## Summary
- Add v0.0.62 release notes from Discussion #5100 and link release
highlights to the relevant docs pages.
- Document the release's GPU sandbox recreation, sandbox-side local
inference verification, and Hermes dashboard port guard in the command
and inference references.
- Refresh generated NemoClaw user skills for the release-prep docs set.

## Source Summary
- #4956 -> `docs/reference/commands.mdx`: Document CDI-first Docker GPU
recreation behavior for Linux Docker-driver sandboxes.
- #5024 -> `docs/inference/use-local-inference.mdx`: Document
sandbox-runtime verification of the `inference.local` local inference
route.
- #5018 -> `docs/reference/commands.mdx`: Document Jetson/Tegra
device-node group propagation for sandbox CUDA initialization.
- #5012, #4763, #4706, #5030, #5015 -> `docs/about/release-notes.mdx`:
Summarize onboarding and recovery reliability fixes, including the
reserved Hermes API port guard.
- #5017 and #5043 -> `docs/about/release-notes.mdx`,
`docs/reference/commands.mdx`: Summarize mutable OpenClaw config
recovery and host-side `agents list` coverage.
- #5010 and #5016 -> `docs/about/release-notes.mdx`: Summarize Hermes
upstream metadata visibility and WhatsApp QR rendering reliability.
- #5045 and prior source docs in the v0.0.62 range -> `.agents/skills/`:
Refresh generated user-skill references from the current docs source.

## Skipped
- #5019 -> skipped for new prose because it touched
`openclaw-sandbox-permissive.yaml`, which matches `docs/.docs-skip`.
Existing source docs remain the source for generated skill
synchronization.

## Verification
- `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix
nemoclaw-user --doc-platform fern-mdx`
- `npm run docs` (passes; Fern reports 0 errors and 1 hidden warning)
- Pre-commit hooks passed during commit, including docs-to-skills
verification, markdown lint, gitleaks, and skills YAML tests.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added `nemoclaw <name> agents list` command.
* v0.0.62 release notes added summarizing onboarding and recovery
improvements.

* **Bug Fixes**
* Improved GPU sandbox onboarding reliability (NVIDIA CDI path,
Jetson/Tegra device handling).
* Better local inference verification and recovery for Linux
Docker-driver GPU sandboxes.
  * Quieter/earlier handling of onboarding drift and port collisions.

* **Documentation**
* Expanded GPU passthrough, inference verification, writable paths
(`/dev/pts`), port 8642 restriction, and command examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>

…VIDIA#4538, NVIDIA#4859)

OpenClaw's `doctor` state-integrity check flags the NemoClaw mutable-config
contract — /sandbox/.openclaw (2770 setgid + group-writable) and openclaw.json
(660) — as "permissions are too open" and, with --fix, tightens them to
single-user 700/600. That durably breaks the group-shared contract the gateway
UID (a member of the sandbox group) needs to persist control-UI config writes,
and prints scary "too open"/"Tightened permissions" output that misrepresents
the intended contract.

PR NVIDIA#5017's always-on openclaw() shell guard only restores 2770/660 *after* a
raw in-sandbox `openclaw doctor --fix` exits — so the warning/tighten still
runs, and any path that bypasses the connect-shell guard (stale image, raw
`command openclaw`, the macOS reporter flow in NVIDIA#4859) leaves the tree durably
locked at 700/600.

Fix the root cause at the OpenClaw source via the established Dockerfile-patch
mechanism: a new patch-openclaw-doctor-mutable-perms.mts narrows doctor's
over-open test from group+other bits (`stat.mode & 63`) to OTHER (world) bits
only (`stat.mode & 7`) when running inside an OpenShell sandbox. Group bits —
the gateway's intended shared access — are then tolerated, so the 2770/660
contract is neither warned about nor tightened, while genuinely world-accessible
modes (e.g. 2777/664) are still caught and repaired. Out-of-sandbox behavior is
byte-identical to upstream. The gate keys on OPENSHELL_SANDBOX being set (not
`=== "1"`): OpenShell injects the sandbox name there, verified on 0.0.44.

Because the fix lives in the baked image, it applies regardless of host OS and
whether the connect-shell guard is loaded, resolving both the All-Platforms
NVIDIA#4538 and the macOS NVIDIA#4859 reports. The NVIDIA#5017 guard is kept as defense-in-depth
for sandboxes built before this patch.

E2E (real onboarded sandbox, patched image, OpenClaw 2026.5.27):
- connect-shell `openclaw doctor --fix`: exit 0, 0 scary messages, 0 bashrc
  EACCES, perms stay 2770/660.
- raw `command openclaw doctor --fix` (guard bypassed, NVIDIA#4859 path): exit 0,
  0 scary messages, perms stay 2770/660.
- unpatched baseline: 4 scary messages, perms regress to 700/600.

The patch classifies the compiled doctor state-integrity module by content
signature, requires exactly the two reviewed permission gates, fails closed on
shape drift, and is idempotent and a no-op when absent.

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>