docs: complete v0.0.106 audit follow-ups - #8831
Conversation
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
📝 WalkthroughWalkthroughThe pull request updates contributor, changelog, image-pinning, and security documentation. It documents portable inference descriptors, sandbox recovery behavior, installer details, managed image digest controls, and OpenClaw audit suppression boundaries. ChangesDocumentation and security controls
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
🌿 Preview your docs: https://nvidia-preview-pr-8831.docs.buildwithfern.com/nemoclaw |
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. 4 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite for the commit under review. Recommended E2E: None 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
miyoungc
added
area: docs
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/changelog/2026-08-10.mdx`:
- Line 45: Rewrite the changelog sentence beginning “A Shields up restart” as
either “A restart with Shields up” or “A Shields-up restart,” preserving the
existing technical details about `/sandbox`, `root:sandbox`, mode `1775`, and
the sandbox workload identity.
In `@docs/security/openclaw-2026.7.1-dependency-review.md`:
- Around line 643-658: Extend
test/openclaw-security-audit-suppressions-real.test.ts to cover managed
onboarding that disables loopback device authentication, alongside the existing
operator opt-out case. Assert suppressions for
gateway.control_ui.device_auth_disabled and config.insecure_or_dangerous_flags,
including each detailIncludes value and reason.
In `@docs/security/process-controls.mdx`:
- Around line 295-297: Clarify the custom-image support boundary in the
recommendation describing the onboarding --from path: link the accepted issue or
design decision defining its scope, ownership, lifecycle, compatibility,
security review, and validation; if no such commitment exists, identify the
image as user-owned and direct users to Community Solutions.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0251a705-6047-402d-a289-3a51af974c78
📒 Files selected for processing (5)
CONTRIBUTING.mddocs/changelog/2026-08-10.mdxdocs/security/gateway-authentication-controls.mdxdocs/security/openclaw-2026.7.1-dependency-review.mddocs/security/process-controls.mdx
💤 Files with no reviewable changes (1)
- docs/security/gateway-authentication-controls.mdx
| - Sandbox recreation and live creation now wait for OpenShell to release ownership before Docker cutover. | ||
| Starting a stopped sandbox waits for a transient missing supervisor and repeats recovery, readiness, and port-forward checks. | ||
| Starting a stopped OpenClaw or Hermes sandbox waits through transient supervisor absence and managed-container restart transitions before it repeats recovery, readiness, and port-forward checks. | ||
| A Shields up restart also keeps `/sandbox` at `root:sandbox` mode `1775` while the explicit process policy selects the sandbox workload identity. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Rewrite the Shields up modifier.
Use A restart with Shields up or A Shields-up restart. The current wording is grammatically ambiguous. The LanguageTool check reports the missing hyphen.
Suggested wording
- A Shields up restart also keeps `/sandbox` at `root:sandbox` mode `1775` while the explicit process policy selects the sandbox workload identity.
+ A restart with Shields up also keeps `/sandbox` at `root:sandbox` mode `1775` while the explicit process policy selects the sandbox workload identity.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| A Shields up restart also keeps `/sandbox` at `root:sandbox` mode `1775` while the explicit process policy selects the sandbox workload identity. | |
| A restart with Shields up also keeps `/sandbox` at `root:sandbox` mode `1775` while the explicit process policy selects the sandbox workload identity. |
🧰 Tools
🪛 LanguageTool
[grammar] ~45-~45: Use a hyphen to join words.
Context: ...ss, and port-forward checks. A Shields up restart also keeps /sandbox at `roo...
(QB_NEW_EN_HYPHEN)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/changelog/2026-08-10.mdx` at line 45, Rewrite the changelog sentence
beginning “A Shields up restart” as either “A restart with Shields up” or “A
Shields-up restart,” preserving the existing technical details about `/sandbox`,
`root:sandbox`, mode `1775`, and the sandbox workload identity.
