NemoClaw v0.0.130 is out!

[rsliter]

NemoClaw v0.0.130

NemoClaw v0.0.130 makes sandbox creation and recovery more predictable. You can onboard OpenClaw or Hermes from a publisher-managed image by immutable digest, and NemoClaw now preserves that image identity through rebuild, resume, and snapshot workflows.

This release also strengthens inference and hardware support. It adds bounded profiles for more DGX and Windows-on-Arm systems, clarifies OpenClaw configuration ownership, improves Hermes recovery, and makes messaging and network-policy failures easier to diagnose safely.

Operational work rounds out the release. Install, uninstall, download, gateway recovery, documentation, skills, and CI now provide stronger evidence and safer failure handling across Docker, Podman, WSL, and managed-image workflows.

Images, sandboxes, and recovery

• #12301 adds nemoclaw onboard --from-image <repository>@sha256:<digest> for publisher-managed OpenClaw and Hermes images. NemoClaw validates the image contract before sandbox creation and preserves the recorded digest through resume, rebuild, and snapshot clone.
• #12305 and #11293 let rebuild preserve declared state from eligible stopped Docker sandboxes in Phase: Error. Deep Agents Code also carries supported managed MCP entries through the bounded recovery handoff.
• #12250 waits for SSH readiness before backing up a stopped sandbox that backup-all or rebuild starts. NemoClaw reserves time to return the sandbox to Stopped and stops before replacement when verification fails.
• #11389 isolates interrupted rebuild state by sandbox. A rebuild for one sandbox no longer consumes another sandbox's recovery transaction.
• #11528 removes an eligible NemoClaw-managed vLLM container after the final registered consumer is destroyed. Use --keep-vllm or NEMOCLAW_KEEP_VLLM=1 when you want to retain it.
• #10478, #12299, #10774, and #12308 make uninstall safer. Unrelated containers remain intact, custom gateway state directories are respected, and managed-gateway cleanup requires two verified empty inventories before removing downstream state.
• #12355 reports labeled Docker containers when connect or start cannot find the expected managed container. Operators can resolve each listed owner before retrying.
• #12393 preserves Pi's sanitized native settings.json through rebuild and snapshot restore while continuing to exclude per-path trust decisions.

Inference, hardware, and runtimes

• #12553 qualifies an installed qwen3.6:35b model on eligible Station GB300 Windows-on-Arm WSL hosts when every bounded CUDA and capacity check passes.
• #12407 recognizes the normalized NVIDIA RTX Spark N1X (5120-core Blackwell RTX GPU) identity under the existing WSL, CUDA, Docker Desktop, and capacity requirements.
• #12502 adds a smaller managed Qwen vLLM profile for DGX Spark systems with 60 GB to less than 64 GB of detected unified memory. It also returns success for replay-unsafe OpenClaw tool turns only when independent completion fields corroborate the final reply.
• #12421 applies the selected OpenShell inference route through native OpenClaw configuration for new custom-Dockerfile sandboxes.
• #12120 returns ownership of /sandbox/.openclaw/openclaw.json to OpenClaw after first launch. Rebuild and restore preserve a credential-sanitized copy without reconciling unrelated OpenShell state.
• #12237 clears NVIDIA credential aliases and only the matching generated legacy profile when a managed OpenClaw route changes to inference.local.
• #12336 removes stale route-specific context-window values when a different OpenClaw route has no replacement evidence. Same-route retries preserve the current value.
• #12339 treats a persistent ordinary 404 from /v1/models as a route failure instead of a verified deployment.
• #12295 lets onboarding reclaim a foreign pending route reservation for an already published sandbox when the selected gateway authority matches.
• #12507 updates managed OpenClaw images to OpenClaw 2026.9.2. Rebuild an existing sandbox after updating NemoClaw to use the new runtime.
• #12555 aligns managed Hermes images with the published multi-architecture base that contains the verified OpenSSL security package.
• #12333 gives Hermes one native configuration for its gateway, CLI, TUI, and Web Dashboard. Startup migrates safe state from retired dashboard homes and stops without deletion when paths or files conflict.
• #12343 lets Hermes wait through its restart-rate cooldown and restart its gateway automatically. The Bedrock Runtime adapter now lists models only after a successful inference request.
• #12267 preserves the current-user runtime context during native rootless Podman gateway recovery and allows reuse of a trusted managed service after ownership reconciliation.
• #12294 passes the selected runtime-provider authority into WSL readiness checks, so a Podman-selected installation does not require Docker.
• #12296 preserves a recognized legacy single-Station workload during DGX Station Express upgrade when automatic peer discovery cannot qualify a trusted pair.

