Skip to content

refactor(validation): share network policy schema - #6877

Merged
cv merged 8 commits into
NVIDIA:mainfrom
HOYALIM:codex/issue-2387-endpoint-schema
Jul 25, 2026
Merged

refactor(validation): share network policy schema#6877
cv merged 8 commits into
NVIDIA:mainfrom
HOYALIM:codex/issue-2387-endpoint-schema

Conversation

@HOYALIM

@HOYALIM HOYALIM commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Summary

  • extract the identical network-policy definitions shared by sandbox policies and policy presets into one canonical JSON Schema resource
  • register the shared schema once in the Ajv validation pipeline so both root schemas resolve the same $defs contract
  • route schema tests through the production compiler instead of maintaining a second test-only Ajv setup

This is the shared-schema slice described in #2387. It removes 144 net lines while keeping the two public root schemas and all existing configuration behavior unchanged.

Validation

  • npm run validate:configs (48 configuration files passed)
  • npx vitest run test/validate-config-schemas.test.ts test/validate-configs-dangerous-hosts.test.ts test/policy-semantic-validation-runtime.test.ts (141 passed)
  • npm run build:cli
  • npm run check:diff
  • jq empty schemas/network-policy.schema.json schemas/sandbox-policy.schema.json schemas/policy-preset.schema.json

Refs #2387

Signed-off-by: Ho Lim subhoya@gmail.com

Summary by CodeRabbit

  • New Features

    • Added a standalone network policy schema to validate endpoints, protocols, routing rules, access controls, and related configuration options.
    • Added schema references to reuse network policy validation in both policy preset and sandbox policy configurations.
    • Expanded configuration validation coverage for REST, WebSocket, JSON-RPC, and MCP policy structures.
  • Bug Fixes

    • Improved configuration schema compilation/validation consistency by reusing the shared schema compilation helper.
    • Added direct test coverage for validating the standalone network policy schema.

DCO

I certify that all commits in this pull request are signed off in accordance with the Developer Certificate of Origin.

Copilot AI review requested due to automatic review settings July 14, 2026 16:50
@copy-pr-bot

copy-pr-bot Bot commented Jul 14, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d1b4d06c-07d3-42c5-beee-cd2608737f0d

📥 Commits

Reviewing files that changed from the base of the PR and between 7490447 and 78c3741.

📒 Files selected for processing (2)
  • schemas/network-policy.schema.json
  • test/validate-config-schemas.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • test/validate-config-schemas.test.ts
  • schemas/network-policy.schema.json

📝 Walkthrough

Walkthrough

A standalone network policy JSON Schema is added with protocol-specific validation, and existing policy schemas reference it externally. Shared AJV compilation registers the schema by ID, while tests use the shared compiler and validate standalone network policies.

Changes

Network policy schema validation

Layer / File(s) Summary
Network policy definitions
schemas/network-policy.schema.json
Defines policy entries, endpoints, protocol conditionals, REST/WebSocket/JSON-RPC/MCP rules and matchers, shared validators, options, and binary paths.
External schema references
schemas/policy-preset.schema.json, schemas/sandbox-policy.schema.json
Replaces embedded or local network policy definitions with references to the standalone schema.
Shared compilation and tests
scripts/validate-configs.mts, test/validate-config-schemas.test.ts
Registers and reuses the network policy schema by ID, routes tests through the shared compiler, and validates valid and invalid standalone policy objects.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SchemaTest
  participant CompileConfigSchema
  participant NetworkPolicySchema
  participant AJV
  SchemaTest->>CompileConfigSchema: request schema compilation
  CompileConfigSchema->>NetworkPolicySchema: load standalone schema
  CompileConfigSchema->>AJV: register or reuse schema ID
  CompileConfigSchema->>AJV: compile referenced policy schema
  AJV-->>SchemaTest: return validator
  SchemaTest->>AJV: validate network policy fixture
  AJV-->>SchemaTest: return validation result
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: refactoring validation to share a common network policy schema.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: inference-routing, network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@schemas/network-policy.schema.json`:
- Around line 1-3: Add the repository-standard SPDX metadata `$comment` block
near the top of the schema, alongside `$schema` and `$id` in the network-policy
schema object. Reuse the existing project wording and preserve the schema’s
current fields and structure.

In `@scripts/validate-configs.ts`:
- Around line 200-203: Update the schema compilation flow in the validation
logic around ajv.getSchema and loadSchema so the object loaded for
NETWORK_POLICY_SCHEMA is reused when repoRelative targets
schemas/network-policy.schema.json, instead of loading and compiling a second
copy with the same $id. Preserve the existing registration behavior for other
schemas, and add a regression test covering that CLI target.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e1eb5637-d14d-4265-87af-5bf0e1760049

📥 Commits

Reviewing files that changed from the base of the PR and between cf04a13 and 46e7a95.

