docs(hermes): fix agent-specific guidance

docs/inference/switch-providers.mdx

@@ -46,16 +46,28 @@ $$nemoclaw inference set --provider <provider> --model <model> --sandbox <name>
 $$nemoclaw <name> shields up
 ```
 
+</AgentOnly>
+
+<AgentOnly variant="openclaw">
+
 For OpenClaw, NemoClaw updates the provider namespace and selected model in the running configuration.
 Changes within the current API family hot-reload without replacing the gateway process.
 When the API family changes, NemoClaw commits the route and configuration, then restarts only the OpenClaw gateway and verifies its health.
 
+</AgentOnly>
+
+<AgentOnly variant="hermes">
+
 For Hermes, NemoClaw updates `/sandbox/.hermes/config.yaml`, including the model, base URL, API-family mode, and OpenShell proxy API-key placeholder.
 When the dashboard profile exists, NemoClaw also mirrors the route into `/sandbox/.hermes/dashboard-home/config.yaml`; a normal runtime route change does not rebuild or restart Hermes.
 If that dashboard mirror cannot be confirmed, the route and main config remain committed but the command exits nonzero.
 Follow [Hermes dashboard config did not converge](../../reference/troubleshooting#hermes-dashboard-config-did-not-converge) before using Dashboard Chat.
 A missing dashboard profile is treated as disabled and does not fail the switch.
 
+</AgentOnly>
+
+<AgentOnly variant="openclaw,hermes">
+
 If the in-sandbox configuration sync fails after the gateway route changes, NemoClaw keeps the gateway and host registry aligned and prints a rebuild hint.
 Run the rebuild before relying on the running agent.
 

docs/reference/network-policies.mdx

@@ -32,14 +32,6 @@ Deep Agents uses strict Landlock compatibility, so sandbox startup fails when Op
 
 </AgentOnly>
 
-<AgentOnly variant="hermes">
-
-<Note>
-Hermes sandboxes use an agent-specific baseline policy in `agents/hermes/policy-additions.yaml` so Hermes runtime binaries can reach the service endpoints they need while keeping the same deny-by-default model.
-</Note>
-
-</AgentOnly>
-
 ### Filesystem
 
 | Path | Access |

test/agent-variant-docs.test.ts

@@ -292,6 +292,44 @@ import { AgentOnly } from "../_components/AgentGuide";
     expect(deepAgents).not.toContain(namedSandboxSyntax);
   });
 
+  it("excludes OpenClaw gateway behavior from Hermes provider switching (#7902)", () => {
+    const source = readFileSync(
+      new URL("../docs/inference/switch-providers.mdx", import.meta.url),
+      "utf8",
+    );
+    const render = (variant: "openclaw" | "hermes") =>
+      renderAgentVariantPage(source, variant, {
+        sourcePath: "/repo/docs/inference/switch-providers.mdx",
+      });
+    const openclaw = render("openclaw");
+    const hermes = render("hermes");
+    const openClawGatewayBehavior = "restarts only the OpenClaw gateway and verifies its health";
+
+    expect(openclaw).toContain(openClawGatewayBehavior);
+    expect(hermes).not.toContain(
+      "updates the provider namespace and selected model in the running configuration",
+    );
+    expect(hermes).not.toContain(
+      "Changes within the current API family hot-reload without replacing the gateway process",
+    );
+    expect(hermes).not.toContain(openClawGatewayBehavior);
+    expect(hermes).toContain("a normal runtime route change does not rebuild or restart Hermes");
+  });
+
+  it("renders the Hermes baseline-policy explanation once (#7903)", () => {
+    const source = readFileSync(
+      new URL("../docs/reference/network-policies.mdx", import.meta.url),
+      "utf8",
+    );
+    const hermes = renderAgentVariantPage(source, "hermes", {
+      sourcePath: "/repo/docs/reference/network-policies.mdx",
+    });
+    const baselineExplanation =
+      "Hermes sandboxes use an agent-specific baseline policy in `agents/hermes/policy-additions.yaml`";
+
+    expect(hermes.split(baselineExplanation)).toHaveLength(2);
+  });
+
   it("keeps the troubleshooting security review link within each agent guide (#6558)", () => {
     const troubleshooting = readFileSync(
       new URL("../docs/reference/troubleshooting.mdx", import.meta.url),