docs: add v0.0.91 release changelog

[apurvvkumaria]

Summary

Add the canonical v0.0.91 changelog entry that was missed before the release tag was cut. Correct the custom-image compatibility guidance because the tagged code still accepts the legacy inference route selector instead of removing it in v0.0.91.

Changes

• Add docs/changelog/2026-07-22.mdx with the release summary and detailed security, rebuild, Hermes, DGX Station, and historical-validation changes from the published v0.0.91 announcement.
• Link shipped behavior to the most specific published OpenClaw and Hermes documentation routes.
• Correct the v0.0.90 changelog and command reference so they match the compatibility fallback present in the tagged v0.0.91 code without inventing a new removal version.
• Keep the immutable v0.0.91 release tag unchanged; this is the documented post-release recovery path.

Source summary:

• #7332, #7289, and #7294 -> docs/changelog/2026-07-22.mdx: Summarize completed-image node-tar remediation and current and historical container verification.
• #7213, #7363, #7366, and #7369 -> docs/changelog/2026-07-22.mdx: Summarize trusted base preparation, backup reuse, deletion convergence, and rebuild confidence.
• #7212 -> docs/changelog/2026-07-22.mdx: Summarize the Hermes API bearer-token lifecycle and supported retrieval command.
• #7327 and #7328 -> docs/changelog/2026-07-22.mdx: Summarize qualified DGX Station guidance and reproducible coding-agent installation instructions.
• #7355, #7360, #7362, and #7364 -> docs/changelog/2026-07-22.mdx: Summarize restored historical OpenClaw upgrade and Hermes rebuild validation.
• #7189 -> docs/changelog/2026-07-20.mdx, docs/reference/commands.mdx: Correct its forward-looking removal deadline after v0.0.91 shipped with the documented legacy fallback still present.
• #7282, #7306, and #7341 need no additional user-guide update because they already update their owned contributor or user-facing text directly.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: test/changelog-docs.test.ts validates dated changelog structure, SPDX syntax, version ordering, and published routes.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; this documentation-only PR does not change Station preparation or runtime behavior.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/changelog-docs.test.ts (6 passed).
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not run; this is a focused documentation-only change.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — completed with 0 errors and 2 existing site-wide warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only) — the native changelog entry uses the required parser-safe MDX SPDX comment and intentionally has no frontmatter.

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Documentation
  • Updated v0.0.91 guidance for custom Dockerfiles, including continued legacy compatibility and recommended migration to NEMOCLAW_INFERENCE_PROVIDER_ID.
  • Added release notes covering image security scanning, safer rebuild behavior, token management, DGX Station guidance, and deterministic release validation.
  • Clarified that existing custom images may continue using the legacy selector temporarily, with fallback removal planned for a future release.

[coderabbitai]

📝 Walkthrough

Walkthrough

Documentation updates revise custom image compatibility guidance and add a v0.0.91 changelog entry covering sandbox security, rebuild operations, Hermes token handling, DGX Station profiles, and deterministic validation.

Changes

Documentation updates

Layer / File(s)	Summary
Custom image compatibility guidance docs/changelog/2026-07-20.mdx, docs/reference/commands.mdx	Updates legacy provider selector fallback windows and instructs migration to NEMOCLAW_INFERENCE_PROVIDER_ID.
v0.0.91 release notes docs/changelog/2026-07-22.mdx	Adds release notes for sandbox image security, rebuild safety, Hermes token lifecycle guidance, DGX Station profiles, and deterministic validation.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: miyoungc

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change by adding the v0.0.91 release changelog.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/docs-v0.0.91-catch-up

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7376.docs.buildwithfern.com/nemoclaw

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/changelog/2026-07-20.mdx`:
- Line 11: Remove the v0.0.91 compatibility and removal-timing migration note
from the v0.0.90 changelog entry, preserving that entry as historical. Move the
guidance to the v0.0.91 changelog entry or the live commands reference.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6ae71e0a-1f77-492c-9b36-2c7cc733459e

📥 Commits

Reviewing files that changed from the base of the PR and between 6e70994 and 9f12096.

📒 Files selected for processing (3)

• docs/changelog/2026-07-20.mdx
• docs/changelog/2026-07-22.mdx
• docs/reference/commands.mdx

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== docs/changelog/2026-07-20.mdx ==\n'
sed -n '1,80p' docs/changelog/2026-07-20.mdx | cat -n

printf '\n== docs/changelog/2026-07-22.mdx ==\n'
sed -n '1,120p' docs/changelog/2026-07-22.mdx | cat -n

printf '\n== docs/reference/commands.mdx (matching lines) ==\n'
rg -n "NEMOCLAW_INFERENCE_PROVIDER_ID|legacy selector|compatibility fallback|v0\.0\.91" docs/reference/commands.mdx docs/changelog/2026-07-20.mdx docs/changelog/2026-07-22.mdx

Repository: NVIDIA/NemoClaw

Length of output: 12348

---

Keep the v0.0.90 entry historical.

Line 11 backdates v0.0.91 compatibility and removal timing into the v0.0.90 release note. Keep that migration note in the v0.0.91 changelog or the live commands reference instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/changelog/2026-07-20.mdx` at line 11, Remove the v0.0.91 compatibility
and removal-timing migration note from the v0.0.90 changelog entry, preserving
that entry as historical. Move the guidance to the v0.0.91 changelog entry or
the live commands reference.

Source: Learnings

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• docs-validation

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Approved after refreshing onto the current base and re-running the full exact-revision gate. The dated v0.0.91 changelog restores the required release documentation, the compatibility corrections match the shipped v0.0.91 behavior, contributor compliance passes, all current checks are green, and no unresolved correctness or security findings remain.