feat(policy): annotate policy-list with preset provenance - #5797
Merged
Conversation
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR removes ChangesPolicy preset provenance and balanced tier defaults
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~28 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
laitingsheng
added
area: onboarding
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements
|
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
docs/reference/commands.mdx (1)
1000-1004: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePassive voice in the provenance description.
The editorial style guide requires active voice.
Each active preset is annotated...,pre-selected by the chosen policy tier, andadded by NemoClaware passive constructions. Consider rephrasing to active voice (for example, "NemoClaw annotates each active preset...", "the chosen policy tier pre-selects this preset").As per path instructions: "Active voice required. Flag passive constructions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` around lines 1000 - 1004, Rephrase the provenance description in active voice in the command docs: update the intro sentence and each bullet so the subject performs the action instead of being acted on. Use the existing provenance labels from the same section, but rewrite phrasing around “policy tier,” “NemoClaw,” and the user-added case to avoid passive constructions while preserving meaning.Source: Path instructions
src/lib/policy/preset-provenance.ts (1)
18-37: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
context.agentNameis accepted but never used in classification.Agent provenance is decided purely by preset-name membership in
OPENCLAW_ONLY_POLICY_PRESETS/HERMES_TOOL_GATEWAY_PRESET_NAMES, regardless of the sandbox's actual agent. Anous-*preset that a user manually applies to an OpenClaw sandbox would be labeled[from hermes agent]instead of[user-added], and theagentNamevalue plumbed in frompolicy-channel.tshas no effect. Either scope the agent branches bycontext.agentName, or dropagentNamefromPresetProvenanceContextto avoid implying it is honored.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/policy/preset-provenance.ts` around lines 18 - 37, The preset provenance classification in classifyPresetProvenance ignores context.agentName, so agent-specific presets are attributed only by name and can be misclassified. Update the logic in classifyPresetProvenance to consult context.agentName before returning the “agent” provenance, so OPENCLAW_ONLY_POLICY_PRESETS and HERMES_TOOL_GATEWAY_PRESET_NAMES are only tagged when the active agent matches, or remove agentName from PresetProvenanceContext if it is not intended to affect classification.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/reference/network-policies.mdx`:
- Line 80: The MDX content in the referenced paragraph combines two sentences on
one source line, violating the one-sentence-per-line guideline. Split the text
in the affected paragraph so the OpenClaw onboarding sentence and the OpenClaw
OTEL diagnostics sentence each occupy their own line, preserving the existing
wording in the same section of the document.
In `@src/lib/policy/preset-provenance.test.ts`:
- Around line 17-45: The `vi.mock("./tiers", ...)` factory in
`preset-provenance.test.ts` is hoisted and should not close over the top-level
`TIER_FIXTURES` constant. Move `TIER_FIXTURES` into a `vi.hoisted(() => ...)`
initializer, or rename it to a `mock`-prefixed binding that is safe for hoisted
mock factories, and keep `getTier` reading from that hoisted fixture map.
---
Nitpick comments:
In `@docs/reference/commands.mdx`:
- Around line 1000-1004: Rephrase the provenance description in active voice in
the command docs: update the intro sentence and each bullet so the subject
performs the action instead of being acted on. Use the existing provenance
labels from the same section, but rewrite phrasing around “policy tier,”
“NemoClaw,” and the user-added case to avoid passive constructions while
preserving meaning.
In `@src/lib/policy/preset-provenance.ts`:
- Around line 18-37: The preset provenance classification in
classifyPresetProvenance ignores context.agentName, so agent-specific presets
are attributed only by name and can be misclassified. Update the logic in
classifyPresetProvenance to consult context.agentName before returning the
“agent” provenance, so OPENCLAW_ONLY_POLICY_PRESETS and
HERMES_TOOL_GATEWAY_PRESET_NAMES are only tagged when the active agent matches,
or remove agentName from PresetProvenanceContext if it is not intended to affect
classification.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: efc352bf-9ca4-4ed3-8907-f46f7ed4b208
📒 Files selected for processing (12)
docs/get-started/quickstart.mdxdocs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxdocs/reference/network-policies.mdxsrc/lib/actions/sandbox/policy-channel-policy.test.tssrc/lib/actions/sandbox/policy-channel.tssrc/lib/onboard/agent-policy-presets.tssrc/lib/onboard/hermes-managed-tools.tssrc/lib/onboard/hermes-tool-gateway-preset-names.tssrc/lib/onboard/openclaw-otel-policy-presets.tssrc/lib/policy/preset-provenance.test.tssrc/lib/policy/preset-provenance.ts
cv
approved these changes
Jun 26, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
LGTM after addressing comments
…ctive agent Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5797.docs.buildwithfern.com/nemoclaw |
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
docs/reference/network-policies.mdx (1)
72-72: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit the
Balanceddescription into one sentence per source line.Line 72 packs three sentences onto one MDX line, which breaks the docs source-formatting rule.
