NVIDIA · chengjiew · Jun 25, 2026 · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026
diff --git a/agents/langchain-deepagents-code/policy-additions.yaml b/agents/langchain-deepagents-code/policy-additions.yaml
@@ -17,7 +17,6 @@ filesystem_policy:
     - /lib
     - /proc
     - /dev/urandom
-    - /app
     - /etc
     - /var/log
   read_write:
@@ -28,10 +27,11 @@ filesystem_policy:
 
 landlock:
   # Deep Agents Code is a terminal coding harness, so filesystem policy must
-  # fail closed when Landlock cannot be applied. `strict` makes the OpenShell
-  # sandbox startup fail instead of silently degrading if the kernel or workspace
-  # mount cannot enforce these read-only system paths.
-  compatibility: strict
+  # fail closed when Landlock cannot be applied. `hard_requirement` makes the
+  # OpenShell sandbox startup fail instead of silently degrading if the kernel or
+  # workspace mount cannot enforce these read-only system paths. Every path
+  # above must exist in the built image; hard_requirement rejects stale paths.
+  compatibility: hard_requirement
 
 process:
   run_as_user: sandbox

diff --git a/docs/deployment/sandbox-hardening.mdx b/docs/deployment/sandbox-hardening.mdx
@@ -129,23 +129,30 @@ System-wide shell hooks that read `/tmp/nemoclaw-proxy-env.sh` source the runtim
 
 ### Landlock Kernel Requirements
 
-Landlock LSM requires Linux kernel 5.13 or later with `CONFIG_SECURITY_LANDLOCK=y`.
-The NemoClaw sandbox policy uses `compatibility: best_effort`, which means Landlock enforcement is silently skipped on kernels that do not support it.
+Landlock first appeared in Linux 5.13 and requires `CONFIG_SECURITY_LANDLOCK=y`.
+OpenShell also requires Landlock to be active and the sandbox runtime to permit Landlock syscalls.
+OpenClaw and Hermes policies use `compatibility: best_effort`, which continues sandbox startup when Landlock is unavailable.
+The pinned OpenShell runtime builds an ABI v2 ruleset, which requires Linux 5.19 or later when the Deep Agents Code policy selects `compatibility: hard_requirement`.
+OpenShell therefore aborts Deep Agents Code startup instead of running the agent with reduced filesystem isolation on an older or incompatible runtime.
 
-On such kernels, protection falls back to DAC (file ownership and permissions) only.
-Files outside the writable paths would be inaccessible to the agent regardless of DAC permissions.
+When Landlock is unavailable, OpenClaw and Hermes continue without the configured Landlock path restrictions.
+Container mounts and DAC file ownership and permissions still apply.
+Deep Agents Code onboarding returns a nonzero exit and does not report the terminal runtime as ready.
+The fail-closed behavior also applies when OpenShell cannot open a configured policy path or enforce the prepared ruleset.
 
-Verify Landlock availability:
+OpenShell probes the actual sandbox runtime during startup instead of relying on a host filesystem path.
+For a running sandbox, inspect its startup events:
 
 ```bash
-ls /sys/kernel/security/landlock
+openshell logs <sandbox-name> -n 100 --source sandbox
 ```
 
-On a kernel with Landlock support, the path exists and `ls` succeeds.
-If it reports `No such file or directory`, the kernel does not expose Landlock, and the sandbox falls back to DAC-only enforcement as described above.
+OpenShell reports successful Landlock preparation with `Applying Landlock filesystem sandbox [abi:<ABI> compat:<mode> ro:<count> rw:<count>]` followed by `Landlock ruleset built [rules_applied:<count> skipped:<count>]`.
+If `best_effort` cannot prepare or enforce Landlock, OpenShell emits a high-severity finding with `Landlock filesystem sandbox unavailable: <reason>` or `Landlock restrict_self failed (best_effort): <reason>` and continues, while either failure prevents Deep Agents Code from starting.
 
-For production deployments, use kernel 5.13+ with Landlock enabled.
-The `test/e2e/e2e-cloud-experimental/checks/04-landlock-readonly.sh` script validates enforcement at runtime.
+For Deep Agents Code production deployments, use Linux 5.19 or later with Landlock enabled and its syscalls permitted.
+OpenClaw and Hermes can apply the access rights available from Linux 5.13 onward in `best_effort` mode.
+The `test/e2e/e2e-cloud-experimental/checks/04-landlock-readonly.sh` and `test/e2e/e2e-cloud-experimental/checks/05-deepagents-code-landlock-readonly.sh` scripts validate enforcement at runtime.
 
