NemoClaw v0.0.96 is out!

[cv]

NemoClaw v0.0.96 gives operators tighter control over sandbox egress and custom inference. Baseline policy exclusions now survive rebuilds and snapshot restores, while DNS-backed HTTPS endpoints use host-pinned connections and route-scoped sandbox credentials.

The release also improves runtime recovery and diagnostics. Supported hosts can manage the default OpenShell gateway as a service, rebuilds can recover managed MCP state after sandbox exec loss, and opt-in MCP discovery lists advertised tool names without invoking them.

Image and release controls now verify more of the deployed boundary. OpenClaw uses one reviewed production lock, managed images share fixed package inventories, and exact-SHA E2E contracts reduce ambiguity in release evidence.

Network policy and inference boundaries

• #7194 adds policy exclude and policy restore for exact baseline entries. Reviewed exclusions persist across rebuilds and snapshot restores without allowing another policy source to reintroduce the excluded key.
• #6877 and #7531 make one shared network policy schema available at runtime. Installed packages now validate the same policy contract as source checkouts.
• #7581 permits the resolved npm-installed Claude Code launcher in its preset. OpenShell can enforce the real executable path without broader network access.
• #7188 routes DNS-backed HTTPS custom endpoints through a host-side pin adapter. Each sandbox route receives a separate credential while the upstream endpoint and secret remain host-only.
• #7427 permits keyless OpenAI-compatible endpoints on exact loopback hosts and reviewed ports. Local development no longer needs a placeholder credential.
• #7546 removes the internal provider marker from URL-form Node.js requests. Custom endpoints no longer receive routing metadata that belongs inside NemoClaw.
• #7238 validates blueprint sandbox names and provider identifiers before state writes or OpenShell calls. Rejections use bounded terminal-safe previews.

Gateway, onboarding, and recovery

• #7319 moves the default port 8080 gateway to a validated host service on supported Linux and Apple Silicon macOS hosts. Custom ports and declared external supervisors keep their existing ownership models.
• #7274 replaces fixed onboarding readiness polls with deadline-based waits, and #7528 omits TLS Server Name Indication for IP-literal health probes. Gateway startup now follows the selected endpoint type.
• #7349 scopes gateway failures to the sandbox's recorded gateway. #7406 reports incomplete lifecycle registration, and #7621 hides route-only reservations left by failed onboarding.
• #7196 lets an explicit forced rebuild recover managed MCP configuration after sandbox exec access is lost. #7559 rechecks the destructive delete target immediately before deletion.
• #7602 creates a missing OpenClaw sessions carveout when Shields locks state before first boot. #7421 returns a clean exit code when a Shields command fails.
• #7305 rejects an installed OpenShell executable that cannot report its version. #7480 reports the requested version tag, and #7471 explains near-miss license acceptance.
• #7353 rejects the macOS Podman compatibility socket before gateway launch. #7365 selects WSL-local Ollama when Docker Desktop integration is absent, and #7541 avoids unrelated vLLM process matches on DGX Station.
• #7295 prints the exact host command when a channel mutation is blocked. #7510 treats policy-picker EOF as cancellation, and #7565 prevents a config set EOF from writing a new key.

MCP, Hermes, and local inference

• #7591 adds mcp status <server> --tools. The bounded, authenticated diagnostic lists advertised tool names without invoking a tool or adding another policy path.
• #7208 stages the repository root when nemohermes onboard --from selects the managed Dockerfile. The build now receives every required source path.
• #7434 combines separate Hermes provider and model flags before forwarding them. #7604 preserves namespaced models during provider rewrites.
• #7482 adds model size, required VRAM, and available GPU memory to the Ollama menu. #7620 preserves the local proxy token during re-onboarding.
• #7466 reports when resumed onboarding keeps its recorded reasoning setting instead of NEMOCLAW_REASONING. Operators can now see which setting won.
• #7492 removes build-only Hermes caches and dependencies. The measured final image is 624,394,525 bytes smaller.

Backups, Shields, and managed images

• #7557 gives each eligible backup-all sandbox its own bounded Shields-down window and restores lockdown before the next sandbox. The batch stops when lockdown restoration fails.
• #7608 restarts a restored clone's gateway after one matching pairing approval. One authenticated verification now determines restore success.
• #7622 removes BuildKit-only bind mounts from managed Dockerfiles. Docker Engine gateway builds can finish when host-side BuildKit prebuilds are unavailable.
• #6830 makes one reviewed OpenClaw 2026.7.1 production lock authoritative for both image paths. Image assembly verifies lock bytes, registry integrity, installed packages, and lifecycle completion.
• #7563 installs checksum-bound fixed Vim, jq, Oniguruma, Expat, npm, and reviewed Perl components across managed base images. Each completed image records a root-owned package inventory.
• #7606 rejects an incompatible cached OpenClaw base image before the final build. Onboarding refreshes the exact release once, then uses a current local build if needed.
• #7585 creates missing writable OpenClaw peer links without weakening the locked state boundary. First boot can initialize its session state after Shields activation.

CI and release confidence

• #7496 binds pre-tag qualification to one exact candidate SHA. The release ledger now requires every default execution plus protected Brev qualification and cleanup evidence.
• #7505 runs approved E2E targets for fork PRs without exposing repository credentials. External contributions receive the same behavior checks within the reviewed trust boundary.
• #7530 retries one confirmed hosted-runner loss, and #7547 retries classified transient base-image pulls. Deterministic failures still remain terminal.
• #7562 retries transient required-gate reads after revalidating PR identity. #7594 and #7595 reconcile uncertain E2E dispatches through bounded inventory reads.
• #7575 retries only incomplete or timed-out npm audits. Complete vulnerability reports are evaluated immediately, and exhausted retries fail closed.
• #7508 reuses the reviewed Hermes production image. #7548, #7549, and #7537 add platform shards, pinned macOS OpenShell provisioning, and orchestration timeouts.
• #7254 protects empty-policy resume behavior, and #7396 protects retained Shields descriptors after hash repair. These regressions keep recovery state transitions explicit.

Thank you

Thank you to the external contributors whose work shipped in this release:

• @HOYALIM for the OpenClaw production lock and shared runtime policy schema in #6830, #6877, and #7531.
• @1PoPTRoN for blueprint identifier validation and terminal-safe rejection output in #7238.
• @scarab-systems for onboarding resume coverage and incomplete lifecycle diagnostics in #7254 and #7406.
• @kagura-agent for actionable channel mutation guidance and Hermes provider-model forwarding in #7295 and #7434.
• @andrewwhitecdw for gateway failure classification against each sandbox's owning gateway in #7349.
• @RUSHcitizen for Shields descriptor recovery coverage in #7396.
• @souvikDevloper for resumed reasoning-setting diagnostics in #7466.
• @harjothkhara for fail-closed EOF behavior in the policy picker and new-key confirmation in #7510 and #7565.
• @cdiddy77 for correct IP-literal gateway health probes in #7528.

See every merged change in the v0.0.95...v0.0.96 comparison.