NVIDIA · cv · Jul 3, 2026 · Jun 22, 2026 · Jun 23, 2026 · Jun 23, 2026
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -409,7 +409,7 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-gateway-auth-contract
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_NON_INTERACTIVE: "1"
-      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.71"
+      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.72"
       DOCKER_GRPC_PROBE_IMAGE: "node:22-trixie-slim@sha256:2d9f5c76c8f4dd36e8f253bee5d828a83a6c09f36188f0b0414325232e0b175d"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

diff --git a/.github/workflows/installer-hash-check.yaml b/.github/workflows/installer-hash-check.yaml
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Verifies pinned installer SHA-256 hashes still match upstream scripts.
-# Checked: Ollama installer.
+# Checked: Ollama installer and OpenShell v0.0.72 release assets.
 # Runs on every PR and push to main, plus a weekly scheduled check.
 
 name: Security / Installer Hash Check
@@ -28,6 +28,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Verify installer hashes are current
         run: bash scripts/check-installer-hash.sh
diff --git a/docs/about/release-notes.mdx b/docs/about/release-notes.mdx
@@ -16,6 +16,14 @@ NVIDIA NemoClaw is available in early preview starting March 16, 2026.
 Use this page to track the highlights of the latest release.
 For more detailed release notes, refer to the [NemoClaw GitHub announcements](https://github.com/NVIDIA/NemoClaw/discussions/categories/announcements?discussions_q=is%3Aopen+category%3AAnnouncements).
 
+## v0.0.72
+
+NemoClaw v0.0.72 advances to OpenShell `0.0.72` and adopts its safe policy round-trip boundary:
+
+- Stable installs pin OpenShell `0.0.72` release artifacts and supervisor image, adding MCP Streamable HTTP and JSON-RPC request-policy enforcement.
+- Policy mutations now read the round-trippable base policy instead of the effective policy, preventing provider-composed `_provider_*` entries from being sent back through `policy set` while preserving existing MCP rules.
+  For more information, refer to [OpenShell 0.0.72 Compatibility Review](../security/openshell-0.0.72-compatibility-review) and [Customize the Network Policy](../network-policy/customize-network-policy).
+
 ## v0.0.70
 
 NemoClaw v0.0.70 hardens OpenShell gateway auth and Hermes recovery behavior:

diff --git a/docs/index.yml b/docs/index.yml
@@ -137,6 +137,9 @@ navigation:
               - page: "Credential Storage"
                 path: _build/agent-variants/security/credential-storage.openclaw.generated.mdx
                 slug: credential-storage
+              - page: "OpenShell 0.0.72 Compatibility Review"
+                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.openclaw.generated.mdx
+                slug: openshell-0.0.72-compatibility-review
               - page: "OpenShell 0.0.71 Review"
                 path: _build/agent-variants/security/openshell-0.0.71-gateway-auth-review.openclaw.generated.mdx
                 slug: openshell-0.0.71-gateway-auth-review
@@ -286,6 +289,9 @@ navigation:
               - page: "Credential Storage"
                 path: _build/agent-variants/security/credential-storage.hermes.generated.mdx
                 slug: credential-storage
+              - page: "OpenShell 0.0.72 Compatibility Review"
+                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.hermes.generated.mdx
+                slug: openshell-0.0.72-compatibility-review
               - page: "OpenShell 0.0.71 Review"
                 path: _build/agent-variants/security/openshell-0.0.71-gateway-auth-review.hermes.generated.mdx
                 slug: openshell-0.0.71-gateway-auth-review

diff --git a/docs/network-policy/customize-network-policy.mdx b/docs/network-policy/customize-network-policy.mdx
@@ -142,28 +142,29 @@ This path preserves existing policy entries and is the only NemoClaw-supported f
 $$nemoclaw my-assistant policy-add
 ```
 
-NemoClaw reads the live policy with `openshell policy get --full`, structurally merges your preset's `network_policies` into it, and writes the merged result back.
+NemoClaw reads the round-trippable base policy with `openshell policy get --base`, structurally merges your preset's `network_policies` into it, and writes the merged result back.
+Provider-composed `_provider_*` entries are excluded because OpenShell reserves that namespace and rejects it in `policy set`.
 Existing presets and the baseline remain in place.
 The preset file under `presets/` also persists across sandbox recreations.
 
 ### Option 2: Snapshot, Edit, and Set with OpenShell
 
 Use this path only when you cannot add a file under the NemoClaw source tree.
 Start from the current live policy so the presets layered on at onboarding stay in the file you apply.
-Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 Strip the OpenShell metadata header before editing the file, then validate the raw policy shape before replacing your editable copy.
 The command order below matches the commands NemoClaw emits internally.
 