Security, messaging, and network policy

• #12197 and #12354 make OpenClaw approval results fail closed. Administrative scope requires explicit approval and successful gateway confirmation before the CLI reports success.
• #12332 removes the automatic device-list probe after nemoclaw <sandbox> exec -- .... When a command reports pending approval, use its native request ID in a prepared connect shell.
• #12292 verifies official registry provenance for managed OpenClaw messaging plugins before runtime checks and keeps WeChat on its compatible runtime.
• #10393 accepts formatted Google Chat service-account JSON with LF or CRLF line breaks in GOOGLECHAT_SERVICE_ACCOUNT. Interactive entry still requires one-line JSON.
• #10860 detects missing, malformed, mismatched, identityless, or non-OpenShell Telegram runtime credentials without exposing credential values.
• #12181 routes running-sandbox messaging cleanup through native OpenShell execution and stops before rebuild after failed or inconclusive cleanup. The same change refreshes supervisor trust through a native stop and start after corporate CA import.
• #10487 adds the brew-balanced policy preset. It restricts raw.githubusercontent.com to GET and HEAD for Homebrew binaries without silently changing existing brew selections.
• #10781 reports public DNS pin drift for MCP endpoints and adds an explicit --refresh-public-pins update path that rejects private and special-use answers.
• #12348 uses a responding Docker authority for CoreDNS repair and checks XDG_RUNTIME_DIR during rootless Podman discovery. This ships the Docker-authority correction originally contributed by @harjothkhara in #10793.
• #12312 translates Landlock strict to v1alpha1 hard_requirement during configuration export, preserving fail-closed enforcement.

CLI, installation, and operator diagnostics

• #11621 keeps dashboard forwarding loopback-bound unless remote binding is explicit while preserving the recorded browser-facing CHAT_UI_URL in dashboard, list, and status output.
• #12391 accepts relative sandbox download paths that begin with - when the standard outer -- separator is present. This ships the path normalization originally contributed by @100milliongold in #11388.
• #12374 bounds stalled OpenShell release downloads with a connection timeout, retry policy, and low-speed limit. This replays and extends the installer fix originally contributed by @harjothkhara in #11354.
• #10465 reports the recorded lock owner during onboarding contention and directs operators to retry normal acquisition after that owner exits.
• #10541 and #10629 normalize trusted gateway service paths during in-place upgrade and wait for ordinary write pairing before closing prepared legacy recovery.
• #10851 adds bounded Linux launch-readiness diagnostics for unsafe authority paths, ownership, permissions, and repair guidance without exposing receipt contents or environment values.
• #12320 makes the experimental direct blueprint runner report an unreadable run directory instead of treating it as missing during reconcile or rollback.
• #12361 preserves exit status 130 when onboarding is interrupted during agent selection and suppresses the raw prompt error.

Skills, documentation, and release confidence

• #12483 verifies staged and installed Deep Agents Code skill copies before publication and reports a reproducible content digest after placement.
• #10937 documents the required baseline network-policy entry fields and adds copyable examples for OpenClaw, Hermes, and Deep Agents Code.
• #12477 fixes the single-session installer example so NEMOCLAW_SINGLE_SESSION reaches the shell that runs the installer.
• #11542 corrects the historical v0.0.82 and v0.0.83 release notes to match their shipped vLLM storage preflight behavior.
• #12508 moves deferred OpenShell diagnostics into typed adapters, reducing ambiguity across failure and cleanup paths without changing the supported interface.
• #12554, #12486, and #12487 improve release confidence by isolating Docker across WSL phases, adding the Portable Hermes GPU selector, and resolving custom-route managed-image receipts.
• #12548 requires assertion audits during E2E triage so test changes retain behavior-level evidence.

Thank you

Thank you to @Dreamstick9 for the network-policy documentation in #10937, @ericcurtin for the installer example correction in #12477, and @helasaoudi for the historical release-note correction in #11542.

Thank you to @harjothkhara for the original Docker-authority and bounded-download contributions in #10793 and #11354, which shipped through #12348 and #12374. Thank you to @100milliongold for the original leading-hyphen path fix in #11388, which shipped through #12391.