Skip to content

docs: refresh release notes for v0.0.49#4078

Merged
cv merged 2 commits into
mainfrom
docs/v0.0.49-refresh
May 22, 2026
Merged

docs: refresh release notes for v0.0.49#4078
cv merged 2 commits into
mainfrom
docs/v0.0.49-refresh

Conversation

@miyoungc
Copy link
Copy Markdown
Contributor

@miyoungc miyoungc commented May 22, 2026

Summary

Refreshes the NemoClaw docs for the v0.0.49 hardening release, including release notes, command reference updates, troubleshooting guidance, version metadata, and regenerated user skills.

Changes

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Verification

  • npx prek run --all-files passes
  • npm test passes
  • Tests added or updated for new or changed behavior
  • No secrets, API keys, or credentials committed
  • Docs updated for user-facing behavior changes
  • make docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

`make docs` was attempted locally but did not complete because `npm` returned `403 Forbidden` while fetching `fern-api` from `registry.npmjs.org` in the sandboxed environment.


Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

  • Documentation

    • Released v0.0.49 with reliability and compatibility improvements including faster gateway failure diagnostics and safer snapshot restore behavior
    • Enhanced snapshot restore documentation with --to cloning and --force overwrite requirements
    • Expanded troubleshooting guides for source installs, GPU setup, and gateway recovery
    • Clarified Docker group access requirements and improved CLI command reference
  • Chores

    • Version bumped to 0.0.49

Review Change Stack

@miyoungc miyoungc added documentation Improvements or additions to documentation v0.0.49 Release target labels May 22, 2026
@miyoungc miyoungc self-assigned this May 22, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 22, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 03c68901-8c72-482e-9348-cb53b1799936

📥 Commits

Reviewing files that changed from the base of the PR and between 7a71ead and 398406b.

📒 Files selected for processing (4)
  • .agents/skills/nemoclaw-user-overview/references/release-notes.md
  • .agents/skills/nemoclaw-user-reference/references/commands.md
  • docs/about/release-notes.mdx
  • docs/reference/commands.mdx
✅ Files skipped from review due to trivial changes (4)
  • docs/about/release-notes.mdx
  • .agents/skills/nemoclaw-user-overview/references/release-notes.md
  • .agents/skills/nemoclaw-user-reference/references/commands.md
  • docs/reference/commands.mdx

📝 Walkthrough

Walkthrough

This PR updates NemoClaw documentation for v0.0.49: adds release notes and version metadata, changes deployment topology to a Docker-driver model, expands CLI docs (exec, snapshot restore --to, channels, logs/status), and improves setup/troubleshooting and messaging-channel/snapshot restore guidance.

Changes

v0.0.49 Release Documentation & Version

Layer / File(s) Summary
Release Notes & Version Bump
.agents/skills/nemoclaw-user-overview/references/release-notes.md, docs/about/release-notes.mdx, docs/project.json, docs/versions1.json
v0.0.49 release notes added in agent-skill and public docs; project/docs metadata bumped and versions1.json marked preferred.

Architecture & CLI Documentation

Layer / File(s) Summary
Docker-Driver Deployment Topology
.agents/skills/nemoclaw-user-reference/references/architecture.md
Deployment topology rewritten to show OpenShell gateway as a host process with sandbox as Docker container; Mermaid diagram and layer table updated.
CLI Commands: exec, snapshot restore, policy, channels
.agents/skills/nemoclaw-user-reference/references/commands.md, docs/reference/commands.mdx
Documented nemoclaw <name> exec; expanded snapshot restore with --to, --force, --yes and examples; sandbox-scoped policy preset tracking; channels add/remove usage and cleanup semantics.
CLI Selection Guide & logs/status semantics
.agents/skills/nemoclaw-user-reference/references/cli-selection-guide.md, docs/reference/commands.mdx
Clarified openshell logs vs NemoClaw logs semantics and updated examples; nemoclaw status docs now classify failing gateway layer and suggest recovery commands.

