docs: fix sandbox hardening links by miyoungc · Pull Request #6151 · NVIDIA/NemoClaw

miyoungc · 2026-07-01T22:39:01Z

Summary

Fixes stale Sandbox Hardening links that still routed through the old deployment path.
The affected docs now point to the current manage-sandboxes/sandbox-hardening route.

Related Issue

Fixes #6093.

Changes

Updated docs/security/best-practices.mdx to use the current Sandbox Hardening route in both OpenClaw-only references.
Updated docs/reference/enterprise-readiness.mdx to use the current Sandbox Hardening route.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification: link-only documentation route fix.
Docs updated for user-facing behavior changes
Docs not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: link-only docs route fix; no runtime behavior, security controls, policy, credentials, or sandbox defaults changed.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
Targeted tests pass for changed behavior
Full npm test passes (broad runtime changes only)
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

npm run docs:sync-agent-variants && npm run docs passed with 0 errors. Fern reported 1 existing hidden warning.

Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

Documentation
- Updated several “Sandbox Hardening” links in the security and enterprise-readiness docs to point to the current guide location.
- Improved navigation from related security guidance so readers can find sandbox hardening information more reliably.

Fixes #6093.

coderabbitai · 2026-07-01T22:39:24Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 17479463-c7ae-4ff3-90a8-e105778c0896

📥 Commits

Reviewing files that changed from the base of the PR and between 0bc6073 and cc24373.

📒 Files selected for processing (2)

docs/reference/enterprise-readiness.mdx
docs/security/best-practices.mdx

📝 Walkthrough

Walkthrough

Updated three hyperlink references to the "Sandbox Hardening" documentation page, changing the relative path from ../deployment/sandbox-hardening to ../manage-sandboxes/sandbox-hardening in enterprise-readiness.mdx and best-practices.mdx.

Changes

Sandbox hardening link fixes

Layer / File(s)	Summary
Update broken link paths `docs/reference/enterprise-readiness.mdx`, `docs/security/best-practices.mdx`	Corrected three "Sandbox Hardening" link targets from `../deployment/sandbox-hardening` to `../manage-sandboxes/sandbox-hardening`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main doc link fix.
Linked Issues check	✅ Passed	The Security Best Practices sandbox-hardening links now point to the current path, matching the linked issue.
Out of Scope Changes check	✅ Passed	The extra enterprise-readiness link update is still directly related to the same sandbox-hardening path fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch docs/issue-6093-sandbox-hardening-link

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-01T22:43:00Z

🌿 Preview your docs: https://nvidia-preview-pr-6151.docs.buildwithfern.com/nemoclaw

github-actions · 2026-07-01T22:43:28Z

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

None. Docs-only link corrections cannot affect installer/onboarding, sandbox lifecycle, credentials, security boundaries, network policy enforcement, inference routing, deployment behavior, or real assistant user flows. No E2E is needed.

Optional E2E

None.

New E2E recommendations

None.

github-actions · 2026-07-01T22:43:29Z

E2E Target Recommendation

Required E2E targets: None
Optional E2E targets: None

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

None. Docs-only changes do not affect E2E target workflow, registry, runtime support, fixtures, or live target behavior.

Optional E2E targets

None.

Relevant changed files

None.

github-actions · 2026-07-01T22:45:13Z

PR Review Advisor — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Update stale Sandbox Hardening link regression test.
Open items: 0 required · 1 warning · 0 suggestions · 5 test follow-ups
Top item: Update stale Sandbox Hardening link regression test

Action checklist

PRA-1 Resolve or justify: Update stale Sandbox Hardening link regression test in test/repro-5088-best-practices-layers.test.ts:18
PRA-T1 Add or justify test follow-up: Update stale Sandbox Hardening link regression test
PRA-T2 Add or justify test follow-up: Acceptance clause
PRA-T3 Add or justify test follow-up: Acceptance clause
PRA-T4 Add or justify test follow-up: Acceptance clause
PRA-T5 Add or justify test follow-up: Acceptance clause

Findings index

ID	Severity	Category	Location	Required action
`PRA-1`	Resolve/justify	tests	`test/repro-5088-best-practices-layers.test.ts:18`	Update the test in this PR to make the Fern route the expected value: assert that `docs/security/best-practices.mdx` no longer contains `../deployment/sandbox-hardening` and that its Sandbox Hardening links use `../manage-sandboxes/sandbox-hardening`. Keep the existing layer-count assertions unchanged.

Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

`PRA-1` Resolve/justify — Update stale Sandbox Hardening link regression test

Location: test/repro-5088-best-practices-layers.test.ts:18
Category: tests
Problem: The PR intentionally changes `docs/security/best-practices.mdx` links from `../deployment/sandbox-hardening` to `../manage-sandboxes/sandbox-hardening`, which matches the Fern navigation route. However, the existing regression test still asserts that `manage-sandboxes/sandbox-hardening` must not appear and that `../deployment/sandbox-hardening` must appear.
Impact: The relevant security-docs regression coverage now contradicts the intended fix. That can either fail the focused test for this docs page or, if the test is removed without replacement, lose coverage that prevents this route from drifting again.
Recommended action: Update the test in this PR to make the Fern route the expected value: assert that `docs/security/best-practices.mdx` no longer contains `../deployment/sandbox-hardening` and that its Sandbox Hardening links use `../manage-sandboxes/sandbox-hardening`. Keep the existing layer-count assertions unchanged.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Read `test/repro-5088-best-practices-layers.test.ts:18-20` and compare it with the changed links in `docs/security/best-practices.mdx:325` and `docs/security/best-practices.mdx:661`.
Missing regression test: Revise the existing `best-practices.mdx security-layer consistency ([All Platforms][Docs] Security Best Practices: broken sandbox-hardening link and four-vs-five layer inconsistency #5088)` test case named `links Sandbox Hardening via the canonical deployment path` so it covers the new behavior: no `../deployment/sandbox-hardening` links remain and all Security Best Practices Sandbox Hardening links resolve through `../manage-sandboxes/sandbox-hardening`.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `test/repro-5088-best-practices-layers.test.ts:18-20` and compare it with the changed links in `docs/security/best-practices.mdx:325` and `docs/security/best-practices.mdx:661`.
Evidence: `test/repro-5088-best-practices-layers.test.ts` currently contains `expect(text).not.toMatch(/manage-sandboxes\/sandbox-hardening/);` and `expect(text).toMatch(/\.\.\/deployment\/sandbox-hardening/);`, while this PR changes the docs to `../manage-sandboxes/sandbox-hardening`.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

None.

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

PRA-T1 Update stale Sandbox Hardening link regression test — Update the test in this PR to make the Fern route the expected value: assert that `docs/security/best-practices.mdx` no longer contains `../deployment/sandbox-hardening` and that its Sandbox Hardening links use `../manage-sandboxes/sandbox-hardening`. Keep the existing layer-count assertions unchanged.
PRA-T2 Acceptance clause — All sandbox-hardening links on the page should point to the current path: `/nemoclaw/latest/user-guide/openclaw/manage-sandboxes/sandbox-hardening` (HTTP 200) — add test evidence or identify existing coverage. The docs source now points Security Best Practices links at the route-relative `../manage-sandboxes/sandbox-hardening`, and existing link-check tests recognize that route. The remaining gap is that `test/repro-5088-best-practices-layers.test.ts` still encodes the old route expectation and needs updating.
PRA-T3 Acceptance clause — The broken link needs to be updated to the new path. — add test evidence or identify existing coverage. The changed docs links are updated, but the nearby regression test still asserts that the new path must not appear in `docs/security/best-practices.mdx`.
PRA-T4 Acceptance clause — Discovered during doc-validation audit run fix: detect cgroup v2 misconfiguration during onboard preflight #62 (2026-06-29). — add test evidence or identify existing coverage. This is provenance for the issue report rather than a code acceptance requirement; no diff evidence can validate the external audit run.
PRA-T5 Acceptance clause — Related open PRs: - [fix: detect cgroup v2 misconfiguration during onboard preflight #62 fix: detect cgroup v2 misconfiguration during onboard preflight](https://github.com/NVIDIA/NemoClaw/pull/62\) — add test evidence or identify existing coverage. The issue comment appears unrelated to the docs route change and does not add a verifiable acceptance requirement for this PR.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

github-actions · 2026-07-01T22:45:55Z

PR Review Advisor (Nemotron Ultra) — Blocked

Merge posture: Do not merge until addressed
Primary next action: Fix PRA-2: Broken documentation link to sandbox hardening guide; then add or justify PRA-T1.
Open items: 4 required · 3 warnings · 1 suggestion · 4 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 3 new items found

