Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reference/nemoclaw-openshell-integration.md`:
- Line 1: Add the required SPDX license header to the top of the Markdown file
docs/reference/nemoclaw-openshell-integration.md by inserting the SPDX copyright
and license lines as a header block (e.g., an HTML comment or plain text)
including "SPDX-FileCopyrightText: <YEAR> <OWNER>" and "SPDX-License-Identifier:
Apache-2.0" as the first lines of the file so the document complies with the
repository rule for *.{md,mdx} files.

In `@nemoclaw-blueprint/provider-profiles/brew.yaml`:
- Around line 12-32: The entries for public hosts (host: github.com, ghcr.io,
pkg-containers.githubusercontent.com, objects.githubusercontent.com,
raw.githubusercontent.com) currently set tls: skip; remove or change those tls
settings so normal TLS verification is enforced (e.g., delete the tls: skip
lines or set tls: verify) for each listed host in the provider profile to
restore proper transport security and policy guarantees.

In `@nemoclaw-blueprint/provider-profiles/npm.yaml`:
- Around line 11-16: Replace the insecure "tls: skip" setting for the external
registry entry (the block containing host: registry.yarnpkg.com and tls: skip)
so TLS verification is enabled by default; remove the tls: skip line or change
it to an affirmative verification setting (e.g., tls: verify or tls: true) in
the provider profile that contains the npm registry configuration to ensure
package registry traffic performs TLS certificate validation.

In `@nemoclaw/src/access-client.ts`:
- Around line 396-401: The loop over listProviderProfilePresets() currently
keeps the built-in preset on name collisions and only copies provider_profile,
which loses provider-sourced endpoints/binaries; change the collision branch in
that loop (the byName.set call where existing is checked) to merge the records
so the incoming preset's provider-sourced fields override the existing entry
(e.g., preserve any other existing metadata but copy
preset.endpoint/binaries/provider_profile/etc. from preset), ensuring
provider-supplied endpoints/binaries are used for overlapping names; locate this
logic around listProviderProfilePresets(), the byName map, and the
existing/preset variables and update the merge strategy accordingly.

In `@src/lib/onboard.ts`:
- Around line 1795-1805: The new helper function ensureProviderProfilesAvailable
in src/lib/onboard.ts causes net growth and breaks the onboard-entrypoint
budget; remove this local helper and either inline its minimal behavior at the
original call site or move it into a separate smaller module so onboard.ts
shrinks. Specifically, replace calls to ensureProviderProfilesAvailable with the
explicit call to
providerProfileOnboard.ensureNemoClawProviderProfiles(runOpenshell, { log: note
}) followed by the same branching on result.status and the
policies.clearProviderProfileCache() call (or export a tiny helper from a new
module and import it), preserving use of symbols
providerProfileOnboard.ensureNemoClawProviderProfiles, runOpenshell, note, and
policies.clearProviderProfileCache.

In `@src/lib/onboard/provider-profiles.ts`:
- Around line 116-123: The current branch always returns status:"unsupported"
whenever `list.status !== 0`; change this so you only return the unsupported
payload when the `list.stdout`/`list.stderr` explicitly indicate the
"unsupported command" signals from the `list-profiles` invocation, and for any
other non-zero exit produce a thrown Error (or rethrow) that includes
`list.status`, `list.stdout`, and `list.stderr` so callers can see
runtime/transient failures; locate the check on `list.status` in
provider-profiles.ts and replace the unconditional return with an explicit
pattern-match for the unsupported-case and an error throw containing
stdout/stderr for all other failures.

In `@test/e2e/test-nemoclaw-policy-local-plugin.sh`:
- Around line 25-29: Before setting the global OpenShell setting, read and store
the current value of agent_policy_proposals_enabled (use "${OPENSHELL_BIN}
settings get --global --key agent_policy_proposals_enabled") into a variable
(e.g., prior_agent_policy_proposals_enabled), then keep that variable in the
script scope and in the cleanup function restore it by calling "${OPENSHELL_BIN}
settings set --global --key agent_policy_proposals_enabled --value
<stored_value> --yes"; ensure the cleanup function (cleanup) is registered to
run on exit (trap) so the original global setting is always reverted.

---

Nitpick comments:
In `@Dockerfile`:
- Around line 62-66: This change modifies the runtime image by installing
provider tools via the RUN step that executes
/usr/local/lib/nemoclaw/install-provider-tools.sh, so validate the new image by
running the recommended container E2E suites: cloud-e2e, sandbox-survival-e2e,
hermes-e2e, and rebuild-openclaw-e2e (also verify the other related RUN change
at the second occurrence of the same install step). Ensure each job runs against
a real container build of this Dockerfile and report any failures back with the
failing job logs and the exact container image digest.

In `@Dockerfile.base`:
- Around line 75-77: This change adds COPY and execution of
scripts/install-provider-tools.sh in Dockerfile.base (the COPY line and the RUN
invoking /usr/local/lib/nemoclaw/install-provider-tools.sh), which modifies the
sandbox base image toolchain; before merging, build the container and run the
full sandbox image E2E matrix: execute cloud-e2e, sandbox-survival-e2e,
hermes-e2e, and rebuild-openclaw-e2e against the new base image build to
validate runtime behavior and ensure the provider tools script causes no
regressions.

In `@docs/reference/nemoclaw-openshell-integration.md`:
- Around line 1-73: The page "NemoClaw OpenShell Integration" is missing
required frontmatter, a short intro, and a "Next Steps" section; add YAML
frontmatter containing title, description, keywords, topics, tags, content_type,
difficulty, audience, and status at the top of the file, prepend a one- or
two-sentence introduction paragraph under the main heading summarizing the page
purpose, and append a "Next Steps" section at the bottom linking to related docs
(e.g., pages about onboarding, policy.local, adapter contracts or provider
profiles) and any follow-up actions; ensure the existing mermaid diagram and
section headings (Flow, Agent Tools, Adapter Contract, Provider Profiles) remain
unchanged and the new frontmatter fields match the repository's docs schema.

In `@src/lib/onboard.ts`:
- Line 9751: This change touches the core onboarding flow at
ensureProviderProfilesAvailable() in src/lib/onboard.ts, so before merging run
the recommended E2E suites to validate gateway/sandbox lifecycle and provider
profile provisioning: cloud-e2e, sandbox-operations-e2e, rebuild-openclaw-e2e,
channels-stop-start-e2e, messaging-compatible-endpoint-e2e, hermes-discord-e2e,
hermes-slack-e2e, and openshell-gateway-upgrade-e2e; if any test fails, capture
logs around ensureProviderProfilesAvailable() and provider profile provisioning,
fix the failing behavior, and re-run until all pass.