📒 Files selected for processing (5)
  • schemas/network-policy.schema.json
  • schemas/policy-preset.schema.json
  • schemas/sandbox-policy.schema.json
  • scripts/validate-configs.ts
  • test/validate-config-schemas.test.ts

Comment thread schemas/network-policy.schema.json
Comment thread scripts/validate-configs.ts Outdated
@wscurran wscurran added area: policy Network policy, egress rules, presets, or sandbox policy area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery refactor PR restructures code without intended behavior change labels Jul 14, 2026
@wscurran

Copy link
Copy Markdown
Contributor

✨ Thanks for the refactor, @HOYALIM. Extracting the shared network policy schema into a canonical resource and routing tests through the production compiler cleans up duplication. Ready for maintainer review.


Related open issues:

HOYALIM added 2 commits July 15, 2026 13:17
Signed-off-by: Ho Lim <subhoya@gmail.com>
Signed-off-by: Ho Lim <subhoya@gmail.com>
@HOYALIM
HOYALIM force-pushed the codex/issue-2387-endpoint-schema branch from 8d4a5b9 to 7490447 Compare July 15, 2026 20:19
@apurvvkumaria apurvvkumaria self-assigned this Jul 18, 2026
apurvvkumaria and others added 2 commits July 18, 2026 15:41
Co-authored-by: Ho Lim <subhoya@gmail.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

@apurvvkumaria apurvvkumaria left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed exact head 0debc85. The shared network-policy definitions are byte-for-byte equivalent to both removed copies, AJV registers the canonical schema before resolving either wrapper, and the direct schema target remains fail-closed. Local validation passed: 103 focused schema tests, all 48 checked-in configuration files, CLI build, and JS typecheck. All four commits are GitHub Verified; no unresolved review threads or advisor findings remain. The only red status is the fork credentialed-E2E coordination gate, not a detected code/test failure.

Co-authored-by: Ho Lim <subhoya@gmail.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
@apurvvkumaria

Copy link
Copy Markdown
Collaborator

Maintainer refresh pushed in 306be65.

This is an append-only merge of current main 3c4ea5a into the existing branch. There were no conflicts or overlapping changed files, and the stable PR patch identity is unchanged.

Validation:

  • 48/48 checked-in configurations passed schema validation
  • focused schema and policy suites: 146/146 passed
  • CLI build and typecheck passed
  • scoped pre-commit, commitlint, pre-push, repository, budget, and secret checks passed
  • no documentation change is needed because the extraction is behavior-preserving

The merge commit is signed, DCO-compliant, GitHub Verified, and credits Ho Lim as co-author. Fresh exact-head CI, advisors, and protected E2E coordination are now being monitored.

Co-authored-by: Ho Lim <subhoya@gmail.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Copilot AI review requested due to automatic review settings July 25, 2026 06:08

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

@apurvvkumaria

Copy link
Copy Markdown
Collaborator

Maintainer refresh pushed at exact head 5697d31ea0f0236a9e51db1f4f348e20a1fed4dd. This is a signed merge of current main; Ho Lim's original commits and stable patch identity are preserved.\n\nValidated on the refreshed head:\n- 48/48 configuration schemas\n- 146/146 focused schema/policy tests\n- CLI build and CLI typecheck\n- required pre-push plugin/JS/CLI typechecks\n\nDocumentation review found no user-facing docs change needed. Fresh exact-head CI is now running.

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Copilot AI review requested due to automatic review settings July 25, 2026 14:26

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

@cv
cv merged commit 2ac4a0d into NVIDIA:main Jul 25, 2026
37 of 39 checks passed
cv pushed a commit that referenced this pull request Jul 25, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Restore runtime sandbox-policy validation after #6877 extracted network
policy definitions into an external schema. The runtime validator now
registers that shared schema before compiling the sandbox schema, and
the published package ships both files.

