chore(deps): bump plugins/nemoclaw from a47ddd8 to 0de2789

[dependabot]

Bumps plugins/nemoclaw from a47ddd8 to 0de2789.

Commits

• 0de2789 test(e2e): model boot restart before recovery (#8049)
• 31fb403 fix(onboard): enforce cron inference readiness budget (#8046)
• dfc789d fix(onboard): reuse DNS-pinned endpoint validation (#8044)
• 47df762 fix(rebuild): persist replacement lifecycle proof (#8042)
• a77b44e fix(rebuild): remove obsolete sandbox images (#8039)
• 9bc461f fix(cli): clean up headless gateway fallback (#8033)
• 3aeee69 fix(onboard): fit streaming probe within phase budget (#8038)
• 227e8b9 docs: add v0.0.100 release entry (#8030)
• 4feccff fix(skills): preserve superseded PR attribution (#7974)
• 02b2c74 fix(snapshot): stabilize pending pairing publication (#8021)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 22, 2026, 3:07 AM ET / 07:07 UTC.

ClawSweeper review

What this changes

The PR updates the NemoClaw external-plugin fixture from commit a47ddd8 to 0de2789.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: the pin changes, but the generated reports still publish evidence links for the previous NemoClaw revision.

Priority: P2
Reviewed head: 9858913c7ea59c8637bf61f1bc74bb6b48764432

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The pin is narrow and CI-backed, but required generated report evidence is absent.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored fixture-pin update is exempt from the external-contributor proof gate; the necessary merge evidence is regenerated credential-free reports.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored fixture-pin update is exempt from the external-contributor proof gate; the necessary merge evidence is regenerated credential-free reports.
Evidence reviewed	6 items	Current main remains on the old fixture pin: Current main records NemoClaw at a47ddd8, so it does not already include this update. PR changes the fixture pin only: The reviewed PR head moves the NemoClaw gitlink to 0de2789 while its GitHub diff contains one changed path. Report renderer derives links from the checked-out gitlink: The report library reads submodule SHA values from HEAD and uses the matched SHA to build upstream blob URLs.
Findings	1 actionable finding	[P2] Regenerate reports for the new fixture pin
Security	None	None.

Live Verification

Command: node scripts/generate-report.mjs --fixture-set nemoclaw

Result: FAIL (partial) — step 3 expect_output reports/crabpot-report.md: expected terminal output was not visible within 30 seconds: "reports/crabpot-report.md"

node scripts/generate-report.mjs --fixture-set nemoclaw
runner@runnervm76f27:/tmp/clawsweeper-live-proof-279-kXGW0L/target$ node scripts/generate-report.mjs --fixture-set nemoclaw
node scripts/generate-report.mjs --fixture-set nemoclaw
wrote /tmp/clawsweeper-live-proof-279-kXGW0L/target/reports/crabpot-report.md
wrote /tmp/clawsweeper-live-proof-279-kXGW0L/target/reports/crabpot-report.json
wrote /tmp/clawsweeper-live-proof-279-kXGW0L/target/reports/crabpot-issues.md
runner@runnervm76f27:/tmp/clawsweeper-live-proof-279-kXGW0L/target$ node scripts/generate-report.mjs --fixture-set nemoclaw
wrote /tmp/clawsweeper-live-proof-279-kXGW0L/target/reports/crabpot-report.md
wrote /tmp/clawsweeper-live-proof-279-kXGW0L/target/reports/crabpot-report.json
wrote /tmp/clawsweeper-live-proof-279-kXGW0L/target/reports/crabpot-issues.md
runner@runnervm76f27:/tmp/clawsweeper-live-proof-279-kXGW0L/target$ rg -c '0de2789608a86e580d787991e81c03c5f0b14dbf' reports/crabpot-report.md reports/crabpot-i
ssues.md
Command 'rg' not found, but can be installed with:
apt install ripgrep
Please ask your administrator.
runner@runnervm76f27:/tmp/clawsweeper-live-proof-279-kXGW0L/target$

Assertions:

• FAIL expect_output: reports/crabpot-report.md

How this fits together

Crabpot inspects configured external plugin fixtures and publishes generated compatibility reports. Fixture gitlink commits feed the upstream evidence links in those reports.

flowchart LR
  A[Fixture configuration] --> B[NemoClaw submodule]
  B --> C[Inspector and report generator]
  C --> D[Gitlink revision lookup]
  D --> E[Generated evidence links]
  E --> F[Published compatibility reports]

Loading

Before merge

• Regenerate reports for the new fixture pin (P2) - The report renderer derives upstream evidence URLs from the current submodule gitlink, but this branch changes only plugins/nemoclaw; the two checked-in reports still contain 42 links to a47ddd8. Regenerate and commit them for 0de2789 so published evidence identifies the inspected fixture.
• Resolve merge risk (P1) - Merging the new gitlink while retaining old report links would publish evidence for a different NemoClaw revision than the fixture actually inspected.

Findings

• [P2] Regenerate reports for the new fixture pin — plugins/nemoclaw:1

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Stale evidence links	42 stale links across 2 generated reports	Published evidence would point to the old upstream revision after the fixture pin changes.

Merge-risk options

Maintainer options:

1. Refresh generated fixture evidence (recommended)
   Regenerate the checked-in reports from the updated fixture so all published NemoClaw links resolve to 0de2789 before merging.
2. Pause the update
   Close or defer this pin bump if a reproducible report refresh cannot be produced for the target revision.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Regenerate the NemoClaw fixture reports and verify no a47ddd8 evidence URL remains; do not alter other fixture pins.

Technical review

Best possible solution:

Regenerate and commit the NemoClaw-derived reports against 0de2789, then retain the pin only when their evidence links identify that revision.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection shows the pin at 0de2789 while 42 generated report links still name a47ddd8.

Is this the best way to solve the issue?

Yes—repository policy and the report renderer make regenerating the checked-in evidence the narrow maintainable repair.

Full review comments:

• [P2] Regenerate reports for the new fixture pin — plugins/nemoclaw:1
  The report renderer derives upstream evidence URLs from the current submodule gitlink, but this branch changes only plugins/nemoclaw; the two checked-in reports still contain 42 links to a47ddd8. Regenerate and commit them for 0de2789 so published evidence identifies the inspected fixture.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b03503877def.

Labels

Label justifications:

• P2: The update is a bounded fixture-maintenance change with a concrete report-consistency defect.
• merge-risk: 🚨 compatibility: The fixture pin and its published source-evidence links would disagree after merge.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot-authored fixture-pin update is exempt from the external-contributor proof gate; the necessary merge evidence is regenerated credential-free reports.

Evidence

Acceptance criteria:

• [P1] node scripts/generate-report.mjs --fixture-set nemoclaw.
• [P1] rg '0de2789608a86e580d787991e81c03c5f0b14dbf' reports/crabpot-report.md reports/crabpot-issues.md.
• [P1] ! rg -n 'a47ddd896eb1bae3d0ecc4136c7e039d2f822eaa' reports/crabpot-report.md reports/crabpot-issues.md.

What I checked:

• Current main remains on the old fixture pin: Current main records NemoClaw at a47ddd8, so it does not already include this update. (plugins/nemoclaw:1, b03503877def)
• PR changes the fixture pin only: The reviewed PR head moves the NemoClaw gitlink to 0de2789 while its GitHub diff contains one changed path. (plugins/nemoclaw:1, 9858913c7ea5)
• Report renderer derives links from the checked-out gitlink: The report library reads submodule SHA values from HEAD and uses the matched SHA to build upstream blob URLs. (scripts/report-lib.mjs:269, 9858913c7ea5)
• Generated reports retain the previous revision: The two checked-in Markdown reports contain 42 links to a47ddd8—21 each—rather than the PR's 0de2789 fixture revision. (reports/crabpot-report.md:1121, 9858913c7ea5)
• Repository policy requires synchronized generated expectations: The applicable repository policy requires package-version changes to update the source ref and generated report/test expectations. (AGENTS.md:10, 9858913c7ea5)
• Prior fixture-refresh provenance: Recent main history includes a fixture refresh by Peter Steinberger and the prior Dependabot NemoClaw pin update. (plugins/nemoclaw:1, db6987c128f5)

Likely related people:

• Peter Steinberger: Authored the recent main-branch fixture refresh affecting this surface. (role: recent fixture-refresh contributor; confidence: medium; commits: b92a5b604375; files: plugins/nemoclaw, reports/crabpot-report.md, reports/crabpot-issues.md)
• Vincent Koc: History sampling shows substantial authorship across report-generation paths, though shallow history limits line-level provenance. (role: report-generation area contributor; confidence: medium; files: scripts/report-lib.mjs, scripts/generate-report.mjs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Regenerate the two affected Markdown reports against 0de2789.
• Verify that no a47ddd8 NemoClaw evidence URL remains before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (61 earlier review cycles; latest 8 shown)

• reviewed 2026-08-09T17:32:54.310Z sha 9858913 :: needs changes before merge. :: [P2] Regenerate report artifacts for the new fixture pin
• reviewed 2026-08-09T19:32:06.006Z sha 9858913 :: found issues before merge. :: [P2] Regenerate reports for the new fixture pin
• reviewed 2026-08-09T21:03:25.292Z sha 9858913 :: needs changes before merge. :: [P2] Regenerate reports for the new fixture pin
• reviewed 2026-08-09T22:13:26.282Z sha 9858913 :: needs changes before merge. :: [P2] Regenerate reports for the new fixture pin
• reviewed 2026-08-11T05:11:37.377Z sha 9858913 :: found issues before merge. :: [P2] Regenerate reports for the new fixture pin
• reviewed 2026-08-11T05:15:15.571Z sha 9858913 :: found issues before merge. :: [P2] Regenerate reports for the new fixture pin
• reviewed 2026-08-11T07:14:22.233Z sha 9858913 :: found issues before merge. :: [P2] Regenerate reports for the new fixture pin
• reviewed 2026-08-11T11:09:55.493Z sha 9858913 :: needs changes before merge. :: [P2] Regenerate reports for the new fixture pin