Release Notes

NemoClaw v0.0.123 expands configuration export for managed OpenClaw and Hermes sandboxes. It adds an experimental external-component onboarding contract and improves installer recovery, sandbox lifecycle handling, and inference diagnostics.

• nemoclaw config export now exports canonical managed Hermes sandboxes, including verified API-key authentication and nondefault interface settings. OAuth authentication and Hermes tool gateways remain outside the export contract. Related changes: PR #11323, PR #11450, and PR #11477. Refer to the NemoClaw CLI Commands Reference.
• OpenClaw configuration export now preserves managed Brave Search references, proxy settings, hosted inference tuning, execution settings, dashboard settings, direct tool disclosure, and local conversation diagnostics. It also supports one read-only secondary agent that shares the primary hosted inference route. Local Ollama export preserves verified daemon and proxy ports. Export verifies live and retained configuration evidence and writes credential references instead of secret values. Related changes: PR #11384, PR #11387, PR #11383, PR #11429, PR #11430, PR #11431, PR #11473, and PR #11478. Refer to the NemoClaw CLI Commands Reference for the supported export profiles and their limits.
• Fresh onboarding on Linux can register one experimental external host component with a NemoClaw-managed Docker-driver gateway. NemoClaw validates the declaration before gateway changes and verifies sandbox identity and effective policy before activation. Failed or ambiguous activation preserves the sandbox and records incomplete state; resume and automatic activation retries are unsupported. NemoClaw does not manage the component service or its credentials. Related changes: PR #11366 and PR #11471. Refer to Register an External Component During Onboarding.
• The installer now attempts existing sandbox recovery before generic host admission and preserves each sandbox’s recorded GPU selection. It distinguishes confirmed recovery from missing sandboxes or unconfirmed recovery output, and reports warnings instead of claiming complete recovery. Fresh onboarding and required DGX Station reconciliation still require host admission. Related change: PR #10397. Refer to Update Sandboxes.
• Sandbox status now distinguishes an intentional stop from a failure, and connect directs you to start a stopped sandbox. Portable Hermes start, stop, and recovery use OpenShell for lifecycle changes and verify the receipt-owned Podman container afterward. Portable lifecycle operations share the same lock authority, including the host fence during startup. Related changes: PR #11211, PR #11336, PR #11482, and PR #11490. Refer to Recover and Rebuild Sandboxes.
• NVIDIA Endpoints validation now checks the selected inference route. Onboarding and sandbox status identify the account-access cause when NVIDIA returns a matching model-access 404, without exposing the response body in status diagnostics. Docker readiness failures identify authority conflicts, and GPU-mode probe failures retain the Docker failure reason. Non-interactive onboarding resolves the sandbox name before provider selection. Related changes: PR #10957, PR #11393, PR #11280, and PR #11442. Refer to Verify the Sandbox Inference Route and System Readiness.
• Removing Teams now removes Teams-owned Microsoft login credential bindings from matching Outlook policy endpoints. It refuses to remove bindings owned by another integration. Related change: PR #10846. Refer to the NemoClaw CLI Commands Reference.

NemoClaw v0.0.122 improves host detection and local inference selection for Docker, DGX Station, and N1x WSL. It also strengthens interrupted onboarding, Hermes Portable lifecycle recovery, configuration export, remote dashboard access, and uninstall failure reporting.

• Host readiness now runs Docker probes with the environment that later Docker commands use. It respects the selected Docker context and configuration, rejects unsafe explicit endpoints, and can select the rootless Linux socket after an unreachable default authority. DGX Station checks now separate GB300 hardware identity from the qualified software profile and apply the same classifier during host preparation and onboarding. Related changes: PR #10379 and PR #10914. For more information, refer to System Readiness and Prepare a DGX Station.
• A CUDA-qualified N1x WSL host now selects the managed Qwen llama.cpp profile instead of falling back to the smaller Ollama profile. A resumed preset-driven managed vLLM installation verifies the recorded model and serving preset before it changes runtime state. A mismatch stops onboarding and directs you to restart with nemoclaw onboard --fresh. Related changes: PR #11078 and PR #11271. For more information, refer to Choose a Local Inference Server, Set Up llama.cpp, and Set Up vLLM.
• Interrupted onboarding now releases its process lock and abandons an uncommitted inference-route reservation before a later resume. Final handoff keeps incomplete sandbox identity available for recovery and does not report success when replacement onboarding exits nonzero. The global nemoclaw doctor command remains available without a sandbox name, including when a registered sandbox is named doctor. Related changes: PR #11140, PR #11205, PR #11218, and PR #11296. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• Hermes Portable onboarding now records the selected OpenShell gateway for later recovery and uninstall operations. Start and recovery repair the receipt-owned host forwards before reporting readiness, while stop retries an incomplete identity observation within its bounded settlement policy. Upgrade recovery preserves the Portable lifecycle and forward identities instead of replacing them with ambient gateway state. Related changes: PR #11034, PR #11266, and PR #11312. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• nemoclaw config export now supports native NVIDIA hosted inference only when the gateway uses the built-in nvidia-prod profile, its default endpoint, and no provider configuration overrides. Missing or inconsistent provider evidence stops the export without writing a configuration document. Related changes: PR #11065 and PR #11318. For more information, refer to the NemoClaw CLI Commands Reference.
• Neutral managed OpenClaw images no longer declare the uninstalled Tavily plugin. This removes recurring plugin not installed: tavily warnings when Tavily Search was not selected, while explicitly selected Tavily configuration remains unchanged. Related change: PR #10331. For more information, refer to Troubleshooting.
• Remote dashboard access now keeps an external CHAT_UI_URL separate from the host forward bind. A reverse proxy or tunnel can reach the loopback forward while the URL configures the browser origin and Host-header validation. Direct access on a non-WSL host requires NEMOCLAW_DASHBOARD_BIND=0.0.0.0 before onboarding and for later nemohermes <sandbox> connect calls. Protect the dashboard and API ingress before exposing either service. Related change: PR #10931. For more information, refer to Quickstart with Hermes and Gateway Authentication Controls.
• The installer now refuses an implicit NemoClaw CLI downgrade and reports the installed and requested versions before it changes the installation. Uninstall exits nonzero when it cannot remove the gateway registration, so automation does not treat partial cleanup as success. Related changes: PR #11209 and PR #9860. For more information, refer to Update Sandboxes and Uninstall NemoClaw.

