Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/hermes/plugin/__init__.py`:
- Around line 230-237: The merge in _all_presets() only copies provider_profile
into an existing fallback entry, so when a provider preset shares a name (e.g.,
"github") its rule and other fields never override the fallback; change the
merge so provider presets take precedence: when an existing entry is found for
preset["name"] update/replace its fields with the provider preset (e.g.,
existing.update(preset) or replace by_name[preset["name"]] = dict(preset) while
preserving any required metadata), ensuring _rule_for_access_request() will see
the provider preset's rule and not the stale fallback.

In `@docs/network-policy/provider-access-requests.md`:
- Around line 33-38: Add a one-sentence introduction immediately below the "##
Access Types" header that summarizes the table purpose (e.g., "The table below
describes the different access types and what each approval grants.") so readers
get context before the table; update the section containing the "## Access
Types" header and the rows for `openshell_provider_access` and
`openshell_network_access` to ensure the intro appears directly above the table.
- Around line 152-156: The bottom section currently titled "Related Pages"
should be renamed to "Next Steps" to conform to the guideline requiring a Next
Steps section; update the heading text from "Related Pages" to "Next Steps"
while preserving the existing links (Approve or Deny Network Requests, Customize
the Network Policy, NemoClaw Provider and Resource Access Flow) and formatting
so nothing else in the "Related Pages" block (link URLs and order) changes.

In `@docs/reference/nemoclaw-openshell-integration.md`:
- Around line 191-195: Update the CLI snippet block: change the code fence
language tag from "bash" to "console" and add "$ " prompt prefixes to each
command line in the snippet (the curl invocation, the -x "$HTTPS_PROXY" line,
the -H "Authorization: Bearer $GITHUB_TOKEN" line, and the URL line) so the
example follows the docs guideline for console blocks with $ prompts.
- Around line 200-220: Add a "Next Steps" section to the bottom of the document
following the "Why the CLIs Are in the Image" section; create a heading "Next
Steps" and include a short bulleted list linking to related pages such as the
provider approval policy, OpenShell policy reference, sandbox image docs, and
provider integration guide (use their existing internal doc titles/anchors), so
readers have direct navigation to provider policy, credential setup, sandbox
access model, and integration instructions.
- Around line 1-2: Add a YAML frontmatter block at the top of the document
(immediately before the "# NemoClaw Provider and Resource Access Flow" heading)
containing title, description, keywords, topics, tags, content type, difficulty,
audience, and status fields, and then add the SPDX license header block (e.g.,
"SPDX-License-Identifier: Apache-2.0" or the project standard) immediately after
the frontmatter; ensure the frontmatter keys match the repo guideline names and
the SPDX header appears directly following the frontmatter so the file complies
with the "SPDX license header is present after frontmatter" rule.

In `@nemoclaw/src/access-client.ts`:
- Around line 379-384: The cleanProviderEndpoint function currently converts
endpoint.port with Number(...) but lets NaN, non-integers, and out-of-range
values through; update its validation to only accept a numeric integer port in
the TCP range 1–65535 and return null otherwise. Specifically, in
cleanProviderEndpoint check that typeof endpoint.host === "string", parse the
port to a number (or integer) and ensure it is not NaN, is an integer, and 1 <=
port <= 65535 before constructing the NetworkEndpoint object (otherwise return
null); keep using the same function name cleanProviderEndpoint and the output
variable NetworkEndpoint so callers remain unchanged.

In `@nemoclaw/src/index.ts`:
- Around line 877-895: When checking provider readiness, honor an explicit
requested provider_type before reusing an attached provider: read the requested
provider_type with readStringProperty(params, "provider_type") and, after
fetching the attached provider via getProviderAccess(providerName,
clientOptions), verify that the fetched provider's type field (e.g.,
provider.provider_type or provider.type as used in your provider object) matches
the requested provider_type; if it does not match, return a failed
providerAccessToolResult (or a similar result object) explaining the mismatch
instead of reporting the provider as ready. Apply the same check in the
analogous fast-path later in the file (the block around lines referenced
898-910) so both code paths use readStringProperty, getProviderAccess, and
providerAccessToolResult and consistently validate provider_type before
reporting success.

