## Release range
- Previous release: `v0.0.109` at `d027b770d7130685d020964c4811211baf3d5f31`
- Candidate: `9ab3cd3a569e6d01aef26dee876461d281aef06a`
- Commits: 180
- Risky files detected: 518
## QA context
### Risky areas
- Workflow / enforcement
- Sandbox / policy / SSRF
- Credentials / inference
- Installer / bootstrap
- Onboarding / host glue
### Suggested test focus
- Fresh install and upgrade paths
- Onboarding wizard and sandbox creation
- Policy enforcement, network egress, and SSRF protections
- CI checks, pre-commit hooks, and DCO declarations
- Credential storage and inference provider routing
## Canonical release entry
- Path: `docs/changelog/2026-08-17.mdx`
- Entry:
## v0.0.110
NemoClaw v0.0.110 adds an Experimental managed llama.cpp profile for Meta Muse Glimmer 30B on one DGX Spark and requires native tool-use evidence from custom Anthropic-compatible endpoints.
It strengthens the explicit experimental Portable OpenClaw path with rootless Podman lifecycle authority, CPU-delegation preflight, and receipt-bound uninstall.
It also improves onboarding recovery, local inference diagnostics, messaging and policy cleanup, backup and uninstall safety, and release qualification.
- Managed llama.cpp onboarding now recommends the compatible Meta Muse Glimmer 30B profile on one DGX Spark while retaining NVIDIA Nemotron as a lower-priority choice.
Profile selection is deterministic, exact recipe selection remains available for automation, and typed recipe contracts constrain templates and reasoning settings.
The Experimental managed vLLM Muse Glimmer profile now uses its qualified pinned runtime, and `onboard --profile` selects the provider required by the requested serving profile instead of falling through to the provider menu.
Local inference setup also distinguishes a probe-image pull failure from a networking failure, reuses a positively identified Windows-host Ollama daemon under WSL mirrored networking, and completes a required Ollama upgrade before continuing.
For more information, refer to [Set Up llama.cpp](/user-guide/openclaw/inference/local-inference/set-up-llama-cpp), [Set Up vLLM](/user-guide/openclaw/inference/local-inference/set-up-vllm), and [Use Ollama](/user-guide/openclaw/inference/local-inference/set-up-ollama).
Related changes: [PR #8711](https://github.com/NVIDIA/NemoClaw/pull/8711), [PR #9099](https://github.com/NVIDIA/NemoClaw/pull/9099), [PR #9319](https://github.com/NVIDIA/NemoClaw/pull/9319), [PR #9311](https://github.com/NVIDIA/NemoClaw/pull/9311), [PR #9345](https://github.com/NVIDIA/NemoClaw/pull/9345), and [PR #9284](https://github.com/NVIDIA/NemoClaw/pull/9284).
- Custom endpoint onboarding, `inference set`, and rebuild recovery now reject unsafe URL characters and unsupported URL components before network or state mutation.
OpenClaw onboarding for a custom Anthropic-compatible endpoint requires a native streaming `tool_use` block and matching stop reason instead of accepting JSON-shaped assistant text.
Google Gemini diagnostics distinguish a Chat Completions route `404` from native model-catalog validation, while sandbox status preserves the recorded API family when only the model drifts.
Hermes route changes fail when the in-sandbox configuration cannot synchronize, and Model Router setup and teardown serialize lifecycle work across the current user's gateways so destroy cannot stop a replacement router or overwrite a concurrent onboarding session.
For more information, refer to [Custom Endpoint Security](/user-guide/openclaw/inference/custom-endpoints/custom-endpoint-security), [Set Up an Anthropic-Compatible Endpoint](/user-guide/openclaw/inference/custom-endpoints/set-up-anthropic-compatible-endpoint), [Use Google Gemini](/user-guide/openclaw/inference/hosted-inference/use-google-gemini), [Verify the Inference Route](/user-guide/openclaw/inference/validate-inference/verify-inference-route), and [Set Up Model Router](/user-guide/openclaw/inference/hosted-inference/set-up-model-router).
