docs(security): add credential rotation guide - #6266
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR adds a new ChangesCredential rotation documentation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
🧹 Nitpick comments (4)
docs/security/credential-rotation.mdx (2)
113-136: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUnnecessary bold text in emergency rotation steps.
Each numbered step (lines 117, 118, 124, 125, 131) bolds its lead phrase, which the docs style guideline discourages.
As per coding guidelines, "Avoid filler, hype, rhetorical questions, emoji, em-dashes, and unnecessary bold text."✏️ Proposed fix
-1. **Revoke the key** at the provider dashboard (NVIDIA API Catalog, Slack, Telegram, etc.) before doing anything else. -2. **Remove it from the gateway** immediately so the sandbox cannot use the compromised value: +1. Revoke the key at the provider dashboard (NVIDIA API Catalog, Slack, Telegram, etc.) before doing anything else. +2. Remove it from the gateway immediately so the sandbox cannot use the compromised value:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/security/credential-rotation.mdx` around lines 113 - 136, Remove the unnecessary bold formatting from the lead phrases in the Emergency Rotation After Key Compromise steps so the numbered list matches the docs style guide. Update the markdown in the credential-rotation section by editing the step text around the emergency rotation instructions, keeping the content the same but writing the step labels as plain text instead of bold emphasis.Source: Coding guidelines
79-82: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAgentOnly block content doesn't actually diverge by variant.
The block states messaging-token rotation happens "through the same onboard path" for Hermes, i.e. no different behavior/setup flow from the general instructions above it. Per coding guidelines,
<AgentOnly>should only be used when content genuinely differs by behavior, setup flow, state layout, or agent-specific wording, not to restate the same flow with a Hermes label.
As per coding guidelines, "Use<AgentOnly>blocks only when content differs by behavior, setup flow, state layout, or agent-specific wording."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/security/credential-rotation.mdx` around lines 79 - 82, Remove the <AgentOnly variant="hermes"> block in credential-rotation.mdx or rewrite it so Hermes-specific content truly differs from the general flow. The current text in the AgentOnly block mirrors the same rotation path already described above, so locate the Hermes messaging-token section and either fold it into the shared instructions or replace it with genuinely Hermes-only behavior using the AgentOnly marker only when the setup or flow changes.Source: Coding guidelines
docs/inference/custom-llm-provider.md (2)
50-50: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse code formatting instead of bold for the literal option value.
"Custom"is a literal UI value; per the style guide it should use code formatting rather than bold.
As per coding guidelines, "Usecodeformatting for commands, paths, flags, environment variables, file names, and literal values" and "Avoid ... unnecessary bold text."✏️ Proposed fix
-When prompted for the endpoint, select **"Custom"** and enter your provider's base URL. +When prompted for the endpoint, select `Custom` and enter your provider's base URL.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/inference/custom-llm-provider.md` at line 50, The documentation text in the custom LLM provider guide uses bold for the literal UI option value "Custom" instead of code formatting. Update the sentence in the affected markdown content to use inline code formatting for the exact option value, keeping the rest of the wording unchanged and ensuring the style follows the guide for literal values.Source: Coding guidelines
1-338: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd
custom-llm-providerto the Inference nav.
docs/inference/custom-llm-provider.mdis not listed indocs/index.yml; add it under theInferencesection so the page shows up in the docs navigation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/inference/custom-llm-provider.md` around lines 1 - 338, The custom LLM provider doc exists but is missing from the docs navigation. Update the docs index entry under the Inference section in docs/index.yml to include the custom-llm-provider page so it appears alongside the other inference docs. Use the page title or slug that matches the existing custom-llm-provider.md document and keep the ordering consistent with the other Inference items.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/inference/custom-llm-provider.md`:
- Line 24: Remove the em dash styling from the prose in this guide and replace
it with acceptable punctuation or sentence breaks. Update the affected text in
the custom-llm-provider.md content so the opening description, the relevant
section around the linked reference, and the closing note no longer use em
dashes. Make the edits in the markdown prose and any link text that contains the
em dash, keeping the wording otherwise unchanged.
