docs(security): remove internal review pages from public docs (#9062)

<!-- markdownlint-disable MD041 -->
## Summary

Remove point-in-time dependency and migration review artifacts from the
public Security documentation, preserve the remaining maintainer
evidence internally, and delete obsolete Fern review ledgers. Former
public routes now redirect to canonical gateway authentication guidance,
and the dependency-upgrade workflow prevents internal review evidence
from returning to `docs/`.

## Changes

- Move 15 review records from `docs/security/` to
`internal/security-reviews/`, delete two obsolete Fern review records
and their ledger-only test, and document the public/internal ownership
boundary.
- Remove review pages from Security navigation and public
cross-references while preserving supported compatibility guidance on
the canonical gateway authentication page.
- Add direct legacy redirects for extensionless, HTML, index, Markdown,
and MDX route forms, with route regression coverage.
- Update source comments, warnings, and evidence tests to use the
canonical public guidance or internal evidence location.
- Add dependency-upgrade guardrails that keep review evidence out of
`docs/` and prohibit Fern dependency-review documents or durable Fern
review ledgers anywhere in the repository.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Codex Desktop
independently reviewed public/internal security ownership, canonical
redirects, variant output, and retained compatibility guidance on the
final commit.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `docs-updated`
- Evidence: Reviewed
`docs/security/gateway-authentication-controls.mdx`, `docs/index.yml`,
`docs/reference/commands.mdx`, `docs/reference/troubleshooting.mdx`,
changed changelog entries, `fern/docs.yml`,
`internal/security-reviews/`, the Fern review-record deletions and
no-ledger policy, and
`.agents/skills/nemoclaw-contributor-update-dependencies/SKILL.md`;
writing rules and documentation style were reviewed.
- Agent: Codex Desktop
<!-- docs-review-head-sha: 34da83f -->
<!-- docs-review-agents-blob-sha: e30afb2 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: 17
focused Vitest files passed, 197/197 tests; the added Fern no-ledger
policy regression passed, with 31 unrelated tests skipped.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

`npm run docs` passed with 0 errors and 1 existing Fern warning; the
warning checkbox remains clear because the command was not warning-free.

---
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Documentation**
- Updated gateway authentication and compatibility guidance with current
security information, networking details, and supported environments.
- Replaced outdated security-review links across changelogs, commands,
troubleshooting, and navigation.
- Added redirects so retired security documentation URLs continue to
reach the relevant guidance.
- **Security**
- Separated engineering review evidence from publicly published
documentation.
- Clarified which gateway compatibility behavior is opt-in and
documented associated security considerations.
- **Bug Fixes**
- Corrected outdated documentation references and an MCP documentation
link.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>

Author: miyoungc

.agents/skills/nemoclaw-contributor-update-dependencies/SKILL.md

@@ -71,6 +71,16 @@ Pass the reviewed absolute Git and gh executable paths. Preserve its minimal all
 environments and its byte and record ceilings. Keep private report permissions at mode 0600.
 Follow the current collector help when those controls evolve.
 
+## Keep Review Evidence out of Public Documentation
+
+Do not write release ledgers, concern records, reviews, or qualification reports under `docs/`; they are maintainer evidence. Keep temporary evidence outside the repository with private permissions.
+For Fern, do not create a dependency review document or durable review ledger. Keep Fern upgrade
+evidence in the pull request description and executable configuration and publishing tests. Put
+other durable records in `internal/security-reviews/`, by the owning component, or in the pull request description.
+
+For a user-visible change, update the canonical `docs/` page with supported behavior and operator action.
+Do not publish review chronology or concern ledgers, add internal evidence to `docs/index.yml`, or link to it from public documentation.
+
 ## Resolve concerns
 
 Use [Contract audit](references/contract-audit.md) to select the relevant risk surfaces and record

Dockerfile

@@ -603,7 +603,7 @@ ENV AWS_EC2_METADATA_DISABLED=true
 COPY --from=builder /usr/local/bin/node /usr/local/bin/node
 
 # Dependency review evidence for this runtime pin lives in
-# docs/security/openclaw-2026.7.1-dependency-review.md.
+# internal/security-reviews/openclaw-2026.7.1-dependency-review.md.
 ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_2026_7_1_INTEGRITY=sha512-ge/Xss99CHAjPL/ikmH/UFoiOrjcxDB4sW3y9mhyCD+dYW3wzV7TKbAVdkrXFgAG2d2BjpJofP97zUZ+umxo8g==
 ARG OPENCLAW_2026_7_1_TARBALL=https://registry.npmjs.org/openclaw/-/openclaw-2026.7.1.tgz

