Release Notes

NemoClaw v0.0.132 expands qualified image and NVIDIA inference paths and improves sandbox recovery. It also strengthens credential checks, preserves gateway-scoped tunnels during sandbox changes, and makes failure guidance more specific.

• Rootless Podman can onboard, resume, rebuild, and clean up exact-digest external OpenClaw and Hermes images selected with --from-image. NemoClaw validates the local image identity and retains shared images that it does not own. Related change: PR #12538. Refer to Recover and Rebuild Sandboxes.
• New and recreated NVIDIA Endpoints sandboxes use a sandbox-attached OpenShell provider instead of the shared inference.local route. Older sandboxes keep the shared route until recreated. Recreate Deep Agents Code sandboxes during onboarding. OpenClaw and Hermes can switch an existing native attachment in place. Follow-up repairs restore native sandbox requests and use the supervisor-issued credential handle for OpenClaw and Hermes. Related changes: PR #12562, PR #12826, and PR #12895. Refer to Use NVIDIA Endpoints.
• A qualifying Station GB300 Windows Subsystem for Linux host can automatically select the managed Qwen 3.6 35B-A3B llama.cpp recipe. Managed vLLM selection retains a completed Docker GPU proof across WSL preflight, and read-only readiness reports when it did not run a container CUDA proof. Related changes: PR #12557, PR #12609, and PR #12856. Refer to Set Up llama.cpp.
• Custom-image OpenClaw onboarding waits for native startup before it configures and restarts the gateway. For the Other OpenAI-compatible endpoint provider, OpenClaw rebuild verifies the restored inference route. If verification fails, NemoClaw reports the preserved backup and a retry action. Related change: PR #12720. Refer to Recover and Rebuild Sandboxes.
• Resumed Deep Agents Code onboarding restarts a stopped OpenRouter adapter and requires a bounded inference request before it reports success. Failed adapter recovery or model validation leaves onboarding incomplete for retry. Related change: PR #12681. Refer to Verify the Sandbox Inference Route.
• nemoclaw tunnel start uses the selected OpenShell gateway port, and the tunnel stays available when one sandbox stops, is destroyed, or is recreated. Tunnel selection and cleanup retain gateway ownership checks. Related changes: PR #12490 and PR #12566. Refer to Run Sandboxes.
• nemoclaw <name> destroy --yes can remove a retained live sandbox after interrupted onboarding when its OpenShell identity matches the recovery record. Missing identity, uncertain presence, and identity drift still block deletion. OpenShell deletes by mutable name, so the final identity check and deletion are not atomic; prevent another client from replacing the sandbox name during cleanup. Related change: PR #12893. Refer to the NemoClaw CLI Commands Reference.
• Rebuild validates a nonempty host API key for applicable remote providers before image preparation or backup and again before sandbox deletion. A failed validation preserves the existing sandbox even with --force; unset a host key when you intend to reuse a valid OpenShell-stored credential. Related change: PR #12801. Refer to Recover and Rebuild Sandboxes.
• Legacy sandbox rebuild can recover after a confirmed failed probe without treating the old sandbox as absent. Source-installed CLI rebuilds use the installed source catalog instead of requesting an unpublished release version. Related changes: PR #12767 and PR #12762.
• A successful default uninstall identifies the native-state archive that contains Deep Agents Code files. Ordinary Docker uninstall also accepts a completed empty registry after the last sandbox was destroyed; ambiguous or non-Docker authority still fails closed. Related change: PR #12774. Refer to Uninstall NemoClaw.
• Rebuild preserves Hermes messaging configuration, and Slack remediation validates the managed install and policy boundaries before applying a repair. A failed Slack remediation command is reported instead of being treated as success. Related changes: PR #12841, PR #12846, and PR #12662.
• Onboarding keeps unprovable forwarded ports occupied rather than selecting a conflicting port. It also checks the local inference route during GPU finalization and preserves a completed GPU proof across a resumed create step. Related changes: PR #12763, PR #12755, and PR #12372.
• Diagnostics identify a failed custom endpoint while redacting credential-bearing URL components. Inference switching reports the gateway restart failure category, and non-GPU startup failures use the selected operation’s recovery guidance. Related changes: PR #12759, PR #12705, and PR #12796.
• nemoclaw config export rejects unsupported Gemini configuration instead of producing an unusable export. Related change: PR #12551.
• Sandbox image cleanup protects images used by sibling gateways. Fresh onboarding no longer detaches providers before the sandbox exists, avoiding misleading sandbox not found warnings. Related changes: PR #12608 and PR #12835.

NemoClaw v0.0.131 preserves the complete OpenShell native agent home and workspace during rebuilds, improves local and routed inference reliability, and hardens lifecycle diagnostics. It also adds Tavily to managed OpenClaw images, expands configuration export coverage, and fixes sandbox-specific command selection.

• Rebuild transfers the complete native agent home and workspace instead of a selected file inventory. NemoClaw rejects a transfer that contains credentials, fails inspection, or fails integrity validation before it replaces the sandbox. The retired selective snapshot commands are no longer available. Use an independent host backup when you need a user-controlled recovery point; backup-all remains an installer-facing pre-upgrade safeguard. Related change: PR #12340. Refer to Persist Sandbox State and Recover and Rebuild Sandboxes.
• The managed N1x Qwen vLLM profile allows one corrective retry when OpenClaw rejects a compaction summary. The quality guard remains enabled, and a repeated rejection or failed retry does not replace the conversation history. Other compaction profiles retain zero corrective retries. Related change: PR #12516. Refer to Understand Context Compaction.
• The 64 GB DGX Spark Qwen vLLM recipe uses lazy safetensors loading instead of fastsafetensors. This change reduces startup memory pressure on the Experimental 64 GB profile without changing its model, context, concurrency, or memory limits. Physical qualification remains pending. Related change: PR #12633. Refer to Set Up vLLM.
• Operator-attached llama.cpp onboarding now checks sandbox reachability before it accepts a host service. A confirmed TCP failure stops fresh or resumed onboarding with binding and firewall guidance. Related change: PR #11709. Refer to Set Up llama.cpp.
• OpenRouter model changes now verify the selected model through the target sandbox before NemoClaw commits agent configuration. A failed verification restores the previous route when possible. Launch readiness and status also require a bounded inference request because the OpenRouter adapter does not expose /v1/models. Related changes: PR #12625 and PR #12685. Refer to Switch Inference Providers.
• OpenAI-compatible probes use max_completion_tokens for GPT-6 models, including gpt-6-astra. The existing GPT-5 and o1, o3, and o4 compatibility handling remains unchanged. Related change: PR #12691. Refer to Choose a Compatible Inference API.
• nemoclaw inference set accepts recognized underscore spellings such as ollama_local, nvidia_prod, and open_router. NemoClaw normalizes each recognized spelling to its canonical OpenShell provider ID. Related change: PR #11700. Refer to Switch Inference Providers.
• nemoclaw config export now accepts native NVIDIA provider bindings from the current workspace or an unscoped binding and emits YAML that passes the pinned v1 parser. When retained corporate CA state is present, a successful export reports the omission on standard error and directs you to review destination trust requirements. Related change: PR #12451. Refer to the NemoClaw CLI Commands Reference.
• SDK-backed commands accept an externally supervised gateway’s declared mTLS state directory when its ownership and permissions pass validation. The directory does not need a NemoClaw-managed ownership marker. Related change: PR #12535. Refer to Understand Gateway Lifecycle Authority.
• Managed OpenClaw images preinstall the verified Tavily plugin in a disabled state. Selecting Tavily during onboarding enables it, and configuration export preserves admitted OpenClaw and Hermes Tavily sources without exporting credential values. Managed-image publication requires the exact supported Tavily package version and disabled default configuration. Related changes: PR #12225 and PR #12624. Refer to the OpenClaw Quickstart and Hermes Quickstart.
• Skill install, list, and remove commands select the agent from the target sandbox’s registry record. Onboarding another Hermes or Deep Agents sandbox no longer changes skill command routing for a registered OpenClaw sandbox. Related change: PR #12607. Refer to the NemoClaw CLI Commands Reference.
• nemoclaw policy list labels the Deep Agents Code observability-otlp-local preset as [from dcode agent]. This change corrects displayed provenance without changing sandbox permissions or preset application. Related change: PR #12635. Refer to the NemoClaw CLI Commands Reference.
• nemoclaw-acp preserves a remote hermes-acp exit status, including status 255, and reports SSH transport failures separately. If temporary SSH configuration cleanup fails, NemoClaw reports the retained directory without replacing an existing remote failure status. Related change: PR #11774. Refer to the NemoClaw CLI Commands Reference.
• Managed cloud onboarding waits up to 5 seconds for Docker to expose the exact container after OpenShell returns a verified sandbox identity. Ambiguous ownership, identity changes, stopped containers, and inspection mismatches still fail immediately. Related change: PR #12606.
• Portable onboarding checks that its managed registry responds before it builds the sandbox image. An unreachable registry produces a bounded failure before the build starts. Related change: PR #11874.
• Brev CPU bootstrap removes the older bundled npm tree before it extracts the pinned Node archive. This prevents files from the previous npm installation from remaining beside the new bundled npm. Related change: PR #12239.
• Tunnel startup and cleanup verify the recorded cloudflared process identity before they act on it. An inconclusive identity check preserves the process and PID record and reports recovery guidance. Related change: PR #12491. Refer to Troubleshooting.
• Legacy DNS proxy repair now requires an exact sandbox pod name or a valid generated suffix. Repairing a sandbox such as box1 no longer selects an unrelated pod such as box10-xyz12. Related change: PR #12556.
• Docker GPU failure diagnostics use typed OpenShell observations when they are available. A collection or artifact-write failure remains best effort and cannot hide the original GPU failure or cleanup guidance. Related change: PR #12560.
• Managed runtime dependency graphs and the installed official Slack bundle now use proxy-addr 2.0.8. Documentation validation also checks internal links across every published page. Related change: PR #12656.

