Merge remote-tracking branch 'origin/main' into feat/n1x-express-install-8574

Author: sandl99

ci/platform-matrix.json

@@ -261,7 +261,7 @@
     {
       "name": "Podman / other container runtimes",
       "status": "unsupported",
-      "notes": "Onboard surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed)."
+      "notes": "Standard onboarding surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). The explicit portable experimental profile has one installer-preflight admission exception for the Podman unsupported-runtime finding, as accepted in issue #9007. It does not waive any other readiness blocker or make Podman generally supported. Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed)."
     },
     {
       "name": "Intel Mac (macOS x86_64)",

docs/reference/commands.mdx

@@ -782,7 +782,10 @@ Kanban backup does not include named boards, attachments, worker logs, scratch w
 </AgentOnly>
 
 Before creating the gateway, the wizard runs preflight checks.
-It verifies that Docker is reachable, rejects unsupported runtimes such as Podman, and prints host remediation guidance when prerequisites are missing.
+It verifies that Docker is reachable and prints host remediation guidance when prerequisites are missing.
+Standard onboarding rejects unsupported runtimes such as Podman.
+The explicit portable experimental profile has one installer-preflight admission exception for the Podman unsupported-runtime finding.
+It does not waive any other readiness blocker or make Podman generally supported.
 The preflight also enforces the OpenShell version range declared in the blueprint (`min_openshell_version` and `max_openshell_version`).
 If the installed OpenShell version falls outside this range, onboarding exits with an actionable error and a link to compatible releases.
 For fresh OpenShell installs, NemoClaw queries published OpenShell releases and asks the installer to use a release that fits the blueprint range.

docs/reference/platform-support.mdx

@@ -167,7 +167,7 @@ They are listed here so launch material, sales conversations, and support triage
 {/* out-of-scope:begin */}
 | Item | Status | Why |
 |------|--------|-----|
-| Podman / other container runtimes | Unsupported | Onboard surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed). |
+| Podman / other container runtimes | Unsupported | Standard onboarding surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). The explicit portable experimental profile has one installer-preflight admission exception for the Podman unsupported-runtime finding, as accepted in issue #9007. It does not waive any other readiness blocker or make Podman generally supported. Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed). |
 | Intel Mac (macOS x86_64) | Unsupported | The supported OpenShell Homebrew gateway service path is Apple Silicon only, and OpenShell does not publish macOS x86_64 standalone gateway assets. The top-level installer rejects Intel Mac hosts before release-ref resolution or downloads (`install.sh:108`), and the OpenShell installer retains a downstream asset guard (`scripts/install-openshell.sh:687`). See issue #954 (closed). |
 | Non-Ubuntu/Debian Linux distros | Unsupported | Installer assumes `apt-get`. Fedora/Rocky/Alma/Arch/NixOS are not validated and the installer's package-manager probes do not cover them. See open issue #899 (Fedora hang). |
 | Native Kubernetes or OpenShift deployments | Unsupported | NemoClaw runs the sandbox as a Docker container, not a Kubernetes pod. The default Docker-driver topology does not embed k3s. Operator-managed K8s/OpenShift deployments are out of scope; see issue #407 (community OpenShift through agent-sandbox CRD). |

test/install-portable-profile.test.ts

@@ -51,31 +51,37 @@ describe("installer portable profile runtime override", () => {
 
   it("rejects an unknown experimental profile before install effects (#9007)", () => {
     const fixture = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-invalid-profile-"));
-    const marker = path.join(fixture, "existing-state");
-    fs.writeFileSync(marker, "unchanged\n");
-    const stateBefore = fs.readdirSync(fixture);
+    const processTemp = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-invalid-profile-tmp-"));
+    try {
+      const marker = path.join(fixture, "existing-state");
+      fs.writeFileSync(marker, "unchanged\n");
+      const stateBefore = fs.readdirSync(fixture);
 
-    const result = spawnSync(
-      "bash",
-      [INSTALLER_PAYLOAD, "--experimental-profile", "not-portable"],
-      {
-        cwd: fixture,
-        encoding: "utf-8",
-        env: {
-          ...process.env,
-          HOME: fixture,
-          NEMOCLAW_EXPERIMENTAL_PROFILE: "",
-          TMPDIR: fixture,
-          XDG_CONFIG_HOME: path.join(fixture, "config"),
+      const result = spawnSync(
+        "bash",
+        [INSTALLER_PAYLOAD, "--experimental-profile", "not-portable"],
+        {
+          cwd: fixture,
+          encoding: "utf-8",
+          env: {
+            ...process.env,
+            HOME: fixture,
+            NEMOCLAW_EXPERIMENTAL_PROFILE: "",
+            TMPDIR: processTemp,
+            XDG_CONFIG_HOME: path.join(fixture, "config"),
+          },
         },
-      },
-    );
+      );
 
-    expect(result.status).toBe(1);
-    expect(`${result.stdout}${result.stderr}`).toContain(
-      "Unknown experimental profile: not-portable (expected: portable).",
-    );
-    expect(fs.readdirSync(fixture)).toEqual(stateBefore);
-    expect(fs.readFileSync(marker, "utf-8")).toBe("unchanged\n");
+      expect(result.status).toBe(1);
+      expect(`${result.stdout}${result.stderr}`).toContain(
+        "Unknown experimental profile: not-portable (expected: portable).",
+      );
+      expect(fs.readdirSync(fixture)).toEqual(stateBefore);
+      expect(fs.readFileSync(marker, "utf-8")).toBe("unchanged\n");
+    } finally {
+      fs.rmSync(processTemp, { force: true, recursive: true });
+      fs.rmSync(fixture, { force: true, recursive: true });
+    }
   });
 });