[ericksoa]

Summary

Remove NemoClaw's host-side CoreDNS patch and leave gateway DNS ownership with OpenShell. This is PR 20 of 21 in the dependent OpenShell gRPC migration stack and targets refactor/openshell-remove-sandbox-dns-proxy/ae.

Changes

• Delete the Docker socket and cluster-container discovery, CoreDNS ConfigMap mutation, rollout handling, hidden CLI command, compatibility script, and dedicated domain helpers.
• Remove CoreDNS patch hooks from gateway startup and recovery.
• Remove the retired transport site from the legacy inventory and delete the obsolete command and troubleshooting guidance.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Self-review completed by Aaron Erickson; this change deletes host-controlled Docker and Kubernetes mutation and leaves OpenShell responsible for its cluster DNS.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npm run build:cli; 12 gateway-recovery CLI tests; 30 platform, internal-CLI, and legacy-transport integration tests; and the focused custom-Dockerfile onboarding integration test pass.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

npm run docs passed; Fern reported the existing two hidden warnings.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 53de5d17-e01b-40ae-a335-09e53e9e3ef9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/openshell-remove-coredns-patch/ae

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the refactor/openshell-r... branch.

TypeScript / code-coverage/cli

The overall coverage in the refactor/openshell-r... branch is 80%. The coverage in the refactor/openshell-r... branch is 79%.

Show a code coverage summary of the most impacted files.

File	refactor/openshell-r... 3cccebf	refactor/openshell-r... 73b4608	+/-
src/lib/onboard...tup-nim-vllm.ts	89%	71%	-18%
src/lib/actions...box/snapshot.ts	79%	83%	+4%
src/lib/diagnostics/debug.ts	14%	29%	+15%
src/lib/adapter...teway-config.ts	0%	77%	+77%
src/lib/adapter...dbox-control.ts	0%	78%	+78%
src/lib/state/s...tore-payload.ts	0%	83%	+83%
src/lib/adapter...dbox-control.ts	0%	97%	+97%
src/lib/adapter...trol-routing.ts	0%	97%	+97%
src/lib/adapter...ndbox-upload.ts	0%	99%	+99%
src/lib/actions...store-source.ts	0%	100%	+100%

---

_{Updated July 15, 2026 08:48 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 1 suggestion
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, 1 more suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

Since last review: 0 prior items resolved · 0 still apply · 0 new items found

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, onboard-repair, onboard-resume

1 optional E2E recommendation

• gateway-health-honest

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[ericksoa]

Closing as superseded: NemoClaw will consume the upstream OpenShell TypeScript SDK from NVIDIA/OpenShell#2122 instead of maintaining this raw gRPC/proto transport stack.