- Around line 334-338: The Related Topics links in the custom-llm-provider docs
need to be corrected. Update the markdown in the Related Topics section so the
switch-inference-providers and approve-network-requests entries use route-style
slugs without the .md extension, and replace the broken inference-profiles link
with the correct matching reference page path. Focus on the links in the Related
Topics list for custom-llm-provider.md.
In `@docs/security/credential-rotation.mdx`:
- Line 33: The Markdown/MDX text in the credential-rotation doc contains two
sentences on a single line, violating the one-sentence-per-line guideline. Split
the sentence in this section into separate lines in the same paragraph, keeping
the wording unchanged and preserving the existing content around the
sandbox/provider name pattern and the credential reset guidance.
- Around line 92-111: The step headings in the credential rotation doc use
unnecessary bold text and an em-dash in the markers. Update the section in
credential-rotation.mdx so the step labels under Remove and Re-register a
Credential use plain text with the existing numbering, and replace the em-dash
punctuation with the preferred guideline-compliant separator. Keep the
surrounding content in the same flow, including the credential reset and onboard
examples, while making the headings match the style used elsewhere in the docs.
- Line 15: The sentence in the credential-rotation MDX content uses an em-dash
and violates the docs style guide; update the text in the affected paragraph to
remove the em-dash and rewrite it with plain punctuation, and ensure the
Markdown/MDX source keeps one sentence per line in that section.
- Around line 142-148: The GitHub Actions example in credential-rotation.mdx
uses the literal CLI name instead of the shared host-variant placeholder. Update
the “Rotate inference key” `run:` example to match the other command blocks in
this file by using `$$nemoclaw` in the command, so the generated OpenClaw and
Hermes pages stay consistent.
- Around line 157-163: The docs snippet uses the internal command id form
instead of the user-facing CLI syntax. Update the credential-rotation example in
the section that references nemoclaw status and the inference command to use the
space-separated form `inference get` (consistent with the `inference get
[--json]` usage and the rest of the docs), and keep the surrounding wording
unchanged.
In `@nemoclaw-sandbox-policy.yaml`:
- Around line 26-34: The openai policy entry is missing the binaries restriction
required by the sandbox schema. Update the openai block in
nemoclaw-sandbox-policy.yaml to include a binaries field matching the other
network_policies entries, so it satisfies schemas/sandbox-policy.schema.json and
is scoped to the intended process. Use the existing openai policy entry as the
location to add the missing field.
In `@skill/nat/references/custom-tools.md`:
- Around line 11-19: The directory tree in the custom-tools reference is using a
bare fenced block, which triggers the markdownlint warning. Update the fenced
block in custom-tools.md to use the text language tag for the tree snippet so
the directory listing remains lint-clean.
- Around line 31-52: The custom tool example is incomplete because it uses
Builder and FunctionInfo without importing them, so the snippet will not run as
written. Update the example around MyCustomToolConfig, my_custom_tool_function,
and the register_function usage to either add the missing imports for Builder
and FunctionInfo or explicitly label the block as partial/illustrative so
readers know it is not copy-paste ready.
- Around line 65-68: The override example uses the wrong YAML instance name in
the path. Update the command under the custom-tools example to use the actual
function key from the surrounding config, `functions.docs_query.webpage_url`,
instead of `functions.webpage_query.webpage_url`, so the example matches the
referenced tool instance.
In `@skill/nat/references/function-groups.md`:
- Around line 19-58: The example snippet is missing required imports, making the
builder example incomplete. In the ObjectStoreConfig / build_object_store
example, add the missing references for Builder and boto3 alongside the existing
FunctionGroupBaseConfig, Field, register_function_group, and FunctionGroup
imports, or explicitly label the snippet as partial pseudocode so readers know
it is not directly runnable.
