NVIDIA
diff --git a/‎docs/inference/use-local-inference.mdx‎
Lines changed: 5 additions & 4 deletions b/‎docs/inference/use-local-inference.mdx‎
Lines changed: 5 additions & 4 deletions
diff --git a/‎docs/monitoring/monitor-sandbox-activity.mdx‎
Lines changed: 6 additions & 5 deletions b/‎docs/monitoring/monitor-sandbox-activity.mdx‎
Lines changed: 6 additions & 5 deletions
diff --git a/‎docs/reference/commands.mdx‎
Lines changed: 25 additions & 11 deletions b/‎docs/reference/commands.mdx‎
Lines changed: 25 additions & 11 deletions
diff --git a/‎docs/reference/troubleshooting.mdx‎
Lines changed: 5 additions & 4 deletions b/‎docs/reference/troubleshooting.mdx‎
Lines changed: 5 additions & 4 deletions
diff --git a/‎src/commands/sandbox/oclif-command-adapters.test.ts‎
Lines changed: 27 additions & 0 deletions b/‎src/commands/sandbox/oclif-command-adapters.test.ts‎
Lines changed: 27 additions & 0 deletions
diff --git a/‎src/commands/sandbox/status.ts‎
Lines changed: 6 additions & 1 deletion b/‎src/commands/sandbox/status.ts‎
Lines changed: 6 additions & 1 deletion
@@ -161,8 +161,8 @@ NemoClaw configures the sandbox provider to use proxy port `11435` with the gene
 OpenShell's L7 proxy injects the token at egress, so the agent inside the sandbox never sees the token directly.
 
 All proxy endpoints require the Bearer token, including `GET /api/tags`.
-Internal health and reachability checks that run through the proxy treat any HTTP response, including `401`, as proof the proxy is alive.
-They fail only when nothing answers at all.
+The host-side proxy liveness diagnostic is an auxiliary check; it treats an HTTP response such as `401` as proof that the proxy answered.
+Separately, the authoritative `status` and `doctor` route probe runs from inside the sandbox and reports HTTP `200` through `499` (including `401` and `403`) as `healthy`, HTTP `500` through `599` as `unhealthy`, and an interim `100` through `199`, `000`, a transport failure, or an unavailable probe as `unreachable` or `not probed`.
 
 If Ollama is already running on a non-loopback address when you start onboard, the wizard restarts it on `127.0.0.1:11434`.
 The proxy becomes the only network path to the model server.
@@ -285,8 +285,9 @@ $$nemoclaw <name> status
 ```
 
 The output shows the provider label (for example, "Local vLLM" or "Other OpenAI-compatible endpoint") and the active model.
-For Local Ollama, status also checks the authenticated proxy when a proxy token is available.
-If `Inference` is healthy but `Inference (auth proxy)` is not, rerun onboarding to repair the proxy path that sandbox requests use.
+The main `Inference` line checks `inference.local` from inside the sandbox, which is the path agent requests use.
+For Local Ollama, status can also print an `Inference (auth proxy)` host-side diagnostic when a proxy token is available.
+If that diagnostic fails, rerun onboarding to recreate the proxy token and restart the proxy, even if the authoritative route is still responding.
 
 ## Switch Models at Runtime
 
 
@@ -28,14 +28,14 @@ Run the status command to view sandbox state, gateway health, and the active inf
 $$nemoclaw <name> status
 ```
 
-For local Ollama and local vLLM routes, `$$nemoclaw <name> status` also probes the host-side health endpoint.
-The check catches a stopped local backend before you retry `inference.local` from inside the sandbox.
+`$$nemoclaw <name> status` probes `https://inference.local/v1/models` from inside the sandbox as the authoritative inference check.
+For local Ollama and local vLLM routes, it also prints labeled host-side backend diagnostics that help identify which hop failed.
 
 Review these output fields.
 
 - Sandbox details show the configured model, provider, GPU mode, and applied policy presets.
 - Gateway and process health show whether NemoClaw can reach the OpenShell gateway and whether the in-sandbox agent process is running.
-- Inference health for local Ollama and local vLLM shows `healthy` or `unreachable` with the probed local URL.
+- The main inference health line reflects the in-sandbox route the agent uses; labeled upstream, local-backend, and auth-proxy lines are diagnostic only.
 - NIM status shows whether a NIM container is running and healthy when that path is in use.
 
 Run `$$nemoclaw <name> status` on the host to check sandbox state.
@@ -122,8 +122,9 @@ hermes
 If the request fails, check these items.
 
 1. Run `$$nemoclaw <name> status` to confirm the active provider and endpoint.
-   For local Ollama and local vLLM, check the `Inference` line first.
-   If it shows `unreachable`, restart the local backend before retrying from inside the sandbox.
+   Check the main `Inference` line first.
+   If it shows `unhealthy`, `unreachable`, or `not probed`, inspect the labeled upstream, local-backend, and auth-proxy diagnostics to identify the failing hop.
+   Restart a local backend only when its own diagnostic fails.
 2. Run `$$nemoclaw <name> logs --follow` to view error messages from the blueprint runner.
 3. Verify that the host can reach the inference endpoint.
 4. If the agent reports a context-overflow or token-limit error, clear the conversation with `/reset` (or start a fresh one with `/new`) in the TUI before retrying.
 
