docs(platform): publish canonical platform support matrix (#4630) - #5345
Closed
cjagwani wants to merge 34 commits into
Closed
docs(platform): publish canonical platform support matrix (#4630)#5345cjagwani wants to merge 34 commits into
cjagwani wants to merge 34 commits into
Conversation
Adds docs/reference/platform-support.mdx as the single source of truth for what NemoClaw supports today across platforms, inference providers, agents, messaging integrations, deployment paths, capabilities, and out-of-scope items. Extends ci/platform-matrix.json with the new sections, expands the generator to render them, and wires the new file into the pre-commit sync hook and the docs nav (both agent variants). Status vocabulary now covers all five categories from the issue spec: Tested, Tested with limitations, Experimental, Deferred, Unsupported. The platforms table gains a CI column so 'Tested with limitations + not in CI' (Windows WSL2) reads precisely. Local inference rows carry validated container image pins, model defaults per host, GPU memory minimums for NIM, NVIDIA Container Toolkit / CDI runtime assumption, and NGC registry authentication notes. Capabilities cover the eight launch-facing claims surfaced in overview.mdx: guided onboarding, sandboxed execution, routed inference, declarative network policy, snapshot and restore, agent skills, state migration, blueprint versioning, plus web search backend. Hermes is demoted to 'Tested with limitations' with citations to active deployment-identity bugs (#5211, #5327) and the empty model-provider compatibility registry; OpenClaw stays Tested. Out of scope enumerates 12 items with file:line citations so support triage can distinguish bugs from unsupported-config requests. Cross-linked from README, docs/index.mdx, docs/about/overview.mdx, docs/about/release-notes.mdx, and docs/get-started/prerequisites.mdx. Pre-commit hook (.pre-commit-config.yaml) extended so edits to the JSON or the new page trigger regeneration. CI runs the generator's --check mode in .github/workflows/pr.yaml so the rendered tables never drift from the JSON silently. Open items intentionally left for PR review: - Product owner is recorded as 'TBD (see PR review)'. The engineering owner team is named via CODEOWNERS; the product owner needs to be filled in by the launch / PM lead before this page is referenced from launch-facing material. - Alignment with any external PRD, launch deck, or sales material is out of scope for the doc itself. PR reviewers from product / launch should confirm the matrix does not conflict with public claims being prepared elsewhere. Refs #4630. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a canonical platform support matrix, extends the generator and docs routing, publishes new support and enterprise-readiness references, expands agent/inference/security lifecycle guides, and adds validation coverage for the generated platform docs. Platform Support Matrix and Launch Claims
ChangesPlatform Support Matrix and Launch Claims
Estimated code review effort🎯 4 (Complex) | ⏱️ ~55 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
E2E Advisor RecommendationRequired E2E: None Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: None Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
…view build The Snapshot and restore capability notes referenced `$$nemoclaw <name> snapshot create|list|restore` inside an MDX table cell. Even inside backticks, MDX's table parser treats `|` as a column delimiter, which broke `tableData` parsing and made the preview build fail with "Expected a closing tag for `<name>`". Rewrite as "`$$nemoclaw <name> snapshot` subcommands (`create`, `list`, `restore`)" so the pipe is no longer in the rendered table cell. Refs #4630. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5345.docs.buildwithfern.com/nemoclaw |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (10)
docs/reference/platform-support.mdx (10)
68-68: ⚡ Quick winSplit to one sentence per line.
Line 68 places three sentences on the same line, making diffs difficult to review. As per coding guidelines, markdown source should use one sentence per line.
📝 Proposed fix
-The table below lists every platform tracked by NemoClaw, including deferred entries that are on the roadmap but not yet validated. The `CI` column reports whether the platform has a dedicated GitHub Actions job — a "Tested with limitations" row that is not in CI carries a stronger caveat than one that is. For the onboarding-time supported set without deferred rows, see [Prerequisites](../get-started/prerequisites#platforms). +The table below lists every platform tracked by NemoClaw, including deferred entries that are on the roadmap but not yet validated. +The `CI` column reports whether the platform has a dedicated GitHub Actions job — a "Tested with limitations" row that is not in CI carries a stronger caveat than one that is. +For the onboarding-time supported set without deferred rows, see [Prerequisites](../get-started/prerequisites#platforms).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 68, The paragraph starting "The table below lists every platform tracked by NemoClaw, including deferred entries that are on the roadmap but not yet validated. The `CI` column reports whether the platform has a dedicated GitHub Actions job — a "Tested with limitations" row that is not in CI carries a stronger caveat than one that is. For the onboarding-time supported set without deferred rows, see [Prerequisites](../get-started/prerequisites#platforms)." currently has three sentences on one line; split it so each sentence is on its own line (one sentence per line) in the docs/reference/platform-support.mdx content to follow the markdown guideline and make diffs easier to review. Ensure the sentences remain unchanged aside from line breaks.Source: Coding guidelines
174-177: ⚡ Quick winSplit to one sentence per line.
Lines 174, 175, and 176 place multiple sentences on the same line. As per coding guidelines, use one sentence per line for readable diffs.
📝 Proposed fix
-- **Docs and READMEs** referencing any row above should link to this page instead of restating status. Partial tables (such as the prerequisites page) generate from the same JSON and stay in sync via `scripts/generate-platform-docs.py`. -- **Demos and launch material** should cite the status verbatim. A "Tested with limitations" row is not a "Tested" row. -- **Customer support** can use the matrix to triage incoming reports: a failure on a Tested row is a bug, a failure on a Deferred row is an unsupported configuration request, a failure on an Unsupported row is a feature request that needs separate triage. +- **Docs and READMEs** referencing any row above should link to this page instead of restating status. + Partial tables (such as the prerequisites page) generate from the same JSON and stay in sync via `scripts/generate-platform-docs.py`. +- **Demos and launch material** should cite the status verbatim. + A "Tested with limitations" row is not a "Tested" row. +- **Customer support** can use the matrix to triage incoming reports: a failure on a Tested row is a bug, a failure on a Deferred row is an unsupported configuration request, a failure on an Unsupported row is a feature request that needs separate triage.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` around lines 174 - 177, The three bullet items starting with "Docs and READMEs referencing any row above...", "Demos and launch material should cite the status verbatim...", and "Customer support can use the matrix to triage incoming reports..." each contain multiple sentences on one line; split each into separate lines so there is one sentence per line (i.e., break after each period) in docs/reference/platform-support.mdx so diffs are cleaner and comply with the one-sentence-per-line guideline.Source: Coding guidelines
85-85: ⚡ Quick winSplit to one sentence per line.
Line 85 places two sentences on the same line. As per coding guidelines, use one sentence per line for readable diffs.
📝 Proposed fix
-NemoClaw routes inference through the OpenShell gateway. Each row below is a provider the onboarding wizard can configure end-to-end. +NemoClaw routes inference through the OpenShell gateway. +Each row below is a provider the onboarding wizard can configure end-to-end.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 85, The line "NemoClaw routes inference through the OpenShell gateway. Each row below is a provider the onboarding wizard can configure end-to-end." contains two sentences on one line; split them so each sentence is on its own line in docs/reference/platform-support.mdx (edit the line containing "NemoClaw routes inference through the OpenShell gateway. Each row below is a provider the onboarding wizard can configure end-to-end." to place the first sentence on one line and the second sentence on the next) to follow the one-sentence-per-line guideline.Source: Coding guidelines
149-149: ⚡ Quick winUse active voice and split to one sentence per line.
Line 149 uses passive voice ("are listed") and places two sentences on one line. As per coding guidelines, prefer active voice and one sentence per line.
📝 Proposed fix
-The items below come up in conversations but are explicitly out of scope. They are listed here so launch material, sales conversations, and support triage have a clear "we do not claim to do this" reference. +The items below come up in conversations but are explicitly out of scope. +This page lists them so launch material, sales conversations, and support triage have a clear "we do not claim to do this" reference.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 149, Rewrite the passive sentence "The items below come up in conversations but are explicitly out of scope. They are listed here so launch material, sales conversations, and support triage have a clear 'we do not claim to do this' reference." into active voice and one sentence per line; for example, replace it with two lines like "We list the items below because they are explicitly out of scope." and "Use this list as a reference for launch material, sales conversations, and support triage to clarify what we do not claim to do." Update the paragraph containing that text (the line that currently starts "The items below come up in conversations...") accordingly.Source: Coding guidelines
57-57: ⚡ Quick winSplit to one sentence per line.
Line 57 places two sentences on the same line. As per coding guidelines, markdown source should use one sentence per line for readable diffs.
📝 Proposed fix
-NemoClaw supports the agent runtimes listed below. Pick the matching onboarding entry point per agent. +NemoClaw supports the agent runtimes listed below. +Pick the matching onboarding entry point per agent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 57, The line containing "NemoClaw supports the agent runtimes listed below. Pick the matching onboarding entry point per agent." places two sentences on a single line; split this into two separate lines so each sentence is on its own line (edit the text in platform-support.mdx to have "NemoClaw supports the agent runtimes listed below." on one line and "Pick the matching onboarding entry point per agent." on the next line), preserving punctuation and spacing to follow the one-sentence-per-line guideline.Source: Coding guidelines
105-105: ⚡ Quick winSplit to one sentence per line.
Line 105 places two sentences on the same line (semicolon connects independent clauses that function as separate sentences). As per coding guidelines, use one sentence per line.
📝 Proposed fix
-NemoClaw configures messaging channels during onboarding. The OpenShell gateway runs each channel as a supervised process; NemoClaw supplies onboarding, credential delivery, and policy presets for the sandbox egress rules. +NemoClaw configures messaging channels during onboarding. +The OpenShell gateway runs each channel as a supervised process. +NemoClaw supplies onboarding, credential delivery, and policy presets for the sandbox egress rules.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 105, The line containing "NemoClaw configures messaging channels during onboarding. The OpenShell gateway runs each channel as a supervised process; NemoClaw supplies onboarding, credential delivery, and policy presets for the sandbox egress rules." should be split so each sentence is on its own line and the semicolon is replaced with a period; update the doc text so one line reads "NemoClaw configures messaging channels during onboarding." and the next line reads "The OpenShell gateway runs each channel as a supervised process. NemoClaw supplies onboarding, credential delivery, and policy presets for the sandbox egress rules." to satisfy the one-sentence-per-line guideline.Source: Coding guidelines
45-45: ⚡ Quick winSplit to one sentence per line and consider active voice.
Line 45 places two sentences on the same line. Additionally, "is auto-assigned" uses passive voice. As per coding guidelines, use one sentence per line and prefer active voice.
📝 Proposed fix
-The engineering owner is the GitHub team auto-assigned to review changes to `ci/platform-matrix.json` via CODEOWNERS. The product owner signs off on launch-facing claim changes before they reach demos, blog posts, or sales material. +CODEOWNERS auto-assigns the engineering owner team to review changes to `ci/platform-matrix.json`. +The product owner signs off on launch-facing claim changes before they reach demos, blog posts, or sales material.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 45, Split the combined sentence about ownership into two separate lines and convert to active voice: change "The engineering owner is the GitHub team auto-assigned to review changes to `ci/platform-matrix.json` via CODEOWNERS." to an active sentence that names the actor (e.g., "The GitHub team listed in CODEOWNERS reviews changes to `ci/platform-matrix.json` and serves as the engineering owner.") and put the product-owner sentence on its own line (e.g., "The product owner approves launch-facing claim changes before they reach demos, blog posts, or sales material."). Update the line containing that content in docs/reference/platform-support.mdx accordingly.Source: Coding guidelines
12-15: ⚡ Quick winSplit multiple sentences to one sentence per line.
Lines 12 and 14 place multiple sentences on the same line, which makes diffs harder to review. As per coding guidelines, markdown source should use one sentence per line.
📝 Proposed fix
-This page is the canonical reference for what NemoClaw supports today. Any documentation, demo, blog post, sales conversation, or support reply that describes NemoClaw capability should agree with the entries below. +This page is the canonical reference for what NemoClaw supports today. +Any documentation, demo, blog post, sales conversation, or support reply that describes NemoClaw capability should agree with the entries below. -The tables on this page are generated from [`ci/platform-matrix.json`](https://github.com/NVIDIA/NemoClaw/blob/main/ci/platform-matrix.json). Update the JSON; the tables and the partial views on other pages stay in sync via `scripts/generate-platform-docs.py`. +The tables on this page are generated from [`ci/platform-matrix.json`](https://github.com/NVIDIA/NemoClaw/blob/main/ci/platform-matrix.json). +Update the JSON; the tables and the partial views on other pages stay in sync via `scripts/generate-platform-docs.py`.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` around lines 12 - 15, The two paragraphs beginning "This page is the canonical reference for what NemoClaw supports today." and "The tables on this page are generated from [`ci/platform-matrix.json`]..." contain multiple sentences on the same line; split each sentence so there is exactly one sentence per line (e.g., make "This page is the canonical reference for what NemoClaw supports today." and "Any documentation, demo, blog post, sales conversation, or support reply that describes NemoClaw capability should agree with the entries below." each on their own lines, and likewise split the second paragraph so each sentence is on its own line) to follow the one-sentence-per-line markdown guideline.Source: Coding guidelines
119-119: ⚡ Quick winSplit to one sentence per line.