Action checklist

Findings index

ID	Severity	Category	Location	Required action
`PRA-1`	Resolve/justify	architecture	—	Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
`PRA-2`	Required	correctness	`docs/reference/enterprise-readiness.mdx:86`	Revert link to '../deployment/sandbox-hardening' which correctly resolves to the source file at docs/deployment/sandbox-hardening.mdx. The published URL structure (Fern) differs from source structure; source-relative links must point to actual source files.
`PRA-3`	Required	correctness	`docs/security/best-practices.mdx:325`	Revert to '../deployment/sandbox-hardening'.
`PRA-4`	Required	correctness	`docs/security/best-practices.mdx:661`	Revert to '../deployment/sandbox-hardening'.
`PRA-5`	Required	acceptance	`docs/reference/enterprise-readiness.mdx:86`	1) Revert all three link changes to '../deployment/sandbox-hardening'. 2) Investigate published docs build (Fern config) separately if published URLs are incorrect. 3) Do not conflate published URL structure with source file structure.
`PRA-6`	Resolve/justify	security	`docs/security/best-practices.mdx:325`	Revert links to restore access to security hardening reference. Add link validation to prevent regression.
`PRA-7`	Resolve/justify	security	`docs/about/how-it-works.mdx:136`	Fix in follow-up PR: change to '../deployment/sandbox-hardening'.
`PRA-8`	Improvement	tests	`package.json`	Add a CI step (e.g., 'markdown-link-check' or custom script) that validates all relative .mdx/.md links resolve to existing files. Run on PRs touching docs/.

🚨 Required before merge

Address these before merging unless a maintainer explicitly overrides the advisor with rationale.

`PRA-2` Required — Broken documentation link to sandbox hardening guide

Location: docs/reference/enterprise-readiness.mdx:86
Category: correctness
Problem: Changed link from '../deployment/sandbox-hardening' (correct source-relative path to existing file docs/deployment/sandbox-hardening.mdx) to '../manage-sandboxes/sandbox-hardening' (file does not exist in source tree). Users clicking this link in GitHub source view or local markdown preview get 404.
Impact: Enterprise evaluators and operators following the enterprise-readiness guide cannot access critical sandbox hardening documentation (capability drops, ulimits, Landlock filesystem policy, SSRF protection, Docker Compose hardening examples).
Required action: Revert link to '../deployment/sandbox-hardening' which correctly resolves to the source file at docs/deployment/sandbox-hardening.mdx. The published URL structure (Fern) differs from source structure; source-relative links must point to actual source files.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Open docs/reference/enterprise-readiness.mdx line 86 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx (200) not 404.
Missing regression test: Add markdown link validation step to CI (e.g., markdownlint rule or custom script) that verifies all relative .mdx links resolve to existing files in the repository.
Done when: The required change is committed and verification passes: Open docs/reference/enterprise-readiness.mdx line 86 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx (200) not 404.
Evidence: grep -r 'manage-sandboxes/sandbox-hardening' docs/ returns 4 matches across 3 files; find docs -name 'sandbox-hardening*' returns only docs/deployment/sandbox-hardening.mdx; index.yml confirms source path is deployment/sandbox-hardening.mdx

`PRA-3` Required — Broken documentation link to sandbox hardening guide (capability drops section)

Location: docs/security/best-practices.mdx:325
Category: correctness
Problem: Changed link from '../deployment/sandbox-hardening' to '../manage-sandboxes/sandbox-hardening' in OpenClaw-specific capability-drops guidance. Target file does not exist.
Impact: Operators following capability-drop defense-in-depth guidance (--cap-drop=ALL at container runtime) cannot reach the hardening reference with Docker Compose examples and capability drop details.
Required action: Revert to '../deployment/sandbox-hardening'.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Open docs/security/best-practices.mdx line 325 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx.
Missing regression test: Add markdown link validation to CI to catch broken relative links in documentation.
Done when: The required change is committed and verification passes: Open docs/security/best-practices.mdx line 325 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx.
Evidence: Diff shows '-Refer to [Sandbox Hardening](../deployment/sandbox-hardening).\n+Refer to [Sandbox Hardening](../manage-sandboxes/sandbox-hardening).' at line 325; target file missing.

`PRA-4` Required — Broken documentation link to sandbox hardening guide (related topics section)

Location: docs/security/best-practices.mdx:661
Category: correctness
Problem: Changed link in Related Topics section from '../deployment/sandbox-hardening' to '../manage-sandboxes/sandbox-hardening'. Target file does not exist.
Impact: Security reviewers and operators navigating from best-practices related topics cannot access the hardening reference.
Required action: Revert to '../deployment/sandbox-hardening'.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Open docs/security/best-practices.mdx line 661 in GitHub source view and click the link; verify it resolves.
Missing regression test: Add markdown link validation to CI.
Done when: The required change is committed and verification passes: Open docs/security/best-practices.mdx line 661 in GitHub source view and click the link; verify it resolves.
Evidence: Diff shows same pattern at line 661; target file missing.

