[Epic] Support native Podman with buildless managed onboarding

[ericksoa]

Outcome

NemoClaw supports Docker and native Podman as pluggable compute runtimes without rebuilding a stock agent from a Dockerfile during onboarding.

The supported path applies to every shipped agent:

• OpenClaw
• Hermes
• LangChain Deep Agents Code (DCode)

All three agents launch from complete, immutable managed-image digests on linux/amd64 and linux/arm64. Podman support includes sandbox GPU access and host-local Ollama, NIM, and vLLM through inference.local, including GPU-backed local inference. Those requirements are part of the support gate, not follow-up scope.

Runtime-specific behavior stays below driver-neutral lifecycle and bootstrap contracts. The abstractions must also admit a socket-free MXC-style provider without adding Podman switches to central onboarding, rebuild, snapshot, or recovery orchestration.

NemoClaw uses OpenShell's existing contracts as-is. No OpenShell code change, issue, or pull request is a prerequisite for this epic, and this work does not authorize mutations in NVIDIA/OpenShell.

Product decisions and invariants

• Docker remains supported.
• Stock managed onboarding becomes buildless; explicit user-supplied --from Dockerfiles remain a separate opt-in path.
• Earlier implementation slices remain inert or internally complete. They must not advertise partial buildless or Podman support.
• Buildless support activates only after OpenClaw, Hermes, and DCode pass together.
• Podman support activates only after all agents, both architectures, GPU access, Ollama, NIM, vLLM, lifecycle recovery, installer validation, and protected E2E pass.
• GPU, local inference, multi-architecture support, recovery, and any supported agent may not be cut from scope without a separate maintainer decision.
• Central orchestration selects capabilities and opaque providers. It must not branch on Podman.
• Each runtime registers exactly once as one immutable RuntimeProviderBundle. The provider identity, capability record, preflight and doctor, gateway, workload, lifecycle, mutation authority, managed bootstrap, snapshot, recovery, cleanup, and container-engine components must be complete and identity-consistent. Registration fails closed otherwise.
• Container-engine selection is an explicit operation-scoped dependency. Shared host-container and host-local-inference flows cannot read or mutate a process-global active engine or execute Podman through Docker-named helpers.
• Podman remains absent from the production selectable registry until 4.6. Earlier PR 4 slices construct it directly for tests and internal qualification only.
• A source-shape guard forbids Podman imports, Podman identity comparisons, and Podman-specific switches in central orchestration.
• A mutable name is never sufficient authority for destructive cleanup. Where the owning surface can delete only by name, NemoClaw quiesces and retains the exact runtime and returns typed immutable cleanup evidence. It must not issue an unsafe name-only delete, even after a best-effort re-resolution.

Driver-neutral architecture

Managed-image selection

The selection layer resolves an exact all-agent publication cohort and platform-specific digest. It validates repository, release/cohort identity, source revision, platform, immutable digest, and agent identity. Unknown runtimes and incomplete or mixed cohorts fail closed.

The selection contract is extensible: tests must register a fake MXC-style runtime profile without editing a central runtime switch. Adding the selection seam does not activate production buildless onboarding.

Startup profile and image runtime

Managed images own a versioned, secret-free startup profile and image-runtime contract. Agent-specific configuration is data, not a runtime-adapter fork. Credentials continue to use existing secret and policy delivery paths and are excluded from images, startup profiles, labels, logs, and completion receipts.

Driver-neutral lifecycle

Onboarding, destroy, rebuild, snapshot, clone, restore, and recovery depend on one injected provider bundle with opaque handles and normalized capability records, not separately mutable registries. Providers may use a socket, CLI, API, session, or runtime-native mechanism internally; those details cannot leak into central orchestration.

Transactional bootstrap

The supported bootstrap sequence is:

1. Select an exact managed image for agent and platform.
2. Create the sandbox with a bounded, non-agent hold.
3. Discover exactly one workload from durable sandbox and bootstrap identity.
4. Take stable normalized inspections and make the observed immutable image/spec identity authoritative.
5. Stage the validated root-owned startup envelope into a stopped replacement.
6. Start through the image-owned bootstrap trampoline, which applies allowlisted state atomically and directly executes the exact captured supervisor argv.
7. Verify an image-authored completion receipt bound to runtime, image, spec, profile, shared-state transaction, and bootstrap identity.
8. Commit registry/shared state only after readiness and required GPU/local-inference proof.
9. On failure, roll back idempotently through the owning provider without unsafe name deletion.

