VDR 5 checklist: non-DGX findings and current-release verification

[sandl99]

VDR 5 checklist: non-DGX findings and current-release verification

This issue reconciles the non-DGX findings in Will Curran's July 8, 2026 VDR 5 progress update.

DGX Spark and DGX Station are tracked separately in #6743. This checklist covers Getting Started, New NemoClaw Setup, Local Models, Windows WSL + RTX, Brev, and the reference-only macOS, OpenClaw plugin, WSL2 ARM/N1X, Jetson, and migration findings.

The original evidence spans older releases, especially v0.0.55 and WSL v0.0.61. As of July 20, 2026, the newest semver tag is v0.0.88, and the maintained lkg tag points to the same commit. Verification should use the maintained current release available when each item is tested.

Status and validation rules

Every item begins unchecked, including items with related closed issues or merged PRs.

• [ ] means the exact VDR behavior still needs current-release reconciliation.
• Check an item only when the original behavior passes on the affected platform, code and tests directly cover it, or a maintainer records that it is no longer applicable or intentionally declined.
• A related closed issue or merged PR is evidence of progress, not by itself proof that the VDR finding is resolved.
• Record the tested release, platform, commands, result, and evidence when checking an item.
• macOS, plugin, N1X, Jetson, and migration were not rated or were descoped. Their presence here does not approve them as supported NemoClaw product surfaces.

Getting Started

• Verify public installer and release trust. The public one-line installer previously resolved to v0.0.55 while newer maintained builds existed. On a clean supported host, capture the resolved ref and nemoclaw --version; confirm they match the maintained lkg, the completion output exposes the installed version, and an explicit NEMOCLAW_INSTALL_TAG=<tag> pin works. Related: #4891, #5630, PR #5545. lkg is intentionally admin-promoted and may trail newest semver, so acceptance is maintained-channel trust rather than requiring lkg == latest.

• Verify one authoritative first-time prerequisite path. Users previously had to assemble Node.js, Docker, OpenShell, and platform preparation requirements from README and platform pages. Starting from the product page and README, confirm the main journey identifies mandatory prerequisites before expensive work and links to platform-specific preparation without conflicting instructions. Related: #1403, #4630, PR #5616.

• Verify the public NVIDIA product page links directly to canonical documentation. Confirm a new user can reach a current installation or Quickstart page without first navigating through GitHub. No exact tracker proving the external product-page route was found.

• Verify the host, sandbox, and two-terminal workflow. Quickstart must state where each command runs and explain that openshell term is a separate host terminal used for network approvals. Confirm the user can approve or deny and return to the original workflow. Related: #5082.

• Verify remote/dashboard discoverability. Complete onboarding over SSH and confirm completion output gives the local URL and copyable SSH forwarding command, the URL can be reprinted later, and Quickstart links to remote-dashboard guidance. Related: #20, #5084, #5925.

• Verify custom endpoint and policy usability. Add, list, update, and remove a custom HTTPS endpoint through supported NemoClaw surfaces. Errors must identify invalid fields and show valid examples; docs must distinguish temporary approval from persistent policy. Related: #2039, #2867, #5764, #991, #3590, #4510, and open #7178.

New NemoClaw Setup

• Verify interrupted public-install recovery. Interrupt before sandbox-name capture, after provider selection, and after sandbox creation. Rerunning must resume safely or print one valid --fresh recovery path without silently reusing an unrelated provider or sandbox. Related: #5627, #5719, #5720, PR #5487, PR #5642, PR #5690.

• Verify resume preserves completed choices. Interrupt after each onboarding section and confirm nemoclaw onboard --resume does not repeat sandbox-name, web-search, messaging, resource-profile, or other completed non-secret choices. Raw credentials must not be persisted. Related exact tracker: #6932.

• Verify default security/status messages are honest. On a fresh sandbox, run status, doctor, TUI, and OpenClaw security audit. Expected NemoClaw-managed defaults must not be presented as user misconfiguration, while actionable security failures remain prominent. Related: PR #5474, PR #5477, #3271.