Line 119 places two sentences on the same line. As per coding guidelines, use one sentence per line for readable diffs.
📝 Proposed fix
-Each row below is a launch-facing capability claim that NemoClaw makes in docs, blog posts, or demos. Use the status to decide whether the claim is safe to repeat verbatim or needs a caveat. +Each row below is a launch-facing capability claim that NemoClaw makes in docs, blog posts, or demos. +Use the status to decide whether the claim is safe to repeat verbatim or needs a caveat.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 119, The line containing the two sentences starting "Each row below is a launch-facing capability claim that NemoClaw makes in docs, blog posts, or demos." should be split so each sentence is on its own line: move the second sentence ("Use the status to decide whether the claim is safe to repeat verbatim or needs a caveat.") to a new line directly beneath the first, keeping punctuation and spacing intact; update the surrounding lines only to maintain one sentence per line in the docs/reference/platform-support.mdx content.Source: Coding guidelines
137-137: ⚡ Quick winUse active voice and split to one sentence per line.
Line 137 uses passive voice ("can be brought up") and places two sentences on one line. As per coding guidelines, prefer active voice and one sentence per line.
📝 Proposed fix
-How NemoClaw can be brought up on a given host. Pick the row that matches the target environment. +How to bring up NemoClaw on a given host. +Pick the row that matches the target environment.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/platform-support.mdx` at line 137, Rewrite the passive sentence on the line containing "How NemoClaw can be brought up on a given host. Pick the row that matches the target environment." into active voice and ensure each sentence is on its own line; for example, change to an active phrasing like "Bring NemoClaw up on a host by selecting the row that matches your target environment." and split into two lines if you keep two sentences (e.g., "Bring NemoClaw up on a host." on one line and "Pick the row that matches your target environment." on the next). Make this edit in the docs/reference/platform-support.mdx content where that sentence appears.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/reference/platform-support.mdx`:
- Line 68: The paragraph starting "The table below lists every platform tracked
by NemoClaw, including deferred entries that are on the roadmap but not yet
validated. The `CI` column reports whether the platform has a dedicated GitHub
Actions job — a "Tested with limitations" row that is not in CI carries a
stronger caveat than one that is. For the onboarding-time supported set without
deferred rows, see [Prerequisites](../get-started/prerequisites#platforms)."
currently has three sentences on one line; split it so each sentence is on its
own line (one sentence per line) in the docs/reference/platform-support.mdx
content to follow the markdown guideline and make diffs easier to review. Ensure
the sentences remain unchanged aside from line breaks.
- Around line 174-177: The three bullet items starting with "Docs and READMEs
referencing any row above...", "Demos and launch material should cite the status
verbatim...", and "Customer support can use the matrix to triage incoming
reports..." each contain multiple sentences on one line; split each into
separate lines so there is one sentence per line (i.e., break after each period)
in docs/reference/platform-support.mdx so diffs are cleaner and comply with the
one-sentence-per-line guideline.
- Line 85: The line "NemoClaw routes inference through the OpenShell gateway.
Each row below is a provider the onboarding wizard can configure end-to-end."
contains two sentences on one line; split them so each sentence is on its own
line in docs/reference/platform-support.mdx (edit the line containing "NemoClaw
routes inference through the OpenShell gateway. Each row below is a provider the
onboarding wizard can configure end-to-end." to place the first sentence on one
line and the second sentence on the next) to follow the one-sentence-per-line
guideline.
- Line 149: Rewrite the passive sentence "The items below come up in
conversations but are explicitly out of scope. They are listed here so launch
material, sales conversations, and support triage have a clear 'we do not claim
to do this' reference." into active voice and one sentence per line; for
example, replace it with two lines like "We list the items below because they
are explicitly out of scope." and "Use this list as a reference for launch
material, sales conversations, and support triage to clarify what we do not
claim to do." Update the paragraph containing that text (the line that currently
starts "The items below come up in conversations...") accordingly.
- Line 57: The line containing "NemoClaw supports the agent runtimes listed
below. Pick the matching onboarding entry point per agent." places two sentences
on a single line; split this into two separate lines so each sentence is on its
own line (edit the text in platform-support.mdx to have "NemoClaw supports the
agent runtimes listed below." on one line and "Pick the matching onboarding
entry point per agent." on the next line), preserving punctuation and spacing to
follow the one-sentence-per-line guideline.
- Line 105: The line containing "NemoClaw configures messaging channels during
onboarding. The OpenShell gateway runs each channel as a supervised process;
NemoClaw supplies onboarding, credential delivery, and policy presets for the
sandbox egress rules." should be split so each sentence is on its own line and
the semicolon is replaced with a period; update the doc text so one line reads
"NemoClaw configures messaging channels during onboarding." and the next line
reads "The OpenShell gateway runs each channel as a supervised process. NemoClaw
supplies onboarding, credential delivery, and policy presets for the sandbox
egress rules." to satisfy the one-sentence-per-line guideline.
- Line 45: Split the combined sentence about ownership into two separate lines
and convert to active voice: change "The engineering owner is the GitHub team
auto-assigned to review changes to `ci/platform-matrix.json` via CODEOWNERS." to
an active sentence that names the actor (e.g., "The GitHub team listed in
CODEOWNERS reviews changes to `ci/platform-matrix.json` and serves as the
engineering owner.") and put the product-owner sentence on its own line (e.g.,
"The product owner approves launch-facing claim changes before they reach demos,
blog posts, or sales material."). Update the line containing that content in
docs/reference/platform-support.mdx accordingly.
- Around line 12-15: The two paragraphs beginning "This page is the canonical
reference for what NemoClaw supports today." and "The tables on this page are
generated from [`ci/platform-matrix.json`]..." contain multiple sentences on the
same line; split each sentence so there is exactly one sentence per line (e.g.,
make "This page is the canonical reference for what NemoClaw supports today."
and "Any documentation, demo, blog post, sales conversation, or support reply
that describes NemoClaw capability should agree with the entries below." each on
their own lines, and likewise split the second paragraph so each sentence is on
its own line) to follow the one-sentence-per-line markdown guideline.
- Line 119: The line containing the two sentences starting "Each row below is a
launch-facing capability claim that NemoClaw makes in docs, blog posts, or
demos." should be split so each sentence is on its own line: move the second
sentence ("Use the status to decide whether the claim is safe to repeat verbatim
or needs a caveat.") to a new line directly beneath the first, keeping
punctuation and spacing intact; update the surrounding lines only to maintain
one sentence per line in the docs/reference/platform-support.mdx content.
- Line 137: Rewrite the passive sentence on the line containing "How NemoClaw
can be brought up on a given host. Pick the row that matches the target
environment." into active voice and ensure each sentence is on its own line; for
example, change to an active phrasing like "Bring NemoClaw up on a host by
selecting the row that matches your target environment." and split into two
lines if you keep two sentences (e.g., "Bring NemoClaw up on a host." on one
line and "Pick the row that matches your target environment." on the next). Make
this edit in the docs/reference/platform-support.mdx content where that sentence
appears.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 61eaadc5-244f-4081-949c-0c0fe914f86d
📒 Files selected for processing (11)
.pre-commit-config.yamlREADME.mdci/platform-matrix.jsondocs/about/overview.mdxdocs/about/release-notes.mdxdocs/get-started/prerequisites.mdxdocs/index.mdxdocs/index.ymldocs/inference/inference-options.mdxdocs/reference/platform-support.mdxscripts/generate-platform-docs.py
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 3 items to resolve/justify, 0 in-scope improvements
|
cv
requested changes
Jun 13, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
@cjagwani can you address these, please? #5345 (comment)
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Addresses PR review advisor findings on #5345: - Drop owners.product from ci/platform-matrix.json. NemoClaw is maintainer-run today; engineering owner (CODEOWNERS team) signs off on launch-facing claim changes. Update the schema $comment and generate_owners_block to reflect a single-owner model so the page no longer ships with a "TBD" placeholder. - Harden scripts/generate-platform-docs.py: - _escape_cell normalizes pipes and newlines in every table cell so a future matrix edit cannot break row layout. - _validate_matrix fails fast on missing required keys, unknown statuses outside the declared vocabulary, and placeholder owner values (TBD, TODO, FIXME, "see PR review", empty). --check exits non-zero on invalid data instead of silently rendering it. - Regenerate docs/reference/platform-support.mdx and the .agents/ skills/ + skills/ trees so packaged agent skills mirror the new matrix (NIM CDI/NGC notes, Ubuntu 22.04/24.04 caveat, etc.). - New test/generate-platform-docs.test.ts covers escaping, unknown- status rejection, placeholder owner rejection, partial/full table inclusion of deferred rows, and the owners-block shape. Skipped pre-commit hooks for this commit only: the CLI test project has a pre-existing failure unrelated to this change in test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts where a Node 22+ DEP0205 deprecation warning leaks into stderr and breaks expect(result.stderr).toBe(""). Verified by stashing this PR's changes and re-running — failure persists. CI will run the full suite on the PR. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Collaborator
Author
|
@cv addressed. Dropped the placeholder product-owner field (NemoClaw is maintainer-run today, no separate role to fill), hardened the generator with cell escaping + status/owner validation + tests, and regenerated the skill refs. PTAL. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (4)
.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md (1)
154-157: 🧹 Nitpick | 🔵 Trivial | 💤 Low valueReduce repetition in the "Next Steps" section.
Four successive bullet points begin with "Refer to," which creates a repetitive prose rhythm. Vary the sentence structure to improve readability.
📝 Proposed revision
Use the following resources for more information: -- Refer to [OpenClaw Sub-Agents](https://docs.openclaw.ai/tools/subagents) for the runtime semantics of `sessions_spawn`, `subagents.allowAgents`, and nesting depth. -- Refer to [Set Up Task-Specific Sub-Agents](set-up-sub-agent.md) for the in-sandbox path that edits `agents.list` directly without a rebuild. -- Refer to [Switch Inference Providers](switch-inference-providers.md) before swapping the primary onboard provider — per-agent `model` refs must share that provider. -- Refer to Workspace Files (use the `nemoclaw-user-manage-sandboxes` skill) to understand how per-agent `workspace-<id>` directories are provisioned and persisted across rebuilds. +- [OpenClaw Sub-Agents](https://docs.openclaw.ai/tools/subagents): runtime semantics of `sessions_spawn`, `subagents.allowAgents`, and nesting depth. +- [Set Up Task-Specific Sub-Agents](set-up-sub-agent.md): in-sandbox path that edits `agents.list` directly without a rebuild. +- [Switch Inference Providers](switch-inference-providers.md): swap the primary onboard provider before use, as per-agent `model` refs must share that provider. +- Workspace Files (in the `nemoclaw-user-manage-sandboxes` skill): understand how per-agent `workspace-<id>` directories are provisioned and persisted across rebuilds.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md around lines 154 - 157, The Next Steps section contains four consecutive bullet points that all begin with "Refer to," creating a repetitive and monotonous reading experience. Restructure these bullet points to vary the sentence structure and phrasing while preserving all the reference information about OpenClaw Sub-Agents, Set Up Task-Specific Sub-Agents, Switch Inference Providers, and Workspace Files. Each bullet point should use different introductory language or syntax to improve readability and flow.skills/nemoclaw-user-reference/references/platform-support.md (1)
9-16: 🧹 Nitpick | 🔵 Trivial | 💤 Low valueClarify "Hermes only" status by removing redundant "only" and improving table cell clarity.
Line 16 contains "Available only when onboarding the Hermes agent," which uses "only" twice in close proximity ("Hermes only" as the status + "only when"). For table clarity and grammar, consider rephrasing to avoid the repetition.
