063380fc4f03b9e6813b677473e64768296d0",
-  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:838dcc19764788aa7963183e14a063380fc4f03b9e6813b677473e64768296d0",
+  "digest": "sha256:972be6bb8debabf87cb980086c2a0ef767233db5459cbc4bba48b39b6964baee",
+  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:972be6bb8debabf87cb980086c2a0ef767233db5459cbc4bba48b39b6964baee",
   "source": {
     "repository": "NVIDIA/NemoClaw",
-    "revision": "4a3560862a8262abe087b6e94431b03e825ba965",
+    "revision": "e44d6f1ee65e05bfab0949f01a91be31f497aaaf",
     "release": "v0.1.0",
-    "cohort": "ghrun-34717583242-1"
+    "cohort": "ghrun-34727786488-1"
   },
   "startupProfileContractVersion": 1,
   "capabilityContractVersion": 1

ci/pi-agent-qualification-v1-linux-arm64.json

@@ -3,13 +3,13 @@
   "agent": "pi",
   "platform": "linux/arm64",
   "image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
-  "digest": "sha256:45ea8e84013f63437e4aff87e6c82818d726eb3401d786fb9ede6c208df868aa",
-  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:45ea8e84013f63437e4aff87e6c82818d726eb3401d786fb9ede6c208df868aa",
+  "digest": "sha256:18e011b7ceb560962157e9efe7cdf576141ae494c7da4cf18cc738ebf84f1b73",
+  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:18e011b7ceb560962157e9efe7cdf576141ae494c7da4cf18cc738ebf84f1b73",
   "source": {
     "repository": "NVIDIA/NemoClaw",
-    "revision": "4a3560862a8262abe087b6e94431b03e825ba965",
+    "revision": "e44d6f1ee65e05bfab0949f01a91be31f497aaaf",
     "release": "v0.1.0",
-    "cohort": "ghrun-34717583242-1"
+    "cohort": "ghrun-34727786488-1"
   },
   "startupProfileContractVersion": 1,
   "capabilityContractVersion": 1

scripts/checks/managed-image-protected-runtime-contract.ts

@@ -99,10 +99,14 @@ export function withManagedImageLocalInferenceProfile(
   model: string,
 ): ManagedStartupProfile {
   const primaryModelRef =
-    profile.agent === "openclaw" ? `inference/${model}` : profile.inference.primaryModelRef;
+    profile.agent === "openclaw"
+      ? `inference/${model}`
+      : (profile.inference?.primaryModelRef ?? null);
   return {
     ...profile,
     inference: {
+      compatibility: profile.agent === "openclaw" ? {} : null,
+      inputModalities: profile.agent === "openclaw" ? ["text"] : null,
       ...profile.inference,
       routeProvider: "inference",
       upstreamProvider: route.providerName,

scripts/generate-openclaw-config.mts

@@ -27,6 +27,8 @@
 //   NEMOCLAW_OPENCLAW_OTEL_SERVICE_NAME, NEMOCLAW_OPENCLAW_OTEL_SAMPLE_RATE,
 //   NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION.
 
+import { hasProviderlessInferenceEnvironment } from "../src/lib/providerless-inference.ts";
+
 import {
   chmodSync,
   existsSync,
@@ -792,11 +794,13 @@ export function buildManagedInferenceSafeguardCompaction(
 }
 
 export function buildConfig(env: Env = process.env): JsonObject {
+  const providerless = hasProviderlessInferenceEnvironment(env);
   const proxyHost = env.NEMOCLAW_PROXY_HOST || "10.200.0.1";
   const proxyPort = env.NEMOCLAW_PROXY_PORT || "3128";
   const proxyUrl = `http://${proxyHost}:${proxyPort}`;
   const emitOpenClawManagedProxy = truthyEnvDefault(env, "NEMOCLAW_OPENCLAW_MANAGED_PROXY", true);
   const model = env.NEMOCLAW_MODEL as string;
+  if (!providerless && !model) throw new Error("NEMOCLAW_MODEL is required");
   const rawChatUiUrl = env.CHAT_UI_URL || "";
   let chatUiUrl = rawChatUiUrl || `http://127.0.0.1:${DEFAULT_DASHBOARD_PORT}`;
   const gatewayPort = resolveGatewayPort(env, chatUiUrl);
@@ -840,16 +844,18 @@ export function buildConfig(env: Env = process.env): JsonObject {
     agentHeartbeat = "";
   }
 
