[Epic] Support computer-use agents as a first-class agent type

[abhipi]

Summary

Make computer-use agents (CUAs) a default-off, first-class NemoClaw agent type through five cumulative vertical capabilities.

A CUA owns planning, visual grounding, runtime-private task state/recovery, and evidence production. NemoClaw owns guarded discovery/onboarding, one OpenShell agent sandbox, managed inference, public lifecycle records, fail-closed state, and release verification. A separately managed disposable desktop target exposes browser, computer, and terminal services.

The preserved implementation prototype and review corpus remain visible in closed PRs #8174 and #7785. They are architectural/security reference material, not a stack to reopen or merge wholesale.

The complete post-review prototype is also preserved locally as signed commit
cd616e491cad42f197efb3fd52db019072991a28 on
codex/cua-prototype-archive-20260806. That local archive is not remotely
fetchable and is not a delivery input. The replacement Slice 1 PR must publish
the row-by-row extraction receipt that maps the applicable prototype tests and
review findings to replacement tests on its exact base and head SHAs. Later
slices extend that cumulative receipt.

Accepted topology and ownership

NemoClaw host
  ├── one OpenShell-managed NemoCUA agent sandbox
  │     └── planning, managed inference, task execution, private evidence
  └── one separately managed disposable desktop target
        ├── browser service
        ├── computer service
        └── terminal service

• NemoClaw core remains host-agnostic and creates no nested NemoCUA sandbox.
• The CUA is selected through canonical interactive/non-interactive onboarding and reuses the ordinary terminal runtime contract.
• The host-worker adapter maps only public NemoClaw JSON/CLI surfaces. It does not import private modules or inspect registry state.
• Target provisioning/transport, fixture setup, independent oracles, and private evidence collection remain outside core.
• No slice operates employee desktops, production accounts, shared mutable sessions, or uncontrolled external side effects.
• Detailed screenshots, documents, page/task content, logs, browser state, credentials, endpoints, and transport stay private.

Feature and readiness states

• NEMOCLAW_CUA_ENABLED=1 is the only feature value that exposes CUA behavior.
• Candidate execution additionally requires NEMOCLAW_CUA_QUALIFICATION=1 and exact bounded candidate authority.
• Candidate public readiness uses status: "candidate"; a final-only consumer cannot accept it as "available".
• Every cumulative record binds the complete current readiness identity, exact source, artifacts, OpenShell, inference/provider authority, policy, adapters, target, and applicable evidence.
• The feature remains disabled by default after merge. Technical final readiness and product support are separate maintainer decisions.

Cumulative vertical capability stack

Each PR must leave a real, independently usable capability at its head. Later PRs preserve every earlier journey and test.

1. CUA vertical slice 1: Install and inspect a candidate worker #7755 — Install and inspect a candidate worker. Discover the pinned runtime, admit it before side effects, onboard exactly one OpenShell sandbox, verify runtime/inference, and expose validated candidate readiness publicly.
2. [Deferred] CUA: Attach and secure a disposable target #8450 — Attach and secure a disposable target. Attach/status/health/detach/destroy one exact three-service target, verify its deny-by-default security boundary, and reconcile uncertain target effects.
3. [Deferred] CUA: Run and verify a browser-form task #8449 — Run and verify a browser-form task. Start/status/result/cancel one real browser task, accept only manifest-pinned one-shot driver evidence, and independently verify submitted JSON.
4. [Deferred] CUA: Run a terminal task and recover lifecycle state #7751 — Run a terminal task and recover lifecycle state. Verify exact filesystem state, cancellation/reconnect, uncertain-effect recovery, target reset, and same-name sandbox recreation.
5. [Deferred] CUA: Run a computer task and the integrated journey #7752 — Run a computer task and the integrated journey. Verify DOCX content and private post-save evidence, run all three capabilities together, repeat after recreation, and complete cleanup.

This replaces the earlier three-PR boundary because the preserved prototype measured about 39,100 added lines across 144 files. The five-capability stack keeps the same end product and security model while making the first review unit the approximately production-sized host-agnostic install/readiness capability. It does not introduce a horizontal qualification/promotion feature phase.

