docs(manage-sandboxes): add runtime controls + shields + mutability table (#3230)#3501
Conversation
…able (#3230) Adds a consolidated reference page for two operator questions that were previously fragmented across overview, architecture, sub-agent, switch-inference, sandbox-hardening, network-policy, best-practices, and quickstart pages: 1. **What can change at runtime vs. what requires rebuild / re-onboard.** A single table maps each commonly changed item (inference provider, model, sub-agent, policy presets, channel tokens, dashboard port + bind address, web search backend, filesystem layout, sandbox name, GPU passthrough, shields posture, agents allow-list) to its mutability tier and the command that changes it. 2. **The operator-only `shields up` / `shields down` / `shields status` commands.** Previously undocumented despite being load-bearing for the lockdown ↔ default-mutable posture transition. Now documents all three commands with their full surface — including the `--timeout`, `--reason`, and `--policy` flags on `shields down` and the auto-restore timer semantics. The new page lives at `docs/manage-sandboxes/runtime-controls.md` (one of the two homes the issue suggested) and is plugged into the "Manage Sandboxes" Sphinx toctree directly after the Lifecycle page. Cross-refs to the existing scattered pages so the consolidated table stays an index, not a duplicate source of truth. Closes #3230. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
📝 WalkthroughWalkthroughThis PR adds an operator-facing Runtime Controls documentation page describing NemoClaw sandbox mutability and the ChangesRuntime Controls Documentation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Comment |
E2E Advisor RecommendationRequired E2E: None Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
docs/manage-sandboxes/runtime-controls.md (3)
81-81: ⚡ Quick winAvoid colon-as-punctuation in prose lines.
The colons in “Raise shields: ...” and “Lower shields: ...” are clause separators, not list introducers; rewrite with a period or comma.
As per coding guidelines, "Colons should only introduce a list. Flag colons used as general punctuation between clauses."
Also applies to: 94-94
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/manage-sandboxes/runtime-controls.md` at line 81, Change the prose headings that use a colon as clause separator—specifically the lines beginning with "Raise shields:" and "Lower shields:"—to use a period or comma instead (e.g., "Raise shields. Lock `openclaw.json`..." or "Raise shields, lock `openclaw.json`...") so the colon is only used to introduce lists per the style guideline; update both occurrences referenced by the "Raise shields" and "Lower shields" phrases.
52-55: 💤 Low valueRemove routine bold emphasis in table values (LLM pattern detected).
**Locked at creation**and similar emphasis here reads as stylistic emphasis rather than a UI label or warning.As per coding guidelines, "Unnecessary bold on routine instructions ... should be flagged. Bold is reserved for UI labels, parameter names, and genuine warnings."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/manage-sandboxes/runtime-controls.md` around lines 52 - 55, In the runtime-controls table remove the unnecessary Markdown bold markup around routine status values (e.g. change "**Locked at creation**" and similar occurrences to plain text "Locked at creation" and remove bold from "Runtime (operator-only)") so the entries read as neutral labels; keep bold only for genuine UI labels or warnings such as parameter names like `--name` or command examples like `nemoclaw <name> shields up`/`shields down`, and update the table cells for "Filesystem layout (Landlock zones, read-only mounts, container caps)", "Sandbox name", "GPU passthrough enable / device selector", and "Shields posture (locked ↔ default mutable)" accordingly.
37-38: ⚡ Quick winUse active voice and present tense consistently.
These lines include passive/future constructions (for example, “is baked,” “is initiated,” “are hidden,” “Recorded...,” “will surface”); rewrite in active, present-tense voice addressing the reader directly.
As per coding guidelines, "Active voice required... Second person ('you')... Present tense. Flag future tense ('will') in descriptions of current behavior."
Also applies to: 63-67, 104-104, 108-108
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/manage-sandboxes/runtime-controls.md` around lines 37 - 38, Rewrite the two sentences to use active voice, present tense, and address the reader in second person; specifically change "NemoClaw applies its security posture in three layers — what is baked into the sandbox image at onboard, what is hot-reloadable on the running sandbox, and what requires a rebuild or re-onboard." to something like "NemoClaw enforces security across three layers: settings you bake into the sandbox image when you onboard, settings you hot-reload on a running sandbox, and settings that require you to rebuild or re-onboard." and change "The table below maps each commonly changed item to the layer that owns it and the command that changes it." to an active, present-tense instruction such as "Use the table below to find which layer owns each commonly changed item and which command you run to change it." Also update the similar passive/future phrases identified elsewhere (e.g., "is baked", "is initiated", "are hidden", "Recorded...", "will surface" and the ranges noted) to active, present-tense second-person phrasing throughout.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/manage-sandboxes/runtime-controls.md`:
- Line 110: Rename the final related-links heading from "## See also" to "##
Next Steps" so it matches the docs page template; locate the heading text "##
See also" in the document and replace it with "## Next Steps" ensuring this is
the bottom related-links section referenced by the page guidelines.