-  const modelSpecificSetups = matchingModelSpecificSetups(
-    "openclaw",
-    {
-      model,
-      providerKey,
-      baseUrl: inferenceBaseUrl,
-      inferenceApi,
-    },
-    env,
-  );
+  const modelSpecificSetups = providerless
+    ? []
+    : matchingModelSpecificSetups(
+        "openclaw",
+        {
+          model,
+          providerKey,
+          baseUrl: inferenceBaseUrl,
+          inferenceApi,
+        },
+        env,
+      );
 
   const inferenceCompat = coerceCompatDict(
     decodeJsonEnv(env, "NEMOCLAW_INFERENCE_COMPAT_B64", "e30="),
@@ -1055,7 +1061,7 @@ export function buildConfig(env: Env = process.env): JsonObject {
   }
 
   const agentDefaults: JsonObject = {
-    model: { primary: primaryModelRef },
+    ...(providerless ? {} : { model: { primary: primaryModelRef } }),
     timeoutSeconds: agentTimeout,
     ...(agentHeartbeat ? { heartbeat: { every: agentHeartbeat, isolatedSession: true } } : {}),
     skipBootstrap: true,
@@ -1094,7 +1100,7 @@ export function buildConfig(env: Env = process.env): JsonObject {
       defaults: agentDefaults,
       list: buildAgentsList(extraAgents, extraAgentsPayload.main),
     },
-    models: { mode: "merge", providers },
+    ...(providerless ? {} : { models: { mode: "merge", providers } }),
     channels,
     tools: openclawTools,
     update: { checkOnStart: false },

src/lib/actions/sandbox/agents/managed-workload-rebuild-profile.ts

@@ -96,7 +96,7 @@ export function prepareManagedRebuildProfileHandoff(input: {
   );
   const upstreamProvider =
     agent === "hermes" && resumeConfig.provider === "hermes-provider"
-      ? catalogHandoff.previousProfile.inference.upstreamProvider
+      ? (catalogHandoff.previousProfile.inference?.upstreamProvider ?? resumeConfig.provider)
       : resumeConfig.provider;
   const currentOpenClawContextWindow =
     agent === "openclaw"
@@ -108,8 +108,8 @@ export function prepareManagedRebuildProfileHandoff(input: {
   if (
     agent === "openclaw" &&
     currentOpenClawContextWindow === null &&
-    (catalogHandoff.previousProfile.inference.model !== resumeConfig.model ||
-      catalogHandoff.previousProfile.inference.upstreamProvider !== resumeConfig.provider)
+    (catalogHandoff.previousProfile.inference?.model !== resumeConfig.model ||
+      catalogHandoff.previousProfile.inference?.upstreamProvider !== resumeConfig.provider)
   ) {
     throw new Error(
       `Cannot determine a context window for the current OpenClaw target '${resumeConfig.provider}/${resumeConfig.model}'.`,

src/lib/actions/sandbox/rebuild-managed-workload-mutation-guard.test.ts

@@ -165,7 +165,7 @@ describe("managed workload rebuild mutation guard", () => {
       agentDefinition: {},
       resumeConfig: {
         provider: "nvidia",
-        model: previousProfile.inference.model,
+        model: previousProfile.inference!.model,
         preferredInferenceApi: "openai-completions",
         endpointUrl: null,
         compatibleEndpointReasoning: null,

src/lib/actions/sandbox/snapshot-hermes-managed-clone-broker.test.ts

@@ -66,8 +66,8 @@ function sourceEntry(profile: ManagedStartupProfile): SandboxEntry {
     workload: receipt,
     lifecycleGeneration: "generation-source",
     lifecycleLiveIdentityFingerprint: createHash("sha256").update("source").digest("hex"),
-    provider: profile.inference.upstreamProvider,
-    model: profile.inference.model,
+    provider: profile.inference!.upstreamProvider,
+    model: profile.inference!.model,
     hermesToolGateways: ["nous-web"],
     hermesInferenceProvider: "source-hermes-inference",
   };

src/lib/actions/sandbox/snapshot-managed-clone-providers.test.ts

@@ -75,8 +75,8 @@ function entry(
     workload,
     lifecycleGeneration: `generation-${name}`,
     lifecycleLiveIdentityFingerprint: createHash("sha256").update(name).digest("hex"),
-    provider: profile.inference.upstreamProvider,
-    model: profile.inference.model,
+    provider: profile.inference!.upstreamProvider,
+    model: profile.inference!.model,
     ...overrides,
   };
 }