NemoClaw v0.0.73 tightens the line between endpoint validation and runtime use. DNS-backed HTTPS endpoints now fail closed when peer pinning cannot survive the OpenShell boundary, while ordinary Linux GPU onboarding takes the native OpenShell route and retains a hardened compatibility fallback for WSL and Jetson.

Day-two workflows are more resilient. Pre-upgrade backup can explicitly skip unreachable sandboxes for validated restore, terminal runtimes reject unsupported messaging policies before disclosure, and LangChain Deep Agents Code keeps inference.local on its managed proxy across interactive, login-shell, direct-exec, and connect-probe paths.

The release also makes setup and shipping easier to audit. Documentation adds an agent-first installation prompt and practical recovery references, while maintainer workflow now requires docs-before-tag and an exact-SHA E2E evidence ledger before confirmation.

Endpoint and runtime security

• #6139 rejects DNS-backed HTTPS endpoints before downstream handoff when NemoClaw cannot preserve the validated peer across the runtime boundary. Public HTTP endpoints continue to use DNS-pinned IP URLs and HTTPS IP literals remain supported. This closes the DNS-rebinding gap conservatively without introducing a partial host-local proxy; it carries forward the narrow safety outcome identified by @1PoPTRoN in #4685.

GPU onboarding and upgrade recovery

• #6142 routes ordinary native CDI Linux through OpenShell's native GPU injection instead of the legacy container swap. WSL, Jetson, and explicitly forced legacy runs retain the compatibility path, now with stricter supervisor boundaries, bounded redacted diagnostics, and safer rollback so failed recreation does not strand the original sandbox.
• #6199 adds NEMOCLAW_SKIP_UNREACHABLE_SANDBOX_BACKUP=1 for running sandboxes whose in-sandbox SSH endpoint cannot answer. This lets installer-driven upgrades continue and recover from the latest validated backup instead of looping forever, while keeping the potentially lossy skip explicit.

Deep Agents Code and agent boundaries

• #6197 rejects messaging-channel policy presets on terminal runtimes that have no inbound messaging gateway. The gate runs before endpoint disclosure, confirmation, or mutation, keeping policy-add aligned with the existing agent-aware channels add boundary.
• #6204 and #6206 restore LangChain Deep Agents Code access to inference.local through OpenShell's managed proxy. Root-owned proxy inputs, normalized proxy variables, cleared inherited ALL_PROXY state, stricter route probes, and expanded secret-pattern parity keep login-shell, direct-exec, and connect flows working without persisting credential-bearing proxy state. Existing Deep Agents Code sandboxes should be rebuilt to receive the corrected image scripts.

Documentation and agent-first setup

• #6213 adds focused recovery guidance for Homebrew Colima, Cursor on Windows, stale Kubernetes namespaces, gateway startup ordering, and stopped containers, plus a consolidated Host Files and State reference. This gives operators a clearer recovery ladder and explains which registry and backup state survives uninstall.
• #6216 adds an agent-first installation path to the docs front door and quickstarts. One shared, trust-bounded prompt now powers both the copy button and manual fallback, making NemoClaw easier to install through local coding agents without duplicating or drifting the instructions.

Release confidence

• #6205 and #6208 make release preparation explicit and auditable: user-facing docs must be refreshed before planning, and every E2E execution declared by the frozen candidate workflow needs green evidence or an itemized maintainer exception before tag confirmation. This reduces silent docs drift and prevents a moving candidate from inheriting stale test evidence.

Thank you

Thank you to external contributor @1PoPTRoN for the original DNS-rebinding analysis and implementation work in #4685, whose focused safety outcome was replayed in #6139 for this release.