 ```bash
 # shellcheck shell=bash
 # Source-of-truth review:
-# invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+# invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
 # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
 # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
 # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
 # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
 tmp_policy=$(mktemp)
-openshell policy get --full my-assistant \
+openshell policy get --base my-assistant \
   | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
   > "$tmp_policy" \
   && grep -q '^version:' "$tmp_policy" \

diff --git a/docs/network-policy/integration-policy-examples.mdx b/docs/network-policy/integration-policy-examples.mdx
@@ -365,18 +365,18 @@ $$nemoclaw my-assistant policy-list
 ```
 
 Use OpenShell when you need an editable copy of the live policy.
-Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 
 ```bash
 # shellcheck shell=bash
 # Source-of-truth review:
-# invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+# invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
 # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
 # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
 # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
 # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
 tmp_policy=$(mktemp)
-openshell policy get --full my-assistant \
+openshell policy get --base my-assistant \
   | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
   > "$tmp_policy" \
   && grep -q '^version:' "$tmp_policy" \

diff --git a/docs/reference/cli-selection-guide.mdx b/docs/reference/cli-selection-guide.mdx
@@ -118,18 +118,18 @@ Use `openshell` when the docs explicitly call for a live OpenShell gateway opera
 
 - Inspect or replace raw OpenShell policy:
 
