docs: move walkthrough prerequisites before command

[miyoungc]

Summary

The network-request walkthrough previously disclosed its prerequisites after the run command.
This change places the existing tmux, host environment, and onboarded-sandbox requirements before the command so readers can prepare the host first.

Related Issue

Fixes #8115

Changes

• Move the walkthrough prerequisite text before the numbered procedure.
• Keep the walkthrough result after the procedure.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification: This documentation-only change moves existing prerequisite text before the documented command.
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head proportional nine-category security review at f08b4de79562ea77bbabbc7dae57e275f4ef104e against 89e17bfe9a22ffc6b16c8407ce83a2c0a493ba74 passed with no findings. This documentation-only move preserves the existing NVIDIA_INFERENCE_API_KEY identifier and walkthrough command; it changes no runtime policy, credential handling, network enforcement, or trust boundary.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Independently reviewed docs/network-policy/approve-network-requests.mdx at exact head f08b4de79562ea77bbabbc7dae57e275f4ef104e against base 89e17bfe9a22ffc6b16c8407ce83a2c0a493ba74. The source-checkout requirement, tmux, NVIDIA_INFERENCE_API_KEY, onboarded-sandbox prerequisite, and existing-sandbox effect now appear before the walkthrough command, exactly addressing [All Platforms][Docs] Hermes "Approve or Deny Network Requests" walkthrough runs scripts/walkthrough.sh before disclosing its tmux / NVIDIA_INFERENCE_API_KEY prerequisites #8115. OpenClaw and Hermes variants contain the reordered walkthrough; Deep Agents intentionally omits the agent-specific section. Routes, links, commands, terminology, structure, voice, and code-block presentation pass the writing and documentation style rules. The sole substantive commit is unchanged after the no-conflict signed main merge. npm run docs passed with 0 errors and 2 standard warnings; npm run validate:pr, normal pre-push hooks, and git diff --check passed.
• Agent: Codex Desktop

Security Review

• Verdict: PASS; no findings.
• Reviewed head: f08b4de79562ea77bbabbc7dae57e275f4ef104e.
• Reviewed base: 89e17bfe9a22ffc6b16c8407ce83a2c0a493ba74.
• Secrets and credentials: PASS; only the existing environment-variable name moves, with no value or handling change.
• Input validation and data sanitization: PASS; no executable input path changed.
• Authentication and authorization: PASS; no authentication or authorization behavior changed.
• Dependencies and third-party libraries: PASS; no dependency changed.
• Error handling and logging: PASS; no runtime or log path changed.
• Cryptography and data protection: PASS; no cryptography or protected-data handling changed.
• Configuration and security headers: PASS; no network policy, HTTP header, or service configuration changed.
• Security testing: PASS; docs generation, agent variants, routes, links, and repository validation passed.
• System security: PASS; moving prerequisites before execution improves safe operator sequencing without altering the trust boundary.

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Tests are not applicable to this documentation-only ordering correction.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

• Documentation
  • Clarified the prerequisites for approving network requests.
  • Noted that the walkthrough attaches to an existing sandbox.
  • Removed duplicate prerequisite information from the script-output section.

[coderabbitai]

📝 Walkthrough

Walkthrough

The walkthrough now lists tmux, NVIDIA_INFERENCE_API_KEY, and an onboarded sandbox attached to the active gateway before the script runs. It also states that the script attaches to an existing sandbox.

Changes

Network policy walkthrough documentation

Layer / File(s)	Summary
Document walkthrough prerequisites docs/network-policy/approve-network-requests.mdx	The walkthrough states its required tools, environment variable, and sandbox setup before the script instructions. It clarifies that the script attaches to an existing sandbox.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change places the tmux, NVIDIA_INFERENCE_API_KEY, and onboarded-sandbox prerequisites before the walkthrough command as required by issue #8115.
Out of Scope Changes check	✅ Passed	The pull request contains only documentation changes directly related to the prerequisite ordering issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes moving the walkthrough prerequisites before the command.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/docs-fix-8115

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8256.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — active gateway at docs/network-policy/approve-network-requests.mdx:93: Retain the established term.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Reviewed exact head f08b4de against base 89e17bf. The prerequisite notice now precedes the walkthrough command, the effective one-page patch is unchanged after the clean main refresh, the independent documentation review passed, and all required checks pass.