feat(policy): support persistent baseline network policy exclusions

ci/platform-matrix.json

@@ -193,7 +193,7 @@
     {
       "name": "Declarative network policy",
       "status": "tested",
-      "notes": "YAML-defined egress with policy presets. Presets include `slack`, `discord`, `telegram`, `weather`, `openclaw-pricing`, `huggingface`, `npm`, `pypi`, `brew`, and others. Hot-reloadable at runtime with `$$nemoclaw <name> policy-add`."
+      "notes": "YAML-defined egress with policy presets. Presets include `slack`, `discord`, `telegram`, `weather`, `openclaw-pricing`, `huggingface`, `npm`, `pypi`, `brew`, and others. Hot-reloadable at runtime with `$$nemoclaw <name> policy add`."
     },
     {
       "name": "Snapshot and restore",

docs/get-started/quickstart-langchain-deepagents-code.mdx

@@ -286,9 +286,9 @@ The policy preset is a per-sandbox managed-Python opt-in, but provider registrat
 
 ```bash
 # Preview the endpoints the preset opens:
-nemo-deepagents <sandbox-name> policy-add tavily --dry-run
+nemo-deepagents <sandbox-name> policy add tavily --dry-run
 # Apply it:
-nemo-deepagents <sandbox-name> policy-add tavily --yes
+nemo-deepagents <sandbox-name> policy add tavily --yes
 # Export the key on the host (NemoClaw reads it from the current shell):
 export TAVILY_API_KEY=tvly-...
 # Register the provider with the gateway:
@@ -308,7 +308,7 @@ Because OpenShell attributes the harness's calls to the sandbox `python3` interp
 Remove the target sandbox's managed-Python opt-in when it is no longer needed.
 
 ```bash
-nemo-deepagents <sandbox-name> policy-remove tavily --yes
+nemo-deepagents <sandbox-name> policy remove tavily --yes
 ```
 
 This does not unregister the gateway-wide `tavily-search` provider; its credential and Node/curl routes remain available to sandboxes that attach it.
@@ -404,14 +404,14 @@ On an existing sandbox, skip mode leaves the current live policy unchanged.
 Inspect the effective policy first.
 
 ```bash
-nemo-deepagents "$SANDBOX_NAME" policy-list
+nemo-deepagents "$SANDBOX_NAME" policy list
 ```
 
 If `observability-otlp-local` is not active, preview and apply it.
 
 ```bash
-nemo-deepagents "$SANDBOX_NAME" policy-add observability-otlp-local --dry-run
-nemo-deepagents "$SANDBOX_NAME" policy-add observability-otlp-local --yes
+nemo-deepagents "$SANDBOX_NAME" policy add observability-otlp-local --dry-run
+nemo-deepagents "$SANDBOX_NAME" policy add observability-otlp-local --yes
 ```
 
 The preset permits only `POST /v1/traces` to `host.openshell.internal:4318` from `/opt/venv/bin/python3*`.
@@ -659,7 +659,7 @@ This does not change the recorded observability choice.
 A later rebuild restores the matching preset on Balanced and Open tiers, while Restricted continues to suppress it.
 
