Skip to content

docs: clarify policy preview and Station package state#7331

Merged
miyoungc merged 1 commit into
mainfrom
codex/docs-policy-station-followups
Jul 21, 2026
Merged

docs: clarify policy preview and Station package state#7331
miyoungc merged 1 commit into
mainfrom
codex/docs-policy-station-followups

Conversation

@miyoungc

@miyoungc miyoungc commented Jul 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

This PR documents the full YAML-derived policy-add --dry-run disclosure near the preset preview workflow.
It also defines the generic Ubuntu package-state boundary for DGX Station preparation.
This post-release documentation follow-up does not change a dated changelog entry.

Changes

  • #7187 -> docs/network-policy/integration-policy-examples.mdx: Explain that the preview uses the exact preset YAML and discloses endpoint, HTTP rule, and binary scope.
  • #7241 -> docs/get-started/dgx-station-preparation.mdx: Document that NemoClaw accepts and quiesces an idle PackageKit daemon.
  • #7202 -> docs/get-started/dgx-station-preparation.mdx: Document the fail-closed package transaction, lock, package-state, and query boundary before mutation.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification: This PR changes prose only. Existing source tests own the documented behavior, and focused documentation guards pass.
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification:
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/changelog-docs.test.ts test/station-doc-ownership.test.ts test/policy-roundtrip-docs.test.ts: 3 files and 12 tests passed.
  • Applicable broad gate passed — Not applicable to this doc-only change.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only) — The build passed with 0 errors. Fern reported the existing light-mode accent contrast warning.
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

  • Documentation
    • Clarified Ubuntu preparation behavior when PackageKit, APT, or dpkg activity is detected, including conditions that stop preparation before changes are made.
    • Expanded network policy preview guidance to explain that output reflects the maintained preset configuration and includes hosts, ports, access rules, protocols, TLS and enforcement settings, HTTP methods and paths, and binary allowlists.

@miyoungc miyoungc added the area: docs Documentation, examples, guides, or docs build label Jul 21, 2026
@miyoungc miyoungc self-assigned this Jul 21, 2026
@copy-pr-bot

copy-pr-bot Bot commented Jul 21, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 66b9541d-bad8-4c55-ac1a-96e428fa76c9

📥 Commits

Reviewing files that changed from the base of the PR and between d3d5171 and b1df5a2.

📒 Files selected for processing (2)
  • docs/get-started/dgx-station-preparation.mdx
  • docs/network-policy/integration-policy-examples.mdx

📝 Walkthrough

Walkthrough

Documentation updates clarify DGX Station package-manager preparation checks and expand network-policy dry-run preview documentation.

Changes

DGX Station preparation

Layer / File(s) Summary
Package-manager preparation guidance
docs/get-started/dgx-station-preparation.mdx
Documents idle PackageKit quiescing and stop conditions for active transactions, APT/dpkg activity or locks, unhealthy package state, and failed state queries.

Network policy preview

Layer / File(s) Summary
Policy preview details
docs/network-policy/integration-policy-examples.mdx
Clarifies that dry-run output uses the exact preset YAML and lists hosts, ports, access, protocol, TLS/enforcement settings, HTTP methods and paths, and the binary allowlist.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

Suggested labels: area: docs, platform: dgx-station

Suggested reviewers: jyaunches, cv

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the docs-only changes: policy preview clarification and DGX Station package state handling.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/docs-policy-station-followups

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

2 optional E2E recommendations
  • docs-validation
  • network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@miyoungc miyoungc added the v0.0.91 Release target label Jul 21, 2026
@miyoungc
miyoungc marked this pull request as ready for review July 21, 2026 17:41

@senthilr-nv senthilr-nv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed against the merged PackageKit, package-state, and policy-scope implementations. The documentation accurately describes the fail-closed boundaries and exact preset-YAML preview behavior. No blocking findings.

@miyoungc
miyoungc merged commit acfa261 into main Jul 21, 2026
82 checks passed
@miyoungc
miyoungc deleted the codex/docs-policy-station-followups branch July 21, 2026 17:48
miyoungc added a commit that referenced this pull request Jul 22, 2026
<!-- markdownlint-disable MD041 -->
## Summary

The OpenClaw, Hermes, and Deep Agents Quickstarts now keep separate
source pages with consistent first-run platform ownership.
Each Quickstart retains immediate Docker, Windows, DGX Station, Express,
and model choices while linking durable details to their canonical
owners.
The refactor preserves published Quickstart routes, navigation,
supported workflows, and Commands and Troubleshooting content.

## Changes

- Condense duplicated Docker and platform prose in all three Quickstarts
into concise first-run summaries and canonical links.
- Keep Docker installation behavior in Prerequisites, Windows
preparation in its focused setup page, Station qualification and
preparation in the Station page, managed model and headless workflows in
Set Up vLLM, and validation status in Platform Support.
- Preserve Hermes-specific remote dashboard and API setup, including
`CHAT_UI_URL`, port forwarding, and API bearer-token retrieval.
- Make each Quickstart installer command set the sandbox name used by
its subsequent status, dashboard, and connect commands.
- Preserve the complete headless Station workflow and render the correct
OpenClaw, Hermes, and Deep Agents selection.
- Keep existing routes, navigation entries, and redirects unchanged
while generating agent-variant content from the canonical source pages.
- Incorporate merged PR #7331, including its PackageKit boundary,
without duplicating its integration-policy change.
- Incorporate merged PR #7327 while keeping Platform Support as the
canonical Station validation-status owner.
- Incorporate merged PR #7285 while keeping its existing-vLLM ownership
handoff in the canonical Station preparation page.