Setup, Prerequisites & Troubleshooting

Layer / File(s) Summary
Docker Group Access: Prerequisites & Security
.agents/skills/nemoclaw-user-get-started/references/prerequisites.md, .agents/skills/nemoclaw-user-reference/references/troubleshooting.md, docs/reference/troubleshooting.mdx
Added "Docker group access" guidance explaining docker group setup for sudo-less Docker and security implications with external reference.
Source-Checkout Installation Bootstrap
.agents/skills/nemoclaw-user-reference/references/troubleshooting.md, docs/reference/troubleshooting.mdx
Documented that source-checkout installs bootstrap OpenShell when missing and added remediation steps (re-run from repo root, verify ~/.local/bin on PATH).
Gateway Connectivity & Connection Troubleshooting
.agents/skills/nemoclaw-user-reference/references/troubleshooting.md, docs/reference/troubleshooting.mdx
Added troubleshooting for nemoclaw <name> connect early-exit when gateway is unreachable with recovery commands and nemoclaw status pointer.
GPU Validation & Jetson Compatibility
.agents/skills/nemoclaw-user-reference/references/troubleshooting.md, docs/reference/troubleshooting.mdx
Added GPU troubleshooting for placeholder GPU names on Windows/WSL; documents real NVIDIA GPU requirement for NIM/sandbox passthrough and Jetson guidance to rerun without --sandbox-gpu.
WSL Windows-Host Ollama Configuration
.agents/skills/nemoclaw-user-configure-inference/SKILL.md
Reformatted WSL Ollama guidance into clearer bullets: OLLAMA_HOST, relaunch/wait for HTTP endpoint, PowerShell ollama.exe detection, and single-instance port 11434 guidance.

Backup/Snapshot & Messaging Channel Operations

Layer / File(s) Summary
Snapshot Cloning: --to Destination & Overwrite Safety
.agents/skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md, docs/manage-sandboxes/backup-restore.mdx
Documented nemoclaw snapshot restore --to behavior to clone into a different sandbox name; default refusal to overwrite existing destination unless --force (and --yes) provided, with examples.
Messaging Channel Removal: Cleanup & Credential Sync
.agents/skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md
Expanded channels remove to document destructive QR-paired session cleanup (OpenClaw vs Hermes paths), exec-first/SSH-fallback cleanup transport, non-zero exit on unreachable sandbox, and WhatsApp/Baileys note about server-side linked-device persistence.

Estimated code review effort:
🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly Related PRs

  • NVIDIA/NemoClaw#4028: Overlapping deployment-topology change replacing embedded-k3s description with Docker-driver gateway-as-host-process model.
  • NVIDIA/NemoClaw#4011: Related Docker group access documentation and installer/preflight remediation adjustments.
  • NVIDIA/NemoClaw#4007: Adjacent edits to WSL Ollama detection and OLLAMA_HOST guidance.

Poem

🐰 A rabbit hops through docs so bright,

Bumping versions into night,
Docker tales and snapshots spun,
Gateway guides and logs all done,
v0.0.49—hop, delight!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change—refreshing documentation for the v0.0.49 release—which is the primary focus of the changeset across multiple documentation files and version metadata.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch docs/v0.0.49-refresh

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.


Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 22, 2026

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • None. No E2E is recommended because this PR is documentation and generated/reference skill-content only. Although the text discusses sensitive areas such as onboarding, Docker permissions, channels, snapshots, logs, and gateway topology, the diff does not change runtime code, installer logic, credentials handling, sandbox lifecycle implementation, network policy assets, inference routing, deployment code, or real assistant execution paths.

Optional E2E

  • None.

New E2E recommendations

  • None.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (3)
docs/about/release-notes.mdx (2)

19-20: ⚡ Quick win

Tone is drifting into marketing language (LLM pattern detected).

Phrases like “more stable,” “more resilient,” “more robust,” and “clearer” read as superlative/marketing claims; state concrete behavior without promotional qualifiers.

As per coding guidelines, "Superlatives and marketing language ('powerful,' 'robust,' 'seamless,' 'cutting-edge'). Say what it does, not how great it is."