NemoClaw v0.0.130 adds publisher-managed Docker image onboarding, strengthens sandbox recovery and security controls, and expands hardware and inference qualification. It also improves messaging, status output, configuration export, and operator diagnostics.

• When CHAT_UI_URL records a non-loopback browser address, onboarding keeps the host dashboard forward loopback-bound unless remote binding is explicitly configured. nemoclaw <sandbox> dashboard-url, nemoclaw list, and nemoclaw status show the recorded browser-facing URL, while status retains the local forwarding port. Related change: PR #11621. Refer to the NemoClaw CLI Commands Reference.
• On Windows-on-Arm WSL with Docker Desktop, a Station GB300 chassis can qualify an installed qwen3.6:35b model when the bounded CUDA proof verifies every reported GPU, includes an NVIDIA GB300 device, and reports at least 30,000 MiB available. Generic multi-GPU and Podman Station hosts remain compute-constrained. Related change: PR #12553. Refer to Set Up Ollama.
• Managed Hermes images now use the published multi-architecture base that contains OpenSSL 3.5.7-1~deb13u3 and matches the completed-image security verification. Related change: PR #12555.
• Docker and qualified rootless Podman onboarding for OpenClaw and Hermes accept a publisher-managed image with nemoclaw onboard --from-image <repository>@sha256:<digest>. NemoClaw validates the image platform, non-root user, /sandbox working directory, executable, any agent metadata, and tool-disclosure declaration before it creates a sandbox. It inspects a local image before it pulls, and the selected runtime’s configured credentials provide private-registry access. In non-interactive onboarding, use NEMOCLAW_FROM_IMAGE and a sandbox name. Related changes: PR #12301 and PR #12538. Refer to the NemoClaw CLI Commands Reference for image requirements and recovery limits.
• Sandboxes created with --from-image retain their recorded digest through resume, rebuild, and snapshot clone. NemoClaw revalidates the image before a rebuild or clone changes a sandbox. Cleanup retains the published image, and nemoclaw upgrade-sandboxes lists the sandbox as pinned without automatically rebuilding it. After you update NemoClaw, run nemoclaw <sandbox> rebuild to recreate the sandbox from its recorded digest. Related change: PR #12301. Refer to Update Sandboxes for the update behavior.
• Fresh OpenClaw sandboxes created with a custom Dockerfile apply the selected OpenShell inference route through OpenClaw’s native configuration before onboarding completes. If the selected model differs from the image’s model, OpenClaw uses its own defaults for any inherited context-window and output-token limits. Related change: PR #12421. Refer to Understand Runtime Changes for OpenClaw configuration ownership.
• OpenClaw owns /sandbox/.openclaw/openclaw.json after first launch. Configure it inside the sandbox with openclaw configure, openclaw config set, or openclaw config unset. Rebuild and snapshot restore preserve only credential-sanitized native configuration; they do not reconcile OpenShell inference routes, credential bindings, or network policy. Related change: PR #12120. Refer to Troubleshooting.
• Windows WSL GPU qualification recognizes the exact normalized NVIDIA RTX Spark N1X (5120-core Blackwell RTX GPU) identity. The existing WSL, CUDA proof, Docker Desktop, and capacity requirements still apply. Related change: PR #12407. Refer to System Readiness.
• Configuration export translates a source Landlock strict compatibility setting to v1alpha1 hard_requirement, preserving fail-closed enforcement. It preserves best_effort unchanged. Related change: PR #12312. Refer to the NemoClaw CLI Commands Reference.
• OpenClaw device approval exits successfully only after direct-gateway or local-fallback output drains. A callback failure or a one-second timeout exits nonzero instead. A same-device CLI request for operator.admin requires explicit approval; bounded non-administrative scope upgrades remain automatic. After approving the local CLI device for operator.admin, the CLI confirms the grant through the gateway before reporting success. Ordinary local agent turns use OpenClaw’s native method scopes, while model overrides and session resets retain administrative scope. Related changes: PR #12197 and PR #12354. Refer to Gateway Authentication Controls.
• nemoclaw <sandbox> exec -- ... no longer runs openclaw devices list --json after a command. When a command reports a pending scope approval, use the native request ID to review and approve the matching request in a prepared connect shell. Related change: PR #12332. Refer to Troubleshooting.
• Hermes now uses one native configuration for its gateway, CLI, TUI, and Web Dashboard. Startup migrates safe state from retired dashboard homes, including WhatsApp session state. It removes generated shadow configuration only after verification; unsafe paths or conflicting files stop migration without deleting either copy. Related change: PR #12333. Refer to Create and Restore Snapshots for migration and recovery limits.
• Google Chat accepts formatted service-account JSON with LF or CRLF line breaks in GOOGLECHAT_SERVICE_ACCOUNT. Interactive entry still requires minified one-line JSON. Related change: PR #10393. Refer to Set Up Google Chat.
• OpenClaw managed inference.local routes clear NVIDIA credential aliases and remove only the matching NemoClaw-generated legacy profile before setup. Direct routes and unrelated profiles remain unchanged. Related change: PR #12237. Refer to Process Controls.
• OpenClaw messaging image builds verify trusted official registry provenance for Discord, Slack, WhatsApp, Microsoft Teams, and Google Chat plugins. They stop before runtime checks when the verification fails or the offline cache lacks a verified package. WeChat uses the compatible 2.4.9 runtime. Related change: PR #12292. Refer to Add Channels After Onboarding for build-failure recovery.
• The experimental direct blueprint runner reports an unreadable run directory instead of treating it as missing during reconcile or rollback. It stops before OpenShell commands or state writes; correct the directory access, then rerun the command. Related change: PR #12320.
• Onboarding treats a persistent ordinary 404 from /v1/models as an inference-route failure instead of reporting a verified deployment. Correct the endpoint, then run nemoclaw onboard --resume to verify the retained session. Related change: PR #12339. Refer to Verify the Sandbox Inference Route.
• Native rootless Podman preserves its current-user runtime context during gateway recovery. It can reuse a trusted managed gateway service after that service removes standalone ownership records. Related change: PR #12267. Refer to Podman for provider requirements and recovery guidance.
• Balanced policy tiers now use brew-balanced, which limits raw.githubusercontent.com to GET and HEAD requests for its Homebrew binaries. Existing brew access remains until you remove brew and add brew-balanced; Open retains brew. Related change: PR #10487. Refer to Network Policies for tier and replacement details.
• Rebuild can preserve declared state from a managed Docker OpenClaw or Deep Agents Code sandbox in Phase: Error without starting or executing in its stopped container. Deep Agents Code carries only supported managed native MCP entries through a bounded recovery handoff. It requires an unchanged source container and exclusively owned managed state volume; credential state and user-authored or unsupported MCP content remain excluded. Related changes: PR #12305 and PR #11293. Refer to Recover and Rebuild Sandboxes for requirements and recovery limits.
• Destroying the final registered vllm-local consumer now removes an eligible NemoClaw-managed vLLM container after sandbox deletion, ownership, and cross-gateway consumer checks succeed. Use --keep-vllm or NEMOCLAW_KEEP_VLLM=1 to retain the container for later reuse. Related change: PR #11528. Refer to Set Up vLLM for cleanup and recovery conditions.
• Pi rebuild and snapshot restore preserve the sanitized native settings.json, including its global project-trust default. Per-path decisions in trust.json remain excluded. Related change: PR #12393. Refer to Pi Support for the preservation boundary.
• Lock contention during onboarding now reports the recorded owner state and directs you to retry normal lock acquisition after any active owner exits. It no longer recommends deleting a lock or stopping an unverified process. Related change: PR #10465.
