[ericksoa]

Summary

Remove NemoClaw's per-sandbox DNS proxy and route Kubernetes inference recovery through the existing supported OpenShell inference reset. This is PR 19 of 21 in the dependent OpenShell gRPC migration stack and targets refactor/openshell-remove-bootstrap-secret-repair/ae.

Changes

• Delete the Python DNS forwarder, pod and network-namespace discovery, iptables and resolv.conf mutation, compatibility script, hidden CLI command, and their dedicated domain helpers.
• Remove DNS-proxy hooks from onboarding, snapshot restore, and connect-time repair.
• Preserve fail-closed route probing and the VM-only DNS patch, while delegating broken Kubernetes routes to the existing managed openshell inference set reset exactly once.
• Remove the retired hidden command from the generated command-reference source.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Self-review completed by Aaron Erickson; this change deletes host-controlled pod/network-namespace mutation and preserves fail-closed inference-route tests.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npm run build:cli; 151 focused CLI assertions across DNS, connect, route repair, and snapshot files; 10 integration assertions for the DNS wrapper, internal CLI, and onboarding argv; and 3 route-swap integration assertions pass.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

npm run docs passed; Fern reported the existing two hidden warnings.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ade619e6-5f93-4ebd-a266-c8b060b626db

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/openshell-remove-sandbox-dns-proxy/ae

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the refactor/openshell-r... branch.

TypeScript / code-coverage/cli

The overall coverage in the refactor/openshell-r... branch remains at 79%, unchanged from the refactor/openshell-r... branch.

Show a code coverage summary of the most impacted files.

File	refactor/openshell-r... 3cccebf	refactor/openshell-r... d701115	+/-
src/lib/onboard...tup-nim-vllm.ts	89%	71%	-18%
src/lib/actions...box/snapshot.ts	79%	83%	+4%
src/lib/diagnostics/debug.ts	14%	29%	+15%
src/lib/adapter...teway-config.ts	0%	77%	+77%
src/lib/adapter...dbox-control.ts	0%	78%	+78%
src/lib/state/s...tore-payload.ts	0%	83%	+83%
src/lib/adapter...dbox-control.ts	0%	97%	+97%
src/lib/adapter...trol-routing.ts	0%	97%	+97%
src/lib/adapter...ndbox-upload.ts	0%	99%	+99%
src/lib/actions...store-source.ts	0%	100%	+100%

---

_{Updated July 15, 2026 08:30 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

Since last review: 0 prior items resolved · 0 still apply · 0 new items found

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, onboard-repair, onboard-resume, state-backup-restore, upgrade-stale-sandbox

2 optional E2E recommendations

• snapshot-commands
• inference-routing

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[ericksoa]

Closing as superseded: NemoClaw will consume the upstream OpenShell TypeScript SDK from NVIDIA/OpenShell#2122 instead of maintaining this raw gRPC/proto transport stack.