---
Nitpick comments:
In `@docs/manage-sandboxes/runtime-controls.md`:
- Line 81: Change the prose headings that use a colon as clause
separator—specifically the lines beginning with "Raise shields:" and "Lower
shields:"—to use a period or comma instead (e.g., "Raise shields. Lock
`openclaw.json`..." or "Raise shields, lock `openclaw.json`...") so the colon is
only used to introduce lists per the style guideline; update both occurrences
referenced by the "Raise shields" and "Lower shields" phrases.
- Around line 52-55: In the runtime-controls table remove the unnecessary
Markdown bold markup around routine status values (e.g. change "**Locked at
creation**" and similar occurrences to plain text "Locked at creation" and
remove bold from "Runtime (operator-only)") so the entries read as neutral
labels; keep bold only for genuine UI labels or warnings such as parameter names
like `--name` or command examples like `nemoclaw <name> shields up`/`shields
down`, and update the table cells for "Filesystem layout (Landlock zones,
read-only mounts, container caps)", "Sandbox name", "GPU passthrough enable /
device selector", and "Shields posture (locked ↔ default mutable)" accordingly.
- Around line 37-38: Rewrite the two sentences to use active voice, present
tense, and address the reader in second person; specifically change "NemoClaw
applies its security posture in three layers — what is baked into the sandbox
image at onboard, what is hot-reloadable on the running sandbox, and what
requires a rebuild or re-onboard." to something like "NemoClaw enforces security
across three layers: settings you bake into the sandbox image when you onboard,
settings you hot-reload on a running sandbox, and settings that require you to
rebuild or re-onboard." and change "The table below maps each commonly changed
item to the layer that owns it and the command that changes it." to an active,
present-tense instruction such as "Use the table below to find which layer owns
each commonly changed item and which command you run to change it." Also update
the similar passive/future phrases identified elsewhere (e.g., "is baked", "is
initiated", "are hidden", "Recorded...", "will surface" and the ranges noted) to
active, present-tense second-person phrasing throughout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6eaaadbd-5cb0-4666-9fda-b88aa5263841
📒 Files selected for processing (2)
docs/index.mddocs/manage-sandboxes/runtime-controls.md
| The auto-restore timer is detached from the `shields down` invocation — closing your terminal does not cancel the restore. | ||
| If the timer process is killed before the deadline (e.g. host reboot), `shields status` will surface the inconsistency on the next check (see #3112 for the fail-open fix). | ||
|
|
||
| ## See also |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win
Rename this section to Next Steps to match the docs page template.
Use ## Next Steps as the final related-links section heading instead of ## See also.
As per coding guidelines, "When reviewing new pages, verify: ... A 'Next Steps' section at the bottom links to related pages."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/manage-sandboxes/runtime-controls.md` at line 110, Rename the final
related-links heading from "## See also" to "## Next Steps" so it matches the
docs page template; locate the heading text "## See also" in the document and
replace it with "## Next Steps" ensuring this is the bottom related-links
section referenced by the page guidelines.
…lity table (#3230) Stage 9 perfect-match audit found that #3230 explicitly calls out "openclaw.json keys" as one of the 10 commonly-changed items the consolidated reference should classify, but the original page only covered it implicitly through the model / provider / channels / agents.list rows and the trailing source-of-truth note. Adds an explicit row classifying openclaw.json mutability as "locked under shields up, runtime-editable under shields down" with a cross-ref to the shields workflow. Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
There was a problem hiding this comment.
🧹 Nitpick comments (3)
docs/manage-sandboxes/runtime-controls.md (3)
109-109: ⚡ Quick winUse present tense instead of future tense.
"
shields statuswill surface..." should be present-tense phrasing.As per coding guidelines, "Present tense. Flag future tense ('will') in descriptions of current behavior."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/manage-sandboxes/runtime-controls.md` at line 109, The sentence uses future tense ("`shields status` will surface the inconsistency on the next check"); change it to present tense by replacing "will surface" with "surfaces" so the line reads: "If the timer process is killed before the deadline (e.g. host reboot), `shields status` surfaces the inconsistency on the next check (see `#3112` for the fail-open fix)." Update the sentence containing `shields status` and the reference to `#3112` accordingly.
52-54: 💤 Low valueAvoid bold for routine table states (LLM pattern detected).
**Locked at creation**reads like emphasis rather than a warning/UI label.As per coding guidelines, "Unnecessary bold on routine instructions ... Bold is reserved for UI labels, parameter names, and genuine warnings."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/manage-sandboxes/runtime-controls.md` around lines 52 - 54, The table currently uses markdown bold for the routine state string "**Locked at creation**" in rows like "Filesystem layout (Landlock zones, read-only mounts, container caps)", "Sandbox name", and "GPU passthrough enable / device selector"; remove the bold markup and replace it with plain text "Locked at creation" (or a UI-label-safe format if needed) so the state reads as a regular instruction rather than emphasized UI/warning text, ensuring only true UI labels or warnings remain bolded.
67-67: ⚡ Quick winUse active voice for this sentence.
"The commands are hidden..." is passive; rewrite with an active subject.
As per coding guidelines, "Active voice required. Flag passive constructions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/manage-sandboxes/runtime-controls.md` at line 67, Replace the passive sentence "The commands are hidden from the standard `--help` output because they are operator workflows, not developer workflows; everything below documents the full surface." with an active-voice version (for example: "We hide the commands from the standard `--help` output because they are operator workflows, not developer workflows; everything below documents the full surface.") so the sentence uses a clear subject and active verb.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/manage-sandboxes/runtime-controls.md`:
- Line 109: The sentence uses future tense ("`shields status` will surface the
inconsistency on the next check"); change it to present tense by replacing "will
surface" with "surfaces" so the line reads: "If the timer process is killed
before the deadline (e.g. host reboot), `shields status` surfaces the
inconsistency on the next check (see `#3112` for the fail-open fix)." Update the
sentence containing `shields status` and the reference to `#3112` accordingly.
- Around line 52-54: The table currently uses markdown bold for the routine
state string "**Locked at creation**" in rows like "Filesystem layout (Landlock
zones, read-only mounts, container caps)", "Sandbox name", and "GPU passthrough
enable / device selector"; remove the bold markup and replace it with plain text
"Locked at creation" (or a UI-label-safe format if needed) so the state reads as
a regular instruction rather than emphasized UI/warning text, ensuring only true
UI labels or warnings remain bolded.
- Line 67: Replace the passive sentence "The commands are hidden from the
standard `--help` output because they are operator workflows, not developer
workflows; everything below documents the full surface." with an active-voice
version (for example: "We hide the commands from the standard `--help` output
because they are operator workflows, not developer workflows; everything below
documents the full surface.") so the sentence uses a clear subject and active
verb.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 53342aa2-5bfe-4d3f-b923-760ecbae5ba3
📒 Files selected for processing (1)
docs/manage-sandboxes/runtime-controls.md
Summary
Adds a consolidated reference page that answers two operator questions previously fragmented across many existing docs:
shields up/shields down/shields statuscommands — previously undocumented despite being load-bearing for the lockdown ↔ default posture transition. Full surface documented including the--timeout,--reason,--policyflags onshields downand the auto-restore timer semantics.Closes #3230.
Acceptance criteria mapping
shields up/down/statuscommands documentedruntime-controls.md### sections — 3/3--timeout,--reason,--policyflag tables### shields down— 3/3## What you can change at runtimedocs/security/openclaw-controls.mdOR newdocs/manage-sandboxes/runtime-controls.mddocs/index.mdTest plan
make docsbuilds cleanly (1 pre-existing warning unrelated to this page aboutdocs/superpowers/specs/...not in toctree)mainshields up,shields down,shields statuseach have a dedicated section--timeout,--reason,--policyflags documented with defaults and effectsmake docs-live) and verify the table and code blocks render correctly on the Sphinx theme — pending reviewerNotes for reviewers
docs/manage-sandboxes/(the issue suggested either there ordocs/security/; the operator-task framing fits manage-sandboxes better since it sits alongside lifecycle/messaging-channels/workspace-files)./opt/nemoclaw/openclaw.jsonand cross-refs to related issues ([macOS][Brev][CLI&UX] Dashboard port 18789 hard-bound to 127.0.0.1 — no flag/env to bind 0.0.0.0 for remote-SSH-deployed hosts #3259 dashboard bind, bug(messaging)channels stop <name>does not stop the bridge through rebuild —openclaw.jsonstill bakes the channel in #3453 channel stop, [Ubuntu 24.04][Security] shields-down timer process death leaves shields permanently DOWN (fail-open) #3112 shields timer) are inline so users searching for those keywords land here as well.🤖 Generated with Claude Code
Summary by CodeRabbit