• In-place upgrades normalize trusted OpenShell gateway service paths before comparing them, so equivalent HOME and XDG paths with redundant slashes do not block retirement of NemoClaw’s own service. Prepared legacy OpenClaw recovery also waits for ordinary write pairing before closing the recovery transaction. Related changes: PR #10541 and PR #10629. Refer to Update Sandboxes for upgrade recovery behavior.
• The hosted installer passes the selected runtime-provider authority into Windows WSL readiness checks, allowing a Podman-selected installation to reach onboarding without Docker. Related change: PR #12294. Refer to Windows Preparation for supported runtime paths.
• Onboarding can reclaim a foreign pending inference-route reservation attached to an already published sandbox when the selected gateway authority matches. The route remains pending until normal onboarding finalization, and sandbox data is preserved. Related change: PR #12295. Refer to the NemoClaw CLI Commands Reference for resume behavior.
• When both Docker selectors are set, NemoClaw now follows Docker CLI precedence and uses DOCKER_HOST instead of DOCKER_CONTEXT across readiness, onboarding, image builds, storage checks, runner commands, and cleanup diagnostics. Related change: PR #12330. Refer to System Readiness for Docker endpoint selection.
• Uninstall leaves unrelated Docker containers intact and keeps a managed gateway running until its registered sandboxes are cleaned up. For a nondefault gateway whose runtime is gone, --destroy-user-data can purge retained Docker registry and backup data after it verifies that the selected containers are absent. Related changes: PR #10478 and PR #12299. Refer to Uninstall NemoClaw for verification and retry conditions.
• The --all-gateway-ports sweep restores each gateway’s recorded custom OpenShell state directory. It preserves the affected state when recorded directories conflict or cannot be read. Related change: PR #10774. Refer to Uninstall NemoClaw for gateway-state recovery.
• DGX Station Express preserves a recognized legacy single-Station workload when automatic peer discovery cannot qualify a trusted pair. If the workload changes during discovery, installation stops rather than continuing the upgrade. Related change: PR #12296. Refer to Set Up vLLM on Two DGX Stations for the recovery procedure.
• Messaging-channel removal uses native OpenShell execution for running-sandbox session cleanup. A failed, cancelled, or inconclusive cleanup does not retry through SSH or a local runtime provider, and the command stops before rebuilding. OpenClaw WeChat can use its separately verified stopped-state cleanup before native execution. Related change: PR #12181. Refer to Manage Messaging Channels for cleanup and retry conditions.
• When managed OpenClaw onboarding imports a corporate CA, it refreshes the OpenShell supervisor trust through a native stop and start before onboarding completes. If either action fails, onboarding retains the sandbox for recovery. Related change: PR #12181. Refer to Configure Corporate CA Trust for the trust boundary.
• MCP status reports public DNS pin drift without changing the live policy. Refresh verified public pins with nemoclaw <sandbox> mcp update <server> --refresh-public-pins; the command replaces only the endpoint’s allowed_ips. It rejects private or special-use DNS answers and address ranges. Related change: PR #10781. Refer to Manage MCP Servers for recovery and verification.
• CoreDNS repair uses a responding Docker authority. A stale Podman socket does not redirect repair from a working Docker CLI default. On Linux, rootless Podman discovery also checks the socket under XDG_RUNTIME_DIR. Related change: PR #12348. Refer to Troubleshooting for CoreDNS recovery.
• Hermes now waits through a restart-rate cooldown and restarts its gateway automatically. The Bedrock Runtime adapter lists models only after it successfully serves an inference request. Related change: PR #12343. Refer to Understand Gateway Lifecycle Control for Hermes recovery behavior.
• Linux launch-readiness failures can identify the unsafe authority path, owner UID, permissions, bounded error code, and supported repair guidance. Diagnostics exclude receipt contents, environment values, and raw operating-system error messages. Related change: PR #10851. Refer to Recover and Rebuild Sandboxes.
• OpenClaw Telegram channel status detects missing, malformed, mismatched, identityless, or non-OpenShell runtime credentials without exposing the credential value. It reports these states as token_rejected. Related change: PR #10860. Refer to the CLI Commands Reference.
• When connect or start reaches a terminal phase for a Docker sandbox with no matching managed container, NemoClaw identifies containers that carry the sandbox-name label. Resolve each listed container through its owning workflow, then rerun the command. Related change: PR #12355. Refer to the CLI Commands Reference.
• Interrupting onboarding during agent selection exits with status 130 without printing a raw prompt error. Related change: PR #12361.
• The installer limits a curl connection to 10 seconds and retries a failed OpenShell release-asset download up to three times. It stops a transfer that remains below 1 KiB/s for 60 seconds. Related change: PR #12374.
• Sandbox download accepts a relative source path that begins with - when you place the standard outer -- before the path. NemoClaw anchors that path before it checks and transfers the source, so OpenShell treats it as a path rather than an option. Related change: PR #12391. Refer to the NemoClaw CLI Commands Reference.
• An interrupted rebuild retains recovery state separately for each sandbox. Rerun the affected sandbox’s rebuild with the same settings; do not delete its recovery files. Related change: PR #11389. Refer to Recover and Rebuild Sandboxes.
• Linux Ollama onboarding retries a timed-out systemd execution proof with a bounded direct proof as the configured service user. Onboarding continues when the direct proof succeeds and stops without restarting Ollama when it fails or times out. Related change: PR #12337. Refer to Set Up Ollama.
• For a NemoClaw-managed gateway, full uninstall deletes sandboxes through the selected gateway authority and requires two consecutive empty inventories before it removes providers, registrations, or local state. If authority or inventory verification fails, it preserves the downstream state for a retry. Related change: PR #12308. Refer to Uninstall NemoClaw for retry conditions.
• For a stopped sandbox that backup-all or rebuild starts, NemoClaw waits for SSH readiness before it captures the backup. It reserves time to return the sandbox to Stopped, and stops without replacement if backup or return-to-stopped verification fails. Related change: PR #12250. Refer to Recover and Rebuild Sandboxes for recovery limits.
• When an OpenClaw inference-route change lacks context-window evidence, NemoClaw removes the prior route’s context-window value so OpenClaw uses its default. A same-route retry preserves its existing value; a retry after incomplete native configuration synchronization removes a stale value. Related change: PR #12336. Refer to the NemoClaw CLI Commands Reference.
• Managed OpenClaw images now use OpenClaw 2026.9.2. After you update NemoClaw, rebuild an existing sandbox to use the new runtime. Related change: PR #12507. Refer to Update Sandboxes.
• On DGX Spark, managed Qwen vLLM selects a smaller recipe for detected unified memory from 60 GB to less than 64 GB. The recipe supports a 32,768-token context window, one concurrent sequence, 4,096 batched tokens, and 0.5 GPU-memory utilization. A detected capacity of at least 64 GB retains the 262,144-token recipe. Related change: PR #12502. Refer to Set Up vLLM for qualification and override details.
• For a JSON OpenClaw agent response with replayInvalid: true, NemoClaw returns success only when completed-run, successful-tool-summary, and final-reply evidence corroborate completion. Otherwise, it exits with status 1 and inspect-before-retry guidance because retrying can repeat side effects. Related change: PR #12502. Refer to the NemoClaw CLI Commands Reference.
• Deep Agents Code skill installation verifies the staged and placed canonical-root copies before publication. After placement and private staging cleanup succeed, it prints a SHA-256 digest of sorted relative paths, normalized executable modes, and file digests. The digest attests the placed copy at that time; it does not identify which same-name skill Deep Agents Code activates. Related change: PR #12483. Refer to the NemoClaw CLI Commands Reference.

