NVIDIA
diff --git a/‎.github/workflows/e2e.yaml‎
Lines changed: 1363 additions & 46 deletions b/‎.github/workflows/e2e.yaml‎
Lines changed: 1363 additions & 46 deletions
diff --git a/‎docs/manage-sandboxes/uninstall-nemoclaw.mdx‎
Lines changed: 2 additions & 0 deletions b/‎docs/manage-sandboxes/uninstall-nemoclaw.mdx‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎scripts/checks/run-native-runtime-installer-qualification.sh‎
Lines changed: 64 additions & 26 deletions b/‎scripts/checks/run-native-runtime-installer-qualification.sh‎
Lines changed: 64 additions & 26 deletions
diff --git a/‎src/lib/onboard/runtime-provider/native-qualification-authority.ts‎
Lines changed: 1 addition & 1 deletion b/‎src/lib/onboard/runtime-provider/native-qualification-authority.ts‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎src/lib/onboard/runtime-provider/podman-preflight.test.ts‎
Lines changed: 43 additions & 15 deletions b/‎src/lib/onboard/runtime-provider/podman-preflight.test.ts‎
Lines changed: 43 additions & 15 deletions
diff --git a/‎src/lib/onboard/runtime-provider/podman-preflight.ts‎
Lines changed: 35 additions & 18 deletions b/‎src/lib/onboard/runtime-provider/podman-preflight.ts‎
Lines changed: 35 additions & 18 deletions
diff --git a/‎src/lib/onboard/runtime-provider/podman.test.ts‎
Lines changed: 11 additions & 1 deletion b/‎src/lib/onboard/runtime-provider/podman.test.ts‎
Lines changed: 11 additions & 1 deletion
@@ -180,6 +180,8 @@ It skips the generic Docker availability probe and all generic Docker container,
 It does not remove the user's Podman installation, storage, networks, or unrelated containers.
 It does not disable a user-managed socket.
 On every successful portable cleanup, the final retirement operation removes the exact portable lifecycle receipts, their matching `sandboxes.json` rows, and `~/.config/nemoclaw/portable/containers.conf`, regardless of `--destroy-user-data`.
+After NemoClaw removes `containers.conf`, it removes `~/.config/nemoclaw/portable/` and `~/.config/nemoclaw/` only when each directory is empty.
+NemoClaw preserves either directory when it contains an unrelated entry.
 Other preserved user data follows the normal `--destroy-user-data` behavior.
 After NemoClaw releases the locks, later uninstall-plan cleanup never recursively revisits the canonical receipt, sandbox registry, or `~/.config/nemoclaw/portable/containers.conf` paths.
 This preserves any new lifecycle generation published after lock release.
 
@@ -98,6 +98,7 @@ verify_checkout() {
     *) fail "$label has an unexpected origin repository." ;;
   esac
   assert_checkout_has_no_git_credentials "$checkout" "$label"
+  printf '%s\n' "$revision"
 }
 
 verify_committed_file() {
@@ -191,14 +192,51 @@ assert_docker_unavailable() {
     [[ ! -S "$socket_path" ]] \
       || fail "A Docker socket exists during the ${phase} check."
   done < <(docker_socket_paths)
+
+  printf '%s\n' \
+    '{"dockerCommandGuarded":true,"dockerEnvironmentVariablesUnset":true,"dockerServiceInactive":true,"dockerSocketUnitInactive":true,"dockerdProcessNameAbsent":true,"defaultSocketPathsAbsent":true}'
 }
 
-run_native_runtime_installer_qualification() {
-  candidate_checkout=""
-  candidate_sha=""
-  expected_installer_sha256=""
-  expected_architecture=""
-  artifact_dir_input=""
+run_native_runtime_installer_qualification() (
+  local candidate_checkout=""
+  local candidate_sha=""
+  local expected_installer_sha256=""
+  local expected_architecture=""
+  local artifact_dir_input=""
+  local artifact_parent=""
+  local artifact_name=""
+  local artifact_dir=""
+  local runner_architecture=""
+  local candidate_installer=""
+  local candidate_setup_script=""
+  local qualification_root=""
+  local qualification_home=""
+  local qualification_tmp=""
+  local docker_guard_dir=""
+  local managed_payload_root=""
+  local verified_script_dir=""
+  local verified_installer=""
+  local verified_setup_script=""
+  local installed_checkout=""
+  local receipt_stage=""
+  local docker_guard=""
+  local docker_guard_sha256=""
+  local candidate_status=0
+  local verified_candidate_revision=""
+  local installed_revision=""
+  local pre_execution_docker_posture=""
+  local post_execution_docker_posture=""
+
+  cleanup() {
+    if [[ -n "$receipt_stage" && -d "$receipt_stage" && ! -L "$receipt_stage" ]]; then
+      rm -rf -- "$receipt_stage"
+    fi
+    if [[ -n "$qualification_root" && -d "$qualification_root" && ! -L "$qualification_root" ]]; then
+      rm -rf -- "$qualification_root"
+    fi
+  }
+  trap cleanup EXIT
+
   while [[ "$#" -gt 0 ]]; do
     case "$1" in
       --candidate-checkout)
@@ -272,7 +310,9 @@ run_native_runtime_installer_qualification() {
 
