docs: add Deep Agents network policy tasks

[miyoungc]

Summary

Add the supported Deep Agents Network Policy tasks to the canonical policy guides. Preserve legacy page fragments so existing links continue to resolve after the documentation split.

Changes

• Add Deep Agents commands for policy preset, approval, baseline, and custom preset tasks.
• Keep unsupported Deep Agents policy workflows out of generated variants.
• Update navigation, security guidance, CLI selection, troubleshooting, and network policy reference ownership.
• Preserve legacy monitoring and network policy fragments as compatibility pointers.
• Expand published-route and agent-variant tests for the new ownership and compatibility contracts.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence:
  • docs/get-started/quickstart-langchain-deepagents-code.mdx
  • docs/index.yml
  • docs/network-policy/apply-policy-presets.mdx
  • docs/network-policy/approve-network-requests.mdx
  • docs/network-policy/change-baseline-network-policy.mdx
  • docs/network-policy/create-custom-policy-presets.mdx
  • docs/network-policy/customize-network-policy.mdx
  • docs/reference/cli-selection-guide.mdx
  • docs/reference/network-policies.mdx
  • docs/reference/troubleshooting.mdx
  • docs/security/best-practices.mdx
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — commit hooks passed; push used --no-verify at the contributor's request
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/check-docs-published-routes.test.ts test/check-docs-links.test.ts test/network-policies-published-routes.test.ts test/agent-variant-docs.test.ts passed 4 files and 64 tests; exact-head documentation review passed 4 files and 51 tests
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable to this documentation-only change
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — passed with 0 errors and one pre-existing Fern warning
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only) — no new pages

---

Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

• Documentation
  • Added a new Network Policy section to Deep Agents documentation navigation.
  • Expanded network policy guidance with Deep Agents-specific setup, customization, presets, approvals, troubleshooting, and integration examples.
  • Improved variant-specific content so OpenClaw, Hermes, and Deep Agents users see relevant instructions.
  • Added in-page navigation anchors and refreshed related-topic links.
  • Updated trace export guidance with clearer subsection navigation.
• Tests
  • Expanded validation of published documentation routes, compatibility links, and agent-variant visibility.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The documentation adds Deep Agents network-policy navigation, variant-specific guidance, cross-references, and compatibility anchors. Published-route tests now verify Deep Agents route inclusion, variant filtering, shared configuration pages, and legacy link resolution.

Changes

Network Policy Documentation

Layer / File(s)	Summary
Variant-specific network policy content docs/network-policy/*	Network policy pages now conditionally render Deep Agents and OpenClaw/Hermes workflows, commands, presets, examples, and policy guidance.
Navigation and troubleshooting references docs/index.yml, docs/reference/..., docs/security/best-practices.mdx	Deep Agents navigation and related documentation now link to network-policy customization, approval, and troubleshooting workflows.
Published routes and compatibility anchors docs/get-started/quickstart-langchain-deepagents-code.mdx, test/*published-routes.test.ts	Quickstart and network-policy anchors support legacy links, while tests validate published routes, variant filtering, and anchor ordering.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: aasthajh, afourniernv, ahunnargikar-nvidia

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding Deep Agents network policy tasks and related documentation updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/docs-preserve-legacy-fragments

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 1e3c33a in the codex/docs-preserve-... branch remains at 96%, unchanged from commit 5e6a821 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 1e3c33a in the codex/docs-preserve-... branch is 80%. The coverage in commit d0a95dc in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main d0a95dc	codex/docs-preserve-... 1e3c33a	+/-
src/lib/onboard...flight-ports.ts	67%	33%	-34%
src/lib/onboard...box-prebuild.ts	92%	74%	-18%
src/lib/actions...ocker-health.ts	82%	65%	-17%
src/lib/actions...confirmation.ts	79%	69%	-10%
src/lib/onboard...box-gpu-mode.ts	97%	92%	-5%
src/lib/actions...light-guards.ts	90%	86%	-4%
src/lib/onboard/preflight.ts	80%	80%	0%
src/lib/actions...eway-restart.ts	94%	95%	+1%
src/lib/onboard...host-anchors.ts	90%	94%	+4%
src/lib/onboard/docker-cdi.ts	70%	80%	+10%

---

_{Updated July 27, 2026 19:19 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7653.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (1)

test/network-policies-published-routes.test.ts (1)

1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicate readDoc/expectUniqueAnchorsBeforePointer helpers across two test files. Both files independently implement the same doc-anchor-precedes-pointer assertion logic, and the signatures have already diverged (3-arg vs. 4-arg with linkText), which is a sign of copy/paste drift.

• test/network-policies-published-routes.test.ts#L86-105: extract readDoc and expectUniqueAnchorsBeforePointer into a shared test-support module (e.g. test/support/doc-anchors.ts), exposing a signature that optionally accepts linkText so both files can consume the same implementation.
• test/deepagents-monitoring-published-routes.test.ts#L51-71: replace the local readDoc/expectUniqueAnchorsBeforePointer definitions with an import from the same shared test-support module.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/network-policies-published-routes.test.ts` at line 1, Extract the
duplicated readDoc and expectUniqueAnchorsBeforePointer helpers from the
published-routes tests into a shared test-support module, with
expectUniqueAnchorsBeforePointer accepting optional linkText. Replace both local
implementations in network-policies-published-routes.test.ts and
deepagents-monitoring-published-routes.test.ts with imports from that module,
preserving existing assertion behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/network-policies-published-routes.test.ts`:
- Line 1: Extract the duplicated readDoc and expectUniqueAnchorsBeforePointer
helpers from the published-routes tests into a shared test-support module, with
expectUniqueAnchorsBeforePointer accepting optional linkText. Replace both local
implementations in network-policies-published-routes.test.ts and
deepagents-monitoring-published-routes.test.ts with imports from that module,
preserving existing assertion behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9e16dd3a-5316-4296-856f-4a665121cc52

📥 Commits

Reviewing files that changed from the base of the PR and between 3d88c04 and 1e3c33a.

📒 Files selected for processing (13)

• docs/get-started/quickstart-langchain-deepagents-code.mdx
• docs/index.yml
• docs/network-policy/apply-policy-presets.mdx
• docs/network-policy/approve-network-requests.mdx
• docs/network-policy/change-baseline-network-policy.mdx
• docs/network-policy/create-custom-policy-presets.mdx
• docs/network-policy/customize-network-policy.mdx
• docs/reference/cli-selection-guide.mdx
• docs/reference/network-policies.mdx
• docs/reference/troubleshooting.mdx
• docs/security/best-practices.mdx
• test/deepagents-monitoring-published-routes.test.ts
• test/network-policies-published-routes.test.ts

💤 Files with no reviewable changes (1)

• docs/reference/network-policies.mdx