NVIDIA · miyoungc · Jul 24, 2026 · Jul 24, 2026 · Jul 24, 2026 · Jul 24, 2026
diff --git a/ci/platform-matrix.json b/ci/platform-matrix.json
@@ -231,7 +231,7 @@
     {
       "name": "Intel Mac (macOS x86_64)",
       "status": "unsupported",
-      "notes": "OpenShell does not publish macOS x86_64 standalone gateway assets. Install hard-fails on x86_64 macOS (`scripts/install-openshell.sh:689`). See issue #954 (closed)."
+      "notes": "OpenShell does not publish macOS x86_64 standalone gateway assets. The top-level installer rejects Intel Mac hosts before release-ref resolution or downloads (`install.sh:108`), and the OpenShell installer retains a downstream asset guard (`scripts/install-openshell.sh:689`). See issue #954 (closed)."
     },
     {
       "name": "Non-Ubuntu/Debian Linux distros",

diff --git a/docs/changelog/2026-06-08.mdx b/docs/changelog/2026-06-08.mdx
@@ -9,7 +9,7 @@ NemoClaw v0.0.61 improves sandbox network visibility, onboarding recovery, Herme
 
 - Agents and operators can inspect a redacted policy context that lists active presets, allowed host categories, approval paths, and policy drift states.
   Strict SSRF fetches now route through the sandbox proxy, stale `sandboxes.json` locks held by recycled PIDs are reclaimed, and dashboard tool-scope approvals can recover through doctor after sandbox startup.
-  For more information, refer to [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy).
+  For more information, refer to [Explain Network Policy to Agents](/user-guide/openclaw/network-policy/explain-network-policy-to-agents).
 - Sandbox hardening now caps open file descriptors at entrypoint, preserves the tunnel service PID directory across restarts, and keeps build-time plugin install state from forcing runtime npm calls offline.
   NemoClaw also closed coordinated code-scanning findings and consolidated HTTP probe policy handling without changing the operator contract.
   For more information, refer to [Security Best Practices](/user-guide/openclaw/security/best-practices).

diff --git a/docs/changelog/2026-06-11.mdx b/docs/changelog/2026-06-11.mdx
@@ -8,7 +8,7 @@
 NemoClaw v0.0.64 improves sandbox restore, onboarding stability, inference routing, messaging setup, and release validation:
 
 - Snapshot restore preserves custom policy presets applied with `policy-add --from-file` or `policy-add --from-dir`, so restored sandboxes keep the custom egress rules that were recorded with the source sandbox.
-  For more information, refer to [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots) and [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy).
+  For more information, refer to [Create and Restore Snapshots](/user-guide/openclaw/manage-sandboxes/state-and-backups/create-and-restore-snapshots) and [Create Custom Policy Presets](/user-guide/openclaw/network-policy/configure-policies/create-custom-policy-presets).
 - OpenClaw onboarding keeps Brave Search pinned to the NemoClaw-managed runtime and preserves the `BRAVE_API_KEY` placeholder through build doctor.
   Docker-driver gateway health checks now follow the entrypoint path that actually launches the in-container gateway, which avoids misleading health reports on host-gateway setups.
   For more information, refer to [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).

diff --git a/docs/changelog/2026-06-28.mdx b/docs/changelog/2026-06-28.mdx
@@ -27,4 +27,4 @@ NemoClaw v0.0.69 improves sandbox recovery, Deep Agents Code workflows, Hermes m
   For more information, refer to [Security Best Practices](/user-guide/openclaw/security/best-practices), [Credential Storage](/user-guide/openclaw/security/credential-storage), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Monitor Sandbox Activity](/user-guide/openclaw/monitoring/monitor-sandbox-activity).
 - Documentation and release gates now cover more policy, approval, and live validation paths.
   The docs include clearer policy round-trip and network-request approval examples, while the live release gates distinguish public NVIDIA API keys from hosted inference keys and exercise Deep Agents Code terminal behavior more directly.
-  For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy), and [Approve or Deny Agent Network Requests](/user-guide/openclaw/network-policy/approve-network-requests).
+  For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy), and [Approve or Deny Agent Network Requests](/user-guide/openclaw/network-policy/approve-network-requests).
diff --git a/docs/changelog/2026-07-01.mdx b/docs/changelog/2026-07-01.mdx
@@ -18,7 +18,7 @@ NemoClaw v0.0.72 improves installer recovery, sandbox diagnostics, inference set
   For more information, refer to [Choose an Inference Provider](/user-guide/openclaw/inference/learn-and-choose/choose-inference-provider), [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers), and [Security Best Practices](/user-guide/openclaw/security/best-practices).
 - Custom policy and sandbox credential boundaries are tighter.
   User-supplied custom presets reject `allowed_ips` except the explicit host bridge, OpenClaw processes receive `AWS_EC2_METADATA_DISABLED=true`, Hermes runtime configuration output masks API key fields, and `exec` restores mutable OpenClaw config permissions after one-shot commands.
-  For more information, refer to [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy), [Security Best Practices](/user-guide/openclaw/security/best-practices), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
+  For more information, refer to [Create Custom Policy Presets](/user-guide/openclaw/network-policy/configure-policies/create-custom-policy-presets), [Security Best Practices](/user-guide/openclaw/security/best-practices), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - Runtime repair covers more sandbox-specific drift.
   OpenClaw gateway watchdog exits respawn the gateway instead of ending PID 1, Hermes upgrade checks compare agent versions in the Hermes runtime scheme, Tavily access is restored for managed Python workflows, and prompt-stdin EOF during onboarding is treated as cancellation.
   For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), [Common NemoClaw Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
diff --git a/docs/changelog/2026-07-04.mdx b/docs/changelog/2026-07-04.mdx
@@ -9,7 +9,7 @@ NemoClaw v0.0.74 upgrades the OpenShell policy boundary, adds managed MCP and pr
 