 ## References
 

diff --git a/docs/reference/enterprise-readiness.mdx b/docs/reference/enterprise-readiness.mdx
@@ -119,7 +119,7 @@ Each one includes the current workaround or next step.
 | Controls bypassed outside the managed gateway path | Network policy and inference auth are not enforced if a runtime starts outside the NemoClaw-managed entrypoint. | Use NemoClaw-managed onboarding and sandbox entrypoints for production workflows. Refer to [Known Limitations](../security/best-practices#known-limitations). |
 | One consumer per messaging bot token | Two sandboxes sharing a bot token disconnect each other and drop messages. | Use a distinct bot token per sandbox. Refer to the messaging troubleshooting in [Troubleshooting](troubleshooting#messaging-bridge-appears-running-but-no-messages-arrive). |
 | In-sandbox config edits do not persist | Direct edits to agent config inside the running sandbox do not survive rebuilds. | Make durable config changes from the host by re-running `$$nemoclaw onboard`, not inside the sandbox. Refer to [Troubleshooting](troubleshooting). |
-| Landlock filesystem enforcement degrades on old kernels | Filesystem restrictions fall back to container mounts below Linux kernel 5.13. | Run on kernel 5.13 or later for full enforcement. Refer to [Landlock LSM Enforcement](../security/best-practices#landlock-lsm-enforcement). |
+| Landlock failure handling varies by agent | OpenClaw and Hermes continue with reduced filesystem isolation when Landlock cannot be fully applied, while Deep Agents Code fails sandbox startup. | Run Deep Agents Code on Linux 5.19 or later with Landlock enabled and its syscalls permitted, resolve any reported policy-path error, keep its policy at `hard_requirement`, and refer to [Landlock LSM Enforcement](../security/best-practices#landlock-lsm-enforcement). |
 | Best-effort capability and resource limits | Capability drops and ulimits skip silently when the runtime blocks them. | Pass `--cap-drop=ALL` and `--ulimit` at the container runtime, or set `NEMOCLAW_REQUIRE_CAP_DROP=1` to fail closed. Refer to [Process Controls](../security/best-practices#process-controls). |
 
 ## Field Conversation Guidance

diff --git a/docs/reference/troubleshooting.mdx b/docs/reference/troubleshooting.mdx
@@ -1203,7 +1203,8 @@ nemo-deepagents <name> rebuild
 ```
 
 If startup reports that Landlock enforcement is unavailable, the Deep Agents sandbox fails closed instead of running with reduced filesystem enforcement.
-Deep Agents uses `compatibility: strict` for its managed filesystem policy, so kernels older than 5.13 or VM-backed Docker runtimes without Landlock support can block sandbox creation.
+Deep Agents uses `compatibility: hard_requirement` for its managed filesystem policy.
+The pinned OpenShell runtime builds a Landlock ABI v2 ruleset, so Linux kernels older than 5.19 or VM-backed Docker runtimes without Landlock support can block sandbox creation.
 Move the sandbox to a Linux kernel and container runtime that support Landlock, then rerun onboarding or rebuild the sandbox.
 
 </AgentOnly>
@@ -1859,31 +1860,48 @@ To fix, run `$$nemoclaw <other-sandbox> destroy` on whichever sandbox should sto
 
 ### Landlock filesystem restrictions silently degraded
 
-After sandbox creation, NemoClaw checks whether the host kernel supports Landlock (Linux 5.13+).
-If the kernel is too old or you are running on macOS (where the Docker VM kernel may lack Landlock), a warning prints:
+OpenShell applies Landlock inside the sandbox runtime, whose kernel and syscall restrictions can differ from the CLI host on Docker Desktop or a remote gateway.
+Landlock requires Linux 5.13 or later, an enabled Landlock LSM, and permission to use the Landlock syscalls.
+
+OpenClaw and Hermes use `best_effort` compatibility.
+After creating one of these sandboxes, NemoClaw compares the Linux kernel version or Docker Desktop VM kernel version with 5.13 and prints a warning when it is too old:
 