Also applies to: 26-27

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/about/release-notes.mdx` around lines 19 - 20, Reword the two
release-note bullets to remove marketing superlatives and state concrete,
testable behavior: replace "Gateway upgrade and fallback paths are more stable"
with a description of what changed (e.g., which fallback coverage was hardened,
which checks were added or improved such as "hardened older gateway fallback
coverage, added OpenShell gateway upgrade checks, improved crash-loop detection
tests, and expanded Brev GPU bridge gateway traffic coverage"), and replace
"OpenClaw compatibility is more resilient" with specific compatibility changes
(e.g., "normalized Kimi mixed tool calls, tolerated OpenClaw JSON envelope
variations in tests, improved runtime dependency handling across filesystem
boundaries, and added classification for OpenClaw patch drift during image
builds"); use the exact phrases shown in the diff ("Gateway upgrade and fallback
paths are more stable" and "OpenClaw compatibility is more resilient") to locate
the bullets and substitute concrete behavior details without superlative
adjectives.

18-27: ⚡ Quick win

Split sentences onto separate source lines.

Line 18 through Line 27 place multiple sentences on single lines; the docs style requires one sentence per line for diff readability.

As per coding guidelines, "One sentence per line in source (makes diffs readable). Flag paragraphs where multiple sentences appear on the same line."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/about/release-notes.mdx` around lines 18 - 27, The release-notes bullet
lines contain multiple sentences per source line; edit the relevant bullet
paragraphs (e.g., the line starting "Gateway failures now fail faster..." and
subsequent lines in this block) so each sentence is on its own source line (one
sentence per line) to satisfy the "one sentence per line" docs style; split
sentences, keeping the existing order and punctuation, and ensure no new
semantic changes are introduced.
docs/manage-sandboxes/backup-restore.mdx (1)

59-59: ⚡ Quick win

End the sentence with a period, not a colon.

Line 59 is a sentence but ends with :. Use a period, then place the code block on the next line.

As per coding guidelines: “Every sentence must end with a period.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/backup-restore.mdx` at line 59, The sentence "If the
destination sandbox already exists, NemoClaw refuses to overwrite it unless you
pass `--force`:" should end with a period instead of a colon; change the
trailing ":" to "." and ensure the following code block begins on the next line
(i.e., terminate the sentence with a period and place the fenced code block
after a blank line or newline so the sentence and code block are separate).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/skills/nemoclaw-user-reference/references/commands.md:
- Around line 316-335: The README contains a duplicated "nemoclaw <name> exec"
section; remove the redundant copy and keep a single canonical block for the
command (including the usage, examples, explanatory paragraph about
HOME=/sandbox and behavior versus docker exec, and the flags table). Locate both
occurrences (one around the shown block and the other around the 419-434
region), delete the duplicate content, and ensure the remaining section
preserves the examples, the note about forwarding arguments after --, the
exit-code behavior, and the flags table (`--workdir`, `--tty/--no-tty`,
`--timeout`) so no information is lost.

In `@docs/project.json`:
- Line 1: Add an SPDX license header as the very first line of the JSON file to
satisfy the repo rule; open the file that contains the "name" and "version" keys
(the docs/project.json content shown) and prepend a comment-style SPDX string
(e.g. /* SPDX-License-Identifier: Apache-2.0 */) as the first line so the header
appears before the existing JSON object.

---

Nitpick comments:
In `@docs/about/release-notes.mdx`:
- Around line 19-20: Reword the two release-note bullets to remove marketing
superlatives and state concrete, testable behavior: replace "Gateway upgrade and
fallback paths are more stable" with a description of what changed (e.g., which
fallback coverage was hardened, which checks were added or improved such as
"hardened older gateway fallback coverage, added OpenShell gateway upgrade
checks, improved crash-loop detection tests, and expanded Brev GPU bridge
gateway traffic coverage"), and replace "OpenClaw compatibility is more
resilient" with specific compatibility changes (e.g., "normalized Kimi mixed
tool calls, tolerated OpenClaw JSON envelope variations in tests, improved
runtime dependency handling across filesystem boundaries, and added
classification for OpenClaw patch drift during image builds"); use the exact
phrases shown in the diff ("Gateway upgrade and fallback paths are more stable"
and "OpenClaw compatibility is more resilient") to locate the bullets and
substitute concrete behavior details without superlative adjectives.
- Around line 18-27: The release-notes bullet lines contain multiple sentences
per source line; edit the relevant bullet paragraphs (e.g., the line starting
"Gateway failures now fail faster..." and subsequent lines in this block) so
each sentence is on its own source line (one sentence per line) to satisfy the
"one sentence per line" docs style; split sentences, keeping the existing order
and punctuation, and ensure no new semantic changes are introduced.