 - Stable installs pin OpenShell `0.0.72` release artifacts and the supervisor image, adding MCP Streamable HTTP and JSON-RPC request-policy enforcement.
   Policy mutations read the round-trippable base policy instead of the effective policy, which preserves existing MCP rules without sending provider-composed `_provider_*` entries back through `policy set`.
-  For more information, refer to [OpenShell 0.0.72 Compatibility Review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review) and [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy).
+  For more information, refer to [OpenShell 0.0.72 Compatibility Review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review) and [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy).
 - Managed MCP commands use `add`, `list`, `status`, `restart`, and `remove` to manage authenticated HTTPS Streamable HTTP servers for OpenClaw, Hermes, and experimental LangChain Deep Agents Code through native OpenShell policy enforcement and provider-backed credential replacement.
   The LangChain Deep Agents Code rebuild path validates the recorded gateway, route, image, staged build context, and prepared replacement inputs before deleting the previous sandbox, then restores managed MCP state after the recreated runtime is ready.
   For more information, refer to [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers), [Quickstart with LangChain Deep Agents Code](/user-guide/deepagents/get-started/quickstart), and the [accepted architecture decision](https://github.com/NVIDIA/NemoClaw/issues/566#issuecomment-4847534784).
@@ -25,7 +25,7 @@ NemoClaw v0.0.74 upgrades the OpenShell policy boundary, adds managed MCP and pr
   On Windows on Arm N1X systems, automatic Local Ollama setup treats the integrated GPU as compute-constrained and selects `qwen3.5:9b` instead of the 30B and 35B starter models.
   For more information, refer to [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Install OpenClaw Plugins](/user-guide/openclaw/manage-sandboxes/install-openclaw-plugins), [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server), [Prepare Windows for NemoClaw](/user-guide/openclaw/get-started/additional-setup/windows-preparation), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
 - Messaging configuration now keeps channel policy ownership with the enabled channel, persists selected policy presets through onboarding and rebuilds, reports Telegram mention mode in channel status, and detects credential conflicts before a destructive rebuild starts.
-  For more information, refer to [Choose Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/choose-messaging-channels), [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
+  For more information, refer to [Choose Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/choose-messaging-channels), [Apply Policy Presets](/user-guide/openclaw/network-policy/configure-policies/apply-policy-presets), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - Day-two commands provide safer recovery and clearer automation behavior.
   `update --fresh` can reinstall the current version, and `destroy --force` can remove a local record when the OpenShell gateway is unavailable while warning that the sandbox and retained volume may still exist.
   Failed `exec` commands can surface recent policy-denial context, tunnel stop releases its gateway port, WSL keeps a usable loopback dashboard URL, and affected CLI user-error surfaces preserve a nonzero exit status.

diff --git a/docs/changelog/2026-07-08.mdx b/docs/changelog/2026-07-08.mdx
@@ -24,7 +24,7 @@ NemoClaw v0.0.78 adds opt-in thread-scoped auto-approval and policy-routed repos
   For more information, refer to [Choose a Local Inference Server](/user-guide/openclaw/inference/local-inference/choose-local-inference-server) and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
 - New `nemoclaw <name> policy-get` output provides validated base-policy YAML suitable for review, editing, and reapplication, while `--raw` preserves the metadata-bearing response for diagnostics.
   The plugin registration banner now uses stderr, and `agents apply` tolerates warning-prefixed and wrapped JSON so command stdout remains usable by automation.
-  For more information, refer to [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy), [Common Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
+  For more information, refer to [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy), [Common Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - Rebuild now prints redacted managed MCP destroy diagnostics before backup or deletion, recovers prepared-only transactions through `mcp remove --force`, and lets an explicit `rebuild --force` continue without a backup when a crashed sandbox cannot be reached.
   The no-backup path warns that prior sandbox state is not preserved, and gateway recovery reports its bounded retry budget.
   For more information, refer to [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes).