• Verify gateway lifecycle and ownership. Start, stop, restart, destroy, reboot, and re-onboard. One component must clearly own the OpenShell gateway; commands must explain what stops, what remains, and how ports are released or recovered. Related open work: #6576, #6903, #7174; improvements: PR #5181, PR #5382.
  Remaining work: OpenShell persist after host reboot Install and uninstall a managed OpenShell gateway service for reboot persistence #6903

• Verify displayed prompt defaults. Press Enter at provider, resource-profile, messaging, policy, and confirmation prompts. Empty input must select the displayed default; prompts without defaults must explain what is required. Related: #4432, #4387, #5557.

• Verify host/sandbox file movement is discoverable and works. Find the NemoClaw upload, download, and sessions export commands through help/docs; confirm relative host paths resolve from the caller working directory and routine file movement does not require raw OpenShell commands. Related: PR #5201, PR #5509, #2631, #1045.

Local Models

• Reproduce the WSL Local Ollama full agent loop. Installation previously completed with green checks but the agent produced no reply and could show auto compaction could not recover this turn. Test supported Windows-host and WSL-hosted Ollama paths through TUI and dashboard, and require failures to identify Ollama, auth proxy, inference.local, model, or OpenClaw. Related: #336, #1472, #2770, #4421, PR #5508; related but non-identical open ARM64 case #3707.

• Verify express default model sizing. WSL express previously attempted llama3.3:70b, too large for the default machine. Confirm the default fits detected RAM/GPU/architecture, larger models require explicit choice, and size/headroom appears before download. Related: #2639, open #3707.

• Verify llama.cpp through the generic OpenAI-compatible path. Start a documented llama.cpp server, ensure onboarding does not misclassify it as vLLM, complete sandbox creation, and send inference from inside the sandbox. Failures must distinguish schema, model ID, reachability, and compatibility. Related: PR #5400, #5635, #5636, #5744. No exact llama.cpp E2E tracker was found.

• Verify the installed OpenClaw version contract. A new sandbox must match the OpenClaw version pinned by its NemoClaw release. Docs must explain that supported means the release pin, not necessarily upstream npm latest. Related: #2635 and the disposition in #6743.

Windows WSL + RTX

This was the highest-risk non-DGX row. The evidence was from WSL v0.0.61, not only stale .55 behavior.

• Docker Desktop is detected on the first preflight attempt. Distinguish daemon unavailable, WSL integration disabled, and permission failure. Related: PR #4330, PR #5198.

• Successful sandbox creation does not print fatal-looking transient gRPC NotFound/sandbox not found errors. Expected polling must be progress; terminal failures must stop with recovery. No exact tracker found.

• Docker GPU patch supervisor failures recover or fail once with action. Exercise reconnect delays and require bounded retry plus safe cleanup/resume. Related: PR #4668, #5512, #5180.

• License prompt accepts its documented input and has no typo. Test y, Y, yes, Enter, n, and no; remove license and and third-party software notice. No exact tracker found.

• No active forward found for port 18789 is neutral on first run. It should only be a warning when an expected forward is missing. Related dashboard contract: #2390.

• Mistyped sandbox names show close matches. nemoclaw my-assitant connect should suggest my-assistant without automatically selecting it. No exact tracker found.

• The WSL public installer reports and installs maintained lkg. Verify on a clean supported WSL distribution; current repository research found lkg aligned with v0.0.88.

• nemoclaw update gives a valid recovery command after failed onboarding. The exact suggested command must execute; do not recommend nemoclaw update --fresh if unsupported. Related: #5627, #5719, #5720.

• Windows-host Ollama produces real agent responses. Use the Local Models full-agent-loop acceptance criteria. Related closed connectivity fixes: #336, #1472, #2770, #4421.

• Inference-provider setup cannot hang indefinitely. Unreachable, slow, malformed, and auth-failing endpoints need bounded timeout, progress, secret-safe diagnostics, and retry/back/exit. Related: PR #5400, #2770.

