docs: address post-tag audit findings and adjust DORI install guidance

.gitignore

@@ -20,6 +20,7 @@ Thumbs.db
 
 # Project-specific
 .nemoclaw-maintainer/
+# Legacy DORI status file; no longer read, kept ignored to prevent accidental commits.
 .dori_user_status
 draft_newsletter_*
 research/

AGENTS.md

@@ -297,46 +297,28 @@ If the command trace contains no reviewer-request write, report the event as an
 
 ### NVIDIA DORI Routing
 
-Use the ignored `.dori_user_status` file at the repository root to select the
-documentation path. The file can contain only one line: `authorized` or
-`external`.
-
-1. Read `.dori_user_status` before checking for DORI.
-   - If the value is `external`, use the
-     [Writing Style Guide](docs/AGENTS.md#writing-style-guide) without checking
-     DORI.
-   - If the value is `authorized`, continue to step 2.
-   - If the file is absent or invalid, ask the user to select one of these
-     options. Use selectable options when the host supports them. Otherwise,
-     present the numbered list:
-
-     1. Select `authorized` if you are an NVIDIA employee or authorized
-        contractor with access to `gitlab-master.nvidia.com`.
-     2. Select `external` for all other contributors.
-
-   - Normalize an unambiguous response and write only the corresponding
-     lowercase value to `.dori_user_status`.
-     - Store `authorized` for option 1, `1`, `authorized`, or a response that
-       clearly selects `authorized`, such as `yes, authorized`.
-     - Store `external` for option 2, `2`, `external`, or a response that
-       clearly selects `external`.
-     - If the response is ambiguous, selects both options, or does not select
-       either option, ask again and do not write the file.
-   - If the user declines to answer or store a value, do not create the file.
-     Use the [Writing Style Guide](docs/AGENTS.md#writing-style-guide).
-   - Tell the user that deleting `.dori_user_status` resets the choice.
-2. Only after an `authorized` value, check whether the current agent exposes
-   `dori_handle` or `dori_route`.
-   - If DORI is available, use it for task routing. When `dori_collections` is
-     available, verify that a collection source contains
-     `tech-docs/skill-library`.
-   - If DORI is unavailable or the Skill Library is missing, follow
-     [NVIDIA DORI Setup](docs/DORI_SETUP.md).
-
-The stored value does not prove access or approve installation or host
-configuration. Use the
-[Writing Style Guide](docs/AGENTS.md#writing-style-guide) if setup is declined
-or fails.
+Select the documentation path from current host capabilities.
+Do not ask the user to classify themselves or store repository-scoped identity
+state during a normal documentation task.
+
+1. Check whether the current agent exposes `dori_handle` or `dori_route` and
+   `dori_collections`.
+   If the user explicitly asks not to use DORI, use the
+   [Writing Style Guide](docs/AGENTS.md#writing-style-guide) instead.
+2. When those tools are available, list the installed collections.
+   - If a collection source contains `tech-docs/skill-library`, use DORI for
+     task routing.
+   - If the collection is missing, inaccessible, or cannot be verified,
+     continue with the
+     [Writing Style Guide](docs/AGENTS.md#writing-style-guide).
+3. When the DORI tools are unavailable, continue with the Writing Style Guide.
+   Do not inspect a shell-visible CLI, install software, or configure the host
+   during a normal documentation task.
+4. Use [NVIDIA DORI Setup](docs/DORI_SETUP.md) only when the user explicitly
+   asks to install or configure DORI.
+
+Capability detection does not approve installation or host configuration.
+DORI unavailability must not block documentation work.
 
 ## PR Requirements
 

docs/AGENTS.md

@@ -75,10 +75,10 @@ Apply these rules to documentation, examples, headings, UI text, and release not
 
 ## Use DORI for Complete NVIDIA Doc Tools
 
-Follow [NVIDIA DORI Routing](../AGENTS.md#nvidia-dori-routing) before checking for DORI.
-Only an `authorized` value can select the DORI path.
-When root routing selects that path, you can use DORI for additional documentation tools.
-Complete the documentation before the developer opens the pull or merge request.
+Follow [NVIDIA DORI Routing](../AGENTS.md#nvidia-dori-routing).
+Use the following DORI workflow only when current host capabilities include the
+verified NVIDIA documentation Skill Library. Complete the documentation before
+the developer opens the pull or merge request.
 
 1. Route the documentation task through DORI. Include the changed source files,
    the user-visible impact, the documentation that might need updates, and the
@@ -91,8 +91,9 @@ Complete the documentation before the developer opens the pull or merge request.
 4. When the host does not support subagents, complete the same documentation
    work in the primary task.
 
-If root routing directs you to the Writing Style Guide, or if DORI is unavailable, inaccessible, declined, or fails, do not block the change.
-Continue using the Writing Style Guide above.
+If the verified Skill Library is unavailable, inaccessible, or fails, skip DORI.
+Do not attempt routing, prompt for setup, or ask for or persist a user
+classification. Continue using the Writing Style Guide above.
 
