## Release range

- Previous release: `v0.0.134` at `8a5718dd14a2c2e440011488b1f3a32e9414cf82`
- Candidate: `7a099aeb4f6678d9b9ce6236535e7b41b03c81a2`
- Candidate selection: current-main
- Commits: 34
- Risky files detected: 182

## QA context

### Risky areas

- Workflow / enforcement
- Sandbox / policy / SSRF
- Credentials / inference
- Installer / bootstrap
- Onboarding / host glue

### Suggested test focus

- Fresh install and upgrade paths
- Onboarding wizard and sandbox creation
- Policy enforcement, network egress, and SSRF protections
- CI checks, pre-commit hooks, and DCO declarations
- Credential storage and inference provider routing

## Canonical release entry

- Path: `docs/changelog/2026-10-15.mdx`
- Entry:

## v0.0.135

NemoClaw v0.0.135 strengthens credential handling, sandbox recovery, and failure diagnostics.
It also updates managed inference and OpenClaw behavior for qualified local models.

- Hermes managed-tool gateways now use a dedicated OpenShell provider profile and an opaque broker token.
  NemoClaw verifies the profile and provider binding before creation or reuse.
  Related change: [PR #13102](https://github.com/NVIDIA/NemoClaw/pull/13102).
- Native NVIDIA Build routes reject noncanonical URLs that resolve to the NVIDIA endpoint.
  Deep Agents Code uses the scoped OpenRouter credential handle for native OpenRouter requests.
  Related changes: [PR #12925](https://github.com/NVIDIA/NemoClaw/pull/12925) and [PR #13055](https://github.com/NVIDIA/NemoClaw/pull/13055).
- During an OpenClaw rebuild, NemoClaw refreshes restored scoped credential references for native NVIDIA and OpenRouter routes when the endpoint and credential key match the current runtime binding.
  It leaves user-managed credentials unchanged.
  Related change: [PR #13050](https://github.com/NVIDIA/NemoClaw/pull/13050).
- Initial Deep Agents Code onboarding accepts `--dcode-auto-approval disabled|thread-opt-in` for managed images.
  `thread-opt-in` grants the capability without activating auto-approval; resume preserves explicit pending and registered choices, including a recorded revocation.
  Related change: [PR #13277](https://github.com/NVIDIA/NemoClaw/pull/13277).
- OpenClaw stores the attached provider's scoped credential reference in native configuration when switching NVIDIA Endpoints, OpenAI, Anthropic, Gemini, OpenRouter, or Hermes Provider routes.
  The reference does not expose the raw provider credential.
  Related change: [PR #13064](https://github.com/NVIDIA/NemoClaw/pull/13064).
- Fresh OpenClaw sandboxes using the accepted N1x Qwen managed-vLLM preview default to progressive tool disclosure.
  Explicit and recorded choices still take precedence.
  Related change: [PR #13173](https://github.com/NVIDIA/NemoClaw/pull/13173).
- New single-DGX-Station Express installs default to the experimental NVIDIA Nemotron 3.5 Super VL profile.
  Unattended OpenClaw onboarding enables image input for this registered multimodal model.
  Automatic Express selection uses distributed Ultra when a trusted reciprocal pair qualifies; explicit Ultra and DeepSeek choices remain available, and existing installations are not migrated.
  Related changes: [PR #13279](https://github.com/NVIDIA/NemoClaw/pull/13279) and [PR #13295](https://github.com/NVIDIA/NemoClaw/pull/13295).
- OpenClaw now applies named-agent list changes to a live gateway without restarting it.
  Google Chat remains an explicit reload-off exception.
  Related change: [PR #13271](https://github.com/NVIDIA/NemoClaw/pull/13271).
- Direct sandbox creation warns when an attached NemoClaw-owned provider profile cannot be confirmed unchanged.
  After Docker GPU reconnect, onboarding also requires OpenShell to report the sandbox as `Ready` or `Running`.
  Related changes: [PR #13189](https://github.com/NVIDIA/NemoClaw/pull/13189) and [PR #13123](https://github.com/NVIDIA/NemoClaw/pull/13123).
- Deep Agents Code backup scans database sidecars for credentials before publication.
  A detected credential or incomplete scan stops the backup.
  Related change: [PR #13190](https://github.com/NVIDIA/NemoClaw/pull/13190).
- On Linux, launch-readiness evidence accepts a current-user home with group-write permission.
  NemoClaw still keeps its state directories private and rejects a home writable by other users.
  Related change: [PR #13133](https://github.com/NVIDIA/NemoClaw/pull/13133).
- OpenClaw guidance treats a proxy `CONNECT` 403 as a refusal that may involve OpenShell policy.
  Operators can match the destination and time with sandbox logs before changing policy.
  Related change: [PR #13192](https://github.com/NVIDIA/NemoClaw/pull/13192).
- Managed llama.cpp sends each request through an owned native curl client.
  On cancellation, deadline expiry, or bridge shutdown, NemoClaw verifies that the remote request stops before it accepts another request.
  Related changes: [PR #13204](https://github.com/NVIDIA/NemoClaw/pull/13204) and [PR #12664](https://github.com/NVIDIA/NemoClaw/pull/12664).
- Managed image builds use a curl package revision compatible with the current Debian security libraries on AMD64 and ARM64.
  Related change: [PR #13158](https://github.com/NVIDIA/NemoClaw/pull/13158).
- If a pre-delete backup fails during OpenClaw recreation, the original sandbox remains registered, connectable, and selected.
  Backups also accept the exact generated NVIDIA inference credential reference without copying a raw key.
  Related change: [PR #13051](https://github.com/NVIDIA/NemoClaw/pull/13051).
- Sandbox log and failed exec policy checks announce when NemoClaw attempts to enable OpenShell OCSF audit logging.
  Set `NEMOCLAW_NO_AUTO_AUDIT_LOGS=1` to leave the setting unchanged.
  Related change: [PR #13199](https://github.com/NVIDIA/NemoClaw/pull/13199).
- Onboarding can print redacted output from a failed Docker sandbox container and save it as `sandbox-container.log` in the reported diagnostics directory.
  This requires NemoClaw to identify and inspect the container.
  Related change: [PR #13202](https://github.com/NVIDIA/NemoClaw/pull/13202).
- On native Linux with default Docker, an identity-free failed create can release its local name reservation after confirmed absence, even after a gateway restart.
  Eligible legacy records with lost authority require explicit `destroy --force` to discard local tracking; this does not prove cleanup on the original runtime.
  Related change: [PR #13170](https://github.com/NVIDIA/NemoClaw/pull/13170).

## Documentation coverage

- Latest included cumulative docs PR: [#13289](https://github.com/NVIDIA/NemoClaw/pull/13289), merged into the candidate.
- Final PR commit and merge commit: `38205c7abe5b55a34dbf2a08111cfc83b3daa57e`; `7a099aeb4f6678d9b9ce6236535e7b41b03c81a2`.
- Final automated refresh coverage commit: `b5efa876a775265b63ee963f0b363cc650bdd87e`.
- Later commits and merged PRs: `04967cce` [#13295](https://github.com/NVIDIA/NemoClaw/pull/13295) (single-Station Super VL default); `a5344846` [#13271](https://github.com/NVIDIA/NemoClaw/pull/13271) (live named-agent reload); `7a099aeb` [#13289](https://github.com/NVIDIA/NemoClaw/pull/13289) (cumulative docs and Station E2E metadata fix).
- Changed paths: 15 total; six outside `docs/**`, `fern/docs.yml`, or `fern/assets/**`: `.github/workflows/e2e.yaml`, `ci/platform-matrix.json`, `test/e2e/README.md`, `test/e2e/support/dgx-station-workflow-boundary.test.ts`, `test/generation/station-doc-ownership.test.ts`, `tools/e2e/dgx-station-workflow-boundary.mts`.
- Review and checks: `APPROVED`. All 12 CLI test shards and the pre-merge required checks passed. The exact-head [CI run](https://github.com/NVIDIA/NemoClaw/actions/runs/38850600792) then failed in `cli-tests` because the coverage upload returned HTTP 400 for the already merged PR branch; aggregate `checks` failed as a consequence. This is a post-merge coverage publishing failure, with no failing test shard. Two cancelled governance checks were superseded by successful checks, and documented skip cases were terminal. The Review Advisor had no final run for this head before the colleague merged the PR. Independent documentation review found no release blocker at head `38205c7abe5b55a34dbf2a08111cfc83b3daa57e`.
- Open managed docs PRs: None.
- Maintainer decision: Proceed with the candidate as shown.

## Base and managed image evidence

- Base-image candidate: `7a099aeb4f6678d9b9ce6236535e7b41b03c81a2`
- Evidence: The exact-candidate [`base-image-publication` job](https://github.com/NVIDIA/NemoClaw/actions/runs/38851744143/job/116814821951) succeeded at 2026-10-16T04:43:20Z in [E2E main push run 38851744143, attempt 1](https://github.com/NVIDIA/NemoClaw/actions/runs/38851744143). The job verified applicable GHCR base and complete managed-image publication, including the immutable Deep Agents Code base contract. The underlying [main image publication run 38843896442](https://github.com/NVIDIA/NemoClaw/actions/runs/38843896442) succeeded at the last image-input commit `a5344846775caac1dda43b03198327d11a4fd965`; the docs merge changed no image publication trigger path.

## General E2E decision

- Newest identifiable named full manual `main` run: [run 38819349760, attempt 1](https://github.com/NVIDIA/NemoClaw/actions/runs/38819349760), commit `d1c1843147ba40a7d67c1a48affbba7c899010d9`, created and started 2026-10-15T22:46:19Z, last updated 2026-10-16T00:28:58Z, completed with failure. It does not match the candidate.
- Newer manually dispatched [E2E main run 38847561786, attempt 1](https://github.com/NVIDIA/NemoClaw/actions/runs/38847561786), commit `a5344846775caac1dda43b03198327d11a4fd965`, created and started 2026-10-16T03:51:00Z, last updated 2026-10-16T04:18:01Z, was still in progress at the 2026-10-16T04:44:12Z inspection (age 53 minutes 12 seconds). It also does not match the candidate. Its `base-image-publication` job passed, and no further E2E result review was requested.
- Candidate [automatic E2E main push run 38851744143, attempt 1](https://github.com/NVIDIA/NemoClaw/actions/runs/38851744143) was queued after its required image verifier passed. General E2E jobs were not reviewed.
- Maintainer choice: Proceed with the displayed general E2E status. Rebecca expressly waived E2E result review for an early release; no additional focused or full E2E run was requested for this candidate.

Exceptions: The newest identifiable named full E2E result failed on an older commit, and the newer manual and candidate automatic E2E runs remain unresolved. At the maintainer’s direction, proceed early without waiting for or reviewing general E2E results; those runs do not establish a successful full result for this candidate.