Release Notes

NemoClaw v0.0.125 strengthens Hermes Portable recovery, OpenShell gateway authority, and onboarding finalization. It also improves sandbox transfers, native Podman and OpenClaw networking, and the release validation pipeline.

• Hermes Portable interactive connect and launch can recover the exact stopped managed Ollama runtime after the recorded route becomes unavailable. Forward recovery now allows 30 seconds for verification and 60 seconds for the complete transaction, while retaining the original structured failure when cleanup cannot be proved. Related changes: PR #11759 and PR #11735. For more information, refer to Recover and Rebuild Sandboxes, Set Up Ollama, and the Hermes CLI Commands Reference.
• The Hermes nemoclaw-acp adapter can select and, when required, start only its exact recorded OpenShell gateway when it is missing, unhealthy, or unreachable, or when a different gateway is connected. Conflicting or ambiguous gateway identities, authentication errors, schema failures, timeouts, and other observation failures stop recovery before gateway startup or ACP session creation. Related changes: PR #11691 and PR #11681. For more information, refer to the Hermes CLI Commands Reference and Recover and Rebuild Sandboxes.
• Onboarding preserves process-inspection and secret-boundary refusals as incomplete, resumable state instead of reporting a ready sandbox. Experimental version 2 external-component activation evidence now accepts the same namespaced component IDs as registration while continuing to reject the reserved openshell/ prefix and malformed evidence. Related changes: PR #11760 and PR #11745. For more information, refer to the NemoClaw CLI Commands Reference, Troubleshooting, and Register an External Component During Onboarding.
• Legacy OpenShell upgrade recovery preserves the recorded gateway, sandbox identity, workspace, and digest-verified pre-upgrade policy when live provider inspection is unavailable. Portable Hermes lifecycle and onboarding operations now await live policy reads and revalidate authority before startup, publication, restoration, or uninstall effects. Related changes: PR #11612 and PR #11585. For more information, refer to Recover and Rebuild Sandboxes and Recover and Rebuild Sandboxes for Hermes.
• Sandbox upload and download commands now await typed OpenShell transfers on the sandbox’s recorded gateway. The lifecycle lock and owned staging remain active until transfer, verification, publication, and cleanup settle, while existing terminal output and exit behavior remain unchanged. Related change: PR #11496. For more information, refer to the NemoClaw CLI Commands Reference.
• Managed OpenClaw now uses its native sandbox-local loopback endpoint by default and no longer depends on private-interface discovery, insecure private WebSockets, or a dedicated gateway dialback policy. Native Podman onboarding accepts the standard rootless socket layout when a private current-user directory prevents access by other users, while unsafe reachable sockets remain blocked. Related changes: PR #11695 and PR #11730. For more information, refer to Network Policies, System Readiness, and Troubleshooting.
• Protected managed-image qualification now retains bounded, redacted failure evidence and completes rollback in OpenShell-before-Docker order. Lifecycle changes trigger the corresponding activation and publication gates, platform runs retain per-commit evidence, isolated jobs initialize their gateway before owned cleanup, transient tool downloads retry, and obsolete or overly broad E2E fixtures have been removed or narrowed. Agent-alias and onboarding probes also run independent cases concurrently without reducing assertions. Related changes: PR #11713, PR #11663, PR #11607, PR #11769, PR #11742, PR #11743, PR #11588, PR #11708, and PR #11704.
• PR Review Advisor accepts unresolved required E2E coverage when no runnable selector exists, requires a nonempty read of each declared evidence file, and records bounded tool-flow metadata for failed turns without exposing arguments, paths, or untrusted names. Related changes: PR #11773, PR #11762, and PR #11728.
• Internal messaging declarations with no active consumer have been removed without changing channel manifests or runtime behavior. The source scan configuration also recognizes the checksum-pinned Hermes documentation search key through one exact, read-only allowlist entry. Related changes: PR #11705 and PR #11740.

NemoClaw v0.0.124 updates the managed OpenShell runtime to 0.0.116 and improves upgrades, local inference, and sandbox recovery. It also restores interactive Deep Agents Code execution features and improves agent message handling.