   candidate_installer="${candidate_checkout}/scripts/install.sh"
   candidate_setup_script="${candidate_checkout}/scripts/setup-jetson.sh"
-  verify_checkout "$candidate_checkout" "$candidate_sha" "The candidate checkout"
+  verified_candidate_revision="$(
+    verify_checkout "$candidate_checkout" "$candidate_sha" "The candidate checkout"
+  )"
   verify_installer \
     "$candidate_checkout" \
     "$candidate_sha" \
@@ -303,16 +343,6 @@ run_native_runtime_installer_qualification() {
     "$managed_payload_root" \
     "$verified_script_dir"
 
-  cleanup() {
-    if [[ -n "${receipt_stage:-}" && -d "$receipt_stage" && ! -L "$receipt_stage" ]]; then
-      rm -rf -- "$receipt_stage"
-    fi
-    if [[ -n "${qualification_root:-}" && -d "$qualification_root" && ! -L "$qualification_root" ]]; then
-      rm -rf -- "$qualification_root"
-    fi
-  }
-  trap cleanup EXIT
-
   cp -- "$candidate_installer" "$verified_installer"
   cp -- "$candidate_setup_script" "$verified_setup_script"
   chmod 500 "$verified_installer" "$verified_setup_script"
@@ -336,9 +366,10 @@ run_native_runtime_installer_qualification() {
   PATH="${docker_guard_dir}:${PATH}"
   export PATH
 
-  assert_docker_unavailable "pre-execution" "$docker_guard" "$docker_guard_sha256"
+  pre_execution_docker_posture="$(
+    assert_docker_unavailable "pre-execution" "$docker_guard" "$docker_guard_sha256"
+  )"
 
-  candidate_status=0
   # The child shell expands positional parameters inside this literal program.
   # shellcheck disable=SC2016
   env -i \
@@ -366,11 +397,15 @@ run_native_runtime_installer_qualification() {
     install_nemoclaw_before_onboarding
   ' _ "$verified_installer" "$verified_script_dir" || candidate_status=$?
 
-  assert_docker_unavailable "post-execution" "$docker_guard" "$docker_guard_sha256"
+  post_execution_docker_posture="$(
+    assert_docker_unavailable "post-execution" "$docker_guard" "$docker_guard_sha256"
+  )"
   [[ "$candidate_status" -eq 0 ]] \
     || fail "The candidate installer phase executor exited with status ${candidate_status}."
 
-  verify_checkout "$installed_checkout" "$candidate_sha" "The installed checkout"
+  installed_revision="$(
+    verify_checkout "$installed_checkout" "$candidate_sha" "The installed checkout"
+  )"
   verify_installer \
     "$installed_checkout" \
     "$candidate_sha" \
@@ -382,16 +417,16 @@ run_native_runtime_installer_qualification() {
     "$expected_installer_sha256" "$candidate_sha" "$runner_architecture" \
     >"${receipt_stage}/invocation.json"
   printf '{"receiptVersion":1,"repository":"%s","revision":"%s","installerSha256":"%s"}\n' \
-    "$CANONICAL_REPOSITORY" "$candidate_sha" "$expected_installer_sha256" \
+    "$CANONICAL_REPOSITORY" "$verified_candidate_revision" "$expected_installer_sha256" \
     >"${receipt_stage}/candidate-source.json"
   printf '{"receiptVersion":1,"repository":"%s","requestedRevision":"%s","installedRevision":"%s","installMode":"managed","installerSha256":"%s"}\n' \
-    "$CANONICAL_REPOSITORY" "$candidate_sha" "$candidate_sha" "$expected_installer_sha256" \
+    "$CANONICAL_REPOSITORY" "$candidate_sha" "$installed_revision" "$expected_installer_sha256" \
     >"${receipt_stage}/installed-source.json"
   printf '{"receiptVersion":1,"requested":"%s","runner":"%s"}\n' \
     "$expected_architecture" "$runner_architecture" \
     >"${receipt_stage}/architecture.json"
-  printf '%s\n' \
-    '{"receiptVersion":1,"preExecution":{"dockerCommandGuarded":true,"dockerEnvironmentVariablesUnset":true,"dockerServiceInactive":true,"dockerSocketUnitInactive":true,"dockerdProcessNameAbsent":true,"defaultSocketPathsAbsent":true},"postExecution":{"dockerCommandGuarded":true,"dockerEnvironmentVariablesUnset":true,"dockerServiceInactive":true,"dockerSocketUnitInactive":true,"dockerdProcessNameAbsent":true,"defaultSocketPathsAbsent":true}}' \
+  printf '{"receiptVersion":1,"preExecution":%s,"postExecution":%s}\n' \
+    "$pre_execution_docker_posture" "$post_execution_docker_posture" \
     >"${receipt_stage}/docker-absence.json"
 
