docs(messaging): clarify Slack token validation and slack policy preset (#4979) by abhi-0906 · Pull Request #4986 · NVIDIA/NemoClaw

abhi-0906 · 2026-06-08T20:07:46Z

Summary

Documents the intended Slack onboarding behavior that #4979 ran into: NemoClaw validates Slack tokens against the live Slack API during onboard, so invalid/placeholder tokens (invalid_auth) cause the Slack channel to be skipped — and because the slack network policy preset is only applied for channels that are actually enabled, the preset is not applied either (not shown as ● in policy-list). Also points to the existing NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION=1 escape hatch for exercising Slack setup and the slack preset with placeholder tokens in restricted/hermetic environments.

Related Issue

Fixes #4979

Context

The current behavior is intentional and secure: live token validation prevents onboarding from enabling a channel with credentials Slack cannot use. The "fake-token test mode" the issue asks for already exists as NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION (documented in the commands reference). The gap was purely documentation — the consequence chain (invalid tokens → channel skipped → slack preset not applied) and the skip-flag's role in policy-preset testing were not stated where Slack onboarding is documented. This is the reporter's "at minimum, document the mismatch" resolution; no behavior change.

Changes

docs/manage-sandboxes/messaging-channels.mdx — in the Slack section, document that validation calls the live Slack API, that rejected tokens skip the channel and therefore do not apply the slack preset, and that NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION=1 skips the live probes for testing (format checks still apply).

Type of Change

Doc only (prose changes, no code sample modifications)

Verification

No secrets or credentials committed
Uses the existing <name> sandbox placeholder and backtick-wrapped ● conventions; new env/command references match the commands reference
Note: npm run docs / the docs link-check were not run on my Windows dev box (the link-check harness shells out in a way that fails locally); the change adds no links and is plain prose with inline code spans. Deferred to CI on Linux.

Summary by CodeRabbit

Documentation
- Updated Slack channel requirements section to document the credential validation flow that occurs when enabling Slack channels, including behavior when validation fails.
- Added documentation for the environment variable option that allows bypassing live Slack authentication checks in restricted or hermetic test environments while preserving token format validation.

Signed-off-by: abhi-0906 abhimanyukumar7290@gmail.com

…et (NVIDIA#4979) Signed-off-by: Abhimanyu Kumar <abhimanyukumar7290@gmail.com>

copy-pr-bot · 2026-06-08T20:07:50Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

prekshivyas

LGTM. Docs-only clarification that directly addresses #4979's confusion: it documents that Slack credential validation calls the live Slack API (auth.test/apps.connections.open), so placeholder tokens get invalid_auth → the channel is skipped → the slack preset isn't applied (no ● in policy-list). Verified against source: the documented NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION=1 escape hatch is real (SLACK_AUTH_VALIDATION_SKIP_ENV in slack/hooks/credential-validation.ts) and the per-channel preset gating matches (manifest policyPresets: ["slack"]). Accurate, low-risk. CI green.

coderabbitai · 2026-06-10T01:36:26Z

📝 Walkthrough

Walkthrough

Documentation update to messaging-channels.mdx that clarifies NemoClaw's live Slack credential validation behavior during channel enablement, including the skip behavior when validation fails and the environment variable to bypass validation in test environments.

Changes

Slack Channel Validation Documentation

Layer / File(s)	Summary
Slack credential validation and policy behavior documentation `docs/manage-sandboxes/messaging-channels.mdx`	"Channel Requirements" section now documents that NemoClaw calls Slack's `auth.test` and `apps.connections.open` APIs, skips Slack channel enablement if validation fails, does not apply the `slack` policy preset when skipped, and provides the `NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION=1` environment variable to bypass live validation in restricted test environments.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

NVIDIA/NemoClaw#4582: Implements the live Slack credential validation behavior (auth.test and apps.connections.open checks) that this PR documents, including the bypass flag.

