Skip to content

docs: complete v0.0.104 audit follow-ups #8588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cv merged 5 commits into from
Aug 8, 2026
Merged

docs: complete v0.0.104 audit follow-ups #8588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e3a28de
docs: complete v0.0.104 audit follow-ups
miyoungc Aug 7, 2026
7895a61
docs: address audit follow-up review
miyoungc Aug 7, 2026
2cc3fa8
Apply suggestion from @miyoungc
miyoungc Aug 7, 2026
d70bc43
Apply suggestion from @miyoungc
miyoungc Aug 7, 2026
538e684
Apply suggestion from @miyoungc
miyoungc Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions docs/changelog/2026-08-06.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@ It also improves Hermes configuration safety, MCP diagnostics, credential isolat
NemoClaw acquires and verifies the exact GGUF through the shared Hugging Face cache, publishes an authenticated loopback runtime, and uses owner, receipt, and journal state for onboarding, status, doctor, recovery, destroy, and uninstall.
This path remains experimental and does not establish a supported agent, model, and runtime tuple until its protected qualification and activation gates pass.
For more information, refer to [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server), the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Understand Host Files and State](/user-guide/openclaw/reference/host-files-and-state).
- DGX Spark users can now select an opt-in fixed vLLM serving profile through the hosted installer or the CLI.

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Scope the vLLM statement to qualified two-node clusters.

The profile contract in managed-inference/presets/vllm.dgx-spark-gb10.dual.deepseek-v4-flash-0731.yaml requires exactly two nodes, DGX Spark qualification on every node, and the host-cluster.direct-cx7 topology qualification. The current “DGX Spark users” wording is broader than that contract. State that this applies to qualified two-node DGX Spark clusters.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/changelog/2026-08-06.mdx` at line 16, Update the vLLM serving profile
changelog entry to state that it applies only to qualified two-node DGX Spark
clusters, matching the profile’s node-count, per-node qualification, and
topology requirements.

