> This page is for version Latest (default). > For other versions, use one of these documentation indexes: > - Latest (default): https://docs.nvidia.com/nemoclaw/latest/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server. # Release Notes NVIDIA NemoClaw is available in early preview starting March 16, 2026. Use these release notes to track changes across NemoClaw, NemoHermes, and NemoDeepAgents. For release announcements and downloadable assets, refer to [NemoClaw announcements on GitHub](https://github.com/NVIDIA/NemoClaw/discussions/categories/announcements?discussions_q=is%3Aopen+category%3AAnnouncements). ## October 12, 2026 ## v0.0.133 NemoClaw v0.0.133 extends sandbox-attached OpenShell inference to supported hosted providers and improves recovery when sandbox or gateway state is incomplete. It also makes policy removal, provider verification, and configuration export more predictable. * New OpenAI, Anthropic, Google Gemini, OpenRouter, and Hermes Provider selections use sandbox-attached OpenShell providers. Provider credentials stay on the host, and each sandbox records its own attachment. Existing sandboxes without a native attachment retain their recorded shared route. Related change: [PR #12886](https://github.com/NVIDIA/NemoClaw/pull/12886). Refer to [How Inference Routing Works](/user-guide/openclaw/inference/about-inference-routing). * A fresh managed OpenClaw sandbox using local Ollama or vLLM defaults to direct tool disclosure when no mode is selected. An explicit selection or existing sandbox state takes precedence. Related change: [PR #12968](https://github.com/NVIDIA/NemoClaw/pull/12968). Refer to [Progressive Tool Disclosure](/user-guide/openclaw/configure-agents/progressive-tool-disclosure). * Provider creation and attachment warn when a previously verified profile changes or its follow-up check cannot complete. The successful operation remains successful; ask the gateway operator to inspect the profile before relying on its credential boundary. The advisory lookup follows the caller's timeout, capped at 30 seconds. Related changes: [PR #12985](https://github.com/NVIDIA/NemoClaw/pull/12985) and [PR #13033](https://github.com/NVIDIA/NemoClaw/pull/13033). * Policy preset removal accepts OpenShell's provider-composed `_provider_*` readback entries but still rejects missing or changed operator-owned rules. Related change: [PR #12983](https://github.com/NVIDIA/NemoClaw/pull/12983). Refer to [Apply Policy Presets](/user-guide/openclaw/network-policy/configure-policies/apply-policy-presets). * Native-home backup removes a new backup directory when capture throws. If cleanup also fails, the error identifies the retained incomplete path for inspection. Related change: [PR #13010](https://github.com/NVIDIA/NemoClaw/pull/13010). Refer to [Back Up and Restore Sandboxes](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots). * After failed onboarding leaves an identity-free recovery reservation, `nemoclaw destroy --yes` can release the name when the selected gateway and Docker confirm that the sandbox is absent. Ownership conflicts and uncertain absence still block removal. Related change: [PR #12839](https://github.com/NVIDIA/NemoClaw/pull/12839). * Gateway recovery retains the last successful state-directory and Docker-network binding for each port. Process identity checks also handle a live sibling of a zombie leader and large inherited environments without dropping ownership checks. Related changes: [PR #12800](https://github.com/NVIDIA/NemoClaw/pull/12800) and [PR #12928](https://github.com/NVIDIA/NemoClaw/pull/12928). * `nemoclaw config export` accepts sandboxes with an empty messaging plan. Deep Agents Code `sessions` and `sessions list` instead report that listing is unsupported and exit with code 1. Related changes: [PR #13021](https://github.com/NVIDIA/NemoClaw/pull/13021) and [PR #12918](https://github.com/NVIDIA/NemoClaw/pull/12918). * Native Linux ARM64 can recognize a qualified N1x PCI identity without the FastOS marker. Physical qualification remains pending. Related change: [PR #12768](https://github.com/NVIDIA/NemoClaw/pull/12768). * QA runs can select the fixed TEST receiver with `NEMOCLAW_TELEMETRY_TEST_LABEL`. NemoClaw attempts one completion record for each covered installer or CLI operation. Collection and delivery share a five-second total limit, and `NEMOCLAW_DISABLE_TELEMETRY=1` suppresses both. Production delivery is not enabled. Related change: [PR #12859](https://github.com/NVIDIA/NemoClaw/pull/12859). Refer to [QA Operation Telemetry](/user-guide/openclaw/security/best-practices#qa-operation-telemetry). ## October 9, 2026 ## v0.0.132 NemoClaw v0.0.132 expands qualified image and NVIDIA inference paths and improves sandbox recovery. It also strengthens credential checks, preserves gateway-scoped tunnels during sandbox changes, and makes failure guidance more specific. * Rootless Podman can onboard, resume, rebuild, and clean up exact-digest external OpenClaw and Hermes images selected with `--from-image`. NemoClaw validates the local image identity and retains shared images that it does not own. Related change: [PR #12538](https://github.com/NVIDIA/NemoClaw/pull/12538). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * New and recreated NVIDIA Endpoints sandboxes use a sandbox-attached OpenShell provider instead of the shared `inference.local` route. Older sandboxes keep the shared route until recreated. Recreate Deep Agents Code sandboxes during onboarding. OpenClaw and Hermes can switch an existing native attachment in place. Follow-up repairs restore native sandbox requests and use the supervisor-issued credential handle for OpenClaw and Hermes. Related changes: [PR #12562](https://github.com/NVIDIA/NemoClaw/pull/12562), [PR #12826](https://github.com/NVIDIA/NemoClaw/pull/12826), and [PR #12895](https://github.com/NVIDIA/NemoClaw/pull/12895). Refer to [Use NVIDIA Endpoints](/user-guide/openclaw/inference/hosted-inference/use-nvidia-endpoints). * A qualifying Station GB300 Windows Subsystem for Linux host can automatically select the managed Qwen 3.6 35B-A3B llama.cpp recipe. Managed vLLM selection retains a completed Docker GPU proof across WSL preflight, and read-only readiness reports when it did not run a container CUDA proof. Related changes: [PR #12557](https://github.com/NVIDIA/NemoClaw/pull/12557), [PR #12609](https://github.com/NVIDIA/NemoClaw/pull/12609), and [PR #12856](https://github.com/NVIDIA/NemoClaw/pull/12856). Refer to [Set Up llama.cpp](/user-guide/openclaw/inference/local-inference/set-up-llama-cpp). * Custom-image OpenClaw onboarding waits for native startup before it configures and restarts the gateway. For the **Other OpenAI-compatible endpoint** provider, OpenClaw rebuild verifies the restored inference route. If verification fails, NemoClaw reports the preserved backup and a retry action. Related change: [PR #12720](https://github.com/NVIDIA/NemoClaw/pull/12720). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Resumed Deep Agents Code onboarding restarts a stopped OpenRouter adapter and requires a bounded inference request before it reports success. Failed adapter recovery or model validation leaves onboarding incomplete for retry. Related change: [PR #12681](https://github.com/NVIDIA/NemoClaw/pull/12681). Refer to [Verify the Sandbox Inference Route](/user-guide/deepagents/inference/validate-inference/verify-inference-route). * `nemoclaw tunnel start` uses the selected OpenShell gateway port, and the tunnel stays available when one sandbox stops, is destroyed, or is recreated. Tunnel selection and cleanup retain gateway ownership checks. Related changes: [PR #12490](https://github.com/NVIDIA/NemoClaw/pull/12490) and [PR #12566](https://github.com/NVIDIA/NemoClaw/pull/12566). Refer to [Run Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/run-sandboxes). * `nemoclaw destroy --yes` can remove a retained live sandbox after interrupted onboarding when its OpenShell identity matches the recovery record. Missing identity, uncertain presence, and identity drift still block deletion. OpenShell deletes by mutable name, so the final identity check and deletion are not atomic; prevent another client from replacing the sandbox name during cleanup. Related change: [PR #12893](https://github.com/NVIDIA/NemoClaw/pull/12893). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#inspect-retained-sandbox-recovery). * Rebuild validates a nonempty host API key for applicable remote providers before image preparation or backup and again before sandbox deletion. A failed validation preserves the existing sandbox even with `--force`; unset a host key when you intend to reuse a valid OpenShell-stored credential. Related change: [PR #12801](https://github.com/NVIDIA/NemoClaw/pull/12801). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Legacy sandbox rebuild can recover after a confirmed failed probe without treating the old sandbox as absent. Source-installed CLI rebuilds use the installed source catalog instead of requesting an unpublished release version. Related changes: [PR #12767](https://github.com/NVIDIA/NemoClaw/pull/12767) and [PR #12762](https://github.com/NVIDIA/NemoClaw/pull/12762). * A successful default uninstall identifies the native-state archive that contains Deep Agents Code files. Ordinary Docker uninstall also accepts a completed empty registry after the last sandbox was destroyed; ambiguous or non-Docker authority still fails closed. Related change: [PR #12774](https://github.com/NVIDIA/NemoClaw/pull/12774). Refer to [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw). * Rebuild preserves Hermes messaging configuration, and Slack remediation validates the managed install and policy boundaries before applying a repair. A failed Slack remediation command is reported instead of being treated as success. Related changes: [PR #12841](https://github.com/NVIDIA/NemoClaw/pull/12841), [PR #12846](https://github.com/NVIDIA/NemoClaw/pull/12846), and [PR #12662](https://github.com/NVIDIA/NemoClaw/pull/12662). * Onboarding keeps unprovable forwarded ports occupied rather than selecting a conflicting port. It also checks the local inference route during GPU finalization and preserves a completed GPU proof across a resumed create step. Related changes: [PR #12763](https://github.com/NVIDIA/NemoClaw/pull/12763), [PR #12755](https://github.com/NVIDIA/NemoClaw/pull/12755), and [PR #12372](https://github.com/NVIDIA/NemoClaw/pull/12372). * Diagnostics identify a failed custom endpoint while redacting credential-bearing URL components. Inference switching reports the gateway restart failure category, and non-GPU startup failures use the selected operation's recovery guidance. Related changes: [PR #12759](https://github.com/NVIDIA/NemoClaw/pull/12759), [PR #12705](https://github.com/NVIDIA/NemoClaw/pull/12705), and [PR #12796](https://github.com/NVIDIA/NemoClaw/pull/12796). * `nemoclaw config export` rejects unsupported Gemini configuration instead of producing an unusable export. Related change: [PR #12551](https://github.com/NVIDIA/NemoClaw/pull/12551). * Sandbox image cleanup protects images used by sibling gateways. Fresh onboarding no longer detaches providers before the sandbox exists, avoiding misleading `sandbox not found` warnings. Related changes: [PR #12608](https://github.com/NVIDIA/NemoClaw/pull/12608) and [PR #12835](https://github.com/NVIDIA/NemoClaw/pull/12835). ## October 6, 2026 ## v0.0.131 NemoClaw v0.0.131 preserves the complete OpenShell native agent home and workspace during rebuilds, improves local and routed inference reliability, and hardens lifecycle diagnostics. It also adds Tavily to managed OpenClaw images, expands configuration export coverage, and fixes sandbox-specific command selection. * Rebuild transfers the complete native agent home and workspace instead of a selected file inventory. NemoClaw rejects a transfer that contains credentials, fails inspection, or fails integrity validation before it replaces the sandbox. The retired selective snapshot commands are no longer available. Use an independent host backup when you need a user-controlled recovery point; `backup-all` remains an installer-facing pre-upgrade safeguard. Related change: [PR #12340](https://github.com/NVIDIA/NemoClaw/pull/12340). Refer to [Persist Sandbox State](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots) and [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * The managed N1x Qwen vLLM profile allows one corrective retry when OpenClaw rejects a compaction summary. The quality guard remains enabled, and a repeated rejection or failed retry does not replace the conversation history. Other compaction profiles retain zero corrective retries. Related change: [PR #12516](https://github.com/NVIDIA/NemoClaw/pull/12516). Refer to [Understand Context Compaction](/user-guide/openclaw/configure-agents/understand-context-compaction). * The 64 GB DGX Spark Qwen vLLM recipe uses lazy `safetensors` loading instead of `fastsafetensors`. This change reduces startup memory pressure on the Experimental 64 GB profile without changing its model, context, concurrency, or memory limits. Physical qualification remains pending. Related change: [PR #12633](https://github.com/NVIDIA/NemoClaw/pull/12633). Refer to [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm). * Operator-attached llama.cpp onboarding now checks sandbox reachability before it accepts a host service. A confirmed TCP failure stops fresh or resumed onboarding with binding and firewall guidance. Related change: [PR #11709](https://github.com/NVIDIA/NemoClaw/pull/11709). Refer to [Set Up llama.cpp](/user-guide/openclaw/inference/local-inference/set-up-llama-cpp). * OpenRouter model changes now verify the selected model through the target sandbox before NemoClaw commits agent configuration. A failed verification restores the previous route when possible. Launch readiness and status also require a bounded inference request because the OpenRouter adapter does not expose `/v1/models`. Related changes: [PR #12625](https://github.com/NVIDIA/NemoClaw/pull/12625) and [PR #12685](https://github.com/NVIDIA/NemoClaw/pull/12685). Refer to [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers). * OpenAI-compatible probes use `max_completion_tokens` for GPT-6 models, including `gpt-6-astra`. The existing GPT-5 and `o1`, `o3`, and `o4` compatibility handling remains unchanged. Related change: [PR #12691](https://github.com/NVIDIA/NemoClaw/pull/12691). Refer to [Choose a Compatible Inference API](/user-guide/openclaw/inference/custom-endpoints/choose-compatible-inference-api). * `nemoclaw inference set` accepts recognized underscore spellings such as `ollama_local`, `nvidia_prod`, and `open_router`. NemoClaw normalizes each recognized spelling to its canonical OpenShell provider ID. Related change: [PR #11700](https://github.com/NVIDIA/NemoClaw/pull/11700). Refer to [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers). * `nemoclaw config export` now accepts native NVIDIA provider bindings from the current workspace or an unscoped binding and emits YAML that passes the pinned v1 parser. When retained corporate CA state is present, a successful export reports the omission on standard error and directs you to review destination trust requirements. Related change: [PR #12451](https://github.com/NVIDIA/NemoClaw/pull/12451). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-config-export-sandbox). * SDK-backed commands accept an externally supervised gateway's declared mTLS state directory when its ownership and permissions pass validation. The directory does not need a NemoClaw-managed ownership marker. Related change: [PR #12535](https://github.com/NVIDIA/NemoClaw/pull/12535). Refer to [Understand Gateway Lifecycle Authority](/user-guide/openclaw/deployment/gateway-lifecycle-authority). * Managed OpenClaw images preinstall the verified Tavily plugin in a disabled state. Selecting Tavily during onboarding enables it, and configuration export preserves admitted OpenClaw and Hermes Tavily sources without exporting credential values. Managed-image publication requires the exact supported Tavily package version and disabled default configuration. Related changes: [PR #12225](https://github.com/NVIDIA/NemoClaw/pull/12225) and [PR #12624](https://github.com/NVIDIA/NemoClaw/pull/12624). Refer to the [OpenClaw Quickstart](/user-guide/openclaw/get-started/quickstart#configure-web-search-optional) and [Hermes Quickstart](/user-guide/hermes/get-started/quickstart#configure-web-search-optional). * Skill install, list, and remove commands select the agent from the target sandbox's registry record. Onboarding another Hermes or Deep Agents sandbox no longer changes skill command routing for a registered OpenClaw sandbox. Related change: [PR #12607](https://github.com/NVIDIA/NemoClaw/pull/12607). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-name-skill). * `nemoclaw policy list` labels the Deep Agents Code `observability-otlp-local` preset as `[from dcode agent]`. This change corrects displayed provenance without changing sandbox permissions or preset application. Related change: [PR #12635](https://github.com/NVIDIA/NemoClaw/pull/12635). Refer to the [NemoClaw CLI Commands Reference](/user-guide/deepagents/reference/commands#nemoclaw-name-policy-list). * `nemoclaw-acp` preserves a remote `hermes-acp` exit status, including status `255`, and reports SSH transport failures separately. If temporary SSH configuration cleanup fails, NemoClaw reports the retained directory without replacing an existing remote failure status. Related change: [PR #11774](https://github.com/NVIDIA/NemoClaw/pull/11774). Refer to the [NemoClaw CLI Commands Reference](/user-guide/hermes/reference/commands#nemoclaw-acp). * Managed cloud onboarding waits up to 5 seconds for Docker to expose the exact container after OpenShell returns a verified sandbox identity. Ambiguous ownership, identity changes, stopped containers, and inspection mismatches still fail immediately. Related change: [PR #12606](https://github.com/NVIDIA/NemoClaw/pull/12606). * Portable onboarding checks that its managed registry responds before it builds the sandbox image. An unreachable registry produces a bounded failure before the build starts. Related change: [PR #11874](https://github.com/NVIDIA/NemoClaw/pull/11874). * Brev CPU bootstrap removes the older bundled npm tree before it extracts the pinned Node archive. This prevents files from the previous npm installation from remaining beside the new bundled npm. Related change: [PR #12239](https://github.com/NVIDIA/NemoClaw/pull/12239). * Tunnel startup and cleanup verify the recorded `cloudflared` process identity before they act on it. An inconclusive identity check preserves the process and PID record and reports recovery guidance. Related change: [PR #12491](https://github.com/NVIDIA/NemoClaw/pull/12491). Refer to [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Legacy DNS proxy repair now requires an exact sandbox pod name or a valid generated suffix. Repairing a sandbox such as `box1` no longer selects an unrelated pod such as `box10-xyz12`. Related change: [PR #12556](https://github.com/NVIDIA/NemoClaw/pull/12556). * Docker GPU failure diagnostics use typed OpenShell observations when they are available. A collection or artifact-write failure remains best effort and cannot hide the original GPU failure or cleanup guidance. Related change: [PR #12560](https://github.com/NVIDIA/NemoClaw/pull/12560). * Managed runtime dependency graphs and the installed official Slack bundle now use `proxy-addr` 2.0.8. Documentation validation also checks internal links across every published page. Related change: [PR #12656](https://github.com/NVIDIA/NemoClaw/pull/12656). ## October 1, 2026 ## v0.0.130 NemoClaw v0.0.130 adds publisher-managed Docker image onboarding, strengthens sandbox recovery and security controls, and expands hardware and inference qualification. It also improves messaging, status output, configuration export, and operator diagnostics. * When `CHAT_UI_URL` records a non-loopback browser address, onboarding keeps the host dashboard forward loopback-bound unless remote binding is explicitly configured. `nemoclaw dashboard-url`, `nemoclaw list`, and `nemoclaw status` show the recorded browser-facing URL, while status retains the local forwarding port. Related change: [PR #11621](https://github.com/NVIDIA/NemoClaw/pull/11621). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-name-dashboard-url). * On Windows-on-Arm WSL with Docker Desktop, a Station GB300 chassis can qualify an installed `qwen3.6:35b` model when the bounded CUDA proof verifies every reported GPU, includes an NVIDIA GB300 device, and reports at least 30,000 MiB available. Generic multi-GPU and Podman Station hosts remain compute-constrained. Related change: [PR #12553](https://github.com/NVIDIA/NemoClaw/pull/12553). Refer to [Set Up Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama). * Managed Hermes images now use the published multi-architecture base that contains OpenSSL 3.5.7-1\~deb13u3 and matches the completed-image security verification. Related change: [PR #12555](https://github.com/NVIDIA/NemoClaw/pull/12555). * Docker and qualified rootless Podman onboarding for OpenClaw and Hermes accept a publisher-managed image with `nemoclaw onboard --from-image @sha256:`. NemoClaw validates the image platform, non-root user, `/sandbox` working directory, executable, any agent metadata, and tool-disclosure declaration before it creates a sandbox. It inspects a local image before it pulls, and the selected runtime's configured credentials provide private-registry access. In non-interactive onboarding, use `NEMOCLAW_FROM_IMAGE` and a sandbox name. Related changes: [PR #12301](https://github.com/NVIDIA/NemoClaw/pull/12301) and [PR #12538](https://github.com/NVIDIA/NemoClaw/pull/12538). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-onboard) for image requirements and recovery limits. * Sandboxes created with `--from-image` retain their recorded digest through resume, rebuild, and snapshot clone. NemoClaw revalidates the image before a rebuild or clone changes a sandbox. Cleanup retains the published image, and `nemoclaw upgrade-sandboxes` lists the sandbox as pinned without automatically rebuilding it. After you update NemoClaw, run `nemoclaw rebuild` to recreate the sandbox from its recorded digest. Related change: [PR #12301](https://github.com/NVIDIA/NemoClaw/pull/12301). Refer to [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes) for the update behavior. * Fresh OpenClaw sandboxes created with a custom Dockerfile apply the selected OpenShell inference route through OpenClaw's native configuration before onboarding completes. If the selected model differs from the image's model, OpenClaw uses its own defaults for any inherited context-window and output-token limits. Related change: [PR #12421](https://github.com/NVIDIA/NemoClaw/pull/12421). Refer to [Understand Runtime Changes](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-runtime-changes) for OpenClaw configuration ownership. * OpenClaw owns `/sandbox/.openclaw/openclaw.json` after first launch. Configure it inside the sandbox with `openclaw configure`, `openclaw config set`, or `openclaw config unset`. Rebuild and snapshot restore preserve only credential-sanitized native configuration; they do not reconcile OpenShell inference routes, credential bindings, or network policy. Related change: [PR #12120](https://github.com/NVIDIA/NemoClaw/pull/12120). Refer to [Troubleshooting](/user-guide/openclaw/reference/troubleshooting#change-openclaw-configuration-inside-the-sandbox). * Windows WSL GPU qualification recognizes the exact normalized `NVIDIA RTX Spark N1X (5120-core Blackwell RTX GPU)` identity. The existing WSL, CUDA proof, Docker Desktop, and capacity requirements still apply. Related change: [PR #12407](https://github.com/NVIDIA/NemoClaw/pull/12407). Refer to [System Readiness](/user-guide/openclaw/reference/system-readiness#interpret-platform-qualification). * Configuration export translates a source Landlock `strict` compatibility setting to v1alpha1 `hard_requirement`, preserving fail-closed enforcement. It preserves `best_effort` unchanged. Related change: [PR #12312](https://github.com/NVIDIA/NemoClaw/pull/12312). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-config-export-sandbox). * OpenClaw device approval exits successfully only after direct-gateway or local-fallback output drains. A callback failure or a one-second timeout exits nonzero instead. A same-device CLI request for `operator.admin` requires explicit approval; bounded non-administrative scope upgrades remain automatic. After approving the local CLI device for `operator.admin`, the CLI confirms the grant through the gateway before reporting success. Ordinary local agent turns use OpenClaw's native method scopes, while model overrides and session resets retain administrative scope. Related changes: [PR #12197](https://github.com/NVIDIA/NemoClaw/pull/12197) and [PR #12354](https://github.com/NVIDIA/NemoClaw/pull/12354). Refer to [Gateway Authentication Controls](/user-guide/openclaw/security/security-controls/gateway-authentication-controls#approve-administrative-scopes-manually). * `nemoclaw exec -- ...` no longer runs `openclaw devices list --json` after a command. When a command reports a pending scope approval, use the native request ID to review and approve the matching request in a prepared `connect` shell. Related change: [PR #12332](https://github.com/NVIDIA/NemoClaw/pull/12332). Refer to [Troubleshooting](/user-guide/openclaw/reference/troubleshooting#an-openclaw-command-inside-the-sandbox-fails-with-scope-upgrade-pending-approval). * Hermes now uses one native configuration for its gateway, CLI, TUI, and Web Dashboard. Startup migrates safe state from retired dashboard homes, including WhatsApp session state. It removes generated shadow configuration only after verification; unsafe paths or conflicting files stop migration without deleting either copy. Related change: [PR #12333](https://github.com/NVIDIA/NemoClaw/pull/12333). Refer to [Create and Restore Snapshots](/user-guide/hermes/manage-sandboxes/state-and-backups/create-and-restore-snapshots) for migration and recovery limits. * Google Chat accepts formatted service-account JSON with LF or CRLF line breaks in `GOOGLECHAT_SERVICE_ACCOUNT`. Interactive entry still requires minified one-line JSON. Related change: [PR #10393](https://github.com/NVIDIA/NemoClaw/pull/10393). Refer to [Set Up Google Chat](/user-guide/openclaw/manage-sandboxes/messaging-channels/set-up-google-chat). * OpenClaw managed `inference.local` routes clear NVIDIA credential aliases and remove only the matching NemoClaw-generated legacy profile before setup. Direct routes and unrelated profiles remain unchanged. Related change: [PR #12237](https://github.com/NVIDIA/NemoClaw/pull/12237). Refer to [Process Controls](/user-guide/openclaw/security/security-controls/process-controls#auth-profile-permissions). * OpenClaw messaging image builds verify trusted official registry provenance for Discord, Slack, WhatsApp, Microsoft Teams, and Google Chat plugins. They stop before runtime checks when the verification fails or the offline cache lacks a verified package. WeChat uses the compatible 2.4.9 runtime. Related change: [PR #12292](https://github.com/NVIDIA/NemoClaw/pull/12292). Refer to [Add Channels After Onboarding](/user-guide/openclaw/manage-sandboxes/messaging-channels/add-channels-after-onboarding) for build-failure recovery. * The experimental direct blueprint runner reports an unreadable run directory instead of treating it as missing during `reconcile` or `rollback`. It stops before OpenShell commands or state writes; correct the directory access, then rerun the command. Related change: [PR #12320](https://github.com/NVIDIA/NemoClaw/pull/12320). * Onboarding treats a persistent ordinary `404` from `/v1/models` as an inference-route failure instead of reporting a verified deployment. Correct the endpoint, then run `nemoclaw onboard --resume` to verify the retained session. Related change: [PR #12339](https://github.com/NVIDIA/NemoClaw/pull/12339). Refer to [Verify the Sandbox Inference Route](/user-guide/openclaw/inference/validate-inference/verify-inference-route). * Native rootless Podman preserves its current-user runtime context during gateway recovery. It can reuse a trusted managed gateway service after that service removes standalone ownership records. Related change: [PR #12267](https://github.com/NVIDIA/NemoClaw/pull/12267). Refer to [Podman](/user-guide/openclaw/reference/troubleshooting#podman) for provider requirements and recovery guidance. * Balanced policy tiers now use `brew-balanced`, which limits `raw.githubusercontent.com` to GET and HEAD requests for its Homebrew binaries. Existing `brew` access remains until you remove `brew` and add `brew-balanced`; Open retains `brew`. Related change: [PR #10487](https://github.com/NVIDIA/NemoClaw/pull/10487). Refer to [Network Policies](/user-guide/openclaw/reference/network-policies#policy-tiers) for tier and replacement details. * Rebuild can preserve declared state from a managed Docker OpenClaw or Deep Agents Code sandbox in `Phase: Error` without starting or executing in its stopped container. Deep Agents Code carries only supported managed native MCP entries through a bounded recovery handoff. It requires an unchanged source container and exclusively owned managed state volume; credential state and user-authored or unsupported MCP content remain excluded. Related changes: [PR #12305](https://github.com/NVIDIA/NemoClaw/pull/12305) and [PR #11293](https://github.com/NVIDIA/NemoClaw/pull/11293). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) for requirements and recovery limits. * Destroying the final registered `vllm-local` consumer now removes an eligible NemoClaw-managed vLLM container after sandbox deletion, ownership, and cross-gateway consumer checks succeed. Use `--keep-vllm` or `NEMOCLAW_KEEP_VLLM=1` to retain the container for later reuse. Related change: [PR #11528](https://github.com/NVIDIA/NemoClaw/pull/11528). Refer to [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm#handle-a-running-vllm-server) for cleanup and recovery conditions. * Pi rebuild and snapshot restore preserve the sanitized native `settings.json`, including its global project-trust default. Per-path decisions in `trust.json` remain excluded. Related change: [PR #12393](https://github.com/NVIDIA/NemoClaw/pull/12393). Refer to [Pi Support](/user-guide/pi/reference/pi-support#persistent-and-reconstructed-state) for the preservation boundary. * Lock contention during onboarding now reports the recorded owner state and directs you to retry normal lock acquisition after any active owner exits. It no longer recommends deleting a lock or stopping an unverified process. Related change: [PR #10465](https://github.com/NVIDIA/NemoClaw/pull/10465). * In-place upgrades normalize trusted OpenShell gateway service paths before comparing them, so equivalent `HOME` and XDG paths with redundant slashes do not block retirement of NemoClaw's own service. Prepared legacy OpenClaw recovery also waits for ordinary write pairing before closing the recovery transaction. Related changes: [PR #10541](https://github.com/NVIDIA/NemoClaw/pull/10541) and [PR #10629](https://github.com/NVIDIA/NemoClaw/pull/10629). Refer to [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes) for upgrade recovery behavior. * The hosted installer passes the selected runtime-provider authority into Windows WSL readiness checks, allowing a Podman-selected installation to reach onboarding without Docker. Related change: [PR #12294](https://github.com/NVIDIA/NemoClaw/pull/12294). Refer to [Windows Preparation](/user-guide/openclaw/get-started/additional-setup/windows-preparation) for supported runtime paths. * Onboarding can reclaim a foreign pending inference-route reservation attached to an already published sandbox when the selected gateway authority matches. The route remains pending until normal onboarding finalization, and sandbox data is preserved. Related change: [PR #12295](https://github.com/NVIDIA/NemoClaw/pull/12295). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-onboard) for resume behavior. * When both Docker selectors are set, NemoClaw now follows Docker CLI precedence and uses `DOCKER_HOST` instead of `DOCKER_CONTEXT` across readiness, onboarding, image builds, storage checks, runner commands, and cleanup diagnostics. Related change: [PR #12330](https://github.com/NVIDIA/NemoClaw/pull/12330). Refer to [System Readiness](/user-guide/openclaw/reference/system-readiness) for Docker endpoint selection. * Uninstall leaves unrelated Docker containers intact and keeps a managed gateway running until its registered sandboxes are cleaned up. For a nondefault gateway whose runtime is gone, `--destroy-user-data` can purge retained Docker registry and backup data after it verifies that the selected containers are absent. Related changes: [PR #10478](https://github.com/NVIDIA/NemoClaw/pull/10478) and [PR #12299](https://github.com/NVIDIA/NemoClaw/pull/12299). Refer to [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw) for verification and retry conditions. * The `--all-gateway-ports` sweep restores each gateway's recorded custom OpenShell state directory. It preserves the affected state when recorded directories conflict or cannot be read. Related change: [PR #10774](https://github.com/NVIDIA/NemoClaw/pull/10774). Refer to [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw) for gateway-state recovery. * DGX Station Express preserves a recognized legacy single-Station workload when automatic peer discovery cannot qualify a trusted pair. If the workload changes during discovery, installation stops rather than continuing the upgrade. Related change: [PR #12296](https://github.com/NVIDIA/NemoClaw/pull/12296). Refer to [Set Up vLLM on Two DGX Stations](/user-guide/openclaw/inference/local-inference/set-up-vllm-on-two-dgx-stations) for the recovery procedure. * Messaging-channel removal uses native OpenShell execution for running-sandbox session cleanup. A failed, cancelled, or inconclusive cleanup does not retry through SSH or a local runtime provider, and the command stops before rebuilding. OpenClaw WeChat can use its separately verified stopped-state cleanup before native execution. Related change: [PR #12181](https://github.com/NVIDIA/NemoClaw/pull/12181). Refer to [Manage Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/manage-messaging-channels) for cleanup and retry conditions. * When managed OpenClaw onboarding imports a corporate CA, it refreshes the OpenShell supervisor trust through a native stop and start before onboarding completes. If either action fails, onboarding retains the sandbox for recovery. Related change: [PR #12181](https://github.com/NVIDIA/NemoClaw/pull/12181). Refer to [Configure Corporate CA Trust](/user-guide/openclaw/security/configure-corporate-ca-trust) for the trust boundary. * MCP status reports public DNS pin drift without changing the live policy. Refresh verified public pins with `nemoclaw mcp update --refresh-public-pins`; the command replaces only the endpoint's `allowed_ips`. It rejects private or special-use DNS answers and address ranges. Related change: [PR #10781](https://github.com/NVIDIA/NemoClaw/pull/10781). Refer to [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers#change-endpoint-pins) for recovery and verification. * CoreDNS repair uses a responding Docker authority. A stale Podman socket does not redirect repair from a working Docker CLI default. On Linux, rootless Podman discovery also checks the socket under `XDG_RUNTIME_DIR`. Related change: [PR #12348](https://github.com/NVIDIA/NemoClaw/pull/12348). Refer to [Troubleshooting](/user-guide/openclaw/reference/troubleshooting#coredns-crashloop-after-onboarding) for CoreDNS recovery. * Hermes now waits through a restart-rate cooldown and restarts its gateway automatically. The Bedrock Runtime adapter lists models only after it successfully serves an inference request. Related change: [PR #12343](https://github.com/NVIDIA/NemoClaw/pull/12343). Refer to [Understand Gateway Lifecycle Control](/user-guide/hermes/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control) for Hermes recovery behavior. * Linux launch-readiness failures can identify the unsafe authority path, owner UID, permissions, bounded error code, and supported repair guidance. Diagnostics exclude receipt contents, environment values, and raw operating-system error messages. Related change: [PR #10851](https://github.com/NVIDIA/NemoClaw/pull/10851). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes#understand-launch-readiness-leases). * OpenClaw Telegram channel status detects missing, malformed, mismatched, identityless, or non-OpenShell runtime credentials without exposing the credential value. It reports these states as `token_rejected`. Related change: [PR #10860](https://github.com/NVIDIA/NemoClaw/pull/10860). Refer to the [CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-name-channels-status). * When `connect` or `start` reaches a terminal phase for a Docker sandbox with no matching managed container, NemoClaw identifies containers that carry the sandbox-name label. Resolve each listed container through its owning workflow, then rerun the command. Related change: [PR #12355](https://github.com/NVIDIA/NemoClaw/pull/12355). Refer to the [CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-name-connect). * Interrupting onboarding during agent selection exits with status `130` without printing a raw prompt error. Related change: [PR #12361](https://github.com/NVIDIA/NemoClaw/pull/12361). * The installer limits a curl connection to 10 seconds and retries a failed OpenShell release-asset download up to three times. It stops a transfer that remains below 1 KiB/s for 60 seconds. Related change: [PR #12374](https://github.com/NVIDIA/NemoClaw/pull/12374). * Sandbox download accepts a relative source path that begins with `-` when you place the standard outer `--` before the path. NemoClaw anchors that path before it checks and transfers the source, so OpenShell treats it as a path rather than an option. Related change: [PR #12391](https://github.com/NVIDIA/NemoClaw/pull/12391). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-name-download-sandbox-path-host-dest). * An interrupted rebuild retains recovery state separately for each sandbox. Rerun the affected sandbox's rebuild with the same settings; do not delete its recovery files. Related change: [PR #11389](https://github.com/NVIDIA/NemoClaw/pull/11389). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes#continue-an-interrupted-replacement). * Linux Ollama onboarding retries a timed-out systemd execution proof with a bounded direct proof as the configured service user. Onboarding continues when the direct proof succeeds and stops without restarting Ollama when it fails or times out. Related change: [PR #12337](https://github.com/NVIDIA/NemoClaw/pull/12337). Refer to [Set Up Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama). * For a NemoClaw-managed gateway, full uninstall deletes sandboxes through the selected gateway authority and requires two consecutive empty inventories before it removes providers, registrations, or local state. If authority or inventory verification fails, it preserves the downstream state for a retry. Related change: [PR #12308](https://github.com/NVIDIA/NemoClaw/pull/12308). Refer to [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw) for retry conditions. * For a stopped sandbox that `backup-all` or `rebuild` starts, NemoClaw waits for SSH readiness before it captures the backup. It reserves time to return the sandbox to `Stopped`, and stops without replacement if backup or return-to-stopped verification fails. Related change: [PR #12250](https://github.com/NVIDIA/NemoClaw/pull/12250). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) for recovery limits. * When an OpenClaw inference-route change lacks context-window evidence, NemoClaw removes the prior route's context-window value so OpenClaw uses its default. A same-route retry preserves its existing value; a retry after incomplete native configuration synchronization removes a stale value. Related change: [PR #12336](https://github.com/NVIDIA/NemoClaw/pull/12336). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-inference-set). * Managed OpenClaw images now use OpenClaw 2026.9.2. After you update NemoClaw, rebuild an existing sandbox to use the new runtime. Related change: [PR #12507](https://github.com/NVIDIA/NemoClaw/pull/12507). Refer to [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes). * On DGX Spark, managed Qwen vLLM selects a smaller recipe for detected unified memory from 60 GB to less than 64 GB. The recipe supports a 32,768-token context window, one concurrent sequence, 4,096 batched tokens, and 0.5 GPU-memory utilization. A detected capacity of at least 64 GB retains the 262,144-token recipe. Related change: [PR #12502](https://github.com/NVIDIA/NemoClaw/pull/12502). Refer to [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm) for qualification and override details. * For a JSON OpenClaw agent response with `replayInvalid: true`, NemoClaw returns success only when completed-run, successful-tool-summary, and final-reply evidence corroborate completion. Otherwise, it exits with status `1` and inspect-before-retry guidance because retrying can repeat side effects. Related change: [PR #12502](https://github.com/NVIDIA/NemoClaw/pull/12502). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands#nemoclaw-name-agent). * Deep Agents Code skill installation verifies the staged and placed canonical-root copies before publication. After placement and private staging cleanup succeed, it prints a SHA-256 digest of sorted relative paths, normalized executable modes, and file digests. The digest attests the placed copy at that time; it does not identify which same-name skill Deep Agents Code activates. Related change: [PR #12483](https://github.com/NVIDIA/NemoClaw/pull/12483). Refer to the [NemoClaw CLI Commands Reference](/user-guide/deepagents/reference/commands#nemoclaw-name-skill-install-path). ## September 23, 2026 ## v0.0.129 NemoClaw v0.0.129 extends configuration export and deferred onboarding, improves OpenClaw restart readiness, and corrects recovery across local gateways. It also strengthens host OS reporting and Windows WSL GPU verification. * Configuration export preserves effective OpenClaw and Hermes settings when v1alpha1 omission defaults would change behavior. Supported OpenClaw exports for attached Ollama with a managed proxy and the fixed managed vLLM profile now include local inference service templates. These templates contain `image: null`; replace that value with an official, immutable, compatible v1 runtime image before v1 parsing or planning. Related changes: [PR #12054](https://github.com/NVIDIA/NemoClaw/pull/12054) and [PR #12161](https://github.com/NVIDIA/NemoClaw/pull/12161). For supported profiles and refusal conditions, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Hermes and LangChain Deep Agents Code can defer onboarding when installing without NVIDIA hosted inference credentials. The installer creates no provider, sandbox, or completed onboarding state in that case; present credentials retain normal validation. Complete setup later through the installed agent's onboarding command. Related change: [PR #10341](https://github.com/NVIDIA/NemoClaw/pull/10341). For the opt-in flag and prerequisites, refer to the [CLI Commands Reference](/user-guide/deepagents/reference/commands). * OpenClaw gateway restart loads updated native plugins from a fresh module graph and waits for `/readyz` to return HTTP `200` with `{"ready":true}` before repairing forwards. Managed startup also preserves the SQLite temporary-directory environment for standalone memory commands. Related changes: [PR #11911](https://github.com/NVIDIA/NemoClaw/pull/11911) and [PR #12256](https://github.com/NVIDIA/NemoClaw/pull/12256). Refer to [Install OpenClaw Plugins](/user-guide/openclaw/manage-sandboxes/install-openclaw-plugins) and [Understand Gateway Lifecycle Control](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control). * Sandbox status and recovery use the owning local gateway registry even when another gateway is active. On Linux, `nemoclaw connect --probe-only` starts a stopped sandbox through its recorded gateway, including a sibling registry root. Recovery guidance follows the recorded runtime provider, and rebuild delegates to the owning registry after confirmation. Resumed host-local inference onboarding reserves its retained authority before creating a runtime and reports actionable diagnostics when that reservation fails. Related changes: [PR #11945](https://github.com/NVIDIA/NemoClaw/pull/11945), [PR #12075](https://github.com/NVIDIA/NemoClaw/pull/12075), and [PR #12303](https://github.com/NVIDIA/NemoClaw/pull/12303). Refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Host readiness reports the Linux distribution and release, with warnings for unqualified or inconclusive OS evidence. Windows on Arm GPU verification checks every reported device and aggregate capacity without qualifying generic multi-GPU hosts for larger automatic Ollama model selection. Related changes: [PR #11780](https://github.com/NVIDIA/NemoClaw/pull/11780) and [PR #12212](https://github.com/NVIDIA/NemoClaw/pull/12212). Refer to [System Readiness](/user-guide/openclaw/reference/system-readiness) and [Prepare Windows for NemoClaw](/user-guide/openclaw/get-started/additional-setup/windows-preparation). * NVIDIA Endpoints onboarding no longer selects the retired MiniMax M3 model. Interactive onboarding asks for a replacement; noninteractive onboarding uses an eligible configured model or the agent default. OpenRouter model selection remains separate from NVIDIA's retirement policy. Related change: [PR #11864](https://github.com/NVIDIA/NemoClaw/pull/11864). Refer to [Use NVIDIA Endpoints](/user-guide/openclaw/inference/hosted-inference/use-nvidia-endpoints). * Provider credential recovery directs you to choose `retry` before entering an API key in the secure prompt. Recovery requires interactive terminals for standard input and standard error; otherwise, onboarding exits with a nonzero status. Related change: [PR #12093](https://github.com/NVIDIA/NemoClaw/pull/12093). Refer to [Understand Provider Validation](/user-guide/openclaw/inference/validate-inference/understand-provider-validation). * Legacy plaintext credential cleanup removes only entries whose migration to the OpenShell gateway has been verified. Unmigrated entries remain available for later onboarding attempts. Related change: [PR #10384](https://github.com/NVIDIA/NemoClaw/pull/10384). Refer to [Credential Storage](/user-guide/openclaw/security/credential-storage) for migration and cleanup conditions. ## September 22, 2026 ## v0.0.128 NemoClaw v0.0.128 adds canonical v1alpha1 configuration export for supported single-agent sandboxes and completes more OpenShell lifecycle ownership. It also updates the managed OpenClaw and Hermes runtimes and improves inference readiness, MCP changes, onboarding recovery, and Deep Agents compatibility. * `nemoclaw config export` now emits the supported `nemoclaw.nvidia.com/v1alpha1` shape for hosted single-agent OpenClaw, Hermes, and Deep Agents sandboxes. OpenClaw and Hermes exports use the singular `sandbox.agent` field and omit the target-managed image, while imported corporate CA state no longer blocks migration output. Exports with unsupported secondary-agent rosters still fail before publication instead of dropping agents. Related changes: [PR #11986](https://github.com/NVIDIA/NemoClaw/pull/11986), [PR #12057](https://github.com/NVIDIA/NemoClaw/pull/12057), [PR #12013](https://github.com/NVIDIA/NemoClaw/pull/12013), [PR #12164](https://github.com/NVIDIA/NemoClaw/pull/12164), and [PR #12168](https://github.com/NVIDIA/NemoClaw/pull/12168). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Standard Docker and native Podman sandbox lifecycle now stays behind OpenShell, including ordinary sandbox creation through the typed lifecycle adapter. Forward startup errors now retain bounded diagnostics, post-create recovery can reconcile an exact retained identity before publication, and upgrades restore a missing named gateway registration. Rebuild failures now distinguish an unverified replacement version from a version mismatch and print the preserved backup and recovery commands. Related changes: [PR #11909](https://github.com/NVIDIA/NemoClaw/pull/11909), [PR #12121](https://github.com/NVIDIA/NemoClaw/pull/12121), [PR #12090](https://github.com/NVIDIA/NemoClaw/pull/12090), [PR #12083](https://github.com/NVIDIA/NemoClaw/pull/12083), [PR #11956](https://github.com/NVIDIA/NemoClaw/pull/11956), and [PR #12061](https://github.com/NVIDIA/NemoClaw/pull/12061). For more information, refer to [Understand Gateway Lifecycle Control](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control), [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Managed images now include OpenClaw 2026.9.1 and Hermes 0.21.3. Fresh Hermes installs preserve the forwards created during onboarding, and credential changes accept the expected OpenShell relay disconnect only after the native gateway recovers and its messaging forward returns. OpenClaw device approval now exits after both direct-gateway and local-fallback output drains; a drain failure or timeout exits nonzero instead of waiting on leftover gateway handles. Related changes: [PR #11105](https://github.com/NVIDIA/NemoClaw/pull/11105), [PR #11817](https://github.com/NVIDIA/NemoClaw/pull/11817), [PR #12102](https://github.com/NVIDIA/NemoClaw/pull/12102), [PR #12101](https://github.com/NVIDIA/NemoClaw/pull/12101), and [PR #12178](https://github.com/NVIDIA/NemoClaw/pull/12178). For more information, refer to the [OpenClaw Quickstart](/user-guide/openclaw/get-started/quickstart), [Quickstart with Hermes](/user-guide/hermes/get-started/quickstart), and [Troubleshooting for Hermes](/user-guide/hermes/reference/troubleshooting). * `nemoclaw status` now reports each sandbox's configured inference provider and model separately from the shared gateway's live route. JSON output adds a redacted `configuredInference` object while preserving the existing schema-version-1 meaning of the row-level `provider` and `model` fields. Related change: [PR #12233](https://github.com/NVIDIA/NemoClaw/pull/12233). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * NVIDIA Endpoints validation now uses the documented `reasoning_effort: "none"` control for Nemotron 3 Super. Managed llama.cpp honors its configured readiness budget, Model Router startup waits for each semantic health response within its existing startup budget, and qualifying Windows WSL N1x hosts can rank installed Ollama models when the chassis reports an OEM model string. Related changes: [PR #12007](https://github.com/NVIDIA/NemoClaw/pull/12007), [PR #11955](https://github.com/NVIDIA/NemoClaw/pull/11955), [PR #12096](https://github.com/NVIDIA/NemoClaw/pull/12096), and [PR #11617](https://github.com/NVIDIA/NemoClaw/pull/11617). For more information, refer to [Choose an Inference Provider](/user-guide/openclaw/inference/learn-and-choose/choose-inference-provider), [Set Up llama.cpp](/user-guide/openclaw/inference/local-inference/set-up-llama-cpp), and [Prepare Windows for NemoClaw](/user-guide/openclaw/get-started/additional-setup/windows-preparation). * MCP registration now rejects aliases that resolve to one endpoint but request different credential providers before it mutates policy or provider state. Credential-bound probes run through the adapter executable boundary, and Hermes MCP add now verifies a committed healthy reload before it accepts an expected exec-relay disconnect. Related changes: [PR #11917](https://github.com/NVIDIA/NemoClaw/pull/11917), [PR #12175](https://github.com/NVIDIA/NemoClaw/pull/12175), and [PR #12091](https://github.com/NVIDIA/NemoClaw/pull/12091). For more information, refer to [Add an MCP Server](/user-guide/openclaw/manage-sandboxes/mcp-servers/add-an-mcp-server), [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers), and [Troubleshoot MCP Servers](/user-guide/openclaw/reference/troubleshoot-mcp-servers). * Installer and onboarding checks now support protected Docker 27 receipt transfer and an explicit force-fresh macOS reset that retains model caches. Port overrides with leading zeroes fail before onboarding, and Teams channel changes verify the selected webhook port before mutation or rebuild deletion. Invalid `NEMOCLAW_CORPORATE_CA_BUNDLE` input now reports an actionable path-free validation reason instead of a managed image catalog failure, and lock contention diagnostics identify the live process that owns the onboarding state lock. Related changes: [PR #12015](https://github.com/NVIDIA/NemoClaw/pull/12015), [PR #11875](https://github.com/NVIDIA/NemoClaw/pull/11875), [PR #10489](https://github.com/NVIDIA/NemoClaw/pull/10489), [PR #12074](https://github.com/NVIDIA/NemoClaw/pull/12074), and [PR #12234](https://github.com/NVIDIA/NemoClaw/pull/12234). For more information, refer to [System Readiness](/user-guide/openclaw/reference/system-readiness), [Enable Channels During Onboarding](/user-guide/openclaw/manage-sandboxes/messaging-channels/enable-channels-during-onboarding), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Deep Agents Code can now complete its first interactive model turn while the OpenShell sandbox continues to deny `memfd_create`. Headless inference and sandbox lifecycle behavior remain unchanged. Related change: [PR #11972](https://github.com/NVIDIA/NemoClaw/pull/11972). For more information, refer to the [Deep Agents Quickstart](/user-guide/deepagents/get-started/quickstart). ## September 17, 2026 ## v0.0.127 NemoClaw v0.0.127 returns gateway, plugin, and package lifecycle ownership to OpenClaw and Hermes while preserving OpenShell sandbox controls. It also improves sandbox startup and deletion convergence, configuration export, shared inference routing, installer readiness, MCP diagnostics, and messaging reuse. * OpenClaw and Hermes now own their native gateway processes, plugins, packages, child processes, hooks, and background work after onboarding. NemoClaw continues to select the exact OpenShell sandbox, project credentials, observe health, repair host forwards, and preserve native agent state through rebuild and restore. Managed Docker bootstrap also retains recovery state until the replacement sandbox identity and reconnect path are verified. Related changes: [PR #11792](https://github.com/NVIDIA/NemoClaw/pull/11792), [PR #11906](https://github.com/NVIDIA/NemoClaw/pull/11906), and [PR #11698](https://github.com/NVIDIA/NemoClaw/pull/11698). For more information, refer to [Understand Gateway Lifecycle Control](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control), [Install OpenClaw Plugins](/user-guide/openclaw/manage-sandboxes/install-openclaw-plugins), and [Install Hermes Plugins](/user-guide/hermes/manage-sandboxes/install-hermes-plugins). * Starting a stopped OpenClaw or Hermes sandbox now waits for the native gateway to become observably ready before health checks and host-forward restoration. A failed OpenClaw startup retains its intentional-stop record so a retry repeats the bounded settlement path, while Hermes recovery rejects a persistently stopped gateway instead of reporting readiness early. Related changes: [PR #11914](https://github.com/NVIDIA/NemoClaw/pull/11914), [PR #11933](https://github.com/NVIDIA/NemoClaw/pull/11933), and [PR #11950](https://github.com/NVIDIA/NemoClaw/pull/11950). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Sandbox destroy, rebuild, forced snapshot restore, and final-gateway cleanup now wait for bounded OpenShell deletion convergence without retrying the delete mutation. Ambiguous or persistent state preserves local recovery ownership, and final-gateway cleanup explains why it kept the gateway when sandbox absence or the lack of other live sandboxes cannot be proved. Related changes: [PR #11838](https://github.com/NVIDIA/NemoClaw/pull/11838), [PR #11951](https://github.com/NVIDIA/NemoClaw/pull/11951), and [PR #11614](https://github.com/NVIDIA/NemoClaw/pull/11614). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Docker-backed rebuild now replays the exact provider-captured GPU selector and fails before deletion when the selected acceleration cannot be represented safely. Related change: [PR #11929](https://github.com/NVIDIA/NemoClaw/pull/11929). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * `nemoclaw config export` now accepts HTTP and HTTPS inference endpoints, retains supported managed vLLM execution and model settings, and exports the verified selected Ollama model with its SHA-256 digest. At that release, hosted OpenClaw exports preserved supported read-only secondary agents. The current v1-aligned exporter instead rejects every secondary-agent roster without producing a document. Related changes: [PR #11789](https://github.com/NVIDIA/NemoClaw/pull/11789), [PR #11889](https://github.com/NVIDIA/NemoClaw/pull/11889), [PR #11891](https://github.com/NVIDIA/NemoClaw/pull/11891), and [PR #11900](https://github.com/NVIDIA/NemoClaw/pull/11900). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) and [Set Up Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama). * Pi rebuild now preserves recorded context-window, output-token, reasoning, and reasoning-effort settings, and its qualification path verifies context-free automation and interactive session persistence across onboarding, rebuild, and recovery. The Pi documentation now defines model limits, lifecycle commands, candidate-image authority, and the current support boundary. Related change: [PR #10355](https://github.com/NVIDIA/NemoClaw/pull/10355). For more information, refer to [Configure Pi Model Limits](/user-guide/pi/inference/configure-model-limits), [Run Pi](/user-guide/pi/manage-sandboxes/run-pi), and [Pi Support and Security](/user-guide/pi/reference/pi-support). * `nemoclaw inference set` now permits provider-only or model-only changes on a shared OpenShell gateway and warns which registered sandboxes the route change affects. Endpoint, API-family, credential, incomplete-route, and invalid-gateway conflicts still stop before mutation. Related change: [PR #11947](https://github.com/NVIDIA/NemoClaw/pull/11947). For more information, refer to [Use Shared Gateway Routes](/user-guide/openclaw/inference/manage-inference/use-shared-gateway-routes) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Docker readiness and onboarding now treat `DOCKER_CONTEXT` as the operator-selected authority instead of silently falling back to another local daemon. Installation now stages and verifies the required OpenShell SDK without GitHub credentials, and a trusted package upgrade writes the complete authenticated gateway environment before restarting the service. Related changes: [PR #11786](https://github.com/NVIDIA/NemoClaw/pull/11786), [PR #11921](https://github.com/NVIDIA/NemoClaw/pull/11921), and [PR #11843](https://github.com/NVIDIA/NemoClaw/pull/11843). For more information, refer to [System Readiness](/user-guide/openclaw/reference/system-readiness), [Troubleshooting](/user-guide/openclaw/reference/troubleshooting), and the [OpenClaw Quickstart](/user-guide/openclaw/get-started/quickstart). * MCP status and credential probes now honor the recorded trusted private host when discovering tools, while entries without that recorded trust keep the strict public-address boundary. Managed MCP documentation now distinguishes adapter-scoped egress from interactive shell commands, and `nemoclaw credentials add` refuses an ambient untrusted gateway endpoint override before any host-side probe or provider mutation. Related changes: [PR #11405](https://github.com/NVIDIA/NemoClaw/pull/11405), [PR #11866](https://github.com/NVIDIA/NemoClaw/pull/11866), and [PR #11865](https://github.com/NVIDIA/NemoClaw/pull/11865). For more information, refer to [Add an MCP Server](/user-guide/openclaw/manage-sandboxes/mcp-servers/add-an-mcp-server), [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers), and [Troubleshoot MCP Servers](/user-guide/openclaw/reference/troubleshoot-mcp-servers). * Reusing a sandbox through onboarding now preserves an active messaging channel and its matching network policy when durable gateway credential bindings still prove that configuration. Explicit channel removal or durable credential removal still disables the channel and removes its policy preset. Related change: [PR #10782](https://github.com/NVIDIA/NemoClaw/pull/10782). For more information, refer to [Enable Channels During Onboarding](/user-guide/openclaw/manage-sandboxes/messaging-channels/enable-channels-during-onboarding) and [Network Policies Reference](/user-guide/openclaw/reference/network-policies). * Manual OpenClaw state transfer now includes every seeded workspace template, including `TOOLS.md` and `HEARTBEAT.md`, while keeping generated `POLICY.md` out of uploads. Related change: [PR #11524](https://github.com/NVIDIA/NemoClaw/pull/11524). For more information, refer to [Transfer State Manually](/user-guide/openclaw/manage-sandboxes/state-and-backups/transfer-state-manually). ## September 15, 2026 ## v0.0.126 NemoClaw v0.0.126 moves sandbox, gateway, and host-forward recovery onto typed OpenShell lifecycle controls. It also strengthens Podman onboarding, destructive-operation safety, secret redaction, policy activation, and package execution. * Sandbox lifecycle and host-forward operations now share typed OpenShell adapters for selection, registration, observation, recovery, and cleanup. Stop, destroy, and rebuild retain the local sandbox registry record when forward release cannot be proved. Gateway startup offers a service stop command only when one stable active service is the sole listener and owns the selected state, and supported recovery no longer replaces legacy keepalive containers. Related changes: [PR #11594](https://github.com/NVIDIA/NemoClaw/pull/11594), [PR #11725](https://github.com/NVIDIA/NemoClaw/pull/11725), [PR #11741](https://github.com/NVIDIA/NemoClaw/pull/11741), and [PR #11776](https://github.com/NVIDIA/NemoClaw/pull/11776). For more information, refer to [Understand Gateway Lifecycle Control](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control) and [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * `nemoclaw recover` now starts a stopped Docker-driver sandbox through OpenShell so the sandbox returns to `Ready` instead of leaving a running container in `Stopped`. A later `start` repairs the same phase mismatch, while paused sandboxes and running sandboxes in other phases remain unchanged. Related changes: [PR #11784](https://github.com/NVIDIA/NemoClaw/pull/11784) and [PR #11797](https://github.com/NVIDIA/NemoClaw/pull/11797). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) and [Recover and Rebuild Sandboxes for Hermes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Managed Podman onboarding now reads the structured OpenShell main-process specification, preserves its terminal setting, and releases the stopped original container before the replacement binds its port. Failed-onboarding destroy uses the explicitly selected Podman provider only before durable sandbox or gateway provider state exists, and it does not fall through to Docker. Related change: [PR #11816](https://github.com/NVIDIA/NemoClaw/pull/11816). For more information, refer to [Platform Support](/user-guide/openclaw/reference/platform-support) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * `rebuild` now stops before backup or sandbox deletion when a recorded remote inference credential is expired, missing, or cannot be verified. It checks the credential again immediately before deletion, preserves the existing sandbox, and does not let `--force` bypass this boundary. Related change: [PR #11779](https://github.com/NVIDIA/NemoClaw/pull/11779). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * `nemoclaw uninstall --yes` can now remove a non-default-port state root left by onboarding that failed during preflight before it created a sandbox or gateway. Cleanup holds the onboarding lock, revalidates ownership and absence, and preserves state when the evidence changes, belongs to another gateway, or uses a custom state root. Related change: [PR #11602](https://github.com/NVIDIA/NemoClaw/pull/11602). For more information, refer to [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw). * OpenShell policy writes now allow 65 seconds for the 60-second activation wait and process settlement, while read-only policy operations retain their 15-second deadline. This prevents larger policy updates, including a second managed MCP server, from ending before OpenShell reports the activation result. Related change: [PR #11863](https://github.com/NVIDIA/NemoClaw/pull/11863). For more information, refer to [Apply Policy Presets](/user-guide/openclaw/network-policy/configure-policies/apply-policy-presets) and [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers). * `nemoclaw list` now applies the same redaction boundary as `nemoclaw status` to sandbox, inference, policy, agent, phase, and recovery fields in text and JSON output. Managed vLLM adoption now queries the published port by the inspected container ID, so a container-name transfer cannot redirect the adoption decision. Related changes: [PR #11815](https://github.com/NVIDIA/NemoClaw/pull/11815) and [PR #11821](https://github.com/NVIDIA/NemoClaw/pull/11821). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) and [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm). * Managed image and CI builds use Node.js 24.18.1 with integrity-verified npm 12.0.2 while the public Node.js 22.19 compatibility floor remains unchanged. Builds also set every `package.json` executable, including `nemoclaw-acp` and `nemoclaw-blueprint-runner`, to mode `0755`, so fresh packages can invoke them directly. Related changes: [PR #11736](https://github.com/NVIDIA/NemoClaw/pull/11736), [PR #11839](https://github.com/NVIDIA/NemoClaw/pull/11839), and [PR #11840](https://github.com/NVIDIA/NemoClaw/pull/11840). For more information, refer to [Quickstart with Hermes](/user-guide/hermes/get-started/quickstart) and [Troubleshooting](/user-guide/hermes/reference/troubleshooting). * The Experimental NemoCUA command reference now states that host-local inference, including local Ollama, is unsupported and names the onboarding error for that selection. Related change: [PR #11095](https://github.com/NVIDIA/NemoClaw/pull/11095). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). ## September 14, 2026 ## v0.0.125 NemoClaw v0.0.125 strengthens OpenShell gateway authority and onboarding finalization. It also improves sandbox transfers, native Podman and OpenClaw networking, and the release validation pipeline. * The Hermes `nemoclaw-acp` adapter can select and, when required, start only its exact recorded OpenShell gateway when it is missing, unhealthy, or unreachable, or when a different gateway is connected. Conflicting or ambiguous gateway identities, authentication errors, schema failures, timeouts, and other observation failures stop recovery before gateway startup or ACP session creation. Related changes: [PR #11691](https://github.com/NVIDIA/NemoClaw/pull/11691) and [PR #11681](https://github.com/NVIDIA/NemoClaw/pull/11681). For more information, refer to the [Hermes CLI Commands Reference](/user-guide/hermes/reference/commands) and [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Onboarding preserves process-inspection and secret-boundary refusals as incomplete, resumable state instead of reporting a ready sandbox. Experimental version 2 external-component activation evidence now accepts the same namespaced component IDs as registration while continuing to reject the reserved `openshell/` prefix and malformed evidence. Related changes: [PR #11760](https://github.com/NVIDIA/NemoClaw/pull/11760) and [PR #11745](https://github.com/NVIDIA/NemoClaw/pull/11745). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Troubleshooting](/user-guide/openclaw/reference/troubleshooting), and [Register an External Component During Onboarding](/user-guide/openclaw/deployment/register-external-component). * Legacy OpenShell upgrade recovery preserves the recorded gateway, sandbox identity, workspace, and digest-verified pre-upgrade policy when live provider inspection is unavailable. Related changes: [PR #11612](https://github.com/NVIDIA/NemoClaw/pull/11612) and [PR #11585](https://github.com/NVIDIA/NemoClaw/pull/11585). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) and [Recover and Rebuild Sandboxes for Hermes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Sandbox upload and download commands now await typed OpenShell transfers on the sandbox's recorded gateway. The lifecycle lock and owned staging remain active until transfer, verification, publication, and cleanup settle, while existing terminal output and exit behavior remain unchanged. Related change: [PR #11496](https://github.com/NVIDIA/NemoClaw/pull/11496). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Managed OpenClaw now uses its native sandbox-local loopback endpoint by default and no longer depends on private-interface discovery, insecure private WebSockets, or a dedicated gateway dialback policy. Native Podman onboarding accepts the standard rootless socket layout when a private current-user directory prevents access by other users, while unsafe reachable sockets remain blocked. Related changes: [PR #11695](https://github.com/NVIDIA/NemoClaw/pull/11695) and [PR #11730](https://github.com/NVIDIA/NemoClaw/pull/11730). For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [System Readiness](/user-guide/openclaw/reference/system-readiness), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Protected managed-image qualification now retains bounded, redacted failure evidence and completes rollback in OpenShell-before-Docker order. Lifecycle changes trigger the corresponding activation and publication gates, platform runs retain per-commit evidence, isolated jobs initialize their gateway before owned cleanup, transient tool downloads retry, and obsolete or overly broad E2E fixtures have been removed or narrowed. Agent-alias and onboarding probes also run independent cases concurrently without reducing assertions. Related changes: [PR #11713](https://github.com/NVIDIA/NemoClaw/pull/11713), [PR #11663](https://github.com/NVIDIA/NemoClaw/pull/11663), [PR #11607](https://github.com/NVIDIA/NemoClaw/pull/11607), [PR #11769](https://github.com/NVIDIA/NemoClaw/pull/11769), [PR #11742](https://github.com/NVIDIA/NemoClaw/pull/11742), [PR #11743](https://github.com/NVIDIA/NemoClaw/pull/11743), [PR #11588](https://github.com/NVIDIA/NemoClaw/pull/11588), [PR #11708](https://github.com/NVIDIA/NemoClaw/pull/11708), and [PR #11704](https://github.com/NVIDIA/NemoClaw/pull/11704). * PR Review Advisor accepts unresolved required E2E coverage when no runnable selector exists, requires a nonempty read of each declared evidence file, and records bounded tool-flow metadata for failed turns without exposing arguments, paths, or untrusted names. Related changes: [PR #11773](https://github.com/NVIDIA/NemoClaw/pull/11773), [PR #11762](https://github.com/NVIDIA/NemoClaw/pull/11762), and [PR #11728](https://github.com/NVIDIA/NemoClaw/pull/11728). * Internal messaging declarations with no active consumer have been removed without changing channel manifests or runtime behavior. The source scan configuration also recognizes the checksum-pinned Hermes documentation search key through one exact, read-only allowlist entry. Related changes: [PR #11705](https://github.com/NVIDIA/NemoClaw/pull/11705) and [PR #11740](https://github.com/NVIDIA/NemoClaw/pull/11740). ## v0.0.124 NemoClaw v0.0.124 updates the managed OpenShell runtime to 0.0.116 and improves upgrades, local inference, and sandbox recovery. It also restores interactive Deep Agents Code execution features and improves agent message handling. * Upgrade recovery now waits for the replaced packaged gateway to bind before recovering sandboxes. Failed required pre-upgrade backups no longer leave incomplete directories that appear to be recovery points; failed cleanup reports the retained path. Rebuild also preserves the recorded serving-profile selection instead of losing it during recreation. Related changes: [PR #11251](https://github.com/NVIDIA/NemoClaw/pull/11251), [PR #11710](https://github.com/NVIDIA/NemoClaw/pull/11710), [PR #11589](https://github.com/NVIDIA/NemoClaw/pull/11589), and [PR #11686](https://github.com/NVIDIA/NemoClaw/pull/11686). * Named sandbox commands now use the sandbox's recorded gateway across gateway-port registry roots. If forward startup fails, recovery removes only forwards it started and reports cleanup it cannot verify. Interactive `launch` releases lifecycle locks after dispatch so other lifecycle commands can proceed during the session. Related changes: [PR #11445](https://github.com/NVIDIA/NemoClaw/pull/11445), [PR #11668](https://github.com/NVIDIA/NemoClaw/pull/11668), [PR #11670](https://github.com/NVIDIA/NemoClaw/pull/11670), and [PR #11657](https://github.com/NVIDIA/NemoClaw/pull/11657). * llama.cpp selection uses the authenticated server's served context window when no valid explicit override is set. Docker Desktop on WSL checks the host-loopback listener from the WSL CLI process before the sandbox bridge check. Unsupported inference-provider errors list supported providers on the selected gateway, with a supported-provider fallback when discovery fails. Related changes: [PR #11544](https://github.com/NVIDIA/NemoClaw/pull/11544), [PR #11444](https://github.com/NVIDIA/NemoClaw/pull/11444), and [PR #11464](https://github.com/NVIDIA/NemoClaw/pull/11464). * Interrupted managed vLLM installation can replace a running container only when its ownership, local Docker connection, and port mapping match the requested installation. Other port holders remain protected. N1x preview rebuild accepts a retained canonical managed endpoint with the recorded preview decision. Related changes: [PR #11587](https://github.com/NVIDIA/NemoClaw/pull/11587) and [PR #11580](https://github.com/NVIDIA/NemoClaw/pull/11580). * Native Linux Docker OpenClaw configuration export accepts the verified Ollama route created during ordinary onboarding. It requires the managed proxy credential and omits its value from the export. Stopping an Ollama sandbox no longer retains its model solely because a matching sibling is stopped or incomplete. An unverified sibling state prevents model unload and makes `stop` exit nonzero. Related changes: [PR #11550](https://github.com/NVIDIA/NemoClaw/pull/11550) and [PR #11656](https://github.com/NVIDIA/NemoClaw/pull/11656). * Managed Deep Agents Code interactive sessions restore native local shell, startup-command, and interpreter behavior inside the OpenShell sandbox. Headless shell execution remains disabled, and headless non-shell tools retain automatic approval. Non-interactive reply handling and pre-session inference verification also improve. Related changes: [PR #11683](https://github.com/NVIDIA/NemoClaw/pull/11683), [PR #11276](https://github.com/NVIDIA/NemoClaw/pull/11276), and [PR #11546](https://github.com/NVIDIA/NemoClaw/pull/11546). * Agent message dispatch preserves piped input and avoids waiting on idle standard input when a message is already supplied. Managed OpenClaw heartbeats use isolated sessions to avoid changing the main conversation. Related changes: [PR #11382](https://github.com/NVIDIA/NemoClaw/pull/11382) and [PR #11487](https://github.com/NVIDIA/NemoClaw/pull/11487). * Fresh interceptor-based providerless onboarding now leaves OpenClaw and Hermes without an inference route until a managed provider is configured. Version 2 external-component declarations remain unqualified against a released OpenShell runtime and must not be relied on in an installed release. Related changes: [PR #11584](https://github.com/NVIDIA/NemoClaw/pull/11584), [PR #11633](https://github.com/NVIDIA/NemoClaw/pull/11633), and [PR #11525](https://github.com/NVIDIA/NemoClaw/pull/11525). * Discord setup rejects the literal bot-token placeholder before configuring the channel. Uninstall failures caused by unavailable Docker now explain how to restore access and retry while preserving gateway state. Fatal messaging-build and npm remediation diagnostics redact sensitive process details. Related changes: [PR #11404](https://github.com/NVIDIA/NemoClaw/pull/11404), [PR #11474](https://github.com/NVIDIA/NemoClaw/pull/11474), and [PR #11674](https://github.com/NVIDIA/NemoClaw/pull/11674). ## September 10, 2026 ## v0.0.123 NemoClaw v0.0.123 expands configuration export for managed OpenClaw and Hermes sandboxes. It adds an experimental external-component onboarding contract and improves installer recovery, sandbox lifecycle handling, and inference diagnostics. * `nemoclaw config export` now exports canonical managed Hermes sandboxes, including verified API-key authentication and nondefault interface settings. OAuth authentication and Hermes tool gateways remain outside the export contract. Related changes: [PR #11323](https://github.com/NVIDIA/NemoClaw/pull/11323), [PR #11450](https://github.com/NVIDIA/NemoClaw/pull/11450), and [PR #11477](https://github.com/NVIDIA/NemoClaw/pull/11477). Refer to the [NemoClaw CLI Commands Reference](/user-guide/hermes/reference/commands). * OpenClaw configuration export now preserves managed Brave Search references, proxy settings, hosted inference tuning, execution settings, dashboard settings, direct tool disclosure, and local conversation diagnostics. It also supports one read-only secondary agent that shares the primary hosted inference route. Local Ollama export preserves verified daemon and proxy ports. Export verifies live and retained configuration evidence and writes credential references instead of secret values. Related changes: [PR #11384](https://github.com/NVIDIA/NemoClaw/pull/11384), [PR #11387](https://github.com/NVIDIA/NemoClaw/pull/11387), [PR #11383](https://github.com/NVIDIA/NemoClaw/pull/11383), [PR #11429](https://github.com/NVIDIA/NemoClaw/pull/11429), [PR #11430](https://github.com/NVIDIA/NemoClaw/pull/11430), [PR #11431](https://github.com/NVIDIA/NemoClaw/pull/11431), [PR #11473](https://github.com/NVIDIA/NemoClaw/pull/11473), and [PR #11478](https://github.com/NVIDIA/NemoClaw/pull/11478). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) for the supported export profiles and their limits. * Fresh onboarding on Linux can register one experimental external host component with a NemoClaw-managed Docker-driver gateway. NemoClaw validates the declaration before gateway changes and verifies sandbox identity and effective policy before activation. Failed or ambiguous activation preserves the sandbox and records incomplete state; resume and automatic activation retries are unsupported. NemoClaw does not manage the component service or its credentials. Related changes: [PR #11366](https://github.com/NVIDIA/NemoClaw/pull/11366) and [PR #11471](https://github.com/NVIDIA/NemoClaw/pull/11471). Refer to [Register an External Component During Onboarding](/user-guide/openclaw/deployment/register-external-component). * The installer now attempts existing sandbox recovery before generic host admission and preserves each sandbox's recorded GPU selection. It distinguishes confirmed recovery from missing sandboxes or unconfirmed recovery output, and reports warnings instead of claiming complete recovery. Fresh onboarding and required DGX Station reconciliation still require host admission. Related change: [PR #10397](https://github.com/NVIDIA/NemoClaw/pull/10397). Refer to [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes). * Sandbox status now distinguishes an intentional stop from a failure, and connect directs you to start a stopped sandbox. Related changes: [PR #11211](https://github.com/NVIDIA/NemoClaw/pull/11211), [PR #11336](https://github.com/NVIDIA/NemoClaw/pull/11336), [PR #11482](https://github.com/NVIDIA/NemoClaw/pull/11482), and [PR #11490](https://github.com/NVIDIA/NemoClaw/pull/11490). Refer to [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * NVIDIA Endpoints validation now checks the selected inference route. Onboarding and sandbox status identify the account-access cause when NVIDIA returns a matching model-access 404, without exposing the response body in status diagnostics. Docker readiness failures identify authority conflicts, and GPU-mode probe failures retain the Docker failure reason. Non-interactive onboarding resolves the sandbox name before provider selection. Related changes: [PR #10957](https://github.com/NVIDIA/NemoClaw/pull/10957), [PR #11393](https://github.com/NVIDIA/NemoClaw/pull/11393), [PR #11280](https://github.com/NVIDIA/NemoClaw/pull/11280), and [PR #11442](https://github.com/NVIDIA/NemoClaw/pull/11442). Refer to [Verify the Sandbox Inference Route](/user-guide/openclaw/inference/validate-inference/verify-inference-route) and [System Readiness](/user-guide/openclaw/reference/system-readiness). * Removing Teams now removes Teams-owned Microsoft login credential bindings from matching Outlook policy endpoints. It refuses to remove bindings owned by another integration. Related change: [PR #10846](https://github.com/NVIDIA/NemoClaw/pull/10846). Refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). ## v0.0.122 NemoClaw v0.0.122 improves host detection and local inference selection for Docker, DGX Station, and N1x WSL. It also strengthens interrupted onboarding, configuration export, remote dashboard access, and uninstall failure reporting. * Host readiness now runs Docker probes with the environment that later Docker commands use. It respects the selected Docker context and configuration, rejects unsafe explicit endpoints, and can select the rootless Linux socket after an unreachable default authority. DGX Station checks now separate GB300 hardware identity from the qualified software profile and apply the same classifier during host preparation and onboarding. Related changes: [PR #10379](https://github.com/NVIDIA/NemoClaw/pull/10379) and [PR #10914](https://github.com/NVIDIA/NemoClaw/pull/10914). For more information, refer to [System Readiness](/user-guide/openclaw/reference/system-readiness) and [Prepare a DGX Station](/user-guide/openclaw/get-started/additional-setup/dgx-station-preparation). * A CUDA-qualified N1x WSL host now selects the managed Qwen llama.cpp profile instead of falling back to the smaller Ollama profile. A resumed preset-driven managed vLLM installation verifies the recorded model and serving preset before it changes runtime state. A mismatch stops onboarding and directs you to restart with `nemoclaw onboard --fresh`. Related changes: [PR #11078](https://github.com/NVIDIA/NemoClaw/pull/11078) and [PR #11271](https://github.com/NVIDIA/NemoClaw/pull/11271). For more information, refer to [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server), [Set Up llama.cpp](/user-guide/openclaw/inference/local-inference/set-up-llama-cpp), and [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm). * Interrupted onboarding now releases its process lock and abandons an uncommitted inference-route reservation before a later resume. Final handoff keeps incomplete sandbox identity available for recovery and does not report success when replacement onboarding exits nonzero. The global `nemoclaw doctor` command remains available without a sandbox name, including when a registered sandbox is named `doctor`. Related changes: [PR #11140](https://github.com/NVIDIA/NemoClaw/pull/11140), [PR #11205](https://github.com/NVIDIA/NemoClaw/pull/11205), [PR #11218](https://github.com/NVIDIA/NemoClaw/pull/11218), and [PR #11296](https://github.com/NVIDIA/NemoClaw/pull/11296). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * `nemoclaw config export` now supports native NVIDIA hosted inference only when the gateway uses the built-in `nvidia-prod` profile, its default endpoint, and no provider configuration overrides. Missing or inconsistent provider evidence stops the export without writing a configuration document. Related changes: [PR #11065](https://github.com/NVIDIA/NemoClaw/pull/11065) and [PR #11318](https://github.com/NVIDIA/NemoClaw/pull/11318). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Neutral managed OpenClaw images no longer declare the uninstalled Tavily plugin. This removes recurring `plugin not installed: tavily` warnings when Tavily Search was not selected, while explicitly selected Tavily configuration remains unchanged. Related change: [PR #10331](https://github.com/NVIDIA/NemoClaw/pull/10331). For more information, refer to [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Remote dashboard access now keeps an external `CHAT_UI_URL` separate from the host forward bind. A reverse proxy or tunnel can reach the loopback forward while the URL configures the browser origin and Host-header validation. Direct access on a non-WSL host requires `NEMOCLAW_DASHBOARD_BIND=0.0.0.0` before onboarding and for later `nemohermes connect` calls. Protect the dashboard and API ingress before exposing either service. Related change: [PR #10931](https://github.com/NVIDIA/NemoClaw/pull/10931). For more information, refer to [Quickstart with Hermes](/user-guide/hermes/get-started/quickstart) and [Gateway Authentication Controls](/user-guide/hermes/security/security-controls/gateway-authentication-controls). * The installer now refuses an implicit NemoClaw CLI downgrade and reports the installed and requested versions before it changes the installation. Uninstall exits nonzero when it cannot remove the gateway registration, so automation does not treat partial cleanup as success. Related changes: [PR #11209](https://github.com/NVIDIA/NemoClaw/pull/11209) and [PR #9860](https://github.com/NVIDIA/NemoClaw/pull/9860). For more information, refer to [Update Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/update-sandboxes) and [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw). ## September 8, 2026 ## v0.0.121 NemoClaw v0.0.121 adds managed MCP tool-denial rules and moves skill lifecycle to agent-owned state. It also hardens messaging providers, Windows and WSL inference, sandbox recovery, file transfer, and Hermes state repair. * Managed MCP servers can now deny exact tool names or glob patterns through repeatable `--deny-tool` options. The new `mcp update` command replaces the complete denied-tool list or clears it with `--clear-deny-tools`. Status, restart, rebuild, and launch-readiness checks use the persisted rules and report drift with a recovery command. Related change: [PR #11135](https://github.com/NVIDIA/NemoClaw/pull/11135). For more information, refer to [Add an MCP Server](/user-guide/openclaw/manage-sandboxes/mcp-servers/add-an-mcp-server), [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers), and [Troubleshoot MCP Servers](/user-guide/openclaw/reference/troubleshoot-mcp-servers). * Skill lifecycle state now belongs to the selected agent instead of a parallel NemoClaw inventory. `skill list` streams the agent's native result, while install and remove use native commands when the agent exposes an equivalent operation. Other operations use the manifest-declared writable skill directory without claiming that a same-name skill elsewhere is absent. Related change: [PR #11093](https://github.com/NVIDIA/NemoClaw/pull/11093). For more information, refer to [Understand Sandbox State](/user-guide/openclaw/manage-sandboxes/state-and-backups/understand-sandbox-state) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Messaging provider setup now uses typed OpenShell lifecycle results for registration, reuse, authorized replacement, attachment, refresh observation, and partial-failure recovery. Typed lifecycle results include credential names but never credential values, and channel removal omits placeholder credentials that were never configured. Channel stop and start now preserve credentials and runtime configuration through rebuild and stopped-sandbox restart. Related changes: [PR #11009](https://github.com/NVIDIA/NemoClaw/pull/11009), [PR #11126](https://github.com/NVIDIA/NemoClaw/pull/11126), [PR #11188](https://github.com/NVIDIA/NemoClaw/pull/11188), and [PR #11193](https://github.com/NVIDIA/NemoClaw/pull/11193). For more information, refer to [Manage Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/manage-messaging-channels) and [Credential Storage](/user-guide/openclaw/security/credential-storage). * A CUDA-qualified WSL RTX Spark N1x with at least 30,000 MiB available now ranks an installed `qwen3.6:35b` before `qwen3.5:9b` for Ollama. Windows Ollama onboarding and restart keep traffic in Docker Desktop's verified network context and restore the previous User-scope binding and process state when a transaction fails. Recovery also reports bounded probe-timeout guidance instead of leaving the route failure ambiguous. Related changes: [PR #11187](https://github.com/NVIDIA/NemoClaw/pull/11187), [PR #10855](https://github.com/NVIDIA/NemoClaw/pull/10855), [PR #10889](https://github.com/NVIDIA/NemoClaw/pull/10889), and [PR #11192](https://github.com/NVIDIA/NemoClaw/pull/11192). For more information, refer to [Set Up Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama), [Prepare Windows](/user-guide/openclaw/get-started/additional-setup/windows-preparation), and [System Readiness](/user-guide/openclaw/reference/system-readiness). * Inference provider creation, update, deletion, inspection, settlement, and rollback now use the typed OpenShell provider boundary. Mutations fail closed when ownership or revision identity is incomplete, and rollback verifies the provider revision before deletion. `inference get` reports a reusable endpoint for compatible custom providers only when persisted metadata is safe, complete, and unambiguous. Status distinguishes the configured model from the live routed model and requires verified llama.cpp routes. Related changes: [PR #11008](https://github.com/NVIDIA/NemoClaw/pull/11008), [PR #10833](https://github.com/NVIDIA/NemoClaw/pull/10833), [PR #10261](https://github.com/NVIDIA/NemoClaw/pull/10261), [PR #10471](https://github.com/NVIDIA/NemoClaw/pull/10471), and [PR #11207](https://github.com/NVIDIA/NemoClaw/pull/11207). For more information, refer to [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Sandbox download now rejects a directory that contains a symbolic link or another special file before transfer or host destination creation. Snapshot and rebuild recovery preserve fail-closed identity checks, recover an interrupted backup, and reject unsafe local fallback images. A retained sandbox is removed only after its gateway confirms absence and residual resources have sufficient identity evidence. Related changes: [PR #10654](https://github.com/NVIDIA/NemoClaw/pull/10654), [PR #11142](https://github.com/NVIDIA/NemoClaw/pull/11142), [PR #11094](https://github.com/NVIDIA/NemoClaw/pull/11094), and [PR #10867](https://github.com/NVIDIA/NemoClaw/pull/10867). For more information, refer to [Transfer State Manually](/user-guide/openclaw/manage-sandboxes/state-and-backups/transfer-state-manually), [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). * Hermes startup now repairs restored session, gateway, runtime, history, and log state through descriptor-verified paths before the gateway opens them. It rejects symbolic-link and file substitutions without changing their targets, and it keeps mutable runtime configuration outside relaunch policy. Hermes diagnostics also preserve invalid dashboard URL details and initialize the Kanban schema atomically. Related changes: [PR #10872](https://github.com/NVIDIA/NemoClaw/pull/10872), [PR #11110](https://github.com/NVIDIA/NemoClaw/pull/11110), [PR #11227](https://github.com/NVIDIA/NemoClaw/pull/11227), and [PR #11177](https://github.com/NVIDIA/NemoClaw/pull/11177). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), [Gateway Lifecycle Control](/user-guide/hermes/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control), and [Troubleshooting](/user-guide/hermes/reference/troubleshooting). * Onboarding now fails before sandbox mutation when a managed-image flow cannot honor a configured base-image override. GPU handoff resumes from validated checkpoints, managed vLLM avoids repeated retries after a rejected pinned image, and Gemini HTTP `400` failures include provider-specific recovery guidance. Related changes: [PR #11152](https://github.com/NVIDIA/NemoClaw/pull/11152), [PR #11124](https://github.com/NVIDIA/NemoClaw/pull/11124), [PR #11048](https://github.com/NVIDIA/NemoClaw/pull/11048), and [PR #11171](https://github.com/NVIDIA/NemoClaw/pull/11171). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), and [Use Google Gemini](/user-guide/openclaw/inference/hosted-inference/use-google-gemini). * Managed OpenClaw and Hermes recovery now waits within a 210-second budget for a typed delayed managed-container discovery result. Other privileged-control, identity, and diagnostic failures remain terminal. Related change: [PR #11236](https://github.com/NVIDIA/NemoClaw/pull/11236). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Hermes rebuild now preserves supported configuration values recorded through `nemohermes config set`. It excludes gateway settings, managed inference-route fields, and credential material, verifies restored values, and lists restored and dropped keys. Capture failures stop before deletion; restore or verification failures retain recovery state and exit nonzero. Related change: [PR #10780](https://github.com/NVIDIA/NemoClaw/pull/10780). For more information, refer to [Rebuild While Preserving State](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes#rebuild-while-preserving-state). ## September 4, 2026 ## v0.0.120 NemoClaw v0.0.120 adds secret-free verified configuration export and a global host and gateway doctor. It updates the supported Hermes runtime to 0.20.6, retires Shields from NemoClaw core, and moves managed host forwarding to OpenShell service forwarding. It also hardens sandbox recovery, onboarding, inference validation, MCP lifecycle operations, mTLS selection, and credential-bound messaging policy. * `nemoclaw config export --output ` now writes a canonical `nemoclaw.nvidia.com/v1` configuration document after cross-checking registry, lifecycle, gateway, workload, image, inference, policy, and credential-reference state. The command keeps secrets out of YAML and JSON output and fails closed on inconsistent evidence. On Linux, file output uses owner-only atomic publication; `--output -` writes YAML to standard output on any supported host or in a pipeline. Related change: [PR #11015](https://github.com/NVIDIA/NemoClaw/pull/11015). For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * `nemoclaw doctor` now runs read-only host and gateway checks before onboarding or without selecting a sandbox. It supports human-readable and redacted JSON reports, leaves gateway and sandbox state unchanged, and returns a nonzero status when a required check fails. Related change: [PR #11012](https://github.com/NVIDIA/NemoClaw/pull/11012). For more information, refer to [System Readiness](/user-guide/openclaw/reference/system-readiness) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * The managed Hermes runtime is now 0.20.6 with retargeted compatibility patches, reviewed lazy Hindsight dependencies, workspace-aware session previews, scheduled-task recovery, and the maintained managed-image security boundaries. Gateway startup preserves the validated lazy-install target for both direct root-entrypoint and OpenShell-managed same-UID topologies. Legacy rebuilds with no image hint now require the release-pinned immutable Hermes base and stop before mutation if it cannot be resolved and validated. Related changes: [PR #10595](https://github.com/NVIDIA/NemoClaw/pull/10595), [PR #11071](https://github.com/NVIDIA/NemoClaw/pull/11071), and [PR #11024](https://github.com/NVIDIA/NemoClaw/pull/11024). For more information, refer to [Install Hermes Plugins](/user-guide/hermes/manage-sandboxes/install-hermes-plugins) and [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Shields has been retired from NemoClaw core, including its commands, plugin status, timers, policies, state-lock plans, and runtime-provider mutation contract. Upgrades preserve and report legacy Shields state instead of interpreting or deleting it, and affected installations must follow the printed fail-closed quarantine and rebuild guidance before ordinary mutation. Legacy OpenClaw migration also preserves the prepared rebuild context and exact candidate managed-image selection across replacement creation. Related changes: [PR #10722](https://github.com/NVIDIA/NemoClaw/pull/10722) and [PR #10996](https://github.com/NVIDIA/NemoClaw/pull/10996). For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) and [Security Best Practices](/user-guide/openclaw/security/best-practices). * NemoClaw now uses detached `openshell forward service` processes for managed dashboard, messaging, and MCP host forwards instead of owning SSH forwarding processes and receipt state. The forward lifecycle follows sandbox and gateway availability, refuses an occupied host port, verifies reachability before success, and relaunches through normal recovery. MCP lifecycle work and typed policy reads also retain the sandbox's recorded gateway, workspace, TLS, and mTLS authority instead of inheriting ambient selectors. Related changes: [PR #10695](https://github.com/NVIDIA/NemoClaw/pull/10695), [PR #10814](https://github.com/NVIDIA/NemoClaw/pull/10814), [PR #10815](https://github.com/NVIDIA/NemoClaw/pull/10815), and [PR #10810](https://github.com/NVIDIA/NemoClaw/pull/10810). For more information, refer to [Understand Gateway Lifecycle Control](/user-guide/openclaw/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control) and [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers). * Onboarding can restore a validated managed snapshot into a replacement sandbox before it publishes the replacement registry entry, preserving the snapshot and leaving the replacement unregistered when restore or authority checks fail. Native Podman providers can own their Docker-less readiness checks, qualified N1x users who decline the Deferred Express preview continue into ordinary provider selection, and managed vLLM preserves the catalog's served model when a resume checkpoint records a short alias. Related changes: [PR #10690](https://github.com/NVIDIA/NemoClaw/pull/10690), [PR #10900](https://github.com/NVIDIA/NemoClaw/pull/10900), [PR #11046](https://github.com/NVIDIA/NemoClaw/pull/11046), [PR #10882](https://github.com/NVIDIA/NemoClaw/pull/10882), and [PR #10864](https://github.com/NVIDIA/NemoClaw/pull/10864). For more information, refer to the [NemoClaw Quickstart with OpenClaw](/user-guide/openclaw/get-started/quickstart), [Use vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), and [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). * Inference status retries transient HTTP `429`, `502`, `503`, and `504` results up to three total attempts while preserving redacted JSON stdout and the final unhealthy result when every attempt fails. NVIDIA Nemotron 3 Super endpoint validation now sends its required sampling and chat-template parameters, and the default Model Router pool replaces the retired Nemotron Nano route with GPT-OSS 20B High. Related changes: [PR #10956](https://github.com/NVIDIA/NemoClaw/pull/10956), [PR #10910](https://github.com/NVIDIA/NemoClaw/pull/10910), and [PR #11070](https://github.com/NVIDIA/NemoClaw/pull/11070). For more information, refer to [Verify the Inference Route](/user-guide/openclaw/inference/validate-inference/verify-inference-route), [Set Up Model Router](/user-guide/openclaw/inference/hosted-inference/set-up-model-router), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). * Deep Agents MCP status now rejects symbolic links, dangling symbolic links, FIFOs, and other unsafe managed projection entries instead of reporting an ordinary adapter mismatch. Snapshot restore can reconstruct the NemoClaw-owned projection through an atomic no-follow replacement while preserving directory targets for explicit operator recovery. Related changes: [PR #10911](https://github.com/NVIDIA/NemoClaw/pull/10911) and [PR #10909](https://github.com/NVIDIA/NemoClaw/pull/10909). For more information, refer to [Create and Restore Snapshots](/user-guide/deepagents/manage-sandboxes/state-and-backups/create-and-restore-snapshots) and [About Managed MCP Servers](/user-guide/deepagents/manage-sandboxes/mcp-servers/about-managed-mcp-servers). * Messaging and web-search provider setup now verifies the exact checked-in OpenShell profile before registration or Ready reuse. An existing refreshing bridge keeps its working credential until replacement minting succeeds, and lookup, update, cleanup, and recovery failures remain distinct, redacted, and fail closed. Named gateway operations also reject an ambient OpenShell endpoint that could redirect provider preparation. Related changes: [PR #10884](https://github.com/NVIDIA/NemoClaw/pull/10884) and [PR #10895](https://github.com/NVIDIA/NemoClaw/pull/10895). For more information, refer to [Manage Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/manage-messaging-channels) and [Credential Storage](/user-guide/openclaw/security/credential-storage). * Hermes Discord policy now authorizes only the Hermes and Python runtime binaries used for Discord traffic and removes the unused generic Node.js grant. Existing Hermes Discord sandboxes can reapply the maintained preset to remove the durable old grant without changing unrelated policy entries. Related change: [PR #10682](https://github.com/NVIDIA/NemoClaw/pull/10682). For more information, refer to [Apply Policy Presets](/user-guide/hermes/network-policy/configure-policies/apply-policy-presets). ## September 2, 2026 ## v0.0.119 NemoClaw v0.0.119 adds an explicitly selected native rootless Podman runtime path and an experimental managed llama.cpp path for qualifying Windows WSL N1x hosts. It hardens custom network policy, WeChat redirect, Langfuse, MCP credential, and messaging-rebuild boundaries. It also improves local inference selection, Hermes recovery, interrupted-install guidance, and sandbox command behavior, and updates reviewed production dependency graphs to remove four high-severity `fast-uri` advisories. * Native rootless Podman can now run standard managed-image onboarding on qualified Linux hosts when you set `NEMOCLAW_GATEWAY_RUNTIME=podman`. The provider verifies the current-user socket, rootless service, cgroups v2, bridge networking, DNS, platform, and exact managed-image receipt before admission. Qualifying Windows WSL N1x hosts can use an explicit Experimental managed llama.cpp recipe for Qwen 3.6 35B-A3B after Docker Desktop, GPU passthrough, memory, driver, and product-identity checks pass. Related changes: [PR #9923](https://github.com/NVIDIA/NemoClaw/pull/9923) and [PR #10742](https://github.com/NVIDIA/NemoClaw/pull/10742). * Windows-host Ollama requests now stay inside Docker Desktop across inventory, pull, validation, health, recovery, and cleanup instead of switching to a WSL-inaccessible route. Automatic Ollama selection chooses the largest fitting registered installed model before unregistered inventory entries, and managed vLLM preserves explicit GPU intent when an existing server occupies the selected port while reporting safe reuse or reconfiguration steps. Failed Ollama proof processes are also cleaned up as a process tree. Related changes: [PR #10741](https://github.com/NVIDIA/NemoClaw/pull/10741), [PR #10326](https://github.com/NVIDIA/NemoClaw/pull/10326), [PR #10308](https://github.com/NVIDIA/NemoClaw/pull/10308), and [PR #10767](https://github.com/NVIDIA/NemoClaw/pull/10767). * Custom policy presets now reject untrusted private, local, metadata, and other special-use destinations before preview or mutation, while preserving exact explicit trust for supported private destinations. Dry-run and apply share the same reserved-key ownership checks, and successful custom-preset lookup and removal no longer print a contradictory missing-preset warning. Related changes: [PR #10659](https://github.com/NVIDIA/NemoClaw/pull/10659), [PR #10834](https://github.com/NVIDIA/NemoClaw/pull/10834), and [PR #10809](https://github.com/NVIDIA/NemoClaw/pull/10809). * OpenShell policy reads and rebuild handoffs now use typed policy boundaries, separate provider-composed entries from the round-trippable base policy, and refuse to carry literal credentials into a replacement sandbox. Credential commands route through the shared OpenShell provider adapter, including endpoint-bound non-secret provider configuration and managed MCP key ownership checks. Related changes: [PR #10150](https://github.com/NVIDIA/NemoClaw/pull/10150) and [PR #10149](https://github.com/NVIDIA/NemoClaw/pull/10149). * Experimental WeChat QR login now rejects untrusted redirect hosts before contact and authorizes only the exact validated Tencent iLink IDC origin captured for the account. Rebuild preserves channels whose complete required credentials remain available through matching gateway providers; it disables a channel only after confirmed absence and stops without staging changes when inspection is uncertain or conflicting. Related changes: [PR #10692](https://github.com/NVIDIA/NemoClaw/pull/10692) and [PR #10707](https://github.com/NVIDIA/NemoClaw/pull/10707). * Managed MCP restart now verifies every selected server's stored credential before changing policy, providers, or agent adapters when no replacement host value is exported. Hermes Langfuse Cloud credentials use an endpoint-bound OpenShell profile for the exact public and secret key names instead of relying on destination-independent placeholder rewriting. Related changes: [PR #10759](https://github.com/NVIDIA/NemoClaw/pull/10759) and [PR #10844](https://github.com/NVIDIA/NemoClaw/pull/10844). * An interrupted install or upgrade now reports that the compiled CLI is incomplete and directs you to rerun the installer, which attempts sandbox recovery. Related changes: [PR #10444](https://github.com/NVIDIA/NemoClaw/pull/10444) and [PR #10743](https://github.com/NVIDIA/NemoClaw/pull/10743). * A bare sandbox action now reports the required `nemoclaw ` grammar without exposing arbitrary input. `nemoclaw exec` runs without a pseudo-terminal by default so formatted output and stderr redirection behave predictably; pass `--tty` for an interactive terminal. Uninstall previews now name the gateway and Docker volume selected by `NEMOCLAW_GATEWAY_PORT`. Related changes: [PR #10335](https://github.com/NVIDIA/NemoClaw/pull/10335), [PR #10760](https://github.com/NVIDIA/NemoClaw/pull/10760), and [PR #10803](https://github.com/NVIDIA/NemoClaw/pull/10803). * Hermes onboarding now requires its tracked base image, or a repository-built local base that passes the same controls, instead of falling through to an image that final provenance checks must reject. Stopped-container recovery omits one known-futile prelaunch health request, keeps final authenticated health required, and reports credential-safe timing for its qualification, startup, polling, rollback, and total phases. Related changes: [PR #10831](https://github.com/NVIDIA/NemoClaw/pull/10831), [PR #10805](https://github.com/NVIDIA/NemoClaw/pull/10805), and [PR #10811](https://github.com/NVIDIA/NemoClaw/pull/10811). * NemoClaw now pins `fast-uri` 3.1.6 across its production dependency graphs and managed-image build inputs. Reviewed locks, integrity metadata, runtime bundles, and image fixtures now exclude the four high-severity advisories that affect earlier 3.x releases while preserving the fail-closed audit threshold. Related changes: [PR #10894](https://github.com/NVIDIA/NemoClaw/pull/10894) and [PR #10892](https://github.com/NVIDIA/NemoClaw/pull/10892). ## September 1, 2026 ## v0.0.118 NemoClaw v0.0.118 adds headless package boundaries for Hermes lifecycle planning and credential-free external OpenShell gateway health checks. It improves fail-closed sandbox destruction, rebuild, onboarding, Shields, inference, and Hermes recovery. It also broadens Deferred N1x detection and gives N1x managed vLLM a dedicated serving profile. * The new `nemoclaw/lifecycle` package export supports deterministic Hermes 0.19.0 lifecycle planning and read-only agent observation with OpenShell 0.0.106. Callers provide the observation capability; the package does not own transport, authentication, persistence, or mutation. The Blueprint Runner can also check a configured external OpenShell gateway through the pinned SDK without credentials or mutation. Related changes: [PR #10703](https://github.com/NVIDIA/NemoClaw/pull/10703) and [PR #10618](https://github.com/NVIDIA/NemoClaw/pull/10618). * OpenClaw sandbox destruction now detects Shields-locked Mcporter configuration before mutation and provides recovery guidance. `destroy --force` can continue only for retained OpenClaw Mcporter entries, while Hermes and ordinary MCP mutations remain fail-closed. Related change: [PR #10483](https://github.com/NVIDIA/NemoClaw/pull/10483). * Rebuild now stops before deleting the original sandbox when any declared state directory or file cannot be preserved, including with `--force`. When cleanup fails, NemoClaw retains the incomplete snapshot at the reported path. It excludes the snapshot from `snapshot list` and restore selection. The directory can contain unsanitized credentials. Keep it owner-only. Do not restore, copy, share, or edit it. Repair access to the original sandbox state. Remove the retained directory only after you verify that the original sandbox or a complete snapshot contains every required state item. Confirm that the reported path is absent. Then rerun the operation. A failed nested onboarding result no longer proceeds to restore or report success. Related changes: [PR #10686](https://github.com/NVIDIA/NemoClaw/pull/10686) and [PR #10590](https://github.com/NVIDIA/NemoClaw/pull/10590). * Fresh onboarding now ends the OpenShell create handoff after receiving a validated durable sandbox ID, then settles and verifies identity before post-create effects. This prevents affected WSL2 ARM OpenClaw sandboxes from moving from Ready to Error while publication metadata is still settling. Related change: [PR #10789](https://github.com/NVIDIA/NemoClaw/pull/10789). * Hermes stopped-sandbox recovery reuses verified lifecycle and inference state. It still rolls back failures and performs final readiness qualification. Hermes dashboards behind a reverse proxy also accept the hostname from a validated HTTPS `CHAT_UI_URL` for HTTP and WebSocket requests while remaining bound to loopback. Related changes: [PR #10641](https://github.com/NVIDIA/NemoClaw/pull/10641) and [PR #10687](https://github.com/NVIDIA/NemoClaw/pull/10687). * Inference status now queries the selected gateway instead of implicitly using the default gateway. Hugging Face model downloads with no output abort after a bounded stall timeout. Managed vLLM accepts a catalog short name, full Hugging Face model ID, or registered served model name as aliases for the same model. Onboarding normalizes known aliases when it reuses an existing managed vLLM endpoint, while pull-request CI verifies pinned Hugging Face references without credentials. Related changes: [PR #10698](https://github.com/NVIDIA/NemoClaw/pull/10698), [PR #10352](https://github.com/NVIDIA/NemoClaw/pull/10352), and [PR #10429](https://github.com/NVIDIA/NemoClaw/pull/10429). * Shields status for Hermes now remains read-only instead of repairing mutable state during observation. Related change: [PR #10710](https://github.com/NVIDIA/NemoClaw/pull/10710). * DGX Station Express host preparation now ignores NemoClaw and OpenShell agent processes owned by another user for non-root and `sudo` controllers. It still blocks the controller agent processes and keeps direct-root agent checks, vLLM conflicts, and Docker conflicts host-wide. Related change: [PR #10689](https://github.com/NVIDIA/NemoClaw/pull/10689). * Deferred N1x preview detection now accepts NVIDIA display-class GPUs without requiring one PCI device ID and recognizes OEM DGX Spark FastOS identity. v0.0.118 introduced a dedicated N1x Qwen3.6 35B NVFP4 serving profile with its original memory, context, concurrency, and batching envelope physically exercised. For the current limits and validation status, refer to [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm#use-n1x-express). N1x remains Deferred pending complete Express end-to-end validation. Related changes: [PR #10099](https://github.com/NVIDIA/NemoClaw/pull/10099), [PR #10721](https://github.com/NVIDIA/NemoClaw/pull/10721), and [PR #10625](https://github.com/NVIDIA/NemoClaw/pull/10625). ## August 31, 2026 ## v0.0.117 NemoClaw v0.0.117 makes OpenShell the sole durable network-policy authority. It improves fail-closed recovery for sandboxes, Shields, the installer, and messaging channels. It also removes the deprecated Brev deploy wrapper and adds contributor and maintainer analysis tools. * OpenShell is now the sole durable source of sandbox policy state. NemoClaw policy commands and Shields operate on the live OpenShell policy without storing a second desired-policy copy, while rebuild carries the current policy through one private, temporary handoff. Legacy policy fields are removed from NemoClaw state without changing the live policy. Related change: [PR #10515](https://github.com/NVIDIA/NemoClaw/pull/10515). * Failed onboarding cleanup now retains immutable sandbox, gateway, policy, and create-attempt evidence. While OpenShell still reports the sandbox live, `destroy` preserves recovery instead of deleting by mutable name. After OpenShell confirms absence, NemoClaw removes only containers that match the retained immutable identity and verifies their absence before clearing recovery state. Related change: [PR #10571](https://github.com/NVIDIA/NemoClaw/pull/10571). * The OpenClaw memory secret scanner now covers writes under absolute named-workspace paths such as `/sandbox/.openclaw/workspace-main/`. Project directories whose names start with `workspace-` remain outside the memory-path classification unless they are under the OpenClaw state directory. Related change: [PR #10527](https://github.com/NVIDIA/NemoClaw/pull/10527). * Hermes activation and Shields recovery now bind release acknowledgement, writer rescans, root-broker cleanup, and completed auto-restore lock retirement to exact process and transaction identities. Transient replaced writers are reconsidered under fresh identity, while live, foreign, durable, or ambiguous identity remains denied. Related changes: [PR #10272](https://github.com/NVIDIA/NemoClaw/pull/10272), [PR #10597](https://github.com/NVIDIA/NemoClaw/pull/10597), and [PR #10603](https://github.com/NVIDIA/NemoClaw/pull/10603). * macOS upgrades can retire an identity-verified legacy OpenShell gateway or Homebrew service before selecting the checksum-verified replacement binaries. Managed startup also transfers protected receipts through read-only Docker volumes, so VM-backed Docker daemons such as Colima do not need access to a client-only temporary path. Failed verification retains the recovery receipts, and successful finalization reports any exact volume that cleanup cannot remove. Related changes: [PR #10484](https://github.com/NVIDIA/NemoClaw/pull/10484) and [PR #10534](https://github.com/NVIDIA/NemoClaw/pull/10534). * Experimental OpenClaw WeChat setup now writes the exact revision-scoped OpenShell placeholder to the Tencent plugin account file and binds both authorized iLink endpoints to the channel provider. Channel removal clears durable account state before provider, policy, or registry teardown, and raw bot tokens remain outside sandbox files, process arguments, and diagnostics. Related change: [PR #10601](https://github.com/NVIDIA/NemoClaw/pull/10601). * The deprecated `nemoclaw deploy` Brev compatibility command has been removed. Remote hosts use their provisioning workflow, the hosted installer, and `nemoclaw onboard`; `deploy` is now available as a sandbox name. Related change: [PR #10576](https://github.com/NVIDIA/NemoClaw/pull/10576). * `nemoclaw logs` now labels OpenClaw gateway lines with `[gateway]` and keeps existing OpenShell source tags unchanged. Follow mode bounds incomplete-line memory, honors output backpressure, waits for accepted writes, and reports source failures. Related change: [PR #10342](https://github.com/NVIDIA/NemoClaw/pull/10342). * Contributors with a prepared checkout can run the checked-in PR Review Advisor specialists on committed and working-tree changes with `npm run review:local` before PR publication. The [local-run prerequisites](https://github.com/NVIDIA/NemoClaw/blob/main/tools/pr-review-advisor/README.md#local-run) name the required host tools, the `origin/main` trust base, and the credential boundary. Hosted specialist jobs publish completed analyses in their GitHub job summaries. Maintainer analysis now emits bounded slow-test evidence and Perfetto-compatible PR lifetime traces with revision, readiness, review-request, workflow, job, and step timelines. Related changes: [PR #10581](https://github.com/NVIDIA/NemoClaw/pull/10581), [PR #10604](https://github.com/NVIDIA/NemoClaw/pull/10604), [PR #10608](https://github.com/NVIDIA/NemoClaw/pull/10608), [PR #10611](https://github.com/NVIDIA/NemoClaw/pull/10611), [PR #10616](https://github.com/NVIDIA/NemoClaw/pull/10616), [PR #10617](https://github.com/NVIDIA/NemoClaw/pull/10617), and [PR #10623](https://github.com/NVIDIA/NemoClaw/pull/10623). * Development qualification now contains a provider-owned record and dormant executor for the OpenShell v0.0.24 and MXC v0.7.0-rc1 checkpoint on physical Windows. NemoClaw does not register or select MXC, expose Windows onboarding, activate this executor, or treat the checkpoint as an accepted stable distribution. Related changes: [PR #10591](https://github.com/NVIDIA/NemoClaw/pull/10591) and [PR #10596](https://github.com/NVIDIA/NemoClaw/pull/10596). ## August 28, 2026 ## v0.0.116 NemoClaw v0.0.116 improves compatible endpoint validation, sandbox lifecycle safety, managed images, Windows Subsystem for Linux onboarding, managed local inference, and experimental Hermes channel credentials. It also preserves recorded network-policy intent during sandbox reuse and rebuild. * OpenClaw compatible endpoint onboarding now validates `inference.local` from inside the sandbox even when no messaging channel is selected, and an unreachable route stops onboarding before final deployment verification. `inference set` can reuse a recorded loopback no-auth endpoint without replacing its provider, and reasoning-only responses receive one bounded larger-budget content attempt before failure. Related changes: [PR #10458](https://github.com/NVIDIA/NemoClaw/pull/10458), [PR #10531](https://github.com/NVIDIA/NemoClaw/pull/10531), and [PR #10540](https://github.com/NVIDIA/NemoClaw/pull/10540). * Uninstall now creates fresh snapshots for eligible registered sandboxes before deletion unless destroy-user-data is selected. It honors NEMOCLAW\_OPENSHELL\_GATEWAY\_STATE\_DIR and stops before cleanup when backup, lifecycle-lock, ownership, or registration checks fail. Related changes: [PR #10231](https://github.com/NVIDIA/NemoClaw/pull/10231), [PR #10550](https://github.com/NVIDIA/NemoClaw/pull/10550), and [PR #10562](https://github.com/NVIDIA/NemoClaw/pull/10562). * Sandbox creation and reuse now retain verified sandbox identity, policy, provider, credential, and lifecycle authority across retries and process restarts. Same-name replacements and authority drift stop mutation, while managed-image registration tolerates a transient non-`Ready` report only when durable sandbox identity still matches. Related changes: [PR #10510](https://github.com/NVIDIA/NemoClaw/pull/10510) and [PR #10512](https://github.com/NVIDIA/NemoClaw/pull/10512). * Sandbox destruction can recover an expired Shields auto-restore timer only when its process is gone or its recorded start identity no longer matches. Live or unverifiable timer ownership remains fail-closed, and destruction skips pre-delete hardening only after Docker proves the sandbox container is absent. Related change: [PR #10225](https://github.com/NVIDIA/NemoClaw/pull/10225). * OpenClaw images now install checksum-pinned libevent 2.1.13 on AMD64 and ARM64. Related changes: [PR #10532](https://github.com/NVIDIA/NemoClaw/pull/10532) and [PR #10526](https://github.com/NVIDIA/NemoClaw/pull/10526). * On WSL, public managed image pulls, generated image builds, GPU probes, and local inference probe pulls use a temporary credential-free Docker configuration when the default Docker Desktop credential helper is unavailable. Managed local inference now waits for disposable Podman probe identities to disappear after one removal command, and llama.cpp image-pull failures report a fixed layer, code, and exit status without exposing raw pull output. Related changes: [PR #10470](https://github.com/NVIDIA/NemoClaw/pull/10470), [PR #10554](https://github.com/NVIDIA/NemoClaw/pull/10554), and [PR #10561](https://github.com/NVIDIA/NemoClaw/pull/10561). * Re-onboarding or rebuilding an OpenClaw sandbox with a recorded Balanced or Open tier now keeps an already-applied `brave` preset when web search is disabled or switched to Tavily Search. Restricted and unknown tiers, unsupported agents, and custom preset ownership retain their existing fail-closed reconciliation behavior. Related change: [PR #10457](https://github.com/NVIDIA/NemoClaw/pull/10457). * For the experimental Hermes WeChat and Microsoft Teams channels, managed startup now maps revision-scoped OpenShell credential placeholders to the environment names Hermes reads. Only matching revision-scoped placeholders are copied. Raw or identityless runtime values are ignored, while malformed or channel-unbound aliases stop startup; both channels remain experimental. Related change: [PR #10563](https://github.com/NVIDIA/NemoClaw/pull/10563). ## v0.0.115 NemoClaw v0.0.115 strengthens sandbox lifecycle authority, managed messaging credentials, and installer recovery. It also improves managed local inference and adds bounded experimental planning for an externally managed OpenShell target. * Stock Docker-driver onboarding for OpenClaw, Hermes, and LangChain Deep Agents Code now requires the release's exact managed image. Registry or catalog failures stop before sandbox creation instead of falling back to a local stock-image build; explicit custom Dockerfiles remain separate. Existing and recreated sandboxes retain exact image, policy, route-reservation, and lifecycle authority checks. Related changes: [PR #10113](https://github.com/NVIDIA/NemoClaw/pull/10113), [PR #10320](https://github.com/NVIDIA/NemoClaw/pull/10320), [PR #10321](https://github.com/NVIDIA/NemoClaw/pull/10321), [PR #10322](https://github.com/NVIDIA/NemoClaw/pull/10322), [PR #10332](https://github.com/NVIDIA/NemoClaw/pull/10332), [PR #10396](https://github.com/NVIDIA/NemoClaw/pull/10396), and [PR #10422](https://github.com/NVIDIA/NemoClaw/pull/10422). * Messaging setup now binds revision-scoped credentials to canonical OpenShell providers before sandbox creation or rebuild. This restores runtime credential delivery for maintained Slack, Discord, Google Chat, and Telegram paths while preserving endpoint-specific policy matching and fail-closed provider ownership. Related changes: [PR #10170](https://github.com/NVIDIA/NemoClaw/pull/10170), [PR #10271](https://github.com/NVIDIA/NemoClaw/pull/10271), [PR #10273](https://github.com/NVIDIA/NemoClaw/pull/10273), [PR #10275](https://github.com/NVIDIA/NemoClaw/pull/10275), [PR #10277](https://github.com/NVIDIA/NemoClaw/pull/10277), [PR #10307](https://github.com/NVIDIA/NemoClaw/pull/10307), and [PR #10314](https://github.com/NVIDIA/NemoClaw/pull/10314). * The Hermes installer accepts `--defer-onboarding` or `NEMOCLAW_DEFER_ONBOARDING=1` only for NVIDIA-hosted inference when no supported credential and no sandbox exist. It installs NemoClaw and Hermes without creating a provider, sandbox, or completed onboarding state; any credential or existing sandbox keeps the normal validation and recovery path. Related change: [PR #10299](https://github.com/NVIDIA/NemoClaw/pull/10299). * The experimental managed llama.cpp path now offers NVIDIA Nemotron 3 Nano 30B-A3B on qualified DGX Spark Arm64 and Linux x86\_64 NVIDIA GPU hosts and recommends it during onboarding. Meta Muse Glimmer remains available on DGX Spark only by explicit selection, and existing Muse-owned installations are not migrated. Local NVIDIA NIM selection now enforces the documented usable-memory limit, including the DGX Spark unified-memory cap. Related changes: [PR #10122](https://github.com/NVIDIA/NemoClaw/pull/10122) and [PR #10292](https://github.com/NVIDIA/NemoClaw/pull/10292). * `nemoclaw upgrade-sandboxes --check` now exits nonzero when it reports actionable stale, unknown-version, backup-recovery, or missing-sandbox state. Sandbox destruction and stale-container cleanup have bounded waits and preserve registry or lifecycle authority when deletion cannot be confirmed. Managed Hermes uninstall also removes its exact owned state volume and stops before state retirement on Docker failure. Related changes: [PR #10128](https://github.com/NVIDIA/NemoClaw/pull/10128), [PR #10133](https://github.com/NVIDIA/NemoClaw/pull/10133), and [PR #10224](https://github.com/NVIDIA/NemoClaw/pull/10224). * The experimental direct blueprint runner can validate and sanitize a plan for an externally managed OpenShell target. Planning validates the HTTPS endpoint, workspace, expected release range, CA bundle, and authentication-file metadata without reading credential contents, connecting to the gateway, authenticating, or applying changes. Related change: [PR #10045](https://github.com/NVIDIA/NemoClaw/pull/10045). * Security and diagnostics now reject config reads through a symlinked config directory, redact URL userinfo credentials in debug bundles, bind sandbox mutations and cancellation recovery to durable exact identity, and classify incomplete onboarding without reporting success. Related changes: [PR #10041](https://github.com/NVIDIA/NemoClaw/pull/10041), [PR #10127](https://github.com/NVIDIA/NemoClaw/pull/10127), [PR #10146](https://github.com/NVIDIA/NemoClaw/pull/10146), and [PR #10396](https://github.com/NVIDIA/NemoClaw/pull/10396). ## August 23, 2026 ## v0.0.114 NemoClaw v0.0.114 adds deterministic read-only MCP tool calls for LangChain Deep Agents Code and per-stage launch-readiness probe timing. It strengthens destructive-operation warnings, session export cleanup, sealed configuration recovery, and installation verification. It also improves managed local inference, Hermes onboarding, image provenance, and release documentation automation. * Managed LangChain Deep Agents Code automation can invoke one uniquely registered, coherently read-only MCP tool with `dcode tools call-read-only TOOL --json` without model participation. The command accepts one bounded JSON object on standard input, rejects ambiguous or mutating tools, bounds execution and