The untrusted agent workload may not run before bootstrap release. The agent remains nonroot after the original supervisor is restored.

The adapter contract separates non-destructive preparation from destructive activation. Preparation creates and inspects a stopped replacement under a transaction-temporary identity, stages the identity-bound envelope, and returns the complete exact original and replacement IDs plus opaque rollback authority. Only after the coordinator durably records those IDs, the bootstrap identity, plan fingerprint, provider and sandbox identities, phase, rollback target, and commit and cleanup receipts may activation quiesce or rename the original. The preserved donor sequence that stops or renames the original before creating and identifying the replacement is explicitly rejected. Recovery must be able to resume or roll back from every recorded phase without relying on process-local maps.

Incremental PR stack

The former monolithic PR 3 and PR 4 review units are source material only. The implementation is extracted into the budgeted chain below.

Review budget:

• one subsystem and one review thesis per PR;
• normally 25–40 files and 2–5k changed lines;
• split again when a unit materially exceeds that budget;
• tests and relevant documentation travel with the behavior they validate; and
• each completed slice is pushed as a correctly based NemoClaw PR only after its local exact-head gates pass; placeholder or monolithic review units are not opened.

Foundation status

PR 1 — #7747: driver-neutral compute selection groundwork (merged)

• Separate compute-driver selection from gateway launch.
• Persist the resolved driver identity.
• Keep current behavior unchanged.
• Merged as cbaeac80b34f5918c44d810cfa2fe2149ea518bf on 2026-07-30.
• The live release label is v0.0.99; no later stack slice receives a release label before its exact head is green and the live bucket is reverified.

PR 2 — #7756: complete immutable managed images (merged)

• Publish complete OpenClaw, Hermes, and DCode images.
• Publish native linux/amd64 and linux/arm64 manifests.
• Validate exact per-platform image contracts.
• Promote an all-agent cohort only after every immutable candidate passes.
• Do not activate buildless onboarding.
• Exact-head CI, advisor, and protected E2E passed for
  061e44f571db855f3fcbbd2d78990c8fe4e4df7b.
• Admin-merged by explicit maintainer instruction as
  f75c03d1faf501b8dcd35c260e0867f09a06d317 on 2026-07-30.
• Merge-time release automation assigned the live v0.0.99 label because the
  PR landed on main before that tag was cut.

PR 3 series — buildless managed onboarding

The preserved #7772 implementation head is extraction source. #7772 is only PR 3.1; every later unit is reconstructed as a clean sequential review boundary, locally validated, and then pushed with its exact predecessor as the base.

Dependency chain:

3.1 → 3.2 → 3.3 → 3.4a → 3.4b → 3.5 → 3.5a → 3.5b → 3.5c → 3.6 → 3.7 → 3.8 → 3.9 → 3.10a → 3.10b → 3.11 → 3.12a → 3.12b → 3.13 → 3.14a → 3.14b → 3.14c → 3.15

3.1 — managed-image catalog, resolution, and inert buildless selection

• Exact all-agent catalog and registry resolution.
• Exact digest/platform/release/cohort validation.
• Driver-neutral buildless selection contract and custom---from escape hatch.
• Fake Podman/MXC-style runtime registration test.
• No production caller, activation, Dockerfile change, workflow change, or public support claim.

Concrete extraction boundary: #7772 contains 18 files (+3,365/-30) for the managed-image contract, catalog, scoped registry transport, workload runtime/source/preparation contracts, the leaf proxy helper, package metadata, and their source and packed-package tests. Registry transport distinguishes unavailability from integrity failure, preserves uppercase/lowercase proxy exclusions, and declares its locked undici import as a production dependency. The package contract packs the CLI, installs it with --omit=dev, asserts the installed production tree contains undici@8.5.0, and constructs the transport. No production onboarding caller imports the new entry points.

The implementation review tree is the clean nine-commit semantic replay at 8d44c748e633b20f11ccfb15d2373a499fb1b5f7 on main 1ce71fa0fe93650b191c396355c817085e515a41. Repository rules prohibited force-pushing the existing PR branch, so final reviewed head 5cc8660794d6a773dfc2c0ba3d75161236fed37c retained the signed protected fast-forward history and merged main 231395a333ed9e415e9c662257e172d01b725b0e. Its final PR diff was byte-identical to the clean semantic replay: 18 files, +3,365/-30. The former monolithic and intermediate heads remain reachable only because of that protected-branch rule and are also preserved in durable local backup refs.