As per coding guidelines: "Keep one sentence per line in Markdown and MDX source files." As per path instructions: "One sentence per line in source."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/network-policies.mdx` at line 72, The Balanced preset description is combining multiple sentences on one MDX source line, which violates the one-sentence-per-line formatting rule. Update the table row in the network policies docs so the description for Balanced is split into separate source lines/sentences while keeping the same meaning, and make sure the text remains associated with the Balanced row and its source list formatting.Sources: Coding guidelines, Path instructions
nemoclaw-blueprint/policies/tiers.yaml (1)
22-32: 🔒 Security & Privacy | 🔵 TrivialRun the
network-policy-e2eworkflow for this tier change.Removing
weatherfrombalancedchanges default sandbox egress, so it is worth re-running the deny-by-default, whitelist, hot-reload, and SSRF coverage before merge.Based on path instructions:
nemoclaw-blueprint/policies/**changes affect sandbox egress rules and SSRF filtering, withnetwork-policy-e2erecommended.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw-blueprint/policies/tiers.yaml` around lines 22 - 32, The tier policy update in the policies configuration changes default sandbox egress by removing weather access from the balanced preset, so re-run the network-policy-e2e workflow before merging to verify deny-by-default, whitelist behavior, hot-reload handling, and SSRF coverage still pass for this tier change. Focus on the tier definitions in the tiers policy and the network-policy-e2e validation that exercises those sandbox egress rules.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/reference/network-policies.mdx`:
- Line 72: The Balanced preset description is combining multiple sentences on
one MDX source line, which violates the one-sentence-per-line formatting rule.
Update the table row in the network policies docs so the description for
Balanced is split into separate source lines/sentences while keeping the same
meaning, and make sure the text remains associated with the Balanced row and its
source list formatting.
In `@nemoclaw-blueprint/policies/tiers.yaml`:
- Around line 22-32: The tier policy update in the policies configuration
changes default sandbox egress by removing weather access from the balanced
preset, so re-run the network-policy-e2e workflow before merging to verify
deny-by-default, whitelist behavior, hot-reload handling, and SSRF coverage
still pass for this tier change. Focus on the tier definitions in the tiers
policy and the network-policy-e2e validation that exercises those sandbox egress
rules.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1bb60567-10e4-4234-9015-1350a6ba921d
📒 Files selected for processing (12)
docs/get-started/quickstart.mdxdocs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxdocs/reference/network-policies.mdxnemoclaw-blueprint/policies/tiers.yamlsrc/lib/actions/sandbox/policy-channel-policy.test.tssrc/lib/policy/preset-provenance.test.tssrc/lib/policy/preset-provenance.tstest/onboard-policy-suggestions.test.tstest/onboard-preset-diff.test.tstest/policy-tiers-onboard.test.tstest/policy-tiers.test.ts
💤 Files with no reviewable changes (1)
- test/onboard-preset-diff.test.ts
✅ Files skipped from review due to trivial changes (3)
- docs/get-started/quickstart.mdx
- docs/reference/commands.mdx
- docs/reference/commands-nemohermes.mdx
🚧 Files skipped from review as they are similar to previous changes (2)
- src/lib/policy/preset-provenance.test.ts
- src/lib/policy/preset-provenance.ts
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…sted) Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor (Nemotron Ultra) — InformationalMerge posture: Informational / low confidence Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Collaborator
|
