Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reference/nemoclaw-openshell-integration.md`:
- Around line 1-2: Add a YAML frontmatter block at the top of the document
containing the required fields (title, description, keywords, topics, tags,
content type, difficulty, audience, status) and then insert the SPDX license
header immediately after the closing frontmatter delimiter; ensure the SPDX
header uses the project's standard SPDX string and that all frontmatter keys
match the docs schema exactly.

In `@nemoclaw/src/access-client.ts`:
- Around line 305-310: cleanProviderEndpoint currently uses
Number(endpoint.port) <= 0 which lets non-numeric ports like "abc" slip through
(NaN comparison is false); update the validation in cleanProviderEndpoint to
parse and validate the port explicitly (e.g., const p = Number(endpoint.port)),
then check Number.isFinite(p) && Number.isInteger(p) && p > 0 (optionally also p
<= 65535) and return null if that fails, otherwise set output.port = p; keep
references to ProviderProfileEndpoint and NetworkEndpoint and ensure invalid
ports are rejected and not serialized.
- Line 578: The proxy target construction is hard-coding policy.local:80, which
ignores the configured policyLocalUrl host and port when HTTP_PROXY is enabled.
Update the target logic in access-client.ts to derive the proxy destination from
the existing policyLocalUrl configuration (reusing the same parsed host/port
used in the non-proxy path) instead of a fixed hostname and port, and keep the
pathname/requestPath concatenation behavior unchanged.
- Around line 396-400: The preset merge in the listProviderProfilePresets()
handling is preserving the built-in preset object on name collisions, which
keeps the old rule and drops other provider_profile fields. Update the collision
path in the byName.set logic so a provider profile with the same preset name
replaces the preset’s provider_profile data from the imported preset instead of
only copying provider_profile; ensure the rule selection also follows the
provider-profile rule when a collision occurs.

In `@nemoclaw/src/index.ts`:
- Around line 384-403: The normalizeRequestedResource function currently
canonicalizes only GitHub hosts and returns other hostnames verbatim, causing
request_resource_access to send preset ids that list_resource_access_presets
never returns; update normalizeRequestedResource to either (A) validate inputs
against a closed set of supported provider host mappings (e.g., map pypi.org ->
pypi, registry.npmjs.org -> npm, api.telegram.org -> telegram, github.com ->
github) and return a canonical preset id for those hosts, or (B) throw an error
for any host not in that supported mapping so callers like
request_resource_access reject non-preset inputs up front; implement the chosen
approach inside normalizeRequestedResource (and update any callers if switching
to throwing) so preset ids always match what list_resource_access_presets
produces.

In `@src/lib/onboard.ts`:
- Around line 1795-1805: Move the wrapper/reporting logic out of
ensureProviderProfilesAvailable in onboard.ts into the provider-profiles module:
create a new exported helper in the provider-profiles module that calls
providerProfileOnboard.ensureNemoClawProviderProfiles(runOpenshell, { log: note
}) and performs the status branches (logging the "unsupported" message or the
"already-present" skipped list) and then calls
policies.clearProviderProfileCache(); then update
ensureProviderProfilesAvailable to simply call and return that new exported
helper (or inline a single short delegating call) so onboard.ts loses the extra
lines while keeping behavior identical; ensure imports/exports are updated to
reference the new helper and preserve the same runtime logging by reusing the
same runOpenshell, note, and policies symbols.

In `@src/lib/onboard/provider-profiles.ts`:
- Around line 116-123: The code currently treats any non-zero result from the
`provider list-profiles` invocation (the `list` variable and its `status` check)
as "unsupported"; change this so you only return {status: "unsupported", ...}
when the command output actually matches the unsupported-command patterns
(inspect `list.stdout` / `list.stderr` for those specific messages), and for any
other non-zero exit throw an Error that includes `list.stdout` and `list.stderr`
so callers can see the runtime failure details; update the branch that handles
`list.status !== 0` to perform the pattern match and either return the
unsupported response or throw with stderr/stdout accordingly.

In `@test/e2e/test-nemoclaw-policy-local-plugin.sh`:
- Around line 25-28: Before enabling agent_policy_proposals_enabled, read and
save the current global value by invoking "${OPENSHELL_BIN} settings get
--global --key agent_policy_proposals_enabled" (or equivalent) into a variable,
then set the flag as you do now; in cleanup(), restore the saved value by
calling "${OPENSHELL_BIN} settings set --global --key
agent_policy_proposals_enabled --value <saved_value>" (or delete/unset it if the
saved value indicates it was absent), ensuring the saved variable is in a scope
accessible to cleanup() so the original global setting is always restored even
on early exit.

---

Nitpick comments:
In `@docs/reference/nemoclaw-openshell-integration.md`:
- Line 68: The prose line containing "Each agent adapter exposes the same tool
names and response shape through the harness-native mechanism. OpenClaw uses its
plugin API. Hermes uses its Python plugin API. Additional harnesses can
implement the same contract without changing the OpenShell policy proposal
flow." should be split so each sentence is on its own source line (one sentence
per line); similarly split the sentence group at the other occurrence starting
with "OpenClaw" so that every sentence occupies its own line to satisfy the "one
sentence per line" guideline.
- Around line 1-73: Add a 1–2 sentence intro above the mermaid diagram (locate
the "# NemoClaw OpenShell Integration" header or the "```mermaid" block) that
briefly summarizes what this page covers, and append a "Next Steps" section at
the bottom (after the "Provider Profiles" paragraph) with links to related docs
such as the agent tools and onboarding pages (eg. list_resource_access_presets,
request_resource_access, check_resource_access, and the NemoClaw
onboarding/import guidance) so readers can navigate to implementation and usage
details.

In `@src/lib/onboard.ts`:
- Line 9751: The onboarding change adds a core hook call
ensureProviderProfilesAvailable() in src/lib/onboard.ts so you must run the
recommended targeted E2E matrix before merging: execute the cloud-e2e,
sandbox-operations-e2e, rebuild-openclaw-e2e, channels-stop-start-e2e,
messaging-compatible-endpoint-e2e, hermes-discord-e2e, hermes-slack-e2e and
openshell-gateway-upgrade-e2e pipelines against this branch, confirm all pass
(or capture/fix any failures), and attach the passing job artifacts to the PR;
do not merge the change to ensureProviderProfilesAvailable() until those E2E
jobs are green.