docs: complete v0.0.96 post-tag audit fixes

[miyoungc]

Summary

This PR corrects post-tag v0.0.96 documentation drift for exact-loopback no-auth compatible endpoints and local Ollama onboarding.
It also aligns the Windows changelog link label and source-only dependency review headings with their canonical titles and writing rules.

Changes

• Distinguish OpenAI-compatible exact-loopback no-auth mode from the Anthropic-compatible non-empty placeholder requirement from fix(inference): allow keyless localhost endpoints #7427.
• Document the Ollama menu download size, approximate VRAM requirement, and available or total GPU memory fields from feat(onboard): show model size and VRAM headroom in Ollama model menu #7482.
• Document persisted Ollama proxy-token reuse during re-onboarding from test(ollama): preserve proxy token during re-onboard #7620.
• Match the Windows changelog link label to the target page title and remove colons from the source-only dependency review headings.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: Source tests from fix(inference): allow keyless localhost endpoints #7427, feat(onboard): show model size and VRAM headroom in Ollama model menu #7482, and test(ollama): preserve proxy token during re-onboard #7620 protect the shipped behavior, and 21 changelog and link tests pass for this documentation diff.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Reviewed docs/changelog/2026-07-25.mdx, docs/inference/custom-endpoint-security.mdx, docs/inference/set-up-ollama.mdx, and docs/security/sandbox-base-2026-07-25-dependency-review.md against docs/CONTRIBUTING.md and WRITING.md. The exact-head review found no remaining findings.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: not applicable
• Station profile/scenario: not applicable
• Result: not applicable
• Supporting evidence: not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/changelog-docs.test.ts test/check-docs-links.test.ts passed 21 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not run because this is a focused documentation-only change.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only). The command passed with 0 errors and two Fern warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Miyoung Choi miyoungc@nvidia.com

Summary by CodeRabbit

• Documentation
  • Clarified authentication requirements for OpenAI- and Anthropic-compatible endpoints, including options for unauthenticated local services.
  • Updated Ollama onboarding to show download size and VRAM needs, explain GPU memory reporting behavior, and clarify persisted proxy token reuse.
  • Refreshed Windows setup link text and improved sandbox dependency review heading formatting for consistency.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 460266d5-2a77-46b5-afca-56274ee6823b

📥 Commits

Reviewing files that changed from the base of the PR and between 3e7b7da and 5d103d9.

📒 Files selected for processing (1)

• docs/inference/custom-endpoint-security.mdx

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/inference/custom-endpoint-security.mdx

---

📝 Walkthrough

Walkthrough

Documentation updates clarify endpoint authentication rules, Ollama onboarding and proxy-token behavior, a Windows setup reference, and sandbox dependency review headings.

Changes

Documentation updates

Layer / File(s)	Summary
Endpoint authentication guidance docs/inference/custom-endpoint-security.mdx	Documents provider-specific API keys, unauthenticated local endpoints, non-interactive auth configuration, and Anthropic placeholder requirements.
Ollama onboarding and proxy behavior docs/inference/set-up-ollama.mdx	Adds model download and VRAM details and documents persisted proxy-token reuse after reboot and re-onboarding.
References and heading wording docs/changelog/2026-07-25.mdx, docs/security/sandbox-base-2026-07-25-dependency-review.md	Updates the Windows setup link text and reformats the sandbox dependency review headings.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7649: Both PRs modify the same v0.0.96 changelog entry with user-facing release text.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the documentation-only v0.0.96 audit fixes across the changelog and related docs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/post-tag-docs-audit-20260728-100149

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7758.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

3 optional E2E recommendations

• messaging-compatible-endpoint
• ollama-auth-proxy
• inference-routing

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/inference/custom-endpoint-security.mdx`:
- Around line 20-22: Update the non-interactive onboarding sentence in the
custom endpoint security documentation to explicitly scope
NEMOCLAW_COMPATIBLE_AUTH_MODE=none to OpenAI-compatible endpoints. Preserve the
existing localhost no-auth guidance and the documented distinction that
Anthropic-compatible onboarding requires a non-empty authentication value.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4b2c6a1f-20fc-4936-b226-e8971f71e301

📥 Commits

Reviewing files that changed from the base of the PR and between 71a7856 and 3e7b7da.

📒 Files selected for processing (4)

• docs/changelog/2026-07-25.mdx
• docs/inference/custom-endpoint-security.mdx
• docs/inference/set-up-ollama.mdx
• docs/security/sandbox-base-2026-07-25-dependency-review.md