-  Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+  Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 
   ```bash
   # shellcheck shell=bash
   # Source-of-truth review:
-  # invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+  # invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
   # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
   # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
   # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
   # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
   tmp_policy=$(mktemp)
-  openshell policy get --full <sandbox-name> \
+  openshell policy get --base <sandbox-name> \
     | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
     > "$tmp_policy" \
     && grep -q '^version:' "$tmp_policy" \
@@ -228,7 +228,8 @@ Use `$$nemoclaw <name> policy-add` or `policy-remove` for NemoClaw presets and c
 NemoClaw merges the new policy with the live policy and reapplies presets during rebuilds.
 
 Use `openshell policy update` for precise live endpoint or REST rule changes.
-Use `openshell policy get --full <name>` and `openshell policy set --policy <file> --wait <name>` only when you need to edit and replace the raw policy file.
+Use `openshell policy get --base <name>` and `openshell policy set --policy <file> --wait <name>` only when you need to edit and replace the round-trippable base policy.
+Use `--full` only to inspect the effective policy, including provider-composed rules.
 
 ### Move Workspace Files
 

diff --git a/docs/reference/commands-nemohermes.mdx b/docs/reference/commands-nemohermes.mdx
@@ -1746,7 +1746,7 @@ All ports must be non-privileged integers between 1024 and 65535.
 | Variable | Default | Service |
 |----------|---------|---------|
 | `NEMOCLAW_GATEWAY_PORT` | 8080 | OpenShell gateway port |
-| `NEMOCLAW_GATEWAY_BIND_ADDRESS` | 127.0.0.1 | OpenShell gateway bind address. Docker-driver gateways on OpenShell 0.0.71 keep this on loopback while gateway JWT auth is active. |
+| `NEMOCLAW_GATEWAY_BIND_ADDRESS` | 127.0.0.1 | The OpenShell gateway uses this bind address; Docker-driver gateways on OpenShell 0.0.72 keep it on loopback while gateway JWT auth is active. |
 | `NEMOCLAW_DASHBOARD_PORT` | 18789 (auto-derived from `CHAT_UI_URL` port if set) | Dashboard or API forward |
 | `NEMOCLAW_VLLM_PORT` | 8000 | vLLM / NIM inference |
 | `NEMOCLAW_OLLAMA_PORT` | 11434 | Ollama inference |
@@ -1760,7 +1760,7 @@ When you run multiple NemoClaw gateways with different `NEMOCLAW_GATEWAY_PORT` v
 On non-WSL hosts, `NEMOCLAW_OLLAMA_PORT` and `NEMOCLAW_OLLAMA_PROXY_PORT` must be different.
 If you run Ollama on port 11435, set `NEMOCLAW_OLLAMA_PROXY_PORT` to another free port before onboarding.
 
-`NEMOCLAW_GATEWAY_BIND_ADDRESS` accepts only `127.0.0.1` and `0.0.0.0`, but Docker-driver gateways on OpenShell 0.0.71 reject `0.0.0.0` while gateway JWT auth is active.
+`NEMOCLAW_GATEWAY_BIND_ADDRESS` accepts only `127.0.0.1` and `0.0.0.0`, but Docker-driver gateways on OpenShell 0.0.72 reject `0.0.0.0` while gateway JWT auth is active.
 Keep the OpenShell gateway on loopback and use `NEMOCLAW_DASHBOARD_BIND` when you need remote browser/API access.
 
 `NEMOCLAW_DASHBOARD_BIND` controls the dashboard or API port forward bind address.
@@ -1890,7 +1890,7 @@ Set them before running `nemohermes onboard`.
 | `NEMOCLAW_SANDBOX_GPU` | `auto`, `1`, or `0` | Controls sandbox GPU passthrough during onboarding. `auto` enables GPU passthrough when an NVIDIA GPU is detected, `1` requires GPU passthrough, and `0` forces CPU-only sandbox creation. |
 | `NEMOCLAW_SANDBOX_GPU_DEVICE` | OpenShell GPU device selector | Selects the GPU device passed with `openshell sandbox create --gpu-device`. Requires explicit sandbox GPU enablement with `NEMOCLAW_SANDBOX_GPU=1` (or `--sandbox-gpu` for CLI-driven onboarding); otherwise onboarding rejects the selector instead of treating it as an implicit opt-in. |
 | `NEMOCLAW_DOCKER_GPU_PATCH` | `0` to disable, anything else to keep the default | Controls the Linux Docker-driver GPU sandbox compatibility patch. Set to `0` only as an escape hatch when the patch fails and you need onboarding to continue without patching the GPU sandbox container. |
-| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | Explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run. This mode uses host networking and mounts the Docker socket read-only, but the socket still exposes the privileged Docker API. Use it only on a trusted local host; prefer OpenShell 0.0.71's directly supported glibc 2.28+ path. See the [OpenShell 0.0.71 gateway auth review](../security/openshell-0.0.71-gateway-auth-review#source-of-truth-boundaries). |
+| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | This setting explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run; use it only on a trusted local host because it uses host networking and mounts the Docker socket read-only even though the socket still exposes the privileged Docker API; prefer OpenShell 0.0.72's directly supported glibc 2.28+ path; see the [OpenShell 0.0.72 compatibility review](../security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for details. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_BIN` | path | Advanced override for the `openshell-gateway` binary used by the Linux Docker-driver standalone fallback. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_SANDBOX_BIN` | path | Advanced override for the `openshell-sandbox` binary used by the Linux Docker-driver standalone fallback. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR` | path | Advanced override for the Linux Docker-driver gateway SQLite state directory and standalone-fallback PID file. Defaults to `~/.local/state/nemoclaw/openshell-docker-gateway`. |

diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
@@ -2104,7 +2104,7 @@ All ports must be non-privileged integers between 1024 and 65535.
 | Variable | Default | Service |
 |----------|---------|---------|
 | `NEMOCLAW_GATEWAY_PORT` | 8080 | OpenShell gateway port |
-| `NEMOCLAW_GATEWAY_BIND_ADDRESS` | 127.0.0.1 | OpenShell gateway bind address. Docker-driver gateways on OpenShell 0.0.71 keep this on loopback while gateway JWT auth is active. |
+| `NEMOCLAW_GATEWAY_BIND_ADDRESS` | 127.0.0.1 | The OpenShell gateway uses this bind address; Docker-driver gateways on OpenShell 0.0.72 keep it on loopback while gateway JWT auth is active. |
 | `NEMOCLAW_DASHBOARD_PORT` | 18789 (auto-derived from `CHAT_UI_URL` port if set) | Dashboard or API forward |
 | `NEMOCLAW_VLLM_PORT` | 8000 | vLLM / NIM inference |
 | `NEMOCLAW_OLLAMA_PORT` | 11434 | Ollama inference |
@@ -2118,7 +2118,7 @@ When you run multiple NemoClaw gateways with different `NEMOCLAW_GATEWAY_PORT` v
 On non-WSL hosts, `NEMOCLAW_OLLAMA_PORT` and `NEMOCLAW_OLLAMA_PROXY_PORT` must be different.
 If you run Ollama on port 11435, set `NEMOCLAW_OLLAMA_PROXY_PORT` to another free port before onboarding.
 
-`NEMOCLAW_GATEWAY_BIND_ADDRESS` accepts only `127.0.0.1` and `0.0.0.0`, but Docker-driver gateways on OpenShell 0.0.71 reject `0.0.0.0` while gateway JWT auth is active.
+`NEMOCLAW_GATEWAY_BIND_ADDRESS` accepts only `127.0.0.1` and `0.0.0.0`, but Docker-driver gateways on OpenShell 0.0.72 reject `0.0.0.0` while gateway JWT auth is active.
 Keep the OpenShell gateway on loopback and use `NEMOCLAW_DASHBOARD_BIND` when you need remote browser/API access.
 
 `NEMOCLAW_DASHBOARD_BIND` controls the dashboard or API port forward bind address.
@@ -2343,7 +2343,7 @@ Set them before running `$$nemoclaw onboard`.
 | `NEMOCLAW_SANDBOX_GPU` | `auto`, `1`, or `0` | Controls sandbox GPU passthrough during onboarding. `auto` enables GPU passthrough when an NVIDIA GPU is detected, `1` requires GPU passthrough, and `0` forces CPU-only sandbox creation. |
 | `NEMOCLAW_SANDBOX_GPU_DEVICE` | OpenShell GPU device selector | Selects the GPU device passed with `openshell sandbox create --gpu-device`. Requires explicit sandbox GPU enablement with `NEMOCLAW_SANDBOX_GPU=1` (or `--sandbox-gpu` for CLI-driven onboarding); otherwise onboarding rejects the selector instead of treating it as an implicit opt-in. |
 | `NEMOCLAW_DOCKER_GPU_PATCH` | `0` to disable, anything else to keep the default | Controls the Linux Docker-driver GPU sandbox compatibility patch. Set to `0` only as an escape hatch when the patch fails and you need onboarding to continue without patching the GPU sandbox container. |
-| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | Explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run. This mode uses host networking and mounts the Docker socket read-only, but the socket still exposes the privileged Docker API. Use it only on a trusted local host; prefer OpenShell 0.0.71's directly supported glibc 2.28+ path. See the [OpenShell 0.0.71 gateway auth review](../security/openshell-0.0.71-gateway-auth-review#source-of-truth-boundaries). |
+| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | This setting explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run; use it only on a trusted local host because it uses host networking and mounts the Docker socket read-only even though the socket still exposes the privileged Docker API; prefer OpenShell 0.0.72's directly supported glibc 2.28+ path; see the [OpenShell 0.0.72 compatibility review](../security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for details. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_BIN` | path | Advanced override for the `openshell-gateway` binary used by the Linux Docker-driver standalone fallback. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_SANDBOX_BIN` | path | Advanced override for the `openshell-sandbox` binary used by the Linux Docker-driver standalone fallback. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR` | path | Advanced override for the Linux Docker-driver gateway SQLite state directory and standalone-fallback PID file. Defaults to `~/.local/state/nemoclaw/openshell-docker-gateway`. |

diff --git a/docs/reference/network-policies.mdx b/docs/reference/network-policies.mdx
@@ -136,18 +136,18 @@ openshell policy update <sandbox-name> --add-endpoint api.example.com:443:read-o
 ```
 
 To replace the live policy with a complete raw policy file, start from the live policy and use `openshell policy set`.
-Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 
 ```bash
 # shellcheck shell=bash
 # Source-of-truth review:
-# invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+# invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
 # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
 # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
 # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
 # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
 tmp_policy=$(mktemp)
-openshell policy get --full <sandbox-name> \
+openshell policy get --base <sandbox-name> \
   | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
   > "$tmp_policy" \
   && grep -q '^version:' "$tmp_policy" \