`PRA-5` Required — Acceptance clause from issue #6093 not met - PR breaks working links instead of fixing broken published links

Location: docs/reference/enterprise-readiness.mdx:86
Category: acceptance
Problem: Issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093 reported that published docs at docs.nvidia.com had a broken link at /deployment/sandbox-hardening (404) and a working link at /manage-sandboxes/sandbox-hardening (200). The PR author misunderstood: the published URL structure (Fern section hierarchy) differs from source file structure. The source file IS at deployment/sandbox-hardening.mdx (confirmed by index.yml). The PR changed correct source links to incorrect ones.
Impact: Issue remains unfixed (published docs may still have issues) AND new regressions introduced in source repository. Users browsing source on GitHub now hit broken links.
Required action: 1) Revert all three link changes to '../deployment/sandbox-hardening'. 2) Investigate published docs build (Fern config) separately if published URLs are incorrect. 3) Do not conflate published URL structure with source file structure.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Check issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093: the curl commands test published URLs (docs.nvidia.com), not GitHub source links. The fix belongs in Fern configuration or doc build pipeline, not source-relative markdown links.
Missing regression test: Add published-docs link validation in release pipeline (separate from source link validation).
Done when: The required change is committed and verification passes: Check issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093: the curl commands test published URLs (docs.nvidia.com), not GitHub source links. The fix belongs in Fern configuration or doc build pipeline, not source-relative markdown links.
Evidence: Issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093 shows curl tests against https://docs.nvidia.com/nemoclaw/latest/...; index.yml shows source path 'deployment/sandbox-hardening.mdx' with slug 'sandbox-hardening' under manage-sandboxes section; PR changes source links to match published URL pattern incorrectly.

Review findings by urgency: 4 required fixes, 3 items to resolve/justify, 1 in-scope improvement

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

`PRA-1` Resolve/justify — Source-of-truth review needed: Documentation link references to sandbox-hardening guide

Location: not file-specific
Category: architecture
Problem: The advisor marked localized patch analysis as missing.
Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
Missing regression test: Automated markdown link validation in CI verifying all relative .mdx links resolve to existing files.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
Evidence: find docs -name 'sandbox-hardening*' returns only deployment/sandbox-hardening.mdx; index.yml line 101 confirms source path.

`PRA-6` Resolve/justify — Security hardening documentation inaccessible via broken links

Location: docs/security/best-practices.mdx:325
Category: security
Problem: Three links to sandbox-hardening guide (capability drops, ulimits, Landlock, SSRF protection, Docker Compose hardening) now return 404 in source view. Security guidance on defense-in-depth container hardening is unreachable from best-practices and enterprise-readiness docs.
Impact: Operators and security reviewers cannot navigate to critical hardening controls: --cap-drop=ALL, ulimit nproc/nofile, Landlock LSM enforcement, no-new-privileges, read-only rootfs, tmpfs sizing.
Recommended action: Revert links to restore access to security hardening reference. Add link validation to prevent regression.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Visit docs/security/best-practices.mdx on GitHub, click 'Sandbox Hardening' links at lines 325 and 661; verify they resolve to deployment/sandbox-hardening.mdx.
Missing regression test: CI check: markdown-link validation for all .mdx files in docs/ directory.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Visit docs/security/best-practices.mdx on GitHub, click 'Sandbox Hardening' links at lines 325 and 661; verify they resolve to deployment/sandbox-hardening.mdx.
Evidence: Security categories 7 (Configuration) and 9 (Holistic) review: broken links degrade security posture by hiding hardening guidance.

`PRA-7` Resolve/justify — Pre-existing broken link to sandbox hardening (not changed by this PR but same root cause)

Location: docs/about/how-it-works.mdx:136
Category: security
Problem: docs/about/how-it-works.mdx line 136 already had '../manage-sandboxes/sandbox-hardening' before this PR. This PR didn't fix it; the same misunderstanding exists in another file.
Impact: Additional entry point to hardening guide is broken.
Recommended action: Fix in follow-up PR: change to '../deployment/sandbox-hardening'.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Open docs/about/how-it-works.mdx line 136 and click the Sandbox Hardening link.
Missing regression test: Link validation would catch this pre-existing issue.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Open docs/about/how-it-works.mdx line 136 and click the Sandbox Hardening link.
Evidence: grep output shows how-it-works.mdx:136 has the same incorrect path; not modified in this PR.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