@@ -773,6 +773,11 @@ When the live OpenShell gateway inference route differs from the route recorded
 It realigns the route only when those registry entries are compatible with the requested provider and model.
 If another sandbox records a conflicting route, `connect` exits non-zero without changing the gateway and names the affected sandboxes.
 Use `$$nemoclaw inference set --provider <provider> --model <model>` to make an intentional compatible route change.
+Before it opens SSH, `connect` probes `https://inference.local/v1/models` from inside the sandbox with the selected agent's trusted CA and proxy context.
+HTTP `200` through `499` confirms that the route is reachable.
+When the probe returns a recognized broken result, `connect` attempts DNS or route repair and verifies the route again.
+When the initial probe cannot return a trusted result, `connect` fails closed before health-driven repair and before opening SSH.
+It prints a bounded, redacted last-probe detail and points you to `$$nemoclaw <name> doctor`.
 If the sandbox is registered locally but missing from a healthy gateway, `connect` preserves the registry entry and points you to `rebuild --yes`, `onboard`, or `destroy` instead of deleting the metadata needed for recovery.
 
 After a host reboot, the OpenShell gateway rotates its SSH host keys.
@@ -1080,7 +1085,7 @@ The JSON output includes at least `schemaVersion`, `name`, `found`, `model`, `pr
 In that case, text output keeps OpenShell's authoritative phase but prints a `docker unpause <container>` recovery hint instead of sending you directly to rebuild.
 For terminal runtime sandboxes, the command also checks cgroup OOM kill counters.
 If the counter records an OOM kill, text output prints `Runtime health: degraded (... OOM kill recorded)` and points you to `$$nemoclaw <name> rebuild`; JSON output reports `terminalRuntimeHealth.kind: "degraded"` with the OOM kill count and source counter path.
-The command exits non-zero when the sandbox is missing locally, the gateway state is not `present`, the gateway reports a schema/protobuf mismatch (mirrored as `rpcIssue`), `failureLayer` is non-null, or a terminal runtime sandbox reports a recorded OOM kill.
+The command exits non-zero when the sandbox is missing locally, the gateway state is not `present`, the gateway reports a schema/protobuf mismatch (mirrored as `rpcIssue`), `failureLayer` is non-null, the authoritative in-sandbox inference route fails or cannot be probed, or a terminal runtime sandbox reports a recorded OOM kill.
 The alias form `$$nemoclaw <name> status --json` requires the sandbox to be registered locally; the canonical form `$$nemoclaw sandbox status <name> --json` is the one to use from automation that may run against an unknown sandbox name, since it still emits a JSON document with `found: false` instead of a text error.
 
 ```bash
@@ -1089,21 +1094,25 @@ $$nemoclaw my-assistant status --json
 $$nemoclaw sandbox status my-assistant --json
 ```
 
-The command probes every inference provider and reports one of three states on the `Inference` line:
+The command probes `https://inference.local/v1/models` from inside the sandbox as the authoritative inference health check.
+This check exercises the same route that agent traffic uses.
+The main `Inference` line reports one of these states:
 
 | State | Meaning |
 |-------|---------|
-| `healthy` | The provider endpoint returned a reachable response. |
-| `unreachable` | The probe failed. The output includes the endpoint URL and a remediation hint. |
-| `not probed` | The endpoint URL is not known (for example, `compatible-*` providers). |
+| `healthy` | The route returned an HTTP status from `200` through `499`. Authentication responses such as `401` and `403` confirm route reachability. |
+| `unhealthy` | The route returned an HTTP status from `500` through `599`. |
+| `unreachable` | The route had a transport failure, returned no final HTTP status (`000` or an interim `100` through `199`), or returned an invalid status outside `100` through `599`. |
+| `not probed` | NemoClaw could not run the authoritative route probe from a reachable sandbox. |
 | `not verified` | NemoClaw could not verify the sandbox or gateway state, so it skips inference probing. |
 
-Local providers (Ollama, vLLM) probe the host-side health endpoint.
-Remote providers (NVIDIA Endpoints, OpenAI, Anthropic, Gemini) use a lightweight reachability check; any HTTP response, including `401` or `403`, counts as reachable.
-No API keys are sent.
+An authentication response confirms that the route is reachable, not that provider credentials are valid.
+The command can also print direct host-side provider checks such as `Inference (upstream)` and provider-specific subprobes.
+These checks are diagnostic only and do not override the authoritative `inference.local` result or determine the command exit status.
 