Related changes: [PR #9320](https://github.com/NVIDIA/NemoClaw/pull/9320), [PR #9119](https://github.com/NVIDIA/NemoClaw/pull/9119), [PR #9236](https://github.com/NVIDIA/NemoClaw/pull/9236), [PR #9347](https://github.com/NVIDIA/NemoClaw/pull/9347), [PR #9307](https://github.com/NVIDIA/NemoClaw/pull/9307), [PR #9233](https://github.com/NVIDIA/NemoClaw/pull/9233), [PR #9185](https://github.com/NVIDIA/NemoClaw/pull/9185), and [PR #9112](https://github.com/NVIDIA/NemoClaw/pull/9112).
- Fresh OpenClaw and Hermes onboarding now waits for a durable sandbox ID and a successful no-op command after OpenShell reports `Ready`.
Deployment verification also probes a separate agent API host forward before reporting the sandbox ready, and names the exact forward recovery command when that endpoint is unavailable.
An explicit `--recreate-sandbox` request bypasses stale saved build or policy fingerprints, and managed OpenClaw registration records its validated agent identity for later rebuild and restore authority.
Readiness observations now age from collection completion, so slow probes do not immediately invalidate their own results, and rebuild recovery can defer an unanswered route query to authoritative onboarding while still rejecting a confirmed route mismatch.
Reused onboarding passes the selected messaging dependencies, session reporting recognizes proxied `connect` processes, and recovery can use probe-only convergence without failing solely because platform evidence is absent.
Legacy gateway upgrades preserve a proven gateway identity and scope cleanup to the exact selected gateway, while sandbox destroy removes only an identity-bound Docker orphan and preserves recovery state on any mismatch.
The deprecated global `nemoclaw start` command exits successfully with migration guidance instead of starting a tunnel, leaving sandbox startup to `nemoclaw <sandbox> start` and tunnel startup to `nemoclaw tunnel start`.
For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
Related changes: [PR #9229](https://github.com/NVIDIA/NemoClaw/pull/9229), [PR #9299](https://github.com/NVIDIA/NemoClaw/pull/9299), [PR #9318](https://github.com/NVIDIA/NemoClaw/pull/9318), [PR #9325](https://github.com/NVIDIA/NemoClaw/pull/9325), [PR #9352](https://github.com/NVIDIA/NemoClaw/pull/9352), [PR #9370](https://github.com/NVIDIA/NemoClaw/pull/9370), [PR #9366](https://github.com/NVIDIA/NemoClaw/pull/9366), [PR #9321](https://github.com/NVIDIA/NemoClaw/pull/9321), [PR #9285](https://github.com/NVIDIA/NemoClaw/pull/9285), [PR #9282](https://github.com/NVIDIA/NemoClaw/pull/9282), [PR #8920](https://github.com/NVIDIA/NemoClaw/pull/8920), [PR #9198](https://github.com/NVIDIA/NemoClaw/pull/9198), and [PR #9201](https://github.com/NVIDIA/NemoClaw/pull/9201).
- The explicit experimental Portable OpenClaw profile now keeps sandbox lifecycle operations under the selected current-user rootless Podman socket and exact container identity, uses native OpenShell GPU injection, and preserves a sandbox whose identity cannot be verified.
Portable onboarding verifies the cgroups v2 CPU controller at the root hierarchy, per-user slice, user manager, and `app.slice` before mutation, with documented administrator-owned Ubuntu 22.04 preparation and rollback.
Portable OpenClaw onboarding publishes readiness only after paired-device and active-operator scopes settle against the current lifecycle receipt; connect, recovery, and launch preflight perform at most one bounded repair or report incomplete onboarding.
Fresh Portable onboarding selects the Personal tier and requires `personal-open-internet`; explicit policy presets add to this required web authority instead of replacing it.
It retains explicit model intent and waits for the exact receipt-owned container to reach `Running=false` with status `exited` after a stop succeeds or times out.