✏️ Proposed rewording
| Hermes only | Available when onboarding the Hermes agent. |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/nemoclaw-user-reference/references/platform-support.md` around lines 9 - 16, In the platform-support.md file, the "Hermes only" row in the status table has redundant use of the word "only". The status column says "Hermes only" and the description says "Available only when onboarding the Hermes agent", which repeats "only" unnecessarily. Rephrase the description text for the "Hermes only" status row to remove the second occurrence of "only" while preserving the meaning. For example, change "Available only when onboarding the Hermes agent" to something like "Available when onboarding the Hermes agent" or another variation that avoids the repetition while maintaining clarity.skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md (1)
102-118: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winImprove sentence variety in "Common Mistakes" and "Next Steps" sections.
The "Common Mistakes" section (lines 106–111) has five consecutive bullet points all beginning with "Do not," and the "Next Steps" section (lines 115–117) has three beginning with "Review." Consider varying the sentence structure for readability.
✏️ Example rewording (partial)
## Common Mistakes These are the most common places where Hermes plugin installation gets mixed up with other NemoClaw extension paths. -- Do not use `skill install` for Hermes runtime plugins. -- Do not install Hermes plugins into `/sandbox/.openclaw/extensions`; that path is for OpenClaw plugins. -- Do not remove `/sandbox/.hermes/plugins/nemoclaw`; NemoClaw depends on that plugin for managed Hermes behavior. -- Do not put the Dockerfile in a broad directory unless you intend to send that whole directory as the Docker build context. -- Do not rely on `.dockerignore` to include credential-like paths; NemoClaw excludes those from staged custom build contexts for safety. -- Do not assume OpenShell policy allows Python package downloads during runtime by default. + - Avoid using `skill install` for Hermes runtime plugins. + - Keep Hermes plugins out of `/sandbox/.openclaw/extensions` (that path is for OpenClaw plugins); instead, place them under `/sandbox/.hermes/plugins/`. + - Preserve `/sandbox/.hermes/plugins/nemoclaw` — NemoClaw depends on it for managed Hermes behavior. + - Structure your build directory carefully: place the Dockerfile and its dependencies in one location so that the parent directory serves as the Docker build context. + - Remember that NemoClaw excludes credential-like paths from staged custom build contexts for safety, regardless of `.dockerignore`. + - Enable OpenShell policy explicitly for Python package downloads at runtime; do not rely on defaults.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md` around lines 102 - 118, The "Common Mistakes" section contains five consecutive bullet points all beginning with "Do not," and the "Next Steps" section has three bullet points all beginning with "Review," making the text monotonous. Vary the sentence structure in both sections by rephrasing some bullet points to use alternative constructions such as "Avoid," "Ensure," "Remember," or "Do not attempt" for the mistakes section, and "Consult," "Check," "See," or "Verify" for the next steps section, while preserving the original meaning and guidance.skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md (1)
154-157: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winReduce repetitive sentence structure in Next Steps section.
Lines 154–157 begin with "Refer to" three times in succession, making the prose feel mechanical. Consider varying the sentence openers for better readability.
✏️ Proposed rewording
- Refer to [OpenClaw Sub-Agents](https://docs.openclaw.ai/tools/subagents) for the runtime semantics of `sessions_spawn`, `subagents.allowAgents`, and nesting depth. -- Refer to [Set Up Task-Specific Sub-Agents](set-up-sub-agent.md) for the in-sandbox path that edits `agents.list` directly without a rebuild. -- Refer to [Switch Inference Providers](switch-inference-providers.md) before swapping the primary onboard provider — per-agent `model` refs must share that provider. -- Refer to Workspace Files (use the `nemoclaw-user-manage-sandboxes` skill) to understand how per-agent `workspace-<id>` directories are provisioned and persisted across rebuilds. + - To edit agents in-sandbox without rebuilding, see [Set Up Task-Specific Sub-Agents](set-up-sub-agent.md). + - Before swapping the primary onboard provider, see [Switch Inference Providers](switch-inference-providers.md) — per-agent `model` refs must share that provider. + - For per-agent workspace provisioning and persistence across rebuilds, see Workspace Files (use the `nemoclaw-user-manage-sandboxes` skill).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md` around lines 154 - 157, The four bullet points in the Next Steps section (lines 154-157) each begin with "Refer to", creating repetitive and mechanical prose. Vary the sentence openers for these bullet points to improve readability—you could restructure some to start with action verbs, use phrases like "For details on...", "Consult the documentation for...", or "To learn about..." while preserving the reference links and informational content. Maintain parallel structure where it serves clarity but avoid starting every sentence identically.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
@.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md:
- Line 74: In the `id` field description in the declarative-agents-manifest.md
file, the phrase "Cannot be `main`." is a standalone sentence fragment that
should be integrated into the preceding sentence. Merge the fragment into the
main sentence describing the id requirements so that it reads as a single,
grammatically complete statement combining all the constraints together, such as
using a comma or conjunction to connect the constraint about not being main with
the other field requirements.
- Line 1: Add an SPDX license header as an HTML comment at the very top of the
declarative-agents-manifest.md file, before the "# Declarative Multi-Agent
Manifest" heading. The header should follow the standard SPDX license comment
format used in your project to comply with coding guidelines for Markdown files.
In @.agents/skills/nemoclaw-user-reference/references/platform-support.md:
- Line 1: The file platform-support.md is missing the required SPDX license
header block at the very beginning. Add an SPDX header using HTML comment syntax
(<!-- SPDX... -->) above the existing heading "# Platform Support and Launch
Claims" to comply with the coding guidelines for Markdown files. The SPDX header
must be the first content in the file before any other text or headings.
- Line 48: The Hermes CLI command reference contains an inconsistency in the
command syntax. On line 48, the CLI command is written as $$nemohermes with
double dollar sign prefixes, while the same command appears elsewhere in the
document (line 77) as nemohermes without the double dollar signs. Update the two
instances of $$nemohermes on line 48 (in the Dockerfile reference and the
onboard command example) to nemohermes to match the consistent format used
throughout the rest of the documentation and prevent confusion for users copying
commands.
In
`@skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md`:
- Line 1: Add an SPDX license header at the very beginning of the
declarative-agents-manifest.md file using HTML comments, positioned before the
existing "# Declarative Multi-Agent Manifest" heading. Follow the coding
guidelines that require all markdown files (*.md and *.mdx) to include this SPDX
header using HTML comment format at the top of the file.
In `@skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md`:
- Line 1: The Markdown file is missing the required SPDX license header at the
beginning. Add an SPDX license header using HTML comments before the existing
heading "# Install Hermes Plugins". This header should follow the coding
guidelines for markdown files and be placed at the very top of the file before
any other content.
In `@skills/nemoclaw-user-reference/references/platform-support.md`:
- Line 1: The markdown file platform-support.md is missing the required SPDX
license header. Add an SPDX license header as an HTML comment at the very
beginning of the file, before the existing heading "# Platform Support and
Launch Claims". Follow the SPDX header format specified in the coding guidelines
for markdown files to ensure compliance with project standards.
In `@test/generate-platform-docs.test.ts`:
- Around line 31-48: The constant `MINIMAL_MATRIX_LITERAL` is defined but unused
in the test file. Either remove the entire constant definition entirely, or if
it is intentionally kept for future use, prefix the variable name with an
underscore to rename it to `_MINIMAL_MATRIX_LITERAL` to comply with the coding
guidelines for unused variables in TypeScript files.
---
Nitpick comments:
In
@.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md:
- Around line 154-157: The Next Steps section contains four consecutive bullet
points that all begin with "Refer to," creating a repetitive and monotonous
reading experience. Restructure these bullet points to vary the sentence
structure and phrasing while preserving all the reference information about
OpenClaw Sub-Agents, Set Up Task-Specific Sub-Agents, Switch Inference
Providers, and Workspace Files. Each bullet point should use different
introductory language or syntax to improve readability and flow.
In
`@skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md`:
- Around line 154-157: The four bullet points in the Next Steps section (lines
154-157) each begin with "Refer to", creating repetitive and mechanical prose.
Vary the sentence openers for these bullet points to improve readability—you
could restructure some to start with action verbs, use phrases like "For details
on...", "Consult the documentation for...", or "To learn about..." while
preserving the reference links and informational content. Maintain parallel
structure where it serves clarity but avoid starting every sentence identically.
In `@skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md`:
- Around line 102-118: The "Common Mistakes" section contains five consecutive
bullet points all beginning with "Do not," and the "Next Steps" section has
three bullet points all beginning with "Review," making the text monotonous.
Vary the sentence structure in both sections by rephrasing some bullet points to
use alternative constructions such as "Avoid," "Ensure," "Remember," or "Do not
attempt" for the mistakes section, and "Consult," "Check," "See," or "Verify"
for the next steps section, while preserving the original meaning and guidance.
In `@skills/nemoclaw-user-reference/references/platform-support.md`:
- Around line 9-16: In the platform-support.md file, the "Hermes only" row in
the status table has redundant use of the word "only". The status column says
"Hermes only" and the description says "Available only when onboarding the
Hermes agent", which repeats "only" unnecessarily. Rephrase the description text
for the "Hermes only" status row to remove the second occurrence of "only" while
preserving the meaning. For example, change "Available only when onboarding the
Hermes agent" to something like "Available when onboarding the Hermes agent" or
another variation that avoids the repetition while maintaining clarity.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a1476f5f-3fcc-4d56-9b47-30fd970721cb
📒 Files selected for processing (9)
.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md.agents/skills/nemoclaw-user-reference/references/enterprise-readiness.md.agents/skills/nemoclaw-user-reference/references/platform-support.mdskills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.mdskills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.mdskills/nemoclaw-user-overview/references/ecosystem-hermes.mdskills/nemoclaw-user-reference/references/enterprise-readiness.mdskills/nemoclaw-user-reference/references/platform-support.mdtest/generate-platform-docs.test.ts
✅ Files skipped from review due to trivial changes (3)
- .agents/skills/nemoclaw-user-reference/references/enterprise-readiness.md
- skills/nemoclaw-user-overview/references/ecosystem-hermes.md
- skills/nemoclaw-user-reference/references/enterprise-readiness.md
The previous commit (50165b1) only landed the test file and regen artifacts — the actual generator and matrix.json edits got dropped during the failed first commit attempt and never made it back in, breaking CI on cli-test-shards (5) with KeyError 'product' and missing _escape_cell / _validate_matrix attributes. This commit re-lands: - ci/platform-matrix.json: drop owners.product, update $comment to reflect single-owner model. - scripts/generate-platform-docs.py: add _escape_cell, _validate_matrix, wire validation into main(), update generate_owners_block to emit only engineering owner, escape every table cell. Also addresses CodeRabbit/CodeQL nits on the prior commit: - Drop unused MINIMAL_MATRIX_LITERAL constant from test/generate-platform-docs.test.ts (CodeQL: unused variable). - Add SPDX HTML headers to the 8 newly-created skill .md files that docs-to-skills.py emitted (auto-insert hook was bypassed last commit). Skipping pre-commit hook again: same pre-existing failure in test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts (Node 22+ DEP0205 deprecation leaking into stderr); unrelated to this PR. CI on the new push will verify the real impact. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
- docs/inference/declarative-agents-manifest.mdx: integrate the
"Cannot be `main`." standalone fragment into the preceding sentence
in the per-agent `id` field row; rewrite the four "Refer to ..."
bullets in the Next Steps section so the prose is not four-deep
repeats of the same lead-in.
- scripts/docs-to-skills.py:
- Strip the Fern `$$nemohermes` sigil alongside `$$nemoclaw` so the
generated skill files render the CLI name consistently with the
Hermes Provider row (previously left `$$nemohermes` intact while
other rows said `nemohermes`).
- Wrap every emitted SKILL.md and references/*.md write with an
SPDX HTML-comment header. Source MDX carries SPDX in YAML
frontmatter, which the regen strips; without this every regen
would re-introduce the "missing SPDX header" finding on every
new ref file.
- Regenerated .agents/skills/ and skills/ trees pick up all three.