In `@skill/nat/references/install-from-source.md`:
- Around line 10-12: The install-from-source recipe is using an extra that the
project does not define, so update the `uv sync` step in this doc to remove
`--extra most` and align it with the repository’s declared metadata. While
you’re here, recheck the `uv venv --python 3.13` pin against the
`requires-python` range and adjust the install instructions if needed so they
match the supported versions and available dependency groups.
In `@skill/nat/SKILL.md`:
- Line 83: The documented agent type name is misspelled in the SKILL.md entry,
so update the `rewwo_agent` reference to `rewoo_agent` in the agent type list.
Make this correction wherever that symbol appears in the docs snippet so
copy-pasted workflow configs match the expected `rewoo_agent` identifier.
---
Nitpick comments:
In `@docs/inference/custom-llm-provider.md`:
- Line 50: The documentation text in the custom LLM provider guide uses bold for
the literal UI option value "Custom" instead of code formatting. Update the
sentence in the affected markdown content to use inline code formatting for the
exact option value, keeping the rest of the wording unchanged and ensuring the
style follows the guide for literal values.
- Around line 1-338: The custom LLM provider doc exists but is missing from the
docs navigation. Update the docs index entry under the Inference section in
docs/index.yml to include the custom-llm-provider page so it appears alongside
the other inference docs. Use the page title or slug that matches the existing
custom-llm-provider.md document and keep the ordering consistent with the other
Inference items.
In `@docs/security/credential-rotation.mdx`:
- Around line 113-136: Remove the unnecessary bold formatting from the lead
phrases in the Emergency Rotation After Key Compromise steps so the numbered
list matches the docs style guide. Update the markdown in the
credential-rotation section by editing the step text around the emergency
rotation instructions, keeping the content the same but writing the step labels
as plain text instead of bold emphasis.
- Around line 79-82: Remove the <AgentOnly variant="hermes"> block in
credential-rotation.mdx or rewrite it so Hermes-specific content truly differs
from the general flow. The current text in the AgentOnly block mirrors the same
rotation path already described above, so locate the Hermes messaging-token
section and either fold it into the shared instructions or replace it with
genuinely Hermes-only behavior using the AgentOnly marker only when the setup or
flow changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ff9e3f06-f0b4-4167-ae77-36a5470241f9
📒 Files selected for processing (12)
docs/index.ymldocs/inference/custom-llm-provider.mddocs/inference/switch-to-brev-nemotron-120b.mddocs/inference/switch-to-nemotron-super-120b.mddocs/security/credential-rotation.mdxnemoclaw-sandbox-policy.yamlskill/nat/SKILL.mdskill/nat/references/a2a-server.mdskill/nat/references/custom-tools.mdskill/nat/references/examples.mdskill/nat/references/function-groups.mdskill/nat/references/install-from-source.md
21787ef to
6b5d442
Compare
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
The copy-paste rotation flow is not executable or safe as documented. It invents provider names and resettable messaging credential names; claims messaging rotation avoids rebuild even though the flow backs up, deletes, and recreates the sandbox; and every non-interactive onboard example omits mandatory --yes-i-accept-third-party-software, so commands can stop before rotation. Validate against actual CLI and provider behavior and update the examples and tests.