   bounded_file "${receipt_stage}/installer.sh" "$MAX_INSTALLER_BYTES"
@@ -409,7 +444,10 @@ run_native_runtime_installer_qualification() {
   receipt_stage=""
 
   printf 'Native runtime installer qualification receipts: %s\n' "$artifact_dir"
-}
+  cleanup
+  trap - EXIT
+  unset -f cleanup
+)
 
 if [[ "${BASH_SOURCE[0]:-}" == "$0" ]]; then
   run_native_runtime_installer_qualification "$@"
 
@@ -10,7 +10,7 @@
 export const NATIVE_RUNTIME_QUALIFICATION_PROTECTED_REPOSITORY = "NVIDIA/NemoClaw";
 /** The trusted collector is separate and rejects evidence emitted by its own workflow. */
 export const NATIVE_RUNTIME_QUALIFICATION_PRODUCER_WORKFLOW =
-  ".github/workflows/native-runtime-qualification.yaml";
+  ".github/workflows/e2e.yaml";
 
 export interface NativeRuntimeQualificationProtectedRun {
   readonly repository: string;
 
@@ -19,6 +19,16 @@ const INFO = JSON.stringify({
     arch: "amd64",
     os: "linux",
     cgroupVersion: "v2",
+    idMappings: {
+      uidmap: [
+        { container_id: 0, host_id: 1000, size: 1 },
+        { container_id: 1, host_id: 100000, size: 65536 },
+      ],
+      gidmap: [
+        { container_id: 0, host_id: 1000, size: 1 },
+        { container_id: 1, host_id: 100000, size: 65536 },
+      ],
+    },
     networkBackend: "netavark",
     security: { rootless: true },
     discoveredDevices: [
@@ -33,7 +43,6 @@ function engine(
     readonly info?: string;
     readonly serverVersion?: string;
     readonly version?: string;
-    readonly idMap?: string;
   } = {},
 ): ContainerEngine {
   const capture = vi.fn((args: readonly string[]) => {
@@ -55,10 +64,7 @@ function engine(
   });
   const captureHost = vi.fn((args: readonly string[]) => ({
     status: 0,
-    stdout:
-      args[0] === "--version"
-        ? (overrides.version ?? "podman version 5.6.2\n")
-        : (overrides.idMap ?? "0 1000 1\n1 100000 65536\n"),
+    stdout: args[0] === "--version" ? (overrides.version ?? "podman version 5.6.2\n") : "",
     stderr: "",
   }));
   return {
@@ -98,14 +104,7 @@ describe("Podman host preflight", () => {
     expect(runtime.capture).toHaveBeenCalledWith(["info", "--format", "json"], 15_000);
     expect(runtime.capture).toHaveBeenCalledWith(["version", "--format", "json"], 10_000);
     expect(runtime.captureHost).toHaveBeenCalledWith(["--version"], 10_000);
-    expect(runtime.captureHost).toHaveBeenCalledWith(
-      ["unshare", "cat", "/proc/self/uid_map"],
-      10_000,
-    );
-    expect(runtime.captureHost).toHaveBeenCalledWith(
-      ["unshare", "cat", "/proc/self/gid_map"],
-      10_000,
-    );
+    expect(runtime.captureHost).toHaveBeenCalledTimes(1);
   });
 
   it("keeps the CPU receipt server version canonical while preserving exact inference authority", () => {
@@ -196,12 +195,41 @@ describe("Podman host preflight", () => {
   });
 
   it("rejects missing subordinate user mappings", () => {
+    const info = JSON.stringify({
+      ...JSON.parse(INFO),
+      host: {
+        ...JSON.parse(INFO).host,
+        idMappings: {
+          ...JSON.parse(INFO).host.idMappings,
+          uidmap: [{ container_id: 0, host_id: 1000, size: 1 }],
+        },
+      },
+    });
+    expect(() =>
+      qualifyPodmanHost(engine({ info }), {
+        platform: "linux",
+        architecture: "x64",
+      }),
+    ).toThrow("subordinate UID range for the API service user");
+  });
+
+  it("rejects malformed API-service ID mappings", () => {
+    const info = JSON.stringify({
+      ...JSON.parse(INFO),
+      host: {
+        ...JSON.parse(INFO).host,
+        idMappings: {
+          ...JSON.parse(INFO).host.idMappings,
+          gidmap: [{ container_id: 0, host_id: 1000, size: "65536" }],
+        },
+      },
+    });
     expect(() =>
-      qualifyPodmanHost(engine({ idMap: "0 1000 1\n" }), {
+      qualifyPodmanHost(engine({ info }), {
         platform: "linux",
         architecture: "x64",
       }),
-    ).toThrow("subordinate UID range");
+    ).toThrow("Podman API returned malformed gidmap");
   });
 
   it("fails before commands for another engine scope or unsupported host platform", () => {
 
