docs(security): remove internal review pages from public docs

.agents/skills/nemoclaw-contributor-update-dependencies/SKILL.md

@@ -71,6 +71,16 @@ Pass the reviewed absolute Git and gh executable paths. Preserve its minimal all
 environments and its byte and record ceilings. Keep private report permissions at mode 0600.
 Follow the current collector help when those controls evolve.
 
+## Keep Review Evidence out of Public Documentation
+
+Do not write release ledgers, concern records, reviews, or qualification reports under `docs/`; they are maintainer evidence. Keep temporary evidence outside the repository with private permissions.
+For Fern, do not create a dependency review document or durable review ledger. Keep Fern upgrade
+evidence in the pull request description and executable configuration and publishing tests. Put
+other durable records in `internal/security-reviews/`, by the owning component, or in the pull request description.
+
+For a user-visible change, update the canonical `docs/` page with supported behavior and operator action.
+Do not publish review chronology or concern ledgers, add internal evidence to `docs/index.yml`, or link to it from public documentation.
+
 ## Resolve concerns
 
 Use [Contract audit](references/contract-audit.md) to select the relevant risk surfaces and record

Dockerfile

@@ -603,7 +603,7 @@ ENV AWS_EC2_METADATA_DISABLED=true
 COPY --from=builder /usr/local/bin/node /usr/local/bin/node
 
 # Dependency review evidence for this runtime pin lives in
-# docs/security/openclaw-2026.7.1-dependency-review.md.
+# internal/security-reviews/openclaw-2026.7.1-dependency-review.md.
 ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_2026_7_1_INTEGRITY=sha512-ge/Xss99CHAjPL/ikmH/UFoiOrjcxDB4sW3y9mhyCD+dYW3wzV7TKbAVdkrXFgAG2d2BjpJofP97zUZ+umxo8g==
 ARG OPENCLAW_2026_7_1_TARBALL=https://registry.npmjs.org/openclaw/-/openclaw-2026.7.1.tgz

Dockerfile.base

@@ -380,7 +380,7 @@ RUN chmod 444 /usr/local/lib/nemoclaw/sandbox-rlimits.sh \
 # the base image on push to main, or use workflow_dispatch on base-image.yaml
 # with the openclaw_version input for a one-off build without editing this file.
 # Dependency review evidence for this runtime pin lives in
-# docs/security/openclaw-2026.7.1-dependency-review.md.
+# internal/security-reviews/openclaw-2026.7.1-dependency-review.md.
 ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_2026_7_1_INTEGRITY=sha512-ge/Xss99CHAjPL/ikmH/UFoiOrjcxDB4sW3y9mhyCD+dYW3wzV7TKbAVdkrXFgAG2d2BjpJofP97zUZ+umxo8g==
 ARG OPENCLAW_2026_7_1_TARBALL=https://registry.npmjs.org/openclaw/-/openclaw-2026.7.1.tgz

docs/changelog/2026-06-30.mdx

@@ -12,7 +12,7 @@ NemoClaw v0.0.71 improves gateway recovery, OpenShell gateway authentication, po
   For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Troubleshooting](/user-guide/openclaw/reference/troubleshooting), and [Trusted Computing Base](/user-guide/openclaw/security/trusted-computing-base).
 - OpenShell 0.0.71 is the validated gateway release for this train.
   NemoClaw generates local TLS, mTLS, and sandbox JWT material for Docker-driver gateways, keeps gateway binds on loopback while JWT auth is active, and documents the explicit compatibility-container boundary for older trusted Linux hosts.
-  For more information, refer to [OpenShell 0.0.71 Review](/user-guide/openclaw/security/openshell-0.0.71-gateway-auth-review), [Security Best Practices](/user-guide/openclaw/security/best-practices), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
+  For more information, refer to [Gateway and Secret Controls](/user-guide/openclaw/security/security-controls/gateway-authentication-controls), [Security Best Practices](/user-guide/openclaw/security/best-practices), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
 - Network policy output now explains why active presets are present.
   `policy-list` annotates verified active presets with tier, agent, user-added, or source-unverified provenance; Restricted onboarding suppresses agent-required preset additions; the Balanced tier no longer includes `weather`; and the `weather` preset covers read-only `wttr.in` lookups when you add it explicitly.
   For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Common NemoClaw Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples).

docs/changelog/2026-07-04.mdx

@@ -9,7 +9,7 @@ NemoClaw v0.0.74 upgrades the OpenShell policy boundary, adds managed MCP and pr
 
 - Stable installs pin OpenShell `0.0.72` release artifacts and the supervisor image, adding MCP Streamable HTTP and JSON-RPC request-policy enforcement.
   Policy mutations read the round-trippable base policy instead of the effective policy, which preserves existing MCP rules without sending provider-composed `_provider_*` entries back through `policy set`.
-  For more information, refer to [OpenShell 0.0.72 Compatibility Review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review) and [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy).
+  For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies) and [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy).
 - Managed MCP commands use `add`, `list`, `status`, `restart`, and `remove` to manage authenticated HTTPS Streamable HTTP servers for OpenClaw, Hermes, and experimental LangChain Deep Agents Code through native OpenShell policy enforcement and provider-backed credential replacement.
   The LangChain Deep Agents Code rebuild path validates the recorded gateway, route, image, staged build context, and prepared replacement inputs before deleting the previous sandbox, then restores managed MCP state after the recreated runtime is ready.
   For more information, refer to [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers), [Quickstart with LangChain Deep Agents Code](/user-guide/deepagents/get-started/quickstart), and the [accepted architecture decision](https://github.com/NVIDIA/NemoClaw/issues/566#issuecomment-4847534784).

docs/changelog/2026-07-06.mdx

@@ -8,14 +8,13 @@
 NemoClaw v0.0.75 upgrades the bundled OpenClaw runtime to `2026.6.10` and improves sandbox upgrade and prepared-backup recovery, custom endpoint inference routing, and local Docker-driver sandbox JWT handling.
 
 - The bundled OpenClaw runtime upgrades to `2026.6.10` with reviewed package pins, fail-closed archive and patch validation, safer same-device pairing repair, and stricter rebuild route and credential recovery.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
 - Upgrading an existing install now recovers a previously onboarded sandbox instead of failing when the recreated gateway has not yet reconfigured its inference route.
   Prepared-backup recovery defers the live route check to authoritative onboarding, which restores and verifies the gateway provider and inference route before sandbox recreation; in-place upgrades recover gateway-orphaned sandboxes, and a same-name `--fresh` re-onboard preserves the newly selected LangChain Deep Agents Code routing.
   For more information, refer to [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
 - Hermes custom Anthropic-compatible inference now uses the OpenAI frontend, and OpenAI-only agents keep the `/v1` base URL when pointed at an Anthropic-compatible endpoint, so switching a managed sandbox to a compatible endpoint routes and reports the provider and model correctly.
   For more information, refer to [Choose an Inference Provider](/user-guide/openclaw/inference/learn-and-choose/choose-inference-provider) and [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers).
 - Local Docker-driver sandbox JWTs now use OpenShell's non-expiring local contract, which keeps a long-running local sandbox reachable without a manual gateway restart.
-  For more information, refer to [OpenShell 0.0.71 Gateway Authentication Review](/user-guide/openclaw/security/openshell-0.0.71-gateway-auth-review).
+  For more information, refer to [Gateway and Secret Controls](/user-guide/openclaw/security/security-controls/gateway-authentication-controls).
 - Hermes runtime and managed MCP state reconcile after a runtime change, and Hermes installs accept a pinned base platform digest.
   For more information, refer to [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers) and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - OpenClaw local CLI pairing restores its previous connection path so a local sandbox reconnects without re-pairing.

docs/changelog/2026-07-14.mdx

@@ -69,4 +69,3 @@ NemoClaw v0.0.82 adds non-destructive sandbox stop and start commands, protects
 - Build and dependency trust boundaries cover more of the sandbox image path.
   Reviewed npm archives now share one production dependency audit, OpenClaw's managed WeChat runtime installs from a NemoClaw-owned offline lock, and the messaging build plan no longer persists in final OpenClaw or Hermes image environments.
   Source and blueprint rebuilds also reuse cached plugin dependency layers.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).