• WSL express install selects a model appropriate for detected resources. Use the Local Models sizing criteria. Related: #2639, open #3707.

• Recommended Windows-host Ollama installation works without manual PowerShell repair. Verify download, signature, PATH, binding, startup, and enterprise-policy fallback. Related: #4066, #4208, #4421, open #6014.

• Dashboard token auto-auth works in headless WSL. Opening the completion/reprinted URL must not require manual token editing or expose secrets in logs. Related: #3573; no exact WSL tracker found.

• A supported command reprints the complete OpenClaw is ready block. It must show current Browser URL, terminal steps, authenticated dashboard URL, and management commands without restarting onboarding. dashboard-url is partial related work; no exact tracker found.

• Unsupported/untested WSL distributions are warned before expensive work. Detect distribution/version and give a supported alternative. No exact tracker found.

• All WSL post-install commands copy without a leading $. Related exact docs fix: #4754, PR #5045, PR #5247.

• Fresh default config has no uninstalled qqbot warning. Related exact all-platform tracker: #6000.

• Re-onboarding does not recreate the gateway or disrupt running sandboxes without approval. Keep one sandbox active while onboarding another; its inference, dashboard, and messaging must remain available. Related: #4520, open #6576.

• Measure and improve the 25–30 minute WSL cold install. Separate installer, image/model downloads, sandbox creation, OpenClaw setup, and validation; report progress for every long phase. Exact open tracker: #3990.

Brev

• Quickstart explicitly separates host provisioning, NemoClaw installation, onboarding, and sandbox creation. Users must not assume a sandbox exists when the Brev instance becomes ready. Related: #5084, PR #5247.

• Pressing Enter accepts the displayed Brev resource-profile default. Related: #4432, #4387, #5557.

• Explain or remove port assignment before any sandbox exists. Determine whether it belongs to a gateway, future forward, or stale resource; the UI must not imply a sandbox is already running. No exact tracker found.

• Measure the reported 8–10 minute Brev sandbox creation. Separate image pull, container creation, gateway, OpenClaw, inference validation, and dashboard delivery for cold and warm instances. Related: #2001, #1326, #1328, #1329.

• Reproduce Brev streaming latency. Compare direct provider time-to-first-token with NemoClaw gateway/router/sandbox/TUI delivery and prove tokens stream instead of buffering. Related: #2001; no exact current tracker found.

• Previous TUI messages remain visible across scroll, reconnect, restart, and dashboard/TUI switching. Related: #2603, #3145.

• Run a clean current-release Brev golden-path validation. Provision the documented SKU; install, onboard, infer, open dashboard, reconnect, stop/restart, and destroy; record version, SKU, durations, and failures. Related: #2634, #2425, open #6576, #6404.

Reference-only findings requiring a scope decision

Checking an item below may mean verified, moved into an accepted scoped issue, or explicitly retained out of scope.

macOS — VDR 5 descoped

• Verify Brave Search empty-input skip/back behavior. Related: #6025, #6032.
• Verify resource-profile defaults, CPU/RAM input clarity, and actionable Colima capacity errors. Related: #4432, #4387, #5557, #2514.
• Verify Colima guidance installs both Colima and Docker CLI. Exact tracker: #6028.
• Verify interrupted onboarding resumes from the last completed step. Related: #6932.
• Clarify that no NVIDIA GPU is acceptable for a basic Docker sandbox while local NIM/GPU acceleration requires one. No exact macOS tracker found.
• Verify supported stop/start lifecycle and prompt port release. Related: #5968, open #6903.
• Verify destroy no longer prints an unrecognized gateway subcommand before success. Related: #3212, #6569.
• Verify macOS installer follows maintained lkg and reports the installed version.
• Confirm selected messaging channels visibly, for example Selected: telegram. Related: PR #5535.
• Offer explicit None / No messaging channels. Related: #3471.
• Verify dashboard reachability does not depend on first prompting the TUI. Related: #2390.
• Remove duplicate license wording and verify prompt behavior. Exact wording fix: #7301, PR #7306; remaining abbreviated-input UX is tracked separately in open #7469 and PR #7471.
• Prevent or document zsh autocorrect noise suggesting .nemoclaw; retain as cosmetic unless prioritized.