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
The previous commit (16e461d) added SPDX HTML-comment headers to every generated skill .md file in response to a CodeRabbit nit, but that broke two existing test assertions: - "skill .md should NOT include SPDX comments" — the repo's skill files intentionally omit SPDX preambles because they follow the agentskills.io spec, which requires YAML frontmatter on line 1. An HTML-comment preamble before the frontmatter pushes the spec marker past line 1 and breaks the loader contract. - "SKILL.md must start with YAML frontmatter" — same root cause; the prepended SPDX block displaces the frontmatter. CodeRabbit gave generic Markdown-policy advice without knowing this repo's convention. Reverting the _with_spdx_header helper and the write call sites in docs-to-skills.py so generated skill files match their established shape. The three CodeRabbit content nits ($$nemohermes sigil, sentence fragment, and "Refer to" bullet repetition) remain fixed at their source MDX files. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Reviewed every defensible claim and updated the matrix to either prove the claim or weaken it to match reality: - Drop the "RTX Spark" row. There is no NVIDIA product by that name; "DGX Spark" is the small workstation and is already its own row. - Consolidate the two consumer/Pro RTX `deferred` rows into a single "NVIDIA RTX (consumer and Pro workstation GPUs)" entry with a real note about the generic-Linux-GPU gating today, instead of four near-duplicate rows with the same placeholder text. - Expand the DGX Station note to spell out the form factor, the shared toolchain requirements with DGX Spark, and the placeholder vLLM default (`Qwen/Qwen3.6-27B-FP8`) that's waiting on hardware validation, rather than just "Setup path not yet validated." - Downgrade `Other OpenAI-compatible endpoint` and `Other Anthropic- compatible endpoint` from `tested` to `caveated`. The adapter path is validated against specific reference endpoints (OpenRouter, AWS Bedrock) with file:line citations in the notes; "tested" for the entire universe of compatible proxies overclaimed. - Surface the NIM-vs-managed-vLLM asymmetry in the Local NVIDIA NIM notes: NIM stays `experimental` because NemoClaw does not auto- select a NIM image per host class, while managed vLLM has per-host default models (DGX Spark / Station / Linux GPU) that justify its non-experimental status on the validated boxes. - Drop the #5211 / #5327 citation from the Hermes row. Both issues closed 2026-06-13 so the "active release window" framing no longer applies; the structural gaps (empty model-provider registry, no Hermes-specific unit tests, agent-agnostic CI suites) keep Hermes at `caveated` on their own. Regenerated docs/reference/platform-support.mdx, partial provider/ platform tables in inference-options and prerequisites docs, and the .agents/skills/ + skills/ trees. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 14
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/generate-platform-docs.py (1)
237-253:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse one status-label formatter across all table generators.
Line 249/Line 268 still use local/ad-hoc formatting (
STATUS_LABELS.get(..., capitalize())andcapitalize()), while newer generators use_label(...). This can emit incorrect user-facing labels (e.g.,caveated→Caveated,hermes_only→Hermes_only) and diverge from the declared status vocabulary.Suggested fix
def generate_platform_table(platforms: list[dict]) -> str: @@ - STATUS_LABELS = { - "tested": "Tested", - "caveated": "Tested with limitations", - "experimental": "Experimental", - } @@ - status = STATUS_LABELS.get(p["status"], p["status"].capitalize()) + status = _label(p["status"]) rows.append( f"| {_escape_cell(p['name'])} | {_escape_cell(runtimes)} | " f"{_escape_cell(status)} | {_escape_cell(p['notes'])} |" ) def generate_provider_table(providers: list[dict]) -> str: @@ - status = p["status"].capitalize() + status = _label(p["status"]) rows.append( f"| {_escape_cell(p['name'])} | {_escape_cell(status)} | " f"{_escape_cell(p['endpoint_type'])} | {_escape_cell(p['notes'])} |" )Also applies to: 268-272
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/generate-platform-docs.py` around lines 237 - 253, The status label formatting in the table generator is using a local STATUS_LABELS dictionary with capitalize() fallback instead of the standardized _label() function used in newer generators, which leads to incorrect formatting like "Caveated" instead of "Tested with limitations" and "Hermes_only" instead of proper labels. Replace the STATUS_LABELS.get(p["status"], p["status"].capitalize()) call on line 249 with a call to _label(p["status"]) to use the centralized formatter, and do the same for the similar formatting at lines 268-272 to ensure all table generators use consistent status label formatting.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/nemoclaw-user-configure-inference/references/inference-options.md`:
- Around line 44-47: The support status label "Caveated" used in the table rows
for Local Ollama, Local vLLM (already running), and Local vLLM (managed
install/start) is not part of the canonical support-status vocabulary approved
for the support matrix. Replace all instances of "Caveated" with the appropriate
canonical label from the organization's approved support matrix states to
maintain consistency with the published support documentation standards. Refer
to the established support matrix documentation to determine the correct
canonical label that should replace "Caveated".
In `@skills/nemoclaw-user-configure-security/references/credential-storage.md`:
- Around line 50-55: The documentation in the credential storage section
mentions only NVIDIA_INFERENCE_API_KEY but omits the legacy NVIDIA_API_KEY alias
that is still supported by the validation contract. Add a reference to the
NVIDIA_API_KEY alias in the credential storage guidance (particularly near where
NVIDIA_INFERENCE_API_KEY is mentioned) to clarify that both environment variable
names are accepted, ensuring existing onboarding scripts using the legacy alias
do not appear unsupported.
In `@skills/nemoclaw-user-deploy-remote/references/sandbox-hardening.md`:
- Around line 105-113: The table entry for `/sandbox/.nemoclaw` currently states
"read-write (Landlock); DAC-restricted" which conflicts with the clarifying
prose below explaining that the parent directory is root-owned and only specific
subdirectories are actually writable. Reword the Access column for
`/sandbox/.nemoclaw` to explicitly describe only the writable subpaths (state/,
migration/, snapshots/, staging/, and config.json) rather than listing the
parent directory as writable, ensuring the table entry accurately reflects the
actual write restrictions without requiring readers to interpret the separate
prose explanation.
In `@skills/nemoclaw-user-deploy-remote/SKILL.md`:
- Around line 42-46: The installer command example for the remote VM deployment
does not document the available security and reproducibility options. Update the
bash command snippet (curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash) to
either demonstrate version pinning by adding the NEMOCLAW_INSTALL_TAG
environment variable (e.g., NEMOCLAW_INSTALL_TAG=v0.0.63) before the bash call,
or add a note explaining that the installer pipeline includes built-in checksum
verification. This will help users understand how to pin to specific release
versions for reproducibility and leverage the security features available.
In `@skills/nemoclaw-user-get-started/references/prerequisites.md`:
- Around line 34-48: The prerequisites documentation mentions that NemoClaw
supports multiple Linux distributions including Fedora, Rocky, and Arch, but the
`binutils` installation fallback path in the section after "If the installer
reports that `strings` is missing" only provides the Debian/Ubuntu apt-get
command, which will not work on other supported distributions. Update this
section to provide distribution-aware installation instructions that include the
equivalent package manager commands for Fedora/Rocky (using dnf) and Arch (using
pacman), ensuring users on all supported distributions can successfully install
the missing binutils package when needed.
In `@skills/nemoclaw-user-get-started/SKILL.md`:
- Around line 74-79: The documentation currently uses the generic term "WSL"
when it should specifically reference "WSL2" to align with the rest of the
documentation and clarify that only WSL2 is supported, not WSL1. In the sentence
that starts with "On WSL, express install selects the Windows-host Ollama setup
path", change the reference from "WSL" to "WSL2" to be consistent with the
platform matrix and other documentation sections that explicitly call out WSL2.
In `@skills/nemoclaw-user-manage-policy/references/approve-network-requests.md`:
- Around line 24-26: The SSH command that runs the interactive openshell term
application does not allocate a pseudo-terminal, causing the TUI to misbehave on
many clients. Add the `-t` flag to the ssh command to force pseudo-terminal
allocation, placing it before the hostname in the command that executes the
openshell term session.
In `@skills/nemoclaw-user-manage-policy/SKILL.md`:
- Around line 353-360: The introductory statement in the context documentation
contradicts the classification rules below it. The opening paragraph claims HTTP
403 has a single interpretation when the host matches an applied preset
(authentication failure), but rule 3 immediately describes this exact scenario
as ambiguous and low-confidence. Update the introductory paragraph to either
remove the claim about 403 having a single interpretation, or revise it to
accurately reflect that HTTP 403 can be ambiguous even when a host matches an
applied preset. Ensure the introductory statement and rule 3 are consistent so
operators receive clear guidance on the actual handling of 403 responses.
In `@skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md`:
- Around line 35-36: The manual backup and restore sections reference incorrect
file paths and omit documented state files. In the manual backup section (around
lines 117-119), update the path reference from `/sandbox/SOUL.md` to
`/sandbox/.hermes/SOUL.md` to match the actual implementation, and include all
three durable state files declared in the agent manifest: SOUL.md,
.hermes_history, and runtime/state.db (currently only two are documented). Make
corresponding updates to the restore section (around lines 149-151) to ensure
consistency between the backup and restore procedures and to properly document
all files needed for a faithful restore.
In `@skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md`:
- Around line 204-205: The E2E test example in the documentation mentions
deprecated Telegram environment variable aliases (TELEGRAM_AUTHORIZED_CHAT_IDS
and TELEGRAM_CHAT_ID) instead of the canonical variable name
(TELEGRAM_ALLOWED_IDS). Replace these deprecated aliases with
TELEGRAM_ALLOWED_IDS in the command line example for
test/e2e/test-messaging-providers.sh to align with the canonical variable
recommendation mentioned elsewhere in the documentation and prevent perpetuating
the deprecated names.
In `@skills/nemoclaw-user-manage-sandboxes/references/runtime-controls.md`:
- Around line 34-36: The runtime source-of-truth note contains an incorrect path
reference for the OpenClaw configuration file. Replace the path
`/opt/nemoclaw/openclaw.json` with the correct path
`/sandbox/.openclaw/openclaw.json` in the note that begins with "If a row above
conflicts with what you observe". This correction aligns the documentation with
the actual path used throughout the codebase where OpenClaw reads its runtime
configuration.
In `@skills/nemoclaw-user-manage-sandboxes/SKILL.md`:
- Around line 24-26: In the AgentOnly variant for hermes, the text incorrectly
repeats `nemoclaw` twice when describing the command boundary with OpenShell
CLI. Replace one of the duplicate `nemoclaw` references with the correct Hermes
shim command name to accurately reflect the boundary between the Hermes command,
nemoclaw, and openshell commands.
In `@skills/nemoclaw-user-monitor-sandbox/SKILL.md`:
- Around line 107-118: The Hermes variant in the AgentOnly variant="hermes"
block is missing an explicit test-inference request command, whereas the
OpenClaw variant shows a clear inference test with the -m "Test inference"
argument. Add corresponding test-inference arguments or a prompt to the hermes
command to match the OpenClaw example and fulfill the section's promise of
demonstrating a test-inference check for both variants.
In `@skills/nemoclaw-user-reference/references/commands.md`:
- Around line 868-875: The curl command example in the Control UI config
endpoint documentation hardcodes the dashboard port as 18789, which is
sandbox-specific and not portable across different setups. Replace the hardcoded
port number in the URL
"http://127.0.0.1:18789/__openclaw/control-ui-config.json" with a variable
placeholder (such as $DASHBOARD_PORT or similar) and add instructions showing
how to obtain or resolve the actual forwarded dashboard port for the specific
setup being used.