`PRA-8` Improvement — Missing automated documentation link validation in CI

Location: package.json
Category: tests
Problem: No markdown-link validation step exists in the docs build or CI pipeline. Broken relative links can be merged undetected.
Impact: Documentation link rot accumulates; security-critical cross-references break silently.
Suggested action: Add a CI step (e.g., 'markdown-link-check' or custom script) that validates all relative .mdx/.md links resolve to existing files. Run on PRs touching docs/.
Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
Verification: Check .github/workflows/ for link-check job; run 'npx markdown-link-check docs/**/*.mdx' locally to see current broken links.
Missing regression test: Implement link validation as a required CI check for docs changes.
Done when: The local improvement is applied, or the PR notes why it should be deferred.
Evidence: This PR merged with broken links; no CI caught it. Quality gates section in PR template shows 'npm run docs builds without warnings' but no link check.

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

PRA-T1 Missing automated documentation link validation in CI — Add a CI step (e.g., 'markdown-link-check' or custom script) that validates all relative .mdx/.md links resolve to existing files. Run on PRs touching docs/.
PRA-T2 Acceptance clause — Fix broken published docs link at /deployment/sandbox-hardening (404) to point to working /manage-sandboxes/sandbox-hardening (200) — add test evidence or identify existing coverage. PR changed source-relative links, not published URL configuration. Source links now broken; published docs fix not addressed.
PRA-T3 Acceptance clause — Update stale Sandbox Hardening links that still routed through the old deployment path — add test evidence or identify existing coverage. The 'old deployment path' (../deployment/sandbox-hardening) IS the correct source path. The PR broke working links.
PRA-T4 Documentation link references to sandbox-hardening guide — Automated markdown link validation in CI verifying all relative .mdx links resolve to existing files.. find docs -name 'sandbox-hardening*' returns only deployment/sandbox-hardening.mdx; index.yml line 101 confirms source path.

Since last review details

Current findings, using the urgency labels above:

`PRA-1` Resolve/justify — Source-of-truth review needed: Documentation link references to sandbox-hardening guide

Location: not file-specific
Category: architecture
Problem: The advisor marked localized patch analysis as missing.
Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
Missing regression test: Automated markdown link validation in CI verifying all relative .mdx links resolve to existing files.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
Evidence: find docs -name 'sandbox-hardening*' returns only deployment/sandbox-hardening.mdx; index.yml line 101 confirms source path.

`PRA-2` Required — Broken documentation link to sandbox hardening guide

Location: docs/reference/enterprise-readiness.mdx:86
Category: correctness
Problem: Changed link from '../deployment/sandbox-hardening' (correct source-relative path to existing file docs/deployment/sandbox-hardening.mdx) to '../manage-sandboxes/sandbox-hardening' (file does not exist in source tree). Users clicking this link in GitHub source view or local markdown preview get 404.
Impact: Enterprise evaluators and operators following the enterprise-readiness guide cannot access critical sandbox hardening documentation (capability drops, ulimits, Landlock filesystem policy, SSRF protection, Docker Compose hardening examples).
Required action: Revert link to '../deployment/sandbox-hardening' which correctly resolves to the source file at docs/deployment/sandbox-hardening.mdx. The published URL structure (Fern) differs from source structure; source-relative links must point to actual source files.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Open docs/reference/enterprise-readiness.mdx line 86 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx (200) not 404.
Missing regression test: Add markdown link validation step to CI (e.g., markdownlint rule or custom script) that verifies all relative .mdx links resolve to existing files in the repository.
Done when: The required change is committed and verification passes: Open docs/reference/enterprise-readiness.mdx line 86 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx (200) not 404.
Evidence: grep -r 'manage-sandboxes/sandbox-hardening' docs/ returns 4 matches across 3 files; find docs -name 'sandbox-hardening*' returns only docs/deployment/sandbox-hardening.mdx; index.yml confirms source path is deployment/sandbox-hardening.mdx

`PRA-3` Required — Broken documentation link to sandbox hardening guide (capability drops section)