659ad00 to
9532d92
Compare
wscurran
added
area: docs
|
✨ Thanks for the PR. This adds a comprehensive Credential Rotation guide covering inference keys, messaging tokens, and web search credentials. Ready for maintainer review. |
|
I pushed The guide now uses provider names from Validation completed:
@coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh pr view 6266 --repo NVIDIA/NemoClaw --json title,body,baseRefName,headRefName,commits --jq '.title, .baseRefName, .headRefName'
echo "---DIFF---"
gh pr diff 6266 --repo NVIDIA/NemoClaw
echo "---FILE---"
gh api repos/NVIDIA/NemoClaw/contents/docs/security/credential-rotation.mdx --jq '.content' | base64 -dLength of output: 14024 🏁 Script executed: #!/bin/bash
set -euo pipefail
git clone --depth 100 -b docs/credential-rotation https://github.com/NVIDIA/NemoClaw.git repo 2>&1 | tail -5
cd repo
echo "=== search for --recreate-sandbox ==="
rg -n "recreate-sandbox" --type-not md -g '!*.mdx' | head -30
echo "=== search for credentials reset ==="
rg -n "credentials reset|credentials list" -g '*.ts' -g '*.go' -g '*.py' | head -30
echo "=== search for channels add ==="
rg -n "channels add" -g '*.ts' -g '*.go' -g '*.py' | head -30
echo "=== search for NEMOCLAW_NON_INTERACTIVE ==="
rg -n "NEMOCLAW_NON_INTERACTIVE" | head -30
echo "=== check related pages existence ==="
fd -a "runtime-controls" docs
fd -a "switch-inference-providers" docs
fd -a "best-practices" docs
fd -a "credential-storage" docs
echo "=== check AgentOnly usage elsewhere ==="
rg -n "AgentOnly variant=" docs -g '*.mdx' | head -20
echo "=== check --yes-i-accept-third-party-software elsewhere ==="
rg -n "yes-i-accept-third-party-software" docs | head -20Length of output: 1522 🏁 Script executed: #!/bin/bash
set -euo pipefail
git clone --depth 200 https://github.com/NVIDIA/NemoClaw.git repo 2>&1 | tail -5
cd repo
git fetch origin pull/6266/head:pr-6266 2>&1 | tail -5
git checkout pr-6266 2>&1 | tail -5
echo "=== search for --recreate-sandbox ==="
rg -n "recreate-sandbox" -g '!*.mdx' | head -30
echo "=== search for credentials reset/list ==="
rg -n "credentials reset|credentials list" -g '*.ts' -g '*.go' -g '*.py' | head -30
echo "=== search for channels add ==="
rg -n "channels add" -g '*.ts' -g '*.go' -g '*.py' | head -30
echo "=== search for NEMOCLAW_NON_INTERACTIVE ==="
rg -n "NEMOCLAW_NON_INTERACTIVE" | head -30
echo "=== check related pages existence ==="
fd -a "runtime-controls" docs
fd -a "switch-inference-providers" docs
fd -a "best-practices" docs
fd -a "credential-storage" docs
echo "=== check AgentOnly usage elsewhere ==="
rg -n "AgentOnly variant=" docs -g '*.mdx' | head -20
echo "=== check --yes-i-accept-third-party-software elsewhere ==="
rg -n "yes-i-accept-third-party-software" docs | head -20
echo "=== check rebuild --yes usage ==="
rg -n "rebuild --yes|rebuild\b" docs -g '*.mdx' | head -20Length of output: 1685 🏁 Script executed: #!/bin/bash
set -uo pipefail
cd repo 2>/dev/null || { git fetch origin pull/6266/head:pr-6266; git checkout pr-6266; }
echo "=== search for --recreate-sandbox ==="
rg -n "recreate-sandbox" -g '!*.mdx' || echo "NO MATCH"
echo "=== search for credentials reset/list ==="
rg -n "credentials reset|credentials list" -g '*.ts' -g '*.go' -g '*.py' || echo "NO MATCH"
echo "=== search for channels add ==="
rg -n "channels add" -g '*.ts' -g '*.go' -g '*.py' || echo "NO MATCH"
echo "=== search for NEMOCLAW_NON_INTERACTIVE ==="
rg -n "NEMOCLAW_NON_INTERACTIVE" || echo "NO MATCH"
echo "=== check related pages existence ==="
fd -a "runtime-controls" docs || echo "NOT FOUND"
fd -a "switch-inference-providers" docs || echo "NOT FOUND"
fd -a "best-practices" docs || echo "NOT FOUND"
fd -a "credential-storage" docs || echo "NOT FOUND"
echo "=== check AgentOnly usage elsewhere ==="
rg -n "AgentOnly variant=" docs -g '*.mdx' || echo "NO MATCH"
echo "=== check --yes-i-accept-third-party-software elsewhere ==="
rg -n "yes-i-accept-third-party-software" docs || echo "NO MATCH"
