Portable onboarding does not prove default policy application finality

[senthilr-nv]

Goal

On an accepted rootless Podman Linux host, fresh Portable OpenClaw onboarding must apply the accepted default policy set and reach authoritative finality.

When NEMOCLAW_POLICY_PRESETS is absent, empty, or whitespace-only, fresh onboarding must:

• select exactly weather,public-reference,github;
• preserve every mandatory baseline policy entry;
• complete step 8/8;
• confirm the applied policy through OpenShell readback; and
• keep the sandbox and onboarding session resumable after a policy failure.

A nonblank NEMOCLAW_POLICY_PRESETS value remains authoritative. Resume must not inject the fresh default.

Scope authority

Epic #9200 records the accepted narrow-default decision and delivery order. Merged PR #9289 implements the fresh default. PR #9238 remains the separate status-preservation and temporary-cleanup slice.

This decision replaces the earlier requirement to compose personal-open-internet with the mandatory exact-host policies. The accepted default does not require an OpenShell host-exclusion capability.

Current gap

The previous personal-open-internet default overlapped mandatory exact-host policies with incompatible OpenShell metadata. Fresh onboarding then stopped before policy finality.

Merged PR #9289 excludes that broad preset from the implicit default. Explicit operator policy intent remains unchanged.

PR #9238 must still preserve an exact nonzero policy submission status through cleanup and resumable unwind.

Acceptance criteria

• Default: Fresh absent, empty, or whitespace-only intent selects exactly weather,public-reference,github.
• Override: Fresh nonblank operator intent remains authoritative.
• Resume: Resume does not inject or restore the fresh default.
• Allowed: The accepted default preserves mandatory baseline policies, completes onboarding 8/8, and supports one real routed-inference request.
• Denied: Broad unapproved network access, loopback addresses, link-local addresses, metadata endpoints, and unapproved binaries, methods, or paths remain blocked.
• Failure: A controlled invalid submission returns the exact OpenShell status and diagnostic. It must not update local preset attribution.
• Recovery: A later onboarding resume uses the same sandbox identity after the operator corrects the owning prerequisite.
• Cleanup: Temporary policy material is removed after success and failure.

Evidence

Exact PR #9289 commit 6df172770c11115b931f06390fdf417feedffa79 completed these boundaries on a dedicated L40S Brev host:

• strict v2.1 host preparation and prerequisite reboot;
• fresh public-installer onboarding 8/8;
• exact qwen3.6:35b model selection without fallback;
• sandbox Ready and direct CUDA proof;
• exact weather,public-reference,github policy readback;
• allowed weather access and denied broad example.com access;
• connect --probe-only with status 0;
• TUI gateway connected | idle; and
• one real chat turn.

The Epic keeps stop/start, product-installed host restart, uninstall, and the protected complete-journey lane open.

Blockers and stop conditions

• The merged current-main revision must repeat the policy evidence because its identity differs from the tested PR commit.
• PR fix(policy): report the authoritative OpenShell policy result (#9206) #9238 must complete the status-preservation and temporary-cleanup slice before this issue closes.
• Stop before weakening a mandatory baseline policy, explicit operator authority, resume authority, or failure status.

Out of scope

Pairing settlement, host restart, general lifecycle recovery, uninstall preservation, Hermes, and production Podman-provider activation remain separate work.

[AzeelSajjad]

Opened #9238 for the first capability slice.

What it establishes

It reproduces the unchanged default before editing policy behavior, as the delivery section requires. Those tests pass against unmodified main, so the default composition is now pinned rather than changed:

• With NEMOCLAW_POLICY_PRESETS unset, onboarding selects only personal-open-internet, with mode custom and tier personal, and required-preset reconciliation does not widen that authoritative selection.
• Composing the preset onto the OpenClaw baseline adds one network policy key and preserves all seven mandatory baseline entries, with managed_inference structurally identical.
• Loopback, link-local, metadata, unspecified, and IPv4-mapped forms stay denied in the merged document, not only in the preset read in isolation.

The defect it fixes

openshell policy set failures reached the runner's process exit from inside the temp-file block holding the composed sandbox policy. Node does not unwind finally on process exit, so every failed submission left the composed policy readable in $TMPDIR, and the operator saw only Command failed (exit N). That is the same generic output recorded in #8991, and it violates the Cleanup criterion here.

Submissions now run through one helper that owns the temp-file lifetime and classifies the result. A refusal reports the preserved OpenShell status and redacted message and is final. An unconfirmed result reports that gateway state is unknown and must be read back. Both leave local preset attribution unwritten and are not retried. Exactly one mkdtempSync for policy material remains in the tree, shared by the batch apply and all three setPolicyFile callers, which matters because the same onboarding step reaches removePreset on deselection and applyPreset under the interactive tier selector.

What it does not establish

• No live finality. No protected rootless Podman evidence is supplied, because no host was available. The criteria requiring a real sandbox identity, policy readback through --base and --full, and a redacted real-chat result remain open.
• No OpenShell version is pinned. Selecting and landing the release to qualify is maintainer-owned and tracked by chore(deps): update OpenShell to 0.0.106 #9192, still a draft. Nothing in the PR depends on a version change.
• It does not resolve Onboarding fails applying policy presets with an OpenShell HTTP/2 stream reset #8991. The personal-open-internet endpoint overlap with the mandatory exact-host entries is untouched. This changes failure reporting and cleanup only.
• The rejected diagnostic shape is inferred, not observed. Onboarding fails applying policy presets with an OpenShell HTTP/2 stream reset #8991 captured a real transport reset but no semantic rejection, because the defect fixed here is what hid it. The classifier fails safe, degrading an unrecognized diagnostic to the unconfirmed path rather than asserting a verdict. Confirming the refusal path against a real captured sample is worth doing during the hardware run.

Two items for maintainer attention: the PR ratchets two ci/source-architecture-budget.json entries, since src/lib/policy/index.ts sat exactly at the default fan-out cap and needed edges for redaction and the classifier; and this slice is larger than "the shortest deterministic tests" because the cleanup criterion could not be met without the cross-cutting control-flow fix. Splitting it is a reasonable call if preferred.