docs/changelog/2026-07-20.mdx

@@ -12,7 +12,6 @@ NemoClaw v0.0.90 keeps managed-image routing identifiers out of secret-shaped bu
   For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - OpenClaw core, Slack, and Microsoft Teams installations now replace reviewed vulnerable transitive packages with integrity-verified remediated versions while retaining the `openclaw@2026.6.10` release pin.
   Archive validation fails closed, and the dependency audit records the remaining reviewed low- and moderate-severity findings.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
 - `credentials reset` now recognizes sandbox attachments from wrapped OpenShell diagnostics, validates each sandbox name, detaches affected sandboxes, and retries provider deletion without exposing credential values.
   For more information, refer to [Credential Rotation](/user-guide/openclaw/security/credential-rotation).
 - OpenClaw WhatsApp status now recognizes the current paired-session path and derives in-process bridge activity from redacted gateway-log evidence.

docs/changelog/2026-07-22.mdx

@@ -34,7 +34,6 @@ NemoClaw v0.0.91 strengthens completed sandbox images, makes rebuild replacement
 
 - Completed OpenClaw, Hermes, and Deep Agents Code images now replace affected `node-tar` installations with reviewed versions and scan the final filesystem before publication.
   Current and historical OpenClaw security-revision verifiers also validate exact dependency versions, resolved archives, integrity metadata, executable identity, and transactional state restoration in constrained containers.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
 - Rebuilds now carry validated local-base trust through Deep Agents Code image preparation, reuse the outer state backup during inner onboarding, and wait for OpenShell to confirm sandbox deletion before removing registry state or creating a replacement.
   These checks prevent rebuild from rejecting its own current base, taking a second backup against stale gateway state, or racing an asynchronous sandbox deletion.
   Rebuild also stops before deletion when a manifest-declared state file cannot be archived unless you pass `--force`.

docs/changelog/2026-08-04.mdx

@@ -46,7 +46,6 @@ It reduces the managed single-node DGX Spark Qwen profile's default memory deman
   For more information, refer to [Set Up WhatsApp](/user-guide/hermes/manage-sandboxes/messaging-channels/set-up-whatsapp), the Hermes [NemoClaw CLI Commands Reference](/user-guide/hermes/reference/commands), and [Configure Corporate CA Trust](/user-guide/deepagents/security/configure-corporate-ca-trust).
 - Managed OpenClaw, Hermes, Deep Agents Code, and MCP discovery images now carry reviewed dependency updates for the release advisory set.
   The changes update locked runtime graphs, remediate private npm dependencies during image assembly, and preserve fail-closed identity and integrity checks.
-  For more information, refer to the [OpenClaw 2026.7.1 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.7.1-dependency-review.md) and [Hermes 0.19.0 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/hermes-0.19.0-dependency-review.md).
 - Affected CLI paths now report invalid enumerated values, unresolved sandbox base images, and changed gateway authority without raw Node.js stack traces.
   Captured output from non-JSON OpenClaw agent commands is inspected for recognized embedded-fallback markers.
   When a marker is present, NemoClaw suppresses the captured transport output, exits with status `1`, and prints the documented recovery commands.

docs/index.yml

@@ -368,12 +368,6 @@ navigation:
               - page: "Trusted Computing Base"
                 path: _build/agent-variants/security/tcb-boundary.openclaw.generated.mdx
                 slug: trusted-computing-base
-              - page: "OpenShell 0.0.72 Compatibility Review"
-                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.openclaw.generated.mdx
-                slug: openshell-0.0.72-compatibility-review
-              - page: "OpenShell 0.0.71 Review"
-                path: _build/agent-variants/security/openshell-0.0.71-gateway-auth-review.openclaw.generated.mdx
-                slug: openshell-0.0.71-gateway-auth-review
               - page: "OpenClaw Controls"
                 path: security/openclaw-controls.mdx
                 slug: openclaw-controls
@@ -720,9 +714,6 @@ navigation:
               - page: "Trusted Computing Base"
                 path: _build/agent-variants/security/tcb-boundary.deepagents.generated.mdx
                 slug: trusted-computing-base
-              - page: "OpenShell 0.0.72 Compatibility Review"
-                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.deepagents.generated.mdx
-                slug: openshell-0.0.72-compatibility-review
           - section: "Reference"
             slug: reference
             collapsed: open-by-default
@@ -1117,12 +1108,6 @@ navigation:
               - page: "Trusted Computing Base"
                 path: _build/agent-variants/security/tcb-boundary.hermes.generated.mdx
                 slug: trusted-computing-base
-              - page: "OpenShell 0.0.72 Compatibility Review"
-                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.hermes.generated.mdx
-                slug: openshell-0.0.72-compatibility-review
-              - page: "OpenShell 0.0.71 Review"
-                path: _build/agent-variants/security/openshell-0.0.71-gateway-auth-review.hermes.generated.mdx
-                slug: openshell-0.0.71-gateway-auth-review
           - section: "Reference"
             slug: reference
             collapsed: open-by-default

docs/reference/commands.mdx

@@ -4708,7 +4708,7 @@ Set them before running `$$nemoclaw onboard`.
 | `NEMOCLAW_SANDBOX_BASE_IMAGE_REFRESH` | `1`, `true`, `yes`, or `on` to enable | Bypasses recorded sandbox base-image resolution metadata during onboarding, recreation, and rebuild. NemoClaw reruns candidate resolution but can still use a compatible image from Docker's local image store. Versioned release candidates that exist locally but fail validation are refreshed from the registry once during normal resolution. This setting does not discard onboarding session state. |
 | `NEMOCLAW_SANDBOX_BASE_LOCAL_BUILD` | unset or `auto` (default); `1`, `true`, `yes`, or `on` to enable; `0`, `false`, `no`, or `off` to disable | Controls whether base-image resolution may build a compatible image locally. The default allows builds during normal CLI runs and disables them when `NODE_ENV=test` or `VITEST=true`. When source inputs or a missing/incompatible release-version base require a fresh build, disabling local builds makes resolution fail instead of using an unproven image. |
 | `NEMOCLAW_DOCKER_GPU_PATCH` | unset, `auto`, `fallback`, `1`, or `0`; other legacy nonzero values remain accepted through `v0.0.x` and will be removed in `v0.1.0` | Selects Linux Docker-driver GPU routing. Unset, `auto`, or `0` uses native OpenShell GPU injection on ordinary native Linux. `fallback` explicitly opts into one native attempt followed by one bounded compatibility retry when trusted host evidence identifies a GPU-routing failure. `1` and legacy nonzero values select the compatibility patch from the outset. Docker Desktop WSL and Jetson/Tegra use the compatibility path by default; Docker Desktop WSL ignores `0`, while Jetson/Tegra accepts `0` only as a troubleshooting override that bypasses device-group propagation. |
-| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | This setting explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run; use it only on a trusted local host because it uses host networking and mounts the Docker socket read-only even though the socket still exposes the privileged Docker API; prefer OpenShell 0.0.101's directly supported glibc 2.39+ path; see the [OpenShell gateway compatibility review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for the unchanged container boundary. |
+| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | This setting explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run; use it only on a trusted local host because it uses host networking and mounts the Docker socket read-only even though the socket still exposes the privileged Docker API; prefer OpenShell 0.0.101's directly supported glibc 2.39+ path; see [Gateway Compatibility Container](/user-guide/openclaw/security/security-controls/gateway-authentication-controls#gateway-compatibility-container) for the container boundary and removal conditions. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_BIN` | path | Advanced override for the `openshell-gateway` binary used by Linux Docker-driver startup. For the default port, the installer accepts the binary under an absolute `XDG_BIN_HOME` when set, otherwise `~/.local/bin/openshell-gateway`; it also accepts `/usr/local/bin/openshell-gateway` or `/usr/bin/openshell-gateway`. Another path fails service staging. The macOS Homebrew service uses the formula's binary. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_SANDBOX_BIN` | path | Advanced override for the `openshell-sandbox` binary used by Linux Docker-driver startup. The macOS Homebrew service uses the formula's driver layout. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR` | path | Advanced override for the Linux Docker-driver gateway SQLite state directory and standalone-fallback PID file. Defaults to `~/.local/state/nemoclaw/openshell-docker-gateway`. |