Summary

Add the canonical docs/changelog/2026-07-25.mdx release entry with the exact ## v0.0.96 heading.
The entry reconciles all 86 first-parent commits since v0.0.95 with the live v0.0.96 label ledger and groups the user-visible changes by operator journey.

Changes

• Add the parser-safe dated MDX changelog entry for v0.0.96 with root-absolute links to the focused user guides.
• Source summary:

  • #7194 -> docs/changelog/2026-07-25.mdx: Document persistent baseline network policy exclusions and their inspection, rebuild, and snapshot behavior.

  • #7188, #7427, and #7546 -> docs/changelog/2026-07-25.mdx: Document DNS-backed HTTPS inference routing, keyless loopback endpoints, and provider-marker isolation.

  • #7238 -> docs/changelog/2026-07-25.mdx: Document blueprint sandbox and provider identifier validation before state writes or OpenShell calls, with bounded terminal-safe rejection previews.

  • #7319, #7274, #7528, #7353, and #7560 -> docs/changelog/2026-07-25.mdx: Document the managed default gateway service, onboarding readiness, and container-runtime identity safeguards.

  • #7349, #7498, #7406, #7196, #7559, #7421, #7510, #7295, and #7565 -> docs/changelog/2026-07-25.mdx: Document gateway-scoped status, lifecycle diagnostics, managed MCP recovery, delete-edge safeguards, and fail-closed CLI prompt and command output.

  • #7305, #7480, #7471, #7365, and #7541 -> docs/changelog/2026-07-25.mdx: Document installer version checks, version-tag reporting, license guidance, WSL Ollama selection, and DGX Station vLLM detection.

  • #7482, #7466, #7208, #7434, and #7586 -> docs/changelog/2026-07-25.mdx: Document Ollama resource details, reasoning precedence, Hermes onboarding behavior, and preserved managed Hermes BuildKit failures.

  • #6830, #7492, #7563, and #7582 -> docs/changelog/2026-07-25.mdx: Document the authoritative OpenClaw production lock, fixed managed-image dependencies, immutable Hermes base adoption, and Hermes image-size reduction.

  • #7505, #7530, #7547, #7508, #7548, #7549, #7537, #7534, #7515, #7511, #7551, #7562, #7575, #7496, #7594, and #7595 -> docs/changelog/2026-07-25.mdx: Summarize release validation, transient and bounded dispatch reconciliation, exact pre-tag qualification, identity revalidation, npm-audit retry, sharding, image reuse, timeout, telemetry, and workflow-hardening changes.

• Reconciled without separate changelog prose:
  • #7539, #7526, #7507, #7506, #7519, #7516, #7396, #7254, #7583, #7596, and #7598: Test-harness or fixture-only changes.
  • #7403, #7161, #6877, #7531, #7525, #7522, #7536, #7552, #7566, #7553, #7561, #7577, #7569, #7585, #7584, #7592, #7580, #7571, #7517, #7589, #7402, and #7558: Dependency, internal recovery, validation, contributor-workflow, E2E optimization, telemetry, or CI trust changes with no separate user-facing release claim.
  • #7556, #7573, #7576, and #7578: Experimental repository-maintainer conflict automation with no canonical user documentation surface.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: test/changelog-docs.test.ts validates dated changelog structure, version headings, and published links.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Reviewed docs/changelog/2026-07-25.mdx at exact head 12868abd6 against 86 first-parent release merges and 88 labeled PRs, WRITING.md, docs/CONTRIBUTING.md, product scope, skip terms, parser-safe MDX structure, published routes, and the blueprint-identifier, config-EOF, managed Hermes BuildKit, bounded-dispatch, and exact pre-tag qualification contracts. No blocking findings or suggested corrections.
• Agent: Codex Desktop documentation-writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/changelog-docs.test.ts: 6/6 passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable to this prose-only changelog entry.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — the build passed with 0 errors and 2 existing Fern warnings; the published-route check passed.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only) — native changelog files use the required parser-safe MDX SPDX comment and no frontmatter.

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• New Features
  • Policy exclude/restore now persists across rebuilds/snapshots, previews removed endpoints/features, and reports consistent exclusion status (with managed inference protection).
  • Improved DNS-backed HTTPS inference routing for custom endpoints with host-side TLS handling and safer compatible-loopback fallback.
  • Refreshed gateway/onboarding checks, improved onboarding readiness timing, and enhanced Ollama model menu details; refined Hermes onboarding flow.
• Bug Fixes
  • Prevent incorrect provider/model restoration on compatible-provider update failures and tighten sandbox/provider validation with clearer lifecycle diagnostics.
• Tests
  • Stronger release validation with fail-closed E2E runs, bounded retries/timeouts, and stricter artifact/evidence handoff rules.