NemoClaw v0.0.129 extends configuration export and deferred onboarding, improves OpenClaw restart readiness, and corrects recovery across local gateways. It also strengthens host OS reporting and Windows WSL GPU verification.

• Configuration export preserves effective OpenClaw and Hermes settings when v1alpha1 omission defaults would change behavior. Supported OpenClaw exports for attached Ollama with a managed proxy and the fixed managed vLLM profile now include local inference service templates. These templates contain image: null; replace that value with an official, immutable, compatible v1 runtime image before v1 parsing or planning. Related changes: PR #12054 and PR #12161. For supported profiles and refusal conditions, refer to the NemoClaw CLI Commands Reference.
• Hermes and LangChain Deep Agents Code can defer onboarding when installing without NVIDIA hosted inference credentials. The installer creates no provider, sandbox, or completed onboarding state in that case; present credentials retain normal validation. Complete setup later through the installed agent’s onboarding command. Related change: PR #10341. For the opt-in flag and prerequisites, refer to the CLI Commands Reference.
• OpenClaw gateway restart loads updated native plugins from a fresh module graph and waits for /readyz to return HTTP 200 with {"ready":true} before repairing forwards. Managed startup also preserves the SQLite temporary-directory environment for standalone memory commands. Related changes: PR #11911 and PR #12256. Refer to Install OpenClaw Plugins and Understand Gateway Lifecycle Control.
• Sandbox status and recovery use the owning local gateway registry even when another gateway is active. On Linux, nemoclaw <name> connect --probe-only starts a stopped sandbox through its recorded gateway, including a sibling registry root. Recovery guidance follows the recorded runtime provider, and rebuild delegates to the owning registry after confirmation. Resumed host-local inference onboarding reserves its retained authority before creating a runtime and reports actionable diagnostics when that reservation fails. Related changes: PR #11945, PR #12075, and PR #12303. Refer to Recover and Rebuild Sandboxes.
• Host readiness reports the Linux distribution and release, with warnings for unqualified or inconclusive OS evidence. Windows on Arm GPU verification checks every reported device and aggregate capacity without qualifying generic multi-GPU hosts for larger automatic Ollama model selection. Related changes: PR #11780 and PR #12212. Refer to System Readiness and Prepare Windows for NemoClaw.
• NVIDIA Endpoints onboarding no longer selects the retired MiniMax M3 model. Interactive onboarding asks for a replacement; noninteractive onboarding uses an eligible configured model or the agent default. OpenRouter model selection remains separate from NVIDIA’s retirement policy. Related change: PR #11864. Refer to Use NVIDIA Endpoints.
• Provider credential recovery directs you to choose retry before entering an API key in the secure prompt. Recovery requires interactive terminals for standard input and standard error; otherwise, onboarding exits with a nonzero status. Related change: PR #12093. Refer to Understand Provider Validation.
• Legacy plaintext credential cleanup removes only entries whose migration to the OpenShell gateway has been verified. Unmigrated entries remain available for later onboarding attempts. Related change: PR #10384. Refer to Credential Storage for migration and cleanup conditions.

NemoClaw v0.0.128 adds canonical v1alpha1 configuration export for supported single-agent sandboxes and completes more OpenShell lifecycle ownership. It also updates the managed OpenClaw and Hermes runtimes and improves inference readiness, MCP changes, onboarding recovery, and Deep Agents compatibility.

• nemoclaw config export now emits the supported nemoclaw.nvidia.com/v1alpha1 shape for hosted single-agent OpenClaw, Hermes, and Deep Agents sandboxes. OpenClaw and Hermes exports use the singular sandbox.agent field and omit the target-managed image, while imported corporate CA state no longer blocks migration output. Exports with unsupported secondary-agent rosters still fail before publication instead of dropping agents. Related changes: PR #11986, PR #12057, PR #12013, PR #12164, and PR #12168. For more information, refer to the NemoClaw CLI Commands Reference.
• Standard Docker and native Podman sandbox lifecycle now stays behind OpenShell, including ordinary sandbox creation through the typed lifecycle adapter. Forward startup errors now retain bounded diagnostics, post-create recovery can reconcile an exact retained identity before publication, and upgrades restore a missing named gateway registration. Rebuild failures now distinguish an unverified replacement version from a version mismatch and print the preserved backup and recovery commands. Related changes: PR #11909, PR #12121, PR #12090, PR #12083, PR #11956, and PR #12061. For more information, refer to Understand Gateway Lifecycle Control, Recover and Rebuild Sandboxes, and Troubleshooting.
• Managed images now include OpenClaw 2026.9.1 and Hermes 0.21.3. Fresh Hermes installs preserve the forwards created during onboarding, and credential changes accept the expected OpenShell relay disconnect only after the native gateway recovers and its messaging forward returns. OpenClaw device approval now exits after both direct-gateway and local-fallback output drains; a drain failure or timeout exits nonzero instead of waiting on leftover gateway handles. Related changes: PR #11105, PR #11817, PR #12102, PR #12101, and PR #12178. For more information, refer to the OpenClaw Quickstart, Quickstart with Hermes, and Troubleshooting for Hermes.
• nemoclaw status now reports each sandbox’s configured inference provider and model separately from the shared gateway’s live route. JSON output adds a redacted configuredInference object while preserving the existing schema-version-1 meaning of the row-level provider and model fields. Related change: PR #12233. For more information, refer to the NemoClaw CLI Commands Reference.
• NVIDIA Endpoints validation now uses the documented reasoning_effort: "none" control for Nemotron 3 Super. Managed llama.cpp honors its configured readiness budget, Model Router startup waits for each semantic health response within its existing startup budget, and qualifying Windows WSL N1x hosts can rank installed Ollama models when the chassis reports an OEM model string. Related changes: PR #12007, PR #11955, PR #12096, and PR #11617. For more information, refer to Choose an Inference Provider, Set Up llama.cpp, and Prepare Windows for NemoClaw.
• MCP registration now rejects aliases that resolve to one endpoint but request different credential providers before it mutates policy or provider state. Credential-bound probes run through the adapter executable boundary, and Hermes MCP add now verifies a committed healthy reload before it accepts an expected exec-relay disconnect. Related changes: PR #11917, PR #12175, and PR #12091. For more information, refer to Add an MCP Server, Manage MCP Servers, and Troubleshoot MCP Servers.
• Installer and onboarding checks now support protected Docker 27 receipt transfer and an explicit force-fresh macOS reset that retains model caches. Port overrides with leading zeroes fail before onboarding, and Teams channel changes verify the selected webhook port before mutation or rebuild deletion. Invalid NEMOCLAW_CORPORATE_CA_BUNDLE input now reports an actionable path-free validation reason instead of a managed image catalog failure, and lock contention diagnostics identify the live process that owns the onboarding state lock. Related changes: PR #12015, PR #11875, PR #10489, PR #12074, and PR #12234. For more information, refer to System Readiness, Enable Channels During Onboarding, and Troubleshooting.
• Deep Agents Code can now complete its first interactive model turn while the OpenShell sandbox continues to deny memfd_create. Headless inference and sandbox lifecycle behavior remain unchanged. Related change: PR #11972. For more information, refer to the Deep Agents Quickstart.

NemoClaw v0.0.127 returns gateway, plugin, and package lifecycle ownership to OpenClaw and Hermes while preserving OpenShell sandbox controls. It also improves sandbox startup and deletion convergence, configuration export, shared inference routing, installer readiness, MCP diagnostics, and messaging reuse.

• OpenClaw and Hermes now own their native gateway processes, plugins, packages, child processes, hooks, and background work after onboarding. NemoClaw continues to select the exact OpenShell sandbox, project credentials, observe health, repair host forwards, and preserve native agent state through rebuild and restore. Managed Docker bootstrap also retains recovery state until the replacement sandbox identity and reconnect path are verified. Related changes: PR #11792, PR #11906, and PR #11698. For more information, refer to Understand Gateway Lifecycle Control, Install OpenClaw Plugins, and Install Hermes Plugins.
• Starting a stopped OpenClaw or Hermes sandbox now waits for the native gateway to become observably ready before health checks and host-forward restoration. A failed OpenClaw startup retains its intentional-stop record so a retry repeats the bounded settlement path, while Hermes recovery rejects a persistently stopped gateway instead of reporting readiness early. Related changes: PR #11914, PR #11933, and PR #11950. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• Sandbox destroy, rebuild, forced snapshot restore, and final-gateway cleanup now wait for bounded OpenShell deletion convergence without retrying the delete mutation. Ambiguous or persistent state preserves local recovery ownership, and final-gateway cleanup explains why it kept the gateway when sandbox absence or the lack of other live sandboxes cannot be proved. Related changes: PR #11838, PR #11951, and PR #11614. For more information, refer to the NemoClaw CLI Commands Reference, Create and Restore Snapshots, and Troubleshooting.
• Docker-backed rebuild now replays the exact provider-captured GPU selector and fails before deletion when the selected acceleration cannot be represented safely. Related change: PR #11929. For more information, refer to the NemoClaw CLI Commands Reference.
• nemoclaw config export now accepts HTTP and HTTPS inference endpoints, retains supported managed vLLM execution and model settings, and exports the verified selected Ollama model with its SHA-256 digest. At that release, hosted OpenClaw exports preserved supported read-only secondary agents. The current v1-aligned exporter instead rejects every secondary-agent roster without producing a document. Related changes: PR #11789, PR #11889, PR #11891, and PR #11900. For more information, refer to the NemoClaw CLI Commands Reference and Set Up Ollama.
• Pi rebuild now preserves recorded context-window, output-token, reasoning, and reasoning-effort settings, and its qualification path verifies context-free automation and interactive session persistence across onboarding, rebuild, and recovery. The Pi documentation now defines model limits, lifecycle commands, candidate-image authority, and the current support boundary. Related change: PR #10355. For more information, refer to Configure Pi Model Limits, Run Pi, and Pi Support and Security.
• nemoclaw <sandbox> inference set now permits provider-only or model-only changes on a shared OpenShell gateway and warns which registered sandboxes the route change affects. Endpoint, API-family, credential, incomplete-route, and invalid-gateway conflicts still stop before mutation. Related change: PR #11947. For more information, refer to Use Shared Gateway Routes and the NemoClaw CLI Commands Reference.
• Docker readiness and onboarding now treat DOCKER_CONTEXT as the operator-selected authority instead of silently falling back to another local daemon. Installation now stages and verifies the required OpenShell SDK without GitHub credentials, and a trusted package upgrade writes the complete authenticated gateway environment before restarting the service. Related changes: PR #11786, PR #11921, and PR #11843. For more information, refer to System Readiness, Troubleshooting, and the OpenClaw Quickstart.
• MCP status and credential probes now honor the recorded trusted private host when discovering tools, while entries without that recorded trust keep the strict public-address boundary. Managed MCP documentation now distinguishes adapter-scoped egress from interactive shell commands, and nemoclaw credentials add refuses an ambient untrusted gateway endpoint override before any host-side probe or provider mutation. Related changes: PR #11405, PR #11866, and PR #11865. For more information, refer to Add an MCP Server, Manage MCP Servers, and Troubleshoot MCP Servers.
• Reusing a sandbox through onboarding now preserves an active messaging channel and its matching network policy when durable gateway credential bindings still prove that configuration. Explicit channel removal or durable credential removal still disables the channel and removes its policy preset. Related change: PR #10782. For more information, refer to Enable Channels During Onboarding and Network Policies Reference.
• Manual OpenClaw state transfer now includes every seeded workspace template, including TOOLS.md and HEARTBEAT.md, while keeping generated POLICY.md out of uploads. Related change: PR #11524. For more information, refer to Transfer State Manually.