 ```text
 ⚠ Landlock: Docker VM kernel <version> does not support Landlock (requires ≥5.13).
   Sandbox filesystem restrictions will silently degrade (best_effort mode).
 ```
 
 This warning is informational and does not block sandbox creation.
-The sandbox runs without kernel-level filesystem restrictions, relying on container mount configuration instead.
-For full filesystem enforcement, run on a Linux kernel 5.13 or later (Ubuntu 22.04 LTS and later include Landlock support).
+The version check is preliminary because OpenShell's startup probe determines whether the sandbox runtime can use Landlock.
+Under `best_effort`, an unavailable Landlock runtime removes the kernel-level filesystem restrictions, while an inaccessible configured path is skipped and the remaining rules are applied.
+Container mounts and DAC permissions continue to apply.
+
+Inspect the authoritative OpenShell startup events for a running sandbox:
+
+```bash
+openshell logs <sandbox-name> -n 100 --source sandbox
+```
+
+OpenClaw and Hermes can apply the access rights available from Linux 5.13 onward in `best_effort` mode.
 
 </AgentOnly>
 <AgentOnly variant="deepagents">
 
 ### Landlock filesystem policy blocks sandbox startup
 
-Deep Agents uses strict Landlock compatibility.
-If the host kernel, Docker VM, or sandbox filesystem mount cannot enforce the managed read-only policy, OpenShell refuses to start the sandbox instead of silently degrading.
+Deep Agents Code uses `hard_requirement` compatibility.
+The pinned OpenShell runtime builds a Landlock ABI v2 ruleset, so this mode requires Linux 5.19 or later in addition to an enabled LSM and permitted syscalls.
+If OpenShell detects that Landlock is unavailable, cannot open a configured policy path, or cannot enforce the prepared ruleset, sandbox startup fails and `$$nemoclaw onboard` returns a nonzero exit instead of reporting the terminal runtime as ready.
+NemoClaw does not automatically delete a failed sandbox from create-stream text because that output does not carry an authoritative resource identity.
+If OpenShell retains the failed resource, inspect it with `openshell sandbox get <name>` and delete it only after confirming that it belongs to the failed attempt.
+Do not replace `hard_requirement` with `best_effort` to bypass this failure.
 
-Run Deep Agents on a Linux kernel 5.13 or later with a container runtime that exposes Landlock to the sandbox.
-After moving to a compatible host or runtime, rerun onboarding or rebuild the sandbox:
+Review the onboarding error first because a policy-path failure names the inaccessible path.
+Use Linux 5.19 or later with Landlock enabled, ensure the sandbox runtime permits Landlock syscalls, and correct any missing or inaccessible path reported by OpenShell.
+After fixing the host, runtime, or policy path, rerun onboarding or rebuild the sandbox:
 
 ```bash
-nemo-deepagents <name> rebuild
+$$nemoclaw <name> rebuild
 ```
 
 </AgentOnly>

diff --git a/docs/security/best-practices.mdx b/docs/security/best-practices.mdx
@@ -275,7 +275,7 @@ The container mounts system directories read-only to prevent the agent from modi
 
 | Aspect | Detail |
 |---|---|
-| Default | `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log` are read-only. |
+| Default | System paths such as `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/etc`, and `/var/log` are read-only. Agent policies can add image-specific paths such as `/app`; Deep Agents Code omits paths that its image does not provide because `hard_requirement` treats a missing path as fatal. |
 | What you can change | Add or remove paths in the `filesystem_policy.read_only` section of the policy file. |
 | Risk if relaxed | Making `/usr` or `/lib` writable lets the agent replace system binaries (such as `curl` or `node`) with trojanized versions. Making `/etc` writable lets the agent modify DNS resolution, TLS trust stores, or user accounts. |
 | Recommendation | Never make system paths writable. If the agent needs a writable location for generated files, use a subdirectory of `/sandbox`. |
@@ -391,10 +391,13 @@ Landlock is a Linux Security Module that enforces filesystem access rules at the
 
 | Aspect | Detail |
 |---|---|
-| Default | `compatibility: best_effort`. The entrypoint applies Landlock rules when the kernel supports them and silently skips them on older kernels. |
+| Default | OpenClaw and Hermes use `compatibility: best_effort`, while Deep Agents Code uses `compatibility: hard_requirement` so OpenShell aborts sandbox startup when Landlock cannot be fully applied. |
 | What you can change | This is a NemoClaw default, not a user-facing knob. |
-| Risk if relaxed | On kernels without Landlock support (pre-5.13), filesystem restrictions rely solely on container mount configuration, which is less granular. |
-| Recommendation | Run on a kernel that supports Landlock (5.13+). Ubuntu 22.04 LTS and later include Landlock support. |
+| Risk if relaxed | A `best_effort` sandbox that cannot use Landlock relies on container mounts and DAC permissions, which are less granular than the configured filesystem policy. |
+| Recommendation | Run Deep Agents Code on Linux 5.19 or later with Landlock enabled and its syscalls permitted. OpenClaw and Hermes can apply the access rights available from Linux 5.13 onward in `best_effort` mode. Treat a Deep Agents Code startup failure as an unsupported runtime or policy-path error instead of changing its policy to `best_effort`. |
+
+Landlock policy is fixed when a sandbox is created.
+Rebuild existing Deep Agents Code sandboxes after upgrading NemoClaw to apply the hard-enforcement policy.
 
 </AgentOnly>
 <AgentOnly variant="hermes">
@@ -411,10 +414,10 @@ Landlock is a Linux Security Module that enforces filesystem access rules at the
 
 | Aspect | Detail |
 |---|---|
-| Default | `compatibility: strict`. Deep Agents sandbox startup fails closed when OpenShell cannot enforce the managed filesystem policy. |
+| Default | `compatibility: hard_requirement`. Deep Agents sandbox startup fails closed when OpenShell cannot enforce the managed filesystem policy. |
 | What you can change | This is a NemoClaw Deep Agents invariant, not a user-facing knob. |
 | Risk if relaxed | Silent Landlock degradation would leave the terminal coding harness with weaker filesystem isolation while still reporting a successful sandbox. |
-| Recommendation | Run Deep Agents on a kernel and runtime that support Landlock enforcement. Rebuild or move hosts if startup reports an enforcement failure. |
+| Recommendation | Run Deep Agents on Linux 5.19 or later with Landlock enabled and its syscalls permitted. Rebuild or move hosts if startup reports an enforcement failure. |
 
 </AgentOnly>
 

diff --git a/schemas/sandbox-policy.schema.json b/schemas/sandbox-policy.schema.json
@@ -30,7 +30,7 @@
       "properties": {
         "compatibility": {
           "type": "string",
-          "enum": ["strict", "best_effort"]
+          "enum": ["best_effort", "hard_requirement"]
         }
       }
     },

diff --git a/src/lib/build-context.test.ts b/src/lib/build-context.test.ts
@@ -79,6 +79,20 @@ describe("printSandboxCreateRecoveryHints", () => {
     expect(stderr()).toContain("reached the gateway");
   });
 
+  it("prints fail-closed guidance for a hard Landlock startup failure", () => {
+    printSandboxCreateRecoveryHints(
+      "Created sandbox: dcode\nLandlock path unavailable in hard_requirement mode: /app (read_only): No such file or directory",
+    );
+
+    const out = stderr();
+    expect(out).toContain("could not apply required Landlock filesystem isolation");
+    expect(out).toContain("Linux 5.19 or later (Landlock ABI v2)");
+    expect(out).toContain("enable the Landlock LSM");