`profiles list` reports catalog entries and their host compatibility without changing resources, while `onboard --profile` records the exact catalog, recipe, and runtime provenance and rejects silent definition drift during resume.
For more information, refer to [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server), [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
- Custom inference endpoints, MCP servers, and custom policy presets can now opt in to explicitly trusted private hosts.
NemoClaw keeps exact host allowlists, pins generated `allowed_ips`, preserves those pins across restart and rebuild, and applies configured certificate authority trust without widening the endpoint policy.
For more information, refer to [Meet Custom Endpoint Security Requirements](/user-guide/openclaw/inference/custom-endpoints/custom-endpoint-security), [Create Custom Policy Presets](/user-guide/openclaw/network-policy/configure-policies/create-custom-policy-presets), and [Configure Corporate CA Trust](/user-guide/openclaw/security/configure-corporate-ca-trust).
Expand All @@ -25,6 +28,10 @@ It also improves Hermes configuration safety, MCP diagnostics, credential isolat
- Gateway and sandbox recovery now waits for the managed gateway lease, resumes journaled rebuild recreation, and applies compatibility decisions before rejecting a restored sandbox as not ready.
Malformed sandbox registry data fails closed, gateways that never served receive bounded boot-grace recovery, and registry repair remains scoped to the target gateway.
For more information, refer to [Understand Gateway Lifecycle Control](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control), [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
- Portable experimental-profile recovery can now restart a receipt-owned user-local Ollama executable after a semantic `/api/tags` health check.
When an unhealthy API requires a user-local start, recovery requires a valid ownership receipt or explicit re-enrollment for a pre-receipt installation.
It rejects symbolic links, refuses to launch a duplicate Ollama process, does not take over a system service or unrelated user-managed daemon, and verifies both the authenticated proxy and the sandbox `inference.local` route before reporting success.
For more information, refer to [Set Up Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama) and [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes).
- Scoped uninstall now deletes the sandbox before removing its unit and preserves the gateway and unit when sandbox deletion fails, leaving a retryable state instead of partial teardown.
Desktop metadata no longer blocks uninstall when the managed runtime state is otherwise valid.
For more information, refer to [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
Expand Down
36 changes: 36 additions & 0 deletions docs/index.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,6 +341,18 @@ navigation:
- page: "Security Best Practices"
path: _build/agent-variants/security/best-practices.openclaw.generated.mdx
slug: best-practices
- section: "Security Controls"
slug: security-controls
contents:
- page: "Filesystem Controls"
path: _build/agent-variants/security/filesystem-controls.openclaw.generated.mdx
slug: filesystem-controls
- page: "Process Controls"
path: _build/agent-variants/security/process-controls.openclaw.generated.mdx
slug: process-controls
- page: "Gateway and Secret Controls"
path: _build/agent-variants/security/gateway-authentication-controls.openclaw.generated.mdx
slug: gateway-authentication-controls
- page: "Configure Corporate CA Trust"
path: _build/agent-variants/security/configure-corporate-ca-trust.openclaw.generated.mdx
slug: configure-corporate-ca-trust
Expand Down Expand Up @@ -681,6 +693,18 @@ navigation:
- page: "Security Best Practices"
path: _build/agent-variants/security/best-practices.deepagents.generated.mdx
slug: best-practices
- section: "Security Controls"
slug: security-controls
contents:
- page: "Filesystem Controls"
path: _build/agent-variants/security/filesystem-controls.deepagents.generated.mdx
slug: filesystem-controls
- page: "Process Controls"
path: _build/agent-variants/security/process-controls.deepagents.generated.mdx
slug: process-controls
- page: "Gateway and Secret Controls"
path: _build/agent-variants/security/gateway-authentication-controls.deepagents.generated.mdx
slug: gateway-authentication-controls
- page: "Configure Corporate CA Trust"
path: _build/agent-variants/security/configure-corporate-ca-trust.deepagents.generated.mdx
slug: configure-corporate-ca-trust
Expand Down Expand Up @@ -1060,6 +1084,18 @@ navigation:
- page: "Security Best Practices"
path: _build/agent-variants/security/best-practices.hermes.generated.mdx
slug: best-practices
- section: "Security Controls"
slug: security-controls
contents:
- page: "Filesystem Controls"
path: _build/agent-variants/security/filesystem-controls.hermes.generated.mdx
slug: filesystem-controls
- page: "Process Controls"
path: _build/agent-variants/security/process-controls.hermes.generated.mdx
slug: process-controls
- page: "Gateway and Secret Controls"
path: _build/agent-variants/security/gateway-authentication-controls.hermes.generated.mdx
slug: gateway-authentication-controls
- page: "Configure Corporate CA Trust"
path: _build/agent-variants/security/configure-corporate-ca-trust.hermes.generated.mdx
slug: configure-corporate-ca-trust
Expand Down
2 changes: 1 addition & 1 deletion docs/inference/set-up-ollama.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ The following settings control non-interactive selection:
|---|---|
| `NEMOCLAW_PROVIDER` | Set to `ollama`. |
| `NEMOCLAW_MODEL` | Optional Ollama model tag. |
| `NEMOCLAW_PROVIDER_MODEL` | Compatibility fallback for the external NVIDIA QA non-interactive Ollama invocation recorded in [#6869](https://github.com/NVIDIA/NemoClaw/issues/6869), the only identified consumer. Its configuration is not stored in this repository, so changes here cannot migrate or verify the invocation. `NEMOCLAW_MODEL` takes precedence, and non-interactive re-onboarding ignores this fallback when the requested provider differs from the recorded provider. Remove the fallback after the QA owner confirms that the invocation uses `NEMOCLAW_MODEL` or is retired. |
| `NEMOCLAW_PROVIDER_MODEL` | Compatibility fallback for an external NVIDIA QA non-interactive Ollama invocation. `NEMOCLAW_MODEL` takes precedence. Non-interactive re-onboarding ignores this fallback when the requested provider differs from the recorded provider. |
| `NEMOCLAW_YES` | Optional model download authorization when set to `1`. |