NemoClaw v0.0.126 moves sandbox, gateway, and host-forward recovery onto typed OpenShell lifecycle controls. It also strengthens Podman onboarding, destructive-operation safety, secret redaction, policy activation, and package execution.

• Sandbox lifecycle and host-forward operations now share typed OpenShell adapters for selection, registration, observation, recovery, and cleanup. Stop, destroy, and rebuild retain the local sandbox registry record when forward release cannot be proved. Gateway startup offers a service stop command only when one stable active service is the sole listener and owns the selected state, and supported recovery no longer replaces legacy keepalive containers. Related changes: PR #11594, PR #11725, PR #11741, and PR #11776. For more information, refer to Understand Gateway Lifecycle Control and Recover and Rebuild Sandboxes.
• nemoclaw <name> recover now starts a stopped Docker-driver sandbox through OpenShell so the sandbox returns to Ready instead of leaving a running container in Stopped. A later start repairs the same phase mismatch, while paused sandboxes and running sandboxes in other phases remain unchanged. Related changes: PR #11784 and PR #11797. For more information, refer to Recover and Rebuild Sandboxes and Recover and Rebuild Sandboxes for Hermes.
• Managed Podman onboarding now reads the structured OpenShell main-process specification, preserves its terminal setting, and releases the stopped original container before the replacement binds its port. Failed-onboarding destroy uses the explicitly selected Podman provider only before durable sandbox or gateway provider state exists, and it does not fall through to Docker. Related change: PR #11816. For more information, refer to Platform Support and the NemoClaw CLI Commands Reference.
• rebuild now stops before backup or sandbox deletion when a recorded remote inference credential is expired, missing, or cannot be verified. It checks the credential again immediately before deletion, preserves the existing sandbox, and does not let --force bypass this boundary. Related change: PR #11779. For more information, refer to Recover and Rebuild Sandboxes.
• nemoclaw uninstall --yes can now remove a non-default-port state root left by onboarding that failed during preflight before it created a sandbox or gateway. Cleanup holds the onboarding lock, revalidates ownership and absence, and preserves state when the evidence changes, belongs to another gateway, or uses a custom state root. Related change: PR #11602. For more information, refer to Uninstall NemoClaw.
• OpenShell policy writes now allow 65 seconds for the 60-second activation wait and process settlement, while read-only policy operations retain their 15-second deadline. This prevents larger policy updates, including a second managed MCP server, from ending before OpenShell reports the activation result. Related change: PR #11863. For more information, refer to Apply Policy Presets and Manage MCP Servers.
• nemoclaw list now applies the same redaction boundary as nemoclaw status to sandbox, inference, policy, agent, phase, and recovery fields in text and JSON output. Managed vLLM adoption now queries the published port by the inspected container ID, so a container-name transfer cannot redirect the adoption decision. Related changes: PR #11815 and PR #11821. For more information, refer to the NemoClaw CLI Commands Reference and Set Up vLLM.
• Managed image and CI builds use Node.js 24.18.1 with integrity-verified npm 12.0.2 while the public Node.js 22.19 compatibility floor remains unchanged. Builds also set every package.json executable, including nemoclaw-acp and nemoclaw-blueprint-runner, to mode 0755, so fresh packages can invoke them directly. Related changes: PR #11736, PR #11839, and PR #11840. For more information, refer to Quickstart with Hermes and Troubleshooting.
• The Experimental NemoCUA command reference now states that host-local inference, including local Ollama, is unsupported and names the onboarding error for that selection. Related change: PR #11095. For more information, refer to the NemoClaw CLI Commands Reference.

NemoClaw v0.0.125 strengthens OpenShell gateway authority and onboarding finalization. It also improves sandbox transfers, native Podman and OpenClaw networking, and the release validation pipeline.

• The Hermes nemoclaw-acp adapter can select and, when required, start only its exact recorded OpenShell gateway when it is missing, unhealthy, or unreachable, or when a different gateway is connected. Conflicting or ambiguous gateway identities, authentication errors, schema failures, timeouts, and other observation failures stop recovery before gateway startup or ACP session creation. Related changes: PR #11691 and PR #11681. For more information, refer to the Hermes CLI Commands Reference and Recover and Rebuild Sandboxes.
• Onboarding preserves process-inspection and secret-boundary refusals as incomplete, resumable state instead of reporting a ready sandbox. Experimental version 2 external-component activation evidence now accepts the same namespaced component IDs as registration while continuing to reject the reserved openshell/ prefix and malformed evidence. Related changes: PR #11760 and PR #11745. For more information, refer to the NemoClaw CLI Commands Reference, Troubleshooting, and Register an External Component During Onboarding.
• Legacy OpenShell upgrade recovery preserves the recorded gateway, sandbox identity, workspace, and digest-verified pre-upgrade policy when live provider inspection is unavailable. Related changes: PR #11612 and PR #11585. For more information, refer to Recover and Rebuild Sandboxes and Recover and Rebuild Sandboxes for Hermes.
• Sandbox upload and download commands now await typed OpenShell transfers on the sandbox’s recorded gateway. The lifecycle lock and owned staging remain active until transfer, verification, publication, and cleanup settle, while existing terminal output and exit behavior remain unchanged. Related change: PR #11496. For more information, refer to the NemoClaw CLI Commands Reference.
• Managed OpenClaw now uses its native sandbox-local loopback endpoint by default and no longer depends on private-interface discovery, insecure private WebSockets, or a dedicated gateway dialback policy. Native Podman onboarding accepts the standard rootless socket layout when a private current-user directory prevents access by other users, while unsafe reachable sockets remain blocked. Related changes: PR #11695 and PR #11730. For more information, refer to Network Policies, System Readiness, and Troubleshooting.
• Protected managed-image qualification now retains bounded, redacted failure evidence and completes rollback in OpenShell-before-Docker order. Lifecycle changes trigger the corresponding activation and publication gates, platform runs retain per-commit evidence, isolated jobs initialize their gateway before owned cleanup, transient tool downloads retry, and obsolete or overly broad E2E fixtures have been removed or narrowed. Agent-alias and onboarding probes also run independent cases concurrently without reducing assertions. Related changes: PR #11713, PR #11663, PR #11607, PR #11769, PR #11742, PR #11743, PR #11588, PR #11708, and PR #11704.
• PR Review Advisor accepts unresolved required E2E coverage when no runnable selector exists, requires a nonempty read of each declared evidence file, and records bounded tool-flow metadata for failed turns without exposing arguments, paths, or untrusted names. Related changes: PR #11773, PR #11762, and PR #11728.
• Internal messaging declarations with no active consumer have been removed without changing channel manifests or runtime behavior. The source scan configuration also recognizes the checksum-pinned Hermes documentation search key through one exact, read-only allowlist entry. Related changes: PR #11705 and PR #11740.

NemoClaw v0.0.124 updates the managed OpenShell runtime to 0.0.116 and improves upgrades, local inference, and sandbox recovery. It also restores interactive Deep Agents Code execution features and improves agent message handling.