OpenClaw plugin — not rated and descoped

• Record a maintainer product-scope decision defining ownership, lifecycle, compatibility, security, and validation before treating the in-sandbox plugin as supported.
• If accepted, verify openclaw nemoclaw discovery and registration inside the sandbox; VDR returned unknown command 'nemoclaw'.
• Explain host nemoclaw and in-sandbox plugin as distinct paths with explicit state ownership.
• Define OpenShell gateway vs OpenClaw/plugin gateway startup order and lifecycle authority.
• Synchronize plugin status with actual sandbox and inference state; do not report not running/configured while the system works.
• Replace stale build-time inference banner/config with current provider state.
• Define actionable /nemoclaw slash commands if this surface is supported.

No accepted issue was found that re-establishes this plugin as a supported product surface.

WSL2 ARM / N1X — not rated

• Record availability, artifact source, versioning, installation, security-update, and external-user support for the special ARM Ollama builds used in VDR testing.
• Decide whether full N1X validation is supported scope; if accepted, define OS, hardware, Ollama build, model, performance target, validation owner, and E2E coverage. Related but non-comprehensive open issue: #3707.

Jetson — VDR 5 descoped

• Make unsupported-JetPack warning state concrete implications, supported alternatives, and whether onboarding should continue.
• Verify default config emits no irrelevant qqbot warning. Related: #6000.
• Ensure CLI is immediately on PATH or print clean refresh commands without $. Related: #2868, #4754, PR #5045.
• Improve progress visibility for the reported approximately 17-minute install.
• Offer explicit None / No messaging channels. Related: #3471.
• Give an immediate first-chat handoff with supported connect/TUI commands and where they run. Related: #755.
• Verify current Jetson GPU detection/passthrough E2E coverage. Related: PR #5613.

Existing OpenClaw migration — descoped

• Record a product-scope decision covering ownership, compatibility, secrets, rollback, extensions, sessions, and lifecycle.
• If accepted, implement and verify non-dry-run blueprint acquisition; VDR dry-run succeeded but real migration failed because fetchBlueprint was unimplemented.
• If accepted, verify plugin discovery before offering openclaw nemoclaw migrate.
• If accepted, document a safe fallback/manual path for configuration, sessions, extensions, and hooks.

No accepted migration issue or design decision establishing this supported surface was found.

Completion evidence

• Every checked item links to current-release evidence, an exact fixing PR/test, or an explicit maintainer disposition.
• Platform-specific findings record OS, architecture, hardware, container runtime, inference provider, and release.
• Related improvements are not treated as proof unless they cover the original reproduction.
• Descoped sections have explicit scope decisions and are not documented as supported accidentally.
• Remaining actionable failures have dedicated issues with owners and acceptance criteria.
• Duplicate findings point to one canonical issue.
• Final summary distinguishes fixed, verified, not reproducible, duplicate, declined, descoped, and still open.

[hunglp6d]

[Getting Started]
Verify remote/dashboard discoverability - resolved

Fixed by #5929 (fixes #5925) in v0.0.78; code + unit tests present on current v0.0.88:

• Onboard output appends a copy-paste SSH forward hint when run inside an SSH session with the dashboard on loopback — reprintable via nemoclaw <sandbox> dashboard-url.
• Quickstart (docs/get-started/quickstart.mdx) documents the ssh -L <port>:127.0.0.1:<port> <user>@<host> command and cross-links Remote Dashboard Access.

Platform-independent by construction — gated on SSH_CONNECTION, no platform branch (ssh-forward-hint.ts; unit tests assert the output), so it holds on any non-DGX remote host. Ready-summary output:

  Remote access (SSH session detected):
    On your workstation, run:
      ssh -L 18790:127.0.0.1:18790 name@<host>
    Then open the dashboard URL above in your local browser.