Maintainer disposition for the final-head advisor findings at 50caee0: PRA-1 fixed by moving all listSandboxPolicies coverage into focused policy-channel-list.test.ts; the original file is back to exactly 333 lines and all 45 focused assertions pass. PRA-2 is now explicit in JSDoc and the command docs: provenance is display-only current-state inference, so a tier-name match intentionally takes precedence because application history is not persisted. PRA-3 fixed with the explicit [source unverified (gateway unreachable)] label and regression. PRA-4 is covered by the exact-head common-egress-agent run 28428118794 (queued behind the still-running prior diagnostic run); network-policy is included too. PRA-5 is not applicable: importing hermes-managed-tools would reintroduce its provider-auth/prompt import chain and defeat the leaf boundary; the leaf list now has a fail-fast exact-set synchronization assertion. Please review the new exact head. |
Contributor
Vitest E2E Target Results — ❌ Some jobs failedRun: 28426978938
|
Collaborator
|
Maintainer resolution for exact head 50caee0 and the latest Nemotron advisor:
Exact-head network-policy E2E is green. The requested common-egress-agent run is still in progress at https://github.com/NVIDIA/NemoClaw/actions/runs/28428118794; no merge will occur until it completes successfully. Please treat the already-resolved PRA-3 as resolved on the next advisor pass. |
Contributor
Vitest E2E Target Results — ❌ Some jobs failedRun: 28428118794
|
Contributor
Vitest E2E Target Results — ❌ Some jobs failedRun: 28430187478
|
Contributor
Vitest E2E Target Results — ✅ All requested jobs passedRun: 28430187478
|
cv
reviewed
Jun 30, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Exact-head maintainer gate review for b73f3a9:
- Required CI is green, the PR is approved/conflict-free, and all commits are GitHub-Verified with DCO.
- Live run 28430187478 attempt 2 passed the exact Balanced six-preset set, runtime provenance tags, explicit user-added weather, policy enforcement, and agent turn. Attempt 1 failed on an OpenShell download HTTP 500 before tests.
- Nemotron PRA-9 is internally marked “No fix needed — secret handling is correct.” The passing live run proves BRAVE_API_KEY is configured; the test explicitly redacts it and the workflow uses only the repository secret expression.
- The alleged Hermes dual-source drift is stale: the leaf module was deleted and the exported name Set derives directly from HERMES_TOOL_GATEWAY_PRESETS. The cited stringSetsEqual helper is unrelated pre-existing selection comparison outside this PR diff.
- Tier-name precedence is an intentional display-only inference where historical provenance is not persisted; docs, JSDoc, and a direct regression test state that limitation.
- The policy-channel renderer was extracted from the monolith (now below the base line count), and the live test validates the new output rather than relying only on mocks.
No gate is waived. This review records the evidence/rationale requested by the automated review and requests a clean exact-head advisor reassessment after the currently serialized advisor run completes.
cv
reviewed
Jun 30, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Exact-head maintainer resolution for advisor run 28431472931 (b73f3a9): GPT-5.5 returned merge_as_is. Nemotron remaining items do not identify an unaddressed defect in this diff. The custom-shadowing behavior is explicitly documented and already covered by preset-provenance.test.ts (the test titled "documents current-tier attribution when a user-added preset shadows a tier name"). HERMES_TOOL_GATEWAY_PRESET_NAMES is not an independent source: it is derived directly from HERMES_TOOL_GATEWAY_PRESETS.map(...), so the alleged drift cannot occur. stringSetsEqual is pre-existing and untouched by this PR; its production call path already has handler coverage, and adding unrelated direct tests is not a release blocker. The BRAVE_API_KEY operational check is proven by successful exact-head common-egress E2E run 28430187478 attempt 2. The remaining scaffold/hotspot items are non-blocking maintenance suggestions. No advisor-requested code change is warranted; this is the explicit maintainer rationale contemplated by the advisor policy.