 ## Before Editing
 

docs/DORI_SETUP.md

@@ -5,10 +5,15 @@
 
 # NVIDIA DORI Setup
 
-Use this guide only after the root `AGENTS.md` reads an `authorized` value from `.dori_user_status`.
-The stored value does not prove private access or approve installation or host configuration.
+Use this guide only when the user explicitly asks to install or configure NVIDIA DORI.
+Before inspecting or installing private components, ask the user to confirm that they can access `gitlab-master.nvidia.com`.
+If the user does not confirm access, stop this setup and use the checked-in [Writing Style Guide](AGENTS.md#writing-style-guide).
+Access confirmation does not approve installation or host configuration.
 
-If the status is not `authorized`, stop this setup and use the checked-in [Writing Style Guide](AGENTS.md#writing-style-guide).
+Use these internal sources for the current installation and registration instructions:
+
+- [NVIDIA Skill Library](https://gitlab-master.nvidia.com/tech-docs/skill-library) contains documentation-focused Agent Skills and guidance for installing them with DORI and other supported hosts.
+- [NVIDIA Template Library](https://gitlab-master.nvidia.com/tech-docs/template-library) contains reusable documentation templates and guidance for installing its template skills with DORI.
 
 ## Inspect the Environment
 
@@ -50,7 +55,7 @@ Before an installation or host configuration change, ask:
 > Do you want me to install or configure these components in your user environment?
 
 Continue only after explicit approval.
-An `authorized` status does not approve these changes.
+The user's private-source access confirmation does not approve these changes.
 If the user declines, use the [Writing Style Guide](AGENTS.md#writing-style-guide).
 
 ## Install Missing Components
@@ -103,8 +108,8 @@ Until the current agent exposes DORI tools, continue the original task with the
 - Never search for, request, print, copy, export, or embed a token, password, cookie, SSH key, or credential-bearing URL.
 - Let `uv`, Git, and DORI use credentials that the user already configured.
   If access is denied or authentication is missing, stop and refer to the internal DORI installation guide.
-- Never stage or commit `.dori_user_status`.
-  Do not treat its value as proof of employment, authorization, or current private access.
+- Do not create repository-scoped identity or authorization files.
+  Confirm private-source access only for an explicit setup request.
 - Do not bypass approval controls for writes outside the repository.
 - Do not create or commit project-scoped DORI state or MCP configuration without separate repository-owner authorization.
 - Do not retry a failed installation in the same task.

docs/changelog/2026-07-30.mdx

@@ -35,7 +35,8 @@ It also hardens host readiness, inference health checks, managed images, documen
 - Trusted CI now publishes agent-complete Open Container Initiative images by immutable digest, validates anonymous pulls and runtime contracts, and promotes aliases only after those checks pass.
   Dormant managed-image selection and startup-profile contracts resolve exact all-agent cohorts and bounded agent-specific startup data without activating buildless onboarding or changing the current `Dockerfile` path.
 - Documentation now keeps provider-switch sections within the applicable OpenClaw and Hermes guide variants, corrects the Omni sub-agent model ID, and generalizes agent-selection guidance.
-  The contributor workflow also separates pre-tag release entries from post-tag Announcements and corrects the NVIDIA DORI installation pin from 0.10.0 to 0.9.0.
+  The runtime identity, two-DGX Station vLLM, and memory search guides are now separate focused pages.
+  The NVIDIA DORI installation pin is corrected from 0.10.0 to 0.9.0.
   For more information, refer to [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers) and [Set Up Task-Specific Sub-Agents](/user-guide/openclaw/configure-agents/set-up-sub-agent).
 - Release E2E now preserves command and agent first-turn latency separately, evaluates recurring anomalies within an exact 12-sample cohort, and routes retired rebuild selectors to focused replacement evidence.
   The credential-generation window runs independently, managed startup recovery covers the persisted startup command, and the standing Brev Launchable waits for the staging image family before deployment.

docs/configure-agents/configure-memory-search.mdx

@@ -16,8 +16,8 @@ This setup lets another local server, such as managed vLLM, continue to serve th
 
 ## Prepare the Embedding Server
 
-Start the host Ollama container with the embedding model.
-This example uses `qwen3-embedding:4b` on port `11434`.
+Before you continue, ensure that a host Ollama container is running on port `11434` and has the `qwen3-embedding:4b` model available.
+This procedure does not start the container or pull the model.
 
 The sandbox reaches the container through `http://host.openshell.internal:11434`.
 Keep the container bound to the local host or a reviewed host interface.
@@ -34,6 +34,8 @@ nemoclaw my-assistant policy add local-inference --yes
 nemoclaw my-assistant exec -- curl -fsS http://host.openshell.internal:11434/api/tags
 ```
 
+Continue only when the returned JSON `models` array contains an entry whose `name` is `qwen3-embedding:4b`.
+
 ## Configure the Embedding Provider
 
 Open a bounded shields-down window before you change the OpenClaw configuration.