Exact pair 2aebae1f221e62dcf662e6b761399cc71138c28a / 1ce71fa0fe93650b191c396355c817085e515a41 completed ordinary CI, both advisor lanes, and protected E2E successfully. After main moved, pair 5d40953bba29dfa5815511dff075265d492e912a / 148efea9766d0dbfedc4cb90258e0a267af03b67 also completed ordinary CI (30578642503), both advisor lanes (30578640273), protected child 30579573317, controller 30579603366, and coordination check 90993131555 successfully. Both protected cycles passed cloud inference, cloud onboarding, OpenClaw and Hermes security posture, onboard repair, and onboard resume.

The final exact pair 5cc8660794d6a773dfc2c0ba3d75161236fed37c / 231395a333ed9e415e9c662257e172d01b725b0e then passed ordinary CI (30581653222), both advisor lanes (30581651198), protected child 30583833767, controller 30581713214, and coordination check 91005816236. Protected qualification again passed cloud inference, cloud onboarding, OpenClaw and Hermes security posture, onboard repair, and onboard resume. With the maintainer's standing approval preserved across the base refresh, #7772 was admin squash-merged as a8c7ab01ef8442e6edc3b071c758d680ecd29549 on 2026-07-30. GitHub's merge-time release automation added v0.0.99; the previously verified v0.0.100 target label also remains on the merged PR.

GitHub automatically closed the stacked #7944 when #7772's merged source branch was deleted. Repository rules prohibited replacing #7944's protected head with the clean current-main history. Its original head remains preserved as a closed source record.

The clean replacement chain is now pushed through PR3.7. The open dependency chain is:

#7961 13932b9b → #7969 5111410 → #7973 7d51947 → #7976 771f48c → #7988 4788d28 → #7990 75730cf0 → #8001 add39657c

PR3.4a #7960 remains merged as 64d68281064b760232694a3150f13d060a28936f. The open chain is append-only from exact main f8fb820159c4843a19759efc9b0e28d4aa122440 through #7961 13932b9b2486cd42b6fc47645e2f3936e5308d1d, #7969 51114100244689bb444d8b5a91c271c8bc1de1e3, #7973 7d51947c870b8f1de2caa1d33e6e9d6e98d11346, #7976 771f48c47c0aaa1d51511d172fffc691e6c9ac76, #7988 4788d287b8672be1b44999e78e094b2221303bd1, #7990 75730cf09bf1a1aa901cc3b275052250f8e7d85d, and #8001 add39657c6c33ec27f212b173cfdb82add8bfda5. Every pushed slice passed local exact-head validation. #7961, #7969, #7973, #7976, and #7988 are fully green including protected E2E and carry v0.0.100. #7990 is fully green on exact 75730cf09bf1a1aa901cc3b275052250f8e7d85d, including protected E2E, has no unresolved CodeRabbit threads, and carries v0.0.100. #8001 is the repaired PR3.7 transaction on exact #7990 at add39657c6c33ec27f212b173cfdb82add8bfda5: 23 files, +4,048/-0, 117 focused tests, zero added test-file if statements, both builds/typechecks, and full validate:pr pass. Its new exact ordinary, advisor, multiarch, and protected E2E gates are active; it receives v0.0.100 only after every gate is green.

The lower chain is reconstructed on exact main f8fb820159c4843a19759efc9b0e28d4aa122440 with signed/DCO append-only merges, stable slice patch IDs, durable backup refs, and local validate:pr on every pushed head. Standing approval remains in force across this refresh: no PR receives needs: review solely because a base moved. Protected E2E runs immediately whenever eligible, and no PR will merge tonight.

3.2 — #7946: startup-profile schema

• Versioned, bounded, secret-free startup-profile and transport schemas.
• Schema validation and canonical serialization tests.
• Complete all-agent capability and Dockerfile-affordance inventory.
• No image-runtime construction or production wiring.