cleanup, redacts recognized credential-shaped output, and returns one versioned JSON envelope. For more information, refer to [Run LangChain Deep Agents Code](/user-guide/deepagents/manage-sandboxes/operate-sandboxes/run-deep-agents-code) and the [NemoClaw CLI Commands Reference](/user-guide/deepagents/reference/commands). Related change: [PR #9894](https://github.com/NVIDIA/NemoClaw/pull/9894). * `nemoclaw connect --probe-only`, `nemohermes connect --probe-only`, and `nemo-deepagents connect --probe-only` now report credential-free elapsed time for each readiness stage. The timing line identifies lifecycle and forwarding actions and names the failed stage when available without changing the command's readiness exit status. For more information, refer to [Deploy NemoClaw to a Headless Server](/user-guide/openclaw/deployment/deploy-to-headless-server) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). Related change: [PR #9865](https://github.com/NVIDIA/NemoClaw/pull/9865). * Sandbox destruction now warns before terminating active SSH sessions, including unattended runs that use `--yes` or `--force`. OpenClaw session tar export now reports a retained in-sandbox staging artifact and its manual removal command when cleanup fails, because the artifact can contain pasted secrets. Host-mount diagnostics report the actual failed directory condition, and pending OpenClaw scope upgrades identify the device-review path. For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) and [Understand Sandbox State](/user-guide/openclaw/manage-sandboxes/state-and-backups/understand-sandbox-state). Related changes: [PR #9782](https://github.com/NVIDIA/NemoClaw/pull/9782), [PR #9787](https://github.com/NVIDIA/NemoClaw/pull/9787), [PR #9853](https://github.com/NVIDIA/NemoClaw/pull/9853), and [PR #9858](https://github.com/NVIDIA/NemoClaw/pull/9858). * Snapshot restore now preserves sealed OpenClaw configuration, and rebuild verifies final OpenClaw configuration integrity before it reports success. Shields timer authority retires only after lifecycle gates complete. For more information, refer to [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots) and [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). Related changes: [PR #9231](https://github.com/NVIDIA/NemoClaw/pull/9231), [PR #9791](https://github.com/NVIDIA/NemoClaw/pull/9791), and [PR #9866](https://github.com/NVIDIA/NemoClaw/pull/9866). * Installation now fails closed when neither `sha256sum` nor `shasum` can verify the nvm installer before a required Node.js installation or upgrade. Hermes retries throttled source archive downloads. For more information, refer to [Prerequisites](/user-guide/openclaw/get-started/prerequisites) and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). Related changes: [PR #9776](https://github.com/NVIDIA/NemoClaw/pull/9776) and [PR #9822](https://github.com/NVIDIA/NemoClaw/pull/9822). * Managed vLLM onboarding restores DGX Station large-model selection and strengthens fixed-profile selection, running-server reuse, and resumed-session validation. Recovery now distinguishes bind refusals for Ollama, unauthenticated compatible endpoints, and backends whose type is unavailable. Protected loopback-route diagnostics also name the endpoint that the route fronts. For more information, refer to [Use vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), [Configure Inference Timeouts](/user-guide/openclaw/inference/manage-inference/configure-inference-timeouts), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). Related changes: [PR #9836](https://github.com/NVIDIA/NemoClaw/pull/9836), [PR #9843](https://github.com/NVIDIA/NemoClaw/pull/9843), [PR #9852](https://github.com/NVIDIA/NemoClaw/pull/9852), [PR #9868](https://github.com/NVIDIA/NemoClaw/pull/9868), and [PR #9906](https://github.com/NVIDIA/NemoClaw/pull/9906). * Managed llama.cpp images include the required patched dependencies, bind lifecycle receipts to published software bill of materials files, and isolate platform-specific receipt pulls. For more information, refer to [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server). Related changes: [PR #9821](https://github.com/NVIDIA/NemoClaw/pull/9821), [PR #9849](https://github.com/NVIDIA/NemoClaw/pull/9849), and [PR #9857](https://github.com/NVIDIA/NemoClaw/pull/9857). * The inference model-limit documentation now shows each agent only the settings it supports and states that Deep Agents Code has no equivalent model-limit operation. For more information, refer to [Configure Model Limits](/user-guide/deepagents/inference/manage-inference/configure-model-limits). Related changes: [PR #9785](https://github.com/NVIDIA/NemoClaw/pull/9785) and [PR #9867](https://github.com/NVIDIA/NemoClaw/pull/9867). * Pi remains unavailable to ordinary installations while its release candidate gains AMD64 and ARM64 image receipts, a protected Docker lifecycle qualification target, and candidate-scoped user documentation. The qualification covers public onboarding, interactive launch, headless structured tool use, rebuild, recovery, policy and credential boundaries, and destroy without adding Pi to the supported release cohort. For more information, refer to [Quickstart with Pi](/user-guide/pi/get-started/quickstart), [Run and Manage Pi](/user-guide/pi/manage-sandboxes/run-pi), and [Pi Support and Security](/user-guide/pi/reference/pi-support). * Ordinary Docker-driver onboarding for stock OpenClaw, Hermes, and LangChain Deep Agents Code requires the release's exact immutable managed-image digest for the host architecture. If registry or catalog availability prevents selection, onboarding stops before sandbox creation; invalid or inconsistent managed-image evidence also stops before creation. Explicit custom Dockerfiles retain their separate path. For more information, refer to the [NemoClaw Quickstart with OpenClaw](/user-guide/openclaw/get-started/quickstart) and [Architecture Details](/user-guide/openclaw/reference/architecture). Related changes: [PR #9323](https://github.com/NVIDIA/NemoClaw/pull/9323) and [PR #10113](https://github.com/NVIDIA/NemoClaw/pull/10113). * Managed single-host vLLM onboarding can select the host GPU by index or full NVIDIA GPU UUID with `--vllm-gpu-device`. The selection is independent of sandbox GPU access, controls Docker placement and GPU preflight checks, and persists across resume. For more information, refer to [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). Related change: [PR #10025](https://github.com/NVIDIA/NemoClaw/pull/10025). * Static messaging credentials now use validated endpointless OpenShell provider profiles across onboarding and channel lifecycle operations. Paused detailed channel status keeps its schema-version-1 `report` envelope, skips the live probe, and returns an informational success. Channel start defers credential-bound policy activation until rebuild attaches the required provider; stopped Hermes Discord retains only its validated static provider without starting the channel or recreating credentials. For more information, refer to [Manage Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/manage-messaging-channels) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). Related changes: [PR #9913](https://github.com/NVIDIA/NemoClaw/pull/9913), [PR #10021](https://github.com/NVIDIA/NemoClaw/pull/10021), [PR #10026](https://github.com/NVIDIA/NemoClaw/pull/10026), [PR #10047](https://github.com/NVIDIA/NemoClaw/pull/10047), and [PR #10052](https://github.com/NVIDIA/NemoClaw/pull/10052). * Deep Agents Code progressive disclosure now derives loaded MCP tools from the pinned executable catalog and rejects duplicate loaded implementations. Tools discovered after startup become searchable only after the runtime loads them. For more information, refer to [Configure Progressive Tool Disclosure](/user-guide/deepagents/configure-agents/progressive-tool-disclosure). Related change: [PR #10031](https://github.com/NVIDIA/NemoClaw/pull/10031). * The maintained `nemoclaw update` installer request and every redirect now require HTTPS. For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). Related change: [PR #9862](https://github.com/NVIDIA/NemoClaw/pull/9862). * Legacy GPU sandbox recovery now corroborates final replacement handoff with the transaction-owned full container ID instead of stale sandbox-name metadata. This prevents a healthy replacement from waiting through the full handoff deadline when legacy metadata differs. For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes). Related change: [PR #10053](https://github.com/NVIDIA/NemoClaw/pull/10053). ## August 20, 2026 ## v0.0.113 NemoClaw v0.0.113 improves sandbox and onboarding recovery across interactive connections, Hermes, policy changes, and local adapters. It adds experimental Hermes Google Chat support while keeping the service-account private key outside the sandbox. It also changes the Google Gemini default, strengthens managed image publication, and improves E2E diagnostics. * Interactive `connect` now releases the lifecycle lock before it waits for the shell, so other commands can use the same sandbox during the session. An explicit sandbox start tolerates a bounded initial OpenShell `Error` phase while the sandbox returns to `Ready`. Hermes onboarding probes the API port recorded for the sandbox, and onboarding bounds each sandbox readiness observation. Non-interactive inference validation failures exit nonzero and preserve the onboarding session when abort cleanup completes. Experimental NemoCUA now uses the standard lifecycle for terminal agents with an operator-prepared sandbox image. For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) and [Set Up an OpenAI-Compatible Endpoint](/user-guide/openclaw/inference/custom-endpoints/set-up-openai-compatible-endpoint). Related changes: [PR #9657](https://github.com/NVIDIA/NemoClaw/pull/9657), [PR #9755](https://github.com/NVIDIA/NemoClaw/pull/9755), [PR #9747](https://github.com/NVIDIA/NemoClaw/pull/9747), [PR #9758](https://github.com/NVIDIA/NemoClaw/pull/9758), [PR #9745](https://github.com/NVIDIA/NemoClaw/pull/9745), [PR #9715](https://github.com/NVIDIA/NemoClaw/pull/9715), [PR #9714](https://github.com/NVIDIA/NemoClaw/pull/9714), and [PR #9723](https://github.com/NVIDIA/NemoClaw/pull/9723). * Policy changes now preserve the authoritative OpenShell exit status and leave rejected or unconfirmed mutations out of NemoClaw state. Invalid interactive preset input now exits nonzero without applying a preset. The Hermes tool gateway broker refuses a healthy listener unless the recorded live process is the NemoClaw broker. Shields commands can recover expired timer state, and full uninstall stops verified NemoClaw-owned Bedrock Runtime adapters before it removes their lifecycle evidence. For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Troubleshooting](/user-guide/openclaw/reference/troubleshooting), and [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw). Related changes: [PR #9238](https://github.com/NVIDIA/NemoClaw/pull/9238), [PR #9751](https://github.com/NVIDIA/NemoClaw/pull/9751), [PR #9593](https://github.com/NVIDIA/NemoClaw/pull/9593), [PR #9749](https://github.com/NVIDIA/NemoClaw/pull/9749), and [PR #9576](https://github.com/NVIDIA/NemoClaw/pull/9576). * No-authentication OpenAI-compatible endpoint examples now bind the backend to loopback behind NemoClaw's token-protected proxy. For more information, refer to [Set Up an OpenAI-Compatible Endpoint](/user-guide/openclaw/inference/custom-endpoints/set-up-openai-compatible-endpoint). Related change: [PR #9759](https://github.com/NVIDIA/NemoClaw/pull/9759). * Linux Ollama service repair proves the systemd user, executable, and ELF interpreter before restart and limits automatic mode repair to the installer-owned executable. LangChain Deep Agents Code launch readiness accepts OpenRouter's HTTP 404 response for `/v1/models` only after an inference request for the recorded model succeeds. Fixed-profile vLLM installation accepts a model selector only when the serving catalog resolves it to the matching recipe. For more information, refer to [Use Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama), [Recover and Rebuild Sandboxes](/user-guide/deepagents/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and [Use vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm). Related changes: [PR #9735](https://github.com/NVIDIA/NemoClaw/pull/9735), [PR #9838](https://github.com/NVIDIA/NemoClaw/pull/9838), and [PR #9839](https://github.com/NVIDIA/NemoClaw/pull/9839). * Google Gemini onboarding now offers and defaults to `gemini-3.6-flash` while retaining manual model entry. Failed Bedrock Runtime adapter startup now removes its process and stale state. Managed MCP add operations republish the credential-free provider revision after delayed credential absence and require a fresh projected revision before commit. Regression evidence now requires exactly one credential refresh across concurrent add operations. Managed llama.cpp publication can create its GitHub Container Registry package during the first platform publish and validates the two-platform candidate against platform manifests. Managed Hermes images include and validate the frozen `agent-client-protocol` package required by the existing `hermes-acp` entry point, but this release does not add an Agent Client Protocol (ACP) session workflow. For more information, refer to [Use Google Gemini](/user-guide/openclaw/inference/hosted-inference/use-google-gemini) and [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers). Related changes: [PR #9640](https://github.com/NVIDIA/NemoClaw/pull/9640), [PR #9769](https://github.com/NVIDIA/NemoClaw/pull/9769), [PR #9771](https://github.com/NVIDIA/NemoClaw/pull/9771), [PR #9772](https://github.com/NVIDIA/NemoClaw/pull/9772), [PR #9794](https://github.com/NVIDIA/NemoClaw/pull/9794), [PR #9766](https://github.com/NVIDIA/NemoClaw/pull/9766), and [PR #9795](https://github.com/NVIDIA/NemoClaw/pull/9795). * Experimental Google Chat support now includes Hermes. Hermes pulls events from a configured Google Cloud Pub/Sub subscription and sends replies through the Google Chat API. OpenShell keeps the service-account private key outside the sandbox and replaces the in-sandbox credential placeholder at the approved request boundary. For more information, refer to [Manage Messaging Channels](/user-guide/hermes/manage-sandboxes/messaging-channels/manage-messaging-channels). Related change: [PR #9393](https://github.com/NVIDIA/NemoClaw/pull/9393). * E2E support now preserves final-handoff diagnostics, stops scheduling later inference-routing tests after the first failure, and shortens token-rotation coverage without removing its credential checks. It reports each Launchable provenance mismatch and retries one protected BuildKit transport failure only after the revision tag is confirmed absent. PR Review Advisor now reports all actionable submission validation errors together so its single repair attempt can address them. Related changes: [PR #9559](https://github.com/NVIDIA/NemoClaw/pull/9559), [PR #9713](https://github.com/NVIDIA/NemoClaw/pull/9713), [PR #9752](https://github.com/NVIDIA/NemoClaw/pull/9752), [PR #9757](https://github.com/NVIDIA/NemoClaw/pull/9757), [PR #9765](https://github.com/NVIDIA/NemoClaw/pull/9765), and [PR #9767](https://github.com/NVIDIA/NemoClaw/pull/9767). ## v0.0.112 NemoClaw v0.0.112 strengthens managed local inference across vLLM, llama.cpp, Ollama, and routed provider recovery. It improves sandbox lifecycle recovery, MCP credential republishing, messaging continuity, and Shields ownership cleanup. It also tightens release provenance, E2E qualification, contributor review automation, and dependency compatibility. * Managed vLLM now validates a running server against the requested serving profile, model, reasoning mode, and configured ports before reuse, and it can resume an interrupted installation without losing the selected provider state. The managed catalog owns the vLLM profiles, adds Linux AMD64 Muse and Lightning options, refreshes llama.cpp image pins, and removes the retired DeepSeek V4 Pro menu entry. Managed llama.cpp preserves authority across resume, authenticates its bridge, bounds DGX Spark request bodies, publishes its owned image, and attaches to servers that omit `/props` model aliases. For more information, refer to [Use vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm) and [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server). Related changes: [PR #9537](https://github.com/NVIDIA/NemoClaw/pull/9537), [PR #9545](https://github.com/NVIDIA/NemoClaw/pull/9545), [PR #9589](https://github.com/NVIDIA/NemoClaw/pull/9589), [PR #9626](https://github.com/NVIDIA/NemoClaw/pull/9626), [PR #9633](https://github.com/NVIDIA/NemoClaw/pull/9633), [PR #9636](https://github.com/NVIDIA/NemoClaw/pull/9636), [PR #9653](https://github.com/NVIDIA/NemoClaw/pull/9653), [PR #9655](https://github.com/NVIDIA/NemoClaw/pull/9655), [PR #9656](https://github.com/NVIDIA/NemoClaw/pull/9656), [PR #9660](https://github.com/NVIDIA/NemoClaw/pull/9660), [PR #9669](https://github.com/NVIDIA/NemoClaw/pull/9669), [PR #9670](https://github.com/NVIDIA/NemoClaw/pull/9670), [PR #9675](https://github.com/NVIDIA/NemoClaw/pull/9675), [PR #9695](https://github.com/NVIDIA/NemoClaw/pull/9695), [PR #9706](https://github.com/NVIDIA/NemoClaw/pull/9706), and [PR #9708](https://github.com/NVIDIA/NemoClaw/pull/9708). * Ollama validation now proves the requested model through the sandbox endpoint, bounds WSL host discovery, and avoids installing a Linux systemd override for Windows-host Ollama during resume. Onboarding requires a healthy Model Router endpoint before accepting it, settles OpenClaw pairing after route changes, preserves provider state after Docker recreation, and distinguishes upstream credential rejection from a broken sandbox route. The Ollama installer also validates downloads before execution. For more information, refer to [Use Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama), [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). Related changes: [PR #9483](https://github.com/NVIDIA/NemoClaw/pull/9483), [PR #9495](https://github.com/NVIDIA/NemoClaw/pull/9495), [PR #9632](https://github.com/NVIDIA/NemoClaw/pull/9632), [PR #9650](https://github.com/NVIDIA/NemoClaw/pull/9650), [PR #9672](https://github.com/NVIDIA/NemoClaw/pull/9672), [PR #9692](https://github.com/NVIDIA/NemoClaw/pull/9692), [PR #9697](https://github.com/NVIDIA/NemoClaw/pull/9697), [PR #9703](https://github.com/NVIDIA/NemoClaw/pull/9703), and [PR #9722](https://github.com/NVIDIA/NemoClaw/pull/9722). * Sandbox lifecycle operations preserve Docker authority across terminal sessions and recreate a gateway when its Docker network is missing. Onboarding reports progress during cold base-image pulls, honors credential retry navigation, diagnoses OpenShell deletion handoffs, validates retired gateway evidence, and migrates Hermes dashboard state before checking gateway health. Tunnel status resolves the default sandbox, launch aligns its forwarded ports, uninstall accepts the default OpenClaw session, and failed llama.cpp cleanup remains resumable. MCP credentials and provider reservations are republished after policy binding, while Shields recovery can reclaim a dead lifecycle owner without treating a reused process ID as authoritative. For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers), [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). Related changes: [PR #9240](https://github.com/NVIDIA/NemoClaw/pull/9240), [PR #9534](https://github.com/NVIDIA/NemoClaw/pull/9534), [PR #9578](https://github.com/NVIDIA/NemoClaw/pull/9578), [PR #9597](https://github.com/NVIDIA/NemoClaw/pull/9597), [PR #9607](https://github.com/NVIDIA/NemoClaw/pull/9607), [PR #9641](https://github.com/NVIDIA/NemoClaw/pull/9641), [PR #9647](https://github.com/NVIDIA/NemoClaw/pull/9647), [PR #9665](https://github.com/NVIDIA/NemoClaw/pull/9665), [PR #9666](https://github.com/NVIDIA/NemoClaw/pull/9666), [PR #9671](https://github.com/NVIDIA/NemoClaw/pull/9671), [PR #9678](https://github.com/NVIDIA/NemoClaw/pull/9678), [PR #9681](https://github.com/NVIDIA/NemoClaw/pull/9681), [PR #9712](https://github.com/NVIDIA/NemoClaw/pull/9712), [PR #9720](https://github.com/NVIDIA/NemoClaw/pull/9720), [PR #9721](https://github.com/NVIDIA/NemoClaw/pull/9721), [PR #9724](https://github.com/NVIDIA/NemoClaw/pull/9724), and [PR #9729](https://github.com/NVIDIA/NemoClaw/pull/9729). * Voice sessions now preserve conversation context across sequential turns, and reused messaging onboarding accepts the schema-owned Microsoft Teams webhook field without rejecting its managed plan. For more information, refer to [Manage Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/manage-messaging-channels). Related changes: [PR #9412](https://github.com/NVIDIA/NemoClaw/pull/9412) and [PR #9654](https://github.com/NVIDIA/NemoClaw/pull/9654). * PR Review Advisor now uses a two-turn atomic review, requires design blockers to reduce the proposed change, removes completed rollout compatibility, accepts a repaired same-turn submission, and reduces review protocol failures. Related changes: [PR #9590](https://github.com/NVIDIA/NemoClaw/pull/9590), [PR #9631](https://github.com/NVIDIA/NemoClaw/pull/9631), [PR #9645](https://github.com/NVIDIA/NemoClaw/pull/9645), [PR #9652](https://github.com/NVIDIA/NemoClaw/pull/9652), and [PR #9690](https://github.com/NVIDIA/NemoClaw/pull/9690). * Release automation now attests production-image requests with the immutable semver tag and full source commit, tolerates an initially empty tag history, and preserves commit-bound local registry authority during E2E runs. E2E support verifies cloud-check wiring, managed-inference catalog compilation, DCode model selection, supervised dashboard recovery, Windows path oracles, llama.cpp bridge cleanup, and fail-closed handling of unscripted onboarding prompts. Dependency maintenance updates OpenShell to `0.0.106`, LangChain Deep Agents Code to `0.1.55`, `actions/setup-go` to `7.0.0`, and the grouped CodeQL actions. Related changes: [PR #8620](https://github.com/NVIDIA/NemoClaw/pull/8620), [PR #9192](https://github.com/NVIDIA/NemoClaw/pull/9192), [PR #9493](https://github.com/NVIDIA/NemoClaw/pull/9493), [PR #9605](https://github.com/NVIDIA/NemoClaw/pull/9605), [PR #9663](https://github.com/NVIDIA/NemoClaw/pull/9663), [PR #9676](https://github.com/NVIDIA/NemoClaw/pull/9676), [PR #9677](https://github.com/NVIDIA/NemoClaw/pull/9677), [PR #9683](https://github.com/NVIDIA/NemoClaw/pull/9683), [PR #9684](https://github.com/NVIDIA/NemoClaw/pull/9684), [PR #9686](https://github.com/NVIDIA/NemoClaw/pull/9686), [PR #9688](https://github.com/NVIDIA/NemoClaw/pull/9688), [PR #9689](https://github.com/NVIDIA/NemoClaw/pull/9689), [PR #9691](https://github.com/NVIDIA/NemoClaw/pull/9691), [PR #9694](https://github.com/NVIDIA/NemoClaw/pull/9694), [PR #9699](https://github.com/NVIDIA/NemoClaw/pull/9699), [PR #9702](https://github.com/NVIDIA/NemoClaw/pull/9702), [PR #9704](https://github.com/NVIDIA/NemoClaw/pull/9704), [PR #9711](https://github.com/NVIDIA/NemoClaw/pull/9711), and [PR #9725](https://github.com/NVIDIA/NemoClaw/pull/9725). * Documentation catch-up aligns local inference, sandbox and MCP operations, troubleshooting, supported preset examples, contribution intake, and environment-variable guidance with the shipped behavior. Related changes: [PR #9543](https://github.com/NVIDIA/NemoClaw/pull/9543), [PR #9642](https://github.com/NVIDIA/NemoClaw/pull/9642), [PR #9664](https://github.com/NVIDIA/NemoClaw/pull/9664), [PR #9667](https://github.com/NVIDIA/NemoClaw/pull/9667), [PR #9674](https://github.com/NVIDIA/NemoClaw/pull/9674), [PR #9687](https://github.com/NVIDIA/NemoClaw/pull/9687), and [PR #9693](https://github.com/NVIDIA/NemoClaw/pull/9693). ## August 18, 2026 ## v0.0.111 It makes Shields recovery, sandbox rebuilds, provider routing, and messaging bootstrap more diagnosable and less likely to leave ambiguous state. It also improves headless and local-inference onboarding, managed gateway recovery, uninstall cleanup, and release qualification. * OpenClaw `connect` now reports a Shields auto-relock that occurs during the active terminal session, keeps the session open, and prints the host command to lower Shields again. `backup-all` recovers lockdown from its trusted policy snapshot and stops before processing another sandbox when it cannot restore the prior Shields state. Rebuild carries read-only host mounts into the recreate session and fails closed on an older journal that cannot prove the original host-mount identity. OpenClaw rebuild also verifies the final `openclaw.json` and `.config-hash` pair, restores Shields, and exits nonzero when it cannot confirm config integrity. Uninstall removes package-owned `nemoclaw`, `nemohermes`, and `nemo-deepagents` binaries and aliases installed under NVM, including binaries that point through a linked npm package, while preserving foreign entries and the linked package source. Managed MCP credential reservations now make `credentials add --from-existing` fail before gateway mutation; operators can provide explicit credential keys or remove the reserving MCP servers. For more information, refer to [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots), [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). Related changes: [PR #9508](https://github.com/NVIDIA/NemoClaw/pull/9508), [PR #9510](https://github.com/NVIDIA/NemoClaw/pull/9510), [PR #9471](https://github.com/NVIDIA/NemoClaw/pull/9471), [PR #9532](https://github.com/NVIDIA/NemoClaw/pull/9532), [PR #9502](https://github.com/NVIDIA/NemoClaw/pull/9502), and [PR #9546](https://github.com/NVIDIA/NemoClaw/pull/9546). * Headless onboarding now warns before image pulls when Docker Desktop's `desktop` credential store is selected from a session where the helper is unavailable, and provides an isolated `DOCKER_CONFIG` recovery path. Hermes Local Ollama validation distinguishes a daemon context setting from a model's native context cap and tells operators either to restart the daemon with the required value or select a larger model. Windows-host Ollama discovery validates the response body and rejects non-object model entries, provider validation rejects replies whose only message field is null, and incomplete or converging OpenShell routes receive bounded, actionable diagnostics. Deep Agents Code onboarding now accepts OpenRouter's native provider and model identity during fresh and resumed final validation instead of reporting false selection drift. NemoClaw reports an OpenClaw-only `NEMOCLAW_OPENCLAW_OTEL*` variable as unsupported for Hermes or Deep Agents Code instead of reporting a missing Dockerfile `ARG`. Station Express preserves the selected managed-vLLM provider state, onboarding traces record the flag that activated collection, and setup reports a dropped corporate CA import or a modified OpenShell migration instead of continuing with incomplete authority. For more information, refer to [Use Ollama](/user-guide/hermes/inference/local-inference/set-up-ollama), [Configure Model Limits](/user-guide/hermes/inference/manage-inference/configure-model-limits), and [Troubleshooting](/user-guide/hermes/reference/troubleshooting). Related changes: [PR #9459](https://github.com/NVIDIA/NemoClaw/pull/9459), [PR #9460](https://github.com/NVIDIA/NemoClaw/pull/9460), [PR #9482](https://github.com/NVIDIA/NemoClaw/pull/9482), [PR #9518](https://github.com/NVIDIA/NemoClaw/pull/9518), [PR #9488](https://github.com/NVIDIA/NemoClaw/pull/9488), [PR #9473](https://github.com/NVIDIA/NemoClaw/pull/9473), [PR #9481](https://github.com/NVIDIA/NemoClaw/pull/9481), [PR #9561](https://github.com/NVIDIA/NemoClaw/pull/9561), [PR #9507](https://github.com/NVIDIA/NemoClaw/pull/9507), [PR #9526](https://github.com/NVIDIA/NemoClaw/pull/9526), [PR #9516](https://github.com/NVIDIA/NemoClaw/pull/9516), [PR #9410](https://github.com/NVIDIA/NemoClaw/pull/9410), and [PR #9405](https://github.com/NVIDIA/NemoClaw/pull/9405). * Managed messaging bootstrap now completes Discord setup, accepts reviewed per-agent credential placeholder aliases and the WeChat account token placeholder, and preserves the selected managed agent identity when onboarding reuses an existing sandbox. The Open network-policy tier documentation also lists the experimental Microsoft Teams preset alongside the other messaging presets. For more information, refer to [Enable Channels During Onboarding](/user-guide/openclaw/manage-sandboxes/messaging-channels/enable-channels-during-onboarding) and [Network Policies Reference](/user-guide/openclaw/reference/network-policies). Related changes: [PR #9474](https://github.com/NVIDIA/NemoClaw/pull/9474), [PR #9477](https://github.com/NVIDIA/NemoClaw/pull/9477), [PR #9478](https://github.com/NVIDIA/NemoClaw/pull/9478), [PR #9479](https://github.com/NVIDIA/NemoClaw/pull/9479), and [PR #9504](https://github.com/NVIDIA/NemoClaw/pull/9504). * Managed sandbox recovery now waits through bounded gateway startup states, stops downstream connect or launch work after a direct recovery failure, and preserves sanitized diagnostics when rollback or replacement identity cannot be confirmed. Onboarding releases its temporary dashboard port reservation before the host forward starts, so the selected port remains available for that forward and later onboarding work. Hermes GPU fallback rollback can restore the shared-state directory's setgid mode after ownership changes. If restoration still fails, NemoClaw revalidates both container identities before removing only the transaction-owned replacement and leaving the original container stopped for cleanup. Identity drift stops rollback without container mutation. Docker replacement failures include the transaction-owned container identity, exit state, and a bounded redacted log tail, while the shared private-network boundary keeps inference and managed MCP target validation consistent. New migration snapshots now use the canonical directory name and matching manifest identity so the documented list, prune, and delete retention commands can manage them. Failed skill installation also removes its temporary SSH configuration, and NemoClaw recognizes the OpenShell `0.0.106` manifest contract used by the release. For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), [Custom Endpoint Security](/user-guide/openclaw/inference/custom-endpoints/custom-endpoint-security), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). Related changes: [PR #9449](https://github.com/NVIDIA/NemoClaw/pull/9449), [PR #9480](https://github.com/NVIDIA/NemoClaw/pull/9480), [PR #9475](https://github.com/NVIDIA/NemoClaw/pull/9475), [PR #9569](https://github.com/NVIDIA/NemoClaw/pull/9569), [PR #9512](https://github.com/NVIDIA/NemoClaw/pull/9512), [PR #9445](https://github.com/NVIDIA/NemoClaw/pull/9445), [PR #9432](https://github.com/NVIDIA/NemoClaw/pull/9432), [PR #9434](https://github.com/NVIDIA/NemoClaw/pull/9434), and [PR #9224](https://github.com/NVIDIA/NemoClaw/pull/9224). * Release and E2E automation now treats staging Launchable as advisory context, binds PR evidence to the shipped managed-image cohort, minimizes guard-chain evidence export, and aligns typed target titles and coverage inventory. Provider-reservation contract coverage now verifies that a failed credential gateway mutation removes its provisional provider, while contributor automation limits each author to five concurrent PRs. The contributor doctor accepts every Git boolean spelling that enables `commit.gpgsign` and continues to reject disabled, unset, or invalid values. The cumulative documentation catch-up records the changed recovery, inference, policy, and troubleshooting contracts. Related changes: [PR #9463](https://github.com/NVIDIA/NemoClaw/pull/9463), [PR #9469](https://github.com/NVIDIA/NemoClaw/pull/9469), [PR #9472](https://github.com/NVIDIA/NemoClaw/pull/9472), [PR #9484](https://github.com/NVIDIA/NemoClaw/pull/9484), [PR #9496](https://github.com/NVIDIA/NemoClaw/pull/9496), [PR #9498](https://github.com/NVIDIA/NemoClaw/pull/9498), [PR #9491](https://github.com/NVIDIA/NemoClaw/pull/9491), [PR #9514](https://github.com/NVIDIA/NemoClaw/pull/9514), [PR #9517](https://github.com/NVIDIA/NemoClaw/pull/9517), [PR #9536](https://github.com/NVIDIA/NemoClaw/pull/9536), [PR #9550](https://github.com/NVIDIA/NemoClaw/pull/9550), and [PR #9566](https://github.com/NVIDIA/NemoClaw/pull/9566). ## August 17, 2026 ## v0.0.110 NemoClaw v0.0.110 adds an Experimental managed llama.cpp profile for Meta Muse Glimmer 30B on one DGX Spark and requires native tool-use evidence from custom Anthropic-compatible endpoints. It also improves onboarding recovery, local inference diagnostics, messaging and policy cleanup, backup and uninstall safety, and release qualification. * Managed llama.cpp onboarding now recommends the compatible Meta Muse Glimmer 30B profile on one DGX Spark while retaining NVIDIA Nemotron as a lower-priority choice. Profile selection is deterministic, recipe selection remains available for automation, and typed recipe contracts constrain templates and reasoning settings. The Experimental managed vLLM Muse Glimmer profile now uses its qualified pinned runtime, and `onboard --profile` selects the provider required by the requested serving profile instead of falling through to the provider menu. Local inference setup also distinguishes a probe-image pull failure from a networking failure, reuses a positively identified Windows-host Ollama daemon under WSL mirrored networking, and completes a required Ollama upgrade before continuing. For more information, refer to [Set Up llama.cpp](/user-guide/openclaw/inference/local-inference/set-up-llama-cpp), [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), and [Use Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama). Related changes: [PR #8711](https://github.com/NVIDIA/NemoClaw/pull/8711), [PR #9099](https://github.com/NVIDIA/NemoClaw/pull/9099), [PR #9319](https://github.com/NVIDIA/NemoClaw/pull/9319), [PR #9311](https://github.com/NVIDIA/NemoClaw/pull/9311), [PR #9345](https://github.com/NVIDIA/NemoClaw/pull/9345), and [PR #9284](https://github.com/NVIDIA/NemoClaw/pull/9284). * Custom endpoint onboarding, `inference set`, and rebuild recovery now reject unsafe URL characters and unsupported URL components before network or state mutation. OpenClaw onboarding for a custom Anthropic-compatible endpoint requires a native streaming `tool_use` block and matching stop reason instead of accepting JSON-shaped assistant text. Google Gemini diagnostics distinguish a Chat Completions route `404` from native model-catalog validation, while sandbox status preserves the recorded API family when only the model drifts. Hermes route changes fail when the in-sandbox configuration cannot synchronize, and Model Router setup and teardown serialize lifecycle work across the current user's gateways so destroy cannot stop a replacement router or overwrite a concurrent onboarding session. For more information, refer to [Custom Endpoint Security](/user-guide/openclaw/inference/custom-endpoints/custom-endpoint-security), [Set Up an Anthropic-Compatible Endpoint](/user-guide/openclaw/inference/custom-endpoints/set-up-anthropic-compatible-endpoint), [Use Google Gemini](/user-guide/openclaw/inference/hosted-inference/use-google-gemini), [Verify the Inference Route](/user-guide/openclaw/inference/validate-inference/verify-inference-route), and [Set Up Model Router](/user-guide/openclaw/inference/hosted-inference/set-up-model-router). Related changes: [PR #9320](https://github.com/NVIDIA/NemoClaw/pull/9320), [PR #9119](https://github.com/NVIDIA/NemoClaw/pull/9119), [PR #9236](https://github.com/NVIDIA/NemoClaw/pull/9236), [PR #9347](https://github.com/NVIDIA/NemoClaw/pull/9347), [PR #9307](https://github.com/NVIDIA/NemoClaw/pull/9307), [PR #9233](https://github.com/NVIDIA/NemoClaw/pull/9233), [PR #9185](https://github.com/NVIDIA/NemoClaw/pull/9185), and [PR #9112](https://github.com/NVIDIA/NemoClaw/pull/9112). * Fresh OpenClaw and Hermes onboarding now waits for a durable sandbox ID and a successful no-op command after OpenShell reports `Ready`. Deployment verification also probes a separate agent API host forward before reporting the sandbox ready, and names the forward recovery command when that endpoint is unavailable. An explicit `--recreate-sandbox` request bypasses stale saved build or policy fingerprints, and managed OpenClaw registration records its validated agent identity for later rebuild and restore authority. Readiness observations now age from collection completion, so slow probes do not immediately invalidate their own results, and rebuild recovery can defer an unanswered route query to authoritative onboarding while still rejecting a confirmed route mismatch. Reused onboarding passes the selected messaging dependencies, session reporting recognizes proxied `connect` processes, and recovery can use probe-only convergence without failing solely because platform evidence is absent. Legacy gateway upgrades preserve a proven gateway identity and scope cleanup to the selected gateway, while sandbox destroy removes only an identity-bound Docker orphan and preserves recovery state on any mismatch. The deprecated global `nemoclaw start` command exits successfully with migration guidance instead of starting a tunnel, leaving sandbox startup to `nemoclaw start` and tunnel startup to `nemoclaw tunnel start`. For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting). Related changes: [PR #9229](https://github.com/NVIDIA/NemoClaw/pull/9229), [PR #9299](https://github.com/NVIDIA/NemoClaw/pull/9299), [PR #9318](https://github.com/NVIDIA/NemoClaw/pull/9318), [PR #9325](https://github.com/NVIDIA/NemoClaw/pull/9325), [PR #9352](https://github.com/NVIDIA/NemoClaw/pull/9352), [PR #9370](https://github.com/NVIDIA/NemoClaw/pull/9370), [PR #9366](https://github.com/NVIDIA/NemoClaw/pull/9366), [PR #9321](https://github.com/NVIDIA/NemoClaw/pull/9321), [PR #9285](https://github.com/NVIDIA/NemoClaw/pull/9285), [PR #9282](https://github.com/NVIDIA/NemoClaw/pull/9282), [PR #8920](https://github.com/NVIDIA/NemoClaw/pull/8920), [PR #9198](https://github.com/NVIDIA/NemoClaw/pull/9198), and [PR #9201](https://github.com/NVIDIA/NemoClaw/pull/9201). * Later onboarding runs now record when the host stops configuring a messaging channel, remove its stale egress preset, and preserve in-sandbox QR-paired channels whose state the host cannot determine. Managed startup validation accepts schema-owned messaging package pins and approved credential placeholder assignments while continuing to reject raw credentials, mismatched keys, and malformed or misplaced values. `policy remove` can remove a preset enforced by the live gateway even when the local registry lacks it, and reports an unavailable gateway separately from a gateway that does not hold the preset. Experimental Google Chat pairing approval becomes active for the next message after direct approval, with managed restart recovery when activation partially commits. For more information, refer to [Enable Channels During Onboarding](/user-guide/openclaw/manage-sandboxes/messaging-channels/enable-channels-during-onboarding), [Set Up Google Chat](/user-guide/openclaw/manage-sandboxes/messaging-channels/set-up-google-chat), and [Apply Policy Presets](/user-guide/openclaw/network-policy/configure-policies/apply-policy-presets). Related changes: [PR #9296](https://github.com/NVIDIA/NemoClaw/pull/9296), [PR #9327](https://github.com/NVIDIA/NemoClaw/pull/9327), [PR #9306](https://github.com/NVIDIA/NemoClaw/pull/9306), [PR #9248](https://github.com/NVIDIA/NemoClaw/pull/9248), and [PR #9374](https://github.com/NVIDIA/NemoClaw/pull/9374). * Snapshot backup now accepts multiply linked regular package files in a Hermes sandbox while continuing to reject unsafe symbolic links and special files. `uninstall --destroy-user-data` removes installer-managed user-local CLI shims when sibling evidence does not require the shared package. The experimental voice gateway reads startup credentials from fixed inherited file descriptors instead of accepting credential paths in process arguments, and Shields accepts only bounded native OpenClaw device-store modes while restoring mutable state. OpenClaw startup guard output now stays in a root-only child directory while the shared runtime directory remains traversable, preserving access to the root-owned managed CA bundle without exposing guard diagnostics to sandbox processes. For more information, refer to [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots), [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw), [Filesystem Controls](/user-guide/openclaw/security/security-controls/filesystem-controls), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands). Related changes: [PR #9317](https://github.com/NVIDIA/NemoClaw/pull/9317), [PR #9288](https://github.com/NVIDIA/NemoClaw/pull/9288), [PR #9239](https://github.com/NVIDIA/NemoClaw/pull/9239), [PR #9269](https://github.com/NVIDIA/NemoClaw/pull/9269), and [PR #9371](https://github.com/NVIDIA/NemoClaw/pull/9371). * Release qualification treats the trusted staging Launchable deployment as E2E context rather than required tag evidence and retains bounded, secret-safe readiness diagnostics and transient collaborator-permission retries. The E2E workflow reports same-commit first-pass and retry reliability, retries only transient reads of the trusted contract artifact, executes the credential-free native-runtime qualification matrix without enabling production Podman selection, and documents canonical target selection and retry rules. Post-merge documentation catch-up now runs after merges through separated author, reviewer, and publisher boundaries, while release prep continues to require the dated changelog entry on `main` before tag planning. Related changes: [PR #9351](https://github.com/NVIDIA/NemoClaw/pull/9351), [PR #9350](https://github.com/NVIDIA/NemoClaw/pull/9350), [PR #9353](https://github.com/NVIDIA/NemoClaw/pull/9353), [PR #9226](https://github.com/NVIDIA/NemoClaw/pull/9226), [PR #9237](https://github.com/NVIDIA/NemoClaw/pull/9237), [PR #9232](https://github.com/NVIDIA/NemoClaw/pull/9232), [PR #9275](https://github.com/NVIDIA/NemoClaw/pull/9275), [PR #9234](https://github.com/NVIDIA/NemoClaw/pull/9234), and [PR #9365](https://github.com/NVIDIA/NemoClaw/pull/9365). _Showing the 20 most recent of 83 entries. Append `/llms.txt` to the changelog URL for the complete index._