Skip to content

fix(rebuild): restore gateway state during prepared recovery - #6370

Merged
jyaunches merged 1 commit into
NVIDIA:mainfrom
prekshivyas:fix/e2e-gateway-upgrade-route-preflight
Jul 7, 2026
Merged

fix(rebuild): restore gateway state during prepared recovery#6370
jyaunches merged 1 commit into
NVIDIA:mainfrom
prekshivyas:fix/e2e-gateway-upgrade-route-preflight

Conversation

@prekshivyas

@prekshivyas prekshivyas commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • defer inference-route matching only for validated prepared-backup recovery
  • allow a missing replacement-gateway provider only when prepared recovery has an explicit host credential
  • let authoritative onboarding recreate and verify the provider and route before sandbox recreation
  • preserve strict missing-provider and route checks for ordinary rebuilds

Root cause

The gateway-upgrade installer replaces the legacy gateway before prepared sandbox recovery. The fresh gateway initially has neither the persisted inference route nor its remote provider registration, but rebuild preflight required both before authoritative onboarding could restore them.

Validation

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

  • New Features

    • Rebuild and onboarding flows now support prepared backup recovery by deferring inference route validation until onboarding completes.
  • Bug Fixes

    • Reduced rebuild preflight failures when prepared recovery data indicates backup recovery is already available.
    • Preserved existing inference route validation behavior when deferral is not enabled.
    • Allow rebuild credential preflight to proceed when a gateway provider is missing but host credentials are present.
  • Tests

    • Added/updated coverage for deferred inference-route validation and for the expected rebuild/preflight call sequence, including prepared recovery and missing-gateway scenarios.

@copy-pr-bot

copy-pr-bot Bot commented Jul 7, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

This PR threads prepared-recovery flags through rebuild preflight paths, defers authoritative inference-route validation when requested, allows gateway-provider recreation from host credentials, and updates tests plus harness support for the new flows.

Changes

Defer inference route validation

Layer / File(s) Summary
Core preflight flag and conditional route check
src/lib/onboard/authoritative-rebuild-target.ts, src/lib/onboard/authoritative-rebuild-target.test.ts
Adds deferInferenceRouteUntilOnboard?: true to authoritative rebuild option and target types; the inference-route readiness check is skipped when the flag is set, with a new test verifying inferenceRouteReady is not invoked.
Runtime and dependency option forwarding
src/lib/actions/sandbox/rebuild-target-runtime.ts, src/lib/actions/sandbox/rebuild-onboard-dependencies.ts
preflightAuthoritativeOnboardRuntime gains an optional options parameter forwarded to rebuildOnboardDependencies.preflightAuthoritativeRebuildTarget; matching optional property added to RebuildAuthoritativePreflightOptions.
Preflight phase propagation
src/lib/actions/sandbox/rebuild-preflight-phase.ts, src/lib/actions/sandbox/rebuild-preflight-target-phase.ts
runRebuildPreflightPhase passes preparedBackupRecovery (derived from recovery manifest presence) to prepareRebuildTargetPreflights, which conditionally forwards deferInferenceRouteUntilOnboard: true and enables missing-provider allowance during target preflight.
Gateway provider allowance
src/lib/actions/sandbox/rebuild-credential-preflight.ts, src/lib/actions/sandbox/rebuild-provider-preflight.ts
Credential preflight and gateway-provider checks accept an allowance flag so a missing provider can be tolerated when explicit host credentials are present.
Test harness and prepared-recovery assertions
test/helpers/rebuild-flow-harness.ts, src/lib/actions/sandbox/rebuild-prepared-recovery.test.ts, test/helpers/rebuild-flow-credential-preflight-cases.ts
Harness exposes preflightAuthoritativeRebuildTargetSpy; prepared-recovery tests assert deferred route validation, and a credential preflight case covers provider recreation from host credentials.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested labels: bug-fix, area: sandbox

Suggested reviewers: jyaunches, ericksoa

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the main change: restoring gateway behavior during prepared recovery.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@prekshivyas
prekshivyas force-pushed the fix/e2e-gateway-upgrade-route-preflight branch from 4a60f45 to f8b38cd Compare July 7, 2026 00:40

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
src/lib/actions/sandbox/rebuild-prepared-recovery.test.ts (1)

40-42: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer an observable outcome over a mock-call assertion.