Reviewed head ea5bd8a8e617563133b1f8fc2843d6b7ba407511 merged current main 0030ba4d3e50a0402a440776f83bace033044937. Its six-file review diff was +3,205/-0; 102 focused profile/transport tests, five watch-trigger integration tests, both builds, validate:pr, diff checks, signature/DCO inspection, and an independent security/dormancy audit passed. The exact diff had no production import or activation. Ordinary CI, both advisors, CodeQL, macOS/WSL, self-hosted amd64/arm64, and protected E2E passed; #7946 was admin squash-merged as 37f6a8a650ff500f7054bae8d36b00e7b42edd41 with v0.0.100.

3.3 — #7959: image-runtime construction

• Hold, image-runtime, onboard-profile, and profile-builder construction.
• Agent/platform-specific construction tests for OpenClaw, Hermes, and DCode.
• No application or shared-state mutation.

Final reviewed head 2a048aeecb4bd491daadc3c109f9b845031a6e04 was a tree-preserving restack commit over merged PR3.2 37f6a8a650ff500f7054bae8d36b00e7b42edd41. Its eight-file diff was +2,714/-1; 156 focused/current-base tests (54 slice-only), both builds, validate:pr, diff and no-docs checks, independent P1/P2 audit, ordinary CI, both advisors, and protected E2E passed. It was admin squash-merged by explicit maintainer instruction as verified commit 91fc63ede7775e2825be8ad6b3c5e5b8706f0119.

3.4a — #7960: all-agent application mapping and coordination

• Map validated profiles into fail-closed application and environment plans.
• Coordinate OpenClaw, Hermes, and DCode configuration without filesystem mutation.
• Preserve engine neutrality and keep production activation absent.

The former combined PR3.4 exceeded the soft review budget and was split. #7960 merged as 64d68281064b760232694a3150f13d060a28936f after its exact head 7d1668bbe6b1758539531db185903fb0256b150a passed the complete ordinary-CI, advisor, CodeRabbit, and protected-E2E gate. Its eight-file diff was +3,587/-0; 45 CLI-project slice tests, ten executable fixture CLI-path tests, and 24 transaction tests under five shuffled seeds passed alongside CLI typecheck/build and validate:pr. Both CodeRabbit threads were resolved, the advisor reported zero blockers, and the one dormant-framework warning was explicitly dispositioned against this epic activation invariant. The merged PR carries v0.0.100.

3.4b — #7961: managed-image application and runtime-input cleanup

• Apply validated all-agent plans inside managed images.
• Forward or remove every runtime input according to its typed agent disposition.
• Sanitize child environments and preserve deterministic committed replay.

Current pushed head 13932b9b2486cd42b6fc47645e2f3936e5308d1d append-only merges exact current main f8fb820159c4843a19759efc9b0e28d4aa122440. Its fourteen-file review diff remains +2,308/-66 with stable patch ID b1697ff3d4ae9ec686a9a027991817427ab76434; local validate:pr passes. All exact-head ordinary CI, advisors, CodeRabbit, multiarch, and protected E2E checks pass. The exact head carries v0.0.100; no merge will occur tonight.

3.5 — #7969: shared-state transactions and Docker adapters

• Root-apply and Docker shared-state transactions.
• Atomic application, ownership, mode, commit, rollback, and exact replay tests.
• Preserve only the six allowlisted OpenClaw scheduler controls through clean root execution.
• Recovery behavior remains deferred to 3.12.

Current pushed head 51114100244689bb444d8b5a91c271c8bc1de1e3 is based on refreshed PR3.4b 13932b9b2486cd42b6fc47645e2f3936e5308d1d. Its ten-file review diff remains +3,251/-37 with stable patch ID 9a4ead01527f33245de5ed62412dca1395e33a13; local validate:pr passes. The exact head retains v0.0.100 while its exact ordinary, advisor, multiarch, CodeRabbit, and protected-E2E gates rerun. The dormant primitives deliberately have no production cutover caller.

3.5a — #7973: CodeRabbit managed-contract hardening

• Close every still-valid managed catalog, profile-builder, onboard-profile, application/coordinator, and image-runtime recommendation found by the retrospective audit of feat(onboard): add managed image selection contracts #7772, feat(onboard): add managed startup profile schema #7946, feat(onboard): construct managed startup profiles #7959, and feat(onboard): map and coordinate startup profiles #7960.
• Exercise the catalog streaming byte cap with a chunked response that omits Content-Length.
• Make messaging apply/clear mode explicit and provider-owned; normalize malformed dashboard URLs into managed-profile domain errors before mutation.
• Validate every extra-agent element, reject unsupported cross-agent fields, and strengthen decoded-profile and non-secret-bearing security assertions.
• Add missing image-runtime adversarial coverage for missing/duplicate/mismatched dashboard state, unknown agents, invalid modes, and pre-mutation ordering.
• Keep activation scaffolding, durable replay intent, coordinator identity guards, and the provider-test dependency-injection seam that later slices consume.
• Base directly on feat(onboard): add managed shared-state transactions #7969. No production activation.