Location: docs/security/best-practices.mdx:325
Category: correctness
Problem: Changed link from '../deployment/sandbox-hardening' to '../manage-sandboxes/sandbox-hardening' in OpenClaw-specific capability-drops guidance. Target file does not exist.
Impact: Operators following capability-drop defense-in-depth guidance (--cap-drop=ALL at container runtime) cannot reach the hardening reference with Docker Compose examples and capability drop details.
Required action: Revert to '../deployment/sandbox-hardening'.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Open docs/security/best-practices.mdx line 325 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx.
Missing regression test: Add markdown link validation to CI to catch broken relative links in documentation.
Done when: The required change is committed and verification passes: Open docs/security/best-practices.mdx line 325 in GitHub source view and click the link; verify it resolves to docs/deployment/sandbox-hardening.mdx.
Evidence: Diff shows '-Refer to [Sandbox Hardening](../deployment/sandbox-hardening).\n+Refer to [Sandbox Hardening](../manage-sandboxes/sandbox-hardening).' at line 325; target file missing.

`PRA-4` Required — Broken documentation link to sandbox hardening guide (related topics section)

Location: docs/security/best-practices.mdx:661
Category: correctness
Problem: Changed link in Related Topics section from '../deployment/sandbox-hardening' to '../manage-sandboxes/sandbox-hardening'. Target file does not exist.
Impact: Security reviewers and operators navigating from best-practices related topics cannot access the hardening reference.
Required action: Revert to '../deployment/sandbox-hardening'.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Open docs/security/best-practices.mdx line 661 in GitHub source view and click the link; verify it resolves.
Missing regression test: Add markdown link validation to CI.
Done when: The required change is committed and verification passes: Open docs/security/best-practices.mdx line 661 in GitHub source view and click the link; verify it resolves.
Evidence: Diff shows same pattern at line 661; target file missing.

`PRA-5` Required — Acceptance clause from issue #6093 not met - PR breaks working links instead of fixing broken published links

Location: docs/reference/enterprise-readiness.mdx:86
Category: acceptance
Problem: Issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093 reported that published docs at docs.nvidia.com had a broken link at /deployment/sandbox-hardening (404) and a working link at /manage-sandboxes/sandbox-hardening (200). The PR author misunderstood: the published URL structure (Fern section hierarchy) differs from source file structure. The source file IS at deployment/sandbox-hardening.mdx (confirmed by index.yml). The PR changed correct source links to incorrect ones.
Impact: Issue remains unfixed (published docs may still have issues) AND new regressions introduced in source repository. Users browsing source on GitHub now hit broken links.
Required action: 1) Revert all three link changes to '../deployment/sandbox-hardening'. 2) Investigate published docs build (Fern config) separately if published URLs are incorrect. 3) Do not conflate published URL structure with source file structure.
Expected follow-up: Fix before merge or get explicit maintainer override.
Verification: Check issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093: the curl commands test published URLs (docs.nvidia.com), not GitHub source links. The fix belongs in Fern configuration or doc build pipeline, not source-relative markdown links.
Missing regression test: Add published-docs link validation in release pipeline (separate from source link validation).
Done when: The required change is committed and verification passes: Check issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093: the curl commands test published URLs (docs.nvidia.com), not GitHub source links. The fix belongs in Fern configuration or doc build pipeline, not source-relative markdown links.
Evidence: Issue [All Platforms][Docs] Security Best Practices page has broken sandbox-hardening link pointing to old /deployment/ path (404) #6093 shows curl tests against https://docs.nvidia.com/nemoclaw/latest/...; index.yml shows source path 'deployment/sandbox-hardening.mdx' with slug 'sandbox-hardening' under manage-sandboxes section; PR changes source links to match published URL pattern incorrectly.

`PRA-6` Resolve/justify — Security hardening documentation inaccessible via broken links

Location: docs/security/best-practices.mdx:325
Category: security
Problem: Three links to sandbox-hardening guide (capability drops, ulimits, Landlock, SSRF protection, Docker Compose hardening) now return 404 in source view. Security guidance on defense-in-depth container hardening is unreachable from best-practices and enterprise-readiness docs.
Impact: Operators and security reviewers cannot navigate to critical hardening controls: --cap-drop=ALL, ulimit nproc/nofile, Landlock LSM enforcement, no-new-privileges, read-only rootfs, tmpfs sizing.
Recommended action: Revert links to restore access to security hardening reference. Add link validation to prevent regression.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Visit docs/security/best-practices.mdx on GitHub, click 'Sandbox Hardening' links at lines 325 and 661; verify they resolve to deployment/sandbox-hardening.mdx.
Missing regression test: CI check: markdown-link validation for all .mdx files in docs/ directory.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Visit docs/security/best-practices.mdx on GitHub, click 'Sandbox Hardening' links at lines 325 and 661; verify they resolve to deployment/sandbox-hardening.mdx.
Evidence: Security categories 7 (Configuration) and 9 (Holistic) review: broken links degrade security posture by hiding hardening guidance.