<user> auto-fills; <host> is a placeholder by design (SSH_CONNECTION can't recover a ~/.ssh/config alias, -p, or ProxyJump). Related #20 (reachable bind + device-auth) and #5084 (remote-GPU doc) both closed.

[hunglp6d]

[Getting Started]
Verify custom endpoint and policy usability - resolved

Custom-endpoint CRUD works through NemoClaw surfaces; no drop to raw openshell needed:

• Add — policy-add takes built-in presets and custom YAML via --from-file ([CLI] nemoclaw policy-add has no custom-preset surface; custom egress targets require dropping to openshell policy set #2039); generated policy carries the required version field ([Linux] nemoclaw policy-add fails: missing version field in generated policy YAML #991).
• List — policy-list reflects applied custom presets accurately in policy-list and status (policy-list reports custom preset as inactive while active policy enforces it #3590, [Ubuntu 24.04][Policy] policy-add --from-file exits 0 but custom preset is absent from policy-list and status #4510).
• Update — change a custom preset by remove + re-add (policy-add no-ops on an already-applied preset); custom inference endpoints re-point via nemoclaw inference set.
• Remove — policy-remove removes applied/custom presets.
• Errors — invalid policy YAML now fails with the specific missing field rather than a raw parse dump ([Linux] nemoclaw policy-add fails: missing version field in generated policy YAML #991).
• Docs — reference/network-policies.mdx distinguishes temporary session approval ("added to the running policy for the session") from persistent policy (baseline + presets); customize-network-policy.mdx round-trip fixed ([All Platforms][Docs] NemoClaw Customize Network Policy — openshell policy set command fails as documented #5764); guided integration examples added (VDR 4: Common integration policy setup lacks guided examples #2867).

Out of scope for this item: #7178 tracks persistent exclusion of a built-in baseline entry (a distinct capability, accepting reduced support) — not custom-endpoint removal — so it does not gate this item.

[sandl99]

[Getting Started]
Verify one authoritative first-time prerequisite path — resolved

Verified on 2026-07-22:

• The README directs first-time users to the canonical Prerequisites page before the agent-specific Quickstarts.
• Prerequisites consolidates hardware minimums, Node.js, npm, Docker, the OpenShell lifecycle, platform status, and required Windows and DGX Station preparation.
• Quickstart repeats “Review the Prerequisites before you begin” before its install procedure.
• Platform support is generated from the canonical ci/platform-matrix.json, keeping setup guidance and support claims aligned.
• The product page’s direct installer is intentional and relies on installer preflight. Direct product-page documentation routing is tracked separately by the next VDR checklist item.

No conflicting supported-platform prerequisite instructions were found. #1403 and #4630 are relevant supporting work. PR #5616 updates architecture references and is not prerequisite-path evidence.

[sandl99]

[Getting Started]
Direct product-page link to canonical documentation — intentionally declined

Maintainer disposition on 2026-07-22: keep the current product-page journey by design.

The NVIDIA NemoClaw product page is intentionally install-first: it provides agent-specific installer commands and Brev “Try It Now” paths. Users who choose the repository route reach the canonical NemoClaw documentation, prerequisites, and Quickstarts from the README.

A separate direct product-page link to a NemoClaw Quickstart is not required for this journey, and no external product-page change is requested. Closing this checklist item as intentionally declined rather than verified.

[sandl99]

[Getting Started]
Host, sandbox, and two-terminal workflow — intentionally declined as a Quickstart requirement

Maintainer disposition on 2026-07-22: keep the current documentation split by design.

The Quickstart should remain focused on installation, onboarding, sandbox connection, and the first agent prompt. The detailed network-approval workflow belongs on the dedicated Approve or Deny Agent Network Requests page.

That page now documents the host context, local and remote openshell term paths, sandbox selection, approve and reject controls, and session persistence. #5082 was verified and closed for those corrections. A second terminal is an optional convenience when keeping the agent TUI open, not a mandatory Quickstart step.

Closing this checklist item as intentionally declined by design rather than requiring the approval procedure to be duplicated in Quickstart.