NemoClaw v0.0.121 adds managed MCP tool-denial rules and moves skill lifecycle to agent-owned state. It also hardens messaging providers, Windows and WSL inference, sandbox recovery, file transfer, and Hermes state repair.

• Managed MCP servers can now deny exact tool names or glob patterns through repeatable --deny-tool options. The new mcp update command replaces the complete denied-tool list or clears it with --clear-deny-tools. Status, restart, rebuild, and launch-readiness checks use the persisted rules and report drift with a recovery command. Related change: PR #11135. For more information, refer to Add an MCP Server, Manage MCP Servers, and Troubleshoot MCP Servers.
• Skill lifecycle state now belongs to the selected agent instead of a parallel NemoClaw inventory. skill list streams the agent’s native result, while install and remove use native commands when the agent exposes an equivalent operation. Other operations use the manifest-declared writable skill directory without claiming that a same-name skill elsewhere is absent. Related change: PR #11093. For more information, refer to Understand Sandbox State and the NemoClaw CLI Commands Reference.
• Messaging provider setup now uses typed OpenShell lifecycle results for registration, reuse, authorized replacement, attachment, refresh observation, and partial-failure recovery. Typed lifecycle results include credential names but never credential values, and channel removal omits placeholder credentials that were never configured. Channel stop and start now preserve credentials and runtime configuration through rebuild and stopped-sandbox restart. Related changes: PR #11009, PR #11126, PR #11188, and PR #11193. For more information, refer to Manage Messaging Channels and Credential Storage.
• A CUDA-qualified WSL RTX Spark N1x with at least 30,000 MiB available now ranks an installed qwen3.6:35b before qwen3.5:9b for Ollama. Windows Ollama onboarding and restart keep traffic in Docker Desktop’s verified network context and restore the previous User-scope binding and process state when a transaction fails. Recovery also reports bounded probe-timeout guidance instead of leaving the route failure ambiguous. Related changes: PR #11187, PR #10855, PR #10889, and PR #11192. For more information, refer to Set Up Ollama, Prepare Windows, and System Readiness.
• Inference provider creation, update, deletion, inspection, settlement, and rollback now use the typed OpenShell provider boundary. Mutations fail closed when ownership or revision identity is incomplete, and rollback verifies the provider revision before deletion. inference get reports a reusable endpoint for compatible custom providers only when persisted metadata is safe, complete, and unambiguous. Status distinguishes the configured model from the live routed model and requires verified llama.cpp routes. Related changes: PR #11008, PR #10833, PR #10261, PR #10471, and PR #11207. For more information, refer to Switch Inference Providers and the NemoClaw CLI Commands Reference.
• Sandbox download now rejects a directory that contains a symbolic link or another special file before transfer or host destination creation. Snapshot and rebuild recovery preserve fail-closed identity checks, recover an interrupted backup, and reject unsafe local fallback images. A retained sandbox is removed only after its gateway confirms absence and residual resources have sufficient identity evidence. Related changes: PR #10654, PR #11142, PR #11094, and PR #10867. For more information, refer to Transfer State Manually, Recover and Rebuild Sandboxes, and Troubleshooting.
• Hermes startup now repairs restored session, gateway, runtime, history, and log state through descriptor-verified paths before the gateway opens them. It rejects symbolic-link and file substitutions without changing their targets, and it keeps mutable runtime configuration outside relaunch policy. Hermes diagnostics also preserve invalid dashboard URL details and initialize the Kanban schema atomically. Related changes: PR #10872, PR #11110, PR #11227, and PR #11177. For more information, refer to Recover and Rebuild Sandboxes, Gateway Lifecycle Control, and Troubleshooting.
• Onboarding now fails before sandbox mutation when a managed-image flow cannot honor a configured base-image override. GPU handoff resumes from validated checkpoints, managed vLLM avoids repeated retries after a rejected pinned image, and Gemini HTTP 400 failures include provider-specific recovery guidance. Related changes: PR #11152, PR #11124, PR #11048, and PR #11171. For more information, refer to the NemoClaw CLI Commands Reference, Set Up vLLM, and Use Google Gemini.
• Managed OpenClaw and Hermes recovery now waits within a 210-second budget for a typed delayed managed-container discovery result. Other privileged-control, identity, and diagnostic failures remain terminal. Hermes Portable recovery reports failed host-forward operations and does not publish readiness after a failed repair. Related change: PR #11236. For more information, refer to Recover and Rebuild Sandboxes.
• Hermes rebuild now preserves supported configuration values recorded through nemohermes <name> config set. It excludes gateway settings, managed inference-route fields, and credential material, verifies restored values, and lists restored and dropped keys. Capture failures stop before deletion; restore or verification failures retain recovery state and exit nonzero. Related change: PR #10780. For more information, refer to Rebuild While Preserving State.

