[Deferred] CUA: Attach and secure a disposable target

[jyaunches]

Parent epic: #6015

This is the second cumulative vertical capability. It builds on the host-agnostic install and readiness slice in #7755 and applies the target/security invariants recorded in #7754.

Outcome

Attach, inspect, secure, and remove one dedicated disposable desktop target through public NemoClaw commands.

The cumulative candidate still onboards exactly one OpenShell-managed NemoCUA sandbox. The separately managed target exposes healthy browser, computer, and terminal services. NemoClaw stores only bounded content-free authority; host provisioning and transport remain outside core.

Feature and readiness gates

• Every CUA target or security command is absent unless NEMOCLAW_CUA_ENABLED=1 exactly.
• Candidate execution additionally requires NEMOCLAW_CUA_QUALIFICATION=1 exactly and current validated status: "candidate" readiness.
• status: "available" and ordinary final execution remain absent in this slice.
• These gates are revalidated immediately before adapter execution and again before its result can become durable authority.

User journey

1. Complete CUA vertical slice 1: Install and inspect a candidate worker #7755 and read current candidate readiness.
2. Attach one manifest-registered, dedicated, disposable, non-production target.
3. Verify exact target-image and service-bundle identities and healthy browser, computer, and terminal services.
4. Read the attachment through public status and health commands.
5. Verify and record the deny-by-default security boundary for the exact runtime, route, policy, target, and adapters.
6. Read the current attestation through public status.
7. Detach or destroy the target and verify loss of reachability and removal of derived authority.
8. Recover an interrupted attach or cleanup operation through the public reconciliation projection and an independent observation.

Cumulative public command sequence

Action	Public command	Record
Onboard	nemoclaw onboard --agent nemocua --name <sandbox> --fresh --non-interactive --yes-i-accept-third-party-software --yes	candidate runtime readiness
Read runtime	nemoclaw <sandbox> status --json	validated cumulative public state
Diagnose runtime	nemoclaw <sandbox> doctor --json	current-authority checks
Run interactive runtime	nemoclaw launch <sandbox>	exact nemocua interactive process
Run headless runtime	nemoclaw <sandbox> agent	exact nemocua headless process
Attach target	nemoclaw <sandbox> cua target attach --adapter <absolute-path> --target-manifest <path> --json	target-attachment
Read target	nemoclaw <sandbox> cua target status --json	target-attachment
Observe/recover	nemoclaw <sandbox> cua target health --adapter <absolute-path> --json	observed attachment or bounded failure
Verify security	nemoclaw <sandbox> cua security verify --adapter <absolute-path> --json	security-attestation
Read security	nemoclaw <sandbox> cua security status --json	security-attestation
Detach target	nemoclaw <sandbox> cua target detach --adapter <absolute-path> --json	detached attachment
Destroy target	nemoclaw <sandbox> cua target destroy --adapter <absolute-path> --json	detached attachment
Destroy sandbox	nemoclaw <sandbox> destroy --yes	removed sandbox authority

Readiness advertises exactly these target/security operations after the cumulative journey consumes them. target.reset and all task operations remain unavailable.

This slice introduces the deterministic #7750 envelope because it introduces
the first dedicated CUA JSON lifecycle handlers. Every target or security
failure uses that envelope. Handlers must not substitute adapter stderr,
private target detail, credentials, paths, or transport coordinates for the
bounded failure family. Existing Slice 1 commands retain their established
redacted, nonzero error behavior instead of gaining a parallel transport.

Architecture and security decisions

• One OpenShell agent sandbox controls one separately managed reconstructible target; NemoClaw does not create a nested sandbox.
• Attach only an exact registered target image/service tuple. Never attach employee desktops, production accounts, shared mutable sessions, or targets with external side effects.
• Target administration credentials, SSH/VNC material, endpoints, and transport handles stay in the host-side boundary and out of public JSON, state, logs, diagnostics, snapshots, and backups. Detach/destroy remove only disposable target/session credentials created for this attachment. Provider credentials follow existing OpenShell gateway ownership, and cleanup cannot delete shared provider authority used by another sandbox or route.
• Permit only managed inference and recorded target services. Deny unrelated Internet, cloud metadata, undeclared loopback, host administration, host desktop, and Docker-socket access.
• Compute one canonical digest over the complete current runtime readiness and bind every target, attestation, adapter request/response, and persisted record to it.
• Bind the attestation to exact OpenShell, inference provider authority, effective policy, runtime and target component identities, adapter digests, and capability set.
• Require a current security attestation before later task admission. A failed security verification clears the prior attestation. Target health that reports unreachable, incompatible, or replaced also clears it; no earlier success remains usable.
• Reobserve live inference and applied-policy identity before adapter invocation and before committing its result.
• Invalidate target and security authority after any source, readiness, manifest, adapter, OpenShell, inference, policy, target, or component change.
• Snapshot adapters from absolute no-follow regular files, verify exact digests, reject replacement/symlink/interpreter drift, and cap input, output, time, process, memory, filesystem, and network authority.
• Treat an --adapter argument only as a selector for manifest-registered immutable bytes, never as caller authority. Target operations must match components.targetAdapter; security.verify must match components.securityVerifier; an ad hoc but schema-valid verifier is rejected.
• Introduce and admit the fixed root-installed isolation runner in this slice before the first candidate adapter invocation. Slice CUA vertical slice 1: Install and inspect a candidate worker #7755 executes no adapters and does not require the runner.
• Hold shared sandbox and inference leases in the declared order; do not execute an adapter while holding the age-bounded registry lock.
• Record a durable pending-effect journal before each external call. Compare-and-swap the complete sandbox row afterward.
• Preserve a possible external effect after timeout, malformed output, process failure, restart, or conflict. Permit only fresh health observation and exact cleanup while reconciliation remains.
• Detach/destroy replace attached authority with a detached projection, clear security and reconciliation-derived state, and preserve current candidate runtime readiness.
• This slice owns live target-image, service-bundle, target-channel, GPU, probe-image, and required host-tool observation and mismatch tests. CUA vertical slice 1: Install and inspect a candidate worker #7755 treats those values only as manifest inputs.

Exact-head live acceptance

The exact PR head must complete attach, status, health, security verify/status,
detach, destroy, and interrupted-effect reconciliation against the real pinned
target lane. E2E-support or a schema-valid fake adapter cannot replace this
evidence.

The live receipt must reobserve and match the target image, service bundle,
three service protocols and health results, target channel, applied policy,
managed inference authority, registered adapters, GPU model/count, driver,
CUDA, NVIDIA container toolkit, immutable probe image, Docker image identity,
probe result, and required host-tool bytes. It must include one negative case
for each mismatched field and prove failed re-verification clears prior security
authority. Cleanup must independently prove loss of target reachability while
preserving shared provider authority.

Tests and acceptance

• Every CUA vertical slice 1: Install and inspect a candidate worker #7755 acceptance criterion remains passing.
• Public attach/status/health/security/detach/destroy command and package-contract tests pass.
• Exact target image, service bundle, three-service health, policy, inference, readiness, and adapter bindings fail closed on drift.
• Candidate adapter execution is isolated and a substituted runner or adapter is rejected.
• Concurrent registry mutation cannot commit stale target/security authority.
• Restart and compare-and-swap conflict tests preserve reconciliation and deny stale authority replay.
• Cleanup requires an independent observation and removes reachability and derived authority.
• The exact-head live acceptance journey above passes with the real pinned target, adapters, GPU/tool tuple, and independent cleanup observation.
• Failed security re-verification and unhealthy/incompatible/replaced health results clear the prior attestation.
• Public state remains bounded, content-free, and credential-free.
• The feature remains disabled by default and advertises no task/reset operations.
• The PR publishes the cumulative row-by-row [Deferred] Preserve CUA security, authority, and recovery invariants #7754 prototype extraction receipt for its exact base and head SHAs.
• Repository checks, relevant E2E support, docs, and exact-head documentation writer review pass.

Exclusions

• Task execution or browser-form qualification.
• Target reset/recreation; that enters the terminal/recovery slice.
• General target provisioning, remote-desktop management, or cloud control-plane behavior in core.
• Final availability or product support.

Stack position

• Required cumulative base: CUA vertical slice 1: Install and inspect a candidate worker #7755.
• Architecture record: Define the CUA architecture and trust boundaries #7750.
• Security/state record: [Deferred] Preserve CUA security, authority, and recovery invariants #7754.
• Release gate: [Deferred] Verify the cumulative CUA release gate on Brev #7753.
• The browser-task capability in [Deferred] CUA: Run and verify a browser-form task #8449 is the next cumulative slice.