`PRA-7` Resolve/justify — Pre-existing broken link to sandbox hardening (not changed by this PR but same root cause)

Location: docs/about/how-it-works.mdx:136
Category: security
Problem: docs/about/how-it-works.mdx line 136 already had '../manage-sandboxes/sandbox-hardening' before this PR. This PR didn't fix it; the same misunderstanding exists in another file.
Impact: Additional entry point to hardening guide is broken.
Recommended action: Fix in follow-up PR: change to '../deployment/sandbox-hardening'.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Open docs/about/how-it-works.mdx line 136 and click the Sandbox Hardening link.
Missing regression test: Link validation would catch this pre-existing issue.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Open docs/about/how-it-works.mdx line 136 and click the Sandbox Hardening link.
Evidence: grep output shows how-it-works.mdx:136 has the same incorrect path; not modified in this PR.

`PRA-8` Improvement — Missing automated documentation link validation in CI

Location: package.json
Category: tests
Problem: No markdown-link validation step exists in the docs build or CI pipeline. Broken relative links can be merged undetected.
Impact: Documentation link rot accumulates; security-critical cross-references break silently.
Suggested action: Add a CI step (e.g., 'markdown-link-check' or custom script) that validates all relative .mdx/.md links resolve to existing files. Run on PRs touching docs/.
Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
Verification: Check .github/workflows/ for link-check job; run 'npx markdown-link-check docs/**/*.mdx' locally to see current broken links.
Missing regression test: Implement link validation as a required CI check for docs changes.
Done when: The local improvement is applied, or the PR notes why it should be deferred.
Evidence: This PR merged with broken links; no CI caught it. Quality gates section in PR template shows 'npm run docs builds without warnings' but no link check.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

## Summary Updates the #5088 documentation regression test after #6151 moved Sandbox Hardening to the canonical `manage-sandboxes` route. Current `main` deterministically fails CLI shard 5 because the test still requires the retired `deployment` path. ## Changes - Require `../manage-sandboxes/sandbox-hardening` in the best-practices regression test. - Reject the retired `../deployment/sandbox-hardening` route. - Apply the repository's current import ordering to the touched test. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: #6151 already changed the user-facing route; this PR only reconciles its regression test. - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **Tests** * Updated regression coverage to ensure the “Sandbox Hardening” link points to the current sandbox management route. * Confirmed the retired deployment link is no longer used. * Kept existing checks for “Gateway Authentication” and the “five layers” wording unchanged.  Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

## Summary Fixes stale Sandbox Hardening links that still routed through the old deployment path. The affected docs now point to the current `manage-sandboxes/sandbox-hardening` route. ## Related Issue Fixes NVIDIA#6093. ## Changes - Updated `docs/security/best-practices.mdx` to use the current Sandbox Hardening route in both OpenClaw-only references. - Updated `docs/reference/enterprise-readiness.mdx` to use the current Sandbox Hardening route. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates  - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: link-only documentation route fix. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: link-only docs route fix; no runtime behavior, security controls, policy, credentials, or sandbox defaults changed. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs:sync-agent-variants && npm run docs` passed with 0 errors. Fern reported 1 existing hidden warning. ---  Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Updated several “Sandbox Hardening” links in the security and enterprise-readiness docs to point to the current guide location. * Improved navigation from related security guidance so readers can find sandbox hardening information more reliably.

## Summary Updates the NVIDIA#5088 documentation regression test after NVIDIA#6151 moved Sandbox Hardening to the canonical `manage-sandboxes` route. Current `main` deterministically fails CLI shard 5 because the test still requires the retired `deployment` path. ## Changes - Require `../manage-sandboxes/sandbox-hardening` in the best-practices regression test. - Reject the retired `../deployment/sandbox-hardening` route. - Apply the repository's current import ordering to the touched test. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: NVIDIA#6151 already changed the user-facing route; this PR only reconciles its regression test. - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **Tests** * Updated regression coverage to ensure the “Sandbox Hardening” link points to the current sandbox management route. * Confirmed the retired deployment link is no longer used. * Kept existing checks for “Gateway Authentication” and the “five layers” wording unchanged.  Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

docs: fix sandbox hardening links

cc24373

Fixes #6093.

miyoungc added the area: docs Documentation, examples, guides, or docs build label Jul 1, 2026

miyoungc self-assigned this Jul 1, 2026

miyoungc added the v0.0.72 label Jul 1, 2026

prekshivyas approved these changes Jul 1, 2026

View reviewed changes

cv merged commit c6a7d23 into main Jul 1, 2026
39 of 42 checks passed

cv deleted the docs/issue-6093-sandbox-hardening-link branch July 1, 2026 22:47

ericksoa mentioned this pull request Jul 1, 2026

test(docs): track canonical sandbox hardening route #6155

Merged

21 tasks

Uh oh!