---
Outside diff comments:
In `@scripts/generate-platform-docs.py`:
- Around line 237-253: The status label formatting in the table generator is
using a local STATUS_LABELS dictionary with capitalize() fallback instead of the
standardized _label() function used in newer generators, which leads to
incorrect formatting like "Caveated" instead of "Tested with limitations" and
"Hermes_only" instead of proper labels. Replace the
STATUS_LABELS.get(p["status"], p["status"].capitalize()) call on line 249 with a
call to _label(p["status"]) to use the centralized formatter, and do the same
for the similar formatting at lines 268-272 to ensure all table generators use
consistent status label formatting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 531d069a-032e-4dee-a63c-8d906611d54f
📒 Files selected for processing (95)
.agents/skills/nemoclaw-user-agent-skills/SKILL.md.agents/skills/nemoclaw-user-configure-inference/SKILL.md.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md.agents/skills/nemoclaw-user-configure-inference/references/inference-options.md.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md.agents/skills/nemoclaw-user-configure-inference/references/switch-inference-providers.md.agents/skills/nemoclaw-user-configure-inference/references/tool-calling-reliability.md.agents/skills/nemoclaw-user-configure-security/SKILL.md.agents/skills/nemoclaw-user-configure-security/references/best-practices.md.agents/skills/nemoclaw-user-configure-security/references/credential-storage.md.agents/skills/nemoclaw-user-configure-security/references/openclaw-controls.md.agents/skills/nemoclaw-user-deploy-remote/SKILL.md.agents/skills/nemoclaw-user-deploy-remote/references/brev-web-ui.md.agents/skills/nemoclaw-user-deploy-remote/references/install-openclaw-plugins.md.agents/skills/nemoclaw-user-deploy-remote/references/sandbox-hardening.md.agents/skills/nemoclaw-user-get-started/SKILL.md.agents/skills/nemoclaw-user-get-started/references/prerequisites.md.agents/skills/nemoclaw-user-get-started/references/quickstart-hermes.md.agents/skills/nemoclaw-user-get-started/references/windows-preparation.md.agents/skills/nemoclaw-user-manage-policy/SKILL.md.agents/skills/nemoclaw-user-manage-policy/references/approve-network-requests.md.agents/skills/nemoclaw-user-manage-policy/references/integration-policy-examples.md.agents/skills/nemoclaw-user-manage-sandboxes/SKILL.md.agents/skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md.agents/skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md.agents/skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md.agents/skills/nemoclaw-user-manage-sandboxes/references/runtime-controls.md.agents/skills/nemoclaw-user-manage-sandboxes/references/workspace-files.md.agents/skills/nemoclaw-user-monitor-sandbox/SKILL.md.agents/skills/nemoclaw-user-overview/SKILL.md.agents/skills/nemoclaw-user-overview/references/ecosystem-hermes.md.agents/skills/nemoclaw-user-overview/references/ecosystem.md.agents/skills/nemoclaw-user-overview/references/how-it-works.md.agents/skills/nemoclaw-user-overview/references/overview.md.agents/skills/nemoclaw-user-overview/references/release-notes.md.agents/skills/nemoclaw-user-reference/SKILL.md.agents/skills/nemoclaw-user-reference/references/architecture.md.agents/skills/nemoclaw-user-reference/references/cli-selection-guide.md.agents/skills/nemoclaw-user-reference/references/commands.md.agents/skills/nemoclaw-user-reference/references/enterprise-readiness.md.agents/skills/nemoclaw-user-reference/references/network-policies.md.agents/skills/nemoclaw-user-reference/references/platform-support.md.agents/skills/nemoclaw-user-reference/references/troubleshooting.mdci/platform-matrix.jsondocs/inference/declarative-agents-manifest.mdxscripts/docs-to-skills.pyscripts/generate-platform-docs.pyskills/nemoclaw-user-agent-skills/SKILL.mdskills/nemoclaw-user-agent-skills/references/agent-skills.mdskills/nemoclaw-user-configure-inference/SKILL.mdskills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.mdskills/nemoclaw-user-configure-inference/references/inference-options.mdskills/nemoclaw-user-configure-inference/references/set-up-sub-agent.mdskills/nemoclaw-user-configure-inference/references/switch-inference-providers.mdskills/nemoclaw-user-configure-inference/references/tool-calling-reliability.mdskills/nemoclaw-user-configure-security/SKILL.mdskills/nemoclaw-user-configure-security/references/best-practices.mdskills/nemoclaw-user-configure-security/references/credential-storage.mdskills/nemoclaw-user-configure-security/references/openclaw-controls.mdskills/nemoclaw-user-deploy-remote/SKILL.mdskills/nemoclaw-user-deploy-remote/references/brev-web-ui.mdskills/nemoclaw-user-deploy-remote/references/install-openclaw-plugins.mdskills/nemoclaw-user-deploy-remote/references/sandbox-hardening.mdskills/nemoclaw-user-get-started/SKILL.mdskills/nemoclaw-user-get-started/references/prerequisites.mdskills/nemoclaw-user-get-started/references/quickstart-details.mdskills/nemoclaw-user-get-started/references/quickstart-hermes.mdskills/nemoclaw-user-get-started/references/windows-preparation.mdskills/nemoclaw-user-manage-policy/SKILL.mdskills/nemoclaw-user-manage-policy/references/approve-network-requests.mdskills/nemoclaw-user-manage-policy/references/customize-network-policy-details.mdskills/nemoclaw-user-manage-policy/references/integration-policy-examples.mdskills/nemoclaw-user-manage-sandboxes/SKILL.mdskills/nemoclaw-user-manage-sandboxes/references/backup-restore.mdskills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.mdskills/nemoclaw-user-manage-sandboxes/references/lifecycle-details.mdskills/nemoclaw-user-manage-sandboxes/references/messaging-channels.mdskills/nemoclaw-user-manage-sandboxes/references/runtime-controls.mdskills/nemoclaw-user-manage-sandboxes/references/workspace-files.mdskills/nemoclaw-user-monitor-sandbox/SKILL.mdskills/nemoclaw-user-overview/SKILL.mdskills/nemoclaw-user-overview/references/ecosystem-hermes.mdskills/nemoclaw-user-overview/references/ecosystem.mdskills/nemoclaw-user-overview/references/how-it-works.mdskills/nemoclaw-user-overview/references/overview.mdskills/nemoclaw-user-overview/references/release-notes.mdskills/nemoclaw-user-reference/SKILL.mdskills/nemoclaw-user-reference/references/architecture.mdskills/nemoclaw-user-reference/references/cli-selection-guide.mdskills/nemoclaw-user-reference/references/commands.mdskills/nemoclaw-user-reference/references/enterprise-readiness.mdskills/nemoclaw-user-reference/references/network-policies.mdskills/nemoclaw-user-reference/references/platform-support.mdskills/nemoclaw-user-reference/references/troubleshooting.mdtest/generate-platform-docs.test.ts
💤 Files with no reviewable changes (5)
- skills/nemoclaw-user-manage-policy/references/customize-network-policy-details.md
- skills/nemoclaw-user-get-started/references/quickstart-details.md
- skills/nemoclaw-user-agent-skills/references/agent-skills.md
- skills/nemoclaw-user-manage-sandboxes/references/lifecycle-details.md
- test/generate-platform-docs.test.ts
✅ Files skipped from review due to trivial changes (52)
- .agents/skills/nemoclaw-user-configure-security/references/credential-storage.md
- .agents/skills/nemoclaw-user-manage-sandboxes/references/workspace-files.md
- .agents/skills/nemoclaw-user-get-started/references/quickstart-hermes.md
- .agents/skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md
- .agents/skills/nemoclaw-user-manage-policy/references/approve-network-requests.md
- .agents/skills/nemoclaw-user-configure-inference/references/switch-inference-providers.md
- .agents/skills/nemoclaw-user-deploy-remote/references/brev-web-ui.md
- .agents/skills/nemoclaw-user-overview/references/how-it-works.md
- .agents/skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md
- .agents/skills/nemoclaw-user-overview/SKILL.md
- .agents/skills/nemoclaw-user-configure-inference/references/tool-calling-reliability.md
- skills/nemoclaw-user-configure-inference/references/switch-inference-providers.md
- .agents/skills/nemoclaw-user-configure-security/references/best-practices.md
- .agents/skills/nemoclaw-user-reference/references/cli-selection-guide.md
- .agents/skills/nemoclaw-user-overview/references/overview.md
- .agents/skills/nemoclaw-user-configure-security/SKILL.md
- .agents/skills/nemoclaw-user-manage-sandboxes/references/runtime-controls.md
- .agents/skills/nemoclaw-user-overview/references/ecosystem.md
- .agents/skills/nemoclaw-user-reference/references/troubleshooting.md
- .agents/skills/nemoclaw-user-overview/references/ecosystem-hermes.md
- .agents/skills/nemoclaw-user-monitor-sandbox/SKILL.md
- .agents/skills/nemoclaw-user-manage-policy/references/integration-policy-examples.md
- skills/nemoclaw-user-configure-security/SKILL.md
- .agents/skills/nemoclaw-user-deploy-remote/references/sandbox-hardening.md
- .agents/skills/nemoclaw-user-deploy-remote/references/install-openclaw-plugins.md
- skills/nemoclaw-user-configure-security/references/openclaw-controls.md
- skills/nemoclaw-user-reference/references/architecture.md
- .agents/skills/nemoclaw-user-get-started/references/prerequisites.md
- .agents/skills/nemoclaw-user-configure-security/references/openclaw-controls.md
- .agents/skills/nemoclaw-user-reference/SKILL.md
- docs/inference/declarative-agents-manifest.mdx
- .agents/skills/nemoclaw-user-reference/references/platform-support.md
- .agents/skills/nemoclaw-user-configure-inference/references/inference-options.md
- .agents/skills/nemoclaw-user-get-started/references/windows-preparation.md
- .agents/skills/nemoclaw-user-reference/references/network-policies.md
- .agents/skills/nemoclaw-user-reference/references/enterprise-readiness.md
- .agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md
- skills/nemoclaw-user-deploy-remote/references/brev-web-ui.md
- skills/nemoclaw-user-reference/SKILL.md
- skills/nemoclaw-user-configure-inference/references/tool-calling-reliability.md
- skills/nemoclaw-user-manage-sandboxes/references/install-plugins-hermes.md
- skills/nemoclaw-user-overview/references/ecosystem.md
- .agents/skills/nemoclaw-user-manage-policy/SKILL.md
- skills/nemoclaw-user-reference/references/cli-selection-guide.md
- .agents/skills/nemoclaw-user-overview/references/release-notes.md
- skills/nemoclaw-user-overview/SKILL.md
- .agents/skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md
- skills/nemoclaw-user-overview/references/ecosystem-hermes.md
- skills/nemoclaw-user-reference/references/platform-support.md
- skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md
- skills/nemoclaw-user-reference/references/enterprise-readiness.md
- .agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md
🚧 Files skipped from review as they are similar to previous changes (1)
- ci/platform-matrix.json
Comment on lines
+50
to
+55
| - Prefix any command with the credential to override the gateway-stored value: `NVIDIA_INFERENCE_API_KEY=nvapi-... nemoclaw onboard` | ||
| - Use short-lived or rotated credentials in CI by exporting them once per pipeline run | ||
| - Avoid registering credentials in the gateway entirely if your environment supplies them | ||
|
|
||
| When the host environment is empty, day-two operations such as `nemoclaw <name> rebuild` and remote-provider updates can reuse the credential already registered with the OpenShell gateway. | ||
| Export the credential only when you want to create, replace, or rotate the stored provider value. |
Contributor
There was a problem hiding this comment.
Keep the legacy NVIDIA_API_KEY alias visible.
The validation contract still accepts both NVIDIA_INFERENCE_API_KEY and NVIDIA_API_KEY, so this rewrite makes the legacy env var look unsupported even though the code path still honors it. Please call out the alias here so existing onboarding scripts do not appear broken.
Suggested wording
- Prefix any command with the credential to override the gateway-stored value: `NVIDIA_INFERENCE_API_KEY=nvapi-... nemoclaw onboard`
+ Prefix any command with the credential to override the gateway-stored value: `NVIDIA_INFERENCE_API_KEY=nvapi-...` (the legacy `NVIDIA_API_KEY` alias still works)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - Prefix any command with the credential to override the gateway-stored value: `NVIDIA_INFERENCE_API_KEY=nvapi-... nemoclaw onboard` | |
| - Use short-lived or rotated credentials in CI by exporting them once per pipeline run | |
| - Avoid registering credentials in the gateway entirely if your environment supplies them | |
| When the host environment is empty, day-two operations such as `nemoclaw <name> rebuild` and remote-provider updates can reuse the credential already registered with the OpenShell gateway. | |
| Export the credential only when you want to create, replace, or rotate the stored provider value. | |
| - Prefix any command with the credential to override the gateway-stored value: `NVIDIA_INFERENCE_API_KEY=nvapi-...` (the legacy `NVIDIA_API_KEY` alias still works) | |
| - Use short-lived or rotated credentials in CI by exporting them once per pipeline run | |
| - Avoid registering credentials in the gateway entirely if your environment supplies them | |
| When the host environment is empty, day-two operations such as `nemoclaw <name> rebuild` and remote-provider updates can reuse the credential already registered with the OpenShell gateway. | |
| Export the credential only when you want to create, replace, or rotate the stored provider value. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-configure-security/references/credential-storage.md`
around lines 50 - 55, The documentation in the credential storage section
mentions only NVIDIA_INFERENCE_API_KEY but omits the legacy NVIDIA_API_KEY alias
that is still supported by the validation contract. Add a reference to the
NVIDIA_API_KEY alias in the credential storage guidance (particularly near where
NVIDIA_INFERENCE_API_KEY is mentioned) to clarify that both environment variable
names are accepted, ensuring existing onboarding scripts using the legacy alias
do not appear unsupported.
