docs: add v0.0.96 release entry

[cv]

Summary

Add the canonical docs/changelog/2026-07-25.mdx release entry with the exact ## v0.0.96 heading.
The entry reconciles all 90 first-parent commits since v0.0.95 with all 92 merged PRs in the live v0.0.96 label ledger and groups the user-visible changes by operator journey.

Changes

• Add the parser-safe dated MDX changelog entry for v0.0.96 with root-absolute links to the focused user guides.
• Source summary:

  • #7194 -> docs/changelog/2026-07-25.mdx: Document persistent baseline network policy exclusions and their inspection, rebuild, and snapshot behavior.

  • #7188, #7427, and #7546 -> docs/changelog/2026-07-25.mdx: Document DNS-backed HTTPS inference routing, keyless loopback endpoints, and provider-marker isolation.

  • #7238 -> docs/changelog/2026-07-25.mdx: Document blueprint sandbox and provider identifier validation before state writes or OpenShell calls, with bounded terminal-safe rejection previews.

  • #7319, #7274, #7528, #7353, and #7560 -> docs/changelog/2026-07-25.mdx: Document the managed default gateway service, onboarding readiness, and container-runtime identity safeguards.

  • #7349, #7498, #7406, #7196, #7559, #7421, #7510, #7295, and #7565 -> docs/changelog/2026-07-25.mdx: Document gateway-scoped status, lifecycle diagnostics, managed MCP recovery, delete-edge safeguards, and fail-closed CLI prompt and command output.

  • #7591 -> docs/changelog/2026-07-25.mdx: Document opt-in authenticated MCP tool-name discovery, its bounded and names-only contract, probe interaction, and rebuild requirement.

  • #7305, #7480, #7471, #7365, and #7541 -> docs/changelog/2026-07-25.mdx: Document installer version checks, version-tag reporting, license guidance, WSL Ollama selection, and DGX Station vLLM detection.

  • #7482, #7466, #7208, #7434, and #7586 -> docs/changelog/2026-07-25.mdx: Document Ollama resource details, reasoning precedence, Hermes onboarding behavior, and preserved managed Hermes BuildKit failures.

  • #6830, #7492, #7563, and #7582 -> docs/changelog/2026-07-25.mdx: Document the authoritative OpenClaw production lock, fixed managed-image dependencies, immutable Hermes base adoption, and Hermes image-size reduction.

  • #7505, #7530, #7547, #7508, #7548, #7549, #7537, #7534, #7515, #7511, #7551, #7562, #7575, #7496, #7594, #7595, and #7599 -> docs/changelog/2026-07-25.mdx: Summarize release validation, transient and bounded dispatch reconciliation, exact pre-tag qualification, identity revalidation, npm-audit retry, sharding, image reuse, timeout, telemetry, and workflow-hardening changes.

• Reconciled without separate changelog prose:
  • #7539, #7526, #7507, #7506, #7519, #7516, #7396, #7254, #7583, #7596, and #7598: Test-harness or fixture-only changes.
  • #7403, #7161, #6877, #7531, #7525, #7522, #7536, #7552, #7566, #7553, #7561, #7577, #7569, #7585, #7584, #7592, #7580, #7571, #7517, #7589, #7402, #7558, #7544, and #7601: Dependency, internal recovery, validation, contributor-workflow, E2E optimization, telemetry, or CI trust changes with no separate user-facing release claim.
  • #7556, #7573, #7576, and #7578: Experimental repository-maintainer conflict automation with no canonical user documentation surface.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: test/changelog-docs.test.ts validates dated changelog structure, version headings, and published links.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Reviewed docs/changelog/2026-07-25.mdx at exact head 0f5dedb47 against 90 first-parent release commits and 92 merged PRs labeled v0.0.96. Verified parser-safe MDX SPDX, the exact version heading, literal CLI names, writing style, skip terms, all 20 root-absolute published links, and the accepted feat(mcp): add opt-in authenticated tool discovery #7591 opt-in authenticated discovery bounds. feat(readiness): define system readiness report contract #7544, fix(e2e): accept canonical controller check URLs #7599, and ci(installer): trust stable formula cleanup transition #7601 remain internal or CI-only release-ledger entries. Changelog tests passed 6/6, the docs build passed with 0 errors and two pre-existing Fern warnings, and npm run check:diff plus the final diff check passed.
• Agent: Codex Desktop documentation-writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/changelog-docs.test.ts: 6/6 passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable to this prose-only changelog entry.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — the build passed with 0 errors and 2 existing Fern warnings; the published-route check passed.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only) — native changelog files use the required parser-safe MDX SPDX comment and no frontmatter.

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• New Features
  • Persistent network policy exclusions with consistent restore/exclusion reporting across rebuilds/snapshots.
  • Opt-in MCP tool discovery via mcp status --tools with bounded, redacted authenticated traffic.
  • Improved HTTPS inference switching for custom endpoints and refreshed onboarding/model menu details.
  • Refined OpenShell gateway defaults for port 8080, including more reliable readiness checks.
• Bug Fixes
  • Prevent incorrect provider/model restoration after compatible-provider update failures.
  • Preserve managed MCP state after exec loss and tighten gateway/doctor status scoping.
• Tests
  • Stronger, fail-closed release validation with hardened evidence/artifact handoff and bounded timeouts/retries.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds the v0.0.96 changelog entry covering policy and inference behavior, gateway operations, installer and onboarding updates, image assembly, MCP discovery, and release validation orchestration.

Changes

v0.0.96 Release Notes

Layer / File(s)	Summary
Release scope and policy behavior docs/changelog/2026-07-25.mdx	Adds the v0.0.96 overview and documents persistent policy exclusions and DNS-backed HTTPS inference routing changes.
Gateway and recovery behavior docs/changelog/2026-07-25.mdx	Documents blueprint validation, OpenShell gateway defaults, lifecycle and health checks, diagnostics, rebuild recovery, MCP tool discovery, and command outcome handling.
Installer, inference, and image updates docs/changelog/2026-07-25.mdx	Records installer requirements, platform preparation, Ollama and Hermes onboarding changes, production lock usage, dependency updates, and image assembly changes.
Release validation orchestration docs/changelog/2026-07-25.mdx	Documents E2E execution, retries, timeouts, platform sharding, image reuse, provisioning, credentials, and artifact handoff rules.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the addition of the v0.0.96 changelog release entry.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/docs-v0.0.96

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7564.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• docs-validation

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[prekshivyas]

Maintainer review complete at exact head 0f5dedb. Release-entry counts and included user-facing changes were refreshed against current main; targeted changelog tests, docs build, diff checks, and exact-head documentation-writer receipt are green. check-gates reports allPass=true with 45 current checks green, no conflicts, no unresolved major/critical CodeRabbit findings, DCO present, and all 9 commits GitHub Verified.