• Upgrade recovery now waits for the replaced packaged gateway to bind before recovering sandboxes. Failed required pre-upgrade backups no longer leave incomplete directories that appear to be recovery points; failed cleanup reports the retained path. Rebuild also preserves the recorded serving-profile selection instead of losing it during recreation. Related changes: PR #11251, PR #11710, PR #11589, and PR #11686.
• Named sandbox commands now use the sandbox’s recorded gateway across gateway-port registry roots. Portable Hermes recovery reconciles a saved stopped OpenShell state and repairs required forwards. If forward startup fails, recovery removes only forwards it started and reports cleanup it cannot verify. Interactive launch releases lifecycle locks after dispatch so other lifecycle commands can proceed during the session. Related changes: PR #11445, PR #11668, PR #11670, and PR #11657.
• llama.cpp selection uses the authenticated server’s served context window when no valid explicit override is set. Docker Desktop on WSL checks the host-loopback listener from the WSL CLI process before the sandbox bridge check. Unsupported inference-provider errors list supported providers on the selected gateway, with a supported-provider fallback when discovery fails. Related changes: PR #11544, PR #11444, and PR #11464.
• Interrupted managed vLLM installation can replace a running container only when its ownership, local Docker connection, and port mapping match the requested installation. Other port holders remain protected. N1x preview rebuild accepts a retained canonical managed endpoint with the recorded preview decision. Related changes: PR #11587 and PR #11580.
• Native Linux Docker OpenClaw configuration export accepts the verified Ollama route created during ordinary onboarding. It requires the managed proxy credential and omits its value from the export. Stopping an Ollama sandbox no longer retains its model solely because a matching sibling is stopped or incomplete. An unverified sibling state prevents model unload and makes stop exit nonzero. Related changes: PR #11550 and PR #11656.
• Managed Deep Agents Code interactive sessions restore native local shell, startup-command, and interpreter behavior inside the OpenShell sandbox. Headless shell execution remains disabled, and headless non-shell tools retain automatic approval. Non-interactive reply handling and pre-session inference verification also improve. Related changes: PR #11683, PR #11276, and PR #11546.
• Agent message dispatch preserves piped input and avoids waiting on idle standard input when a message is already supplied. Managed OpenClaw heartbeats use isolated sessions to avoid changing the main conversation. Related changes: PR #11382 and PR #11487.
• Fresh interceptor-based providerless onboarding now leaves OpenClaw and Hermes without an inference route until a managed provider is configured. Version 2 external-component declarations remain unqualified against a released OpenShell runtime and must not be relied on in an installed release. Related changes: PR #11584, PR #11633, and PR #11525.
• Discord setup rejects the literal bot-token placeholder before configuring the channel. Uninstall failures caused by unavailable Docker now explain how to restore access and retry while preserving gateway state. Fatal messaging-build and npm remediation diagnostics redact sensitive process details. Related changes: PR #11404, PR #11474, and PR #11674.

NemoClaw v0.0.123 expands configuration export for managed OpenClaw and Hermes sandboxes. It adds an experimental external-component onboarding contract and improves installer recovery, sandbox lifecycle handling, and inference diagnostics.

• nemoclaw config export now exports canonical managed Hermes sandboxes, including verified API-key authentication and nondefault interface settings. OAuth authentication and Hermes tool gateways remain outside the export contract. Related changes: PR #11323, PR #11450, and PR #11477. Refer to the NemoClaw CLI Commands Reference.
• OpenClaw configuration export now preserves managed Brave Search references, proxy settings, hosted inference tuning, execution settings, dashboard settings, direct tool disclosure, and local conversation diagnostics. It also supports one read-only secondary agent that shares the primary hosted inference route. Local Ollama export preserves verified daemon and proxy ports. Export verifies live and retained configuration evidence and writes credential references instead of secret values. Related changes: PR #11384, PR #11387, PR #11383, PR #11429, PR #11430, PR #11431, PR #11473, and PR #11478. Refer to the NemoClaw CLI Commands Reference for the supported export profiles and their limits.
• Fresh onboarding on Linux can register one experimental external host component with a NemoClaw-managed Docker-driver gateway. NemoClaw validates the declaration before gateway changes and verifies sandbox identity and effective policy before activation. Failed or ambiguous activation preserves the sandbox and records incomplete state; resume and automatic activation retries are unsupported. NemoClaw does not manage the component service or its credentials. Related changes: PR #11366 and PR #11471. Refer to Register an External Component During Onboarding.
• The installer now attempts existing sandbox recovery before generic host admission and preserves each sandbox’s recorded GPU selection. It distinguishes confirmed recovery from missing sandboxes or unconfirmed recovery output, and reports warnings instead of claiming complete recovery. Fresh onboarding and required DGX Station reconciliation still require host admission. Related change: PR #10397. Refer to Update Sandboxes.
• Sandbox status now distinguishes an intentional stop from a failure, and connect directs you to start a stopped sandbox. Portable Hermes start, stop, and recovery use OpenShell for lifecycle changes and verify the receipt-owned Podman container afterward. Portable lifecycle operations share the same lock authority, including the host fence during startup. Related changes: PR #11211, PR #11336, PR #11482, and PR #11490. Refer to Recover and Rebuild Sandboxes.
• NVIDIA Endpoints validation now checks the selected inference route. Onboarding and sandbox status identify the account-access cause when NVIDIA returns a matching model-access 404, without exposing the response body in status diagnostics. Docker readiness failures identify authority conflicts, and GPU-mode probe failures retain the Docker failure reason. Non-interactive onboarding resolves the sandbox name before provider selection. Related changes: PR #10957, PR #11393, PR #11280, and PR #11442. Refer to Verify the Sandbox Inference Route and System Readiness.
• Removing Teams now removes Teams-owned Microsoft login credential bindings from matching Outlook policy endpoints. It refuses to remove bindings owned by another integration. Related change: PR #10846. Refer to the NemoClaw CLI Commands Reference.

NemoClaw v0.0.122 improves host detection and local inference selection for Docker, DGX Station, and N1x WSL. It also strengthens interrupted onboarding, Hermes Portable lifecycle recovery, configuration export, remote dashboard access, and uninstall failure reporting.

