AI 代理安全與執行期
NemoClaw 0.0.116 Persistently Binds Sandbox Identity, Tightening Recovery, Takeover, and Deletion Permissions
After strengthening local inference and state-drift validation in 0.0.113, NVIDIA has further bound sandbox, inference service, and lifecycle permissions to persistently verifiable identities, preventing retry or recovery operations from taking over an environment with the same name but a different identity.
NVIDIA has released NemoClaw 0.0.116, further tightening recovery, takeover, and deletion workflows for agent sandboxes. The new version preserves verified sandbox identities—and the associated network policies, model providers, credentials, and lifecycle management rights—across operation retries and process restarts. If a same-named container has been replaced, or persistent state indicates drift in the source of authority, the system stops making changes, preventing an old lifecycle receipt from mistaking another runtime environment for the original sandbox.
This continues NemoClaw’s recent reliability overhaul. The earlier 0.0.113 release introduced stricter local inference validation for managed vLLM, Ollama, llama.cpp, and model routers. It also addressed sandbox network reconstruction, MCP credential reissuance after policy binding, and drift between configuration and actual state. Building on that work, 0.0.116 persists validation results and lifecycle permissions, so subsequent recovery or deletion operations must still prove that they control the original resources.
The Portable Hermes workflow now handles only Ollama runners explicitly owned by a lifecycle receipt. If a service is still running, the system only validates it and does not restart it arbitrarily. If the service has stopped, it is recovered at most once, followed by a final check from inside the sandbox that the inference route is reachable. If an operation fails, the system attempts to restore the runner and sandbox registry state; if it cannot prove that restoration succeeded, it reports an explicit error. OpenClaw-compatible endpoints are now also tested against `inference.local` from inside the sandbox, allowing misconfigurations that are reachable only from the host to be caught before deployment completes.
Data and takeover controls have also been tightened. By default, uninstalling now creates a fresh snapshot for eligible non-Portable sandboxes; this is skipped only when `--destroy-user-data` is explicitly specified. The Shields automatic recovery timer may take over only after confirming that the process has disappeared or that its startup identity does not match. If identity cannot be verified, it fails closed. When WSL pulls public images but cannot use the Docker Desktop credential helper, it may instead use a temporary credential-free configuration, reducing the risks of headless environments stalling and host credentials leaking.
The significance of 0.0.116 lies not in new agent capabilities, but in making continued modification conditional on whether the agent still controls the original sandbox. However, NemoClaw remains in early preview, and NVIDIA has not published fault-injection results, cross-version recovery success rates, or performance costs. Before upgrading, teams should continue to pin versions and independently validate snapshot, recovery, deletion, and policy-drift scenarios.