In `@docs/manage-sandboxes/backup-restore.mdx`:
- Line 59: The sentence "If the destination sandbox already exists, NemoClaw
refuses to overwrite it unless you pass `--force`:" should end with a period
instead of a colon; change the trailing ":" to "." and ensure the following code
block begins on the next line (i.e., terminate the sentence with a period and
place the fenced code block after a blank line or newline so the sentence and
code block are separate).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 03bcc6b7-df17-4943-9dda-51aceeb93bf3

📥 Commits

Reviewing files that changed from the base of the PR and between e5540a2 and 7a71ead.

📒 Files selected for processing (15)
  • .agents/skills/nemoclaw-user-configure-inference/SKILL.md
  • .agents/skills/nemoclaw-user-get-started/references/prerequisites.md
  • .agents/skills/nemoclaw-user-manage-sandboxes/references/backup-restore.md
  • .agents/skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md
  • .agents/skills/nemoclaw-user-overview/references/release-notes.md
  • .agents/skills/nemoclaw-user-reference/references/architecture.md
  • .agents/skills/nemoclaw-user-reference/references/cli-selection-guide.md
  • .agents/skills/nemoclaw-user-reference/references/commands.md
  • .agents/skills/nemoclaw-user-reference/references/troubleshooting.md
  • docs/about/release-notes.mdx
  • docs/manage-sandboxes/backup-restore.mdx
  • docs/project.json
  • docs/reference/commands.mdx
  • docs/reference/troubleshooting.mdx
  • docs/versions1.json

Comment on lines +316 to +335
### `nemoclaw <name> exec`

Run a single command non-interactively in a running sandbox via the OpenShell exec endpoint.
The command runs as the sandbox user with `HOME=/sandbox`, so in-sandbox tooling resolves NemoClaw-provisioned config under `/sandbox/.openclaw` the same way it does for `connect` and `openshell sandbox connect`.
This is the supported substitute for `docker exec` on the sandbox container; raw `docker exec` runs as root and lands on `HOME=/root`, where the agent config is not present and `openclaw agent` falls back to its built-in defaults.

```console
$ nemoclaw my-assistant exec -- openclaw agent -m "What is 2+2?"
$ nemoclaw my-assistant exec --workdir /sandbox/workspace -- ls -la
```

Everything after `--` is forwarded verbatim to the sandbox command, including flags the inner command needs.
The exit code is the remote command's exit code.

| Flag | Description |
|------|-------------|
| `--workdir <dir>` | Working directory inside the sandbox |
| `--tty` / `--no-tty` | Allocate a pseudo-terminal; defaults to auto-detection (on when stdin and stdout are terminals) |
| `--timeout <seconds>` | Timeout in seconds (`0` means no timeout) |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Consolidate duplicated nemoclaw <name> exec sections.

The command is documented twice in the same page, which creates conflicting-maintenance risk and user confusion. Keep one canonical section and remove the duplicate.

Also applies to: 419-434

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.agents/skills/nemoclaw-user-reference/references/commands.md around lines
316 - 335, The README contains a duplicated "nemoclaw <name> exec" section;
remove the redundant copy and keep a single canonical block for the command
(including the usage, examples, explanatory paragraph about HOME=/sandbox and
behavior versus docker exec, and the flags table). Locate both occurrences (one
around the shown block and the other around the 419-434 region), delete the
duplicate content, and ensure the remaining section preserves the examples, the
note about forwarding arguments after --, the exit-code behavior, and the flags
table (`--workdir`, `--tty/--no-tty`, `--timeout`) so no information is lost.

