NemoClaw v0.0.95 is out!

[senthilr-nv]

NemoClaw v0.0.95 makes sandbox lifecycle ownership explicit and strengthens recovery across gateways, forwards, snapshots, and local image rebuilds. These changes reduce unintended host mutations and keep sandbox state recoverable when services restart or connections drop.

Onboarding and inference paths now handle more real host configurations, including Windows Ollama, missing Docker CDI directories, OpenRouter connection deadlines, and Nemotron-3 request compatibility. OpenClaw, Hermes, and Deep Agents Code also gain targeted runtime, credential, and recovery fixes.

This release also tightens base-image provenance and package security while making release validation more trustworthy. Native multi-architecture image builds, complete security test suites, exact-SHA E2E evidence, and clearer runtime reporting improve confidence without weakening the checks that protect published images.

Gateway and sandbox lifecycle

• #7246 lets platforms declare whether NemoClaw or an external service owns the OpenShell gateway, which prevents stop, recovery, and uninstall operations from mutating an externally supervised gateway.
• #7228 removes the dashboard port forward when a sandbox stops, which prevents a stopped sandbox from leaving a stale listener.
• #7267 retries a forward listener that terminates during onboarding, which lets transient listener failures recover without restarting the workflow.
• #7169 treats a refused gateway status connection as stale, which lets onboarding repair an unreachable recorded gateway.
• #7509 retries a dropped OpenShell relay during managed recovery, which keeps sandbox recovery from failing on a transient relay disconnect.
• #7489 preserves managed gateway restart recovery for Hermes, which keeps its lifecycle behavior aligned with the managed gateway contract.
• #7351 excludes OpenShell-orphaned sibling sandboxes from uninstall cleanup, which keeps a selected uninstall from removing unrelated state.

State, restore, and sandbox content

• #7344 restores SQLite state through a staged atomic replacement, which prevents readers from observing a partially replaced database.
• #7290 lets strict backup-all skip stranded orphan sandboxes, which keeps valid sandbox backups from failing because of unrelated orphan records.
• #7416 verifies that nemoclaw <name> download wrote every requested host artifact, which prevents a missing download from being reported as successful.
• #7467 preserves openclaw.json when a legacy shields lock has no config hash, which prevents configuration loss during compatibility recovery.
• #7481 allows rebuilds to use a base image built and pinned during the current operation, which supports local rebuild workflows without accepting mutable image references.
• #7514 removes group and other write bits from staged Docker payloads, which restores canonical payload modes without removing required executable permissions.

Onboarding, inference, agents, and messaging

• #7476 reuses a reachable Windows-host Ollama service, which avoids starting a competing service when the configured endpoint already works.
• #7347 uses the standard CDI directories when Docker reports none, which keeps GPU onboarding compatible with hosts that omit the directory list.
• #7281 adds a connection-establishment deadline to OpenRouter forwarding, which bounds requests that cannot establish an outbound connection.
• #7485 omits the unsupported top-level thinking field for Nemotron-3 models, which keeps managed NVIDIA Build requests compatible.
• #7422 classifies non-interactive provider failures in managed Deep Agents Code, which gives headless workflows a stable failure result instead of ambiguous output.
• #7491 preserves configured retry limits in Deep Agents Code headless runs, which prevents managed execution from replacing the operator’s retry policy.
• #7447 accepts Langfuse credential placeholders for Hermes, which lets credential injection complete at runtime without rejecting the configuration early.
• #7303 permits the OpenClaw Discord bot to manage its own application commands, which enables command registration without granting unrelated Discord API access.

Images and security

• #6884 accepts only official immutable remote base-image digests or images pinned during the current operation, which prevents mutable overrides from entering sandbox builds.
• #6878 validates OpenClaw runtime version output, which prevents an unusable runtime from passing an installation check.
• #7502 updates bundled npm packages for reviewed security findings, which reduces known exposure in the published sandbox image.
• #7503 patches libexpat and jq vulnerabilities, which keeps the sandbox base packages aligned with the reviewed security baseline.
• #7504 updates the sandbox Perl runtime and requires the complete upstream suite, which validates the security update before packaging.
• #7518 runs independent Perl test scripts in parallel, which preserves full-suite coverage while reducing emulated build time.
• #7486 combines the final OpenClaw payload into fewer image layers, which reduces build and publication overhead while preserving ownership and modes.
• #7512 gives the base-image publisher enough time to complete its security suite, which prevents a valid build from being terminated before packaging.
• #7520 builds OpenClaw amd64 and arm64 images on native runners and publishes their manifest only after both digests pass, which removes the QEMU bottleneck and keeps publication atomic.
• #7370 adds maintainer-only NVD reconciliation tooling and a security post-mortem, which improves advisory review without changing supported user behavior.

E2E and release confidence

• #7464 provisions Hermes swap for direct main runs, which keeps release validation from depending on runner memory pressure.
• #7465 removes retry reservations after terminal results, which prevents stale reservations from blocking later E2E work.
• #7488 scopes risk signals to the selected tests, which keeps E2E reports focused on the dispatched surface.
• #7493 reports runner wait time separately from execution time, which distinguishes infrastructure queueing from test performance.
• #7494 records rolling nightly runtime history, which makes sustained E2E timing changes visible.
• #7497 selects the full E2E suite for root image changes, which ensures image-wide changes receive image-wide validation.
• #7501 prevents a skipped E2E gate from satisfying the merge requirement, which requires evidence from an executed run.

Documentation and release history

• #7495 completes documentation audit corrections, which keeps published guidance aligned with the supported release surface.
• #7513 adds the canonical v0.0.95 release entry, which records the shipped behavior and its owning documentation in the tagged source.

Thank you

Thank you to external contributor @HOYALIM for OpenClaw runtime-version validation in #6878 and trusted base-image override enforcement in #6884.

Thank you to external contributor @andrewwhitecdw for the Docker CDI directory fallback in #7347.

Thank you to external contributor @kagura-agent for managed Deep Agents Code provider-error classification in #7422.

Full comparison: v0.0.94...v0.0.95