NemoClaw v0.0.120 adds secret-free verified configuration export and a global host and gateway doctor. It updates the supported Hermes runtime to 0.20.6, retires Shields from NemoClaw core, and moves managed host forwarding to OpenShell service forwarding. It also hardens sandbox recovery, onboarding, inference validation, MCP lifecycle operations, mTLS selection, and credential-bound messaging policy.

NemoClaw v0.0.119 adds an explicitly selected native rootless Podman runtime path and an experimental managed llama.cpp path for qualifying Windows WSL N1x hosts. It hardens custom network policy, WeChat redirect, Langfuse, MCP credential, and messaging-rebuild boundaries. It also improves local inference selection, Hermes recovery, interrupted-install guidance, and sandbox command behavior, and updates reviewed production dependency graphs to remove four high-severity fast-uri advisories.

NemoClaw v0.0.118 adds headless package boundaries for Hermes lifecycle planning and credential-free external OpenShell gateway health checks. It improves fail-closed sandbox destruction, rebuild, onboarding, Shields, inference, and Hermes recovery. It also broadens Deferred N1x detection and gives N1x managed vLLM a dedicated serving profile.

• The new nemoclaw/lifecycle package export supports deterministic Hermes 0.19.0 lifecycle planning and read-only agent observation with OpenShell 0.0.106. Callers provide the observation capability; the package does not own transport, authentication, persistence, or mutation. The Blueprint Runner can also check a configured external OpenShell gateway through the pinned SDK without credentials or mutation. Related changes: PR #10703 and PR #10618.
• OpenClaw sandbox destruction now detects Shields-locked Mcporter configuration before mutation and provides recovery guidance. destroy --force can continue only for retained OpenClaw Mcporter entries, while Hermes and ordinary MCP mutations remain fail-closed. Related change: PR #10483.
• Rebuild now stops before deleting the original sandbox when any declared state directory or file cannot be preserved, including with --force. When cleanup fails, NemoClaw retains the incomplete snapshot at the reported path. It excludes the snapshot from snapshot list and restore selection. The directory can contain unsanitized credentials. Keep it owner-only. Do not restore, copy, share, or edit it. Repair access to the original sandbox state. Remove the retained directory only after you verify that the original sandbox or a complete snapshot contains every required state item. Confirm that the reported path is absent. Then rerun the operation. A failed nested onboarding result no longer proceeds to restore or report success. Related changes: PR #10686 and PR #10590.
• Fresh onboarding now ends the OpenShell create handoff after receiving a validated durable sandbox ID, then settles and verifies identity before post-create effects. This prevents affected WSL2 ARM OpenClaw sandboxes from moving from Ready to Error while publication metadata is still settling. Related change: PR #10789.
• Hermes stopped-sandbox recovery reuses verified lifecycle and inference state. It still rolls back failures and performs final readiness qualification. Hermes dashboards behind a reverse proxy also accept the hostname from a validated HTTPS CHAT_UI_URL for HTTP and WebSocket requests while remaining bound to loopback. Related changes: PR #10641 and PR #10687.
• Inference status now queries the selected gateway instead of implicitly using the default gateway. Hugging Face model downloads with no output abort after a bounded stall timeout. Managed vLLM accepts a catalog short name, full Hugging Face model ID, or registered served model name as aliases for the same model. Onboarding normalizes known aliases when it reuses an existing managed vLLM endpoint, while pull-request CI verifies pinned Hugging Face references without credentials. Related changes: PR #10698, PR #10352, and PR #10429.
• Shields status for Hermes now remains read-only instead of repairing mutable state during observation. Related change: PR #10710.
• DGX Station Express host preparation now ignores NemoClaw and OpenShell agent processes owned by another user for non-root and sudo controllers. It still blocks the controller agent processes and keeps direct-root agent checks, vLLM conflicts, and Docker conflicts host-wide. Related change: PR #10689.
• Deferred N1x preview detection now accepts NVIDIA display-class GPUs without requiring one PCI device ID and recognizes OEM DGX Spark FastOS identity. v0.0.118 introduced a dedicated N1x Qwen3.6 35B NVFP4 serving profile with its original memory, context, concurrency, and batching envelope physically exercised. For the current limits and validation status, refer to Set Up vLLM. N1x remains Deferred pending complete Express end-to-end validation. Related changes: PR #10099, PR #10721, and PR #10625.