• Upgrade recovery now waits for the replaced packaged gateway to bind before recovering sandboxes. Failed required pre-upgrade backups no longer leave incomplete directories that appear to be recovery points; failed cleanup reports the retained path. Rebuild also preserves the recorded serving-profile selection instead of losing it during recreation. Related changes: PR #11251, PR #11710, PR #11589, and PR #11686.
• Named sandbox commands now use the sandbox’s recorded gateway across gateway-port registry roots. If forward startup fails, recovery removes only forwards it started and reports cleanup it cannot verify. Interactive launch releases lifecycle locks after dispatch so other lifecycle commands can proceed during the session. Related changes: PR #11445, PR #11668, PR #11670, and PR #11657.
• llama.cpp selection uses the authenticated server’s served context window when no valid explicit override is set. Docker Desktop on WSL checks the host-loopback listener from the WSL CLI process before the sandbox bridge check. Unsupported inference-provider errors list supported providers on the selected gateway, with a supported-provider fallback when discovery fails. Related changes: PR #11544, PR #11444, and PR #11464.
• Interrupted managed vLLM installation can replace a running container only when its ownership, local Docker connection, and port mapping match the requested installation. Other port holders remain protected. N1x preview rebuild accepts a retained canonical managed endpoint with the recorded preview decision. Related changes: PR #11587 and PR #11580.
• Native Linux Docker OpenClaw configuration export accepts the verified Ollama route created during ordinary onboarding. It requires the managed proxy credential and omits its value from the export. Stopping an Ollama sandbox no longer retains its model solely because a matching sibling is stopped or incomplete. An unverified sibling state prevents model unload and makes stop exit nonzero. Related changes: PR #11550 and PR #11656.
• Managed Deep Agents Code interactive sessions restore native local shell, startup-command, and interpreter behavior inside the OpenShell sandbox. Headless shell execution remains disabled, and headless non-shell tools retain automatic approval. Non-interactive reply handling and pre-session inference verification also improve. Related changes: PR #11683, PR #11276, and PR #11546.
• Agent message dispatch preserves piped input and avoids waiting on idle standard input when a message is already supplied. Managed OpenClaw heartbeats use isolated sessions to avoid changing the main conversation. Related changes: PR #11382 and PR #11487.
• Fresh interceptor-based providerless onboarding now leaves OpenClaw and Hermes without an inference route until a managed provider is configured. Version 2 external-component declarations remain unqualified against a released OpenShell runtime and must not be relied on in an installed release. Related changes: PR #11584, PR #11633, and PR #11525.
• Discord setup rejects the literal bot-token placeholder before configuring the channel. Uninstall failures caused by unavailable Docker now explain how to restore access and retry while preserving gateway state. Fatal messaging-build and npm remediation diagnostics redact sensitive process details. Related changes: PR #11404, PR #11474, and PR #11674.

NemoClaw v0.0.123 expands configuration export for managed OpenClaw and Hermes sandboxes. It adds an experimental external-component onboarding contract and improves installer recovery, sandbox lifecycle handling, and inference diagnostics.

• nemoclaw config export now exports canonical managed Hermes sandboxes, including verified API-key authentication and nondefault interface settings. OAuth authentication and Hermes tool gateways remain outside the export contract. Related changes: PR #11323, PR #11450, and PR #11477. Refer to the NemoClaw CLI Commands Reference.
• OpenClaw configuration export now preserves managed Brave Search references, proxy settings, hosted inference tuning, execution settings, dashboard settings, direct tool disclosure, and local conversation diagnostics. It also supports one read-only secondary agent that shares the primary hosted inference route. Local Ollama export preserves verified daemon and proxy ports. Export verifies live and retained configuration evidence and writes credential references instead of secret values. Related changes: PR #11384, PR #11387, PR #11383, PR #11429, PR #11430, PR #11431, PR #11473, and PR #11478. Refer to the NemoClaw CLI Commands Reference for the supported export profiles and their limits.
• Fresh onboarding on Linux can register one experimental external host component with a NemoClaw-managed Docker-driver gateway. NemoClaw validates the declaration before gateway changes and verifies sandbox identity and effective policy before activation. Failed or ambiguous activation preserves the sandbox and records incomplete state; resume and automatic activation retries are unsupported. NemoClaw does not manage the component service or its credentials. Related changes: PR #11366 and PR #11471. Refer to Register an External Component During Onboarding.
• The installer now attempts existing sandbox recovery before generic host admission and preserves each sandbox’s recorded GPU selection. It distinguishes confirmed recovery from missing sandboxes or unconfirmed recovery output, and reports warnings instead of claiming complete recovery. Fresh onboarding and required DGX Station reconciliation still require host admission. Related change: PR #10397. Refer to Update Sandboxes.
• Sandbox status now distinguishes an intentional stop from a failure, and connect directs you to start a stopped sandbox. Related changes: PR #11211, PR #11336, PR #11482, and PR #11490. Refer to Recover and Rebuild Sandboxes.
• NVIDIA Endpoints validation now checks the selected inference route. Onboarding and sandbox status identify the account-access cause when NVIDIA returns a matching model-access 404, without exposing the response body in status diagnostics. Docker readiness failures identify authority conflicts, and GPU-mode probe failures retain the Docker failure reason. Non-interactive onboarding resolves the sandbox name before provider selection. Related changes: PR #10957, PR #11393, PR #11280, and PR #11442. Refer to Verify the Sandbox Inference Route and System Readiness.
• Removing Teams now removes Teams-owned Microsoft login credential bindings from matching Outlook policy endpoints. It refuses to remove bindings owned by another integration. Related change: PR #10846. Refer to the NemoClaw CLI Commands Reference.

NemoClaw v0.0.122 improves host detection and local inference selection for Docker, DGX Station, and N1x WSL. It also strengthens interrupted onboarding, configuration export, remote dashboard access, and uninstall failure reporting.

• Host readiness now runs Docker probes with the environment that later Docker commands use. It respects the selected Docker context and configuration, rejects unsafe explicit endpoints, and can select the rootless Linux socket after an unreachable default authority. DGX Station checks now separate GB300 hardware identity from the qualified software profile and apply the same classifier during host preparation and onboarding. Related changes: PR #10379 and PR #10914. For more information, refer to System Readiness and Prepare a DGX Station.
• A CUDA-qualified N1x WSL host now selects the managed Qwen llama.cpp profile instead of falling back to the smaller Ollama profile. A resumed preset-driven managed vLLM installation verifies the recorded model and serving preset before it changes runtime state. A mismatch stops onboarding and directs you to restart with nemoclaw onboard --fresh. Related changes: PR #11078 and PR #11271. For more information, refer to Choose a Local Inference Server, Set Up llama.cpp, and Set Up vLLM.
• Interrupted onboarding now releases its process lock and abandons an uncommitted inference-route reservation before a later resume. Final handoff keeps incomplete sandbox identity available for recovery and does not report success when replacement onboarding exits nonzero. The global nemoclaw doctor command remains available without a sandbox name, including when a registered sandbox is named doctor. Related changes: PR #11140, PR #11205, PR #11218, and PR #11296. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• nemoclaw config export now supports native NVIDIA hosted inference only when the gateway uses the built-in nvidia-prod profile, its default endpoint, and no provider configuration overrides. Missing or inconsistent provider evidence stops the export without writing a configuration document. Related changes: PR #11065 and PR #11318. For more information, refer to the NemoClaw CLI Commands Reference.
• Neutral managed OpenClaw images no longer declare the uninstalled Tavily plugin. This removes recurring plugin not installed: tavily warnings when Tavily Search was not selected, while explicitly selected Tavily configuration remains unchanged. Related change: PR #10331. For more information, refer to Troubleshooting.
• Remote dashboard access now keeps an external CHAT_UI_URL separate from the host forward bind. A reverse proxy or tunnel can reach the loopback forward while the URL configures the browser origin and Host-header validation. Direct access on a non-WSL host requires NEMOCLAW_DASHBOARD_BIND=0.0.0.0 before onboarding and for later nemohermes <sandbox> connect calls. Protect the dashboard and API ingress before exposing either service. Related change: PR #10931. For more information, refer to Quickstart with Hermes and Gateway Authentication Controls.
• The installer now refuses an implicit NemoClaw CLI downgrade and reports the installed and requested versions before it changes the installation. Uninstall exits nonzero when it cannot remove the gateway registration, so automation does not treat partial cleanup as success. Related changes: PR #11209 and PR #9860. For more information, refer to Update Sandboxes and Uninstall NemoClaw.

NemoClaw v0.0.121 adds managed MCP tool-denial rules and moves skill lifecycle to agent-owned state. It also hardens messaging providers, Windows and WSL inference, sandbox recovery, file transfer, and Hermes state repair.