-For Local Ollama, the command also probes the authenticated proxy and prints an `Inference (auth proxy)` line when a proxy token is available.
-Use that line to distinguish a healthy backend from a broken proxy path that the sandbox uses for inference.
+Local providers add host-side backend diagnostics.
+For Local Ollama, the command can also print an `Inference (auth proxy)` diagnostic when a proxy token is available.
+Use these diagnostics to identify a failing auxiliary hop after checking the main `Inference` line.
 
 For cloud-only providers, the output omits the NIM status line unless a NIM container is registered or an unexpected NIM container is running.
 
@@ -1231,8 +1240,13 @@ The command checks the local CLI build, Docker daemon, OpenShell CLI, NemoClaw g
 For gateway-based agents, it also reports messaging channel conflicts.
 </AgentOnly>
 
+For inference health, `doctor` treats the probe to `https://inference.local/v1/models` from inside the sandbox as authoritative.
+HTTP responses from `200` through `499`, including `401` and `403`, pass this check.
+HTTP `500` through `599`, interim `100` through `199`, transport failures with status `000`, invalid status values, and an unavailable authoritative probe fail the check.
+Direct provider and upstream probes are diagnostics only, so their failure does not fail `doctor` when the authoritative in-sandbox route is healthy.
+
 Warnings do not make the command fail.
-Failed checks exit non-zero so scripts can use `doctor` as a readiness gate.
+Failed checks, including a failed or unavailable authoritative inference route, exit non-zero so scripts can use `doctor` as a readiness gate.
 Use `--json` for machine-readable output.
 
 <AgentOnly variant="openclaw">
 
@@ -1354,10 +1354,11 @@ Check the active provider and endpoint:
 $$nemoclaw <name> status
 ```
 
-For local Ollama and local vLLM, `$$nemoclaw <name> status` also prints an `Inference` line that probes the host-side health endpoint directly.
-If that line shows `unreachable`, start the local backend first and then retry the request.
-For Local Ollama, current releases also print `Inference (auth proxy)` when a proxy token is available.
-If the backend is healthy but the auth proxy is `unauthorized` or `unreachable`, re-run onboarding so NemoClaw can recreate the proxy token, restart the proxy, and refresh the route.
+The main `Inference` line probes `https://inference.local/v1/models` from inside the sandbox, so it reflects the route the agent actually uses.
+If that line shows `unhealthy`, `unreachable`, or `not probed`, inspect the labeled diagnostic lines to identify the failing hop.
+For local Ollama and local vLLM, `Inference (ollama backend)` or the corresponding local-backend line reports the host-side service separately.
+For Local Ollama, current releases can also print `Inference (auth proxy)` when a proxy token is available.
+If a local backend or auth-proxy diagnostic fails, start the backend or re-run onboarding so NemoClaw can recreate the proxy token, restart the proxy, and refresh the route.
 
 If the endpoint is correct but requests still fail, check for network policy rules that may block the connection.
 Then verify the credential and base URL for the provider you selected during onboarding.
 
@@ -302,6 +302,33 @@ describe("sandbox oclif command adapters", () => {
     expect(mocks.shieldsStatus).toHaveBeenCalledWith("alpha");
   });
 
+  it("sets a nonzero JSON exit when doctor reports inference.local failure (#6192)", async () => {
+    const previousExitCode = process.exitCode;
+    process.exitCode = undefined;
+    mocks.runSandboxDoctor.mockResolvedValueOnce({
+      schemaVersion: 1,
+      sandbox: "alpha",
+      status: "fail",
+      failed: 1,
+      warnings: 0,
+      checks: [
+        {
+          group: "Inference",
+          label: "Inference route (gateway)",
+          status: "fail",
+          detail: "Inference gateway returned HTTP 503",
+        },
+      ],
+    });
+
+    try {
+      await SandboxDoctorCliCommand.run(["alpha", "--json"], rootDir);
+      expect(process.exitCode).toBe(1);
+    } finally {
+      process.exitCode = previousExitCode;
+    }
+  });
+
   it("keeps doctor --json stdout clean while diagnostics recovery prints progress", async () => {
     const report = {
       schemaVersion: 1,
 
@@ -1,7 +1,11 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { getSandboxStatusReport, showSandboxStatus } from "../../lib/actions/sandbox/status";
+import {
+  getSandboxStatusReport,
+  isInferenceHealthFailing,
+  showSandboxStatus,
+} from "../../lib/actions/sandbox/status";
 import { NemoClawCommand } from "../../lib/cli/nemoclaw-oclif-command";
 import { sandboxNameArg } from "../../lib/sandbox/command-support";
 import { redactForLog } from "../../lib/security/redact";
@@ -33,6 +37,7 @@ export default class SandboxStatusCommand extends NemoClawCommand {
         report.gatewayState !== "present" ||
         report.rpcIssue ||
         report.failureLayer ||
+        isInferenceHealthFailing(report.inferenceHealth) ||
         report.terminalRuntimeHealth?.kind === "degraded"
       ) {
         process.exitCode = 1;