## Release range

- Previous release: `v0.0.120` at `2444537f5a77c7b2789de4d59430e228328b8279`
- Candidate: `673f815e04c1a4ad0548fac63b5f25cf22d47e47`
- Candidate selection: current-main
- Commits: 76
- Risky files detected: 254

## QA context

### Risky areas

- Workflow / enforcement
- Sandbox / policy / SSRF
- Onboarding / host glue
- Credentials / inference
- Installer / bootstrap

### Suggested test focus

- Fresh install and upgrade paths
- Onboarding wizard and sandbox creation
- Policy enforcement, network egress, and SSRF protections
- CI checks, pre-commit hooks, and DCO declarations
- Credential storage and inference provider routing

## Canonical release entry

- Path: `docs/changelog/2026-09-08.mdx`
- Entry:

## v0.0.121

NemoClaw v0.0.121 adds managed MCP tool-denial rules and moves skill lifecycle to agent-owned state.
It also hardens messaging providers, Windows and WSL inference, sandbox recovery, file transfer, and Hermes state repair.

- Managed MCP servers can now deny exact tool names or glob patterns through repeatable `--deny-tool` options.
  The new `mcp update` command replaces the complete denied-tool list or clears it with `--clear-deny-tools`.
  Status, restart, rebuild, and launch-readiness checks use the persisted rules and report drift with a recovery command.
  Related change: [PR #11135](https://github.com/NVIDIA/NemoClaw/pull/11135).
  For more information, refer to [Add an MCP Server](/user-guide/openclaw/manage-sandboxes/mcp-servers/add-an-mcp-server), [Manage MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/manage-mcp-servers), and [Troubleshoot MCP Servers](/user-guide/openclaw/reference/troubleshoot-mcp-servers).
- Skill lifecycle state now belongs to the selected agent instead of a parallel NemoClaw inventory.
  `skill list` streams the agent's native result, while install and remove use native commands when the agent exposes an equivalent operation.
  Other operations use the manifest-declared writable skill directory without claiming that a same-name skill elsewhere is absent.
  Related change: [PR #11093](https://github.com/NVIDIA/NemoClaw/pull/11093).
  For more information, refer to [Understand Sandbox State](/user-guide/openclaw/manage-sandboxes/state-and-backups/understand-sandbox-state) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
- Messaging provider setup now uses typed OpenShell lifecycle results for registration, reuse, authorized replacement, attachment, refresh observation, and partial-failure recovery.
  Typed lifecycle results include credential names but never credential values, and channel removal omits placeholder credentials that were never configured.
  Channel stop and start now preserve credentials and runtime configuration through rebuild and stopped-sandbox restart.
  Related changes: [PR #11009](https://github.com/NVIDIA/NemoClaw/pull/11009), [PR #11126](https://github.com/NVIDIA/NemoClaw/pull/11126), [PR #11188](https://github.com/NVIDIA/NemoClaw/pull/11188), and [PR #11193](https://github.com/NVIDIA/NemoClaw/pull/11193).
  For more information, refer to [Manage Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/manage-messaging-channels) and [Credential Storage](/user-guide/openclaw/security/credential-storage).
- A CUDA-qualified WSL RTX Spark N1x with at least 30,000 MiB available now ranks an installed `qwen3.6:35b` before `qwen3.5:9b` for Ollama.
  Windows Ollama onboarding and restart keep traffic in Docker Desktop's verified network context and restore the previous User-scope binding and process state when a transaction fails.
  Recovery also reports bounded probe-timeout guidance instead of leaving the route failure ambiguous.
  Related changes: [PR #11187](https://github.com/NVIDIA/NemoClaw/pull/11187), [PR #10855](https://github.com/NVIDIA/NemoClaw/pull/10855), [PR #10889](https://github.com/NVIDIA/NemoClaw/pull/10889), and [PR #11192](https://github.com/NVIDIA/NemoClaw/pull/11192).