• Host readiness now runs Docker probes with the environment that later Docker commands use. It respects the selected Docker context and configuration, rejects unsafe explicit endpoints, and can select the rootless Linux socket after an unreachable default authority. DGX Station checks now separate GB300 hardware identity from the qualified software profile and apply the same classifier during host preparation and onboarding. Related changes: PR #10379 and PR #10914. For more information, refer to System Readiness and Prepare a DGX Station.
• A CUDA-qualified N1x WSL host now selects the managed Qwen llama.cpp profile instead of falling back to the smaller Ollama profile. A resumed preset-driven managed vLLM installation verifies the recorded model and serving preset before it changes runtime state. A mismatch stops onboarding and directs you to restart with nemoclaw onboard --fresh. Related changes: PR #11078 and PR #11271. For more information, refer to Choose a Local Inference Server, Set Up llama.cpp, and Set Up vLLM.
• Interrupted onboarding now releases its process lock and abandons an uncommitted inference-route reservation before a later resume. Final handoff keeps incomplete sandbox identity available for recovery and does not report success when replacement onboarding exits nonzero. The global nemoclaw doctor command remains available without a sandbox name, including when a registered sandbox is named doctor. Related changes: PR #11140, PR #11205, PR #11218, and PR #11296. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• Hermes Portable onboarding now records the selected OpenShell gateway for later recovery and uninstall operations. Start and recovery repair the receipt-owned host forwards before reporting readiness, while stop retries an incomplete identity observation within its bounded settlement policy. Upgrade recovery preserves the Portable lifecycle and forward identities instead of replacing them with ambient gateway state. Related changes: PR #11034, PR #11266, and PR #11312. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• nemoclaw config export now supports native NVIDIA hosted inference only when the gateway uses the built-in nvidia-prod profile, its default endpoint, and no provider configuration overrides. Missing or inconsistent provider evidence stops the export without writing a configuration document. Related changes: PR #11065 and PR #11318. For more information, refer to the NemoClaw CLI Commands Reference.
• Neutral managed OpenClaw images no longer declare the uninstalled Tavily plugin. This removes recurring plugin not installed: tavily warnings when Tavily Search was not selected, while explicitly selected Tavily configuration remains unchanged. Related change: PR #10331. For more information, refer to Troubleshooting.
• Remote dashboard access now keeps an external CHAT_UI_URL separate from the host forward bind. A reverse proxy or tunnel can reach the loopback forward while the URL configures the browser origin and Host-header validation. Direct access on a non-WSL host requires NEMOCLAW_DASHBOARD_BIND=0.0.0.0 before onboarding and for later nemohermes <sandbox> connect calls. Protect the dashboard and API ingress before exposing either service. Related change: PR #10931. For more information, refer to Quickstart with Hermes and Gateway Authentication Controls.
• The installer now refuses an implicit NemoClaw CLI downgrade and reports the installed and requested versions before it changes the installation. Uninstall exits nonzero when it cannot remove the gateway registration, so automation does not treat partial cleanup as success. Related changes: PR #11209 and PR #9860. For more information, refer to Update Sandboxes and Uninstall NemoClaw.

NemoClaw v0.0.121 adds managed MCP tool-denial rules and moves skill lifecycle to agent-owned state. It also hardens messaging providers, Windows and WSL inference, sandbox recovery, file transfer, and Hermes state repair.