Dockerfile.base

@@ -380,7 +380,7 @@ RUN chmod 444 /usr/local/lib/nemoclaw/sandbox-rlimits.sh \
 # the base image on push to main, or use workflow_dispatch on base-image.yaml
 # with the openclaw_version input for a one-off build without editing this file.
 # Dependency review evidence for this runtime pin lives in
-# docs/security/openclaw-2026.7.1-dependency-review.md.
+# internal/security-reviews/openclaw-2026.7.1-dependency-review.md.
 ARG OPENCLAW_VERSION=2026.7.1
 ARG OPENCLAW_2026_7_1_INTEGRITY=sha512-ge/Xss99CHAjPL/ikmH/UFoiOrjcxDB4sW3y9mhyCD+dYW3wzV7TKbAVdkrXFgAG2d2BjpJofP97zUZ+umxo8g==
 ARG OPENCLAW_2026_7_1_TARBALL=https://registry.npmjs.org/openclaw/-/openclaw-2026.7.1.tgz

docs/changelog/2026-06-30.mdx

@@ -12,7 +12,7 @@ NemoClaw v0.0.71 improves gateway recovery, OpenShell gateway authentication, po
   For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), [Troubleshooting](/user-guide/openclaw/reference/troubleshooting), and [Trusted Computing Base](/user-guide/openclaw/security/trusted-computing-base).
 - OpenShell 0.0.71 is the validated gateway release for this train.
   NemoClaw generates local TLS, mTLS, and sandbox JWT material for Docker-driver gateways, keeps gateway binds on loopback while JWT auth is active, and documents the explicit compatibility-container boundary for older trusted Linux hosts.
-  For more information, refer to [OpenShell 0.0.71 Review](/user-guide/openclaw/security/openshell-0.0.71-gateway-auth-review), [Security Best Practices](/user-guide/openclaw/security/best-practices), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
+  For more information, refer to [Gateway and Secret Controls](/user-guide/openclaw/security/security-controls/gateway-authentication-controls), [Security Best Practices](/user-guide/openclaw/security/best-practices), and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
 - Network policy output now explains why active presets are present.
   `policy-list` annotates verified active presets with tier, agent, user-added, or source-unverified provenance; Restricted onboarding suppresses agent-required preset additions; the Balanced tier no longer includes `weather`; and the `weather` preset covers read-only `wttr.in` lookups when you add it explicitly.
   For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies), [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands), and [Common NemoClaw Integration Policy Examples](/user-guide/openclaw/network-policy/integration-policy-examples).

docs/changelog/2026-07-04.mdx

@@ -9,7 +9,7 @@ NemoClaw v0.0.74 upgrades the OpenShell policy boundary, adds managed MCP and pr
 
 - Stable installs pin OpenShell `0.0.72` release artifacts and the supervisor image, adding MCP Streamable HTTP and JSON-RPC request-policy enforcement.
   Policy mutations read the round-trippable base policy instead of the effective policy, which preserves existing MCP rules without sending provider-composed `_provider_*` entries back through `policy set`.
-  For more information, refer to [OpenShell 0.0.72 Compatibility Review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review) and [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy).
+  For more information, refer to [Network Policies](/user-guide/openclaw/reference/network-policies) and [Replace the Live Network Policy](/user-guide/openclaw/network-policy/configure-policies/replace-live-network-policy).
 - Managed MCP commands use `add`, `list`, `status`, `restart`, and `remove` to manage authenticated HTTPS Streamable HTTP servers for OpenClaw, Hermes, and experimental LangChain Deep Agents Code through native OpenShell policy enforcement and provider-backed credential replacement.
   The LangChain Deep Agents Code rebuild path validates the recorded gateway, route, image, staged build context, and prepared replacement inputs before deleting the previous sandbox, then restores managed MCP state after the recreated runtime is ready.
   For more information, refer to [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers), [Quickstart with LangChain Deep Agents Code](/user-guide/deepagents/get-started/quickstart), and the [accepted architecture decision](https://github.com/NVIDIA/NemoClaw/issues/566#issuecomment-4847534784).

docs/changelog/2026-07-06.mdx

@@ -8,14 +8,13 @@
 NemoClaw v0.0.75 upgrades the bundled OpenClaw runtime to `2026.6.10` and improves sandbox upgrade and prepared-backup recovery, custom endpoint inference routing, and local Docker-driver sandbox JWT handling.
 