• Managed MCP servers can now deny exact tool names or glob patterns through repeatable --deny-tool options. The new mcp update command replaces the complete denied-tool list or clears it with --clear-deny-tools. Status, restart, rebuild, and launch-readiness checks use the persisted rules and report drift with a recovery command. Related change: PR #11135. For more information, refer to Add an MCP Server, Manage MCP Servers, and Troubleshoot MCP Servers.
• Skill lifecycle state now belongs to the selected agent instead of a parallel NemoClaw inventory. skill list streams the agent’s native result, while install and remove use native commands when the agent exposes an equivalent operation. Other operations use the manifest-declared writable skill directory without claiming that a same-name skill elsewhere is absent. Related change: PR #11093. For more information, refer to Understand Sandbox State and the NemoClaw CLI Commands Reference.
• Messaging provider setup now uses typed OpenShell lifecycle results for registration, reuse, authorized replacement, attachment, refresh observation, and partial-failure recovery. Typed lifecycle results include credential names but never credential values, and channel removal omits placeholder credentials that were never configured. Channel stop and start now preserve credentials and runtime configuration through rebuild and stopped-sandbox restart. Related changes: PR #11009, PR #11126, PR #11188, and PR #11193. For more information, refer to Manage Messaging Channels and Credential Storage.
• A CUDA-qualified WSL RTX Spark N1x with at least 30,000 MiB available now ranks an installed qwen3.6:35b before qwen3.5:9b for Ollama. Windows Ollama onboarding and restart keep traffic in Docker Desktop’s verified network context and restore the previous User-scope binding and process state when a transaction fails. Recovery also reports bounded probe-timeout guidance instead of leaving the route failure ambiguous. Related changes: PR #11187, PR #10855, PR #10889, and PR #11192. For more information, refer to Set Up Ollama, Prepare Windows, and System Readiness.
• Inference provider creation, update, deletion, inspection, settlement, and rollback now use the typed OpenShell provider boundary. Mutations fail closed when ownership or revision identity is incomplete, and rollback verifies the provider revision before deletion. inference get reports a reusable endpoint for compatible custom providers only when persisted metadata is safe, complete, and unambiguous. Status distinguishes the configured model from the live routed model and requires verified llama.cpp routes. Related changes: PR #11008, PR #10833, PR #10261, PR #10471, and PR #11207. For more information, refer to Switch Inference Providers and the NemoClaw CLI Commands Reference.
• Sandbox download now rejects a directory that contains a symbolic link or another special file before transfer or host destination creation. Snapshot and rebuild recovery preserve fail-closed identity checks, recover an interrupted backup, and reject unsafe local fallback images. A retained sandbox is removed only after its gateway confirms absence and residual resources have sufficient identity evidence. Related changes: PR #10654, PR #11142, PR #11094, and PR #10867. For more information, refer to Transfer State Manually, Recover and Rebuild Sandboxes, and Troubleshooting.
• Hermes startup now repairs restored session, gateway, runtime, history, and log state through descriptor-verified paths before the gateway opens them. It rejects symbolic-link and file substitutions without changing their targets, and it keeps mutable runtime configuration outside relaunch policy. Hermes diagnostics also preserve invalid dashboard URL details and initialize the Kanban schema atomically. Related changes: PR #10872, PR #11110, PR #11227, and PR #11177. For more information, refer to Recover and Rebuild Sandboxes, Gateway Lifecycle Control, and Troubleshooting.
• Onboarding now fails before sandbox mutation when a managed-image flow cannot honor a configured base-image override. GPU handoff resumes from validated checkpoints, managed vLLM avoids repeated retries after a rejected pinned image, and Gemini HTTP 400 failures include provider-specific recovery guidance. Related changes: PR #11152, PR #11124, PR #11048, and PR #11171. For more information, refer to the NemoClaw CLI Commands Reference, Set Up vLLM, and Use Google Gemini.
• Managed OpenClaw and Hermes recovery now waits within a 210-second budget for a typed delayed managed-container discovery result. Other privileged-control, identity, and diagnostic failures remain terminal. Related change: PR #11236. For more information, refer to Recover and Rebuild Sandboxes.
• Hermes rebuild now preserves supported configuration values recorded through nemohermes <name> config set. It excludes gateway settings, managed inference-route fields, and credential material, verifies restored values, and lists restored and dropped keys. Capture failures stop before deletion; restore or verification failures retain recovery state and exit nonzero. Related change: PR #10780. For more information, refer to Rebuild While Preserving State.

NemoClaw v0.0.120 adds secret-free verified configuration export and a global host and gateway doctor. It updates the supported Hermes runtime to 0.20.6, retires Shields from NemoClaw core, and moves managed host forwarding to OpenShell service forwarding. It also hardens sandbox recovery, onboarding, inference validation, MCP lifecycle operations, mTLS selection, and credential-bound messaging policy.

NemoClaw v0.0.119 adds an explicitly selected native rootless Podman runtime path and an experimental managed llama.cpp path for qualifying Windows WSL N1x hosts. It hardens custom network policy, WeChat redirect, Langfuse, MCP credential, and messaging-rebuild boundaries. It also improves local inference selection, Hermes recovery, interrupted-install guidance, and sandbox command behavior, and updates reviewed production dependency graphs to remove four high-severity fast-uri advisories.

NemoClaw v0.0.118 adds headless package boundaries for Hermes lifecycle planning and credential-free external OpenShell gateway health checks. It improves fail-closed sandbox destruction, rebuild, onboarding, Shields, inference, and Hermes recovery. It also broadens Deferred N1x detection and gives N1x managed vLLM a dedicated serving profile.

• The new nemoclaw/lifecycle package export supports deterministic Hermes 0.19.0 lifecycle planning and read-only agent observation with OpenShell 0.0.106. Callers provide the observation capability; the package does not own transport, authentication, persistence, or mutation. The Blueprint Runner can also check a configured external OpenShell gateway through the pinned SDK without credentials or mutation. Related changes: PR #10703 and PR #10618.
• OpenClaw sandbox destruction now detects Shields-locked Mcporter configuration before mutation and provides recovery guidance. destroy --force can continue only for retained OpenClaw Mcporter entries, while Hermes and ordinary MCP mutations remain fail-closed. Related change: PR #10483.
• Rebuild now stops before deleting the original sandbox when any declared state directory or file cannot be preserved, including with --force. When cleanup fails, NemoClaw retains the incomplete snapshot at the reported path. It excludes the snapshot from snapshot list and restore selection. The directory can contain unsanitized credentials. Keep it owner-only. Do not restore, copy, share, or edit it. Repair access to the original sandbox state. Remove the retained directory only after you verify that the original sandbox or a complete snapshot contains every required state item. Confirm that the reported path is absent. Then rerun the operation. A failed nested onboarding result no longer proceeds to restore or report success. Related changes: PR #10686 and PR #10590.
• Fresh onboarding now ends the OpenShell create handoff after receiving a validated durable sandbox ID, then settles and verifies identity before post-create effects. This prevents affected WSL2 ARM OpenClaw sandboxes from moving from Ready to Error while publication metadata is still settling. Related change: PR #10789.
• Hermes stopped-sandbox recovery reuses verified lifecycle and inference state. It still rolls back failures and performs final readiness qualification. Hermes dashboards behind a reverse proxy also accept the hostname from a validated HTTPS CHAT_UI_URL for HTTP and WebSocket requests while remaining bound to loopback. Related changes: PR #10641 and PR #10687.
• Inference status now queries the selected gateway instead of implicitly using the default gateway. Hugging Face model downloads with no output abort after a bounded stall timeout. Managed vLLM accepts a catalog short name, full Hugging Face model ID, or registered served model name as aliases for the same model. Onboarding normalizes known aliases when it reuses an existing managed vLLM endpoint, while pull-request CI verifies pinned Hugging Face references without credentials. Related changes: PR #10698, PR #10352, and PR #10429.
• Shields status for Hermes now remains read-only instead of repairing mutable state during observation. Related change: PR #10710.
• DGX Station Express host preparation now ignores NemoClaw and OpenShell agent processes owned by another user for non-root and sudo controllers. It still blocks the controller agent processes and keeps direct-root agent checks, vLLM conflicts, and Docker conflicts host-wide. Related change: PR #10689.
• Deferred N1x preview detection now accepts NVIDIA display-class GPUs without requiring one PCI device ID and recognizes OEM DGX Spark FastOS identity. v0.0.118 introduced a dedicated N1x Qwen3.6 35B NVFP4 serving profile with its original memory, context, concurrency, and batching envelope physically exercised. For the current limits and validation status, refer to Set Up vLLM. N1x remains Deferred pending complete Express end-to-end validation. Related changes: PR #10099, PR #10721, and PR #10625.

NemoClaw v0.0.117 makes OpenShell the sole durable network-policy authority. It improves fail-closed recovery for sandboxes, Shields, the installer, and messaging channels. It also removes the deprecated Brev deploy wrapper and adds contributor and maintainer analysis tools.