In `@src/lib/onboard.ts`:
- Around line 1795-1805: The new wrapper logic in
ensureProviderProfilesAvailable (calling
providerProfileOnboard.ensureNemoClawProviderProfiles, logging via note, and
calling policies.clearProviderProfileCache) increased the file size and
triggered the entrypoint budget gate; extract that orchestration into a new
module named provider-profiles.ts under the same lib/onboard area, implement a
function (e.g., ensureProviderProfilesOrchestrator) that performs the call to
providerProfileOnboard.ensureNemoClawProviderProfiles, handles the result
branches (unsupported, already-present with skipped), logs with note, and calls
policies.clearProviderProfileCache, then replace the body of
ensureProviderProfilesAvailable with a single thin call that imports and invokes
the new orchestrator to keep onboard.ts net-neutral in size.

In `@test/e2e/docs/parity-inventory.generated.json`:
- Around line 5412-5418: The parity inventory currently lists
test/e2e/test-hermes-policy-local-plugin.sh and
test/e2e/test-nemoclaw-policy-local-plugin.sh as legacy zero-assertion entries;
update those test scripts to emit explicit PASS:/FAIL: (or pass "..." / fail
"...") markers so scripts/e2e/extract-legacy-assertions.ts can extract
assertions, then regenerate test/e2e/docs/parity-inventory.generated.json so
each entry has a non-empty assertions array and no zero_assertion_review.todo;
additionally add the required SPDX license header at the top of
parity-inventory.generated.json (replacing the current file-starting JSON) so
the file includes the SPDX identifier before the JSON payload.

In `@test/e2e/test-hermes-policy-local-plugin.sh`:
- Around line 25-28: Don't mutate global settings permanently: instead of
calling "${OPENSHELL_BIN}" settings set --global --key
agent_policy_proposals_enabled --value true --yes, either set it only for the
test scope by using --local (replace --global with --local) or, if a global
change is required, first capture the current value (e.g.
PREV=$("${OPENSHELL_BIN}" settings get --global --key
agent_policy_proposals_enabled) ), set the new value, and register a cleanup
trap to restore it via "${OPENSHELL_BIN}" settings set --global --key
agent_policy_proposals_enabled --value "$PREV" --yes so the script leaves no
persistent side effects.

In `@test/e2e/test-nemoclaw-policy-local-plugin.sh`:
- Around line 25-28: The test sets the global OpenShell setting
agent_policy_proposals_enabled using "${OPENSHELL_BIN}" settings set but never
restores the previous value; update the test to read and store the existing
value before changing it (e.g., via "${OPENSHELL_BIN}" settings get for
agent_policy_proposals_enabled), then set the value to true for the test, and
finally restore the original value in a teardown/cleanup block (or trap) so the
global setting is returned to its prior state after the test completes.

In `@test/sandbox-build-context.test.ts`:
- Around line 90-93: The test only checked the "others" write bit (0o002),
allowing modes like 0o775 to pass; update the assertion to verify the full
write-bit mask (0o222) so only the owner write bit remains set for
stagedManifestDir. Replace the current check that uses stagedManifestDirMode &
0o002 with a check that (stagedManifestDirMode & 0o222) equals 0o200 (owner
write only), referencing the stagedManifestDirMode variable and the 0o222 mask
to locate and fix the assertion.

---

Outside diff comments:
In `@test/e2e/docs/parity-map.yaml`:
- Line 1: Add the required SPDX copyright + Apache-2.0 header to the top of the
YAML file so the file begins with the standard SPDX license header comment (e.g.
a YAML comment block containing the copyright and "SPDX-License-Identifier:
Apache-2.0") above the existing top-level "scripts:" key in parity-map.yaml.

---

Nitpick comments:
In `@Dockerfile`:
- Around line 32-33: The Dockerfile change adding COPY of
scripts/install-provider-tools.sh (and the other modified sections around lines
62-67, 254-255, 633-634) modifies sandbox image contents and startup behavior,
so before merging run the full Docker-targeted E2E suite: cloud-e2e,
sandbox-survival-e2e, hermes-e2e, and rebuild-openclaw-e2e to validate runtime
parity and startup behavior; if any test fails, iterate on the Dockerfile and
scripts/install-provider-tools.sh changes until the E2E jobs pass.