Current pushed head 7d51947c870b8f1de2caa1d33e6e9d6e98d11346 is directly based on refreshed #7969 51114100244689bb444d8b5a91c271c8bc1de1e3. Its 18-file +595/-151 review patch and stable patch ID 86809993f79f41adbeda714a6b7177a5568116b5 are unchanged; all 37 exact-head ordinary, advisor, CodeRabbit, multiarch, and protected-E2E checks pass. The exact head carries v0.0.100, standing approval remains in force, and no merge will occur tonight.

3.5b — #7976: prior-stack CodeRabbit debt cleanup

• Close every still-valid unresolved recommendation from feat(onboard): apply startup profiles in managed images #7961 and re-audit feat(onboard): map and coordinate startup profiles #7960, feat(onboard): apply startup profiles in managed images #7961, feat(onboard): add managed shared-state transactions #7969, and fix(onboard): harden managed startup contracts #7973 for missed feedback.
• Make post-agent-install channel selection consume the shared enabled-channel contract so disabledChannels is honored.
• Normalize channel identifiers symmetrically across selection, render, build-step, and hook comparisons.
• Fail closed when a post-agent-install step names a hook that the selected agent cannot resolve.
• Guard the managed image-runtime CommonJS entry check under Vitest’s ESM runner.
• Make dashboard-port wrapper scenarios hermetic against ambient runtime variables.
• Add focused regressions and keep the slice inert; no production activation or runtime claim.

#7976 is append-only refreshed onto #7973 at exact signed/DCO head 771f48c47c0aaa1d51511d172fffc691e6c9ac76. The seven-file +462/-80 review slice retains stable patch ID 546bf224e8b4a6f95e91fadac43ae933c5ae9119; all 37 exact-head ordinary, advisor, CodeRabbit, multiarch, and protected-E2E checks pass. The exact head now carries v0.0.100; no merge will occur tonight.

3.5c — #7988: runtime-parameterized protected E2E foundation

• Separate a runtime-neutral scenario contract from a typed execution profile containing provider, platform, architecture, root mode, acceleration, capabilities, and runner requirements.
• Evolve the existing typed target registry and matrix compiler; do not create a second E2E framework or copy every scenario into Docker and Podman variants.
• Bind only capability-compatible scenario/profile pairs and fail matrix generation when a required support obligation has no executable case.
• Group isolated cases into bounded runtime/host shards while retaining unique sandbox, cleanup, result, and artifact identities.
• Add normalized cross-runtime parity assertions while keeping provider-specific transaction and receipt assertions in provider fixtures.
• Preserve current Docker behavior and prove the model is dormant with respect to production runtime selection.

#7988 is pushed append-only on exact #7976 at signed/DCO/Verified head 4788d287b8672be1b44999e78e094b2221303bd1. Its 17-file +2,555/-2 review slice has patch ID d4330cb898113aea3b782a640ef44b33d6f64827; all six CodeRabbit threads are resolved, the inert public non-registration boundary is semantically proven, and independent P0/P1/P2 plus documentation review passed. The exact head completed all 37 ordinary, advisor, multiarch, CodeRabbit, and protected-E2E checks without a current failure and now carries v0.0.100. No merge will occur tonight.

3.6 — #7990: driver-neutral lifecycle and migrated mutation parity

• Register one complete immutable provider bundle and normalized capability DTOs; do not introduce independently populated registries.
• Route registration, start, provider-owned post-start verification, stop, inference mutation authority, live destroy preparation/deletion, and owned-workload cleanup through that bundle.
• Prove OpenClaw, Hermes, and DCode parity with a socket-free MXC-style provider and no Podman/MXC switch in central migrated consumers.
• Keep production selection limited to Docker and Kubernetes.
• Keep direct connect, status, logs, durable recovery, and reconciliation explicitly assigned to later recovery slices before future-provider activation.
• No forward dependency on the transactional bootstrap adapter and no user-visible runtime activation.