Comment thread docs/project.json
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 22, 2026

PR Review Advisor

Recommendation: blocked
Confidence: high
Analyzed HEAD: 398406b85d5532a08587d2592315c42a73dfb702
Findings: 1 blocker(s), 3 warning(s), 0 suggestion(s)

This is an automated advisory review. A human maintainer must make the final merge decision.

Limitations: Review is based on provided trusted GitHub context and the supplied truncated diff; no scripts, tests, package-manager commands, or docs builds were executed by this advisor.; Line-specific validation is limited to visible diff excerpts and trusted review-thread metadata.; No linked issues were present in trusted metadata; acceptance mapping uses PR body clauses and trusted issue/review comments instead of linked issue bodies/comments.; PR-provided title/body/comments are treated as untrusted evidence and were not followed as instructions.

Workflow run

Full advisor summary

PR Review Advisor

Base: origin/main
Head: HEAD
Analyzed SHA: 398406b85d5532a08587d2592315c42a73dfb702
Recommendation: blocked
Confidence: high

Docs-only v0.0.49 refresh appears low runtime risk, but merge is blocked by GitHub merge state and an unresolved review thread; the generated command skill also still has duplicated exec documentation.

Gate status

  • CI: pass — 5 required status context(s) completed with no failures. Required contexts: checks, commit-lint, dco-check, check-hash, changes. Rollup also shows E2E recommendation, markdown-links, preview, CodeQL, ShellCheck, and unit-vitest-linux completed successfully for head SHA 398406b.
  • Mergeability: fail — mergeStateStatus=BLOCKED; reviewDecision=REVIEW_REQUIRED; REST mergeable_state=blocked for head SHA 398406b.
  • Review threads: fail — 1 unresolved review thread remains: CodeRabbit reports duplicated nemoclaw <name> exec sections in .agents/skills/nemoclaw-user-reference/references/commands.md around lines 316-335 and 419-434. The docs/project.json SPDX thread is resolved.
  • Risky code tested: fail — Risky areas detected (credentials/inference/network) with no test file changes. The E2E advisor says no E2E is required because the diff is documentation/generated skill content only.

🔴 Blockers

  • Repository merge gates are not clear: The PR is not currently merge-ready under repository state: GitHub reports mergeStateStatus=BLOCKED and reviewDecision=REVIEW_REQUIRED, and trusted context reports one unresolved review thread.
    • Recommendation: Wait for required human review/branch-protection requirements to clear, resolve the remaining review thread, and re-check mergeability for the same head SHA before merging.
    • Evidence: GraphQL: mergeStateStatus=BLOCKED, reviewDecision=REVIEW_REQUIRED, headRefOid=398406b85d5532a08587d2592315c42a73dfb702; reviewThreads shows one unresolved thread.

🟡 Warnings

🔵 Suggestions

  • None.