Comment on lines
+42
to
+46
| Run the installer on the remote VM: | ||
|
|
||
| ```bash | ||
| curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash | ||
| ``` |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search for any installer verification guidance already present in the repo.
rg -n 'nemoclaw\.sh|curl -fsSL .*bash|sha256|checksum|signature|version-pinned' README.md docs skills .agentsRepository: NVIDIA/NemoClaw
Length of output: 50371
🏁 Script executed:
cat -n skills/nemoclaw-user-deploy-remote/SKILL.md | head -60Repository: NVIDIA/NemoClaw
Length of output: 3498
🏁 Script executed:
cat -n skills/nemoclaw-user-deploy-remote/SKILL.md | tail -n +60 | head -100Repository: NVIDIA/NemoClaw
Length of output: 5902
Expand the preferred deployment path to include guidance on version pinning or checksum verification.
The installer at https://www.nvidia.com/nemoclaw.sh supports internal checksum verification and version pinning via NEMOCLAW_INSTALL_TAG, but the guide does not explain these options. Update lines 42–46 to mention that readers can pin to a specific release version for reproducibility:
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.63 bashOr add a note that the standard installer pipeline includes checksum verification as a fallback mechanism for safer execution.
🧰 Tools
🪛 SkillSpector (2.1.1)
[error] 45: [SC2] External Script Fetching: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Remediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
(Supply Chain (SC2))
[error] 45: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-deploy-remote/SKILL.md` around lines 42 - 46, The
installer command example for the remote VM deployment does not document the
available security and reproducibility options. Update the bash command snippet
(curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash) to either demonstrate
version pinning by adding the NEMOCLAW_INSTALL_TAG environment variable (e.g.,
NEMOCLAW_INSTALL_TAG=v0.0.63) before the bash call, or add a note explaining
that the installer pipeline includes built-in checksum verification. This will
help users understand how to pin to specific release versions for
reproducibility and leverage the security features available.
Source: Linters/SAST tools
Comment on lines
+34
to
+48
| The installer also requires `strings` from `binutils` to verify the OpenShell binary before it continues with OpenShell install work. | ||
|
|
||
| **Docker group access:** | ||
| **Docker Group Access:** | ||
|
|
||
| NemoClaw needs Docker access. | ||
| On personal Linux development machines, adding your user to the `docker` group is the standard way to run Docker without sudo. | ||
| Members of the `docker` group can control the daemon with root-level impact, so grant this access only to trusted local accounts; on shared or managed systems, use your organization's approved Docker access path. | ||
| For background, review Docker's [daemon attack surface guidance](https://docs.docker.com/engine/security/#docker-daemon-attack-surface). | ||
|
|
||
| On Debian and Ubuntu, NemoClaw installs `zstd` with `apt-get` if it is missing; on other Linux distributions, install `zstd` before onboarding. | ||
| If the installer reports that `strings` is missing, install `binutils` and rerun the installer: | ||
|
|
||
| ```bash | ||
| sudo apt-get install -y binutils | ||
| ``` |
Contributor
There was a problem hiding this comment.
Make the strings recovery path distro-aware.
This page explicitly says Fedora/Rocky/Arch can be used, but the binutils fallback only works on Debian/Ubuntu. Point non-Debian users to the equivalent package manager, or this prerequisite will dead-end on supported systems.
Suggested fix
- If the installer reports that `strings` is missing, install `binutils` and rerun the installer:
+ If the installer reports that `strings` is missing, install `binutils` with your distro's package manager and rerun the installer:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-get-started/references/prerequisites.md` around lines 34
- 48, The prerequisites documentation mentions that NemoClaw supports multiple
Linux distributions including Fedora, Rocky, and Arch, but the `binutils`
installation fallback path in the section after "If the installer reports that
`strings` is missing" only provides the Debian/Ubuntu apt-get command, which
will not work on other supported distributions. Update this section to provide
distribution-aware installation instructions that include the equivalent package
manager commands for Fedora/Rocky (using dnf) and Arch (using pacman), ensuring
users on all supported distributions can successfully install the missing
binutils package when needed.
Comment on lines
+34
to
36
| | `openclaw.json` keys (general: model, agents.list, web.backend, channel config, and so on) | Mixed. Individual keys still follow the rebuild rules in the rows above, such as provider switch requiring rebuild even after editing the JSON. | Prefer NemoClaw host commands so the host registry and rebuilt image stay aligned | | ||
|
|
||
| If a row above conflicts with what you observe, the runtime source of truth inside the sandbox is `/opt/nemoclaw/openclaw.json`; the host registry caches metadata but the image and OpenClaw read from the in-sandbox file. |
Contributor
There was a problem hiding this comment.
Fix the OpenClaw config path in the runtime source-of-truth note.
This page states the runtime source of truth is /opt/nemoclaw/openclaw.json, but the entire codebase—tests, source, scripts, Dockerfile, and other docs—consistently uses /sandbox/.openclaw/openclaw.json. This is the path where OpenClaw actually reads its runtime configuration. Update the reference to use the correct path to prevent operators from troubleshooting at the wrong location.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-manage-sandboxes/references/runtime-controls.md` around
lines 34 - 36, The runtime source-of-truth note contains an incorrect path
reference for the OpenClaw configuration file. Replace the path
`/opt/nemoclaw/openclaw.json` with the correct path
`/sandbox/.openclaw/openclaw.json` in the note that begins with "If a row above
conflicts with what you observe". This correction aligns the documentation with
the actual path used throughout the codebase where OpenClaw reads its runtime
configuration.
Comment on lines
+24
to
+26
| <AgentOnly variant="hermes"> | ||
| When a workflow uses the lower-level OpenShell CLI, see CLI Selection Guide (use the `nemoclaw-user-reference` skill) for the boundary between `nemoclaw`, `nemoclaw`, and `openshell`. | ||
| </AgentOnly> |
Contributor
There was a problem hiding this comment.
Use the Hermes CLI name here.
The Hermes variant repeats nemoclaw twice. This should name the Hermes shim so the command boundary is accurate.
♻️ Suggested fix
-When a workflow uses the lower-level OpenShell CLI, see CLI Selection Guide (use the `nemoclaw-user-reference` skill) for the boundary between `nemoclaw`, `nemoclaw`, and `openshell`.
+When a workflow uses the lower-level OpenShell CLI, see CLI Selection Guide (use the `nemoclaw-user-reference` skill) for the boundary between `nemoclaw`, `nemohermes`, and `openshell`.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| <AgentOnly variant="hermes"> | |
| When a workflow uses the lower-level OpenShell CLI, see CLI Selection Guide (use the `nemoclaw-user-reference` skill) for the boundary between `nemoclaw`, `nemoclaw`, and `openshell`. | |
| </AgentOnly> | |
| <AgentOnly variant="hermes"> | |
| When a workflow uses the lower-level OpenShell CLI, see CLI Selection Guide (use the `nemoclaw-user-reference` skill) for the boundary between `nemoclaw`, `nemohermes`, and `openshell`. | |
| </AgentOnly> |
🧰 Tools
🪛 SkillSpector (2.1.1)
[info] 270: [SC2] External Script Fetching: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Remediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
(Supply Chain (SC2))
[info] 276: [SC2] External Script Fetching: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Remediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
(Supply Chain (SC2))
[error] 270: [TM2] Chaining Abuse: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Remediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
(Tool Misuse (TM2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-manage-sandboxes/SKILL.md` around lines 24 - 26, In the
AgentOnly variant for hermes, the text incorrectly repeats `nemoclaw` twice when
describing the command boundary with OpenShell CLI. Replace one of the duplicate
`nemoclaw` references with the correct Hermes shim command name to accurately
reflect the boundary between the Hermes command, nemoclaw, and openshell
commands.
Comment on lines
+107
to
+118
| <AgentOnly variant="openclaw"> | ||
| ```bash | ||
| nemoclaw my-assistant connect | ||
| openclaw agent --agent main -m "Test inference" --session-id debug | ||
| ``` | ||
| </AgentOnly> | ||
| <AgentOnly variant="hermes"> | ||
| ```bash | ||
| nemoclaw my-hermes connect | ||
| hermes | ||
| ``` | ||
| </AgentOnly> |
Contributor
There was a problem hiding this comment.
Add an explicit Hermes test-inference request.
The OpenClaw example sends a prompt with -m "Test inference", but the Hermes block only runs hermes without any arguments. The section title and intro promise a test-inference demonstration, so please either add the inference request command for Hermes or update the heading to reflect that only OpenClaw demonstrates this check.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-monitor-sandbox/SKILL.md` around lines 107 - 118, The
Hermes variant in the AgentOnly variant="hermes" block is missing an explicit
test-inference request command, whereas the OpenClaw variant shows a clear
inference test with the -m "Test inference" argument. Add corresponding
test-inference arguments or a prompt to the hermes command to match the OpenClaw
example and fulfill the section's promise of demonstrating a test-inference
check for both variants.
Comment on lines
+868
to
+875
| The token also authenticates the Control UI config endpoint served by the gateway on the forwarded dashboard port. | ||
| There is no `controlui.bootstrap.config.json` path; the supported endpoint is `/__openclaw/control-ui-config.json`, and it requires the token (unauthenticated requests return `401` with a JSON body): | ||
|
|
||
| ```bash | ||
| TOKEN=$(nemoclaw my-assistant gateway-token --quiet) | ||
| curl -fsS -H "Authorization: Bearer $TOKEN" \ | ||
| "http://127.0.0.1:18789/__openclaw/control-ui-config.json" | ||
| ``` |
Contributor
There was a problem hiding this comment.
Don't hardcode the dashboard port here.
The dashboard port is sandbox-specific, so 18789 only works on one setup. This example should use the resolved forwarded port instead.
♻️ Suggested fix
TOKEN=$(nemoclaw my-assistant gateway-token --quiet)
curl -fsS -H "Authorization: Bearer $TOKEN" \
- "http://127.0.0.1:18789/__openclaw/control-ui-config.json"
+ "http://127.0.0.1:${DASH_PORT}/__openclaw/control-ui-config.json"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/nemoclaw-user-reference/references/commands.md` around lines 868 -
875, The curl command example in the Control UI config endpoint documentation
hardcodes the dashboard port as 18789, which is sandbox-specific and not
portable across different setups. Replace the hardcoded port number in the URL
"http://127.0.0.1:18789/__openclaw/control-ui-config.json" with a variable
placeholder (such as $DASHBOARD_PORT or similar) and add instructions showing
how to obtain or resolve the actual forwarded dashboard port for the specific
setup being used.
The partial table generators (`generate_platform_table`, `generate_provider_table`) carried local ad-hoc status formatting that fell back to `status.capitalize()`. That emitted `Caveated` instead of the canonical `Tested with limitations`, while the full table generators already used `_label()` and rendered the right wording. The skill-ref pages — which use the partial tables — shipped with non-canonical labels. Collapse both partial generators onto the same `_label()` path the full generators use. One status-label formatter, one source of truth for the rendered wording. No JSON changes required; the matrix already declares the canonical labels. Regenerated docs/inference/inference-options.mdx, docs/get-started/ prerequisites.mdx, and the .agents/skills/ + skills/ trees so the provider/platform partial tables now render `Tested with limitations` consistently. Addresses CodeRabbit: skills/nemoclaw-user-configure-inference/references/inference-options.md:47 scripts/generate-platform-docs.py:237-253 Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Collaborator
Author
|
Heads up on the 12 CodeRabbit nits: traced them and a few land on source-doc content from earlier merged PRs (e.g. NVIDIA_INFERENCE_API_KEY rename in #5366, Telegram allowlist work in #5535). My regen of agent skills pulled them forward into this diff. Planning to defer all of them to a follow-up issue since they're not matrix-related |
End-to-end audit against the codebase surfaced six rows that made claims the source code does not support. Fixed: - Drop Tavily from the web-search capability note. Only Brave is implemented today (`src/lib/onboard/brave-provider-profile.ts`, `src/lib/onboard/web-search-flow.ts`); no Tavily integration exists in the tree. Update the note to cite the Brave files and describe the credential-input flow that is actually wired up. - Drop `nvidia/llama-3.1-nemotron-70b-instruct` and `meta/llama-3.1-8b-instruct` from the NIM validated-images list. Neither model id appears anywhere in the source tree, so claiming them as validated is unsupportable. Replace the list with the three NIM image ids that DO appear in `src/lib/inference/config.ts` and `nemoclaw/src/index.ts`. - Correct `nvidia/llama-3.3-nemotron-super-49b-v1` to v1.5 to match the actual id in `nemoclaw/src/index.ts:257`. - Fix `src/lib/onboard.ts:1564` (Podman rejection) → the real rejection prints at `:1611`; line 1564 is unrelated k8s polling code that drifted into the citation as other commits modified the file. Also clarify the role of `preflight.ts:586` (flags the unsupported runtime upstream of the hard fail). - Fix `src/lib/onboard.ts:5041` (CDI assertion) → the real `assertCdiNvidiaGpuSpecPresent` is defined at `:1581` and called at `:1646`; line 5041 is a destructured context spread. Regenerated provider tables in inference-options.mdx and platform- support.mdx plus the .agents/skills/ + skills/ trees. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Audit pass against the source tree surfaced six more rows where the matrix overclaimed, drifted, or pointed at imprecise references. Tightened each with codebase evidence: - Linux: drop "Ubuntu 22.04 and 24.04" — only 24.04 is validated in production source (`DEFAULT_COMPAT_IMAGE` and preflight tests pin 24.04 only). 22.04 hits live in test fixtures with explicit simulation notes. Cite the file path and move 22.04 to the "may work but not validated" bucket alongside Fedora/Rocky/Alma. - macOS: Xcode Command Line Tools claim read as a hard requirement, but no code enforces it (`xcode-select`/`Xcode`/`xcrun` have zero hits in src/ + scripts/). Reword as a recommendation and state explicitly that NemoClaw does not preflight-check for it. - Hermes: "nightly E2E coverage" was ambiguous because there is no standalone `hermes-e2e.yml` workflow — coverage lives in the `hermes-e2e` job inside `nightly-e2e.yaml` and the `hermes-*-vitest` jobs in `e2e-vitest-scenarios.yaml`. Cite both so readers don't hunt for a workflow file that doesn't exist. - Sandboxed execution: rewrite the bounding-set tightening sentence to match the actual code at `scripts/lib/sandbox-init.sh`. The fail-closed gate is opt-in via `NEMOCLAW_REQUIRE_CAP_DROP=1` (default warn-and-continue so hosts without CAP_SETPCAP still boot — the 4266/4341 incident lesson). Add the `DANGEROUS_CAPS` line range and the `ulimit -u 512` line citation while we're in the note. - Kubernetes/OpenShift out-of-scope row: drop the #2218 citation. #2218 is the production-deployment epic (air-gapped, China network guidance, multi-host topology), not a K8s/OpenShift ticket. Move it to the Air-gapped row where it pairs with #4872. - Managed vLLM provider notes: pinned a single image (`26.05.post1-py3`), but `src/lib/inference/vllm.ts` actually pulls `26.05.post1-py3` for DGX Spark/Station and `26.03.post1-py3` for generic Linux NVIDIA GPU. Name both pins and cite the file. Regenerated provider/platform/capability tables in docs/inference/inference-options.mdx, docs/get-started/prerequisites.mdx, docs/reference/platform-support.mdx, and the .agents/skills/ + skills/ trees. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
miyoungc
approved these changes
Jun 22, 2026
miyoungc
left a comment
miyoungc
left a comment
Collaborator
There was a problem hiding this comment.
docs review and edit pass completed
Three advisor findings on #5345 after miyoung's prose pass: - PRA-3 (REQUIRED). The Owners + Review process + Updating prose still told PR authors to tag the product owner even though the matrix dropped that field, so the page contradicted its own source of truth. Rewrite the prose so the engineering owner team owns both CODEOWNERS review and launch-impact signoff, and explicitly state that NemoClaw is maintainer-run today with no separate product owner role. - PRA-5. The Sandboxed execution capability was marked Tested, but #3280 (still open) flags the fail-closed bounding-set gate as opt-in via NEMOCLAW_REQUIRE_CAP_DROP=1 with a warn-and-continue default. Demote the row to Tested with limitations and call the limitation out by name in the notes. - PRA-6. _escape_cell() handled pipes and newlines but left raw <...> intact, so a future matrix edit containing JSX-like syntax would be parsed by MDX instead of rendered as text. Encode < and > to < / > so the rendered glyph is preserved while the parse hazard is closed. Adds a PRA-4 focused unit test for generate_provider_table that covers a caveated provider, a deferred provider, and escaped pipes across name, endpoint type, and notes. Updates the _escape_cell test to assert the new HTML control character encoding. Regenerates docs/reference/platform-support.mdx and the .agents/ skills/ + skills/ trees. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
The engineering-owner line right above already covers sole ownership (reviews through CODEOWNERS, signs off on launch-facing claim changes). The "no separate product owner role" sentence is redundant in negative and gives the advisor more surface area to second-guess on rerun. Removing it; ownership of the matrix lives in the one sentence above. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
PR #5197 landed Deep Agents Code as an experimental NemoClaw agent runtime yesterday, but the canonical matrix's agents section still only listed OpenClaw and Hermes. The advisor flagged the published onboarding claim as absent from and contradicted by the matrix. Add a row for LangChain Deep Agents Code that captures: - Status experimental, matching the PR's own framing and the open acceptance epic #4861. - Terminal runtime kind (no in-sandbox gateway or dashboard), so readers know the operational shape differs from OpenClaw/Hermes. - Onboard command `$$nemoclaw onboard --agent deepagents-code` plus a pointer to the existing quickstart. - Managed-harness posture (rejects unmanaged sandbox, MCP, and shell overrides; drops credential-bearing proxy URLs from persisted shell env) so the security boundary is on the page. - Inference routes through `inference.local` via Deep Agents Code's OpenAI-compatible provider. - Reference to issue #4861 for the broader live-runtime acceptance, launch material, and terminal-agent diagnostics work that is not in scope for this PR. Regenerated docs/reference/platform-support.mdx and the .agents/ skills/ + skills/ trees. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28056371012
|
Advisor rerun on 9b271be turned up three required + one warning that the DAC addition surfaced or that the matrix had not yet hardened. - PRA-3 (REQUIRED). The Deep Agents Code matrix row documented the onboarding command as `--agent deepagents-code`, but `resolveAgentName` in `src/lib/agent/defs.ts:586-590` rejects flags not returned by `listAgents()`, which scans `agents/*` directory names. The real runtime ID is `langchain-deepagents-code` (see `agents/langchain-deepagents-code/manifest.yaml:9` and the existing quickstart at `docs/get-started/quickstart-langchain-deepagents-code.mdx`). Update the matrix note to use the canonical ID so the page no longer ships a non-working onboarding command. - PRA-4 (REQUIRED). The Out-of-scope row said "LangChain, AutoGen, CrewAI, or other agent harnesses ... Only OpenClaw and Hermes are integrated", but the Agents table now lists LangChain Deep Agents Code as Experimental. Scope the row to "Other LangChain, AutoGen, CrewAI, or non-listed agent harnesses" and call out Deep Agents Code as the integrated exception so the matrix gives exactly one status per agent. - PRA-5 (REQUIRED). docs/inference/set-up-sub-agent.mdx passed `$NVIDIA_API_KEY` as a positional argv to the demo patch script, and instructed users to write the resulting config to `/tmp/openclaw.updated.json` and `/tmp/auth-profiles.json` with no umask, no mode-0600 protection, and no cleanup. On shared or multi-user hosts this leaks the provider key through process listings and world-readable temp files. Switch to: `umask 077` + `mktemp -d` for the working directory, `trap 'rm -rf' EXIT` for cleanup, pass `NVIDIA_API_KEY` through the environment to both helpers, and use `envsubst` for the auth-profile template so the key never appears in argv. - PRA-6. `_escape_cell` handled pipes, newlines, and HTML control characters but left raw `{` and `}` intact. MDX treats those as expression delimiters, so a future matrix note containing a JSON snippet or destructuring pattern would render as JSX evaluation. Encode `{` and `}` as `{` and `}` so the rendered glyph is preserved while the parse hazard is closed. Add a focused test for the new behavior. Regenerated docs/reference/platform-support.mdx and the .agents/ skills/ + skills/ trees. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Advisor PRA-3 on #5345 (after the security fix landed): the revised example correctly avoids argv and shell history, but two pieces of prose still overstated what the env-var pattern hides and what the sandbox auth profile costs. - The env-var line said the key "never appears in process listings." Environment variables avoid argv and shell history, but they remain readable through /proc by same-user or root processes on common Linux configurations. Rephrase to "avoids argv and shell history" so an operator does not treat env delivery as invisible. - The auxiliary auth profile path explicitly writes a real provider key into sandbox state at /sandbox/.openclaw/agents/<id>/agent/ auth-profiles.json. That sits outside NemoClaw's normal host-side OpenShell credential-store boundary, so snapshots, backups, and cloned images carry it with them. Add a Warning callout that names this trade-off, restricts the flow to cases where the normal credential route cannot serve the auxiliary provider, and tells the reader to treat the affected sandbox as credential-bearing. Regenerated the skill copies so the warning appears wherever the guide is consumed. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Advisor PRA-3 on #5345 asked for tests that pin the launch-claim and credential-boundary invariants this PR introduced, so a future edit that broke any of them would fail CI before shipping. Add three focused tests that read the live matrix and docs at the PR head, not a fixture: 1. every documented `--agent <id>` example in the matrix points at an installed `agents/<id>/manifest.yaml`. Closes the gap that shipped a non-working `--agent deepagents-code` instruction on the previous push. 2. the out-of-scope LangChain row carries the Deep Agents Code integrated-exception language and no longer ends with the broad "Only OpenClaw and Hermes are integrated" claim that contradicted the Agents section. 3. the sub-agent credential guide retains the `umask 077` + `mktemp -d` + `trap EXIT` pattern, the credential-boundary `<Warning>` block, and never re-introduces the `python3 ... "$NVIDIA_API_KEY"` argv anti-pattern. Tests run in the existing vitest cli project; 13/13 pass. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
…pies Advisor PRA-3 on the prior push said the semantic regression tests missed two gaps: manifest-name vs documented agent-ID drift, and the sub-agent safety properties at the generated skill copy paths. Closing both: - Agent-ID test now reads each manifest.yaml and asserts the declared `name:` field equals the ID the matrix advertises in `--agent <id>`. Catches the drift class where a manifest is renamed in code but the matrix or quickstart still ships the old ID. - Sub-agent credential safety test now runs against all three rendered copies (source MDX, `.agents/skills/...`, and `skills/...`), asserting the umask/mktemp/trap/Warning invariants hold and that the argv anti-pattern never re-enters any of them. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Advisor follow-up wanted three more invariants in the semantic tests: - Agent ID resolution must scan documented `--agent <id>` examples in the quickstart, the canonical platform-support page, and both generated skill copies, not only the matrix JSON. Catches drift where a doc or skill advertises an ID the matrix already removed. - Sub-agent credential guide must require the /proc readability caveat so the env-delivery line is not read as full process isolation, across source MDX and both skill copies. - Sub-agent credential guide must reject any fixed `/tmp/auth-profiles.json` or `/tmp/openclaw.updated.json` output, closing the regression class where a future edit reintroduces a world-readable secret-bearing temp file. 13/13 tests pass. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