Cross-slice decision records

• Define the CUA architecture and trust boundaries #7750 — accepted contract, topology, ownership, public-record, identity, state, evidence, compatibility, and command decisions.
• [Deferred] Preserve CUA security, authority, and recovery invariants #7754 — security/state invariant ledger. Every review finding is assigned to the earliest capability that creates the relevant authority or side effect and remains cumulative afterward.

These issues can receive new review findings. They are not implementation PRs and do not determine stack order.

Cumulative release gate

#7753 is the fresh Brev/GPU release gate, not a sixth feature slice. It reobserves every claimed source, build, environment, runtime, image, service, adapter, inference, policy, GPU/tool, fixture, oracle, result, cleanup, and evidence identity across the cumulative journeys.

After the exact cumulative candidate passes that gate, a distinct signed final head may consume an immutable external qualified manifest. Candidate and final source revisions must differ. Do not claim ancestry unless separate release evidence proves it. Fresh final validation must not depend on mutable candidate-host files.

The gate does not enable CUA by default and does not establish product support. Maintainers record that separate decision here.

Definition of done for each capability

• The PR is based on current main, remains default-off, and contains only its cumulative capability boundary.
• Its named journey works through public NemoClaw inputs and JSON, not a private core API or registry scrape.
• Any runtime/target task uses the real pinned CUA artifacts; fake performers are development-only and cannot satisfy live acceptance.
• An independent oracle verifies target state where the slice changes target state.
• Applicable architecture/security invariants from Define the CUA architecture and trust boundaries #7750/[Deferred] Preserve CUA security, authority, and recovery invariants #7754 fail closed.
• Public records are versioned, deterministic, bounded, content-free, and credential-free.
• Unit, integration, package-contract, E2E-support, applicable live E2E, repository, signature/DCO, docs, and exact-head documentation writer checks pass.
• Evidence names the exact tested commit and immutable applicable identities without exposing private coordinates or credentials.
• Each delivery issue states the exact feature gates and public commands that its journey uses. References to earlier slices do not replace that local command contract.
• Each capability's applicable live journey passes on the exact PR head. A source test, package contract, fake performer, or draft receipt cannot close the capability issue.
• The PR publishes an extraction receipt for every [Deferred] Preserve CUA security, authority, and recovery invariants #7754 invariant first reached by that capability and retains the receipts from earlier slices.

Epic completion criteria

• CUA vertical slice 1: Install and inspect a candidate worker #7755 provides host-agnostic candidate install/onboarding/readiness.
• [Deferred] CUA: Attach and secure a disposable target #8450 attaches and secures one exact disposable target.
• [Deferred] CUA: Run and verify a browser-form task #8449 completes and independently verifies the browser-form task.
• [Deferred] CUA: Run a terminal task and recover lifecycle state #7751 completes terminal/recovery/recreation without regressing earlier journeys.
• [Deferred] CUA: Run a computer task and the integrated journey #7752 completes computer/integrated/recreation/cleanup without regressions.
• Define the CUA architecture and trust boundaries #7750 and [Deferred] Preserve CUA security, authority, and recovery invariants #7754 reflect every accepted architecture/security review decision and map each invariant to a capability.
• [Deferred] Verify the cumulative CUA release gate on Brev #7753 passes on the exact cumulative candidate and distinct final head.
• Fresh-host reproduction requires no source patches, private APIs, registry edits, direct OpenShell workarounds, or manual state edits.
• Maintainers record the final enablement and support decision.

Non-goals

• General remote-desktop, target-fleet, or Brev control-plane management.
• Employee workstations, production accounts, or shared mutable desktops.
• A universal CUA abstraction, cross-agent A2A/MCP delegation, messaging, or dashboard work.
• Public task content/evidence or scenario-specific NemoClaw APIs.

[wscurran]

✨ Thanks for the design proposal. This is a significant new integration surface spanning sandbox, skills, and external desktop automation. Maintainers will need to review the architecture before implementation can proceed.