21 tasks
jyaunches
added a commit
that referenced
this pull request
Jun 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the public documentation for NemoClaw v0.0.71 after scanning commits since v0.0.70. Adds release notes and fills the remaining doc gaps for Windows bootstrap diagnostics, OpenClaw agent auto-relock warnings, auto-pair cadence tuning, and plugin-install recovery hints. ## Changes - `docs/about/release-notes.mdx`: adds the v0.0.71 release-note section, grouped by gateway recovery, OpenShell auth, policy provenance, day-two maintenance, messaging/inference, and Windows setup. - `docs/get-started/windows-preparation.mdx`: documents sanitized WSL install output and reboot gating in the Windows bootstrap. - `docs/reference/commands.mdx`: documents the host `agent` wrapper's shields auto-relock warning and OpenClaw auto-pair watcher tuning variables. - `docs/reference/troubleshooting.mdx`: adds plugin-install network failure recovery guidance and updates Windows WSL troubleshooting for sanitized install logs and reboot-required handling. Source summary: - #6065 -> `docs/about/release-notes.mdx`: Notes explicit model override preservation and gateway-log guard-chain recovery diagnostics. - #5874 -> `docs/about/release-notes.mdx`: Summarizes host-mediated `recover` and `gateway restart`, linking to lifecycle, command, troubleshooting, and trusted-boundary docs already added by the source PR. - #5596 -> `docs/about/release-notes.mdx`: Summarizes OpenShell 0.0.71 gateway auth, loopback binding, and compatibility-container docs already added by the source PR. - #5797 and #5798 -> `docs/about/release-notes.mdx`: Summarizes `policy-list` provenance, Restricted tier suppression, and Balanced tier weather behavior already reflected in policy docs. - #5784 -> `docs/about/release-notes.mdx`: Summarizes `--destroy-user-data` and the safe `--yes` uninstall behavior already documented in lifecycle and command docs. - #6034 -> `docs/about/release-notes.mdx`: Summarizes custom Dockerfile warm-build cache behavior already documented in the command reference. - #5951 -> `docs/reference/commands.mdx`: Documents the stderr-only host `agent` wrapper warning after recent shields auto-relock. - #5387 -> `docs/reference/commands.mdx`: Documents OpenClaw auto-pair watcher cadence and fast-reentry tuning variables. - #5835 -> `docs/reference/troubleshooting.mdx`: Adds recovery guidance for OpenClaw plugin-install network failures. - #5995 and #5956 -> `docs/about/release-notes.mdx`: Summarizes Microsoft Teams final-message delivery and runtime mention hints already covered by messaging docs. - #5716 -> `docs/about/release-notes.mdx`: Summarizes non-interactive Ollama loopback safety already covered by local inference docs. - #5505, #5527, and #5528 -> `docs/about/release-notes.mdx`: Summarizes compatible local endpoint, model task-fit, and model capability audit docs. - #6009 -> `docs/get-started/windows-preparation.mdx`, `docs/reference/troubleshooting.mdx`: Documents sanitized Windows bootstrap WSL output and reboot-required gating. - #6055 -> no additional source doc page change needed beyond the already-merged quickstart update; release notes did not duplicate routine quickstart cleanup. No matching v0.0.71 GitHub announcement discussion was found in the latest 20 discussions, so this refresh is based on the commit scan and existing source PR docs. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only refresh with no runtime behavior changes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — ran `npm run docs`; Fern reported 0 errors and 2 existing warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new release-notes entry covering gateway recovery, authentication, network policy/provenance output, uninstall safety, Windows bootstrap diagnostics, messaging defaults, and inference setup guidance. * Clarified Windows preparation steps around reboot behavior and redacting troubleshooting transcripts. * Expanded command reference details for OpenClaw wrapper behavior and new auto-pair tuning options. * Improved troubleshooting guidance for plugin installation issues, WSL repair/reboot cases, and install timing problems. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary `policy-list` now annotates each verified active preset with its inferred source, and the default Balanced tier no longer grants weather egress. A default Balanced OpenClaw onboarding therefore applies exactly `brave`, `brew`, `huggingface`, `npm`, `openclaw-pricing`, and `pypi`; operators add `weather` explicitly when needed. ## Related Issue Fixes NVIDIA#5774 ## Changes - Add `[from <tier> tier]`, `[from <agent> agent]`, `[user-added]`, and trust-degraded `[source unverified]` annotations to `policy-list`. - Infer provenance only when local registry state and the live gateway agree; document that provenance is inferred from current tier/agent metadata rather than persisted per preset. - Remove `weather` from Balanced while preserving it in Open, and update onboarding suggestions, tier tests, command references, quickstart, and network-policy docs. - Keep OpenClaw-only and Hermes-only classifications agent-gated, normalize stored tier/agent names, and fail fast if the lightweight Hermes preset-name registry diverges from the rich manifest list. - Rebase via a signed merge of current `main`, preserving the newer DGX Station express-install default and source-test boundary. - Strengthen the live contract: Balanced must initially report exactly the six expected active presets with no `wttr.in`; the test then explicitly runs `policy-add weather` and verifies the landed GET/HEAD-only wttr.in path with independent proof. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — provenance is advisory-only, requires registry/gateway agreement, and emits `source unverified` on desync or gateway failure; exact-head advisors are being rerun. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — Fern reports 0 errors and the same 2 existing warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Focused evidence: 45 CLI provenance/policy-list assertions, 95 integration tier/onboarding/weather assertions, 2 Hermes gateway-registry assertions, full normal CLI/integration coverage hook, CLI/plugin/JS pre-push typechecks, and docs validation with 0 errors. Required policy E2E evidence: `network-policy` passed on run 28428118794 before the display-only follow-up; exact-head `common-egress-agent` passed on run 28430187478 attempt 2. Attempt 1 failed during OpenShell download with HTTP 500 before tests executed. ## Maintainer Gate Resolution - Exact head `b73f3a98b55b20c7b6a3c0bae75b5f02970211c9` is signed/GitHub-Verified, approved, conflict-free, and has green required CI. - E2E run 28430187478 attempt 2 passed the live Balanced six-preset set, provenance tags, explicit user-added weather, and agent turn. The first attempt never reached tests because the OpenShell download returned HTTP 500. - Nemotron `PRA-9` describes the workflow secret handling as correct and says no fix is needed. The successful live run proves the repository secret is configured and exercised; no credential is hardcoded or emitted. - The Hermes preset-name leaf module and dual-source sync check were removed. `HERMES_TOOL_GATEWAY_PRESET_NAMES` now derives once from `HERMES_TOOL_GATEWAY_PRESETS`; the cited `stringSetsEqual` helper is pre-existing selection comparison code outside this PR diff. - Current-tier attribution for a same-named user preset is an explicit display-only limitation because application history is not persisted. It is documented in JSDoc/user docs and pinned by a direct regression test; changing it requires a provenance schema, not a registry mock invented in this display helper. - The compiled `policy-channel` test scaffold intentionally uses the existing CJS injection seam; converting it to a different mocking style would not add behavioral coverage. Live policy-list output now validates the runtime surface directly. - The required docs-writer audit found no additional gap after the follow-up. No CI, advisor, signature, approval, or E2E gate is waived; this section supplies the requested rationale/evidence for the next exact-head advisor rerun. --- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the public documentation for NemoClaw v0.0.71 after scanning commits since v0.0.70. Adds release notes and fills the remaining doc gaps for Windows bootstrap diagnostics, OpenClaw agent auto-relock warnings, auto-pair cadence tuning, and plugin-install recovery hints. ## Changes - `docs/about/release-notes.mdx`: adds the v0.0.71 release-note section, grouped by gateway recovery, OpenShell auth, policy provenance, day-two maintenance, messaging/inference, and Windows setup. - `docs/get-started/windows-preparation.mdx`: documents sanitized WSL install output and reboot gating in the Windows bootstrap. - `docs/reference/commands.mdx`: documents the host `agent` wrapper's shields auto-relock warning and OpenClaw auto-pair watcher tuning variables. - `docs/reference/troubleshooting.mdx`: adds plugin-install network failure recovery guidance and updates Windows WSL troubleshooting for sanitized install logs and reboot-required handling. Source summary: - NVIDIA#6065 -> `docs/about/release-notes.mdx`: Notes explicit model override preservation and gateway-log guard-chain recovery diagnostics. - NVIDIA#5874 -> `docs/about/release-notes.mdx`: Summarizes host-mediated `recover` and `gateway restart`, linking to lifecycle, command, troubleshooting, and trusted-boundary docs already added by the source PR. - NVIDIA#5596 -> `docs/about/release-notes.mdx`: Summarizes OpenShell 0.0.71 gateway auth, loopback binding, and compatibility-container docs already added by the source PR. - NVIDIA#5797 and NVIDIA#5798 -> `docs/about/release-notes.mdx`: Summarizes `policy-list` provenance, Restricted tier suppression, and Balanced tier weather behavior already reflected in policy docs. - NVIDIA#5784 -> `docs/about/release-notes.mdx`: Summarizes `--destroy-user-data` and the safe `--yes` uninstall behavior already documented in lifecycle and command docs. - NVIDIA#6034 -> `docs/about/release-notes.mdx`: Summarizes custom Dockerfile warm-build cache behavior already documented in the command reference. - NVIDIA#5951 -> `docs/reference/commands.mdx`: Documents the stderr-only host `agent` wrapper warning after recent shields auto-relock. - NVIDIA#5387 -> `docs/reference/commands.mdx`: Documents OpenClaw auto-pair watcher cadence and fast-reentry tuning variables. - NVIDIA#5835 -> `docs/reference/troubleshooting.mdx`: Adds recovery guidance for OpenClaw plugin-install network failures. - NVIDIA#5995 and NVIDIA#5956 -> `docs/about/release-notes.mdx`: Summarizes Microsoft Teams final-message delivery and runtime mention hints already covered by messaging docs. - NVIDIA#5716 -> `docs/about/release-notes.mdx`: Summarizes non-interactive Ollama loopback safety already covered by local inference docs. - NVIDIA#5505, NVIDIA#5527, and NVIDIA#5528 -> `docs/about/release-notes.mdx`: Summarizes compatible local endpoint, model task-fit, and model capability audit docs. - NVIDIA#6009 -> `docs/get-started/windows-preparation.mdx`, `docs/reference/troubleshooting.mdx`: Documents sanitized Windows bootstrap WSL output and reboot-required gating. - NVIDIA#6055 -> no additional source doc page change needed beyond the already-merged quickstart update; release notes did not duplicate routine quickstart cleanup. No matching v0.0.71 GitHub announcement discussion was found in the latest 20 discussions, so this refresh is based on the commit scan and existing source PR docs. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only refresh with no runtime behavior changes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — ran `npm run docs`; Fern reported 0 errors and 2 existing warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new release-notes entry covering gateway recovery, authentication, network policy/provenance output, uninstall safety, Windows bootstrap diagnostics, messaging defaults, and inference setup guidance. * Clarified Windows preparation steps around reboot behavior and redacting troubleshooting transcripts. * Expanded command reference details for OpenClaw wrapper behavior and new auto-pair tuning options. * Improved troubleshooting guidance for plugin installation issues, WSL repair/reboot cases, and install timing problems. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
policy-listnow annotates each verified active preset with its inferred source, and the default Balanced tier no longer grants weather egress. A default Balanced OpenClaw onboarding therefore applies exactlybrave,brew,huggingface,npm,openclaw-pricing, andpypi; operators addweatherexplicitly when needed.Related Issue
Fixes #5774
Changes
[from <tier> tier],[from <agent> agent],[user-added], and trust-degraded[source unverified]annotations topolicy-list.weatherfrom Balanced while preserving it in Open, and update onboarding suggestions, tier tests, command references, quickstart, and network-policy docs.main, preserving the newer DGX Station express-install default and source-test boundary.wttr.in; the test then explicitly runspolicy-add weatherand verifies the landed GET/HEAD-only wttr.in path with independent proof.Type of Change
Quality Gates
source unverifiedon desync or gateway failure; exact-head advisors are being rerun.Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only) — Fern reports 0 errors and the same 2 existing warningsFocused evidence: 45 CLI provenance/policy-list assertions, 95 integration tier/onboarding/weather assertions, 2 Hermes gateway-registry assertions, full normal CLI/integration coverage hook, CLI/plugin/JS pre-push typechecks, and docs validation with 0 errors. Required policy E2E evidence:
network-policypassed on run 28428118794 before the display-only follow-up; exact-headcommon-egress-agentpassed on run 28430187478 attempt 2. Attempt 1 failed during OpenShell download with HTTP 500 before tests executed.Maintainer Gate Resolution
b73f3a98b55b20c7b6a3c0bae75b5f02970211c9is signed/GitHub-Verified, approved, conflict-free, and has green required CI.PRA-9describes the workflow secret handling as correct and says no fix is needed. The successful live run proves the repository secret is configured and exercised; no credential is hardcoded or emitted.HERMES_TOOL_GATEWAY_PRESET_NAMESnow derives once fromHERMES_TOOL_GATEWAY_PRESETS; the citedstringSetsEqualhelper is pre-existing selection comparison code outside this PR diff.policy-channeltest scaffold intentionally uses the existing CJS injection seam; converting it to a different mocking style would not add behavioral coverage. Live policy-list output now validates the runtime surface directly.No CI, advisor, signature, approval, or E2E gate is waived; this section supplies the requested rationale/evidence for the next exact-head advisor rerun.
Signed-off-by: Tinson Lai tinsonl@nvidia.com
Signed-off-by: Carlos Villela cvillela@nvidia.com