This assertion only checks the arguments passed to a mocked dependency (preflightAuthoritativeRebuildTargetSpy), not an observable effect of the rebuild flow. The underlying skip behavior is already unit-tested in authoritative-rebuild-target.test.ts; this integration test would give more confidence if it verified that the prepared-recovery rebuild actually completes/succeeds despite a route mismatch (e.g., via the harness's public rebuildSandbox boundary), rather than asserting the shape of a call into a mock.

As per path instructions, tests should "Prefer observable outcomes through the public boundary over source-text, private-shape, or mock-call assertions."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/sandbox/rebuild-prepared-recovery.test.ts` around lines 40 -
42, The test in rebuild-prepared-recovery should verify an observable rebuild
outcome through the public harness boundary instead of asserting the mocked
preflightAuthoritativeRebuildTargetSpy call shape. Update the prepared-recovery
scenario to exercise rebuildSandbox and assert that the rebuild
completes/succeeds despite the route mismatch, keeping the existing skip
behavior covered by authoritative-rebuild-target.test.ts and removing the
mock-call assertion.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/actions/sandbox/rebuild-prepared-recovery.test.ts`:
- Around line 40-42: The test in rebuild-prepared-recovery should verify an
observable rebuild outcome through the public harness boundary instead of
asserting the mocked preflightAuthoritativeRebuildTargetSpy call shape. Update
the prepared-recovery scenario to exercise rebuildSandbox and assert that the
rebuild completes/succeeds despite the route mismatch, keeping the existing skip
behavior covered by authoritative-rebuild-target.test.ts and removing the
mock-call assertion.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fecbd2f7-23c1-40d6-9c8f-0b541811143c

📥 Commits

Reviewing files that changed from the base of the PR and between b435598 and 4a60f45.

📒 Files selected for processing (8)
  • src/lib/actions/sandbox/rebuild-onboard-dependencies.ts
  • src/lib/actions/sandbox/rebuild-preflight-phase.ts
  • src/lib/actions/sandbox/rebuild-preflight-target-phase.ts
  • src/lib/actions/sandbox/rebuild-prepared-recovery.test.ts
  • src/lib/actions/sandbox/rebuild-target-runtime.ts
  • src/lib/onboard/authoritative-rebuild-target.test.ts
  • src/lib/onboard/authoritative-rebuild-target.ts
  • test/helpers/rebuild-flow-harness.ts

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28833136392
Workflow ref: fix/e2e-gateway-upgrade-route-preflight
Requested targets: openshell-gateway-upgrade
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ❌ failure

Failed jobs: openshell-gateway-upgrade. Check run artifacts for logs.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@prekshivyas
prekshivyas force-pushed the fix/e2e-gateway-upgrade-route-preflight branch from f8b38cd to 1243429 Compare July 7, 2026 00:56
@prekshivyas prekshivyas changed the title fix(rebuild): defer route check during prepared recovery fix(rebuild): restore gateway state during prepared recovery Jul 7, 2026
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All selected jobs passed

Run: 28833813117
Workflow ref: fix/e2e-gateway-upgrade-recovery-v2
Requested targets: openshell-gateway-upgrade
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ✅ success

@jyaunches
jyaunches merged commit 9107740 into NVIDIA:main Jul 7, 2026
115 checks passed
cv pushed a commit that referenced this pull request Jul 7, 2026
## Summary
Add the v0.0.75 release-notes entry for the release train, summarizing
the user-facing fixes merged since v0.0.74. Release-prep docs for the
`nemoclaw-maintainer-cut-release-tag` gate.

## Related Issue
Release prep for v0.0.75. Remove this section if none.

## Changes
- `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed
intro + grouped bullets with source-page links), matching the existing
v0.0.74 style.

### Source summary (doc-impacting PRs → doc page)
- #6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery
restores gateway state and defers the live route check to onboarding, so
upgrade recovery no longer fails on an unset gateway route.
- #6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover
gateway-orphaned sandboxes.
- #6332 -> `docs/about/release-notes.mdx`: same-name `--fresh`
re-onboard preserves fresh LangChain Deep Agents Code routing.
- #6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible
inference uses the OpenAI frontend.
- #6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the
`/v1` base URL on Anthropic-compatible endpoints.
- #6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway
credentials no longer expire.
- #6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed
MCP state reconcile after a runtime change.
- #6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a
pinned base platform digest.
- #6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing
restores its previous connection path.