In `@Dockerfile.base`:
- Around line 75-77: This change modifies Dockerfile.base by copying and running
/usr/local/lib/nemoclaw/install-provider-tools.sh which affects the cached base
image layer; validate the base-image rebuild path by running the recommended E2E
subset (cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e)
either locally or by triggering the corresponding CI job, record the results in
the PR (pass/fail and any logs), and if failures appear, revert or fix the
Dockerfile.base / install-provider-tools.sh change and re-run the same E2E
subset until green.

In `@docs/network-policy/provider-access-requests.md`:
- Around line 24-31: Split multi-sentence paragraphs so each sentence occupies
its own source line: reflow the block that begins "NemoClaw agents can ask
OpenShell for additional access..." and place the sentence starting "The sandbox
can submit a request, but it cannot approve its own request." on its own line,
do the same for the sentence starting "OpenShell records the proposal, waits for
operator approval, and only then attaches provider credentials or updates
network policy.", and ensure the "Use provider access when the task needs an
account..." vs "Use network-only access when the task only needs unauthenticated
reachability." sentences are each on separate lines; apply the same
one-sentence-per-line normalization to the other identified groups that start
with "Use provider..." / "Use network-only..." and the sentence groups around
the phrases found in the other noted ranges.

In `@docs/reference/nemoclaw-openshell-integration.md`:
- Around line 6-8: The two bullets use unnecessary bold markup for routine
prose; remove the Markdown bold from the phrases "**Provider access**" and
"**Network access**" so they read as normal text (Provider access and Network
access) unless those phrases are actual UI labels—update the doc content in
nemoclaw-openshell-integration.md by replacing the bolded instances in those
list items while keeping the rest of the sentences unchanged.
- Around line 3-12: The prose in the NemoClaw/OpenClaw integration section
contains multiple sentences wrapped across lines (e.g., the opening paragraph
starting "NemoClaw gives OpenClaw agents a provider-first way..." and the
bullets "Provider access attaches a host-managed credential..." and "Network
access only opens a resource path..."), violating the one-sentence-per-line
guideline; fix by reflowing the paragraph and each bullet so each individual
sentence is placed on its own source line (preserve existing wording and
punctuation), and apply the same reflow to the other prose blocks noted in the
review.

In `@nemoclaw/src/register.test.ts`:
- Around line 254-297: Add a test that covers the mismatched provider_type
fast-path: call the openshell_provider_access tool via
getRegisteredTool(...).execute with provider_name "github" but provider_type
"gitlab" while mockedGetProviderAccess.resolveValue returns an attached provider
with provider_name "github" and provider_type "github", then assert that
mockedGetProviderAccess was still called, that mockedCreateProviderAccessRequest
was invoked (i.e. we did not short-circuit), and that the returned result does
not report status "applied" (assert status is "requested" or similar expected
request status) to ensure the code requires both name and type to match before
short-circuiting.

In `@src/lib/onboard.ts`:
- Line 9751: This change invokes ensureProviderProfilesAvailable() and alters
post-gateway onboarding flow in src/lib/onboard.ts; before merging, run the
recommended E2E job set: cloud-e2e, sandbox-operations-e2e,
rebuild-openclaw-e2e, channels-stop-start-e2e,
messaging-compatible-endpoint-e2e, hermes-discord-e2e, hermes-slack-e2e, and
openshell-gateway-upgrade-e2e to validate the orchestration change affecting
ensureProviderProfilesAvailable().

In `@test/hermes-plugin-handlers.test.ts`:
- Around line 109-145: The test currently only checks provider_profile metadata
and request path but doesn't assert that the provider-profile-specific rule was
applied; update the test after invoking
ctx.tools["openshell_network_access"]["handler"] so it asserts
calls[0].payload.operations[0].addRule.rule equals the expected provider-profile
rule (the rule defined in module._read_provider_profiles for "github"); also add
the same assertion for the similar assertions around lines 180-185 to ensure the
merge didn't omit the provider profile's rule.