feat(messaging): onboard additional experimental messaging channels

[sandl99]

Problem Statement

NemoClaw should support more upstream messaging channels through the shared src/lib/messaging architecture instead of requiring users to configure agent-specific channel credentials manually inside the sandbox.

OpenClaw and Hermes both expose broader messaging catalogs than NemoClaw currently onboards. We should add first-class NemoClaw onboarding for the channels that fit the manifest/provider/policy model, while modeling support per agent. A channel only needs to work for OpenClaw, Hermes, or both when the upstream agent actually supports it.

This follows the integration guidance from #3006, but tracks the broader channel onboarding effort.

Proposed Design

Add experimental messaging channels using the manifest-first messaging model.

Channel	OpenClaw	Hermes	NemoClaw	Status	#PR	#Assignee
Telegram	yes	yes	yes	✅ Done
Discord	yes	yes	yes	✅ Done
Slack	yes	yes	yes	✅ Done
WeChat / Weixin	yes	yes	yes	✅ Done	#3186	sandl99
WhatsApp	yes	yes	yes	✅ Done (⚠️ Rotating token - currently stored in Sandbox)
Zalo	yes	no/unknown	no	🚧 In progress	#5583	hunglp6d
Google Chat	yes	yes	no	🚧 In progress (⚠️ Service account JWT)		sandl99
LINE	yes	yes	no	🚧 In progress		hunglp6d
Matrix	yes	yes	no	📋 Todo
Mattermost	yes	yes (not supported at v2026.5.14)	no	🚧 In progress	#5592	sandl99
Microsoft Teams	yes	yes	no	🚧 In progress	#5585	sandl99
WeCom	yes	yes	no	🚧 In progress		sandl99
QQ Bot	yes	yes	no	📋 Todo
SMS / Twilio	yes	yes	no	📋 Todo
Feishu/Lark	yes	yes	no	📋 Todo
Yuanbao	yes	yes	no	📋 Todo
IRC	yes	no/unknown	no	📋 Todo
Nextcloud Talk	yes	no/unknown	no	📋 Todo
Nostr	yes	no/unknown	no	📋 Todo
Synology Chat	yes	no/unknown	no	📋 Todo
Tlon	yes	no/unknown	no	📋 Todo
WeCom Callback	no/unknown	yes	no	📋 Todo
DingTalk	no/unknown	yes	no	📋 Todo
Email	no/unknown	yes	no	📋 Todo
ntfy	no/unknown	yes	no	📋 Todo
Webhooks	no/unknown	yes	no	📋 Todo
Signal	yes	yes	no	🚫 Not planned yet
iMessage / BlueBubbles	yes	yes	no	🚫 Not planned yet
Zalo Personal	yes	no/unknown	no	🚫 Not planned yet
Twitch	yes	no/unknown	no	🚫 Not planned yet

For each channel:

• Add a channel manifest under src/lib/messaging/channels/<channel>/manifest.ts.
• Register it in channels/built-ins.ts.
• Set supportedAgents only for the runtimes that actually support the channel.
• Add render rules only for supported agent configs.
• Add OpenShell provider-backed credential bindings for fixed/static secrets.
• Add policy presets under nemoclaw-blueprint/policies/presets/.
• Add hooks/template resolvers only when the manifest vocabulary is not enough.
• Mark the channel as experimental in CLI output and docs.

Onboarding skills

Use nemoclaw-contributor-onboard-messaging-channel skills #5501 to have better onboarding experience

Security Requirements

• Raw channel credentials must not be stored in the sandbox image, rendered config, build args, process environment, or persisted NemoClaw registry state.
• Fixed/static secrets should live in OpenShell providers and be rendered into agent config only as placeholders.
• Secret manifest inputs must not declare statePath.
• Non-secret config may be persisted for rebuild hydration.
• Channels that cannot operate without raw credential files inside the sandbox must be blocked until a safe provider/proxy design exists.

Acceptance Criteria

• Each added channel works for every lifecycle path for its supported agent(s): onboard, rebuild, channels add, channels remove, channels stop, and channels start.
• Unsupported agent/channel combinations fail clearly and do not appear as selectable for that agent.
• channels list shows the new channels, supported agent scope, and experimental status.
• Test for nemoclaw channels status --channel <channel_name> / nemoclaw doctor
• Rebuild preserves channel configuration and reuses existing OpenShell providers without re-prompting.
• Remove cleans up providers, registry state, rendered config, policy presets, and persisted non-secret channel state where applicable.
• Stop/start disables and re-enables the channel without deleting reusable credentials.
• Existing e2e tests are extended for the new channels.
• Tests cover manifest registration, plan compilation, provider binding, policy inclusion, rendered config, rebuild hydration, credential redaction, and unsupported-agent rejection.
• Docs cover setup, credential requirements, supported agent scope, policy presets, troubleshooting, and experimental status.

Alternatives Considered

• Require every channel to support both OpenClaw and Hermes. Rejected: upstream support differs by channel, and NemoClaw should model that honestly.
• Configure channels manually inside the sandbox. Rejected: this bypasses NemoClaw lifecycle, policy, and credential handling.
• Include rotating/session channels in this issue. Rejected: those need a separate design because credential custody differs from fixed-token channels.

Category

Provider

Checklist

• I searched existing issues and this is not a duplicate.
• This is a design proposal, not a "please build this" request.