diff --git a/docs/changelog/2026-07-09.mdx b/docs/changelog/2026-07-09.mdx
@@ -24,7 +24,7 @@ The release also refreshes quickstarts and variant rendering so OpenClaw, Hermes
   For more information, refer to [Security Best Practices](/user-guide/openclaw/security/best-practices), [Credential Storage](/user-guide/openclaw/security/credential-storage), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Quickstart with LangChain Deep Agents Code](/user-guide/deepagents/get-started/quickstart).
 - Network policy and messaging behavior now preserve narrower boundaries.
   Homebrew Git operations require the GitHub policy preset for Git egress, Gmail has a documented policy preset and integration example, custom URL-based MCP server allowlists are documented, WhatsApp post-pair gateway restarts no longer require `operator.admin`, and the overview hides messaging-channel guidance from Deep Agents pages where the channel flow is not supported.
-  For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [Common Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy), and [Choose Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/choose-messaging-channels).
+  For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [Common Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), [Set Up Gmail With an App Password](/user-guide/openclaw/network-policy/set-up-gmail-with-an-app-password), [Create Custom Policy Presets](/user-guide/openclaw/network-policy/configure-policies/create-custom-policy-presets), and [Choose Messaging Channels](/user-guide/openclaw/manage-sandboxes/messaging-channels/choose-messaging-channels).
 - Onboarding and recovery paths preserve intent across more interrupted flows.
   Resume recovery now follows one explicit finite-state path, pending route reservations survive resume, sandbox create-failure reporting is separated from create-step handling, BuildKit progress no longer forces plain output, and null-name resume sessions are covered so canceled or malformed session state does not send users down the wrong recovery path.
   For more information, refer to [NemoClaw Quickstart with OpenClaw](/user-guide/openclaw/get-started/quickstart), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).

diff --git a/docs/changelog/2026-07-12.mdx b/docs/changelog/2026-07-12.mdx
@@ -32,4 +32,4 @@ NemoClaw v0.0.81 strengthens rebuild and snapshot state preservation, repairs lo
 - Security and policy diagnostics preserve more context without hiding risk.
   OpenClaw security audits keep NemoClaw-managed dashboard compatibility findings visible with their severity, remediation, and recorded reason, while token-shaped URL query values are redacted even when their parameter names look benign.
   The custom Streamable HTTP MCP policy recipe also scopes `DELETE` to the exact MCP endpoint used for session termination.
-  For more information, refer to [Security Best Practices](/user-guide/openclaw/security/best-practices) and [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy).
+  For more information, refer to [Security Best Practices](/user-guide/openclaw/security/best-practices) and [Create Custom Policy Presets](/user-guide/openclaw/network-policy/configure-policies/create-custom-policy-presets).
diff --git a/docs/changelog/2026-07-14.mdx b/docs/changelog/2026-07-14.mdx
@@ -59,7 +59,7 @@ NemoClaw v0.0.82 adds non-destructive sandbox stop and start commands, protects
 - Custom policy application rejects catch-all destinations before widening sandbox egress.
   Runtime custom presets now reject `*`, `0.0.0.0`, `0.0.0.0/0`, `::`, and `::/0` while continuing to allow scoped subdomain wildcards such as `*.example.com`.
   The same semantic check protects repository validation, `policy-add --from-file`, and in-memory custom preset application.
-  For more information, refer to [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy).
+  For more information, refer to [Create Custom Policy Presets](/user-guide/openclaw/network-policy/configure-policies/create-custom-policy-presets).
 - NemoClaw now requires Node.js 22.19 or later for host installs and contributor tooling, matching current OpenClaw runtime and advisor SDK requirements.
   Ubuntu 26.04 has a digest-pinned userspace contract lane for CLI, preflight, installer, and platform checks, while Docker-host, AppArmor, Landlock, and live onboarding validation remain pending.
   For more information, refer to [Prerequisites](/user-guide/openclaw/get-started/prerequisites) and [Platform Support and Launch Claims](/user-guide/openclaw/reference/platform-support).

diff --git a/docs/changelog/2026-07-24.mdx b/docs/changelog/2026-07-24.mdx
@@ -18,7 +18,7 @@ NemoClaw v0.0.94 strengthens sandbox restore and update behavior, adds machine-r
 - `policy-add` now compares an already-applied catalog preset with the live policy.
   It exits without mutation when the content matches and previews the update when the preset changed.
   Network policy guidance now explains when an endpoint requires `tls: skip` raw TLS passthrough and identifies the lost L7 inspection and credential-resolution controls.
-  For more information, refer to [Customize the Network Policy](/user-guide/openclaw/network-policy/customize-network-policy), [Common NemoClaw Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
+  For more information, refer to [Apply Policy Presets](/user-guide/openclaw/network-policy/configure-policies/apply-policy-presets), [Configure Raw TLS Passthrough](/user-guide/openclaw/network-policy/configure-policies/configure-raw-tls-passthrough), [Common NemoClaw Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples), and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - Onboarding now supports `--events=jsonl` for a versioned, redacted stream of canonical state-machine events.
   The human-readable progress stream remains on standard error, and closing or slowing the event stream does not cancel onboarding.
   DGX Spark resume preserves the selected managed vLLM Express path, managed vLLM rejects a model that does not support the detected platform before downloads, and compatibility recovery selects and probes one usable IPv4 resolver.