  For more information, refer to [Set Up Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama), [Prepare Windows](/user-guide/openclaw/get-started/additional-setup/windows-preparation), and [System Readiness](/user-guide/openclaw/reference/system-readiness).
- Inference provider creation, update, deletion, inspection, settlement, and rollback now use the typed OpenShell provider boundary.
  Mutations fail closed when ownership or revision identity is incomplete, and rollback verifies the provider revision before deletion.
  `inference get` reports a reusable endpoint for compatible custom providers only when persisted metadata is safe, complete, and unambiguous.
  Status distinguishes the configured model from the live routed model and requires verified llama.cpp routes.
  Related changes: [PR #11008](https://github.com/NVIDIA/NemoClaw/pull/11008), [PR #10833](https://github.com/NVIDIA/NemoClaw/pull/10833), [PR #10261](https://github.com/NVIDIA/NemoClaw/pull/10261), [PR #10471](https://github.com/NVIDIA/NemoClaw/pull/10471), and [PR #11207](https://github.com/NVIDIA/NemoClaw/pull/11207).
  For more information, refer to [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
- Sandbox download now rejects a directory that contains a symbolic link or another special file before transfer or host destination creation.
  Snapshot and rebuild recovery preserve fail-closed identity checks, recover an interrupted backup, and reject unsafe local fallback images.
  A retained sandbox is removed only after its gateway confirms absence and residual resources have sufficient identity evidence.
  Related changes: [PR #10654](https://github.com/NVIDIA/NemoClaw/pull/10654), [PR #11142](https://github.com/NVIDIA/NemoClaw/pull/11142), [PR #11094](https://github.com/NVIDIA/NemoClaw/pull/11094), and [PR #10867](https://github.com/NVIDIA/NemoClaw/pull/10867).
  For more information, refer to [Transfer State Manually](/user-guide/openclaw/manage-sandboxes/state-and-backups/transfer-state-manually), [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
- Hermes startup now repairs restored session, gateway, runtime, history, and log state through descriptor-verified paths before the gateway opens them.
  It rejects symbolic-link and file substitutions without changing their targets, and it keeps mutable runtime configuration outside relaunch policy.
  Hermes diagnostics also preserve invalid dashboard URL details and initialize the Kanban schema atomically.
  Related changes: [PR #10872](https://github.com/NVIDIA/NemoClaw/pull/10872), [PR #11110](https://github.com/NVIDIA/NemoClaw/pull/11110), [PR #11227](https://github.com/NVIDIA/NemoClaw/pull/11227), and [PR #11177](https://github.com/NVIDIA/NemoClaw/pull/11177).
  For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), [Gateway Lifecycle Control](/user-guide/hermes/manage-sandboxes/configure-sandboxes/understand-gateway-lifecycle-control), and [Troubleshooting](/user-guide/hermes/reference/troubleshooting).
- Onboarding now fails before sandbox mutation when a managed-image flow cannot honor a configured base-image override.
  GPU handoff resumes from validated checkpoints, managed vLLM avoids repeated retries after a rejected pinned image, and Gemini HTTP `400` failures include provider-specific recovery guidance.
  Related changes: [PR #11152](https://github.com/NVIDIA/NemoClaw/pull/11152), [PR #11124](https://github.com/NVIDIA/NemoClaw/pull/11124), [PR #11048](https://github.com/NVIDIA/NemoClaw/pull/11048), and [PR #11171](https://github.com/NVIDIA/NemoClaw/pull/11171).
  For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), and [Use Google Gemini](/user-guide/openclaw/inference/hosted-inference/use-google-gemini).

