[obs-gap:nemoclaw] NemoClaw: model-router NVIDIA-only endpoint verdict not surfaced

[github-actions]

Automated harness-observability audit found a gap for nemoclaw.

• Harness exposes: The onboarding model-router module computes poolTargetsOnlyNvidiaEndpoints() — whether the configured model pool routes exclusively through NVIDIA-managed inference endpoints — alongside isManagedModelRouterCurrent/startModelRouter (test/onboard-model-router.test.ts).
• ClawMetry misses: The adapter's _model_router_currency()/_model_router_live()/_model_router_fingerprint() surface install provenance and process health, but never read or report whether the active pool is NVIDIA-endpoint-only. A pool silently pointed at a non-NVIDIA/unmanaged endpoint (data-exfiltration/compliance risk) has no dashboard field today.
• Where (harness): src/lib/onboard/model-router.ts (poolTargetsOnlyNvidiaEndpoints), exercised by test/onboard-model-router.test.ts
• Severity: high
• Closest capability: new

Filed by scripts/harness/audit.py. Fingerprint: hgap-fcf05cf830 (used to dedupe — keep it in the body).

[vivekchand]

Hi @vivekchand! Took a careful look at this one. Here's the plan:

The problem
The NemoClaw model-router proxy-config can silently route through non-NVIDIA/unmanaged inference endpoints — a data-exfiltration/compliance risk — but ClawMetry has no dashboard field to flag this: the harness's poolTargetsOnlyNvidiaEndpoints() verdict is computed locally but never surfaced anywhere in DetectResult.meta.

Approach

1. Add _model_router_pool_nvidia_only() -> dict in clawmetry/adapters/openclaw.py (~line 1421, alongside the other _model_router_* helpers). It reads <venv>/proxy-config.yaml — the same file _model_router_proxy_config_models() already reads at line 1351 — walks each model's endpoint URL, and checks whether all of them match known NVIDIA-managed inference URL patterns. Returns {"modelRouterPoolNvidiaOnly": True/False}, or {} when the config file is absent (plain OpenClaw, or old NemoClaw installs that pre-date the proxy-config). Never raises.

2. In detect() (~line 2175, inside the existing if "modelRouterFingerprint" in meta: block), call meta.update(_model_router_pool_nvidia_only()) alongside the existing _model_router_live() call so it only runs when a NemoClaw model-router install is actually confirmed present.

Test plan

• Unit: pass a proxy-config YAML string with only NVIDIA endpoint URLs → modelRouterPoolNvidiaOnly: True; add a non-NVIDIA URL → False; absent file → {}.
• Manual: create ~/.nemoclaw/model-router-venv/proxy-config.yaml, verify the field appears in /api/detect output.

Estimated change
~40 lines across 1 file (clawmetry/adapters/openclaw.py).

This one's bigger than I'm comfortable autonomously shipping — specifically the NVIDIA-managed endpoint URL patterns. The harness's poolTargetsOnlyNvidiaEndpoints() lives in src/lib/onboard/model-router.ts in the NemoClaw repo, which I can't clone here to check. The exact set of URL prefixes that qualify as "NVIDIA-managed" needs to match what the harness considers canonical — guessing wrong would produce false-negative compliance flags, which is worse than the current gap. Leaving the plan here for your review — if you can share what URL patterns poolTargetsOnlyNvidiaEndpoints() actually checks (e.g., integrate.api.nvidia.com, api.nvcf.nvidiacloud.net, etc.), or point me to the relevant lines, comment bot-go and I'll pick it up next run.

---

Generated by Claude Code