NemoClaw v0.0.117 makes OpenShell the sole durable network-policy authority. It improves fail-closed recovery for sandboxes, Shields, the installer, Portable runtimes, and messaging channels. It also removes the deprecated Brev deploy wrapper and adds contributor and maintainer analysis tools.

• OpenShell is now the sole durable source of sandbox policy state. NemoClaw policy commands and Shields operate on the live OpenShell policy without storing a second desired-policy copy, while rebuild carries the current policy through one private, temporary handoff. Legacy policy fields are removed from NemoClaw state without changing the live policy. Related change: PR #10515.
• Failed onboarding cleanup now retains immutable sandbox, gateway, policy, and create-attempt evidence. While OpenShell still reports the sandbox live, destroy preserves recovery instead of deleting by mutable name. After OpenShell confirms absence, NemoClaw removes only containers that match the retained immutable identity and verifies their absence before clearing recovery state. Related change: PR #10571.
• The OpenClaw memory secret scanner now covers writes under absolute named-workspace paths such as /sandbox/.openclaw/workspace-main/. Project directories whose names start with workspace- remain outside the memory-path classification unless they are under the OpenClaw state directory. Related change: PR #10527.
• Hermes activation and Shields recovery now bind release acknowledgement, writer rescans, root-broker cleanup, and completed auto-restore lock retirement to exact process and transaction identities. Transient replaced writers are reconsidered under fresh identity, while live, foreign, durable, or ambiguous identity remains denied. Related changes: PR #10272, PR #10597, and PR #10603.
• macOS upgrades can retire an identity-verified legacy OpenShell gateway or Homebrew service before selecting the checksum-verified replacement binaries. Managed startup also transfers protected receipts through read-only Docker volumes, so VM-backed Docker daemons such as Colima do not need access to a client-only temporary path. Failed verification retains the recovery receipts, and successful finalization reports any exact volume that cleanup cannot remove. Related changes: PR #10484 and PR #10534.
• Hermes Portable connect --probe-only now recovers published Ollama only for the ollama-local provider. Descriptor-backed compatible endpoints keep verification-only routing without requiring an Ollama receipt. Routine recovery reuses a healthy published runtime or performs one lifecycle recovery for a stopped runtime before it proves published Ollama readiness. Onboarding and explicit deep validation retain generated completion, tool-call, and model-placement qualification. OpenClaw Portable recovery uses one bounded in-sandbox gateway observer and a shorter OpenShell registration poll while preserving the existing readiness statuses and outer lifecycle deadline. Related changes: PR #10556, PR #10612, and PR #10614.
• Experimental OpenClaw WeChat setup now writes the exact revision-scoped OpenShell placeholder to the Tencent plugin account file and binds both authorized iLink endpoints to the channel provider. Channel removal clears durable account state before provider, policy, or registry teardown, and raw bot tokens remain outside sandbox files, process arguments, and diagnostics. Related change: PR #10601.
• The deprecated nemoclaw deploy Brev compatibility command has been removed. Remote hosts use their provisioning workflow, the hosted installer, and nemoclaw onboard; deploy is now available as a sandbox name. Related change: PR #10576.
• nemoclaw <name> logs now labels OpenClaw gateway lines with [gateway] and keeps existing OpenShell source tags unchanged. Follow mode bounds incomplete-line memory, honors output backpressure, waits for accepted writes, and reports source failures. Related change: PR #10342.
• Contributors with a prepared checkout can run the checked-in PR Review Advisor specialists on committed and working-tree changes with npm run review:local before PR publication. The local-run prerequisites name the required host tools, the origin/main trust base, and the credential boundary. Hosted specialist jobs publish completed analyses in their GitHub job summaries. Maintainer analysis now emits bounded slow-test evidence and Perfetto-compatible PR lifetime traces with revision, readiness, review-request, workflow, job, and step timelines. Related changes: PR #10581, PR #10604, PR #10608, PR #10611, PR #10616, PR #10617, and PR #10623.
• Development qualification now contains a provider-owned record and dormant executor for the OpenShell v0.0.24 and MXC v0.7.0-rc1 checkpoint on physical Windows. NemoClaw does not register or select MXC, expose Windows onboarding, activate this executor, or treat the checkpoint as an accepted stable distribution. Related changes: PR #10591 and PR #10596.

