NVIDIA · jyaunches · Jul 29, 2026 · Jul 28, 2026 · Jul 29, 2026
diff --git a/docs/changelog/2026-07-25.mdx b/docs/changelog/2026-07-25.mdx
@@ -49,7 +49,7 @@ It also hardens blueprint identifier validation, improves onboarding and recover
   A version-tag install reports the requested tag, and a near-miss license response such as `y` receives an in-place hint without weakening exact `yes` acceptance.
   WSL Express selects Windows-host Ollama only with Docker Desktop integration and otherwise configures WSL-local Ollama.
   DGX Station preparation now distinguishes an active vLLM server from unrelated diagnostic processes.
-  For more information, refer to the [NemoClaw Quickstart with OpenClaw](/user-guide/openclaw/get-started/quickstart), [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes), [Prepare Windows for NemoClaw](/user-guide/openclaw/get-started/additional-setup/windows-preparation), and [Prepare DGX Station to Install NemoClaw](/user-guide/openclaw/get-started/additional-setup/dgx-station-preparation).
+  For more information, refer to the [NemoClaw Quickstart with OpenClaw](/user-guide/openclaw/get-started/quickstart), [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes), [Prepare a Windows Machine to Install NemoClaw](/user-guide/openclaw/get-started/additional-setup/windows-preparation), and [Prepare DGX Station to Install NemoClaw](/user-guide/openclaw/get-started/additional-setup/dgx-station-preparation).
 - The Ollama model menu now shows download size, required VRAM, and available or total GPU memory when known.
   Re-onboarding a committed local Ollama route now reuses its persisted proxy token so the existing sandbox and restarted host proxy keep the same credential.
   Resumed onboarding reports when a recorded reasoning setting takes precedence over `NEMOCLAW_REASONING`.

diff --git a/docs/inference/custom-endpoint-security.mdx b/docs/inference/custom-endpoint-security.mdx
@@ -17,10 +17,12 @@ The agent inside the sandbox sends requests to `inference.local` instead of conn
 OpenShell forwards the traffic and injects the provider credential at egress.
 The sandbox does not receive the raw API key.
 
-Use `COMPATIBLE_API_KEY` for a custom OpenAI-compatible endpoint.
+Use `COMPATIBLE_API_KEY` for an OpenAI-compatible endpoint that requires authentication.
+For an HTTP endpoint on `localhost`, `127.0.0.1`, or `[::1]` and port `8000`, `11434`, or `11435`, you can select no authentication.
+For non-interactive onboarding of that OpenAI-compatible endpoint, set `NEMOCLAW_COMPATIBLE_AUTH_MODE=none`.
 Use `COMPATIBLE_ANTHROPIC_API_KEY` for a custom Anthropic-compatible endpoint.
-Both onboarding flows require a non-empty value, even when the upstream server does not authenticate requests.
-Use a non-empty placeholder such as `dummy` for an unauthenticated local server.
+Anthropic-compatible onboarding requires a non-empty value even when the upstream server does not authenticate requests.
+Use a non-empty placeholder such as `dummy` for an unauthenticated Anthropic-compatible endpoint.
 
 ## Understand URL Validation
 

diff --git a/docs/inference/set-up-ollama.mdx b/docs/inference/set-up-ollama.mdx
@@ -71,6 +71,8 @@ $$nemoclaw onboard
 Select the Ollama entry for your host.
 The menu identifies a reachable daemon as running and labels an installed but stopped daemon **Start local Ollama**.
 NemoClaw lists installed models or offers starter models when none are installed.
+For registry-known models, each menu entry shows the download size and approximate VRAM requirement.
+The menu shows currently available GPU memory when the host reports it, or total GPU memory when available memory is unknown.
 
 The starter list includes `qwen3.6:35b` and selects it by default when current GPU memory can accommodate it.
 When another GPU workload consumes most of the available memory, NemoClaw selects the largest starter model that still fits.
@@ -139,7 +141,7 @@ The wizard manages the proxy lifecycle:
 - It removes stale matching proxy processes from previous runs.
 - It probes the sandbox Docker network path before saving the inference route.
 - It stops matching proxy processes during uninstall.
-- It reuses the persisted token after a host reboot.
+- It reuses the persisted token after a host reboot and during re-onboarding for the committed local Ollama route.
 
 All proxy endpoints require the token, including `GET /api/tags`.
 The host-side proxy liveness check treats any HTTP response, including `401`, as evidence that the proxy answered.

diff --git a/docs/security/sandbox-base-2026-07-25-dependency-review.md b/docs/security/sandbox-base-2026-07-25-dependency-review.md
@@ -1,7 +1,7 @@
 <!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
 <!-- SPDX-License-Identifier: Apache-2.0 -->
 
-# Sandbox base dependency review: Vim, jq, Expat, Perl modules, and bundled npm
+# Sandbox base dependency review for Vim, jq, Expat, Perl modules, and bundled npm
 
 Date: 2026-07-25
 
@@ -124,7 +124,7 @@ The core interpreter version check also remains the binding for core-language fi
 
 ## Concern ledger
 
-### DEP-1: affected trixie Vim package
+### DEP-1 affected trixie Vim package
 
 - Range: `2:9.1.1230-2..2:9.2.0782-1`
 - Surface: native package and runtime editor
@@ -136,7 +136,7 @@ The core interpreter version check also remains the binding for core-language fi
 - Verification: exact `RUN`-chain execution, checksum-rejection tests, dpkg identity checks, Vim runtime checks, and native image builds.
 - Remaining gate: multi-image, multi-architecture CI.
 
-### DEP-2: affected package inside npm's private tree
+### DEP-2 affected package inside npm's private tree
 
 - Range: `brace-expansion 5.0.7..5.0.8`
 - Surface: transitive bundled npm dependency
@@ -148,7 +148,7 @@ The core interpreter version check also remains the binding for core-language fi
 - Verification: pre-swap and post-swap rollback, idempotence, unsafe-tree, layout-drift, command-order, Dockerfile-order, and real-registry tests.
 - Remaining gate: multi-image CI.
 
-### DEP-3: Perl package identity does not expose dual-life module versions
+### DEP-3 Perl package identity does not expose dual-life module versions
 
 - Range: Perl `5.44.0` with bundled component versions
 - Surface: native package inventory and runtime modules
@@ -160,7 +160,7 @@ The core interpreter version check also remains the binding for core-language fi
 - Verification: native amd64 and arm64 image builds.
 - Remaining gate: multi-architecture base-image build.
 
-### DEP-4: managed jq, Oniguruma, and Expat identities differ
+### DEP-4 managed jq, Oniguruma, and Expat identities differ
 
 - Range: `libexpat1` distro-selected or `2.8.2-1` to `2.8.2-1`; `libjq1` and `jq` `1.7.1-6+deb13u2..1.8.2-1`; `libonig5 >= 6.9.7.1` to exact `6.9.9-1+b1`.
 - Surface: native packages and runtime libraries