Suggested labels

enhancement: messaging, integration: slack

Suggested reviewers

cv
prekshivyas

Poem

🐰 A Slack doc hops into the fray,
Explaining credentials that pass or decay,
When tokens won't dance with the API test,
We skip the whole channel—a wise, cautious jest!
NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION saves the day! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: documenting Slack token validation behavior and clarifying the slack policy preset application during channel enablement.
Linked Issues check	✅ Passed	The PR directly addresses issue `#4979` by documenting NemoClaw's live Slack API validation flow and the NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION environment variable escape hatch, aligning with Option A (update docs to clarify validation requirements).
Out of Scope Changes check	✅ Passed	All changes are in scope—documentation of existing Slack validation behavior and the escape hatch environment variable in the messaging channels guide, with no unrelated modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (1)

docs/manage-sandboxes/messaging-channels.mdx (1)

85-85: ⚡ Quick win

Rewrite in active voice.

The sentence contains passive constructions ("is only applied", "is not applied"). As per coding guidelines, active voice is required.

✏️ Suggested active voice rewrite

-Because the `slack` network policy preset is only applied for channels that are actually enabled, a skipped Slack channel also means the `slack` preset is not applied, so it does not appear as applied (`●`) in `$$nemoclaw <name> policy-list`.
+Because NemoClaw only applies the `slack` network policy preset for actually enabled channels, a skipped Slack channel means NemoClaw does not apply the `slack` preset, so the preset does not appear as applied (`●`) in `$$nemoclaw <name> policy-list`.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/manage-sandboxes/messaging-channels.mdx` at line 85, Rewrite the
sentence in active voice so it clearly states the actor and action: e.g., say
that the system applies the `slack` network policy preset only for channels that
are enabled, and that when the system skips a Slack channel it does not apply
the `slack` preset, so it won’t appear as applied (`●`) in the `$$nemoclaw
<name> policy-list` output; replace passive phrases like "is only applied" and
"is not applied" with active verbs referring to the system or process applying
the preset.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/manage-sandboxes/messaging-channels.mdx`:
- Line 85: Rewrite the sentence in active voice so it clearly states the actor
and action: e.g., say that the system applies the `slack` network policy preset
only for channels that are enabled, and that when the system skips a Slack
channel it does not apply the `slack` preset, so it won’t appear as applied
(`●`) in the `$$nemoclaw <name> policy-list` output; replace passive phrases
like "is only applied" and "is not applied" with active verbs referring to the
system or process applying the preset.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 64160d49-a5c9-4bf7-b01e-b48cfe10cabb

📥 Commits

Reviewing files that changed from the base of the PR and between 8827570 and 873dabf.

📒 Files selected for processing (1)

docs/manage-sandboxes/messaging-channels.mdx

abhi-0906 · 2026-06-10T18:08:58Z

@cv The failing dco-check is addressed — I've added the sign-off line to the PR description:

Signed-off-by: abhi-0906 <abhimanyukumar7290@gmail.com>

The edit re-triggered dco-check (and commit-lint), but the new runs are waiting on fork workflow approval (action_required). Once approved, dco-check should go green and auto-merge can proceed.

