NemoClaw v0.0.115 is out!

[cv]

NemoClaw v0.0.115 strengthens the boundaries that protect sandbox identity, policy ownership, and managed images. Stock agent onboarding now stops before sandbox creation when it cannot verify the release image, while security and diagnostics reject unsafe configuration paths and remove credentials from debug output.

This release also improves daily operation across Hermes, messaging, inference, and sandbox maintenance. Portable Hermes recovery verifies its recorded runtime authority before acting, maintained messaging channels receive their revision-scoped credentials at startup, and local inference selects models against qualified host capacity.

Installation and planning workflows now cover more controlled starting points. Hermes can defer onboarding when NVIDIA-hosted inference credentials are not yet available, and an experimental runner can validate a plan for an externally managed OpenShell target without connecting or applying changes.

Hermes and Installer Recovery

• Portable Hermes recovery now revalidates the recorded Podman container, OpenShell gateway, executable, policy, route, and runtime identities before each operation. It starts the recorded Hermes command only when recovery restarted the container, which prevents duplicate startup processes and limits rollback to the container that recovery started. #10315, #10376, #10441, #10456, and #10499.
• The Hermes installer now supports --defer-onboarding and NEMOCLAW_DEFER_ONBOARDING=1 for NVIDIA-hosted inference when no supported credential and no sandbox exist. This option lets you install NemoClaw and Hermes before credentials are available. It does not record a provider, sandbox, or completed onboarding state. #10299.

Managed Images and Sandbox Authority

• Stock Docker-driver onboarding for OpenClaw, Hermes, and LangChain Deep Agents Code now requires the release's exact managed image. Registry or catalog verification failures stop before sandbox creation. This prevents an unverified local stock-image build from replacing the release artifact, while explicit custom Dockerfiles remain separate. #10113, #10320, #10321, #10322, #10332, #10396, and #10422.
• nemoclaw upgrade-sandboxes --check now exits nonzero when it finds actionable stale, unknown-version, backup-recovery, or missing-sandbox state. Sandbox destruction uses bounded waits and preserves recovery authority when deletion cannot be confirmed. Non-portable managed Hermes uninstall now removes its owned state volume and stops before retiring state when Docker cleanup fails. These changes let automation detect required work and let operators retry incomplete cleanup without losing ownership records. #10128, #10133, and #10224.

Messaging and Inference

• Messaging setup now binds revision-scoped credentials to canonical OpenShell providers before sandbox creation or rebuild. Maintained Slack, Discord, Google Chat, and Telegram paths therefore receive credentials when the agent starts while retaining endpoint-specific policy matching and provider ownership checks. #10170, #10271, #10273, #10275, #10277, #10307, and #10314.
• Experimental managed llama.cpp onboarding now recommends NVIDIA Nemotron 3 Nano 30B-A3B on qualified DGX Spark Arm64 and Linux x86_64 NVIDIA GPU hosts. Meta Muse Glimmer remains an explicit DGX Spark choice, so existing Muse installations are not migrated. Local NVIDIA NIM selection now rejects models above usable memory, which avoids unsupported model selections. #10122 and #10292.

Security and External Target Planning

• Security and diagnostics now reject configuration reads through a symlinked configuration directory, redact URL userinfo credentials in debug bundles, require durable authority for sandbox mutations, and report interrupted onboarding as incomplete. These checks reduce credential exposure and prevent ambiguous identity or onboarding state from being reported as success. #10041, #10127, #10146, and #10396.
• The experimental direct blueprint runner can now validate and sanitize a plan for an externally managed OpenShell target. It checks endpoint, workspace, release range, certificate authority bundle, and authentication-file metadata without reading credentials, connecting, authenticating, or applying changes, which supports review before any external operation. #10045.

Thank You

Thank you to external contributors @ALDRIN121, @Adityaj0, @Dreamstick9, @deepujain, @harjothkhara, @udsy19, and @ugden-unak. Their work improved installer recovery, policy boundaries, command behavior, package assets, documentation, and release confidence in #10017, #10020, #10028, #10033, #10035, #10038, #10041, #10088, #10089, #10126, #10129, #10137, #10143, #10146, #10158, and #10198.