Acceptance coverage

Security review

  • pass — 1. Secrets and Credentials: No hardcoded real secrets, API keys, passwords, PEM files, credential JSON, or connection strings were introduced. Credential examples use placeholders such as <your-bot-token> and the docs warn not to log, share, or commit dashboard/gateway tokens.
  • pass — 2. Input Validation and Data Sanitization: No runtime input parsing, URL parsing, deserialization, shell execution, or sanitization code changed. The docs describe existing validation behavior for snapshot selectors, destination overwrite protection, channel arguments, sandbox-scoped policy metadata, unsafe symlink/hard-link rejection, and custom preset review.
  • pass — 3. Authentication and Authorization: No authentication or authorization implementation changed. Documentation continues to describe OpenShell credential injection and token handling without adding bypass paths; gateway/dashboard token warnings are explicit.
  • pass — 4. Dependencies and Third-Party Libraries: No package manifests, dependency pins, installer dependency resolution, or third-party registry configuration changed. docs/project.json and docs/versions1.json are docs metadata only.
  • pass — 5. Error Handling and Logging: No runtime logging/error handling code changed. Documentation improves user guidance for gateway failure classification, connect recovery, source installs, Docker group risk, and token handling.
  • pass — 6. Cryptography and Data Protection: No cryptographic operations changed. The docs mention SHA-256 credential hashes and backup/restore data handling only as descriptions of existing behavior.
  • pass — 7. Configuration and Security Headers: No runtime configuration, CORS/CSP, Dockerfiles, container images, workflow config, or security headers changed. The docs add a Docker group access warning that improves awareness of Docker daemon root-level impact.
  • warning — 8. Security Testing: The PR is docs/generated-skill-only and the E2E advisor says runtime E2E is not required, but the automated gate flags credentials/inference/network risky areas with no test file changes. Maintainers should confirm this is documentation-only synchronization of already-tested behavior.
  • pass — 9. Holistic Security Posture: No sandbox lifecycle, SSRF validation, network policy enforcement, workflow trusted-code boundary, installer trust, credential handling, blueprint verification, or runtime assistant execution paths changed. The docs generally strengthen posture by clarifying Docker group privilege, destructive snapshot restore opt-in, QR session cleanup, gateway-down recovery, and token warnings.

Test / E2E status

  • Test depth: unit_sufficient — Changes are limited to documentation, generated user-skill markdown, and docs metadata. CI required checks and doc preview/markdown validation passed for the head SHA. Runtime unit/E2E tests are not needed to prove behavior directly unless the documentation is introducing behavior not covered by the implementation PRs.
  • E2E Advisor: ok

✅ What looks good

  • Patch is limited to documentation, generated user-skill references, and docs metadata; no runtime TypeScript, installers, Dockerfiles, workflows, sandbox lifecycle, SSRF validation, credential-handling code, or policy assets changed.
  • Required status checks passed for head SHA 398406b, and the Fern preview job completed successfully with a preview URL.
  • Security-relevant documentation is improved: Docker group access risk, snapshot restore overwrite opt-in, QR-paired channel cleanup, token handling warnings, gateway-down recovery, and custom preset review are clearer.
  • E2E advisor found no required or optional E2E with high confidence for this docs-only/generated-content change.
  • The prior docs/project.json SPDX review thread is marked resolved in trusted GitHub context.

Review completeness

  • Review is based on provided trusted GitHub context and the supplied truncated diff; no scripts, tests, package-manager commands, or docs builds were executed by this advisor.
  • Line-specific validation is limited to visible diff excerpts and trusted review-thread metadata.
  • No linked issues were present in trusted metadata; acceptance mapping uses PR body clauses and trusted issue/review comments instead of linked issue bodies/comments.
  • PR-provided title/body/comments are treated as untrusted evidence and were not followed as instructions.
  • Human maintainer review required: yes

Audit found the v0.0.49 release notes promised behaviors that did not ship
or were never implemented. Realign to the actual code on main.

- Drop the EXDEV runtime-deps claim: #3820 was reverted by #4051 in this
  release window, so the behavior is not present.
- Drop the "skip broad permission repair" claim: no corresponding commit
  in v0.0.48..v0.0.49.
- Rewrite the gateway probe classifier list in release-notes.mdx and
  commands.mdx to match the real states emitted by
  src/lib/status-command-deps.ts (named gateway unreachable / present
  but not Connected / pointing at a different name / not configured).
  The previous "non-JSON health response" example did not exist in code.
- Expand the channel-removal bullet to describe #4001's user-visible
  teardown (durable QR-paired state wipe, abort-on-failure, config.json
  re-sync) in addition to the existing #4013 sync.
- Add bullets for user-visible PRs that were merged in the release
  window but missing from the notes: #3854 (restricted dmesg in debug
  output), #3866 (shields status and logs --tail UX), #3984 (Hermes
  messaging policy scoping), and #4011 (Docker group security note).

Regenerated nemoclaw-user-overview and nemoclaw-user-reference skills
from the updated docs via scripts/docs-to-skills.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@cv cv merged commit 756fbca into main May 22, 2026
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation v0.0.49 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants