[Deferred] CUA: Run and verify a browser-form task

[jyaunches]

Parent epic: #6015

This is the third cumulative vertical capability. It builds on candidate install/readiness in #7755 and target/security lifecycle in #8450.

Outcome

Run one real seeded browser-form task through the public NemoClaw lifecycle and independently verify its exact submitted JSON.

The task enters text, selects an option, scrolls, and submits. The real manifest-pinned CUA runtime and target services perform the actions. A fake performer, HTTP client assertion, caller-provided action list, or repository test helper cannot satisfy live acceptance.

Feature and readiness gates

• Every CUA task command is absent unless NEMOCLAW_CUA_ENABLED=1 exactly.
• Candidate execution additionally requires NEMOCLAW_CUA_QUALIFICATION=1 exactly and current validated status: "candidate" readiness.
• Task start requires the exact advertised operation, current target authority, healthy browser/computer/terminal services, and a current security attestation.
• The gates are revalidated immediately before adapter execution and again before output can update active-task or result state.

User journey

1. Complete the cumulative install, readiness, target attach, health, and security journey.
2. Prepare one deterministic local browser fixture and bounded private task input.
3. Start the task through the public task command.
4. Poll the same task ID and retrieve one final task-result.
5. Independently read fixture state and verify the exact JSON.
6. Cancel the exact observed task if cleanup is required.
7. Destroy the target and verify fixture/browser reachability and mutable state are removed.

Cumulative public command sequence

Action	Public command	Record
Onboard	nemoclaw onboard --agent nemocua --name <sandbox> --fresh --non-interactive --yes-i-accept-third-party-software --yes	candidate runtime readiness
Read runtime	nemoclaw <sandbox> status --json	validated cumulative public state
Diagnose runtime	nemoclaw <sandbox> doctor --json	current-authority checks
Run interactive runtime	nemoclaw launch <sandbox>	exact nemocua interactive process
Run headless runtime	nemoclaw <sandbox> agent	exact nemocua headless process
Attach target	nemoclaw <sandbox> cua target attach --adapter <absolute-path> --target-manifest <path> --json	target-attachment
Read target	nemoclaw <sandbox> cua target status --json	current attachment
Observe target	nemoclaw <sandbox> cua target health --adapter <absolute-path> --json	observed attachment or bounded failure
Verify security	nemoclaw <sandbox> cua security verify --adapter <absolute-path> --json	security-attestation
Read security	nemoclaw <sandbox> cua security status --json	current attestation
Start task	nemoclaw <sandbox> cua task start --adapter <absolute-path> --task-id <id> --mode headless --input-file <path> --json	active task attachment
Observe task	nemoclaw <sandbox> cua task status --adapter <absolute-path> --task-id <id> --json	active task or final result
Read result	nemoclaw <sandbox> cua task result --adapter <absolute-path> --task-id <id> --json	final task-result
Cancel/reconcile	nemoclaw <sandbox> cua task cancel --adapter <absolute-path> --task-id <id> --json	cancelled result
Detach target	nemoclaw <sandbox> cua target detach --adapter <absolute-path> --json	detached attachment
Destroy target	nemoclaw <sandbox> cua target destroy --adapter <absolute-path> --json	detached attachment
Destroy sandbox	nemoclaw <sandbox> destroy --yes	removed sandbox authority

Readiness advertises exactly task.start, task.status, task.result, and task.cancel. Pause, guide, respond, events, logs, and plans remain unadvertised and fail before input or adapter I/O.

Every failure uses the deterministic #7750 envelope. Task input, adapter
output, fixture state, expected values, and private evidence do not enter its
machine fields or logs.

