## Summary

Complete the planned v0.0.90 changelog after the security remediation in
#7286 merged.
The release entry now records the remediated OpenClaw dependency
boundary and links to the detailed dependency review.

## Related Issue

Related to #5591 and follows #7286.

## Changes

- Add the OpenClaw core, Slack, and Microsoft Teams transitive
dependency remediation to the v0.0.90 summary and release bullets.
- Record fail-closed archive validation and the reviewed residual audit
findings.
- Link the detailed OpenClaw 2026.6.10 dependency review.
- Source summary: #7286 -> `docs/changelog/2026-07-20.mdx`.
- Reconciled #7316 as documentation-only coverage for existing Deep
Agents behavior; its merged source page is already the canonical record
and requires no separate release behavior entry.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [ ] Tests added or updated for changed behavior
- [x] Existing tests cover changed behavior — justification:
`test/changelog-docs.test.ts` validates changelog structure and links,
and the full docs build validates generated content and routes.
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit: not applicable
- Station profile/scenario: not applicable
- Result: not applicable
- Supporting evidence: not applicable

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/changelog-docs.test.ts`: 6/6 passed
- [x] Applicable broad gate passed — `npm run docs`: 0 errors; the two
repository-wide pre-existing Fern warnings remain
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [x] `npm run docs` builds without warnings (doc changes only) — 0
errors; the two repository-wide pre-existing Fern warnings remain
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Clarified inference provider routing and credential handling for
managed agent images.
  * Added migration guidance ahead of the upcoming fallback removal.
* Documented security updates for OpenClaw, Slack, and Microsoft Teams
installations, including verified package remediation and archive
validation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

<!-- markdownlint-disable MD041 -->
## Summary

Add a standalone container verifier for the current OpenClaw security
remediation produced by #7286. The verifier inspects the installed
OpenClaw package graph in an offline, read-only, unprivileged container
and rejects vulnerable, stale, or internally inconsistent dependency
state.

## Related Issue

Related to #7272. The real-container lane validates the final image
produced after #7286 lands; this PR remains independently based on
`main` and has no dependency on #7276.

## Changes

- Keep always-running contract coverage for explicit opt-in, evidence
rejection, and the least-privilege Docker boundary.
- Replace the historical runtime plugin-install matrix with one
current-image probe of the globally installed `openclaw@2026.6.10`
graph.
- Require exact installed and shrinkwrap evidence for `tar@7.5.19`,
`brace-expansion@5.0.7`, `@openclaw/fs-safe@0.3.0`, and `jszip@3.10.1`.
- Require the `@openclaw/fs-safe` optional dependencies to be absent,
reject nested vulnerable copies, validate `npm ls`, and verify the
OpenClaw executable resolves to the reviewed installation.
- Run the image probe with no network, a read-only root filesystem, the
sandbox identity, no capabilities, no privilege escalation, bounded
resources, and no host mounts.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: this changes only an
internal, explicitly opt-in image verifier and introduces no user-facing
behavior, configuration, API, or documentation route.
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit: Not applicable
- Station profile/scenario: Not applicable
- Result: Not applicable
- Supporting evidence: Not applicable

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — current exact-head contract run: 3
passed with the real-container lane intentionally skipped; current
exact-head real-container lane: 4 passed against the exact merged-#7286
CI image; an older pre-final image was correctly rejected for its stale
wrapper, `fs-safe`, and lock metadata.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Additional checks passed: CLI typecheck, exact Vitest project
membership, test-title style, source-shape budget, test-file-size
budget, Biome, repository checks, and secret scanning.

## Merge Dependencies

This is a downstream verifier and does not block #7286 from merging.
Human review can proceed now, but this PR must not merge until all items
below are complete:

- [x] #7286 is merged into `main`.
- [x] Update this PR on the resulting `main` and run the opt-in
real-container lane against the exact final built image.
- [x] Record the merged #7286 SHA, immutable image digest, and passing
test evidence before merging this PR.

Final image evidence:

- Merged #7286 revision: `2ad613d6e9abc26859b59e5a876ddd0ee40c7ca1`
- Exact #7289 head: `48459d489c929076b47b41550b035cc90093bee1`
- CI-built image:
`nemoclaw-production@sha256:a075375409e3c81d248beafe2b627c6bd2ee5ea95f8f36a7b1c0fdb02850bc4c`
- OCI revision label: `acfa2613c7a645ae1bff21914f25d824e5fbcf62`
- Hardened real-container verifier: 4/4 passed (offline, read-only root
filesystem, unprivileged sandbox user, no capabilities, no privilege
escalation, bounded resources, and no host mounts).

---
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added a new end-to-end security validation for an OpenClaw container
image, selected via target ID and/or explicit opt-in.
* Enforces that the image is referenced by an immutable digest (rejects
non-digest/invalid image values).
* When enabled, executes verification in a hardened container boundary
(offline, read-only, least-privilege, constrained resources) and
confirms expected dependency/lockfile integrity, including absence of
optional and nested dependencies.
* Emits and strictly validates structured JSON security evidence,
including negative contract checks for tampered results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Co-authored-by: Charan Jagwani <cjagwani@nvidia.com>

## Summary

Reopen follow-up for #6520: `nemoclaw uninstall --yes` followed by a
curl reinstall hard-aborts at the installer strict pre-upgrade backup.
The uninstall removes the gateway registration and the sandbox container
but preserves `sandboxes.json`, so the stranded record can only ever be
skipped — and the strict gate (`NEMOCLAW_REQUIRE_ALL_SANDBOX_BACKUPS=1`,
#6114) exits 1 before the installer recovery phase
(`recover_preexisting_sandboxes_before_onboard`), the phase that knows
how to surface orphans, ever runs. The #6539 orphan classifier is wired
only into `upgrade-sandboxes`, which is downstream of the aborting
backup.