echo "=== check rebuild --yes usage elsewhere ==="
rg -n "rebuild --yes|rebuild\b" docs -g '*.mdx' || echo "NO MATCH"
echo "=== list top-level dirs (find CLI source) ==="
fd -td -d 2 . | head -40Length of output: 1452 🏁 Script executed: #!/bin/bash
set -uo pipefail
ls
pwd
cd repo && pwd && git status --short | head -5
echo "=== recreate-sandbox ==="
grep -rn "recreate-sandbox" --include="*.ts" --include="*.go" --include="*.py" . 2>/dev/null | head -20
echo "END1"
echo "=== credentials reset/list ==="
grep -rn "credentials reset\|credentials list" --include="*.ts" --include="*.go" --include="*.py" . 2>/dev/null | head -20
echo "END2"
echo "=== channels add ==="
grep -rn "channels add" --include="*.ts" --include="*.go" --include="*.py" . 2>/dev/null | head -20
echo "END3"
echo "=== docs related files ==="
find docs -iname "*runtime-controls*" -o -iname "*switch-inference-providers*" -o -iname "*best-practices*" -o -iname "*credential-storage*" 2>/dev/null
echo "END4"Length of output: 9222 🏁 Script executed: #!/bin/bash
set -uo pipefail
cd repo
echo "=== NEMOCLAW_NON_INTERACTIVE usage ==="
grep -rn "NEMOCLAW_NON_INTERACTIVE" --include="*.ts" . 2>/dev/null | head -20
echo "END1"
echo "=== yes-i-accept-third-party-software ==="
grep -rn "yes-i-accept-third-party-software" --include="*.ts" . 2>/dev/null | head -10
echo "END2"
echo "=== AgentOnly usage in docs ==="
grep -rln "AgentOnly variant=" docs 2>/dev/null | head -10
echo "END3"
echo "=== rebuild --yes usage ==="
grep -rn "rebuild --yes\|rebuild \"" --include="*.ts" . 2>/dev/null | head -10
grep -rln "rebuild --yes" docs 2>/dev/null | head -10
echo "END4"
echo "=== onboard --resume flag ==="
grep -rn "\-\-resume" --include="*.ts" src 2>/dev/null | head -10
echo "END5"Length of output: 7133 All flags, commands, and env vars used in the guide check out against the actual codebase (
I don't see any remaining issues in this revision. Nice work tightening this up with ✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/security/credential-rotation.mdx`:
- Around line 183-205: The verification step descriptions in this section repeat
the same opener, causing the lint warning and making the copy feel repetitive.
Reword one or two of the sentences near the OpenClaw, Hermes, messaging, and web
search checks so they do not all start with “For”, while keeping the meaning
intact and preserving the existing AgentOnly structure and examples.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1b457671-2fab-48f1-8b48-9fc5ad1cfb46
📒 Files selected for processing (3)
docs/index.ymldocs/security/credential-rotation.mdxtest/credential-rotation-docs.test.ts
💤 Files with no reviewable changes (1)
- test/credential-rotation-docs.test.ts
✅ Files skipped from review due to trivial changes (1)
- docs/index.yml
|
Exact head @cv please re-review the exact head and clear the now-outdated change request if the corrected provider names, rebuild boundaries, acceptance flags, and live verification guidance satisfy your request. |
Addressed at exact head a6d628e: provider names now follow credentials list output; messaging rotation uses channels add plus rebuild; every non-interactive onboard example includes the third-party acceptance flag; live verification is distinguished from reachability checks; and focused contract tests cover these boundaries. Dismissing this stale change request. Final approval remains pending the formal merge gate because the exact-head advisor jobs were skipped and check-gates is not allPass.
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Exact-head re-review found one remaining executable-flow blocker in a6d628e66.
All normal credential-rotation onboarding examples use onboard --resume (docs/security/credential-rotation.mdx:45,52,103,118,166). That flag only continues an interrupted resumable onboarding run. A normally completed onboarding session is recorded with resumable=false, and src/lib/onboard/session-bootstrap.ts:56-61,143-147 exits with:
No resumable onboarding session was found.