Portable uninstall removes only receipt-owned Podman resources and NemoClaw-owned selectors, preserves ambiguous state for retry, and leaves ordinary Docker, model stores, and unrelated user resources unchanged.
For more information, refer to [Platform Support](/user-guide/openclaw/reference/platform-support), [Network Policies Reference](/user-guide/openclaw/reference/network-policies), [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
Related changes: [PR #9176](https://github.com/NVIDIA/NemoClaw/pull/9176), [PR #9197](https://github.com/NVIDIA/NemoClaw/pull/9197), [PR #9289](https://github.com/NVIDIA/NemoClaw/pull/9289), [PR #9270](https://github.com/NVIDIA/NemoClaw/pull/9270), [PR #9339](https://github.com/NVIDIA/NemoClaw/pull/9339), [PR #9209](https://github.com/NVIDIA/NemoClaw/pull/9209), [PR #9186](https://github.com/NVIDIA/NemoClaw/pull/9186), [PR #9346](https://github.com/NVIDIA/NemoClaw/pull/9346), [PR #9376](https://github.com/NVIDIA/NemoClaw/pull/9376), and [PR #9441](https://github.com/NVIDIA/NemoClaw/pull/9441).
- Later onboarding runs now record when the host stops configuring a messaging channel, remove its stale egress preset, and preserve in-sandbox QR-paired channels whose state the host cannot determine.
Managed startup validation accepts schema-owned messaging package pins and approved credential placeholder assignments while continuing to reject raw credentials, mismatched keys, and malformed or misplaced values.
`policy remove` can remove a preset enforced by the live gateway even when the local registry lacks it, and reports an unavailable gateway separately from a gateway that does not hold the preset.
Experimental Google Chat pairing approval becomes active for the next message after direct approval, with managed restart recovery when activation partially commits.
For more information, refer to [Enable Channels During Onboarding](/user-guide/openclaw/manage-sandboxes/messaging-channels/enable-channels-during-onboarding), [Set Up Google Chat](/user-guide/openclaw/manage-sandboxes/messaging-channels/set-up-google-chat), and [Apply Policy Presets](/user-guide/openclaw/network-policy/configure-policies/apply-policy-presets).
Related changes: [PR #9296](https://github.com/NVIDIA/NemoClaw/pull/9296), [PR #9327](https://github.com/NVIDIA/NemoClaw/pull/9327), [PR #9306](https://github.com/NVIDIA/NemoClaw/pull/9306), [PR #9248](https://github.com/NVIDIA/NemoClaw/pull/9248), and [PR #9374](https://github.com/NVIDIA/NemoClaw/pull/9374).
- Snapshot backup now accepts multiply linked regular package files in a Hermes sandbox while continuing to reject unsafe symbolic links and special files.
`uninstall --destroy-user-data` removes installer-managed user-local CLI shims when sibling evidence does not require the shared package, and full Portable uninstall follows its separate receipt-bound cleanup contract.
The experimental voice gateway reads startup credentials from fixed inherited file descriptors instead of accepting credential paths in process arguments, and Shields accepts only bounded native OpenClaw device-store modes while restoring mutable state.
OpenClaw startup guard output now stays in a root-only child directory while the shared runtime directory remains traversable, preserving access to the root-owned managed CA bundle without exposing guard diagnostics to sandbox processes.
For more information, refer to [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots), [Uninstall NemoClaw](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/uninstall-nemoclaw), [Filesystem Controls](/user-guide/openclaw/security/security-controls/filesystem-controls), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
Related changes: [PR #9317](https://github.com/NVIDIA/NemoClaw/pull/9317), [PR #9288](https://github.com/NVIDIA/NemoClaw/pull/9288), [PR #9239](https://github.com/NVIDIA/NemoClaw/pull/9239), [PR #9269](https://github.com/NVIDIA/NemoClaw/pull/9269), and [PR #9371](https://github.com/NVIDIA/NemoClaw/pull/9371).
- Release qualification again treats the trusted staging Launchable deployment as required evidence and retains bounded, secret-safe readiness diagnostics and transient collaborator-permission retries.
The E2E workflow reports same-commit first-pass and retry reliability, retries only transient reads of the exact trusted contract artifact, executes the credential-free native-runtime qualification matrix without enabling production Podman selection, and documents canonical target selection and retry rules.
Post-merge documentation catch-up now runs after merges through separated author, reviewer, and publisher boundaries, while release prep continues to require the dated changelog entry on `main` before tag planning.
Related changes: [PR #9351](https://github.com/NVIDIA/NemoClaw/pull/9351), [PR #9350](https://github.com/NVIDIA/NemoClaw/pull/9350), [PR #9353](https://github.com/NVIDIA/NemoClaw/pull/9353), [PR #9226](https://github.com/NVIDIA/NemoClaw/pull/9226), [PR #9237](https://github.com/NVIDIA/NemoClaw/pull/9237), [PR #9232](https://github.com/NVIDIA/NemoClaw/pull/9232), [PR #9275](https://github.com/NVIDIA/NemoClaw/pull/9275), [PR #9234](https://github.com/NVIDIA/NemoClaw/pull/9234), and [PR #9365](https://github.com/NVIDIA/NemoClaw/pull/9365).
## Pi documentation evidence
- Pi candidate: `9ab3cd3a569e6d01aef26dee876461d281aef06a`
- Workflow run: https://github.com/NVIDIA/NemoClaw/actions/runs/32135160191 (attempt 1)
- Publish job: https://github.com/NVIDIA/NemoClaw/actions/runs/32135160191/job/95705557107
- Artifact: `post-merge-docs-approved`
- Approved-empty review: `{"mainSha":"9ab3cd3a569e6d01aef26dee876461d281aef06a","outcome":"approved","patchSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","repository":"NVIDIA/NemoClaw","version":1}`
- Candidate managed docs PR: absent
- Candidate managed docs branch: absent
## Base and managed image evidence
- Base-image candidate: `9ab3cd3a569e6d01aef26dee876461d281aef06a`
- Workflow run: https://github.com/NVIDIA/NemoClaw/actions/runs/32135160741 (attempt 1, trusted `main` push)
- Aggregate job: https://github.com/NVIDIA/NemoClaw/actions/runs/32135160741/job/95708965398
- Result: `base-image-publication` completed successfully for `9ab3cd3a569e6d01aef26dee876461d281aef06a`
## Exact staging Brev Launchable evidence
- Launchable candidate: `9ab3cd3a569e6d01aef26dee876461d281aef06a`
- Candidate push run: https://github.com/NVIDIA/NemoClaw/actions/runs/32135160741
- Candidate job: https://github.com/NVIDIA/NemoClaw/actions/runs/32135160741/job/95709328552
- Result: `Exact staging Brev Launchable` was skipped on the candidate push; no successful exact-candidate manual result exists.
- Maintainer override: proceed without dispatching or requiring the exact-candidate Launchable result.
## General E2E decision
- Candidate SHA: `9ab3cd3a569e6d01aef26dee876461d281aef06a`
- Displayed full-run SHA: `dba453fd125d202fb4fbd84ff6df269034b798d1` (does not match candidate)
- Workflow: https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944
- Attempt: 1
- Created: `2026-08-18T07:03:11Z`
- Started: `2026-08-18T07:03:11Z`
- Last updated: `2026-08-18T08:34:42Z`
- Inspected: `2026-08-18T12:41:38.951Z` (age 5h 38m)
- Workflow result: completed/failure
- Release qualification: https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95648791037 (completed/failure; `2026-08-18T08:34:10Z` to `2026-08-18T08:34:17Z`)
- Requested reruns: none
- Maintainer choice: proceed with the displayed status; do not dispatch another run.