• OpenShell is now the sole durable source of sandbox policy state. NemoClaw policy commands and Shields operate on the live OpenShell policy without storing a second desired-policy copy, while rebuild carries the current policy through one private, temporary handoff. Legacy policy fields are removed from NemoClaw state without changing the live policy. Related change: PR #10515.
• Failed onboarding cleanup now retains immutable sandbox, gateway, policy, and create-attempt evidence. While OpenShell still reports the sandbox live, destroy preserves recovery instead of deleting by mutable name. After OpenShell confirms absence, NemoClaw removes only containers that match the retained immutable identity and verifies their absence before clearing recovery state. Related change: PR #10571.
• The OpenClaw memory secret scanner now covers writes under absolute named-workspace paths such as /sandbox/.openclaw/workspace-main/. Project directories whose names start with workspace- remain outside the memory-path classification unless they are under the OpenClaw state directory. Related change: PR #10527.
• Hermes activation and Shields recovery now bind release acknowledgement, writer rescans, root-broker cleanup, and completed auto-restore lock retirement to exact process and transaction identities. Transient replaced writers are reconsidered under fresh identity, while live, foreign, durable, or ambiguous identity remains denied. Related changes: PR #10272, PR #10597, and PR #10603.
• macOS upgrades can retire an identity-verified legacy OpenShell gateway or Homebrew service before selecting the checksum-verified replacement binaries. Managed startup also transfers protected receipts through read-only Docker volumes, so VM-backed Docker daemons such as Colima do not need access to a client-only temporary path. Failed verification retains the recovery receipts, and successful finalization reports any exact volume that cleanup cannot remove. Related changes: PR #10484 and PR #10534.
• Experimental OpenClaw WeChat setup now writes the exact revision-scoped OpenShell placeholder to the Tencent plugin account file and binds both authorized iLink endpoints to the channel provider. Channel removal clears durable account state before provider, policy, or registry teardown, and raw bot tokens remain outside sandbox files, process arguments, and diagnostics. Related change: PR #10601.
• The deprecated nemoclaw deploy Brev compatibility command has been removed. Remote hosts use their provisioning workflow, the hosted installer, and nemoclaw onboard; deploy is now available as a sandbox name. Related change: PR #10576.
• nemoclaw <name> logs now labels OpenClaw gateway lines with [gateway] and keeps existing OpenShell source tags unchanged. Follow mode bounds incomplete-line memory, honors output backpressure, waits for accepted writes, and reports source failures. Related change: PR #10342.
• Contributors with a prepared checkout can run the checked-in PR Review Advisor specialists on committed and working-tree changes with npm run review:local before PR publication. The local-run prerequisites name the required host tools, the origin/main trust base, and the credential boundary. Hosted specialist jobs publish completed analyses in their GitHub job summaries. Maintainer analysis now emits bounded slow-test evidence and Perfetto-compatible PR lifetime traces with revision, readiness, review-request, workflow, job, and step timelines. Related changes: PR #10581, PR #10604, PR #10608, PR #10611, PR #10616, PR #10617, and PR #10623.
• Development qualification now contains a provider-owned record and dormant executor for the OpenShell v0.0.24 and MXC v0.7.0-rc1 checkpoint on physical Windows. NemoClaw does not register or select MXC, expose Windows onboarding, activate this executor, or treat the checkpoint as an accepted stable distribution. Related changes: PR #10591 and PR #10596.

NemoClaw v0.0.116 improves compatible endpoint validation, sandbox lifecycle safety, managed images, Windows Subsystem for Linux onboarding, managed local inference, and experimental Hermes channel credentials. It also preserves recorded network-policy intent during sandbox reuse and rebuild.

• OpenClaw compatible endpoint onboarding now validates inference.local from inside the sandbox even when no messaging channel is selected, and an unreachable route stops onboarding before final deployment verification. inference set can reuse a recorded loopback no-auth endpoint without replacing its provider, and reasoning-only responses receive one bounded larger-budget content attempt before failure. Related changes: PR #10458, PR #10531, and PR #10540.
• Uninstall now creates fresh snapshots for eligible registered sandboxes before deletion unless destroy-user-data is selected. It honors NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR and stops before cleanup when backup, lifecycle-lock, ownership, or registration checks fail. Related changes: PR #10231, PR #10550, and PR #10562.
• Sandbox creation and reuse now retain verified sandbox identity, policy, provider, credential, and lifecycle authority across retries and process restarts. Same-name replacements and authority drift stop mutation, while managed-image registration tolerates a transient non-Ready report only when durable sandbox identity still matches. Related changes: PR #10510 and PR #10512.
• Sandbox destruction can recover an expired Shields auto-restore timer only when its process is gone or its recorded start identity no longer matches. Live or unverifiable timer ownership remains fail-closed, and destruction skips pre-delete hardening only after Docker proves the sandbox container is absent. Related change: PR #10225.
• OpenClaw images now install checksum-pinned libevent 2.1.13 on AMD64 and ARM64. Related changes: PR #10532 and PR #10526.
• On WSL, public managed image pulls, generated image builds, GPU probes, and local inference probe pulls use a temporary credential-free Docker configuration when the default Docker Desktop credential helper is unavailable. Managed local inference now waits for disposable Podman probe identities to disappear after one removal command, and llama.cpp image-pull failures report a fixed layer, code, and exit status without exposing raw pull output. Related changes: PR #10470, PR #10554, and PR #10561.
• Re-onboarding or rebuilding an OpenClaw sandbox with a recorded Balanced or Open tier now keeps an already-applied brave preset when web search is disabled or switched to Tavily Search. Restricted and unknown tiers, unsupported agents, and custom preset ownership retain their existing fail-closed reconciliation behavior. Related change: PR #10457.
• For the experimental Hermes WeChat and Microsoft Teams channels, managed startup now maps revision-scoped OpenShell credential placeholders to the environment names Hermes reads. Only matching revision-scoped placeholders are copied. Raw or identityless runtime values are ignored, while malformed or channel-unbound aliases stop startup; both channels remain experimental. Related change: PR #10563.

NemoClaw v0.0.115 strengthens sandbox lifecycle authority, managed messaging credentials, and installer recovery. It also improves managed local inference and adds bounded experimental planning for an externally managed OpenShell target.

• Stock Docker-driver onboarding for OpenClaw, Hermes, and LangChain Deep Agents Code now requires the release’s exact managed image. Registry or catalog failures stop before sandbox creation instead of falling back to a local stock-image build; explicit custom Dockerfiles remain separate. Existing and recreated sandboxes retain exact image, policy, route-reservation, and lifecycle authority checks. Related changes: PR #10113, PR #10320, PR #10321, PR #10322, PR #10332, PR #10396, and PR #10422.
• Messaging setup now binds revision-scoped credentials to canonical OpenShell providers before sandbox creation or rebuild. This restores runtime credential delivery for maintained Slack, Discord, Google Chat, and Telegram paths while preserving endpoint-specific policy matching and fail-closed provider ownership. Related changes: PR #10170, PR #10271, PR #10273, PR #10275, PR #10277, PR #10307, and PR #10314.
• The Hermes installer accepts --defer-onboarding or NEMOCLAW_DEFER_ONBOARDING=1 only for NVIDIA-hosted inference when no supported credential and no sandbox exist. It installs NemoClaw and Hermes without creating a provider, sandbox, or completed onboarding state; any credential or existing sandbox keeps the normal validation and recovery path. Related change: PR #10299.
• The experimental managed llama.cpp path now offers NVIDIA Nemotron 3 Nano 30B-A3B on qualified DGX Spark Arm64 and Linux x86_64 NVIDIA GPU hosts and recommends it during onboarding. Meta Muse Glimmer remains available on DGX Spark only by explicit selection, and existing Muse-owned installations are not migrated. Local NVIDIA NIM selection now enforces the documented usable-memory limit, including the DGX Spark unified-memory cap. Related changes: PR #10122 and PR #10292.
• nemoclaw upgrade-sandboxes --check now exits nonzero when it reports actionable stale, unknown-version, backup-recovery, or missing-sandbox state. Sandbox destruction and stale-container cleanup have bounded waits and preserve registry or lifecycle authority when deletion cannot be confirmed. Managed Hermes uninstall also removes its exact owned state volume and stops before state retirement on Docker failure. Related changes: PR #10128, PR #10133, and PR #10224.
• The experimental direct blueprint runner can validate and sanitize a plan for an externally managed OpenShell target. Planning validates the HTTPS endpoint, workspace, expected release range, CA bundle, and authentication-file metadata without reading credential contents, connecting to the gateway, authenticating, or applying changes. Related change: PR #10045.
• Security and diagnostics now reject config reads through a symlinked config directory, redact URL userinfo credentials in debug bundles, bind sandbox mutations and cancellation recovery to durable exact identity, and classify incomplete onboarding without reporting success. Related changes: PR #10041, PR #10127, PR #10146, and PR #10396.

NemoClaw v0.0.114 adds deterministic read-only MCP tool calls for LangChain Deep Agents Code and per-stage launch-readiness probe timing. It strengthens destructive-operation warnings, session export cleanup, sealed configuration recovery, and installation verification. It also improves managed local inference, Hermes onboarding, image provenance, and release documentation automation.

NemoClaw v0.0.113 improves sandbox and onboarding recovery across interactive connections, Hermes, policy changes, and local adapters. It adds experimental Hermes Google Chat support while keeping the service-account private key outside the sandbox. It also changes the Google Gemini default, strengthens managed image publication, and improves E2E diagnostics.