Glossary: NemoClaw Ecosystem

NVIDIA's open-source reference stack for running sandboxed AI agents safely with a single command. Provides CLI tooling for agent onboarding, lifecycle management, versioned blueprint resolution, and digest verification. Sits above OpenShell in the architecture.

The safe, private runtime for autonomous AI agents. NVIDIA's sandbox technology that defines and enforces the execution environment. Handles sandbox lifecycle, network/filesystem/process policy enforcement, and inference routing. Uses Landlock LSM for kernel-level enforcement on Linux 5.13+. OpenShell is the sandbox itself.

The assistant runtime: tools, memory, and behavior inside the container. The default agent that NemoClaw installs. OpenClaw handles what runs inside the sandbox but does not define the sandbox itself. OpenClaw is the agent; OpenShell is the sandbox.

A versioned YAML package containing: (1) sandbox image definition (Dockerfile), (2) policy configuration, (3) inference profile, (4) supporting assets. Blueprints are digest-verified via SHA-256, immutable once published, and reproducible.

LangChain's harness layer for long-running agents. Provides planning (via write_todos), tool orchestration, memory management, and task execution. Complementary to LangGraph: LangGraph = low-level control; DeepAgents = complex extended tasks.

CLI for DeepAgents Code. An open-source terminal coding agent that works with any LLM (provider:model format), features persistent memory, customizable skills via AGENTS.md, and human-in-the-loop approval. Uses the "sandbox as tool" pattern.

Control-plane API coordinating sandbox lifecycle, acting as authentication boundary. Binds to 127.0.0.1 (loopback) by default with device authentication enabled.

Enforces filesystem, network, and process constraints from application to kernel level. Every outbound connection passes through it: ALLOW (matches policy), ROUTE (inference), or DENY (blocked + logged).

Privacy-aware LLM routing that keeps sensitive context on sandbox compute while forwarding inference requests to managed endpoints. Provider credentials stay on host.

Virtual endpoint that agents call for model inference. OpenShell intercepts these requests on the host, injects credentials, and forwards to the configured provider. Agent never sees raw API keys.

Linux Security Module (kernel 5.13+) that enforces filesystem access controls at kernel level, making restrictions impossible to bypass from userspace. Makes system paths read-only and controls writable paths (/sandbox, /tmp only).

Linux kernel feature that isolates system resources (PID, network, mount, user, etc.) for containers. Each namespace type provides isolation for a specific resource class, enabling containers to have their own view of the system.

Linux kernel feature that limits and isolates resource usage (CPU, memory, I/O) for processes. Control groups organize processes hierarchically and apply resource constraints to each group.

Secure computing mode with BPF filters that restricts which system calls a process can make. Allows fine-grained filtering of syscalls based on arguments, enabling sandboxes to block dangerous operations at the kernel level.

Extended Berkeley Packet Filter, used for network traffic interception and filtering at kernel level. Enables programmable packet processing, observability, and security enforcement without kernel module compilation.

Security model where all actions are blocked unless explicitly allowed. NemoClaw implements this across five layers: Network, Filesystem, Process, Gateway Authentication, and Inference.

Three preset security levels: Restricted (baseline only), Balanced (default, includes dev tooling), Open (broad third-party access). Each tier configures network egress rules.

Architecture where provider API keys stay on the host and are injected at egress via resolver placeholders. The sandbox agent never receives raw credentials.

The scope of damage when something goes wrong; sandbox isolation limits blast radius. A well-designed sandbox ensures that agent failures, exploits, or misbehavior cannot affect the host system or other sandboxes.

The scaffolding around a model: system prompts, tool descriptions, and middleware around model/tool calls. Distinct from model weights. "Tuning the harness, not the model" means adapting scaffolding without changing weights.

Architecture where the agent loop runs locally (LLM calls, memory, tool dispatch) but tool invocations (read_file, write_file, execute) target a remote sandbox rather than the local filesystem.

The execution cycle: Inspect (read files) → Edit (modify code) → Run commands (shell) → Test (validate) → Summarize (report). Orchestrated by planning via write_todos tool.

Multi-agent architecture where a central coordinator delegates tasks to specialized agents. The orchestrator handles task decomposition, agent selection, result aggregation, and error handling while sub-agents focus on specific capabilities.

Configuration file for dcode containing user or project customizations to agent instructions. Located at ~/.deepagents/{agent}/AGENTS.md (user) or {project}/.deepagents/AGENTS.md (project).

The scaffolding around a model: system prompts, tool descriptions, and middleware around model/tool calls. Distinct from model weights. "Tuning the harness, not the model" means adapting this scaffolding to improve domain-specific accuracy without fine-tuning.

Component that assembles the complete prompt from skills, AGENTS.md rules, tool descriptions, and user input. Combines all harness components into a single context for the LLM.

Collection of prompt-behavior modules that define HOW to approach specific tasks. Examples: field_discovery.md, exact_matching.md, confidence_scoring.md. Skills are task-specific; AGENTS.md is client-specific.

Configuration of read-only tools available to the planner and subagents. Tool descriptions guide the LLM on WHEN and HOW to use each tool, and are a key part of harness tuning.

Deterministic rule evaluation component that runs AFTER LLM processing. Evaluates structured output against business rules to produce ACCEPT/REVIEW/REJECT decisions. Critical distinction: the LLM cannot bypass it. Can be implemented in Python or OPA (Open Policy Agent).

Rules defined in AGENTS.md that the LLM reads and is ASKED to follow. Advisory in nature — the LLM might follow them or might not. Used for domain knowledge and guidance. Contrast with enforcement-level rules in the Policy Gateway.

Rules evaluated deterministically by code (not LLM) after the agent produces output. Mandatory in nature — cannot be bypassed. Used for compliance requirements and business logic that must be enforced regardless of LLM behavior.

Rule for nested agents: child can never have MORE permissions than parent. Policies only narrow, never widen. Prevents privilege escalation through subagent spawning. Example: parent has network=[*.internal.com], child can have network=[db.internal.com] but not network=[*.external.com].

Anthropic's official CLI for Claude. Terminal-based coding agent locked to Claude models. Uses CLAUDE.md for instructions, local execution, and permission-based approval system. Similar to dcode but model-locked.

NVIDIA's LLM used in the NemoClaw blueprint. Achieved 0.86 aggregate score at $4.48 cost (10x cheaper than alternatives). Open model that teams can tune, run, and optimize themselves.