Test-performance, CI, and chore commits since v0.0.74 are excluded as
non-user-facing.

## Type of Change
- [x] Doc only (prose changes, no code sample modifications)

## Quality Gates
- [x] Tests not applicable — justification: documentation-only change
(release notes prose).
- [x] Docs updated for user-facing behavior changes

## Verification
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] `npm run docs` builds without warnings introduced by this change —
command/result: "Found 0 errors and 2 warnings" (the 2 warnings
pre-exist this change).
- [x] Doc pages follow the style guide (active voice, no numbered/colon
titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms
avoided).
- [x] No secrets, API keys, or credentials committed

---
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added a new **v0.0.75** section to the release notes, highlighting
improved sandbox upgrade hardening and prepared-backup recovery, updated
inference routing for Anthropic-compatible endpoints, longer-lasting
local gateway credential handling, and restored CLI pairing reconnection
without re-pairing. Also includes cross-links to related NemoClaw CLI
and documentation pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ericksoa added a commit that referenced this pull request Jul 7, 2026
<!-- markdownlint-disable MD041 -->
## Summary
<!-- 1-3 sentences: what this PR does and why. -->
Correct the v0.0.75 release-note entry merged in #6371 before the
release tag is cut.
This follow-up restores the omitted OpenClaw `2026.6.10` upgrade and
narrows three claims to the runtime contracts that actually shipped.

## Changes
<!-- Bullet list of key changes. -->
- #5595 -> `docs/about/release-notes.mdx`: add the bundled OpenClaw
`2026.6.10` upgrade and its reviewed package, pairing, and recovery
boundaries.
- #6370 -> `docs/about/release-notes.mdx`: state that authoritative
onboarding restores the gateway provider and inference route during
rebuild, before sandbox recreation.
- #6335 and #6298 -> `docs/about/release-notes.mdx`: scope the OpenAI
frontend to Hermes while retaining the separate OpenAI-only-agent
behavior.
- #6304 -> `docs/about/release-notes.mdx`: name the non-expiring local
Docker-driver sandbox JWT contract precisely and link its gateway-auth
review.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [ ] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [x] Tests not applicable — justification: prose-only release-note
corrections with no runtime behavior or code samples.
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: tests
are not applicable; `npm run docs` passed with 0 errors and 2
pre-existing warnings.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) —
result: 0 errors and 2 pre-existing warnings (missing authenticated
redirects check and existing light-theme accent contrast).
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated the `v0.0.75` release notes with clearer wording and expanded
details.
* Added more specific notes about the runtime upgrade, sandbox recovery
behavior, and routing safeguards.
* Refined the description of inference routing behavior and local
Docker-driver sandbox authentication handling.
* Adjusted the linked references and final release-note wording for
consistency.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
…6370)

## Summary

- defer inference-route matching only for validated prepared-backup
recovery
- allow a missing replacement-gateway provider only when prepared
recovery has an explicit host credential
- let authoritative onboarding recreate and verify the provider and
route before sandbox recreation
- preserve strict missing-provider and route checks for ordinary
rebuilds

## Root cause

The gateway-upgrade installer replaces the legacy gateway before
prepared sandbox recovery. The fresh gateway initially has neither the
persisted inference route nor its remote provider registration, but
rebuild preflight required both before authoritative onboarding could
restore them.

## Validation

- 104 focused rebuild, prepared-recovery, provider, and route tests
passed
- installer gateway-upgrade tests passed
- gateway-upgrade workflow boundary tests passed
- CLI build, typecheck, Biome lint, and formatting passed
- replacement live E2E dispatched:
https://github.com/NVIDIA/NemoClaw/actions/runs/28833813117

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Rebuild and onboarding flows now support prepared backup recovery by
deferring inference route validation until onboarding completes.

* **Bug Fixes**
* Reduced rebuild preflight failures when prepared recovery data
indicates backup recovery is already available.
* Preserved existing inference route validation behavior when deferral
is not enabled.
* Allow rebuild credential preflight to proceed when a gateway provider
is missing but host credentials are present.