Under `--non-interactive`, include `--yes` or set `NEMOCLAW_YES=1` to authorize a model download.
Expand Down
6 changes: 3 additions & 3 deletions docs/reference/enterprise-readiness.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ Each row links to deeper documentation and, when a concrete fix is in progress,
| Monitoring and health | Supported | Use `$$nemoclaw <sandbox> status`, `$$nemoclaw <sandbox> logs --follow`, and `openshell term`. Refer to [CLI Commands Reference](commands). |
| External telemetry and observability export | Supported with caveats | OpenClaw can emit conversation traces through its diagnostics plugin, and LangChain Deep Agents Code can explicitly opt into bounded-content OTLP/HTTP traces with `--observability`. Both paths require an operator-run host collector. NemoClaw does not manage the collector, remote exporter credentials, fleet-wide routing, metrics or logs export, or authenticated tenant identity. Treat exported prompts, responses, tool inputs, and tool results as sensitive application data. Refer to [Deep Agents Code OTLP Traces](commands#deep-agents-code-otlp-traces). Broader observability adapter work remains tracked in [#3915](https://github.com/NVIDIA/NemoClaw/issues/3915). |
| Audit and session records | Supported with caveats | OpenClaw stores per-session JSONL event logs, and Hermes stores its own runtime state. Deep Agents Code has no equivalent session-log export, but it can emit bounded-content traces when you explicitly enable observability. Export is manual per sandbox. |
| Resource quotas | Supported with caveats | The entrypoint applies best-effort process and file-descriptor limits (`ulimit -u 512`, `ulimit -n 65536`). Set hard limits through the container runtime for fail-closed enforcement. Refer to [Process Controls](../security/best-practices#process-controls). |
| Resource quotas | Supported with caveats | The entrypoint applies best-effort process and file-descriptor limits (`ulimit -u 512`, `ulimit -n 65536`). Set hard limits through the container runtime for fail-closed enforcement. Refer to [Process Controls](../security/security-controls/process-controls). |
| Cost and spend controls | Platform or partner-owned | Deny-by-default egress and routed inference reduce exfiltration and stray endpoints, but NemoClaw does not enforce per-token spend budgets. Set spend limits with your inference provider and monitor unattended agents. |
| Credential isolation | Supported | Inference credentials stay on the host and never enter the sandbox; the agent reaches models through `inference.local`. CLI output redaction adds defense in depth, and OpenClaw sandboxes also run a memory secret scanner. Refer to [Credential Storage](../security/credential-storage) and [Security Best Practices](../security/best-practices). |
| Upgrades and lifecycle | Supported with caveats | Upgrade NemoClaw, then run `$$nemoclaw <sandbox> rebuild` to recreate the sandbox with the current image while backing up and restoring state. Do not update the agent runtime in place inside the sandbox because the agent is image-pinned. Known gaps include config restore after rebuild ([#5202](https://github.com/NVIDIA/NemoClaw/issues/5202)) and version attachment flexibility ([#2217](https://github.com/NVIDIA/NemoClaw/issues/2217)). |
Expand Down Expand Up @@ -113,8 +113,8 @@ Each one includes the current workaround or next step.
| Controls bypassed outside the managed gateway path | Network policy and inference auth are not enforced if a runtime starts outside the NemoClaw-managed entrypoint. | Use NemoClaw-managed onboarding and sandbox entrypoints for production workflows. Refer to [Known Limitations](../security/best-practices#known-limitations). |
| One consumer per messaging bot token | Two sandboxes sharing a bot token disconnect each other and drop messages. | Use a distinct bot token per sandbox. Refer to the messaging troubleshooting in [Troubleshooting](troubleshooting#messaging-bridge-appears-running-but-no-messages-arrive). |
| In-sandbox config edits do not persist | Direct edits to agent config inside the running sandbox do not survive rebuilds. | Make durable config changes from the host by re-running `$$nemoclaw onboard`, not inside the sandbox. Refer to [Troubleshooting](troubleshooting). |
| Landlock filesystem enforcement degrades on old kernels | Filesystem restrictions fall back to container mounts below Linux kernel 5.13. | Run on kernel 5.13 or later for full enforcement. Refer to [Landlock LSM Enforcement](../security/best-practices#landlock-lsm-enforcement). |
| Best-effort capability and resource limits | Capability drops and ulimits skip silently when the runtime blocks them. | Pass `--cap-drop=ALL` and `--ulimit` at the container runtime, or set `NEMOCLAW_REQUIRE_CAP_DROP=1` to fail closed. Refer to [Process Controls](../security/best-practices#process-controls). |
| Landlock filesystem enforcement degrades on old kernels | Filesystem restrictions fall back to container mounts below Linux kernel 5.13. | Run on kernel 5.13 or later for full enforcement. Refer to [Landlock LSM Enforcement](../security/security-controls/filesystem-controls#landlock-lsm-enforcement). |
| Best-effort capability and resource limits | Capability drops and ulimits skip silently when the runtime blocks them. | Pass `--cap-drop=ALL` and `--ulimit` at the container runtime, or set `NEMOCLAW_REQUIRE_CAP_DROP=1` to fail closed. Refer to [Process Controls](../security/security-controls/process-controls). |

## Field Conversation Guidance

Expand Down
Loading
Loading