• Managed MCP servers can now deny exact tool names or glob patterns through repeatable --deny-tool options. The new mcp update command replaces the complete denied-tool list or clears it with --clear-deny-tools. Status, restart, rebuild, and launch-readiness checks use the persisted rules and report drift with a recovery command. Related change: PR #11135. For more information, refer to Add an MCP Server, Manage MCP Servers, and Troubleshoot MCP Servers.
• Skill lifecycle state now belongs to the selected agent instead of a parallel NemoClaw inventory. skill list streams the agent’s native result, while install and remove use native commands when the agent exposes an equivalent operation. Other operations use the manifest-declared writable skill directory without claiming that a same-name skill elsewhere is absent. Related change: PR #11093. For more information, refer to Understand Sandbox State and the NemoClaw CLI Commands Reference.
• Messaging provider setup now uses typed OpenShell lifecycle results for registration, reuse, authorized replacement, attachment, refresh observation, and partial-failure recovery. Typed lifecycle results include credential names but never credential values, and channel removal omits placeholder credentials that were never configured. Channel stop and start now preserve credentials and runtime configuration through rebuild and stopped-sandbox restart. Related changes: PR #11009, PR #11126, PR #11188, and PR #11193. For more information, refer to Manage Messaging Channels and Credential Storage.
• A CUDA-qualified WSL RTX Spark N1x with at least 30,000 MiB available now ranks an installed qwen3.6:35b before qwen3.5:9b for Ollama. Windows Ollama onboarding and restart keep traffic in Docker Desktop’s verified network context and restore the previous User-scope binding and process state when a transaction fails. Recovery also reports bounded probe-timeout guidance instead of leaving the route failure ambiguous. Related changes: PR #11187, PR #10855, PR #10889, and PR #11192. For more information, refer to Set Up Ollama, Prepare Windows, and System Readiness.
• Inference provider creation, update, deletion, inspection, settlement, and rollback now use the typed OpenShell provider boundary. Mutations fail closed when ownership or revision identity is incomplete, and rollback verifies the provider revision before deletion. inference get reports a reusable endpoint for compatible custom providers only when persisted metadata is safe, complete, and unambiguous. Status distinguishes the configured model from the live routed model and requires verified llama.cpp routes. Related changes: PR #11008, PR #10833, PR #10261, PR #10471, and PR #11207. For more information, refer to Switch Inference Providers and the NemoClaw CLI Commands Reference.
• Sandbox download now rejects a directory that contains a symbolic link or another special file before transfer or host destination creation. Snapshot and rebuild recovery preserve fail-closed identity checks, recover an interrupted backup, and reject unsafe local fallback images. A retained sandbox is removed only after its gateway confirms absence and residual resources have sufficient identity evidence. Related changes: PR #10654, PR #11142, PR #11094, and PR #10867. For more information, refer to Transfer State Manually, Recover and Rebuild Sandboxes, and Troubleshooting.
• Hermes startup now repairs restored session, gateway, runtime, history, and log state through descriptor-verified paths before the gateway opens them. It rejects symbolic-link and file substitutions without changing their targets, and it keeps mutable runtime configuration outside relaunch policy. Hermes diagnostics also preserve invalid dashboard URL details and initialize the Kanban schema atomically. Related changes: PR #10872, PR #11110, PR #11227, and PR #11177. For more information, refer to Recover and Rebuild Sandboxes, Gateway Lifecycle Control, and Troubleshooting.
• Onboarding now fails before sandbox mutation when a managed-image flow cannot honor a configured base-image override. GPU handoff resumes from validated checkpoints, managed vLLM avoids repeated retries after a rejected pinned image, and Gemini HTTP 400 failures include provider-specific recovery guidance. Related changes: PR #11152, PR #11124, PR #11048, and PR #11171. For more information, refer to the NemoClaw CLI Commands Reference, Set Up vLLM, and Use Google Gemini.
• Managed OpenClaw and Hermes recovery now waits within a 210-second budget for a typed delayed managed-container discovery result. Other privileged-control, identity, and diagnostic failures remain terminal. Hermes Portable recovery reports failed host-forward operations and does not publish readiness after a failed repair. Related change: PR #11236. For more information, refer to Recover and Rebuild Sandboxes.
• Hermes rebuild now preserves supported configuration values recorded through nemohermes <name> config set. It excludes gateway settings, managed inference-route fields, and credential material, verifies restored values, and lists restored and dropped keys. Capture failures stop before deletion; restore or verification failures retain recovery state and exit nonzero. Related change: PR #10780. For more information, refer to Rebuild While Preserving State.

NemoClaw v0.0.120 adds secret-free verified configuration export and a global host and gateway doctor. It updates the supported Hermes runtime to 0.20.6, retires Shields from NemoClaw core, and moves managed host forwarding to OpenShell service forwarding. It also hardens sandbox recovery, onboarding, inference validation, MCP lifecycle operations, mTLS selection, and credential-bound messaging policy.

NemoClaw v0.0.119 adds an explicitly selected native rootless Podman runtime path and an experimental managed llama.cpp path for qualifying Windows WSL N1x hosts. It hardens custom network policy, WeChat redirect, Langfuse, MCP credential, and messaging-rebuild boundaries. It also improves local inference selection, Hermes recovery, interrupted-install guidance, and sandbox command behavior, and updates reviewed production dependency graphs to remove four high-severity fast-uri advisories.

NemoClaw v0.0.118 adds headless package boundaries for Hermes lifecycle planning and credential-free external OpenShell gateway health checks. It improves fail-closed sandbox destruction, rebuild, onboarding, Shields, inference, and Hermes recovery. It also broadens Deferred N1x detection and gives N1x managed vLLM a dedicated serving profile.

• The new nemoclaw/lifecycle package export supports deterministic Hermes 0.19.0 lifecycle planning and read-only agent observation with OpenShell 0.0.106. Callers provide the observation capability; the package does not own transport, authentication, persistence, or mutation. The Blueprint Runner can also check a configured external OpenShell gateway through the pinned SDK without credentials or mutation. Related changes: PR #10703 and PR #10618.
• OpenClaw sandbox destruction now detects Shields-locked Mcporter configuration before mutation and provides recovery guidance. destroy --force can continue only for retained OpenClaw Mcporter entries, while Hermes and ordinary MCP mutations remain fail-closed. Related change: PR #10483.
• Rebuild now stops before deleting the original sandbox when any declared state directory or file cannot be preserved, including with --force. When cleanup fails, NemoClaw retains the incomplete snapshot at the reported path. It excludes the snapshot from snapshot list and restore selection. The directory can contain unsanitized credentials. Keep it owner-only. Do not restore, copy, share, or edit it. Repair access to the original sandbox state. Remove the retained directory only after you verify that the original sandbox or a complete snapshot contains every required state item. Confirm that the reported path is absent. Then rerun the operation. A failed nested onboarding result no longer proceeds to restore or report success. Related changes: PR #10686 and PR #10590.
• Fresh onboarding now ends the OpenShell create handoff after receiving a validated durable sandbox ID, then settles and verifies identity before post-create effects. This prevents affected WSL2 ARM OpenClaw sandboxes from moving from Ready to Error while publication metadata is still settling. Related change: PR #10789.
• Hermes stopped-sandbox recovery reuses verified lifecycle and inference state. It still rolls back failures and performs final readiness qualification. Hermes dashboards behind a reverse proxy also accept the hostname from a validated HTTPS CHAT_UI_URL for HTTP and WebSocket requests while remaining bound to loopback. Related changes: PR #10641 and PR #10687.
• Inference status now queries the selected gateway instead of implicitly using the default gateway. Hugging Face model downloads with no output abort after a bounded stall timeout. Managed vLLM accepts a catalog short name, full Hugging Face model ID, or registered served model name as aliases for the same model. Onboarding normalizes known aliases when it reuses an existing managed vLLM endpoint, while pull-request CI verifies pinned Hugging Face references without credentials. Related changes: PR #10698, PR #10352, and PR #10429.
• Shields status for Hermes now remains read-only instead of repairing mutable state during observation. Related change: PR #10710.
• DGX Station Express host preparation now ignores NemoClaw and OpenShell agent processes owned by another user for non-root and sudo controllers. It still blocks the controller agent processes and keeps direct-root agent checks, vLLM conflicts, and Docker conflicts host-wide. Related change: PR #10689.
• Deferred N1x preview detection now accepts NVIDIA display-class GPUs without requiring one PCI device ID and recognizes OEM DGX Spark FastOS identity. v0.0.118 introduced a dedicated N1x Qwen3.6 35B NVFP4 serving profile with its original memory, context, concurrency, and batching envelope physically exercised. For the current limits and validation status, refer to Set Up vLLM. N1x remains Deferred pending complete Express end-to-end validation. Related changes: PR #10099, PR #10721, and PR #10625.

NemoClaw v0.0.117 makes OpenShell the sole durable network-policy authority. It improves fail-closed recovery for sandboxes, Shields, the installer, Portable runtimes, and messaging channels. It also removes the deprecated Brev deploy wrapper and adds contributor and maintainer analysis tools.

• OpenShell is now the sole durable source of sandbox policy state. NemoClaw policy commands and Shields operate on the live OpenShell policy without storing a second desired-policy copy, while rebuild carries the current policy through one private, temporary handoff. Legacy policy fields are removed from NemoClaw state without changing the live policy. Related change: PR #10515.
• Failed onboarding cleanup now retains immutable sandbox, gateway, policy, and create-attempt evidence. While OpenShell still reports the sandbox live, destroy preserves recovery instead of deleting by mutable name. After OpenShell confirms absence, NemoClaw removes only containers that match the retained immutable identity and verifies their absence before clearing recovery state. Related change: PR #10571.
• The OpenClaw memory secret scanner now covers writes under absolute named-workspace paths such as /sandbox/.openclaw/workspace-main/. Project directories whose names start with workspace- remain outside the memory-path classification unless they are under the OpenClaw state directory. Related change: PR #10527.
• Hermes activation and Shields recovery now bind release acknowledgement, writer rescans, root-broker cleanup, and completed auto-restore lock retirement to exact process and transaction identities. Transient replaced writers are reconsidered under fresh identity, while live, foreign, durable, or ambiguous identity remains denied. Related changes: PR #10272, PR #10597, and PR #10603.
• macOS upgrades can retire an identity-verified legacy OpenShell gateway or Homebrew service before selecting the checksum-verified replacement binaries. Managed startup also transfers protected receipts through read-only Docker volumes, so VM-backed Docker daemons such as Colima do not need access to a client-only temporary path. Failed verification retains the recovery receipts, and successful finalization reports any exact volume that cleanup cannot remove. Related changes: PR #10484 and PR #10534.
• Hermes Portable connect --probe-only now recovers published Ollama only for the ollama-local provider. Descriptor-backed compatible endpoints keep verification-only routing without requiring an Ollama receipt. Routine recovery reuses a healthy published runtime or performs one lifecycle recovery for a stopped runtime before it proves published Ollama readiness. Onboarding and explicit deep validation retain generated completion, tool-call, and model-placement qualification. OpenClaw Portable recovery uses one bounded in-sandbox gateway observer and a shorter OpenShell registration poll while preserving the existing readiness statuses and outer lifecycle deadline. Related changes: PR #10556, PR #10612, and PR #10614.
• Experimental OpenClaw WeChat setup now writes the exact revision-scoped OpenShell placeholder to the Tencent plugin account file and binds both authorized iLink endpoints to the channel provider. Channel removal clears durable account state before provider, policy, or registry teardown, and raw bot tokens remain outside sandbox files, process arguments, and diagnostics. Related change: PR #10601.
• The deprecated nemoclaw deploy Brev compatibility command has been removed. Remote hosts use their provisioning workflow, the hosted installer, and nemoclaw onboard; deploy is now available as a sandbox name. Related change: PR #10576.
• nemoclaw <name> logs now labels OpenClaw gateway lines with [gateway] and keeps existing OpenShell source tags unchanged. Follow mode bounds incomplete-line memory, honors output backpressure, waits for accepted writes, and reports source failures. Related change: PR #10342.
• Contributors with a prepared checkout can run the checked-in PR Review Advisor specialists on committed and working-tree changes with npm run review:local before PR publication. The local-run prerequisites name the required host tools, the origin/main trust base, and the credential boundary. Hosted specialist jobs publish completed analyses in their GitHub job summaries. Maintainer analysis now emits bounded slow-test evidence and Perfetto-compatible PR lifetime traces with revision, readiness, review-request, workflow, job, and step timelines. Related changes: PR #10581, PR #10604, PR #10608, PR #10611, PR #10616, PR #10617, and PR #10623.
• Development qualification now contains a provider-owned record and dormant executor for the OpenShell v0.0.24 and MXC v0.7.0-rc1 checkpoint on physical Windows. NemoClaw does not register or select MXC, expose Windows onboarding, activate this executor, or treat the checkpoint as an accepted stable distribution. Related changes: PR #10591 and PR #10596.

NemoClaw v0.0.116 improves compatible endpoint validation, Portable Hermes inference recovery, sandbox lifecycle safety, managed images, Windows Subsystem for Linux (WSL) onboarding, managed local inference, and experimental Hermes channel credentials. It also preserves recorded network-policy intent during sandbox reuse and rebuild.

• OpenClaw compatible endpoint onboarding now validates inference.local from inside the sandbox even when no messaging channel is selected, and an unreachable route stops onboarding before final deployment verification. inference set can reuse a recorded loopback no-auth endpoint without replacing its provider, and reasoning-only responses receive one bounded larger-budget content attempt before failure. Related changes: PR #10458, PR #10531, and PR #10540.
• nemohermes <name> recover and nemohermes <name> connect --probe-only now recover only the published receipt-owned Portable Ollama runner. They verify an already-running runner without restarting it, resume the recorded stopped runner once, and require a final in-sandbox route proof. If a later check fails, recovery attempts to return the stopped runner and registry to their prior state and reports when either restoration cannot be proved. Related change: PR #10505.
• Uninstall now creates fresh snapshots for eligible registered non-Portable sandboxes before deletion unless --destroy-user-data is selected. It honors NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR, preserves abandoned Portable configuration without treating it as lifecycle authority, and stops before cleanup when backup, lifecycle-lock, ownership, or registration checks fail. Related changes: PR #10231, PR #10550, and PR #10562.
• Sandbox creation and reuse now retain verified sandbox identity, policy, provider, credential, and lifecycle authority across retries and process restarts. Same-name replacements and authority drift stop mutation, while managed-image registration tolerates a transient non-Ready report only when durable sandbox identity still matches. Related changes: PR #10510 and PR #10512.
• Sandbox destruction can recover an expired Shields auto-restore timer only when its process is gone or its recorded start identity no longer matches. Live or unverifiable timer ownership remains fail-closed, and destruction skips pre-delete hardening only after Docker proves the sandbox container is absent. Related change: PR #10225.
• Hermes Portable images now select the reviewed multi-platform base that matches their OpenSSL 3.5.7 package inventory, and OpenClaw images install checksum-pinned libevent 2.1.13 on AMD64 and ARM64. Related changes: PR #10532 and PR #10526.
• On WSL, public managed image pulls, generated image builds, GPU probes, and local inference probe pulls use a temporary credential-free Docker configuration when the default Docker Desktop credential helper is unavailable. Managed local inference now waits for disposable Podman probe identities to disappear after one removal command, and llama.cpp image-pull failures report a fixed layer, code, and exit status without exposing raw pull output. Related changes: PR #10470, PR #10554, and PR #10561.
• Re-onboarding or rebuilding an OpenClaw sandbox with a recorded Balanced or Open tier now keeps an already-applied brave preset when web search is disabled or switched to Tavily Search. Restricted and unknown tiers, unsupported agents, and custom preset ownership retain their existing fail-closed reconciliation behavior. Related change: PR #10457.
• For the experimental Hermes WeChat and Microsoft Teams channels, managed startup now maps revision-scoped OpenShell credential placeholders to the environment names Hermes reads. Only matching revision-scoped placeholders are copied. Raw or identityless runtime values are ignored, while malformed or channel-unbound aliases stop startup; both channels remain experimental. Related change: PR #10563.

NemoClaw v0.0.115 strengthens Portable Hermes recovery, sandbox lifecycle authority, managed messaging credentials, and installer recovery. It also improves managed local inference and adds bounded experimental planning for an externally managed OpenShell target.