## Changes

- Load and register `network-policy.schema.json` before compiling the
sandbox policy schema.
- Include the shared schema in the npm package.
- Extend the out-of-tree package contract to prove the referenced schema
is shipped and runtime validation succeeds.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

<!-- Check one tests line and one docs line. Check other lines when
applicable. Add every requested justification or approval reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: This restores the existing
schema-validation behavior and package contents. It does not change
policy syntax, CLI behavior, configuration, or a user procedure.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Maintainer comparison
confirmed the runtime registers only the trusted schema shipped by
NemoClaw. Policy semantics, rejected input handling, and bounded error
disclosure remain unchanged. Independent PR approval remains required
before merge.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

<!-- Required for code and documentation changes after the changes and
applicable validation are complete. Keep one review checkbox and one
instance of each visible or hidden field. For Evidence, list changed
documentation paths. For documentation-only changes, also state that the
writing rules and documentation style were reviewed. For other results,
explain why no documentation change is needed or why the review is
blocked. For Agent, use a consistent product and surface name, such as
Codex Desktop, Codex CLI, Claude Code, or Cursor. After committing all
review changes, put `git rev-parse --short HEAD` and `git rev-parse
--short HEAD:AGENTS.md` in the hidden metadata below. Rerun the review
and refresh that metadata after any new commit. This receipt is advisory
during the data-collection pilot. -->
- [x] Documentation writer subagent reviewed the completed changes
- Result: `no-docs-needed`
- Evidence: The writer reviewed the live body and exact three-file diff
against `WRITING.md` and `docs/CONTRIBUTING.md`. The fix restores
existing policy validation and package contents without changing the
schema, configuration, supported behavior, or user workflow.
- Agent: Codex Desktop
<!-- docs-review-head-sha: d133ec1 -->
<!-- docs-review-agents-blob-sha: 9c9b36d -->

## DGX Station Hardware Evidence

<!-- Required only when scripts/prepare-dgx-station-host.sh changes.
Maintainers must review the linked evidence before approving or merging.
This is human-reviewed evidence, not authenticated hardware provenance.
Exceptional bypasses use existing repository governance and must be
documented on the PR. -->
- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: The
installed package validator contract passes 1/1, and the focused policy
suites pass 56/56.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Not applicable to this
focused three-file integration repair.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Follow-up to #6877. Supersedes duplicate #7533 and preserves Ho Lim's
original-author credit.

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Ho Lim <subhoya@gmail.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved sandbox policy validation by incorporating network policy
schema checks.
* Added clearer handling when required policy schemas are unavailable or
validation cannot be initialized.

* **Chores**
  * Ensured the network policy schema is included in published packages.
* Expanded package verification to confirm the schema is available after
installation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Ho Lim <subhoya@gmail.com>
@cv cv mentioned this pull request Jul 26, 2026
23 tasks
apurvvkumaria pushed a commit that referenced this pull request Jul 27, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Add the canonical `docs/changelog/2026-07-25.mdx` release entry with the
exact `## v0.0.96` heading.
The entry reconciles all 90 first-parent commits since v0.0.95 with all
92 merged PRs in the live `v0.0.96` label ledger and groups the
user-visible changes by operator journey.

## Changes

- Add the parser-safe dated MDX changelog entry for v0.0.96 with
root-absolute links to the focused user guides.
- Source summary:
- [#7194](#7194) ->
`docs/changelog/2026-07-25.mdx`: Document persistent baseline network
policy exclusions and their inspection, rebuild, and snapshot behavior.
- [#7188](#7188),
[#7427](#7427), and
[#7546](#7546) ->
`docs/changelog/2026-07-25.mdx`: Document DNS-backed HTTPS inference
routing, keyless loopback endpoints, and provider-marker isolation.
- [#7238](#7238) ->
`docs/changelog/2026-07-25.mdx`: Document blueprint sandbox and provider
identifier validation before state writes or OpenShell calls, with
bounded terminal-safe rejection previews.
- [#7319](#7319),
[#7274](#7274),
[#7528](#7528),
[#7353](#7353), and
[#7560](#7560) ->
`docs/changelog/2026-07-25.mdx`: Document the managed default gateway
service, onboarding readiness, and container-runtime identity
safeguards.
- [#7349](#7349),
[#7498](#7498),
[#7406](#7406),
[#7196](#7196),
[#7559](#7559),
[#7421](#7421),
[#7510](#7510),
[#7295](#7295), and
[#7565](#7565) ->
`docs/changelog/2026-07-25.mdx`: Document gateway-scoped status,
lifecycle diagnostics, managed MCP recovery, delete-edge safeguards, and
fail-closed CLI prompt and command output.
- [#7591](#7591) ->
`docs/changelog/2026-07-25.mdx`: Document opt-in authenticated MCP
tool-name discovery, its bounded and names-only contract, probe
interaction, and rebuild requirement.
- [#7305](#7305),
[#7480](#7480),
[#7471](#7471),
[#7365](#7365), and
[#7541](#7541) ->
`docs/changelog/2026-07-25.mdx`: Document installer version checks,
version-tag reporting, license guidance, WSL Ollama selection, and DGX
Station vLLM detection.
- [#7482](#7482),
[#7466](#7466),
[#7208](#7208),
[#7434](#7434), and
[#7586](#7586) ->
`docs/changelog/2026-07-25.mdx`: Document Ollama resource details,
reasoning precedence, Hermes onboarding behavior, and preserved managed
Hermes BuildKit failures.