+    expect(out).toContain("allow its syscalls");
+    expect(out).toContain("unavailable filesystem path");
+    expect(out).toContain("onboard --resume");
+  });
+
   // Manual / ARM64 E2E note (#3266):
   //
   // The misleading "failed to upload image tar into container" Docker 404 only

diff --git a/src/lib/build-context.ts b/src/lib/build-context.ts
@@ -197,6 +197,17 @@ export function printSandboxCreateRecoveryHints(
     console.error("  If this repeats, restart Docker or the gateway and retry.");
     return;
   }
+  if (failure.kind === "landlock_enforcement_failed") {
+    console.error("  Hint: OpenShell could not apply required Landlock filesystem isolation.");
+    console.error(
+      "        Deep Agents Code fails closed when the runtime lacks Landlock support or a",
+    );
+    console.error("        hard-required policy path is absent from the sandbox image.");
+    console.error("  Fix: use Linux 5.19 or later (Landlock ABI v2), enable the Landlock LSM,");
+    console.error("       allow its syscalls, and correct any unavailable filesystem path above.");
+    console.error(`  Recovery: ${CLI_NAME} onboard --resume`);
+    return;
+  }
   if (failure.kind === "sandbox_create_incomplete") {
     console.error("  Hint: sandbox creation started but the create stream did not finish cleanly.");
     console.error(`  Recovery: ${CLI_NAME} onboard --resume`);

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
@@ -261,7 +261,7 @@ const resumeProviderShim = require("./onboard/resume-provider-shim");
 const hermesProviderAuth = require("./hermes-provider-auth");
 const onboardHermesDashboard: typeof import("./onboard/hermes-dashboard") = require("./onboard/hermes-dashboard");
 const hermesAuth: typeof import("./onboard/hermes-auth") = require("./onboard/hermes-auth");
-const { warnIfLandlockUnsupported } = require("./onboard/landlock-warning");
+const { warnIfManagedAgentLandlockUnsupported } = require("./onboard/landlock-warning");
 const {
   HERMES_AUTH_METHOD_API_KEY,
   HERMES_AUTH_METHOD_OAUTH,
@@ -2954,7 +2954,7 @@ async function createSandboxWithBaseImageResolution(
 
   console.log(`  ✓ Sandbox '${sandboxName}' created`);
 
-  warnIfLandlockUnsupported({ dockerInfoFormat, runCapture });
+  warnIfManagedAgentLandlockUnsupported(isManagedDcodeAgent, dockerInfoFormat, runCapture);
 
   // #4614: arm rollback only when the sandbox was not live before (never a recreate/rebuild).
   if (!liveExists) sandboxCancelRollback.arm(sandboxName);

diff --git a/src/lib/onboard/created-sandbox-failure.test.ts b/src/lib/onboard/created-sandbox-failure.test.ts
@@ -76,10 +76,35 @@ describe("reportSandboxCreateFailure", () => {
     expect(deps.printRecoveryHints).toHaveBeenCalledWith("boom", {
       createArgs: ["sandbox", "create", "alpha"],
     });
+    expect(
+      (deps.printCreateFailureDiagnostics as ReturnType<typeof vi.fn>).mock.invocationCallOrder[0],
+    ).toBeLessThan(
+      (deps.printRecoveryHints as ReturnType<typeof vi.fn>).mock.invocationCallOrder[0],
+    );
     expect(deps.exitProcess).toHaveBeenCalledWith(42);
     expect(deps.warn).not.toHaveBeenCalled();
   });
 
+  it("preserves recovery hints and exit status when diagnostics collection fails", () => {
+    const deps = createFailureDeps({
+      printCreateFailureDiagnostics: vi.fn(() => {
+        throw new Error("diagnostics disk unavailable");
+      }),
+    });
+
+    expect(() =>
+      reportSandboxCreateFailure(createFailureOptions({ createStatus: 47 }), deps),
+    ).toThrow(ExitSignal);
+
+    expect(deps.printRecoveryHints).toHaveBeenCalledWith("boom", {
+      createArgs: ["sandbox", "create", "alpha"],
+    });
+    expect(deps.error).toHaveBeenCalledWith(
+      "  Could not save sandbox failure diagnostics; continuing recovery.",
+    );
+    expect(deps.exitProcess).toHaveBeenCalledWith(47);
+  });
+
   it("redacts create output before classification and echoing", () => {
     // With output: leading blank + headline + blank + output echo + "Try:" hint = 5 error() calls.
     const withOutput = createFailureDeps();

diff --git a/src/lib/onboard/created-sandbox-failure.ts b/src/lib/onboard/created-sandbox-failure.ts
@@ -54,9 +54,13 @@ export function reportSandboxCreateFailure(
     deps.error("");
     deps.error(redactedCreateOutput);
   }
-  deps.printCreateFailureDiagnostics(options.sandboxName, {
-    backupPath: options.restoreBackupPath,
-  });
+  try {
+    deps.printCreateFailureDiagnostics(options.sandboxName, {
+      backupPath: options.restoreBackupPath,
+    });
+  } catch {
+    deps.error("  Could not save sandbox failure diagnostics; continuing recovery.");
+  }
   deps.error("  Try:  openshell sandbox list        # check gateway state");
   deps.printRecoveryHints(redactedCreateOutput, { createArgs: options.createArgs });
   return deps.exitProcess(options.createStatus === 0 ? 1 : options.createStatus);