From cd0319120f808a28979425feabf687da161d83eb Mon Sep 17 00:00:00 2001 From: Atharv Kumaria Date: Tue, 21 Jul 2026 15:36:41 -0700 Subject: [PATCH] docs: scope OpenShell 0.0.71 review link to openclaw and hermes The OpenShell 0.0.72 compatibility review links to the 0.0.71 gateway authentication review, but that page is not published in the Deep Agents navigation, so the link 404s for Deep Agents readers. Wrap the sentence in AgentOnly blocks so openclaw and hermes keep the link and deepagents gets the same sentence without it, following the pattern in manage-sandboxes/run-sandboxes.mdx. Signed-off-by: Atharv Kumaria --- docs/security/openshell-0.0.72-compatibility-review.mdx | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/security/openshell-0.0.72-compatibility-review.mdx b/docs/security/openshell-0.0.72-compatibility-review.mdx index 7aca7a41cb3..a62832871fb 100644 --- a/docs/security/openshell-0.0.72-compatibility-review.mdx +++ b/docs/security/openshell-0.0.72-compatibility-review.mdx @@ -23,7 +23,12 @@ The dependency compatibility review was completed on June 29, 2026; the MCP inte ## Source-of-Truth Boundaries + The generated gateway authentication contract remains unchanged from the [OpenShell 0.0.71 gateway authentication review](./openshell-0.0.71-gateway-auth-review). + + +The generated gateway authentication contract remains unchanged from the OpenShell 0.0.71 gateway authentication review. + The `v0.0.71...v0.0.72` source comparison does not change the gateway config loader, local TLS tables, mTLS user authentication, gateway JWT issuer, or `SandboxJwtAuthenticator` contract used by NemoClaw. The live `openshell-gateway-auth-source-contract.test.ts` scenario revalidates that NemoClaw keeps the main OpenShell listener on `127.0.0.1`, rejects unauthenticated Docker-origin calls, accepts a correctly scoped sandbox JWT over guest mTLS, rejects cross-sandbox tokens, and scrubs `OPENSHELL_DISABLE_GATEWAY_AUTH=true`. The inherited contract also continues to reject `NEMOCLAW_GATEWAY_BIND_ADDRESS=0.0.0.0`.