[Deferred] CUA: Run a computer task and the integrated journey

[jyaunches]

Parent epic: #6015

This is the fifth cumulative vertical capability and the top product-behavior slice. It builds on #7755, #8450, #8449, and #7751.

Outcome

Run one real computer-only DOCX task and one integrated browser, terminal, and computer task through the same public lifecycle.

The computer task edits and saves a pinned DOCX. An independent parser verifies exact content. A private post-save screenshot is bound by digest but is not the state oracle. The integrated task uses all three services, repeats after recreation, and finishes with complete cleanup.

Feature and readiness gates

• Every CUA command is absent unless NEMOCLAW_CUA_ENABLED=1 exactly.
• Candidate execution additionally requires NEMOCLAW_CUA_QUALIFICATION=1 exactly and current validated status: "candidate" readiness.
• Computer and integrated tasks use only operations already advertised by [Deferred] CUA: Run and verify a browser-form task #8449. They require current target, security, policy, inference, adapter, and whole-readiness authority before and after adapter execution.

User journeys

Computer task

1. Attach and secure the exact disposable target.
2. Open, edit, and save the pinned DOCX through the computer service.
3. Retrieve one final task result claiming exactly the computer capability.
4. Parse the saved DOCX outside the agent and verify exact contents.
5. Bind a private post-save screenshot digest to the result.

Integrated task

1. Prepare synthetic local state through terminal.
2. Open it through browser and perform the required visual interactions through computer.
3. Retrieve one result with exactly browser, terminal, and computer receipts.
4. Verify final state through an independent oracle.
5. Recreate the sandbox and target, then repeat with distinct identities.
6. Destroy target and sandbox and verify reachability, mutable state, temporary authority, and undeclared backup content are gone.

No computer- or scenario-specific NemoClaw API is added. The host-worker adapter continues to map only the public readiness, target, security, task, result, reconciliation, and sandbox lifecycle surfaces.

Cumulative public command sequence

Action	Public command
Onboard	nemoclaw onboard --agent nemocua --name <sandbox> --fresh --non-interactive --yes-i-accept-third-party-software --yes
Read runtime	nemoclaw <sandbox> status --json
Diagnose runtime	nemoclaw <sandbox> doctor --json
Run interactive runtime	nemoclaw launch <sandbox>
Run headless runtime	nemoclaw <sandbox> agent
Attach target	nemoclaw <sandbox> cua target attach --adapter <absolute-path> --target-manifest <path> --json
Read target	nemoclaw <sandbox> cua target status --json
Observe target	nemoclaw <sandbox> cua target health --adapter <absolute-path> --json
Verify security	nemoclaw <sandbox> cua security verify --adapter <absolute-path> --json
Read security	nemoclaw <sandbox> cua security status --json
Start task	nemoclaw <sandbox> cua task start --adapter <absolute-path> --task-id <id> --mode headless --input-file <path> --json
Observe task	nemoclaw <sandbox> cua task status --adapter <absolute-path> --task-id <id> --json
Read result	nemoclaw <sandbox> cua task result --adapter <absolute-path> --task-id <id> --json
Cancel/reconcile	nemoclaw <sandbox> cua task cancel --adapter <absolute-path> --task-id <id> --json
Reset target	nemoclaw <sandbox> cua target reset --adapter <absolute-path> --json
Detach target	nemoclaw <sandbox> cua target detach --adapter <absolute-path> --json
Destroy target	nemoclaw <sandbox> cua target destroy --adapter <absolute-path> --json
Create snapshot	nemoclaw <sandbox> snapshot create --name <snapshot>
Destroy sandbox	nemoclaw <sandbox> destroy --yes
Re-onboard same name	nemoclaw onboard --agent nemocua --name <sandbox> --fresh --non-interactive --yes-i-accept-third-party-software --yes
Restore in place	nemoclaw <sandbox> snapshot restore <snapshot> --yes

The bounded private input and manifest-pinned adapter select the computer-only
or integrated task. No command flag, public record, or scenario-specific core
API accepts expected result content.

Every failure uses the deterministic #7750 envelope. Document, screenshot,
browser, terminal, fixture, oracle, and adapter content do not enter the public
failure record or logs.

Evidence and security decisions

• Treat webpage/screen/download/DOCX/task/runtime/adapter/fixture/oracle content as untrusted. It cannot change authority, expected values, commands, policy, identities, or cleanup decisions.
• A capability-specific result claims exactly what it exercised; the integrated result contains exactly one receipt for each of the three capabilities.
• The private post-save screenshot comes from the manifest-pinned computer adapter and target-service authority after the save observation. Caller-supplied or pre-save bytes cannot satisfy the evidence binding.
• Keep documents, screenshots, page content, task input, logs, browser profiles, cookies, and transport private. Public records expose bounded content-free digests/status only.
• Expected results remain outside task, fixture, adapter, and oracle inputs. The independent parser/oracle receives no expected final-state digest.
• Bind every result/evidence reference to exact whole readiness, source, OpenShell, inference/provider authority, applied policy, runtime/target components, adapter, target, task, fixture, and oracle identities.
• Reject replay after any identity, readiness, policy, route, target, recreation, or evidence change.
• Use distinct sandbox, target, task, fixture-state, final-state, and evidence identities after recreation.
• Preserve every network, credential, process, adapter, file, size, no-follow, state, concurrency, and reconciliation invariant from [Deferred] Preserve CUA security, authority, and recovery invariants #7754 and earlier slices.
• Cleanup removes disposable target/task session credentials created for these journeys. Provider credentials remain under existing OpenShell gateway ownership and cannot be deleted while another sandbox or route still uses them.

Final technical readiness boundary

#7753 governs cumulative Brev/GPU re-observation and the immutable evidence needed for a later final readiness transition. It is a release gate, not another feature slice.

After #7753 accepts the exact cumulative candidate evidence, a distinct signed final NemoClaw head may consume an immutable external qualified manifest that binds that evidence and the exact final source revision. Candidate and final revisions must differ; do not claim ancestry unless separate release evidence proves it. Fresh-host final validation must not depend on mutable candidate-host files.

status: "available" remains default-off and requires exact final evidence validation. It does not establish product support without the maintainer decision recorded under #6015.

Tests and acceptance

• Every earlier slice remains passing on the cumulative exact SHA.
• The real runtime edits/saves the DOCX and an independent parser verifies exact contents.
• A private post-save screenshot is digest-bound and is not used as the state oracle.
• The computer-only result claims exactly computer.
• The integrated task uses and claims exactly browser, terminal, and computer.
• The recreated journey uses distinct identities and rejects replayed evidence.
• The complete network, credential, process, artifact, build, concurrency, replay, recovery, and cleanup negative matrix passes.
• Target/sandbox destruction removes reachability, mutable state, private artifacts, temporary authority, and undeclared snapshot content.
• Cleanup removes only journey-owned target/task session credentials and preserves shared provider authority.
• Public status, diagnostics, snapshots, results, and receipts remain bounded, credential-free, and content-free.
• Every command in the public lifecycle table and every earlier cumulative command passes on the exact PR head.
• Computer-only, integrated, recreated, and cleanup live journeys pass with the real pinned runtime and target on that exact head.
• The PR publishes the cumulative row-by-row [Deferred] Preserve CUA security, authority, and recovery invariants #7754 prototype extraction receipt for its exact base and head SHAs.
• Repository, package, docs, E2E-support, live E2E, signature/DCO, and exact-head documentation writer checks pass.
• Maintainers receive exact cumulative evidence before any enablement/support decision.

Exclusions

• Product enablement without an explicit maintainer decision.
• Employee desktops, production accounts, uncontrolled external side effects, or general remote-desktop/fleet management.
• Brev control-plane behavior, cross-agent delegation, messaging, or a qualification-private core API.
• Public task content, screenshots, documents, detailed evidence, or transport data.
• Task pause, guide, respond, events, logs, or plans unless a future accepted capability consumes and proves them.

Stack position

• Required cumulative bases: CUA vertical slice 1: Install and inspect a candidate worker #7755, [Deferred] CUA: Attach and secure a disposable target #8450, [Deferred] CUA: Run and verify a browser-form task #8449, and [Deferred] CUA: Run a terminal task and recover lifecycle state #7751.
• Architecture record: Define the CUA architecture and trust boundaries #7750.
• Security/state record: [Deferred] Preserve CUA security, authority, and recovery invariants #7754.
• Cumulative release gate: [Deferred] Verify the cumulative CUA release gate on Brev #7753.
• This is the top product-behavior slice; its cumulative evidence feeds [Deferred] Verify the cumulative CUA release gate on Brev #7753 and the maintainer decision in [Epic] Support computer-use agents as a first-class agent type #6015.

[abhipi]

Each component of this agent should be tested/ modality. A sample plan (laucnh task + deterministic code-based verifier):

Browser:

• Browser tasks-> Sample navigation + form filling with a dummy form (text, drop down fields, scrolling)
• Confirm JSON on submission

Terminal

• Making and moving a text file
• Confirm location and contents deterministically

Computer Use:

• Open and edit a docx document, take a screenshot and save.
• Confirm screenshot + contents of the docx