--resume only continues an interrupted onboarding run.
The executable regression at test/cli/onboard-compatibility.test.ts:222-231 pins that rejection. Therefore the documented inference, web-search, and CI/CD rotation commands stop before rotating credentials in the normal completed-sandbox case.
Please remove --resume from the normal rotation examples and related prose while retaining --name <sandbox>; the web-search examples should also retain --recreate-sandbox. Extend the documentation contract coverage to reject --resume in these completed-sandbox recipes, or add a behavioral test that exercises the option/session-resolution path rather than only checking command strings.
The previously requested provider-name, messaging rebuild, third-party acceptance, and live-verification fixes are addressed. The remaining CodeRabbit repeated-opener comment is stylistic and non-blocking.
a6d628e to
305ae33
Compare
Step-by-step guide for rotating inference API keys, messaging tokens, and other provider credentials without a full sandbox rebuild. Covers emergency rotation, CI/CD workflows, and verification steps. Adds the page to the docs/index.yml navigation for both openclaw and hermes agent variants. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
305ae33 to
88b5448
Compare
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Exact-head re-review at 88b5448e8: the force-push removed the corrective a6d628e66 content and test/credential-rotation-docs.test.ts, so the original copy-paste safety blockers have returned.
- The guide again invents
alpha-nvidia-inference,alpha-slack, andalpha-brave-search; messaging bridge names are not resettable provider credentials. - Normal and CI onboarding examples omit
--name <sandbox>and the mandatory--yes-i-accept-third-party-softwareflag, so non-interactive commands can stop before rotation. - Messaging rotation again routes through
onboardand claims no rebuild. It must usechannels addfollowed byrebuild --yes. - Web-search rotation omits provider selection and
--recreate-sandbox, even though its configuration is applied at sandbox creation. statusandinference getdo not authenticate a real model request, so they cannot prove the replacement credential works.- The focused documentation contract test that guarded provider names, acceptance flags, and rebuild/recreate boundaries was removed.
Please restore the corrective guide and test from a6d628e66 on top of current main, with one necessary adjustment from the later review: normal completed-sandbox rotation recipes must not use onboard --resume. Keep --name <sandbox>; keep --recreate-sandbox for web-search rotation; and add a contract or behavioral assertion preventing --resume from returning to these recipes.
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Co-authored-by: sauravdev <saurava@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Exact-head follow-up at e5c0bcf2fb: all prior provider-name, messaging rebuild, acceptance-flag, no---resume, web-search recreation, and live-verification requests are addressed. The focused docs contracts pass 25/25, and normal CI is green.
One remaining executable-flow correction surfaced in the trusted exact-head advisor run: add --fresh to both Brave and Tavily web-search rotation commands, and pin it in test/credential-rotation-docs.test.ts.
resolveOnboardEntryOptions now auto-detects resume whenever the persisted onboarding session is in_progress, even when the operator did not pass --resume (src/lib/onboard/entry-options.ts:55-69). Therefore onboard --name <sandbox> --recreate-sandbox can resume stale interrupted-session selections instead of deterministically starting the intended emergency credential replacement. The canonical completed-sandbox replacement guidance already uses --fresh --name <sandbox> --recreate-sandbox (docs/reference/commands.mdx:207-214).
Please add --fresh to both web-search examples and extend the existing loop assertion to require it alongside --recreate-sandbox. The trusted GPT advisor run 29002979279 independently recommends merge_after_fixes for this same item. Everything else from the prior reviews is cleared.
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Exact-head follow-up at The remaining red state is not a credential-rotation defect. CI run 29003446208 attempts 2 and 3 both timed out at the default 5 seconds in unchanged The exact trusted manual GPT advisor run 29003515949 checked out this PR at I am leaving the PR unapproved because required CI is red and exact automatic advisor provenance is absent, not because another contributor change is needed in the credential-rotation guide. |
|
The unrelated ordinary-CI blocker is now cleared at exact head No additional #6266 source change is requested. The remaining gate is trusted automatic advisor provenance; the current manual exact-head GPT review is |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Exact-head maintainer follow-up at Local verification:
The exact-head trusted E2E review 29032114836 returned high-confidence no required or optional live E2E targets because this remains documentation plus documentation-contract coverage. Fresh ordinary CI is running. The trusted PR review is being serialized behind another maintainer's manual advisor run; I am leaving the existing review state in place until that exact-head gate completes. |
|
Exact head Trusted manual review run 29032211364 checked out this exact head. Both GPT-5.5 and Nemotron returned high-confidence I am leaving the existing review state in place because the fork guard skips the normal pull-request advisor job, while manual trusted runs do not post the exact-head sticky provenance comment required by the documented merge gate. No additional contributor source change is requested. |
Superseded at exact head 1473591: both Brave and Tavily rotation examples now use --fresh with --recreate-sandbox, the focused contract pins both flags, CI is green, and an independent exact-head approval is present.
<!-- markdownlint-disable MD041 --> ## Summary Adds a dedicated Credential Rotation guide for inference keys, messaging tokens, and web search credentials. The maintainer follow-up validates each copy-paste flow against the current CLI and documents when reuse, rebuild, or recreation is required. The original guide and implementation are by @sauravdev. The corrective maintainer commit preserves that work with `Co-authored-by: sauravdev <saurava@nvidia.com>`. ## Changes - Adds `docs/security/credential-rotation.mdx` and exposes it in both agent variants. - Uses the authoritative `credentials list` output instead of invented provider names. - Routes messaging token rotation through `channels add` followed by `rebuild`. - Recreates the sandbox for web search rotation and distinguishes Brave support from Hermes Tavily support. - Includes the mandatory third-party software acceptance flag in every non-interactive onboarding example. - Separates route and reachability checks from a real authenticated request. - Adds a focused documentation contract test for command flags, provider names, and rebuild boundaries. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — credential rotation and reset behavior remain covered by their focused integration tests. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — validated examples against current credentials, onboarding, messaging, and runtime-control implementations. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — passed with 0 errors and 2 existing repository warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) ### Validation performed - `npm run docs:sync-agent-variants` - `npm run docs` (0 errors; 2 existing warnings) - `npx vitest run --project integration test/credential-rotation-docs.test.ts test/credential-rotation.test.ts test/credentials-reset-outcome.test.ts` (23 passed) - `npm run test-size:check` - `npm run test:titles:check` - Commit and push hooks --- Signed-off-by: sauravdev <saurava@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new credential rotation guide with step-by-step instructions for updating access keys, messaging tokens, and web search settings. * Expanded the security navigation to include the new guide for both product variants. * **Tests** * Added coverage to verify the guide includes the expected command examples, rebuild steps, and valid real-world usage patterns. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: J. Yaunches <jyaunches@nvidia.com>
8 participants
Summary
Adds a dedicated Credential Rotation guide for inference keys, messaging tokens, and web search credentials.
The maintainer follow-up validates each copy-paste flow against the current CLI and documents when reuse, rebuild, or recreation is required.
The original guide and implementation are by @sauravdev.
The corrective maintainer commit preserves that work with
Co-authored-by: sauravdev <saurava@nvidia.com>.Changes
docs/security/credential-rotation.mdxand exposes it in both agent variants.credentials listoutput instead of invented provider names.channels addfollowed byrebuild.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only) — passed with 0 errors and 2 existing repository warnings.Validation performed
npm run docs:sync-agent-variantsnpm run docs(0 errors; 2 existing warnings)npx vitest run --project integration test/credential-rotation-docs.test.ts test/credential-rotation.test.ts test/credentials-reset-outcome.test.ts(23 passed)npm run test-size:checknpm run test:titles:checkSigned-off-by: sauravdev saurava@nvidia.com
Summary by CodeRabbit
Documentation
Tests