## Product Scope

Verdict: In scope.
The diff reorganizes existing Quickstart, Station, and vLLM
documentation and updates its ownership test.
It does not add an integration, solution recipe, custom image,
third-party stack, or supported product surface.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [x] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## DGX Station Hardware Evidence

<!-- Required only when scripts/prepare-dgx-station-host.sh changes.
Maintainers must review the linked evidence before approving or merging.
This is human-reviewed evidence, not authenticated hardware provenance.
Exceptional bypasses use existing repository governance and must be
documented on the PR. -->
- [ ] Tested on DGX Station
- Tested commit: Not applicable; `scripts/prepare-dgx-station-host.sh`
is unchanged in the PR diff.
- Station profile/scenario: Documentation ownership refactor only.
- Result: Not applicable.
- Supporting evidence: Not applicable.

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable —
canonical-base diff-aware hook stages passed against `upstream/main`.
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/station-doc-ownership.test.ts
test/check-docs-published-routes.test.ts test/check-docs-links.test.ts`
(3 files, 44 tests passed).
- [ ] Applicable broad gate passed — Not applicable; this is a focused
documentation ownership refactor with targeted tests and the full docs
build.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — passed
with 0 errors and 2 Fern warnings.
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)
— Not applicable; no pages were added.

Additional validation:

- `npm run docs:sync-agent-variants`
- `npm run docs`
- `npm run source-shape:check`
- `git diff --check upstream/main...HEAD`
- Generated OpenClaw, Hermes, and Deep Agents Set Up vLLM variants
contain the expected agent selection and no residual `<AgentOnly>`
directives.
- Repository-required documentation writer agent review found no content
loss, inaccurate claim, route or anchor drift, or agent-variant
regression. This was not a human review.
- Automated nine-category security review found no security issue in the
documentation and ownership-test diff. This was not a sensitive-path or
human security review.

Adjacent pre-existing debt, intentionally outside this refactor:

- The standalone Station override command and the generic installer
command printed by Windows preparation omit `NEMOCLAW_AGENT`, so users
following those commands directly must return to the agent-specific
Quickstart to preserve Hermes or Deep Agents selection.

---
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

---------

Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>
prekshivyas added a commit that referenced this pull request Jul 24, 2026
<!-- markdownlint-disable MD041 -->
## Summary

This change documents the approved DGX Station OTA metadata fallback in
the canonical Station preparation guide.
It states the public hardware boundary as recognized GB300 hardware
while keeping exact PCI identifiers and the accepted-variant count as
implementation details.

## Changes

- [#7223](#7223) ->
`docs/get-started/dgx-station-preparation.mdx`: Document that
qualification uses the latest reviewed `DGX_OTA_VERSION`;
`DGX_OTA_PRETTY_NAME` must equal `DGX OS` when present; and marker-less
OTA hosts require `DGX_PRETTY_NAME=NVIDIA DGX GB300WS`.
- Preserve the safe, root-owned release-file gate and `DGX_PLATFORM=DGX
Server for GALAXY-GB300` requirement.
- Describe the public PCI qualification boundary only as recognized
GB300 hardware, without publishing identifiers or an accepted-variant
count.
- Extend `test/station-doc-ownership.test.ts` to protect canonical
ownership, the fallback wording, the public hardware term, and
identifier exclusion.
- Leave Quickstart, Platform Support, and provider-selection summaries
unchanged because their canonical links and summary-level statements
remain accurate.
- Rebase on merged PackageKit documentation PR #7331. The unpublished
Quickstart deduplication work touches the ownership test nearby, so
whichever branch lands second may need a mechanical rebase without a
semantic wording dependency.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `docs-updated`
- Evidence: At PR SHA `8cf7b91`, the focused integration test passed 1
file and 4 tests. `npm run docs` passed with the route checker OK, 0
errors, and 2 existing Fern warnings. `npm run check:diff` passed. The
exact-head review found no documentation issues: the OTA marker and
fallback wording matches the implementation, the force override is
limited to recognized GB300 hardware, and the ownership test excludes
raw device IDs.
- Agent: Codex Desktop
<!-- docs-review-head-sha: 8cf7b91 -->
<!-- docs-review-agents-blob-sha:
9c9b36d -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit: Not applicable.
- Station profile/scenario: Documentation-only clarification of merged
behavior.
- Result: No host behavior changed.
- Supporting evidence: Merged PR #7223 and the current Station
classifier and hardware-detection tests.

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/station-doc-ownership.test.ts test/changelog-docs.test.ts`: 2 files
and 10 tests passed.
- [ ] Applicable broad gate passed — Not run; focused documentation
tests and the docs build cover this change.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — The
build passed with 0 errors. Fern reported the existing light-mode accent
contrast warning.
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Refined DGX Station qualification guidance for GB300 systems,
including how OTA hosts qualify using the latest OTA version and
accepted version ranges.
* Clarified `DGX_OTA_PRETTY_NAME` expectations (including when it may be
omitted after OTA upgrades) and strengthened `DGX_PRETTY_NAME`
requirements when `DGX_OTA_PRETTY_NAME` is absent.
* Tightened the warning for `--force-station-install` to specify it
should only be used when automatic Station detection rejects recognized
GB300 `/etc/dgx-release` metadata.

* **Tests**
* Enhanced documentation ownership checks to validate OTA/GB300-specific
text and key qualification requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: docs Documentation, examples, guides, or docs build v0.0.91 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants