docs(platform): publish canonical platform support matrix (#4630)

.agents/skills/nemoclaw-user-agent-skills/SKILL.md

@@ -48,6 +48,7 @@ The following user skills ship with NemoClaw.
 | Skill | Summary |
 |-------|---------|
 | `nemoclaw-user-overview` | What NemoClaw is, ecosystem placement (OpenClaw + OpenShell + NemoClaw), how it works internally, and release notes. |
+| `nemoclaw-user-agent-skills` | Clone, update, and use NemoClaw's agent skills, including this page and the skills directory layout. |
 | `nemoclaw-user-get-started` | Install NemoClaw, launch a sandbox, and run the first agent prompt. |
 | `nemoclaw-user-configure-inference` | Choose inference providers during onboarding, switch models without restarting, and set up local inference servers (Ollama, vLLM, TensorRT-LLM, NIM). |
 | `nemoclaw-user-manage-policy` | Approve or deny blocked egress requests in the TUI and customize the sandbox network policy (add, remove, or modify allowed endpoints). |
@@ -74,6 +75,7 @@ Examples of questions your assistant can answer with these skills:
 | "What security controls can I configure?" | `nemoclaw-user-configure-security` |
 | "Back up my agent workspace files." | `nemoclaw-user-manage-sandboxes` |
 | "What CLI commands are available?" | `nemoclaw-user-reference` |
+| "What NemoClaw skills are available for my coding assistant?" | `nemoclaw-user-agent-skills` |
 
 You can also reference a skill directly by name if you know which one you need.
 

.agents/skills/nemoclaw-user-configure-inference/SKILL.md

@@ -245,6 +245,7 @@ If the provider itself needs to change (for example, switching from vLLM to a cl
 ## References
 
 - **Load [references/switch-inference-providers.md](references/switch-inference-providers.md)** when switching inference providers, changing the model runtime, or reconfiguring inference routing. Changes the active inference model without restarting the sandbox.
+- **Load [references/declarative-agents-manifest.md](references/declarative-agents-manifest.md)** when users ask how to declare a manager-worker layout, how to give a secondary agent its own model, or how to express OpenClaw's `subagents.allowAgents` from NemoClaw. Documents the `nemoclaw onboard --agents <agents.yaml>` flag and the YAML schema it consumes.
 - **Load [references/set-up-sub-agent.md](references/set-up-sub-agent.md)** when users ask how to add a second model, configure a sub-agent model, use Omni for vision tasks, configure agents.list, or use sessions_spawn in NemoClaw. Shows the NemoClaw-specific file paths and update flow for adding an auxiliary OpenClaw sub-agent model.
 - **Load [references/inference-options.md](references/inference-options.md)** when explaining which providers are available, what the onboard wizard presents, or how inference routing works. Lists all inference providers offered during NemoClaw onboarding.
 - **[references/tool-calling-reliability.md](references/tool-calling-reliability.md)** — Explains Ollama tool-call leak symptoms, when to use vLLM with a tool-call parser, and how to repoint NemoClaw to a parser-aware local endpoint.

.agents/skills/nemoclaw-user-configure-inference/references/declarative-agents-manifest.md

@@ -0,0 +1,160 @@
+# Declarative Multi-Agent Manifest
+
+NemoClaw can bake a multi-agent OpenClaw layout into a sandbox image from a single checked-in manifest.
+Supply the manifest at onboard time with `--agents <path>` and NemoClaw embeds the resulting `agents.list` entries, agent-specific overrides, and `agents.defaults.subagents` block into `openclaw.json` during the image build.
+
+The schema mirrors OpenClaw's own `agents.list[]` field names, so the same keys you read in [OpenClaw's sub-agents reference](https://docs.openclaw.ai/tools/subagents) appear verbatim in the manifest.
+
+## When To Use This
+
+Use `--agents` when:
+
+- You want a repeatable, GitOps-friendly multi-agent sandbox (manager + workers, or a research / writing split).
+- A secondary agent needs its own model (different size, different capability profile).
+- You want OpenClaw's `sessions_spawn` validator to enforce a fixed spawn allowlist, not the broad default.
+
+For a single primary agent on the configured inference route, no manifest is required.
+The canonical `main` agent is always baked in as the default.
+
+## Invocation
+
+```bash
+nemoclaw onboard --agents ./agents.yaml --name my-assistant
+```
+
+NemoClaw reads the manifest on the host, sets `NEMOCLAW_EXTRA_AGENTS_JSON` for the Dockerfile patcher, and the build-time validator in `scripts/generate-openclaw-config.mts` is the single source of truth for structured errors.
+A malformed manifest fails the image build with a clear error message.
+
+## Manifest Shape
+
+```yaml
+defaults:
+  subagents:
+    maxSpawnDepth: 2          # optional; OpenClaw allows 1..5
+
+main:                          # optional augments to the canonical "main" agent
+  tools:
+    profile: minimal
+    allow: [read]
+  subagents:
+    allowAgents: [logs-reader, writer]
+    delegationMode: prefer
+    requireAgentId: true
+
+agents:                        # required when secondary agents are needed
+  - id: logs-reader
+    description: "Reads sandbox logs"
+    model: nvidia/nemotron-3-nano-30b
+    tools:
+      allow: [read, exec]
+    subagents:
+      requireAgentId: true
+
+  - id: writer
+    model: nvidia/nemotron-3-super-120b-a12b
+    tools:
+      allow: [read, write]
+```
+
+### Top-Level Fields
+
+| Field | Purpose | Bakes Into |
+|---|---|---|
+| `defaults.subagents.maxSpawnDepth` | Maximum nesting depth for sub-agent spawning. Integer 1..5. | `agents.defaults.subagents.maxSpawnDepth` |
+| `main.tools` | Agent-specific tool policy for the canonical `main` agent. | `agents.list[id=main].tools` |
+| `main.subagents` | Sub-agent delegation policy for `main`. Same shape as a secondary agent's `subagents` block. | `agents.list[id=main].subagents` |
+| `agents[]` | Secondary agents to append after `main` in `agents.list`. | `agents.list[]` |
+
+The `main` agent is always written first into `agents.list` with `default: true`.
+Operators cannot set `default: true` on a secondary agent and cannot rename the primary slot.
+
+### Agent Fields
+
+| Field | Required | Purpose |
+|---|---|---|
+| `id` | yes | Lowercase alphanumeric + `_`/`-`, 1-32 chars, must start with a letter, and cannot be `main`. |
+| `workspace` | auto-filled | Defaults to `/sandbox/.openclaw/workspace-<id>`. Must match the canonical sandbox layout if supplied. |
+| `agentDir` | auto-filled | Defaults to `/sandbox/.openclaw/agents/<id>`. Must match the canonical sandbox layout if supplied. |
+| `tools` | yes | `{profile?, allow?, deny?}`. Must declare a non-empty `allow[]` or `deny[]`. Secondary agents inherit no tools by default. |
+| `description` | no | Human-readable. Baked verbatim. |
+| `model` | no | `provider/model` reference. The provider must match the onboard provider; cross-provider manifests are not supported. |
+| `subagents` | no | OpenClaw-native sub-agent delegation policy. See below. |
+
+### Sub-Agent Delegation Block
+
+Both `main.subagents` and `agents[].subagents` use the same shape, which mirrors OpenClaw's [`agents.list[].subagents`](https://docs.openclaw.ai/gateway/config-agents).
+
+| Field | Type | Purpose |
+|---|---|---|
+| `delegationMode` | `"suggest"` or `"prefer"` | Prompt-only steering for how strongly this agent should delegate. No enforcement. |
+| `allowAgents` | `string[]` | Allowlist of agent ids this agent may target through `sessions_spawn`. `["*"]` allows any configured target; omit for self-only. |
+| `model` | `provider/model` | Default model for spawned sub-agents. Provider must match the onboard provider. |
+| `thinking` | string | Default thinking level for spawned sub-agents. |
+| `requireAgentId` | boolean | Force the model to pass `agentId` explicitly to `sessions_spawn` rather than defaulting to self. |
+
+`maxSpawnDepth` is not accepted for individual agents.
+OpenClaw only honors it on `agents.defaults.subagents`, so the manifest exposes it only under the top-level `defaults` block.
+
+### Multi-Model Sandboxes
+
+When a secondary agent declares its own `model` (or `subagents.model`), NemoClaw widens the baked `models.providers[<onboard-provider>].models[]` array with one entry for each unique `provider/model` reference.
+The base `contextWindow`, `maxTokens`, `reasoning`, and `input` settings from the onboard route apply to each appended entry.
+Model-specific overrides beyond these defaults are out of scope for v1.
+Edit the generated `openclaw.json` in place if you need finer control.
+
+## Manager-Worker Example
+
+```yaml
+defaults:
+  subagents:
+    maxSpawnDepth: 2
+
+main:
+  subagents:
+    allowAgents: [logs-reader]
+    delegationMode: prefer
+    requireAgentId: true
+
+agents:
+  - id: logs-reader
+    description: "Reads /var/log and surfaces error lines"
+    tools:
+      allow: [read]
+```
+
+What this produces in the baked `openclaw.json`:
+
+- `agents.list[0]` is `main` with `default: true`, the operator-supplied `tools`/`subagents` merged in.
+- `agents.list[1]` is `logs-reader` at the canonical workspace/agentDir paths.
+- The primary model stays whatever was selected at onboard.
+- `agents.defaults.subagents.maxSpawnDepth` is `2`.
+- `sessions_spawn` from `main` resolves to `logs-reader` only.
+
+## Iterating
+
+Edit `agents.yaml`, re-run `nemoclaw onboard --agents ./agents.yaml --recreate-sandbox`.
+Workspaces under `/sandbox/.openclaw/workspace-<id>` are preserved across rebuilds because the runtime startup script provisions them on first boot rather than baking their contents.
+
+For interactive agent-specific edits inside an existing sandbox with no rebuild, use the in-sandbox CLI, `nemoclaw <name> agents add|delete|list`.
+The manifest path is for fixed, checked-in layouts; the CLI passthrough is for interactive work.
+
+## Apply To An Existing Sandbox
+
+`nemoclaw <name> agents apply -f <agents.yaml>` reconciles the live sandbox roster against the manifest **without a rebuild**.
+The verb lists current agents with `openclaw agents list --json`, diffs them against the manifest, and drives `openclaw agents add|delete` for each item.
+Agent-specific `model`, `subagents.*`, top-level `defaults`, and `main` overrides require a sandbox rebuild and are reported as warnings the verb prints before exit; rerun `nemoclaw onboard --agents <file> --recreate-sandbox` to bake those.
+
+```bash
+nemoclaw my-assistant agents apply -f ./agents.yaml --yes
+```
+
+The flag pair `--yes / --non-interactive` is required for scripted use: `--yes` confirms the printed roster diff, and `--non-interactive` makes the verb fail fast when `--yes` is absent rather than waiting for an interactive prompt that scripted callers cannot deliver.
+
+## Next Steps
+
+Use the following resources for more information:
+
+- Use [OpenClaw Sub-Agents](https://docs.openclaw.ai/tools/subagents) for runtime semantics of `sessions_spawn`, `subagents.allowAgents`, and nesting depth.
+- Use [Set Up Task-Specific Sub-Agents](set-up-sub-agent.md) for the in-sandbox path that edits `agents.list` directly without a rebuild.
+- Use [Switch Inference Providers](switch-inference-providers.md) before changing agent-specific `model` refs, since refs must share the primary onboard provider.
+- Use Workspace Files (use the `nemoclaw-user-manage-sandboxes` skill) to learn how agent-specific `workspace-<id>` directories are provisioned and persisted across rebuilds.

