[N1x Linux][Sandbox] Sandbox rebuild after channels add fails with N1x validation pending preflight

[JoyceChenNV]

Description

Follow-up to GitHub #8574 (N1x Express installation not available).

After a successful NemoClaw v0.0.109 N1x Express preview install, adding a messaging channel (e.g. Slack) via nemoclaw my-assistant channels add slack triggers a sandbox rebuild. The rebuild fails at onboard runtime preflight with "N1x platform validation is pending a physical NemoClaw Express E2E run." The Express install flow waives host.platform.n1x_validation_pending when the user accepts the Deferred preview prompt, but the rebuild path re-runs the onboard runtime preflight without carrying the waiver forward, causing the rebuild to fail-closed.

The sandbox is left untouched (no data loss), but the user cannot apply any configuration change that requires a rebuild (channels, policy presets, etc.) on an N1x Express install.

Platform scope: Reproduced on N1x FASTOS 1.23.0 (RTX Spark, aarch64) only; other platforms not tested.
Regression: No — N1x Express is new functionality introduced in v0.0.109 (PR #8903).
OpenShell issue: No

Environment

Device:        NVIDIA JMJWOA-Generic-GPU (RTX Spark N1x)
OS:            Ubuntu 24.04.4 LTS
Architecture:  aarch64
Kernel:        7.0.0-1015-nvidia
Driver:        615.63
CUDA UMD:      13.4
Node.js:       v26.7.0
npm:           11.19.0
Docker:        Docker version 29.2.1, build a5c7197
OpenShell CLI: 0.0.101
NemoClaw:      v0.0.109
OpenClaw:      2026.7.1 (2d2ddc4)
N1x FASTOS:    1.23.0

Steps to Reproduce

1. On an N1x Linux Laptop (FASTOS 1.23.0), install NemoClaw v0.0.109 via Express:

   curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.109 bash

2. Accept the Deferred N1x preview prompt (Y) when shown.
3. Wait for Express install to complete (sandbox my-assistant created, vllm-local inference healthy).
4. Add a messaging channel:

   nemoclaw my-assistant channels add slack

5. Enter valid Slack tokens and member/channel IDs.
6. When prompted "Rebuild 'my-assistant' now to apply? [Y/n]:", choose Y.

Expected Result

Rebuild succeeds. The N1x validation waiver granted during Express install carries forward to subsequent rebuild operations. The sandbox is rebuilt with the new Slack channel configuration applied.

Actual Result

Rebuild fails at onboard runtime preflight:

  Rebuild sandbox 'my-assistant'
    Current:  OpenClaw v2026.7.1
    Target:   OpenClaw v2026.7.1

  ✗ N1x platform validation is pending a physical NemoClaw Express E2E run.

  Rebuild preflight failed: the replacement onboarding host/runtime checks did not pass.
  onboard runtime preflight exited with code 1
  Aborting rebuild — sandbox is untouched, no data was lost.
  Replacement onboarding preflight failed

The sandbox is untouched but no configuration change requiring a rebuild can be applied.

Logs

nvidia@localhost:~$ nemoclaw my-assistant channels add slack
  Effective egress that would be opened:
    policy 'slack':
      - slack.com:443 (protocol: rest, enforcement: enforce)
          allow: GET  /**
          allow: POST  /**
      - api.slack.com:443 (protocol: rest, enforcement: enforce)
          allow: GET  /**
          allow: POST  /**
      - hooks.slack.com:443 (protocol: rest, enforcement: enforce)
          allow: GET  /**
          allow: POST  /**
      - wss-primary.slack.com:443 (protocol: websocket, enforcement: enforce)
          allow: GET  /**
          allow: WEBSOCKET_TEXT  /**
      - wss-backup.slack.com:443 (protocol: websocket, enforcement: enforce)
          allow: GET  /**
          allow: WEBSOCKET_TEXT  /**
      binaries:
        - /usr/local/bin/node
        - /usr/bin/node

  Slack API → Your Apps → OAuth & Permissions → Bot User OAuth Token (xoxb-...).
  Slack Bot Token: ***********************************************************

  Slack API → Your Apps → Basic Information → App-Level Tokens (xapp-...).
  Slack App Token (Socket Mode): **************************************************************************************************
  ✓ slack token saved
  ✓ slack app token saved

  In Slack, open each allowed human user's profile -> More -> Copy member ID. Enter one or more comma-separated member IDs, not the app or bot user ID. Member IDs look like U01ABC2DEF3.
  Slack Member IDs (comma-separated allowlist): U0B3T98255M
  ✓ slack allowed IDs saved

  Optional: enter comma-separated Slack channel IDs where the bot may answer @mentions. Channel IDs look like C012AB3CD.
  Slack Channel IDs (comma-separated allowlist): C0B48NQ7FT4
  ✓ slack channel IDs saved
  ✓ Registered slack bridge with the OpenShell gateway.
✓ Policy version 4 submitted (hash: 0c4e99803b64)
✓ Policy version 4 loaded (active version: 4)
  Applied preset: slack
  Rebuild 'my-assistant' now to apply? [Y/n]: Y

  Rebuild sandbox 'my-assistant'
    Current:  OpenClaw v2026.7.1
    Target:   OpenClaw v2026.7.1

  ✗ N1x platform validation is pending a physical NemoClaw Express E2E run.

  Rebuild preflight failed: the replacement onboarding host/runtime checks did not pass.
  onboard runtime preflight exited with code 1
  Aborting rebuild — sandbox is untouched, no data was lost.
  Replacement onboarding preflight failed