docs: complete post-tag audit fixes

[miyoungc]

Summary

Completes the v0.0.93 and v0.0.94 post-tag documentation audit.
The change corrects platform guidance and moves oversized Network Policy, Gmail, and Deep Agents trace-export content into focused canonical pages while preserving existing public routes and compatibility anchors.

Changes

• Correct the Intel Mac source citation in the platform matrix and generated Platform Support page.
• Add managed-vLLM host eligibility and wrong-platform fail-fast behavior to the model table.
• Replace the Network Policy customization monolith with a stable-route chooser and focused OpenClaw and Hermes pages for baseline changes, presets, raw TLS, live replacement, and agent context.
• Move the Gmail App Password workflow into its own OpenClaw and Hermes page.
• Move Deep Agents trace export into separate Understand, Set Up, Verify, and Manage pages under Deep Agents Monitoring.
• Preserve published routes and compatibility anchors, update navigation and inbound links, and add route and ownership tests.
• Apply the NemoClaw writing rules to the advisory and all changed documentation.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop documentation writer reviewed the policy, credential, observability, inference, and agent-variant boundaries on 53b026370f4b26e3591560911088b5235e465b4e and returned PASS.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence:
  • ci/platform-matrix.json, docs/reference/platform-support.mdx, and docs/inference/set-up-vllm.mdx
  • docs/network-policy/customize-network-policy.mdx, docs/network-policy/integration-policy-examples.mdx, and the seven new focused Network Policy pages
  • docs/get-started/quickstart-langchain-deepagents-code.mdx and the four new docs/monitoring/*deepagents-trace-export.mdx pages
  • docs/security/advisory-early-warning.md, docs/security/credential-storage.mdx, docs/reference/commands.mdx, and docs/reference/network-policies.mdx
  • docs/index.yml and the migrated changelog links under docs/changelog/
  • The exact-head merge review confirmed that the advisory preserves cveId, hermetic --inventory, NVD reconciliation, and the fix(images): backport historical OpenClaw security patches #7276 postmortem, and that the Deep Agents compatibility route remains intact.
  • The exact-head follow-up review confirmed the clarification that --nvd-records reads previously fetched files and that the planned scheduled workflow owns fetching after Detect public advisories before reviewed ecosystem mappings reach scanners #7338 sign-off.
  • The final exact-head review confirmed the bounded Gmail IMAP example and the generated OpenClaw and Hermes policy-command anchors.
  • The subagent reviewed docs/CONTRIBUTING.md and WRITING.md, including terminology, structure, voice, code samples, variants, navigation, routes, and compatibility anchors.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/generate-platform-docs.test.ts test/network-policies-published-routes.test.ts test/deepagents-monitoring-published-routes.test.ts test/policy-roundtrip-docs.test.ts test/check-docs-published-routes.test.ts test/check-docs-links.test.ts passed 72 tests.
• Exact-head merge checks pass — the six advisory, NVD, route, policy, and platform Vitest files passed 125 tests; npm run docs, normal hooks, and diff checks passed.
• Exact-head review follow-up checks pass — the advisory and NVD Vitest files passed 93 tests; npm run docs, normal hooks, and diff checks passed.
• Final exact-head checks pass — the Network Policy route and round-trip tests passed 9 tests; npm run docs, variant generation, normal hooks, and diff checks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
  Result: npm run docs passed with 0 errors and one pre-existing Fern light-mode accent contrast warning.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

• Documentation
  • Added setup, verification, management, and conceptual guides for Deep Agents trace export.
  • Expanded network policy guidance, including presets, custom policies, live replacement, TLS passthrough, Gmail integration, and agent-facing explanations.
  • Updated navigation and cross-references to make policy and monitoring workflows easier to find.
  • Streamlined the Deep Agents quickstart with links to dedicated monitoring documentation.
  • Clarified managed-model host compatibility and Intel Mac platform limitations.
  • Refined security advisory guidance and changelog references.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e14123b0-6f43-4b14-9812-1bf6fa70038e

📥 Commits

Reviewing files that changed from the base of the PR and between ee9836c and 53b0263.

📒 Files selected for processing (1)

• docs/network-policy/set-up-gmail-with-an-app-password.mdx

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/network-policy/set-up-gmail-with-an-app-password.mdx

---

📝 Walkthrough

Walkthrough

The PR reorganizes network-policy and Deep Agents trace-export documentation into dedicated workflows, updates navigation and route tests, refreshes changelog and reference links, and clarifies platform, model-host, and security documentation.

Changes

Documentation and support updates

Layer / File(s)	Summary
Deep Agents trace-export documentation docs/monitoring/*, docs/get-started/quickstart-langchain-deepagents-code.mdx, docs/reference/*, docs/security/credential-storage.mdx, docs/index.yml	Adds setup, understanding, verification, and management guides for Deep Agents trace export, replacing embedded quickstart guidance with dedicated links.
Network-policy workflows and references docs/network-policy/*, docs/index.yml	Adds dedicated workflows for presets, baseline changes, TLS passthrough, live replacement, agent explanations, and Gmail setup while condensing the customization overview.
Published-route and round-trip validation test/*published-routes.test.ts, test/policy-roundtrip-docs.test.ts	Validates new monitoring and policy routes, compatibility links, retained anchors, and updated document extraction boundaries.
Support, security, and release references ci/platform-matrix.json, docs/changelog/*, docs/inference/set-up-vllm.mdx, docs/reference/platform-support.mdx, docs/security/advisory-early-warning.md	Updates changelog links and clarifies Intel Mac rejection, model host-profile failures, advisory correlation, and provenance wording.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7468: Updates overlapping v0.0.94 network-policy changelog links.

Suggested labels: chore

Suggested reviewers: prekshivyas, cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the docs-focused changes and accurately summarizes the PR as completing post-tag audit fixes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/post-tag-docs-all-fixes

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 53b0263 in the codex/post-tag-docs-... branch remains at 96%, unchanged from commit 1c7c893 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 53b0263 in the codex/post-tag-docs-... branch remains at 80%, unchanged from commit c737a2c in the main branch.

Show a code coverage summary of the most impacted files.

File	main c737a2c	codex/post-tag-docs-... 53b0263	+/-
src/lib/platform.ts	89%	84%	-5%
src/lib/state/m...-acquisition.ts	89%	87%	-2%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/securit...ntial-filter.ts	93%	93%	0%
src/lib/state/m...ock-identity.ts	95%	95%	0%
src/lib/trace.ts	94%	94%	0%
src/lib/state/g...way-registry.ts	94%	95%	+1%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 24, 2026 21:01 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7495.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard

1 optional E2E recommendation

• docs-validation

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

docs/network-policy/set-up-gmail-with-an-app-password.mdx (1)

89-89: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add a timeout to the IMAP connection, matching the SMTP example.

The SMTP script in this same guide uses smtplib.SMTP_SSL(..., timeout=30), but imaplib.IMAP4_SSL("imap.gmail.com", 993) here has no timeout. Python's imaplib.IMAP4_SSL supports an optional timeout keyword (since 3.9); without it, an unresponsive server can hang the script indefinitely.

⏱️ Proposed fix

-with imaplib.IMAP4_SSL("imap.gmail.com", 993) as mailbox:
+with imaplib.IMAP4_SSL("imap.gmail.com", 993, timeout=30) as mailbox:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/network-policy/set-up-gmail-with-an-app-password.mdx` at line 89, Update
the IMAP4_SSL connection in the guide to pass a 30-second timeout, matching the
existing SMTP_SSL example, while preserving the current Gmail host and port.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/network-policy/apply-policy-presets.mdx`:
- Line 107: Update the Commands link target in apply-policy-presets.mdx to use
the generated anchor fragment nemoclaw-name-policy-add without the literal
dollar-sign prefix, while preserving the existing reference path and link text.

---

Nitpick comments:
In `@docs/network-policy/set-up-gmail-with-an-app-password.mdx`:
- Line 89: Update the IMAP4_SSL connection in the guide to pass a 30-second
timeout, matching the existing SMTP_SSL example, while preserving the current
Gmail host and port.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6a1239ab-7d63-425c-926f-300be8cd2c69

📥 Commits

Reviewing files that changed from the base of the PR and between fd07634 and 7f7f8c0.

📒 Files selected for processing (35)

• ci/platform-matrix.json
• docs/changelog/2026-06-08.mdx
• docs/changelog/2026-06-11.mdx
• docs/changelog/2026-06-28.mdx
• docs/changelog/2026-07-01.mdx
• docs/changelog/2026-07-04.mdx
• docs/changelog/2026-07-08.mdx
• docs/changelog/2026-07-09.mdx
• docs/changelog/2026-07-12.mdx
• docs/changelog/2026-07-14.mdx
• docs/changelog/2026-07-24.mdx
• docs/get-started/quickstart-langchain-deepagents-code.mdx
• docs/index.yml
• docs/inference/set-up-vllm.mdx
• docs/monitoring/manage-deepagents-trace-export.mdx
• docs/monitoring/set-up-deepagents-trace-export.mdx
• docs/monitoring/understand-deepagents-trace-export.mdx
• docs/monitoring/verify-deepagents-trace-export.mdx
• docs/network-policy/apply-policy-presets.mdx
• docs/network-policy/change-baseline-network-policy.mdx
• docs/network-policy/configure-raw-tls-passthrough.mdx
• docs/network-policy/create-custom-policy-presets.mdx
• docs/network-policy/customize-network-policy.mdx
• docs/network-policy/explain-network-policy-to-agents.mdx
• docs/network-policy/integration-policy-examples.mdx
• docs/network-policy/replace-live-network-policy.mdx
• docs/network-policy/set-up-gmail-with-an-app-password.mdx
• docs/reference/commands.mdx
• docs/reference/network-policies.mdx
• docs/reference/platform-support.mdx
• docs/security/advisory-early-warning.md
• docs/security/credential-storage.mdx
• test/deepagents-monitoring-published-routes.test.ts
• test/network-policies-published-routes.test.ts
• test/policy-roundtrip-docs.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security/advisory-early-warning.md`:
- Around line 150-153: Update the “Reviewed-mapping delay” paragraph to state
that the correlation path reads file-based NVD responses supplied through the
--nvd-records input, rather than fetching NVD records itself. Clarify that the
scheduled workflow will perform the fetch and pass those records to the CLI,
while preserving the existing six-hour cadence and `#7338` sign-off gating.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6135f105-b11f-4372-b38b-673f8980bbb9

📥 Commits

Reviewing files that changed from the base of the PR and between 7f7f8c0 and 13f8e46.

📒 Files selected for processing (2)

• docs/get-started/quickstart-langchain-deepagents-code.mdx
• docs/security/advisory-early-warning.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/get-started/quickstart-langchain-deepagents-code.mdx