 - The bundled OpenClaw runtime upgrades to `2026.6.10` with reviewed package pins, fail-closed archive and patch validation, safer same-device pairing repair, and stricter rebuild route and credential recovery.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
 - Upgrading an existing install now recovers a previously onboarded sandbox instead of failing when the recreated gateway has not yet reconfigured its inference route.
   Prepared-backup recovery defers the live route check to authoritative onboarding, which restores and verifies the gateway provider and inference route before sandbox recreation; in-place upgrades recover gateway-orphaned sandboxes, and a same-name `--fresh` re-onboard preserves the newly selected LangChain Deep Agents Code routing.
   For more information, refer to [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands) and [Troubleshooting](/user-guide/openclaw/reference/troubleshooting).
 - Hermes custom Anthropic-compatible inference now uses the OpenAI frontend, and OpenAI-only agents keep the `/v1` base URL when pointed at an Anthropic-compatible endpoint, so switching a managed sandbox to a compatible endpoint routes and reports the provider and model correctly.
   For more information, refer to [Choose an Inference Provider](/user-guide/openclaw/inference/learn-and-choose/choose-inference-provider) and [Switch Inference Providers](/user-guide/openclaw/inference/manage-inference/switch-providers).
 - Local Docker-driver sandbox JWTs now use OpenShell's non-expiring local contract, which keeps a long-running local sandbox reachable without a manual gateway restart.
-  For more information, refer to [OpenShell 0.0.71 Gateway Authentication Review](/user-guide/openclaw/security/openshell-0.0.71-gateway-auth-review).
+  For more information, refer to [Gateway and Secret Controls](/user-guide/openclaw/security/security-controls/gateway-authentication-controls).
 - Hermes runtime and managed MCP state reconcile after a runtime change, and Hermes installs accept a pinned base platform digest.
   For more information, refer to [About Managed MCP Servers](/user-guide/openclaw/manage-sandboxes/mcp-servers/about-managed-mcp-servers) and [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - OpenClaw local CLI pairing restores its previous connection path so a local sandbox reconnects without re-pairing.

docs/changelog/2026-07-14.mdx

@@ -69,4 +69,3 @@ NemoClaw v0.0.82 adds non-destructive sandbox stop and start commands, protects
 - Build and dependency trust boundaries cover more of the sandbox image path.
   Reviewed npm archives now share one production dependency audit, OpenClaw's managed WeChat runtime installs from a NemoClaw-owned offline lock, and the messaging build plan no longer persists in final OpenClaw or Hermes image environments.
   Source and blueprint rebuilds also reuse cached plugin dependency layers.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).

docs/changelog/2026-07-20.mdx

@@ -12,7 +12,6 @@ NemoClaw v0.0.90 keeps managed-image routing identifiers out of secret-shaped bu
   For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
 - OpenClaw core, Slack, and Microsoft Teams installations now replace reviewed vulnerable transitive packages with integrity-verified remediated versions while retaining the `openclaw@2026.6.10` release pin.
   Archive validation fails closed, and the dependency audit records the remaining reviewed low- and moderate-severity findings.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
 - `credentials reset` now recognizes sandbox attachments from wrapped OpenShell diagnostics, validates each sandbox name, detaches affected sandboxes, and retries provider deletion without exposing credential values.
   For more information, refer to [Credential Rotation](/user-guide/openclaw/security/credential-rotation).
 - OpenClaw WhatsApp status now recognizes the current paired-session path and derives in-process bridge activity from redacted gateway-log evidence.

docs/changelog/2026-07-22.mdx

@@ -34,7 +34,6 @@ NemoClaw v0.0.91 strengthens completed sandbox images, makes rebuild replacement
 
 - Completed OpenClaw, Hermes, and Deep Agents Code images now replace affected `node-tar` installations with reviewed versions and scan the final filesystem before publication.
   Current and historical OpenClaw security-revision verifiers also validate exact dependency versions, resolved archives, integrity metadata, executable identity, and transactional state restoration in constrained containers.
-  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
 - Rebuilds now carry validated local-base trust through Deep Agents Code image preparation, reuse the outer state backup during inner onboarding, and wait for OpenShell to confirm sandbox deletion before removing registry state or creating a replacement.
   These checks prevent rebuild from rejecting its own current base, taking a second backup against stale gateway state, or racing an asynchronous sandbox deletion.
   Rebuild also stops before deletion when a manifest-declared state file cannot be archived unless you pass `--force`.

docs/changelog/2026-08-04.mdx

@@ -46,7 +46,6 @@ It reduces the managed single-node DGX Spark Qwen profile's default memory deman
   For more information, refer to [Set Up WhatsApp](/user-guide/hermes/manage-sandboxes/messaging-channels/set-up-whatsapp), the Hermes [NemoClaw CLI Commands Reference](/user-guide/hermes/reference/commands), and [Configure Corporate CA Trust](/user-guide/deepagents/security/configure-corporate-ca-trust).
 - Managed OpenClaw, Hermes, Deep Agents Code, and MCP discovery images now carry reviewed dependency updates for the release advisory set.
   The changes update locked runtime graphs, remediate private npm dependencies during image assembly, and preserve fail-closed identity and integrity checks.
-  For more information, refer to the [OpenClaw 2026.7.1 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.7.1-dependency-review.md) and [Hermes 0.19.0 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/hermes-0.19.0-dependency-review.md).
 - Affected CLI paths now report invalid enumerated values, unresolved sandbox base images, and changed gateway authority without raw Node.js stack traces.
   Captured output from non-JSON OpenClaw agent commands is inspected for recognized embedded-fallback markers.
   When a marker is present, NemoClaw suppresses the captured transport output, exits with status `1`, and prints the documented recovery commands.