## What changed

- `backupAll()` now classifies stranded records with the existing
`classifyOrphanedRegistrySandboxes` (unobserved on the selected gateway
AND persisted binding resolving to that same gateway), gated on the new
`isSandboxContainerDefinitivelyAbsent()`. Stranded records are tracked
separately from `skipped`, so the strict gate keeps failing closed for
every genuine skip, and the run ends with `orphanedRegistrySummary` +
`orphanedRegistryRemediation` (same destroy/onboard guidance as the
recovery phase). End-to-end, the installer now proceeds to its recovery
phase, which reports the orphans and yields "completed with warnings"
instead of a hard abort.
- The exemption is two-phase (PRA-1): after the backup loop, a
confirming second pinned listing re-checks every stranded candidate —
the same #6114 confirmation idiom as `upgrade-sandboxes` — and any
candidate the gateway observes again reverts to a genuine strict skip.
Container absence is itself checked per candidate at skip time.
- `isSandboxContainerDefinitivelyAbsent()` fails closed everywhere
absence cannot be proven: non-docker or unknown driver (including a
throwing registry read), and a failed or timed-out labeled listing. The
listing is status-checked (`docker ps -a` with the OpenShell labels)
rather than reusing `findLabeledSandboxContainers`, which swallows
docker errors — a dead daemon yields `null`, never "absent" — and passes
`ignoreError` so the probe cannot `process.exit` the run.
- `backup-all` now pins its sandbox listing to the selected gateway
(same #6114 rationale and idiom as `upgrade-sandboxes`): an unpinned
list taken from a sibling gateway selection must not feed a fail-open
stranded decision.
- The exemption carries an in-code source-of-truth review block (PRA-2):
source boundary (`nemoclaw uninstall` preserves `sandboxes.json` by
design), source-fix constraint (backup-all must not reconcile the
registry; record removal is owned by the recovery phase destroy/onboard
flow), and removal condition (install/uninstall registry reconciliation,
or running the recovery phase before the strict backup).

## Constraints preserved (pinned by tests)

- Strict gate still aborts on any genuine skip (#6114 cases untouched
and green).
- A sandbox bound to a sibling gateway is never claimed stranded, even
when its container is absent on this host.
- An unobserved sandbox whose container still exists keeps the strict
abort (reconnect race).
- A stranded candidate the confirming listing observes again reverts to
a strict skip (lifecycle race).
- Real backup failures (EACCES, non-manifest paths) still
re-throw/abort.
- A registry row with a null/unknown driver keeps the strict abort —
fail closed, since absence cannot be proven for it.
- `ORPHANED_SANDBOX_MARKER` / summary / remediation wording unchanged;
install.sh greps the marker only from the recovery-phase log, which this
change does not touch.

## Review responses

- **PR Review Advisor PRA-1** (revalidate absence before exempting the
gate): addressed by the confirming second pinned listing after the
backup loop plus per-candidate absence checks at skip time; new test
pins the reappeared-candidate revert.
- **PR Review Advisor PRA-2** (bound the workaround to its source fix):
addressed with the in-code source-of-truth review block (source boundary
/ fix constraint / removal condition).
- `reviewed-npm-audit` failure is upstream-wide (also fails on #7289)
and is being remediated by #7286; this PR adds no dependencies.

## Verification

- `vitest`: `maintenance.test.ts` (32), `stopped-sandbox-backup.test.ts`
(24), `orphan-detection.test.ts`, `upgrade-sandboxes-recovery.test.ts`,
`openshell-sandbox-list.test.ts` — 108 tests green; installer lane
`test/install-orphaned-sandbox-recovery.test.ts` (8, drives strict
backup through recovery and the real install.sh orphan grep) green;
`typecheck:cli`, `lint`, and `biome check` clean. The new maintenance
tests pin `GATEWAY_PORT` so they stay green under an exported
`NEMOCLAW_GATEWAY_PORT`.
- Live end-to-end on a workstation (real docker daemon, real registry
file, openshell CLI shimmed to a healthy empty gateway, real built CLI):
stranded record → warning + `0 skipped` + exit 0 under strict mode
(through both listings); same record bound to `gatewayPort: 9999` →
strict abort exit 1 with no orphan claim; same record with a labeled
container present → strict abort exit 1 with no orphan claim.

Refs #6520

Signed-off-by: Dongni Yang <dongniy@nvidia.com>

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved backup-all orphan handling: potentially stranded sandboxes
are skipped when their containers are definitively absent, then
rechecked with the same selected gateway before remediation occurs.
* Tightened strict-mode “fail closed” behavior for confirmed absent
containers, including mismatched-gateway scenarios and reappearing
candidates.
* Reduced false “container absent” results by treating Docker/registry
uncertainties as unknown rather than absent.
* **Tests**
* Expanded coverage for stranded-orphan detection and definitive
container absence (including fail-closed, reappearance, and
gateway-pinning scenarios) with improved Docker mock observability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->


## Takeover review response

- The PR Review Advisor handoff warning is addressed by an installer
boundary regression that drives strict `backup-all`, orphan recovery,
and the completed-with-warnings result in order.

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `no-docs-needed`
- Evidence: Reviewed the complete five-file diff at `71a02caebe9f`. No
documentation paths changed; existing docs already cover strict backup
and stranded-record recovery and remediation.
- Agent: Codex Desktop
- PR: #7290
<!-- docs-review-head-sha: 71a02ca -->
<!-- docs-review-agents-blob-sha:
560ff38 -->

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

---------

Signed-off-by: Dongni Yang <dongniy@nvidia.com>
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Co-authored-by: Charan Jagwani <cjagwani@nvidia.com>
Co-authored-by: Julie Yaunches <jyaunches@nvidia.com>