Browser proof and result decisions

• Treat the browser HTTP request as form state only. It cannot assert trusted events, ordered actions, isTrusted, or reusable interaction evidence.
• Accept interaction evidence only from the exact manifest-pinned browser driver and target-service authority.
• Bind a one-shot observation to session, whole-readiness digest, source asset, derived asset, target, submitted state, ordered actions, adapter, and task identity.
• Invalidate the observation after use or navigation. Reject forged POST, second GET, wrong authority, state mismatch, and replay without changing durable fixture/task state.
• Accept bounded UTF-8 task input only through a regular no-follow file. Keep it out of arguments, public JSON, state, logs, diagnostics, and snapshots.
• Resolve the task adapter against manifest-declared components.taskProtocol before opening task input or beginning adapter execution.
• Enforce one target and one active task.
• Separate agent-authored result from independent verification.
• Treat input-required as active task state only. A terminal task-result is succeeded, failed, or cancelled. Success requires both a succeeded runtime result and passed independent verification; cancellation states must agree.
• A succeeded result contains exactly one completed browser capability receipt; it must not claim terminal or computer use.
• Retain at most the 16 most recent validated final results for the target, evict older results deterministically, and reject reuse of a retained task ID. Detach or destroy clears the retained set and its private evidence references; [Deferred] CUA: Run a terminal task and recover lifecycle state #7751 adds reset behavior.
• Keep screenshots, page content, browser profiles, cookies, detailed logs, and evidence private. Public records contain bounded credential-free digests and status only.
• Bind active task, result, evidence references, and adapter exchange to the whole current readiness, policy, inference, target, and adapter identities.
• Reject candidate output replayed after finalization or any identity/readiness change.
• Use the durable pending-effect/reconciliation protocol from the target slice for start, result, cancellation, and cleanup uncertainty.
• Deny target detach and target destroy while an active task or uncertain task effect exists. Denial occurs before adapter execution and preserves task and reconciliation authority; only the exact observed cancellation/reconciliation path can clear the gate.

Qualification evidence boundary

• Live candidate acceptance uses an exact external target-services artifact that produces the browser-driver observation; an in-repository helper cannot stand in for it.
• Consume expected values from one controller-owned one-shot snapshot before any untrusted artifact executes. Same-UID fixture, oracle, and adapter processes cannot enumerate, reopen, or reuse it.
• Begin with the requested registry/OpenShell name absent; create exactly one requested sandbox and forward only the selected provider's accepted credential aliases.
• Bind the public result to exact runtime, manifest, bundle, image, service, adapter, fixture, oracle, task-input, final-state, and evidence digests.
• Keep private source coordinates, credentials, form contents, screenshots, and target transport out of public receipts and GitHub artifacts.

The cumulative Brev/GPU identity re-observation and final-readiness transition remain governed by #7753. This slice supplies the real browser journey; it does not introduce a horizontal promotion feature.

Tests and acceptance

• Every earlier cumulative acceptance criterion remains passing.
• Public task start/status/result/cancel CLI and package contracts pass.
• The real pinned runtime performs text entry, selection, scrolling, and submission.
• An independent oracle verifies the exact submitted JSON.
• HTTP-forged, replayed, wrong-authority, mismatched, malformed, extra-field, and oversized observations fail without changing durable state.
• Result and adapter replay after readiness, source, policy, inference, target, or adapter change fails closed.
• The result claims exactly the browser capability and exposes no private task content.
• Contradictory active/terminal, success/oracle, and cancellation combinations fail without mutating the active task or retained results.
• Result-cap overflow evicts deterministically, retained task IDs cannot be reused, and detach/destroy clear the retained result boundary.
• Interrupted task effects remain reconcilable across process restart and exact cancellation/target cleanup.
• Target detach and destroy reject active and uncertain tasks before adapter execution and preserve the complete task/reconciliation record.
• A fresh live run uses the exact external browser-driver/target-service artifact, not a fake performer or repository helper.
• The complete browser journey and applicable [Deferred] Preserve CUA security, authority, and recovery invariants #7754 live denials pass on the exact PR head.
• The PR publishes the cumulative row-by-row [Deferred] Preserve CUA security, authority, and recovery invariants #7754 prototype extraction receipt for its exact base and head SHAs.
• Unit, integration, package-contract, E2E-support, applicable live E2E, repository, docs, and exact-head documentation writer checks pass.

Exclusions

• Terminal filesystem qualification, target reset, or sandbox recreation.
• DOCX/computer or integrated three-capability tasks.
• Final available readiness, product enablement, or support approval.
• Demo-private core APIs, private registry reads, or worker transport behavior.

Stack position

• Required cumulative bases: CUA vertical slice 1: Install and inspect a candidate worker #7755 and [Deferred] CUA: Attach and secure a disposable target #8450.
• Architecture record: Define the CUA architecture and trust boundaries #7750.
• Security/state record: [Deferred] Preserve CUA security, authority, and recovery invariants #7754.
• Cumulative release gate: [Deferred] Verify the cumulative CUA release gate on Brev #7753.
• The terminal/recovery journey follows this slice and must preserve it.