 ```bash
-nemo-deepagents "$SANDBOX_NAME" policy-remove observability-otlp-local --yes
+nemo-deepagents "$SANDBOX_NAME" policy remove observability-otlp-local --yes
 ```
 
 To disable instrumentation persistently, use the transactional rebuild negative flag.
@@ -687,7 +687,7 @@ For additional collector diagnostics, refer to [Troubleshooting the OpenTelemetr
 | --- | --- |
 | Collector exits at startup | Run the validation command again, then inspect `docker logs nemoclaw-otel-langsmith`. Confirm that the image is the Contrib `0.155.0` image and that all four `LANGSMITH_*` variables were set when the container was created. |
 | Port `4318` is already allocated | Run `ss -ltnp 'sport = :4318'` and stop the conflicting listener. The managed sandbox endpoint is fixed, so changing the collector port does not work. |
-| Collector is healthy but logs no trace count | Run `policy-list` and add `observability-otlp-local` if it is absent. Confirm that `docker port` shows the current `$OTLP_BIND_IP`. Run `nemo-deepagents <sandbox> rebuild --observability --yes` if the existing sandbox was originally started without the opt-in. |
+| Collector is healthy but logs no trace count | Run `policy list` and add `observability-otlp-local` if it is absent. Confirm that `docker port` shows the current `$OTLP_BIND_IP`. Run `nemo-deepagents <sandbox> rebuild --observability --yes` if the existing sandbox was originally started without the opt-in. |
 | Collector logs `401` | Replace an invalid or expired LangSmith API key, then recreate the collector container. |
 | Collector logs `403` | Confirm the service key can write to the target workspace and that `LANGSMITH_WORKSPACE_ID` matches that workspace. Organization-scoped service keys require `X-Tenant-Id`. |
 | Collector logs `404` | Confirm that `LANGSMITH_OTLP_TRACES_ENDPOINT` uses the correct US, EU, GCP-hosted APAC, AWS-hosted US, or self-hosted API base and ends in `/otel/v1/traces`. |

docs/get-started/quickstart.mdx

@@ -357,7 +357,7 @@ Use these details when your first-run path needs more control.
       Status:      nemoclaw my-gpt-claw status
       Logs:        nemoclaw my-gpt-claw logs --follow
       Model:       nemoclaw inference set --model <model> --provider <provider> --sandbox my-gpt-claw
-      Policies:    nemoclaw my-gpt-claw policy-add
+      Policies:    nemoclaw my-gpt-claw policy add
       Credentials: nemoclaw credentials reset <KEY> && nemoclaw onboard
     ──────────────────────────────────────────────────
     ```

docs/manage-sandboxes/backup-restore.mdx

@@ -55,8 +55,8 @@ NemoClaw refuses to create a snapshot when it detects an active `dcode` task or
 Wait for active `dcode` work to finish before running `$$nemoclaw <name> snapshot create`.
 </AgentOnly>
 
-Snapshots preserve sandbox registry metadata that affects rebuild behavior, including custom policy presets applied with `policy-add --from-file` or `policy-add --from-dir`.
-When you restore a snapshot, NemoClaw replays those recorded custom presets with their stored YAML content, so you do not need the original preset files on disk.
+Snapshots preserve sandbox registry metadata that affects rebuild behavior, including custom policy presets applied with `policy add --from-file` or `policy add --from-dir` and baseline network policy entries excluded with `policy exclude`.
+When you restore a snapshot, NemoClaw replays those recorded custom presets with their stored YAML content, so you do not need the original preset files on disk, and rebuild continues to apply the recorded baseline exclusions.
 
 The target sandbox's current agent manifest remains authoritative for state-file restore behavior.
 NemoClaw rejects the restore when the snapshot's agent, config directory, state-file path, or state-file strategy conflicts with that manifest.

docs/manage-sandboxes/runtime-controls.mdx

@@ -23,7 +23,7 @@ NemoClaw applies its security posture in three layers: what onboarding writes in
 | Inference provider | Runtime route and config update while shields are down; rebuild only if you need to recreate the image | Run `$$nemoclaw <name> shields down`, then `$$nemoclaw inference set`, then restore shields |
 | Inference model on the current provider | Runtime route and config update while shields are down | Run `$$nemoclaw <name> shields down`, then `$$nemoclaw inference set`, then restore shields |
 | Sub-agent | Re-onboard required because the sub-agent and workspace are baked at onboard | `$$nemoclaw onboard --recreate-sandbox` |
-| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy-add <preset>` or `policy-remove <preset>` |
+| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy add <preset>` or `policy remove <preset>` |
 | Network allowlist | Runtime on the next request | `openshell policy set` or the interactive approval prompt at the gateway |
 | Channel tokens | Rebuild required because the channel configuration and credential attachment are created during onboarding or rebuild | `$$nemoclaw <name> channels add <channel>`, then accept the rebuild prompt |
 | Channel enable or disable | Rebuild required because `openclaw.json` is the runtime source of truth | `$$nemoclaw <name> channels stop <channel>`, then rebuild |
@@ -68,7 +68,7 @@ If preflight detects an unsafe path, invalid config, invalid ownership posture,
 | Inference provider | Runtime route changes apply immediately; rebuild if you need to rebake model metadata into the image | `$$nemoclaw inference set` for route changes, or `$$nemoclaw <name> rebuild` after changing build-time settings |
 | Inference model on the current provider | Hot-reloadable through the Hermes config sync path | `$$nemoclaw inference set` |
 | Agent runtime | Re-onboard required because the agent and state layout are baked at onboard | `$$nemoclaw onboard --recreate-sandbox` or `nemoclaw onboard --agent openclaw --recreate-sandbox` |
-| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy-add <preset>` or `policy-remove <preset>` |
+| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy add <preset>` or `policy remove <preset>` |
 | Network allowlist | Runtime on the next request | `openshell policy set` or the interactive approval prompt at the gateway |
 | Channel tokens | Rebuild required because the channel configuration and credential attachment are created during onboarding or rebuild | `$$nemoclaw <name> channels add <channel>`, then accept the rebuild prompt |
 | Channel enable or disable | Rebuild required because `/sandbox/.hermes/.env` and Hermes config are baked at image build time | `$$nemoclaw <name> channels stop <channel>`, then rebuild |

docs/manage-sandboxes/set-up-slack.mdx

@@ -20,7 +20,7 @@ NemoClaw validates both tokens before it saves Slack credentials or enables the
 This validation calls the live Slack APIs `auth.test` and `apps.connections.open`, so the tokens must belong to a real Slack app.
 
 If Slack rejects the tokens, NemoClaw skips the Slack channel and does not apply the `slack` network policy preset.
-When Slack is skipped, the preset does not appear as applied in `$$nemoclaw <name> policy-list`.
+When Slack is skipped, the preset does not appear as applied in `$$nemoclaw <name> policy list`.
 
 To exercise channel setup with placeholder tokens in a restricted network or hermetic test environment, set `NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION=1`.
 Slack token format checks still apply.