## Summary - Add the v0.0.63 release-note section using the published development note as source context. - Update source docs for sandbox recovery, OpenClaw config restore safety, managed vLLM selection, Slack Socket Mode conflict handling, and host diagnostics. - Refresh generated `nemoclaw-user-*` skills from the updated Fern MDX docs. - Update the release-doc refresh skill so post-release docs for version `n` look up the matching announcement discussion and use the `n+1` patch release label. - Fix CLI/docs parity by avoiding a `--from <Dockerfile>` flag mention inside the `upgrade-sandboxes` command section. ## Source summary - #5034 -> `docs/reference/troubleshooting.mdx`, `docs/about/release-notes.mdx`: Document safer stale-sandbox recovery through `rebuild --yes` before recreating from scratch. - #5091 -> `docs/reference/troubleshooting.mdx`, `docs/about/release-notes.mdx`: Document Docker-driver post-reboot recovery from OpenShell container labels. - #5101, #5174, #5177 -> `docs/manage-sandboxes/backup-restore.mdx`, `docs/about/release-notes.mdx`: Document OpenClaw `openclaw.json` preservation, merge behavior, and fail-safe restore handling. - #5102 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, `docs/manage-sandboxes/lifecycle.mdx`, `docs/about/release-notes.mdx`: Document `upgrade-sandboxes` image-fingerprint drift detection. - #4201 -> `docs/reference/troubleshooting.mdx`, `docs/about/release-notes.mdx`: Document the installer diagnostic for unexpected Docker daemon access outside the `docker` group. - #5038 -> `docs/inference/inference-options.mdx`, `docs/inference/use-local-inference.mdx`, `docs/about/release-notes.mdx`: Document the interactive managed-vLLM model picker and non-interactive override behavior. - #5040, #5041 -> `docs/reference/troubleshooting.mdx`, `docs/about/release-notes.mdx`: Document Ollama auth-proxy recovery and host DNS preflight diagnostics. - #4986, #5039 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/about/release-notes.mdx`: Document Slack validation and duplicate Slack Socket Mode sandbox handling. - #4981, #5168 -> `docs/about/release-notes.mdx`: Capture Hermes gateway secret-guard and wrapped-argv startup hardening in the release surface. - Follow-up -> `.agents/skills/nemoclaw-contributor-update-docs/SKILL.md`: Record the post-release docs workflow, discussion-announcement lookup, and next-patch release label rule. - Follow-up -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`: Reword custom Dockerfile sandbox text so CLI parity does not treat `--from` as an `upgrade-sandboxes` flag. ## Verification - `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw-user --doc-platform fern-mdx` - `npm run docs` - `npm run build:cli` - `bash test/e2e/e2e-cloud-experimental/check-docs.sh --only-cli` - Skip-term scan for `docs/.docs-skip` blocked terms across generated user skills  ## Summary by CodeRabbit * **Documentation** * Enhanced local inference setup with interactive model selection prompts and environment variable overrides * Improved sandbox upgrade detection using build fingerprints and version checks * Clarified configuration restore behavior preserving user settings during rebuild/restore * Added gateway authentication as fifth security layer * Expanded Slack messaging validation with live credential checking * Enhanced troubleshooting guidance for Docker access, DNS issues, and sandbox recovery * Updated release notes for v0.0.63 featuring sandbox recovery and inference improvements

docs(messaging): clarify Slack token validation and slack policy pres…

f5f0877

…et (NVIDIA#4979) Signed-off-by: Abhimanyu Kumar <abhimanyukumar7290@gmail.com>

abhi-0906 mentioned this pull request Jun 8, 2026

[All Platforms][Policy&Network] Slack resume policy test fails: fake SLACK_* env vars now cause invalid_auth and Slack policy preset is not applied #4979

Closed

wscurran added the chore Build, CI, dependency, or tooling maintenance label Jun 8, 2026

prekshivyas self-assigned this Jun 10, 2026

prekshivyas approved these changes Jun 10, 2026

View reviewed changes

prekshivyas added the v0.0.63 Release target label Jun 10, 2026

Merge branch 'main' into docs/issue-4979-slack-onboard-validation

873dabf

coderabbitai Bot reviewed Jun 10, 2026

View reviewed changes

cv enabled auto-merge (squash) June 10, 2026 17:43

Merge branch 'main' into docs/issue-4979-slack-onboard-validation

ca14436

cv merged commit e1240df into NVIDIA:main Jun 10, 2026
24 checks passed

miyoungc mentioned this pull request Jun 11, 2026

docs: refresh v0.0.63 release docs #5244

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(messaging): clarify Slack token validation and slack policy preset (#4979)#4986

docs(messaging): clarify Slack token validation and slack policy preset (#4979)#4986
cv merged 3 commits into
NVIDIA:mainfrom
abhi-0906:docs/issue-4979-slack-onboard-validation

abhi-0906 commented Jun 8, 2026 •

edited

Loading

Uh oh!

copy-pr-bot Bot commented Jun 8, 2026

Uh oh!

prekshivyas left a comment

Uh oh!

coderabbitai Bot commented Jun 10, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

abhi-0906 commented Jun 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

abhi-0906 commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Context

Changes

Type of Change

Verification

Summary by CodeRabbit

Uh oh!

copy-pr-bot Bot commented Jun 8, 2026

Uh oh!

prekshivyas left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

abhi-0906 commented Jun 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

abhi-0906 commented Jun 8, 2026 •

edited

Loading

coderabbitai Bot commented Jun 10, 2026 •

edited

Loading