- [#6830](#6830),
[#7492](#7492),
[#7563](#7563), and
[#7582](#7582) ->
`docs/changelog/2026-07-25.mdx`: Document the authoritative OpenClaw
production lock, fixed managed-image dependencies, immutable Hermes base
adoption, and Hermes image-size reduction.
- [#7505](#7505),
[#7530](#7530),
[#7547](#7547),
[#7508](#7508),
[#7548](#7548),
[#7549](#7549),
[#7537](#7537),
[#7534](#7534),
[#7515](#7515),
[#7511](#7511),
[#7551](#7551),
[#7562](#7562),
[#7575](#7575),
[#7496](#7496),
[#7594](#7594),
[#7595](#7595), and
[#7599](#7599) ->
`docs/changelog/2026-07-25.mdx`: Summarize release validation, transient
and bounded dispatch reconciliation, exact pre-tag qualification,
identity revalidation, npm-audit retry, sharding, image reuse, timeout,
telemetry, and workflow-hardening changes.
- Reconciled without separate changelog prose:
- [#7539](#7539),
[#7526](#7526),
[#7507](#7507),
[#7506](#7506),
[#7519](#7519),
[#7516](#7516),
[#7396](#7396),
[#7254](#7254),
[#7583](#7583),
[#7596](#7596), and
[#7598](#7598): Test-harness or
fixture-only changes.
- [#7403](#7403),
[#7161](#7161),
[#6877](#6877),
[#7531](#7531),
[#7525](#7525),
[#7522](#7522),
[#7536](#7536),
[#7552](#7552),
[#7566](#7566),
[#7553](#7553),
[#7561](#7561),
[#7577](#7577),
[#7569](#7569),
[#7585](#7585),
[#7584](#7584),
[#7592](#7592),
[#7580](#7580),
[#7571](#7571),
[#7517](#7517),
[#7589](#7589),
[#7402](#7402),
[#7558](#7558),
[#7544](#7544), and
[#7601](#7601): Dependency,
internal recovery, validation, contributor-workflow, E2E optimization,
telemetry, or CI trust changes with no separate user-facing release
claim.
- [#7556](#7556),
[#7573](#7573),
[#7576](#7576), and
[#7578](#7578): Experimental
repository-maintainer conflict automation with no canonical user
documentation surface.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [ ] Tests added or updated for changed behavior
- [x] Existing tests cover changed behavior — justification:
`test/changelog-docs.test.ts` validates dated changelog structure,
version headings, and published links.
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `docs-updated`
- Evidence: Reviewed `docs/changelog/2026-07-25.mdx` at exact head
`0f5dedb47` against 90 first-parent release commits and 92 merged PRs
labeled `v0.0.96`. Verified parser-safe MDX SPDX, the exact version
heading, literal CLI names, writing style, skip terms, all 20
root-absolute published links, and the accepted #7591 opt-in
authenticated discovery bounds. #7544, #7599, and #7601 remain internal
or CI-only release-ledger entries. Changelog tests passed 6/6, the docs
build passed with 0 errors and two pre-existing Fern warnings, and `npm
run check:diff` plus the final diff check passed.
- Agent: Codex Desktop documentation-writer subagent
<!-- docs-review-head-sha: 0f5dedb -->
<!-- docs-review-agents-blob-sha: be20a09 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/changelog-docs.test.ts`: 6/6 passed.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Not applicable to this
prose-only changelog entry.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — the
build passed with 0 errors and 2 existing Fern warnings; the
published-route check passed.
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)
— native changelog files use the required parser-safe MDX SPDX comment
and no frontmatter.

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Persistent network policy exclusions with consistent restore/exclusion
reporting across rebuilds/snapshots.
* Opt-in MCP tool discovery via `mcp status --tools` with bounded,
redacted authenticated traffic.
* Improved HTTPS inference switching for custom endpoints and refreshed
onboarding/model menu details.
* Refined OpenShell gateway defaults for port `8080`, including more
reliable readiness checks.
* **Bug Fixes**
* Prevent incorrect provider/model restoration after compatible-provider
update failures.
* Preserve managed MCP state after exec loss and tighten gateway/doctor
status scoping.
* **Tests**
* Stronger, fail-closed release validation with hardened
evidence/artifact handoff and bounded timeouts/retries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: policy Network policy, egress rules, presets, or sandbox policy area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery refactor PR restructures code without intended behavior change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants