NemoClaw v0.0.91

NemoClaw v0.0.91 strengthens the software-supply-chain boundary across its Node-based sandbox images. The release removes vulnerable node-tar copies from completed images, verifies the reviewed dependency graph inside constrained containers, and adds historical-revision coverage so security remediations remain testable across supported upgrade paths.

Rebuild reliability also moves forward across Hermes and Deep Agents Code. Faster Hermes validation preserves the same state, readiness, provenance, and replacement assertions, while targeted fixes carry validated base-image trust through DCode rebuilds, avoid duplicate backups during recreation, and wait for OpenShell deletion to converge before replacement begins.

The release rounds out that work with repaired historical E2E fixtures, clearer Hermes token lifecycle guidance, updated DGX Station qualification, safer coding-agent install instructions, and a shared writing standard for contributors and automated review. Together these changes improve both day-to-day recovery behavior and the confidence of the checks used to ship it.

Security and image integrity

• #7332 removes vulnerable node-tar copies from NemoClaw, npm-private bundles, and completed OpenClaw, Hermes, and Deep Agents Code images, then scans the final filesystems so stale base layers cannot silently reintroduce affected versions.
• #7289 adds a least-privilege container verifier for the current OpenClaw security revision, validating exact package versions, resolved archives, integrity metadata, executable identity, and the absence of nested vulnerable copies.
• #7294 adds opt-in real-container verification for historical OpenClaw security revisions, including transactional state and credential restoration, so upgrade-path remediations are tested against supported state layouts rather than only mocked fixtures.

Rebuild and sandbox recovery

• #7213 reduces Hermes rebuild validation time by reusing prepared dependencies and carrying an immutable base identity through rebuild, while retaining the state, readiness, replacement, and provenance assertions that make the lane meaningful.
• #7363 carries an operation-scoped trust proof from the validated Deep Agents Code base build into managed-image preparation, preventing rebuild from rejecting the current base it just created.
• #7366 reuses the outer rebuild backup during inner onboarding, avoiding a second backup attempt that could fail against a stale gateway listing after sandbox deletion.
• #7369 waits for OpenShell to confirm sandbox deletion before registry removal and recreation, preventing asynchronous delete races and preserving recovery state when absence cannot be confirmed.

Historical E2E and upgrade confidence

• #7355 restores deterministic image and gateway-upgrade coverage by fixing Deep Agents archive-download ordering, remediating the immutable legacy OpenClaw fixture, and narrowing its historical audit exception without weakening production image scanning.
• #7360 bundles the reviewed tar archive into the legacy OpenClaw fixture and binds it to committed integrity metadata, eliminating mutable registry resolution from that historical remediation path.
• #7362 repairs historical gateway-upgrade adapters for their exact pinned release shapes and keeps the reviewed OpenClaw archive inside frozen optimized build contexts, restoring four deterministic E2E paths.
• #7364 seeds historical Hermes fixtures with a valid per-run API bearer key, allowing rebuild tests to exercise token rotation and post-rebuild stability instead of failing before the behavior under test.

Hermes operations

• #7212 documents when the Hermes API bearer token remains stable, when it rotates, and how to retrieve it safely, and adds rebuild guidance so operators can distinguish expected lifecycle changes from regressions.

Onboarding, platforms, and contributor guidance

• #7306 fixes the duplicated wording in the shared license and third-party software acceptance prompt used by both installer and onboarding flows.
• #7327 records qualified single-system DGX Station profiles as tested with limitations while keeping dual-Station and dedicated-CI gaps explicit, giving users a more accurate support boundary.
• #7328 makes coding-agent install guidance explicit about agent, provider, and release-tag selection and keeps Docker approval command-scoped, improving reproducibility without broadening host access.
• #7282 establishes WRITING.md as the permanent shared writing guide and loads it from the trusted workflow checkout, aligning contributor guidance and automated review on one protected source.
• #7341 scopes the OpenShell 0.0.71 review link to OpenClaw and Hermes while preserving equivalent plain text for Deep Agents readers, removing a variant-specific dead link without changing the intentional documentation boundary.

Thank you

Thank you to external contributors @harjothkhara for the Hermes token lifecycle and retrieval guidance in #7212, and @RUSHcitizen for the agent-scoped OpenShell documentation fix in #7341.