• Portable Hermes recovery now revalidates the exact receipt-owned Podman container, OpenShell gateway, executable, policy, route, and runtime identities before each operation. If recovery starts a stopped receipt-owned container and authenticated Hermes health remains unavailable, it launches the receipt-recorded nemoclaw-start command once and waits for authenticated health. If the container was already running, recovery only waits for authenticated health and does not launch another startup process. A failed recovery rolls back only the exact container that recovery started. Related changes: PR #10315, PR #10376, PR #10441, PR #10456, and PR #10499.
• Stock Docker-driver onboarding for OpenClaw, Hermes, and LangChain Deep Agents Code now requires the release’s exact managed image. Registry or catalog failures stop before sandbox creation instead of falling back to a local stock-image build; explicit custom Dockerfiles remain separate. Existing and recreated sandboxes retain exact image, policy, route-reservation, and lifecycle authority checks. Related changes: PR #10113, PR #10320, PR #10321, PR #10322, PR #10332, PR #10396, and PR #10422.
• Messaging setup now binds revision-scoped credentials to canonical OpenShell providers before sandbox creation or rebuild. This restores runtime credential delivery for maintained Slack, Discord, Google Chat, and Telegram paths while preserving endpoint-specific policy matching and fail-closed provider ownership. Related changes: PR #10170, PR #10271, PR #10273, PR #10275, PR #10277, PR #10307, and PR #10314.
• The Hermes installer accepts --defer-onboarding or NEMOCLAW_DEFER_ONBOARDING=1 only for NVIDIA-hosted inference when no supported credential and no sandbox exist. It installs NemoClaw and Hermes without creating a provider, sandbox, or completed onboarding state; any credential or existing sandbox keeps the normal validation and recovery path. Related change: PR #10299.
• The experimental managed llama.cpp path now offers NVIDIA Nemotron 3 Nano 30B-A3B on qualified DGX Spark Arm64 and Linux x86_64 NVIDIA GPU hosts and recommends it during onboarding. Meta Muse Glimmer remains available on DGX Spark only by explicit selection, and existing Muse-owned installations are not migrated. Local NVIDIA NIM selection now enforces the documented usable-memory limit, including the DGX Spark unified-memory cap. Related changes: PR #10122 and PR #10292.
• nemoclaw upgrade-sandboxes --check now exits nonzero when it reports actionable stale, unknown-version, backup-recovery, or missing-sandbox state. Sandbox destruction and stale-container cleanup have bounded waits and preserve registry or lifecycle authority when deletion cannot be confirmed. Non-portable managed Hermes uninstall also removes its exact owned state volume and stops before state retirement on Docker failure. Related changes: PR #10128, PR #10133, and PR #10224.
• The experimental direct blueprint runner can validate and sanitize a plan for an externally managed OpenShell target. Planning validates the HTTPS endpoint, workspace, expected release range, CA bundle, and authentication-file metadata without reading credential contents, connecting to the gateway, authenticating, or applying changes. Related change: PR #10045.
• Security and diagnostics now reject config reads through a symlinked config directory, redact URL userinfo credentials in debug bundles, bind sandbox mutations and cancellation recovery to durable exact identity, and classify incomplete onboarding without reporting success. Related changes: PR #10041, PR #10127, PR #10146, and PR #10396.

NemoClaw v0.0.114 adds deterministic read-only MCP tool calls for LangChain Deep Agents Code and per-stage launch-readiness probe timing. It strengthens destructive-operation warnings, session export cleanup, sealed configuration recovery, and installation verification. It also improves managed local inference, Portable and Hermes onboarding, image provenance, and release documentation automation.

NemoClaw v0.0.113 improves sandbox and onboarding recovery across interactive connections, Hermes, Portable, policy changes, and local adapters. It adds experimental Hermes Google Chat support while keeping the service-account private key outside the sandbox. It also changes the Google Gemini default, strengthens managed image publication, and improves E2E diagnostics.

NemoClaw v0.0.112 strengthens managed local inference across vLLM, llama.cpp, Ollama, and routed provider recovery. It improves Portable and sandbox lifecycle recovery, MCP credential republishing, messaging continuity, and Shields ownership cleanup. It also tightens release provenance, E2E qualification, contributor review automation, and dependency compatibility.

NemoClaw v0.0.111 extends the explicit experimental Portable profile with receipt-owned Hermes lifecycle authority and a fixed host-gateway and registry network topology. It makes Shields recovery, sandbox rebuilds, provider routing, and messaging bootstrap more diagnosable and less likely to leave ambiguous state. It also improves headless and local-inference onboarding, managed gateway recovery, uninstall cleanup, and release qualification.

NemoClaw v0.0.110 adds an Experimental managed llama.cpp profile for Meta Muse Glimmer 30B on one DGX Spark and requires native tool-use evidence from custom Anthropic-compatible endpoints. It strengthens the explicit experimental Portable OpenClaw path with rootless Podman lifecycle authority, CPU-delegation preflight, and receipt-bound uninstall. It also improves onboarding recovery, local inference diagnostics, messaging and policy cleanup, backup and uninstall safety, and release qualification.

NemoClaw v0.0.109 adds credential-free launch-readiness leases, an editable onboarding review, a distinct OpenAI-compatible API port for each Hermes sandbox, and selectable Hermes WhatsApp reply modes. It also adds a Deferred N1x Express preview for one-host managed vLLM while N1x remains outside the supported-platform set. It improves inference health reporting, local inference discovery, onboarding recovery, sandbox startup, messaging status, and uninstall behavior. It also strengthens managed images, Deep Agents Code login probes, Shields transitions, gateway lifecycle authority, and release qualification.

NemoClaw v0.0.108 adds read-only host mounts and an Experimental Muse Glimmer profile for one DGX Spark. It improves onboarding recovery, messaging credential rotation, inference validation, MCP registration, snapshots, and Hermes configuration. It also strengthens managed images, gateway credentials, runtime state, and release qualification.