## Documentation coverage

- Latest included cumulative docs PR: [#11243](https://github.com/NVIDIA/NemoClaw/pull/11243), docs: prepare v0.0.121 documentation.
- Final PR commit and merge commit: `887fb83bcc477960bc82909a8b221c3342583dc1`; `673f815e04c1a4ad0548fac63b5f25cf22d47e47`.
- Final automated refresh coverage commit: `1b3cd3668c0530969de8a24e941587793a0ea7c4`; last parent of the verified workflow-authored final PR commit.
- Later commits and merged PRs: only `673f815e04c1a4ad0548fac63b5f25cf22d47e47`, the documentation PR #11243 merge itself. No later code commits in this candidate.
- Changed paths: allowed docs paths only: `docs/manage-sandboxes/manage-mcp-servers.mdx` (+1) and `docs/reference/commands.mdx` (+3).
- Review and checks: APPROVED; 27 successful and 23 skipped checks, none failed or pending. Local `npm run docs` passed with zero errors and five warnings. Independent documentation-writer review passed exact final PR commit; generated OpenClaw, Hermes and Deep Agents variants verified.
- Open managed docs PRs: None at inspection.
- Maintainer decision: Proceed with the candidate as shown.

## Base and managed image evidence

- Base-image candidate: `673f815e04c1a4ad0548fac63b5f25cf22d47e47`
- Evidence: [E2E run 34316389183](https://github.com/NVIDIA/NemoClaw/actions/runs/34316389183), attempt 1, push on main at candidate `673f815e04c1a4ad0548fac63b5f25cf22d47e47`, completed success; [base-image-publication job 102353398045](https://github.com/NVIDIA/NemoClaw/actions/runs/34316389183/job/102353398045) succeeded. No image rebuild was requested for this docs-only merge.

## General E2E decision

- Newest identifiable full manual main run: [34254574948](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948), attempt 2, completed FAILURE. Tested SHA `d10ba0e23d6b867aa0c23874f87263d5ada4ddfc`, not candidate `673f815e04c1a4ad0548fac63b5f25cf22d47e47`.
- Created `2026-09-08T17:01:18Z`; started `2026-09-08T17:06:56Z`; last updated `2026-09-08T17:42:03Z`. Age at inspection `2026-09-09T05:57:46Z`: 12h 56m 28s.
- Full-run non-success results (other jobs succeeded):
  - [package-openshell-sdk](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102158982988): completed/skipped; started 2026-09-08T17:07:07Z, completed 2026-09-08T17:01:20Z.
  - [openclaw-plugin-runtime-exdev](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159457497): completed/failure; started 2026-09-08T17:09:10Z, completed 2026-09-08T17:15:44Z.
  - [Hermes GPU startup (fallback, docker)](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159457888): completed/failure; started 2026-09-08T17:11:29Z, completed 2026-09-08T17:14:44Z.
  - [Compile protected llama.cpp DGX Spark plan](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159457965): completed/skipped; started 2026-09-08T17:08:32Z, completed 2026-09-08T17:08:32Z.
  - [jetson-nvmap-gpu](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159458180): completed/skipped; started 2026-09-08T17:08:32Z, completed 2026-09-08T17:08:32Z.
  - [native-runtime-qualification-producer-plan](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159458537): completed/skipped; started 2026-09-08T17:08:32Z, completed 2026-09-08T17:08:32Z.
  - [Exact staging Brev Launchable identity](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159458728): completed/skipped; started 2026-09-08T17:08:32Z, completed 2026-09-08T17:08:32Z.
  - [retired-selector-compatibility](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159459190): completed/skipped; started 2026-09-08T17:08:32Z, completed 2026-09-08T17:08:32Z.
  - [external-gateway-health](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159459196): completed/skipped; started 2026-09-08T17:08:32Z, completed 2026-09-08T17:08:32Z.
  - [Exact staging Brev Launchable](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159460910): completed/failure; started 2026-09-08T17:08:35Z, completed 2026-09-08T17:41:22Z.
  - [Gateway: recovers after process termination and remains stable (docker) / no provider credential](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159464330): completed/failure; started 2026-09-08T17:08:35Z, completed 2026-09-08T17:11:15Z.
  - [Protected llama.cpp on NVIDIA DGX Spark](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159465869): completed/skipped; started 2026-09-08T17:08:33Z, completed 2026-09-08T17:08:33Z.
  - [Build pinned native Podman toolchain / ${{ matrix.architecture }}](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159466766): completed/skipped; started 2026-09-08T17:08:34Z, completed 2026-09-08T17:08:33Z.
  - [matrix.jobName](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159475738): completed/skipped; started 2026-09-08T17:08:35Z, completed 2026-09-08T17:08:35Z.
  - [Aggregate native runtime qualification evidence](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102159492651): completed/skipped; started 2026-09-08T17:08:38Z, completed 2026-09-08T17:08:38Z.
  - [Protected managed-image GPU and local inference](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102167130950): completed/failure; started 2026-09-08T17:32:21Z, completed 2026-09-08T17:40:51Z.
  - [Release qualification](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102170619127): completed/failure; started 2026-09-08T17:41:25Z, completed 2026-09-08T17:41:33Z.
  - [Relevant E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/34254574948/job/102170620272): completed/skipped; started 2026-09-08T17:41:23Z, completed 2026-09-08T17:41:22Z.
- Current candidate [push E2E 34316389183](https://github.com/NVIDIA/NemoClaw/actions/runs/34316389183), attempt 1, completed SUCCESS on `673f815e04c1a4ad0548fac63b5f25cf22d47e47`. Created/started `2026-09-09T05:48:40Z`; last updated `2026-09-09T05:55:23Z`; age 9m 6s at inspection. Image verifier, Jetson job, matrix generation, scorecard and Relevant E2E succeeded. Other behavioral jobs and [Release qualification](https://github.com/NVIDIA/NemoClaw/actions/runs/34316389183/job/102354645993) were skipped. This is not a full-suite qualification.
- Maintainer E2E decision: Proceed with the status as shown.
- Maintainer reason: Team is actively working on getting E2Es to a full green state.
- Earlier requested candidate validation: [34287748823](https://github.com/NVIDIA/NemoClaw/actions/runs/34287748823), attempt 2, completed FAILURE on superseded candidate `bea9afb0f35ee6a72da672812716539974c7f68b`. Created `2026-09-08T22:48:57Z`, started `2026-09-08T23:31:51Z`, last updated `2026-09-08T23:53:42Z`; age 7h 8m 49s at the E2E decision inspection. Attempt 1 was cancelled; attempt 2 failed image prerequisites and skipped behavioral E2E. Not evidence for the final candidate.
- Earlier requested candidate validation: [34306361328](https://github.com/NVIDIA/NemoClaw/actions/runs/34306361328), attempt 2, completed FAILURE on superseded candidate `de7f565dd062b6f5affe12218ad825c97efee042`. Created `2026-09-09T03:14:37Z`, started `2026-09-09T04:15:13Z`, last updated `2026-09-09T04:16:42Z`; age 2h 43m 9s at the E2E decision inspection. Attempts 1 and 2 failed image prerequisites and skipped behavioral E2E. Attempt 2 still selected the failed push publisher because manual image publication is ineligible. Not evidence for the final candidate.
- Successful pre-docs candidate validation: [34312092947](https://github.com/NVIDIA/NemoClaw/actions/runs/34312092947), attempt 1, completed SUCCESS on `1b3cd3668c0530969de8a24e941587793a0ea7c4`. Created/started `2026-09-09T04:43:41Z`, last updated `2026-09-09T05:24:01Z`; age 1h 14m 5s at the E2E decision inspection. Required publication verification and selected E2E succeeded. The final candidate adds only the four reviewed documentation lines. This result is not represented as a full-suite pass.
- The later successful candidate publication checks resolve the image-evidence blocker; older failed attempts remain recorded and do not establish successful full-suite coverage. PR-controller runs for unrelated PRs are excluded from candidate behavioral evidence even when their workflow SHA equals a release ancestor.

Exceptions: Proceed without a successful full-suite result for candidate 673f815e04c1a4ad0548fac63b5f25cf22d47e47. The newest identifiable full run failed on an older commit; selected candidate E2E and required image verification passed. The maintainer accepts the displayed failed and superseded-run history because the team is actively working on getting E2Es to a full green state.