NemoClaw v0.0.116 improves compatible endpoint validation, Portable Hermes inference recovery, sandbox lifecycle safety, managed images, Windows Subsystem for Linux (WSL) onboarding, managed local inference, and experimental Hermes channel credentials. It also preserves recorded network-policy intent during sandbox reuse and rebuild.

• OpenClaw compatible endpoint onboarding now validates inference.local from inside the sandbox even when no messaging channel is selected, and an unreachable route stops onboarding before final deployment verification. inference set can reuse a recorded loopback no-auth endpoint without replacing its provider, and reasoning-only responses receive one bounded larger-budget content attempt before failure. Related changes: PR #10458, PR #10531, and PR #10540.
• nemohermes <name> recover and nemohermes <name> connect --probe-only now recover only the published receipt-owned Portable Ollama runner. They verify an already-running runner without restarting it, resume the recorded stopped runner once, and require a final in-sandbox route proof. If a later check fails, recovery attempts to return the stopped runner and registry to their prior state and reports when either restoration cannot be proved. Related change: PR #10505.
• Uninstall now creates fresh snapshots for eligible registered non-Portable sandboxes before deletion unless --destroy-user-data is selected. It honors NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR, preserves abandoned Portable configuration without treating it as lifecycle authority, and stops before cleanup when backup, lifecycle-lock, ownership, or registration checks fail. Related changes: PR #10231, PR #10550, and PR #10562.
• Sandbox creation and reuse now retain verified sandbox identity, policy, provider, credential, and lifecycle authority across retries and process restarts. Same-name replacements and authority drift stop mutation, while managed-image registration tolerates a transient non-Ready report only when durable sandbox identity still matches. Related changes: PR #10510 and PR #10512.
• Sandbox destruction can recover an expired Shields auto-restore timer only when its process is gone or its recorded start identity no longer matches. Live or unverifiable timer ownership remains fail-closed, and destruction skips pre-delete hardening only after Docker proves the sandbox container is absent. Related change: PR #10225.
• Hermes Portable images now select the reviewed multi-platform base that matches their OpenSSL 3.5.7 package inventory, and OpenClaw images install checksum-pinned libevent 2.1.13 on AMD64 and ARM64. Related changes: PR #10532 and PR #10526.
• On WSL, public managed image pulls, generated image builds, GPU probes, and local inference probe pulls use a temporary credential-free Docker configuration when the default Docker Desktop credential helper is unavailable. Managed local inference now waits for disposable Podman probe identities to disappear after one removal command, and llama.cpp image-pull failures report a fixed layer, code, and exit status without exposing raw pull output. Related changes: PR #10470, PR #10554, and PR #10561.
• Re-onboarding or rebuilding an OpenClaw sandbox with a recorded Balanced or Open tier now keeps an already-applied brave preset when web search is disabled or switched to Tavily Search. Restricted and unknown tiers, unsupported agents, and custom preset ownership retain their existing fail-closed reconciliation behavior. Related change: PR #10457.
• For the experimental Hermes WeChat and Microsoft Teams channels, managed startup now maps revision-scoped OpenShell credential placeholders to the environment names Hermes reads. Only matching revision-scoped placeholders are copied. Raw or identityless runtime values are ignored, while malformed or channel-unbound aliases stop startup; both channels remain experimental. Related change: PR #10563.

NemoClaw v0.0.115 strengthens Portable Hermes recovery, sandbox lifecycle authority, managed messaging credentials, and installer recovery. It also improves managed local inference and adds bounded experimental planning for an externally managed OpenShell target.