.agents/skills/nemoclaw-user-configure-inference/references/inference-options.md

@@ -33,15 +33,15 @@ NemoClaw uses provider-specific local tokens for those routes, and rebuilds of l
 |----------|--------|---------------|-------|
 | NVIDIA Endpoints | Tested | OpenAI-compatible | Hosted models on integrate.api.nvidia.com |
 | OpenAI | Tested | Native OpenAI-compatible | Uses OpenAI model IDs |
-| Other OpenAI-compatible endpoint | Tested | Custom OpenAI-compatible | For compatible proxies and gateways |
+| Other OpenAI-compatible endpoint | Tested with limitations | Custom OpenAI-compatible | Adapter path validated with OpenRouter (`https://openrouter.ai`, see `src/lib/onboard.ts:3673`). Behavior on other OpenAI-compatible proxies, gateways, and self-hosted implementations may vary; this row claims the adapter, not the universe of compatible endpoints. |
 | Anthropic | Tested | Native Anthropic | Uses anthropic-messages |
-| Other Anthropic-compatible endpoint | Tested | Custom Anthropic-compatible | For Claude proxies and compatible gateways |
+| Other Anthropic-compatible endpoint | Tested with limitations | Custom Anthropic-compatible | Adapter path validated with AWS Bedrock (`src/lib/onboard/bedrock-runtime.ts`). Behavior on other Anthropic-compatible proxies and gateways may vary; this row claims the adapter, not the universe of compatible endpoints. |
 | Google Gemini | Tested | OpenAI-compatible | Uses Google's OpenAI-compatible endpoint |
 | Hermes Provider | Hermes only | OpenAI-compatible route | Available when onboarding Hermes Agent through `nemohermes` |
-| Local Ollama | Caveated | Local Ollama API | Available when Ollama is installed or running on the host |
-| Local NVIDIA NIM | Experimental | Local OpenAI-compatible | Requires `NEMOCLAW_EXPERIMENTAL=1` and a NIM-capable GPU |
-| Local vLLM (already running) | Caveated | Local OpenAI-compatible | Appears in the onboarding menu when NemoClaw detects a server already on `localhost:8000`. No flag required. |
-| Local vLLM (managed install/start) | Caveated | Local OpenAI-compatible | Appears by default on DGX Spark and DGX Station. Generic Linux NVIDIA GPU hosts require `NEMOCLAW_EXPERIMENTAL=1` or `NEMOCLAW_PROVIDER=install-vllm`. NemoClaw pulls/starts a vLLM container on a supported NVIDIA GPU host. |
+| Local Ollama | Tested with limitations | Local Ollama API | Available when Ollama is installed or running on the host. Validated default models: `qwen3.6:35b` (high VRAM), `nemotron-3-nano:30b` (medium VRAM), `qwen3.5:9b` (low VRAM fallback). |
+| Local NVIDIA NIM | Experimental | Local OpenAI-compatible | Requires `NEMOCLAW_EXPERIMENTAL=1` and a NIM-capable NVIDIA GPU. Host must have the NVIDIA Container Toolkit installed and a CDI spec present (`onboard` asserts CDI presence with `assertCdiNvidiaGpuSpecPresent`, `src/lib/onboard.ts:1581`). NIM images pull from `nvcr.io` and require NGC registry login. NemoClaw gates this path behind the experimental flag because it does not auto-select a NIM image for the host today. You must explicitly pick from the validated image list. Managed vLLM has host-specific default models and is not gated on the same boxes. Validated images referenced in `src/lib/inference/config.ts` and `nemoclaw/src/index.ts`: `nvidia/nemotron-3-super-120b-a12b` (default cloud model), `nvidia/nemotron-3-nano-30b-a3b`, `nvidia/llama-3.3-nemotron-super-49b-v1.5`. |
+| Local vLLM (already running) | Tested with limitations | Local OpenAI-compatible | Appears in the onboarding menu when NemoClaw detects a server already on `localhost:8000`. No flag required. Model is whatever the existing server serves. |
+| Local vLLM (managed install/start) | Tested with limitations | Local OpenAI-compatible | Appears by default on DGX Spark and DGX Station. Generic Linux NVIDIA GPU hosts require `NEMOCLAW_EXPERIMENTAL=1` or `NEMOCLAW_PROVIDER=install-vllm`. Host must have the NVIDIA Container Toolkit installed and a CDI spec present (`onboard` asserts CDI presence). NemoClaw pulls or starts the stable NGC vLLM container for each host profile. See `src/lib/inference/vllm.ts:55,177` for the pins. DGX Spark and DGX Station use `nvcr.io/nvidia/vllm:26.05.post1-py3`; generic Linux NVIDIA GPU hosts use `nvcr.io/nvidia/vllm:26.03.post1-py3`. Validated defaults are listed in `src/lib/inference/vllm-models.ts`: DGX Spark uses `nvidia/Qwen3.6-35B-A3B-NVFP4`, DGX Station uses `Qwen/Qwen3.6-27B-FP8`, and Linux NVIDIA GPU uses `nvidia/NVIDIA-Nemotron-3-Nano-4B-FP8`. Image pulls require NGC registry login (`docker login nvcr.io`); onboard prompts for the NGC API key when authentication is missing. |
 
 ## Provider Options