@@ -177,25 +177,42 @@ function normalizeArchitecture(value: string): "amd64" | "arm64" | null {
   return null;
 }
 
-function hasSubordinateIdMapping(output: string): boolean {
-  return output
-    .trim()
-    .split(/\r?\n/u)
-    .some((line) => {
-      const values = line.trim().split(/\s+/u).map(Number);
-      return values.length === 3 && values.every(Number.isFinite) && (values[2] ?? 0) > 1;
-    });
-}
-
-function requireSubordinateIdMappings(engine: ContainerEngine): void {
-  for (const mapping of ["uid_map", "gid_map"] as const) {
-    const result = requireSuccessful(
-      `${mapping} inspection`,
-      engine.captureHost(["unshare", "cat", `/proc/self/${mapping}`], 10_000),
+function requireSubordinateIdMappings(host: unknown): void {
+  // Bind this check to the same rootless API service as the rest of the
+  // preflight. A local `podman unshare` can resolve different storage and user
+  // authority than an explicitly bound service endpoint.
+  const mappings = field(host, "idMappings", "IDMappings");
+  for (const mapping of ["uidmap", "gidmap"] as const) {
+    const entries = field(
+      mappings,
+      mapping,
+      mapping === "uidmap" ? "UIDMap" : "GIDMap",
     );
-    if (!hasSubordinateIdMapping(result.stdout)) {
+    if (!Array.isArray(entries) || entries.length === 0 || entries.length > 1_024) {
+      throw new PodmanHostPreflightError(`the Podman API returned malformed ${mapping}`);
+    }
+    let hasSubordinateRange = false;
+    for (const value of entries) {
+      const entry = record(value);
+      const containerId = field(entry, "container_id", "containerID", "ContainerID");
+      const hostId = field(entry, "host_id", "hostID", "HostID");
+      const size = field(entry, "size", "Size");
+      if (
+        !entry ||
+        !Number.isSafeInteger(containerId) ||
+        !Number.isSafeInteger(hostId) ||
+        !Number.isSafeInteger(size) ||
+        (containerId as number) < 0 ||
+        (hostId as number) < 0 ||
+        (size as number) <= 0
+      ) {
+        throw new PodmanHostPreflightError(`the Podman API returned malformed ${mapping}`);
+      }
+      if ((size as number) > 1) hasSubordinateRange = true;
+    }
+    if (!hasSubordinateRange) {
       throw new PodmanHostPreflightError(
-        `rootless Podman requires a subordinate ${mapping === "uid_map" ? "UID" : "GID"} range for the current user`,
+        `rootless Podman requires a subordinate ${mapping === "uidmap" ? "UID" : "GID"} range for the API service user`,
       );
     }
   }
@@ -437,7 +454,7 @@ export function qualifyPodmanHost(
       `the Podman service architecture '${normalizedArchitecture}' does not match host '${expectedArchitecture}'`,
     );
   }
-  requireSubordinateIdMappings(engine);
+  requireSubordinateIdMappings(host);
 
   return Object.freeze({
     providerId: "podman",
 
@@ -128,6 +128,16 @@ function hostDoctorEngine(authorityId = AUTHORITY_ID): PodmanContainerEngine {
                 arch: "amd64",
                 os: "linux",
                 cgroupVersion: "v2",
+                idMappings: {
+                  uidmap: [
+                    { container_id: 0, host_id: 1000, size: 1 },
+                    { container_id: 1, host_id: 100000, size: 65536 },
+                  ],
+                  gidmap: [
+                    { container_id: 0, host_id: 1000, size: 1 },
+                    { container_id: 1, host_id: 100000, size: 65536 },
+                  ],
+                },
                 networkBackend: "netavark",
                 security: { rootless: true },
               },
@@ -140,7 +150,7 @@ function hostDoctorEngine(authorityId = AUTHORITY_ID): PodmanContainerEngine {
     }),
     captureHost: vi.fn((args: readonly string[]) => ({
       status: 0,
-      stdout: args[0] === "--version" ? "podman version 5.6.2\n" : "0 1000 1\n1 100000 65536\n",
+      stdout: args[0] === "--version" ? "podman version 5.6.2\n" : "",
       stderr: "",
     })),
   };