• Portable Hermes recovery now revalidates the exact receipt-owned Podman container, OpenShell gateway, executable, policy, route, and runtime identities before each operation. If recovery starts a stopped receipt-owned container and authenticated Hermes health remains unavailable, it launches the receipt-recorded nemoclaw-start command once and waits for authenticated health. If the container was already running, recovery only waits for authenticated health and does not launch another startup process. A failed recovery rolls back only the exact container that recovery started. Related changes: PR #10315, PR #10376, PR #10441, PR #10456, and PR #10499.
• Stock Docker-driver onboarding for OpenClaw, Hermes, and LangChain Deep Agents Code now requires the release’s exact managed image. Registry or catalog failures stop before sandbox creation instead of falling back to a local stock-image build; explicit custom Dockerfiles remain separate. Existing and recreated sandboxes retain exact image, policy, route-reservation, and lifecycle authority checks. Related changes: PR #10113, PR #10320, PR #10321, PR #10322, PR #10332, PR #10396, and PR #10422.
• Messaging setup now binds revision-scoped credentials to canonical OpenShell providers before sandbox creation or rebuild. This restores runtime credential delivery for maintained Slack, Discord, Google Chat, and Telegram paths while preserving endpoint-specific policy matching and fail-closed provider ownership. Related changes: PR #10170, PR #10271, PR #10273, PR #10275, PR #10277, PR #10307, and PR #10314.
• The Hermes installer accepts --defer-onboarding or NEMOCLAW_DEFER_ONBOARDING=1 only for NVIDIA-hosted inference when no supported credential and no sandbox exist. It installs NemoClaw and Hermes without creating a provider, sandbox, or completed onboarding state; any credential or existing sandbox keeps the normal validation and recovery path. Related change: PR #10299.
• The experimental managed llama.cpp path now offers NVIDIA Nemotron 3 Nano 30B-A3B on qualified DGX Spark Arm64 and Linux x86_64 NVIDIA GPU hosts and recommends it during onboarding. Meta Muse Glimmer remains available on DGX Spark only by explicit selection, and existing Muse-owned installations are not migrated. Local NVIDIA NIM selection now enforces the documented usable-memory limit, including the DGX Spark unified-memory cap. Related changes: PR #10122 and PR #10292.
• nemoclaw upgrade-sandboxes --check now exits nonzero when it reports actionable stale, unknown-version, backup-recovery, or missing-sandbox state. Sandbox destruction and stale-container cleanup have bounded waits and preserve registry or lifecycle authority when deletion cannot be confirmed. Non-portable managed Hermes uninstall also removes its exact owned state volume and stops before state retirement on Docker failure. Related changes: PR #10128, PR #10133, and PR #10224.
• The experimental direct blueprint runner can validate and sanitize a plan for an externally managed OpenShell target. Planning validates the HTTPS endpoint, workspace, expected release range, CA bundle, and authentication-file metadata without reading credential contents, connecting to the gateway, authenticating, or applying changes. Related change: PR #10045.
• Security and diagnostics now reject config reads through a symlinked config directory, redact URL userinfo credentials in debug bundles, bind sandbox mutations and cancellation recovery to durable exact identity, and classify incomplete onboarding without reporting success. Related changes: PR #10041, PR #10127, PR #10146, and PR #10396.

NemoClaw v0.0.114 adds deterministic read-only MCP tool calls for LangChain Deep Agents Code and per-stage launch-readiness probe timing. It strengthens destructive-operation warnings, session export cleanup, sealed configuration recovery, and installation verification. It also improves managed local inference, Portable and Hermes onboarding, image provenance, and release documentation automation.

NemoClaw v0.0.113 improves sandbox and onboarding recovery across interactive connections, Hermes, Portable, policy changes, and local adapters. It adds experimental Hermes Google Chat support while keeping the service-account private key outside the sandbox. It also changes the Google Gemini default, strengthens managed image publication, and improves E2E diagnostics.

NemoClaw v0.0.112 strengthens managed local inference across vLLM, llama.cpp, Ollama, and routed provider recovery. It improves Portable and sandbox lifecycle recovery, MCP credential republishing, messaging continuity, and Shields ownership cleanup. It also tightens release provenance, E2E qualification, contributor review automation, and dependency compatibility.

NemoClaw v0.0.111 extends the explicit experimental Portable profile with receipt-owned Hermes lifecycle authority and a fixed host-gateway and registry network topology. It makes Shields recovery, sandbox rebuilds, provider routing, and messaging bootstrap more diagnosable and less likely to leave ambiguous state. It also improves headless and local-inference onboarding, managed gateway recovery, uninstall cleanup, and release qualification.

NemoClaw v0.0.110 adds an Experimental managed llama.cpp profile for Meta Muse Glimmer 30B on one DGX Spark and requires native tool-use evidence from custom Anthropic-compatible endpoints. It strengthens the explicit experimental Portable OpenClaw path with rootless Podman lifecycle authority, CPU-delegation preflight, and receipt-bound uninstall. It also improves onboarding recovery, local inference diagnostics, messaging and policy cleanup, backup and uninstall safety, and release qualification.

NemoClaw v0.0.109 adds credential-free launch-readiness leases, an editable onboarding review, a distinct OpenAI-compatible API port for each Hermes sandbox, and selectable Hermes WhatsApp reply modes. It also adds a Deferred N1x Express preview for one-host managed vLLM while N1x remains outside the supported-platform set. It improves inference health reporting, local inference discovery, onboarding recovery, sandbox startup, messaging status, and uninstall behavior. It also strengthens managed images, Deep Agents Code login probes, Shields transitions, gateway lifecycle authority, and release qualification.

NemoClaw v0.0.108 adds read-only host mounts and an Experimental Muse Glimmer profile for one DGX Spark. It improves onboarding recovery, messaging credential rotation, inference validation, MCP registration, snapshots, and Hermes configuration. It also strengthens managed images, gateway credentials, runtime state, and release qualification.

• On Linux and Windows Subsystem for Linux 2 (WSL2), nemoclaw onboard --host-mount <host:/sandbox/path> can now expose an existing host directory read-only beneath /sandbox. NemoClaw validates each source, destination, and symlink boundary before mutation. It persists accepted mounts across nemoclaw <sandbox> rebuild and interrupted onboarding resumed with nemoclaw onboard --resume. The nemoclaw <sandbox> destroy command removes their declaration. The nemoclaw <sandbox> status command reports them. For more information, refer to Understand Sandbox State and the NemoClaw CLI Commands Reference. Related change: PR #8280.
• The explicit-only Experimental Muse Glimmer managed vLLM profile now runs on one DGX Spark with its validated checkpoint, ARM64 image, parser settings, and resource limits. Two-node DGX Spark setup can remediate a Docker storage conflict before launch only when it is the sole blocking readiness finding and the host reports that remediation is available, and strict tool-call validation escalates its bounded token budget through 256, 1,024, and 4,096 tokens before reporting failure. NVIDIA Nemotron 3.5 Lightning guidance also distinguishes the reasoning and max_tokens fields required by direct OpenAI-compatible callers. For more information, refer to Set Up vLLM, Set Up vLLM on Two DGX Sparks, and Understand Provider Validation. Related changes: PR #8802, PR #8814, PR #8839, and PR #8894.
• Onboarding recovery now preserves the selected configuration after review, hides suggestions for incomplete route-only sandboxes, and keeps an already healthy Docker authority. Explicit fresh recreation, repeated Docker recreation, dashboard port reservation, unavailable-provider guidance, decorated OpenShell readiness output, and readiness handoffs now converge through the same bounded lifecycle authority. The recovery path also handles registered messaging routes, empty dashboard URLs, managed runtime ownership, OpenClaw MCP workspace state, and LangChain Deep Agents Code re-onboarding verification without masking terminal failures. For more information, refer to Recover and Rebuild Sandboxes, System Readiness, and Troubleshooting. Related changes: PR #8724, PR #8820, PR #8823, PR #8842, PR #8851, PR #8863, PR #8901, PR #8929, and PR #8931.
• Messaging credential changes now rebuild the sandbox when durable gateway registration no longer matches the reviewed selection. Compact persisted authority is compared without exposing credentials, and ambiguous or failed gateway reads remain terminal instead of being treated as an absent registration. For more information, refer to Credential Rotation and Manage Messaging Channels. Related changes: PR #8859 and PR #8939.
• Managed Model Context Protocol (MCP) registration now targets the OpenClaw workspace configuration, while agent dispatch exits nonzero when a turn does not produce a delivered response. Incomplete-turn markers, gateway selection, and non-interactive execution are preserved so scripts do not receive false success. For more information, refer to Manage MCP Servers and the NemoClaw CLI Commands Reference. Related changes: PR #8646, PR #8846, and PR #8857.
• Hermes configuration writes now validate the complete candidate configuration, require explicit approval for private service URLs, and restart only after the accepted state is durable. Snapshot clones preserve their allocated gateway port so the restored sandbox and registry agree before startup. For more information, refer to the Hermes Quickstart, Create and Restore Snapshots, and Troubleshooting. Related changes: PR #8845 and PR #8907.
• Legacy OpenShell gateway replacement now retires only verified managed state, corporate CA staging preserves trusted ownership, and Shields state remains readable after runtime locking. NemoClaw creates managed state with owner-only permissions, strips the gateway token from descendant processes, and preserves authenticated gateway metadata through sandbox launch. For more information, refer to Configure Corporate CA Trust, Gateway and Secret Controls, and Credential Storage. Related changes: PR #8811, PR #8812, PR #8822, PR #8860, PR #8872, and PR #8921.
• Managed images now use Node.js 22.23.2, updated runtime dependencies, an audited Hono lock, and setpriv instead of legacy gosu privilege transitions. BuildKit attestation verification is part of image validation, while Sigstore auditing runs outside image builds and the Hermes sandbox base is pinned to the refreshed reviewed digest. For more information, refer to Process Controls, Trusted Computing Base, and Update Sandboxes. Related changes: PR #8819, PR #8858, PR #8862, PR #8864, PR #8914, PR #8927, and PR #8928.
• Contributor guidance now covers JavaScript heap exhaustion during setup, required macOS command-line dependencies, byte-asserted line endings, and the v0.0.106 audit follow-ups. For more information, refer to the documentation contribution guide and Troubleshooting. Related changes: PR #8689, PR #8700, PR #8779, and PR #8831.
• Release qualification now reports one consolidated result across required end-to-end jobs, lifecycle integration coverage shares isolated host-process scenarios, and qualification checks share one dotted-version comparator. NemoClaw no longer contains the Jetson dispatch backend and retains controller contract coverage. The release train also adds deterministic recovery fixtures, bounded SSH and preflight waits, formatted Hermes diagnostics, centralized onboarding wiring, and runtime-aligned live probes. Related changes: PR #8780, PR #8840, PR #8841, PR #8843, PR #8850, PR #8854, PR #8861, PR #8871, PR #8874, PR #8875, PR #8881, PR #8899, PR #8905, PR #8906, PR #8909, PR #8911, and PR #8932.

NemoClaw v0.0.107 adds an Experimental NVIDIA Nemotron 3.5 Lightning profile for one DGX Spark and awaitable Slack readiness for automation. It improves cold-start onboarding, dashboard forwarding, Windows-host Ollama, Hermes operations, sandbox recovery, and CLI inventory output. It also strengthens Hermes Shields state changes and removes sensitive values from more diagnostics.

NemoClaw v0.0.106 converges readiness across lifecycle commands, upgrades the managed OpenShell runtime to v0.0.101, and adds bounded DGX Spark vLLM choices. It strengthens sandbox and Hermes recovery, local inference diagnostics, endpoint policy authority, and scoped uninstall. It also improves update safety, image defaults, and installation failure reporting.

NemoClaw v0.0.105 restores local and managed inference paths across Windows, Linux ARM64, DGX Spark, Ollama, vLLM, and managed llama.cpp. It also improves Shields recovery, uninstall ownership, Hermes operations, network-policy feedback, remote dashboard guidance, agent output integrity, and cold container compatibility probing.

• Strict local-provider validation now retries one reasoning-only tool-call truncation with a larger token budget and still fails unless the retry returns a structured tool call. vLLM parser errors now identify the required automatic tool-choice and parser settings, while Windows-host Ollama readiness runs from the Docker Desktop network context that reaches host.docker.internal. For more information, refer to Understand Provider Validation, Use Ollama, and Additional Setup for Windows Machines.
• Managed vLLM onboarding now accepts its authenticated loopback endpoint without requiring an unrelated trusted-private capability. Dual DGX Spark discovery accepts the filtered ip neighbor output produced by the host and names the failed rail check, while eligible native Linux ARM64 hosts can prove denylisted GPU names with the bounded Docker CUDA workload. The experimental managed llama.cpp lifecycle also uses the loopback port declared by its selected recipe. For more information, refer to Set Up vLLM, Set Up vLLM on Two DGX Sparks, and Troubleshooting.
• Shields down can now recover an OpenClaw sandbox whose protected startup failed before readiness, but only after the installed guard proves that no startup child or readiness lease remains. Hermes Shields transitions now wait for the trusted inference route to converge and roll back the existing transaction when the bounded route check fails. For more information, refer to Understand Runtime Changes, Recover and Rebuild Sandboxes, and Security Best Practices.
• Full uninstall no longer matches unrelated Docker containers and images whose names contain openclaw. It leaves resources from a separate OpenClaw installation in place while continuing to remove the Docker resources that NemoClaw identifies as its own. For more information, refer to Uninstall NemoClaw.
• Hermes now keeps legacy dashboard startup inside its prepared, privilege-separated profile and avoids unintended re-execution into the machine-level dashboard. The nemohermes <sandbox> sessions delete <id> command also uses in-memory SQLite temporary storage so session deletion works inside the restricted sandbox process context. For more information, refer to the NemoClaw CLI Commands Reference and Troubleshooting.
• An interactive policy restore refusal now reports Cancelled., and a non-interactive refusal prints the complete usage line. Both refusal paths stop before policy mutation. For more information, refer to Network Policies Reference and the NemoClaw CLI Commands Reference.
• When an SSH operator needs a port forward for a running OpenClaw or Hermes dashboard, status now points to the tokenized URL from dashboard-url. The hint remains absent for non-SSH sessions, stopped gateways, routable dashboards, and Deep Agents Code sandboxes. For more information, refer to Deploy to a Headless Server and the NemoClaw CLI Commands Reference.
• OpenClaw message handling now reconciles cumulative assistant snapshots with delta and replacement events before it publishes the final response. This recovers text from later snapshots without duplicating earlier output and uses the pinned headless loopback client identity accepted by OpenClaw v2026.7.1.
• Managed Deep Agents Code requests for the reviewed Nemotron Ultra model IDs now include the fixed nonempty-content template argument without trusting mutable provider parameters. A successful Deep Agents Code skill installation also prints its confirmed SHA-256 content digest so operators can compare later installations. For more information, refer to the NemoClaw CLI Commands Reference and Run LangChain Deep Agents Code.

NemoClaw v0.0.104 adds an experimental managed llama.cpp option for DGX Spark, trusted private endpoint configuration, and a selectable Personal network policy tier. It makes agent manifests authoritative for persistent state and strengthens gateway, rebuild, registry, and uninstall recovery. It also improves Hermes configuration safety, MCP diagnostics, credential isolation, and host installation guidance.