Conversation

miyoungc commented Jul 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

github-actions Bot commented Jul 1, 2026

E2E Advisor Recommendation

E2E Recommendation Advisor

Required E2E

Optional E2E

New E2E recommendations

Uh oh!

github-actions Bot commented Jul 1, 2026

E2E Target Recommendation

E2E Target Advisor

Required E2E targets

Optional E2E targets

Relevant changed files

Uh oh!

github-actions Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — Changes requested

Action checklist

Findings index

⚠️ Resolve or justify before merge

PRA-1 Resolve/justify — Update stale Sandbox Hardening link regression test

💡 In-scope improvements

Uh oh!

github-actions Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor (Nemotron Ultra) — Blocked

Action checklist

Findings index

🚨 Required before merge

PRA-2 Required — Broken documentation link to sandbox hardening guide

PRA-3 Required — Broken documentation link to sandbox hardening guide (capability drops section)

PRA-4 Required — Broken documentation link to sandbox hardening guide (related topics section)

PRA-5 Required — Acceptance clause from issue #6093 not met - PR breaks working links instead of fixing broken published links

⚠️ Resolve or justify before merge

PRA-1 Resolve/justify — Source-of-truth review needed: Documentation link references to sandbox-hardening guide

PRA-6 Resolve/justify — Security hardening documentation inaccessible via broken links

PRA-7 Resolve/justify — Pre-existing broken link to sandbox hardening (not changed by this PR but same root cause)

💡 In-scope improvements

PRA-8 Improvement — Missing automated documentation link validation in CI

PRA-1 Resolve/justify — Source-of-truth review needed: Documentation link references to sandbox-hardening guide

PRA-2 Required — Broken documentation link to sandbox hardening guide

PRA-3 Required — Broken documentation link to sandbox hardening guide (capability drops section)

PRA-4 Required — Broken documentation link to sandbox hardening guide (related topics section)

PRA-5 Required — Acceptance clause from issue #6093 not met - PR breaks working links instead of fixing broken published links

PRA-6 Resolve/justify — Security hardening documentation inaccessible via broken links

PRA-7 Resolve/justify — Pre-existing broken link to sandbox hardening (not changed by this PR but same root cause)

PRA-8 Improvement — Missing automated documentation link validation in CI

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

miyoungc commented Jul 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 1, 2026 •

edited

Loading

github-actions Bot commented Jul 1, 2026 •

edited

Loading

`PRA-1` Resolve/justify — Update stale Sandbox Hardening link regression test

github-actions Bot commented Jul 1, 2026 •

edited

Loading

`PRA-2` Required — Broken documentation link to sandbox hardening guide

`PRA-3` Required — Broken documentation link to sandbox hardening guide (capability drops section)

`PRA-4` Required — Broken documentation link to sandbox hardening guide (related topics section)

`PRA-5` Required — Acceptance clause from issue #6093 not met - PR breaks working links instead of fixing broken published links

`PRA-1` Resolve/justify — Source-of-truth review needed: Documentation link references to sandbox-hardening guide

`PRA-6` Resolve/justify — Security hardening documentation inaccessible via broken links

`PRA-7` Resolve/justify — Pre-existing broken link to sandbox hardening (not changed by this PR but same root cause)

`PRA-8` Improvement — Missing automated documentation link validation in CI

`PRA-1` Resolve/justify — Source-of-truth review needed: Documentation link references to sandbox-hardening guide

`PRA-2` Required — Broken documentation link to sandbox hardening guide

`PRA-3` Required — Broken documentation link to sandbox hardening guide (capability drops section)

`PRA-4` Required — Broken documentation link to sandbox hardening guide (related topics section)

`PRA-5` Required — Acceptance clause from issue #6093 not met - PR breaks working links instead of fixing broken published links

`PRA-6` Resolve/justify — Security hardening documentation inaccessible via broken links

`PRA-7` Resolve/justify — Pre-existing broken link to sandbox hardening (not changed by this PR but same root cause)

`PRA-8` Improvement — Missing automated documentation link validation in CI