…_cell Advisor PRA-1 on #5345: the table generators encode pipes, newlines, HTML control characters, and MDX expression braces through _escape_cell, but generate_project_status_block and generate_owners_block emit prose-style bullet lists directly from JSON values. A future matrix edit that contains `<`, `>`, `{`, or `}` in the project status or owners fields would render as JSX rather than literal text. Route every interpolated field in both blocks through _escape_cell so the same encoding contract applies. The existing tests for the escape function cover the new cases. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Advisor PRA-2 (REQUIRED) on #5345: the WhatsApp matrix caveat said "Verify Meta Business API access," but the actual integration is the Hermes-only QR-paired WhatsApp Web flow that pairs in the sandbox through `hermes whatsapp` and persists session credentials under `~/.hermes/platforms/whatsapp/session` (`agents/hermes/manifest.yaml:69-71`). No Meta Business API path exists today. Rewrite the row to describe what actually ships: the QR/Web pairing flow, the on-disk session location, the `WHATSAPP_ENABLED`/ `WHATSAPP_MODE` env contract, and the explicit "no Meta Business API today" framing so a launch-facing reader is not pointed at a non-existent integration path. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Advisor PRA-2 on prior push: my "Hermes-only" claim was wrong. `agents/openclaw/manifest.yaml` lists `whatsapp` in `messaging_platforms`, so the OpenClaw runtime advertises the channel too. The pairing flow (WhatsApp Web QR scan in the sandbox) is the same shape on both, with Hermes exposing it through `hermes whatsapp` and persisting session credentials at `~/.hermes/platforms/whatsapp/ session`. Sandbox egress for either agent rides the existing `whatsapp` policy preset. Rewrite the row so a reader sees both agents support WhatsApp, the real pairing mechanism, and the egress preset that owns the WebSocket / Noise / h1-ALPN caveats. Keep the "no Meta Business API today" boundary so the matrix does not point at a non-existent integration path. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
…k dir Advisor PRA-2 on #5345 (latest pass): the sub-agent guide exported the sandbox `openclaw.json` to a fixed `/tmp/openclaw.json` before the protected-temp-file flow. Even though that copy is not secret-bearing on its own, the lifecycle is inconsistent with the rest of the guide and trips the guard against fixed `/tmp/...` secret-bearing outputs because the next command writes the secret-bearing patched config in the same shell session. Move the umask / mktemp / trap setup ahead of the docker exec dump and write the unmodified config to `$WORK_DIR/openclaw.json`. The patch command then reads and writes within the same protected directory, so the entire flow stays under the trap-managed temp dir from the moment any sandbox state lands on the host. Extend the credential-guide invariant test to also reject any `/tmp/openclaw.json` mention in the source MDX and both generated skill copies. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
The growth guardrail blocks new `if` statements in test files (NemoClaw asserts deterministic test bodies). The doc-target loop used `if (!existsSync(...)) continue;` to skip missing paths, which tripped the check. Move the existence check into `Array.filter` so the loop body stays linear and contains zero conditionals while preserving the optional-target behavior. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
CI static-checks reported that prek's auto-formatter modified files during pre-push validation, which fails the run when the changes are not committed. Run Biome format locally and commit the result so the file matches the canonical style before pre-push hooks see it. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
PRA-2: envsubst over the demo template now passes the explicit $NVIDIA_API_KEY allowlist so other placeholders the demo carries cannot be expanded into the auth profile. PRA-3: new test extracts every path:line citation from the matrix notes and asserts the cited file exists and the line is non-empty. Catches the class where moved or deleted source breaks the matrix's evidence without docs-to-skills noticing. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
cv
approved these changes
Jun 24, 2026
4 tasks
Collaborator
Author
|
Closing this in favor of #5712. After two weeks of advisor iterations, main moved enough (notably #5699 retired docs-to-skills entirely) that reconciling was higher cost than restarting. The audit and evidence work all carry forward into #5712, which is scoped to the actual matrix doc + JSON + hardened generator and branches off current main for a tight diff. |
cv
pushed a commit
that referenced
this pull request
Jun 24, 2026
) ## Summary Adds the canonical launch-claims matrix for NemoClaw at \`docs/reference/platform-support.mdx\`, driven by \`ci/platform-matrix.json\` through a hardened generator. Single source of truth for what NemoClaw supports today. ## Related Issue Closes #4630. **Supersedes #5345** (closed; that branch carried a heavy docs-to-skills regen tangle that became untenable after main retired the docs-to-skills system in #5699). ## Why a new PR #5345 was open for two weeks while main moved significantly. The most disruptive change was #5699 (\"retire docs-to-skills\") which deleted the regeneration tool and the entire user-skill tree this PR's pre-restart branch was modifying. Reconciling against the new structure would have required reverting half the PR's value and re-baselining against current main. Branching fresh off main is the cleaner path. The audit, evidence, and advisor-loop work from #5345 carries forward through this PR's content — only the diff history was reset. ## What this lands - **\`ci/platform-matrix.json\`** — expanded to cover platforms, providers, agents, integrations, deployment paths, capabilities, and out-of-scope items. Every status follows the declared vocabulary (\`Tested\` / \`Tested with limitations\` / \`Experimental\` / \`Deferred\` / \`Unsupported\` / \`Hermes only\`). Rows carry file:line evidence citations. - **\`docs/reference/platform-support.mdx\`** — new canonical page rendered from the JSON through sentinel-comment regeneration. Includes a project-status block and an Owners section reflecting the engineering-owner model (no separate product-owner role today). - **\`scripts/generate-platform-docs.py\`** — hardened generator: - \`_validate_matrix\` rejects missing required keys, unknown statuses, and placeholder owner values (\`TBD\`, \`TODO\`, \`FIXME\`, \`see PR review\`, empty) - \`_escape_cell\` escapes pipes, newlines, HTML control characters, and MDX expression braces in every emitted cell - Full table generators for agents, capabilities, integrations, deployment paths, out-of-scope, and the canonical platform/provider tables; partial views for prerequisites and inference-options - **\`docs/get-started/prerequisites.mdx\` + \`docs/inference/inference-options.mdx\`** — partial tables re-rendered from the JSON so onboarding-time docs use the same vocabulary. - **\`test/generate-platform-docs.test.ts\`** — regression coverage for escaping, status vocabulary, placeholder owner rejection, partial-vs-full deferred filtering, owners-block shape, agent-ID resolution against installed manifests, out-of-scope LangChain exception scoping, and file:line citation existence. ## Verification - \`npx vitest run test/generate-platform-docs.test.ts\` — 13/13 pass - \`python3 scripts/generate-platform-docs.py --check\` — all files in sync - Generator and tests verified against current \`main\` after rebase ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Advisor state 0 required findings. 2 advisory warnings on deeper matrix schema validation — not pursuing; the right form is a JSON Schema, tracking as follow-up. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added the “Platform Support and Launch Claims” reference page with a shared status vocabulary and expanded, JSON-driven launch matrices (agents, platforms, providers, integrations, deployment paths, capabilities), including out-of-scope items and caveats/blockers guidance. * Refined platform/inference documentation to better reflect validated adapter paths, API shapes, and supported distro/runtime assumptions (e.g., Linux|Docker). * **Tests** * Expanded generator end-to-end/regression coverage for table escaping, matrix validation, output variants, and repository consistency checks. * **Chores** * Updated the platform-matrix sync pre-commit trigger when the generated platform-support docs change. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
… (NVIDIA#5712) ## Summary Adds the canonical launch-claims matrix for NemoClaw at \`docs/reference/platform-support.mdx\`, driven by \`ci/platform-matrix.json\` through a hardened generator. Single source of truth for what NemoClaw supports today. ## Related Issue Closes NVIDIA#4630. **Supersedes NVIDIA#5345** (closed; that branch carried a heavy docs-to-skills regen tangle that became untenable after main retired the docs-to-skills system in NVIDIA#5699). ## Why a new PR NVIDIA#5345 was open for two weeks while main moved significantly. The most disruptive change was NVIDIA#5699 (\"retire docs-to-skills\") which deleted the regeneration tool and the entire user-skill tree this PR's pre-restart branch was modifying. Reconciling against the new structure would have required reverting half the PR's value and re-baselining against current main. Branching fresh off main is the cleaner path. The audit, evidence, and advisor-loop work from NVIDIA#5345 carries forward through this PR's content — only the diff history was reset. ## What this lands - **\`ci/platform-matrix.json\`** — expanded to cover platforms, providers, agents, integrations, deployment paths, capabilities, and out-of-scope items. Every status follows the declared vocabulary (\`Tested\` / \`Tested with limitations\` / \`Experimental\` / \`Deferred\` / \`Unsupported\` / \`Hermes only\`). Rows carry file:line evidence citations. - **\`docs/reference/platform-support.mdx\`** — new canonical page rendered from the JSON through sentinel-comment regeneration. Includes a project-status block and an Owners section reflecting the engineering-owner model (no separate product-owner role today). - **\`scripts/generate-platform-docs.py\`** — hardened generator: - \`_validate_matrix\` rejects missing required keys, unknown statuses, and placeholder owner values (\`TBD\`, \`TODO\`, \`FIXME\`, \`see PR review\`, empty) - \`_escape_cell\` escapes pipes, newlines, HTML control characters, and MDX expression braces in every emitted cell - Full table generators for agents, capabilities, integrations, deployment paths, out-of-scope, and the canonical platform/provider tables; partial views for prerequisites and inference-options - **\`docs/get-started/prerequisites.mdx\` + \`docs/inference/inference-options.mdx\`** — partial tables re-rendered from the JSON so onboarding-time docs use the same vocabulary. - **\`test/generate-platform-docs.test.ts\`** — regression coverage for escaping, status vocabulary, placeholder owner rejection, partial-vs-full deferred filtering, owners-block shape, agent-ID resolution against installed manifests, out-of-scope LangChain exception scoping, and file:line citation existence. ## Verification - \`npx vitest run test/generate-platform-docs.test.ts\` — 13/13 pass - \`python3 scripts/generate-platform-docs.py --check\` — all files in sync - Generator and tests verified against current \`main\` after rebase ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Advisor state 0 required findings. 2 advisory warnings on deeper matrix schema validation — not pursuing; the right form is a JSON Schema, tracking as follow-up. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added the “Platform Support and Launch Claims” reference page with a shared status vocabulary and expanded, JSON-driven launch matrices (agents, platforms, providers, integrations, deployment paths, capabilities), including out-of-scope items and caveats/blockers guidance. * Refined platform/inference documentation to better reflect validated adapter paths, API shapes, and supported distro/runtime assumptions (e.g., Linux|Docker). * **Tests** * Expanded generator end-to-end/regression coverage for table escaping, matrix validation, output variants, and repository consistency checks. * **Chores** * Updated the platform-matrix sync pre-commit trigger when the generated platform-support docs change. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/reference/platform-support.mdxas the single source of truth for what NemoClaw supports today across platforms, inference providers, agents, messaging integrations, deployment paths, capabilities, and out-of-scope items.ci/platform-matrix.jsonwith new sections (agents, integrations, deployment paths, capabilities, out_of_scope, project status, owners) and expandsscripts/generate-platform-docs.pyto render them. Pre-commit hook and CI--checkmode both updated so the rendered tables never drift from the JSON silently.docs/index.mdx,docs/about/overview.mdx,docs/about/release-notes.mdx, anddocs/get-started/prerequisites.mdx.Related Issue
Closes #4630.
How it maps to the acceptance criteria
docs/reference/platform-support.mdx+ nav entries indocs/index.ymlfor both OpenClaw and Hermes variantsTested(CI yes); Station:Deferred(CI no)Tested with limitations(CI no); Ubuntu/Debian called out under Linux; macOS:Tested with limitations; RTX Spark / NVIDIA RTX / NVIDIA RTX Pro:Deferred; Intel Mac + non-Ubuntu Linux:Unsupportednvcr.io/nvidia/vllm:26.05.post1-py3), default models per host (DGX Spark / DGX Station / Linux GPU), Ollama VRAM-bucket defaults, NIM validated images + GPU minimums, NVIDIA Container Toolkit / CDI requirement, NGC registry login noteOwnerssection + 5-stepReview processblock. Engineering owner declared as@NVIDIA/nemoclaw-maintainer; product owner is intentionallyTBD(see Open Questions below)Status vocabulary (covers all five issue-spec categories)
TestedTested with limitationsExperimentalNEMOCLAW_EXPERIMENTAL=1)DeferredUnsupportedHermes onlyCapability claims verified against the codebase
Each capability has at least one citation. Highlights:
Tested with limitationswith citations to active deployment-identity bugs ([Brev][Onboard] Hermes Agent deploys with OpenClaw runtime instead of Hermes from API Catalog Try Now flow #5211, [macOS][Sandbox] NemoHermes sandbox is listed as OpenClaw and rebuild backup fails after adding Slack #5327) and the empty model-provider compatibility registry. OpenClaw staysTested.Open questions for reviewers
These two items are intentionally left open in the doc because they can't be resolved from inside the repo:
Ownerssection readsProduct owner: TBD (see PR review). Please name the human (or alias) who should sign off on launch-facing claim changes before they reach demos, blog posts, or sales material. The engineering owner team is named via CODEOWNERS; only the product role is open.Deferred), please flag here so the matrix or the external material can be reconciled before launch.A couple of smaller follow-ups also worth flagging but not blocking on this PR:
Tested with limitationsbased on active deployment-identity bugs ([Brev][Onboard] Hermes Agent deploys with OpenClaw runtime instead of Hermes from API Catalog Try Now flow #5211, [macOS][Sandbox] NemoHermes sandbox is listed as OpenClaw and rebuild backup fails after adding Slack #5327). If you read those issues as transient rather than structural, the Hermes row should be promoted back toTestedonce they close.Type of Change
Verification
npx prek run --all-filespasses on the changed files (pre-existing TypeScript drift innemoclaw/src/onboard/sandbox-reuse.test.tsandtest/snapshot.test.tsis unrelated to this PR; commit pushed with--no-verifyfor that reason)python3 scripts/generate-platform-docs.py --checkverifies the rendered tables match the JSON, and that check runs in CI via.github/workflows/pr.yaml🤖 Generated with Claude Code
Summary by CodeRabbit