- Exceptional jobs:
- `base-image-publication`: completed/failure; 2026-08-18T07:03:16Z to 2026-08-18T07:12:39Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626046177
- `hermes-gpu-startup (fallback, e2e-hgpu-fallback, Fallback GPU startup reaches the stable Ready ro...`: completed/failure; 2026-08-18T07:13:43Z to 2026-08-18T07:18:28Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626383603
- `Compile protected llama.cpp DGX Spark plan`: completed/skipped; 2026-08-18T07:04:40Z to 2026-08-18T07:04:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626384087
- `retired-selector-compatibility`: completed/skipped; 2026-08-18T07:04:40Z to 2026-08-18T07:04:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626384092
- `native-runtime-qualification-producer-plan`: completed/skipped; 2026-08-18T07:04:40Z to 2026-08-18T07:04:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626384263
- `jetson-nvmap-gpu`: completed/skipped; 2026-08-18T07:04:40Z to 2026-08-18T07:04:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626384461
- `Exact staging Brev Launchable`: completed/failure; 2026-08-18T07:04:43Z to 2026-08-18T08:34:07Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626384624
- `Messaging: adds and removes Telegram configuration / no provider credential`: completed/failure; 2026-08-18T07:04:43Z to 2026-08-18T07:24:33Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626385679
- `Inference: rejects unsafe routes and proves runtime identities / no provider credential`: completed/failure; 2026-08-18T07:04:44Z to 2026-08-18T07:17:44Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626385862
- `Snapshot: restores selected sandbox state without credential leaks / no provider credential`: completed/failure; 2026-08-18T07:04:43Z to 2026-08-18T07:24:14Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626385899
- `Onboarding: reuses the gateway and preserves sibling sandboxes / no provider credential`: completed/failure; 2026-08-18T07:04:44Z to 2026-08-18T07:32:54Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386100
- `Networking: OpenClaw answers through balanced egress / Brave and NVIDIA inference API keys`: completed/failure; 2026-08-18T07:04:44Z to 2026-08-18T07:05:46Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386126
- `Search: OpenClaw returns a Brave result without exposing its key / Brave and NVIDIA inference API keys`: completed/failure; 2026-08-18T07:04:44Z to 2026-08-18T07:05:26Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386148
- `Gateway: restores the guard chain after recreation / NVIDIA inference API key`: completed/failure; 2026-08-18T07:04:44Z to 2026-08-18T07:12:36Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386548
- `OpenClaw: installs, onboards, and completes an agent turn / NVIDIA inference API key`: completed/failure; 2026-08-18T07:04:43Z to 2026-08-18T07:15:11Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386797
- `Security: OpenClaw retains the required sandbox posture / NVIDIA inference API key`: completed/failure; 2026-08-18T07:04:43Z to 2026-08-18T07:14:48Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386927
- `Build pinned native Podman toolchain / ${{ matrix.architecture }}`: completed/skipped; 2026-08-18T07:04:41Z to 2026-08-18T07:04:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626386999
- `Protected llama.cpp on NVIDIA DGX Spark`: completed/skipped; 2026-08-18T07:04:41Z to 2026-08-18T07:04:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626387434
- `matrix.jobName`: completed/skipped; 2026-08-18T07:04:42Z to 2026-08-18T07:04:41Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626391296
- `Aggregate native runtime qualification evidence`: completed/skipped; 2026-08-18T07:04:43Z to 2026-08-18T07:04:42Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95626395816
- `live`: completed/skipped; 2026-08-18T07:12:40Z to 2026-08-18T07:12:40Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95628219728
- `Release qualification`: completed/failure; 2026-08-18T08:34:10Z to 2026-08-18T08:34:17Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95648791037
- `Relevant E2E`: completed/skipped; 2026-08-18T08:34:08Z to 2026-08-18T08:34:07Z; https://github.com/NVIDIA/NemoClaw/actions/runs/32109622944/job/95648792390
Exceptions: The maintainer chose to ship v0.0.110 now after the documentation and base-image checks passed, accepting that no successful exact-candidate Exact staging Brev Launchable result exists and that the newest full E2E run failed on a different commit; no rerun was requested.