• On Linux and Windows Subsystem for Linux 2 (WSL2), nemoclaw onboard --host-mount <host:/sandbox/path> can now expose an existing host directory read-only beneath /sandbox. NemoClaw validates each source, destination, and symlink boundary before mutation. It persists accepted mounts across nemoclaw <sandbox> rebuild and interrupted onboarding resumed with nemoclaw onboard --resume. The nemoclaw <sandbox> destroy command removes their declaration. The nemoclaw <sandbox> status command reports them. For more information, refer to Understand Sandbox State and the NemoClaw CLI Commands Reference. Related change: PR #8280.
• The explicit-only Experimental Muse Glimmer managed vLLM profile now runs on one DGX Spark with its validated checkpoint, ARM64 image, parser settings, and resource limits. Two-node DGX Spark setup can remediate a Docker storage conflict before launch only when it is the sole blocking readiness finding and the host reports that remediation is available, and strict tool-call validation escalates its bounded token budget through 256, 1,024, and 4,096 tokens before reporting failure. NVIDIA Nemotron 3.5 Lightning guidance also distinguishes the reasoning and max_tokens fields required by direct OpenAI-compatible callers. For more information, refer to Set Up vLLM, Set Up vLLM on Two DGX Sparks, and Understand Provider Validation. Related changes: PR #8802, PR #8814, PR #8839, and PR #8894.
• Onboarding recovery now preserves the selected configuration after review, hides suggestions for incomplete route-only sandboxes, and keeps an already healthy Docker authority. Explicit fresh recreation, repeated Docker recreation, dashboard port reservation, unavailable-provider guidance, decorated OpenShell readiness output, and readiness handoffs now converge through the same bounded lifecycle authority. The recovery path also handles registered messaging routes, empty dashboard URLs, managed runtime ownership, OpenClaw MCP workspace state, and LangChain Deep Agents Code re-onboarding verification without masking terminal failures. For more information, refer to Recover and Rebuild Sandboxes, System Readiness, and Troubleshooting. Related changes: PR #8724, PR #8820, PR #8823, PR #8842, PR #8851, PR #8863, PR #8901, PR #8929, and PR #8931.
• Messaging credential changes now rebuild the sandbox when durable gateway registration no longer matches the reviewed selection. Compact persisted authority is compared without exposing credentials, and ambiguous or failed gateway reads remain terminal instead of being treated as an absent registration. For more information, refer to Credential Rotation and Manage Messaging Channels. Related changes: PR #8859 and PR #8939.
• Managed Model Context Protocol (MCP) registration now targets the OpenClaw workspace configuration, while agent dispatch exits nonzero when a turn does not produce a delivered response. Incomplete-turn markers, gateway selection, and non-interactive execution are preserved so scripts do not receive false success. For more information, refer to Manage MCP Servers and the NemoClaw CLI Commands Reference. Related changes: PR #8646, PR #8846, and PR #8857.
• Hermes configuration writes now validate the complete candidate configuration, require explicit approval for private service URLs, and restart only after the accepted state is durable. Snapshot clones preserve their allocated gateway port so the restored sandbox and registry agree before startup. For more information, refer to the Hermes Quickstart, Create and Restore Snapshots, and Troubleshooting. Related changes: PR #8845 and PR #8907.
• Legacy OpenShell gateway replacement now retires only verified managed state, corporate CA staging preserves trusted ownership, and Shields state remains readable after runtime locking. NemoClaw creates managed state with owner-only permissions, strips the gateway token from descendant processes, and preserves authenticated gateway metadata through sandbox launch. For more information, refer to Configure Corporate CA Trust, Gateway and Secret Controls, and Credential Storage. Related changes: PR #8811, PR #8812, PR #8822, PR #8860, PR #8872, and PR #8921.
• Managed images now use Node.js 22.23.2, updated runtime dependencies, an audited Hono lock, and setpriv instead of legacy gosu privilege transitions. BuildKit attestation verification is part of image validation, while Sigstore auditing runs outside image builds and the Hermes sandbox base is pinned to the refreshed reviewed digest. For more information, refer to Process Controls, Trusted Computing Base, and Update Sandboxes. Related changes: PR #8819, PR #8858, PR #8862, PR #8864, PR #8914, PR #8927, and PR #8928.
• Contributor guidance now covers JavaScript heap exhaustion during setup, required macOS command-line dependencies, byte-asserted line endings, and the v0.0.106 audit follow-ups. For more information, refer to the documentation contribution guide and Troubleshooting. Related changes: PR #8689, PR #8700, PR #8779, and PR #8831.
• Release qualification now reports one consolidated result across required end-to-end jobs, lifecycle integration coverage shares isolated host-process scenarios, and qualification checks share one dotted-version comparator. NemoClaw no longer contains the Jetson dispatch backend and retains controller contract coverage. The release train also adds deterministic recovery fixtures, bounded SSH and preflight waits, formatted Hermes diagnostics, centralized onboarding wiring, and runtime-aligned live probes. Related changes: PR #8780, PR #8840, PR #8841, PR #8843, PR #8850, PR #8854, PR #8861, PR #8871, PR #8874, PR #8875, PR #8881, PR #8899, PR #8905, PR #8906, PR #8909, PR #8911, and PR #8932.

NemoClaw v0.0.107 adds an Experimental NVIDIA Nemotron 3.5 Lightning profile for one DGX Spark and awaitable Slack readiness for automation. It improves cold-start onboarding, dashboard forwarding, Windows-host Ollama, Hermes operations, sandbox recovery, and CLI inventory output. It also strengthens Hermes Shields state changes and removes sensitive values from more diagnostics.

NemoClaw v0.0.106 converges readiness across lifecycle commands, upgrades the managed OpenShell runtime to v0.0.101, and adds bounded DGX Spark vLLM choices. It strengthens sandbox and Hermes recovery, local inference diagnostics, endpoint policy authority, and scoped uninstall. It also improves update safety, image defaults, and installation failure reporting.