Source: Linters/SAST tools
| NemoClaw's generated OpenClaw audit configuration keeps intentional loopback | ||
| `allowInsecureAuth` findings and provenance-known loopback device-auth opt-out | ||
| findings visible as accepted findings. | ||
| `test/generate-openclaw-config-security-audit.test.ts` locks the generated | ||
| suppression scope, and `test/openclaw-security-audit-suppressions-real.test.ts` | ||
| locks the pinned OpenClaw check IDs and details. | ||
| `test/e2e/live/dashboard-remote-bind.test.ts` proves that a clean-host remote | ||
| bind leaves the device-auth, insecure-auth, and Host-header fallback findings | ||
| active. | ||
|
|
||
| Remove the `allowInsecureAuth` suppressions only after the pinned OpenClaw audit | ||
| contract proves that OpenClaw natively classifies intentional loopback | ||
| development HTTP without them, or after NemoClaw onboarding defaults | ||
| `CHAT_UI_URL` to `https://localhost` with a generated local certificate. | ||
| Remove the device-auth suppressions only after managed onboarding no longer | ||
| applies the loopback device-auth compatibility opt-out. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
files=(
test/generate-openclaw-config-security-audit.test.ts
test/openclaw-security-audit-suppressions-real.test.ts
test/e2e/live/dashboard-remote-bind.test.ts
)
for file in "${files[@]}"; do
test -f "$file"
done
rg -n -C 12 \
'security\.audit\.suppressions|gateway\.control_ui\.(insecure_auth|device_auth_disabled)|config\.insecure_or_dangerous_flags|allowInsecureAuth|dangerouslyDisableDeviceAuth|NEMOCLAW_DISABLE_DEVICE_AUTH|NEMOCLAW_DASHBOARD_BIND|127\.0\.0\.1|0\.0\.0\.0' \
"${files[@]}"Repository: NVIDIA/NemoClaw
Length of output: 40005
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- documentation excerpt ---'
sed -n '635,662p' docs/security/openclaw-2026.7.1-dependency-review.md
printf '%s\n' '--- generator implementation and focused tests ---'
rg -n -C 18 \
'DEVICE_AUTH_OPT_OUT_SOURCE|security\.audit\.suppressions|gateway\.control_ui\.device_auth_disabled|dangerouslyDisableDeviceAuth|managed-onboard|NemoClaw onboarding' \
scripts test/generate-openclaw-config-security-audit.test.ts
printf '%s\n' '--- real audit test setup and loopback cases ---'
sed -n '162,296p' test/openclaw-security-audit-suppressions-real.test.tsRepository: NVIDIA/NemoClaw
Length of output: 41129
Cover the managed-onboarding loopback suppression in the real audit test.
The generator emits suppressions for gateway.control_ui.device_auth_disabled and config.insecure_or_dangerous_flags when managed onboarding disables device authentication on loopback. The real audit test covers only the explicit operator opt-out. Add the managed-onboarding case and assert both suppression identifiers, detailIncludes, and reasons.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/security/openclaw-2026.7.1-dependency-review.md` around lines 643 - 658,
Extend test/openclaw-security-audit-suppressions-real.test.ts to cover managed
onboarding that disables loopback device authentication, alongside the existing
operator opt-out case. Assert suppressions for
gateway.control_ui.device_auth_disabled and config.insecure_or_dangerous_flags,
including each detailIncludes value and reason.
| | What you can change | Use the onboarding `--from` path when you need to build from a reviewed custom image. Locally built custom images do not use the managed registry digest. | | ||
| | Risk if relaxed | Reverting to a mutable tag (`:latest`) allows a registry-side change to replace the sandbox image without any blueprint update, which is a supply-chain risk. | | ||
| | Recommendation | Always reference the sandbox image by digest. If you build a custom image with the onboarding `--from` path, the digest constraint does not apply to your local build. | | ||
| | Recommendation | Keep the managed digest-pinned image unless you need a reviewed custom image. Pin the custom image's base and dependencies before you build it. | |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target documentation section ---'
sed -n '270,310p' docs/security/process-controls.mdx
printf '%s\n' '--- custom-image implementation ---'
sed -n '1025,1105p' nemoclaw/src/blueprint/runner.ts
printf '%s\n' '--- repository guidance and decision references ---'
find .. -name AGENTS.md -print
rg -n -i --hidden \
-g '!node_modules' -g '!dist' -g '!build' \
'custom image|custom-image|--from|Community Solutions|design decision|accepted issue|managed registry|digest-pinned' \
. | head -n 300
printf '%s\n' '--- issue and decision-like files ---'
git ls-files | grep -Ei '(^|/)(adr|rf[ce]|decision|design|issue|proposal|community|security|blueprint)' | head -n 300Repository: NVIDIA/NemoClaw
Length of output: 50371
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- repository policy ---'
sed -n '1,35p' AGENTS.md
sed -n '500,535p' CONTRIBUTING.md
sed -n '60,90p' WRITING.md
printf '%s\n' '--- documentation guidance ---'
sed -n '1,220p' docs/AGENTS.md
printf '%s\n' '--- custom-image support language ---'
sed -n '50,120p' docs/about/ecosystem.mdx
sed -n '80,118p' docs/about/ecosystem-hermes.mdx
sed -n '82,118p' docs/about/ecosystem-deepagents.mdx
sed -n '55,75p' docs/changelog/2026-07-14.mdx
sed -n '1,100p' docs/resources/community-contributions.mdx
printf '%s\n' '--- target file metadata and all custom-image references ---'
sed -n '1,35p' docs/security/process-controls.mdx
rg -n -C 3 -i 'reviewed custom image|custom images|custom-image|custom Dockerfile|--from <Dockerfile>' \
docs nemoclaw/src/blueprint/runner.ts src/lib/onboard.ts | head -n 260
printf '%s\n' '--- local decision/issue references ---'
rg -n -i \
'accepted issue|accepted design decision|#[0-9]{3,}|NEMOCLAW-[0-9]+|custom image.*(scope|owner|lifecycle|compatib|security|validat)' \
AGENTS.md CONTRIBUTING.md WRITING.md docs nemoclaw src test .github \
--glob '!**/changelog/**' --glob '!**/*.generated.mdx' | head -n 300Repository: NVIDIA/NemoClaw
Length of output: 50374
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- onboarding custom-Dockerfile contract ---'
sed -n '1,180p' test/onboard-custom-dockerfile.test.ts
sed -n '3860,3950p' src/lib/onboard.ts
rg -n -C 4 'custom Dockerfile|custom image|--from <Dockerfile>|onboard --from' \
docs/get-started docs/reference docs/security docs/manage-sandboxes docs/cli 2>/dev/null | head -n 260
printf '%s\n' '--- deterministic documentation-scope probe ---'
python3 - <<'PY'
from pathlib import Path
import re
files = [
Path("docs/security/process-controls.mdx"),
Path("docs/about/ecosystem.mdx"),
Path("docs/about/ecosystem-hermes.mdx"),
Path("docs/about/ecosystem-deepagents.mdx"),
Path("docs/resources/community-contributions.mdx"),
]
terms = re.compile(r"custom image|custom Dockerfile|--from|Community Solutions|accepted issue|accepted design decision", re.I)
issue_ref = re.compile(r"(?:#\d{3,}|[A-Z][A-Z0-9_-]+-\d+)", re.I)
for path in files:
print(f"FILE {path}")
for n, line in enumerate(path.read_text().splitlines(), 1):
if terms.search(line):
print(f"{n}: {line}")
refs = issue_ref.findall(path.read_text())
print("ISSUE_OR_DECISION_LIKE_REFS:", refs or "none")
PYRepository: NVIDIA/NemoClaw
Length of output: 43141
🌐 Web query:
site:github.com/NVIDIA/NemoClaw custom image accepted issue design decision --from
💡 Result:
In the context of NemoClaw development and the nemoclaw onboard command, the phrase "custom image accepted issue design decision" refers to the project's strict requirement that any new, supported custom sandbox image—or any significant change to product scope—must be preceded by an approved design decision documented in a GitHub issue [1][2]. The --from flag itself is the standard mechanism for creating these custom sandbox images, allowing users to build from a specific Dockerfile rather than the stock NemoClaw image [3][4]. However, the use of this feature for production or officially supported workflows is governed by the following constraints: 1. Product Scope and Approval: The project's contribution guidelines explicitly state that a pull request must not define a new supported custom image or integration without prior maintainer alignment [1]. Maintainers require an accepted issue or design decision that defines the product behavior, ownership, compatibility, upgrade expectations, and security boundary before such work is accepted into the supported product surface [1][2]. 2. Design Decision Requirements: When a formal design decision is required (e.g., for new agent runtimes or infrastructure components), it must explicitly name owners, canonical IDs, lifecycle contracts, and validation boundaries [2]. For instance, internal decisions (like those tracking artifact handoffs) often require explicit "Needs Design" markers to be cleared by maintainers before the implementation is accepted [5]. 3. Technical Implementation: Technically, the --from flag uses the parent directory of the specified Dockerfile as the build context [3][4]. It is designed to work with NemoClaw's build arguments and integrates with features like --resume [3]. Recent enhancements have focused on honoring .dockerignore files for these custom contexts and implementing security guardrails, such as rejecting certain host-access patterns (e.g., host.docker.internal) to ensure safe sandbox execution [6][7]. In summary, if you are working on a custom image intended for use beyond personal experimentation, you must verify if there is an existing accepted design decision in the repository [1]. If not, you are expected to start a GitHub discussion or open an issue to gain maintainer alignment on the product scope before proceeding with implementation [1].
Citations:
- 1: https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md
- 2: [Epic] Support Pi as a first-class NemoClaw agent runtime #7923
- 3: https://github.com/NVIDIA/NemoClaw/pull/1059/changes
- 4: docs(onboard): document Docker build performance best practices #4683
- 5: Run NemoClaw E2E against an exact staging Brev Launchable #6943
- 6: perf(onboard): honor .dockerignore for custom --from build contexts #4679
- 7: fix(onboard): reject host.docker.internal inference URLs #3804
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- candidate GitHub issue metadata ---'
python3 - <<'PY'
import json
import urllib.request
for number in (7923, 4683, 4679, 6943):
url = f"https://api.github.com/repos/NVIDIA/NemoClaw/issues/{number}"
request = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "read-only-review-check"})
try:
with urllib.request.urlopen(request, timeout=15) as response:
item = json.load(response)
print(json.dumps({
"number": item["number"],
"title": item["title"],
"state": item["state"],
"html_url": item["html_url"],
"labels": [label["name"] for label in item["labels"]],
"body": item.get("body") or "",
}, indent=2))
except Exception as exc:
print(json.dumps({"number": number, "error": str(exc)}))
print('--- issue search: custom image ---')
url = "https://api.github.com/search/issues?q=repo%3ANVIDIA%2FNemoClaw+%22custom+image%22&per_page=100"
request = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "read-only-review-check"})
try:
with urllib.request.urlopen(request, timeout=15) as response:
data = json.load(response)
for item in data.get("items", []):
print(json.dumps({
"number": item["number"],
"title": item["title"],
"state": item["state"],
"html_url": item["html_url"],
}))
except Exception as exc:
print(json.dumps({"error": str(exc)}))
PY
printf '%s\n' '--- focused working-tree diff ---'
git status --short
git diff --unified=8 -- docs/security/process-controls.mdxRepository: NVIDIA/NemoClaw
Length of output: 1066
🌐 Web query:
site:github.com/NVIDIA/NemoClaw/issues/7923
💡 Result:
GitHub issue #7923 is an open epic titled “Support Pi as a first-class NemoClaw agent runtime.” It proposes:
- Selecting Pi during onboarding via
nemoclaw onboard --agent pi - A pinned, managed Pi runtime/image
- Compute-runtime-neutral lifecycle support
- Managed inference without exposing provider credentials
- Support for status, logs, rebuild, backup, upgrade, and destroy
- Interactive and non-interactive terminal flows
- Initial delivery target: July 30–August 13, 2026
- Progress: 0 of 7 child issues completed [1]
[1] (github.com)
Citations:
🌐 Web query:
site:github.com/NVIDIA/NemoClaw/issues/4683
💡 Result:
As of August 11, 2026, there is no official announcement or documentation regarding a Rust 2027 edition. The Rust Project currently operates using a system of annual project goals rather than focusing solely on edition-based roadmaps [1][2][3]. The Rust project has moved away from the biannual planning process used in 2024 and 2025 in favor of a yearly program for project goals, which focuses on long-running, high-impact technical work [3]. Recent development efforts, as of mid-2026, have been centered on flagship themes such as "Beyond the &" (improving ergonomics around references), flexible and faster compilation, and the stabilization of features like the next-generation trait solver and Polonius [2]. For the most up-to-date information on Rust's technical direction, the community is directed to the official Rust Blog and the rust-project-goals repository [1][2].
Citations:
- 1: https://blog.rust-lang.org/2024/08/12/Project-goals/
- 2: https://blog.rust-lang.org/2026/05/18/project-goals-2026-04/
- 3: https://blog.rust-lang.org/inside-rust/2026/02/03/first-look-at-2026-project-goals/
Clarify the support boundary for custom images.
The implemented --from path does not establish that user-built images are a supported NemoClaw product surface. Link the accepted issue or design decision that defines its scope, ownership, lifecycle, compatibility, security review, and validation. Otherwise, identify the image as user-owned and route the workflow through Community Solutions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/security/process-controls.mdx` around lines 295 - 297, Clarify the
custom-image support boundary in the recommendation describing the onboarding
--from path: link the accepted issue or design decision defining its scope,
ownership, lifecycle, compatibility, security review, and validation; if no such
commitment exists, identify the image as user-owned and direct users to
Community Solutions.
Source: Coding guidelines
3 participants
Summary
Completes the v0.0.106 changelog for four user-visible changes that merged before the tag but were omitted from the pre-tag entry. Keeps public security pages focused on operator guidance by relocating maintenance contracts to contributor guidance and the owning OpenClaw dependency review. Records PR #8753's portable inference descriptor as Experimental while leaving its existing workflow documentation unchanged.
Changes
CONTRIBUTING.md.Type of Change
Quality Gates
bbfed36ca; the review verified the operator-facing security claims, the distinctallowInsecureAuthand device-auth suppression removal conditions against their generator branches, and the confirmed Experimental feat(onboard): activate portable runtime inference #8753 release claim. No runtime or policy behavior changes.Documentation Writer Review
docs-updatedCONTRIBUTING.md,docs/changelog/2026-08-10.mdx,docs/security/gateway-authentication-controls.mdx,docs/security/openclaw-2026.7.1-dependency-review.md, anddocs/security/process-controls.mdx; the subagent revieweddocs/CONTRIBUTING.md,WRITING.md, terminology, structure, voice, code-sample presentation, canonical ownership, factual accuracy, and product scope.DGX Station Hardware Evidence
scripts/prepare-dgx-station-host.shis unchanged.Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpx vitest run test/changelog-docs.test.ts test/check-docs-published-routes.test.ts test/check-docs-links.test.tspassed;npm run docsandgit diff --checkpassed again after the review correction.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: not applicable to this bounded documentation-only change.npm run docsbuilds without warnings (doc changes only) — result: passed with zero errors and the existing light-mode accent contrast warning.Signed-off-by: Miyoung Choi miyoungc@nvidia.com
Summary by CodeRabbit