From c8d181c809e2397d3f8438a2475d5aa0adabf690 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 04:45:35 +0000 Subject: [PATCH 1/3] docs: catch up after main Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- docs/changelog/2026-10-20.mdx | 3 +++ docs/inference/understand-provider-validation.mdx | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/docs/changelog/2026-10-20.mdx b/docs/changelog/2026-10-20.mdx index bd7e949e3b3..16ec405d8b2 100644 --- a/docs/changelog/2026-10-20.mdx +++ b/docs/changelog/2026-10-20.mdx @@ -34,3 +34,6 @@ It also improves uninstall recovery, managed image security, policy recovery, ag Existing sandboxes retain their prior images until rebuilt; after updating NemoClaw, run `nemoclaw upgrade-sandboxes` to inspect or rebuild them. A selected Podman runtime no longer triggers Docker host setup, Docker preflight checks, or Docker-only NIM cleanup. Related change: [PR #13513](https://github.com/NVIDIA/NemoClaw/pull/13513). +- After it attaches a provider that uses a verified OpenShell provider profile, NemoClaw verifies the profile again. + If the profile changed or the check cannot complete, the attachment remains and NemoClaw warns the gateway operator to inspect the profile. + Related change: [PR #13557](https://github.com/NVIDIA/NemoClaw/pull/13557). diff --git a/docs/inference/understand-provider-validation.mdx b/docs/inference/understand-provider-validation.mdx index 00cf1750b00..5911c01230e 100644 --- a/docs/inference/understand-provider-validation.mdx +++ b/docs/inference/understand-provider-validation.mdx @@ -27,6 +27,12 @@ The `nvapi-` prefix check applies only to `NVIDIA_INFERENCE_API_KEY`. OpenRouter keys must be non-empty and begin with `sk-or-`. Other provider keys use provider-aware validation during the retry flow. +## Provider Profile Verification + +When NemoClaw attaches a provider after it verifies the expected OpenShell provider profile, it verifies that profile again. +If the profile changed or the second verification cannot complete, the attachment remains in place and NemoClaw prints a warning. +Ask the gateway operator to inspect the profile before you rely on its credential boundary. + ## Provider Requests NemoClaw sends a provider-specific request that exercises the API surface intended for the route. From 1c01a45e0672f441168e1d72da77da3115e454ad Mon Sep 17 00:00:00 2001 From: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Date: Tue, 20 Oct 2026 22:34:16 -0700 Subject: [PATCH 2/3] docs: link provider verification release change Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> --- docs/changelog/2026-10-20.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/changelog/2026-10-20.mdx b/docs/changelog/2026-10-20.mdx index 16ec405d8b2..f8ca36fd2b9 100644 --- a/docs/changelog/2026-10-20.mdx +++ b/docs/changelog/2026-10-20.mdx @@ -36,4 +36,4 @@ It also improves uninstall recovery, managed image security, policy recovery, ag Related change: [PR #13513](https://github.com/NVIDIA/NemoClaw/pull/13513). - After it attaches a provider that uses a verified OpenShell provider profile, NemoClaw verifies the profile again. If the profile changed or the check cannot complete, the attachment remains and NemoClaw warns the gateway operator to inspect the profile. - Related change: [PR #13557](https://github.com/NVIDIA/NemoClaw/pull/13557). + Related change: [PR #13564](https://github.com/NVIDIA/NemoClaw/pull/13564). From c52aed19ab37e57ede5497a9df5225b390d5933e Mon Sep 17 00:00:00 2001 From: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Date: Tue, 20 Oct 2026 22:47:54 -0700 Subject: [PATCH 3/3] docs: scope native local profile verification Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> --- docs/changelog/2026-10-20.mdx | 4 ++-- docs/inference/understand-provider-validation.mdx | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/changelog/2026-10-20.mdx b/docs/changelog/2026-10-20.mdx index f8ca36fd2b9..136883ef98e 100644 --- a/docs/changelog/2026-10-20.mdx +++ b/docs/changelog/2026-10-20.mdx @@ -34,6 +34,6 @@ It also improves uninstall recovery, managed image security, policy recovery, ag Existing sandboxes retain their prior images until rebuilt; after updating NemoClaw, run `nemoclaw upgrade-sandboxes` to inspect or rebuild them. A selected Podman runtime no longer triggers Docker host setup, Docker preflight checks, or Docker-only NIM cleanup. Related change: [PR #13513](https://github.com/NVIDIA/NemoClaw/pull/13513). -- After it attaches a provider that uses a verified OpenShell provider profile, NemoClaw verifies the profile again. - If the profile changed or the check cannot complete, the attachment remains and NemoClaw warns the gateway operator to inspect the profile. +- Native local provider attachment now retains the expected OpenShell profile verified during inspection so NemoClaw can check it again after attachment. + A changed profile, failed export, or timeout warns the gateway operator without rolling back a successful attachment. Related change: [PR #13564](https://github.com/NVIDIA/NemoClaw/pull/13564). diff --git a/docs/inference/understand-provider-validation.mdx b/docs/inference/understand-provider-validation.mdx index 5911c01230e..3e2bbdfd4f6 100644 --- a/docs/inference/understand-provider-validation.mdx +++ b/docs/inference/understand-provider-validation.mdx @@ -27,10 +27,10 @@ The `nvapi-` prefix check applies only to `NVIDIA_INFERENCE_API_KEY`. OpenRouter keys must be non-empty and begin with `sk-or-`. Other provider keys use provider-aware validation during the retry flow. -## Provider Profile Verification +## Native Local Provider Profile Verification -When NemoClaw attaches a provider after it verifies the expected OpenShell provider profile, it verifies that profile again. -If the profile changed or the second verification cannot complete, the attachment remains in place and NemoClaw prints a warning. +During native local endpoint onboarding, NemoClaw retains the expected OpenShell provider profile after a successful inspection and checks it again after attaching the provider. +If the profile changed or the follow-up export fails or times out, NemoClaw warns the gateway operator without rolling back the attachment. Ask the gateway operator to inspect the profile before you rely on its credential boundary. ## Provider Requests