* **Tests**
* Added/updated coverage for deferred inference-route validation and for
the expected rebuild/preflight call sequence, including prepared
recovery and missing-gateway scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary
Add the v0.0.75 release-notes entry for the release train, summarizing
the user-facing fixes merged since v0.0.74. Release-prep docs for the
`nemoclaw-maintainer-cut-release-tag` gate.

## Related Issue
Release prep for v0.0.75. Remove this section if none.

## Changes
- `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed
intro + grouped bullets with source-page links), matching the existing
v0.0.74 style.

### Source summary (doc-impacting PRs → doc page)
- NVIDIA#6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery
restores gateway state and defers the live route check to onboarding, so
upgrade recovery no longer fails on an unset gateway route.
- NVIDIA#6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover
gateway-orphaned sandboxes.
- NVIDIA#6332 -> `docs/about/release-notes.mdx`: same-name `--fresh`
re-onboard preserves fresh LangChain Deep Agents Code routing.
- NVIDIA#6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible
inference uses the OpenAI frontend.
- NVIDIA#6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the
`/v1` base URL on Anthropic-compatible endpoints.
- NVIDIA#6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway
credentials no longer expire.
- NVIDIA#6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed
MCP state reconcile after a runtime change.
- NVIDIA#6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a
pinned base platform digest.
- NVIDIA#6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing
restores its previous connection path.

Test-performance, CI, and chore commits since v0.0.74 are excluded as
non-user-facing.

## Type of Change
- [x] Doc only (prose changes, no code sample modifications)

## Quality Gates
- [x] Tests not applicable — justification: documentation-only change
(release notes prose).
- [x] Docs updated for user-facing behavior changes

## Verification
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] `npm run docs` builds without warnings introduced by this change —
command/result: "Found 0 errors and 2 warnings" (the 2 warnings
pre-exist this change).
- [x] Doc pages follow the style guide (active voice, no numbered/colon
titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms
avoided).
- [x] No secrets, API keys, or credentials committed

---
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added a new **v0.0.75** section to the release notes, highlighting
improved sandbox upgrade hardening and prepared-backup recovery, updated
inference routing for Anthropic-compatible endpoints, longer-lasting
local gateway credential handling, and restored CLI pairing reconnection
without re-pairing. Also includes cross-links to related NemoClaw CLI
and documentation pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary
<!-- 1-3 sentences: what this PR does and why. -->
Correct the v0.0.75 release-note entry merged in NVIDIA#6371 before the
release tag is cut.
This follow-up restores the omitted OpenClaw `2026.6.10` upgrade and
narrows three claims to the runtime contracts that actually shipped.

## Changes
<!-- Bullet list of key changes. -->
- NVIDIA#5595 -> `docs/about/release-notes.mdx`: add the bundled OpenClaw
`2026.6.10` upgrade and its reviewed package, pairing, and recovery
boundaries.
- NVIDIA#6370 -> `docs/about/release-notes.mdx`: state that authoritative
onboarding restores the gateway provider and inference route during
rebuild, before sandbox recreation.
- NVIDIA#6335 and NVIDIA#6298 -> `docs/about/release-notes.mdx`: scope the OpenAI
frontend to Hermes while retaining the separate OpenAI-only-agent
behavior.
- NVIDIA#6304 -> `docs/about/release-notes.mdx`: name the non-expiring local
Docker-driver sandbox JWT contract precisely and link its gateway-auth
review.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [ ] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [x] Tests not applicable — justification: prose-only release-note
corrections with no runtime behavior or code samples.
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: tests
are not applicable; `npm run docs` passed with 0 errors and 2
pre-existing warnings.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) —
result: 0 errors and 2 pre-existing warnings (missing authenticated
redirects check and existing light-theme accent contrast).
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated the `v0.0.75` release notes with clearer wording and expanded
details.
* Added more specific notes about the runtime upgrade, sandbox recovery
behavior, and routing safeguards.
* Refined the description of inference routing behavior and local
Docker-driver sandbox authentication handling.
* Adjusted the linked references and final release-note wording for
consistency.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
@wscurran wscurran added area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression labels Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants