<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. --> <!-- SPDX-License-Identifier: Apache-2.0 -->

Onboard a NemoClaw Contributor

Use the repository setup script as the executable source of truth. Do not duplicate its dependency, build, hook, CLI-exposure, or readiness logic in agent commands.

Establish Trust First

1. Read the root AGENTS.md and CONTRIBUTING.md completely.
2. Inspect the worktree and current branch without discarding or overwriting existing changes.
3. Refresh the trusted origin/main reference, then compare the entire checkout/worktree diff against that up-to-date base before executing any checkout-local code. Include staged, unstaged, and untracked files; review lockfiles and all transitively executed source, not only the entry script or package manifests.
4. If an execution surface differs from trusted origin/main, review the diff before running it. Existing implementation authorization covers in-scope repository-local validation. Isolate candidate code from host credentials and host mutations. This includes setup scripts and installed hooks. Stop before execution if that isolation cannot be established. Ask only for exposure or side effects outside that authorization.

Route by Intent

• Readiness only: run ./scripts/dev-setup.sh --doctor and never run setup, repair, CLI exposure, runtime onboarding, or the pinned agent. Use ./scripts/dev-setup.sh --doctor --json when a machine-readable report helps.
• Initial checkout setup: run ./scripts/dev-setup.sh from the repository root.
• Explicit repository repair: run ./scripts/dev-setup.sh --repair only when the user asks to repair or retry repository-local setup.
• CLI exposure: after explicit approval, run ./scripts/dev-setup.sh --expose-cli.
• Runtime onboarding: after explicit approval, run ./scripts/dev-setup.sh --with-runtime.