#7990 is pushed append-only on exact #7988 at signed/DCO/Verified head 75730cf09bf1a1aa901cc3b275052250f8e7d85d. Its 45-file +4,073/-508 review diff is five files above the soft range because the complete lifecycle and destructive-cleanup authority boundary spans the migrated callers and their regression proof, while remaining inside the 2–5k line guide with stable patch ID eef1fddf8138d6e8a3ef4efb443aa2adc9f74fe3. All 320 changed-surface provider, lifecycle, snapshot, and image-cleanup tests and full local validate:pr pass without changing the test-size budget. All carried CodeRabbit actionables are resolved. The exact-head ordinary CI, both advisors, CodeRabbit, amd64/arm64 self-hosted qualification, and protected E2E are active. It receives v0.0.100 only after every exact-head gate is green, and no merge will occur tonight.

3.7 — #8001: atomic managed-workload rebuild parity

• Managed workload rebuild profile and rebuild phase decomposition.
• Preserve the old authoritative workload until replacement readiness.
• Tests for buildless rebuild planning and rollback.

#8001 is pushed from exact #7990 at signed/DCO/Verified head 827f545bf9f99bb69bb2e87ba85091558213b5fc. Its 23-file +3,828/-0 review diff has stable patch ID 187d076b3bf3838316d1877010eab033ebeb7f24; 107 focused tests, zero added test-file if statements, both builds/typechecks, exact-base hooks, and literal npm run validate:pr pass. The old workload remains authoritative through readiness, restore, and provider rebind; ambiguous publication preserves the staged runtime and emits exact recovery ownership rather than rolling it back; abort cleanup covers post-prepare read failures; all retained authority is agent/provider/platform bound and deeply immutable. The slice is inert with no production caller. PR3.8 owns shared backup-manifest integration, and durable recovery persistence remains mandatory before activation. Exact-head remote qualification is active; no merge occurs tonight and v0.0.100 is added only after every gate is green.

3.8 — snapshot, backup, and restore parity

• Snapshot dependencies and lifecycle state.
• Provider preflight and managed-profile restore behavior.
• Fail closed when runtime/acceleration state cannot be represented.

3.9 — clone, Hermes, and messaging parity

• Provider-aware clone flow.
• Hermes gateway/tool-broker credential and runtime rebinding.
• Messaging hydration, persistence, and clone rebind.

3.10a — transactional bootstrap protocol and image-owned execution

• Bootstrap envelope, exact sandbox identity, normalized inspection, runtime/spec DTOs, and completion receipts.
• Image-owned trampoline and exact captured-supervisor execution.
• Driver-neutral coordinator protocol with fake-provider tests.
• No Docker adapter, create integration, or production activation.

3.10b — Docker bootstrap adapter and exact cleanup

• Docker prepare-stopped-replacement, cutover, await, commit, rollback, and typed incomplete-create cleanup.
• Persist complete original and replacement runtime identities before the first destructive action.
• Exact ownership, shared-state integration, commit, rollback, and cleanup-required behavior.
• No unsafe mutable-name delete.

3.11 — provider/create integration

• Provider registry integration for create and GPU create flows.
• Startup-command, launch-plan, and transport integration.
• Docker GPU/local-inference proof remains required.

3.12a — durable transaction records and restart-safe persistence

• Versioned transaction records contain bootstrap identity, plan fingerprint, provider and sandbox identities, complete original and replacement IDs, phase, rollback target, and commit and cleanup receipts.
• Persist mutation authority before the first destructive action.
• Durable shared-state commit and receipt storage replace process-local Maps and Sets.
• Enumerate and reconstruct unfinished transactions after process restart.

3.12b — phase reconciliation and cross-surface recovery

• Resume or roll back from every recorded phase.
• Incomplete-create recovery, synchronous polling, and exact receipt reconstruction.
• Race handling, idempotent cleanup, and name-reuse failure injection.
• Hermes, destroy, snapshot, and shared-state restart recovery.

3.13 — image-owned all-agent artifacts and direct publication qualification

• Add the shared trampoline/startup assets to all three managed images.
• Validate layouts, entrypoints, config generation, exact image evidence, and sanitized failure diagnostics.
• Qualify direct immutable publication without yet wiring stock onboarding.

3.14a — managed-image publication workflow hardening

• Close every still-valid ci(images): publish validated managed OCI images #7756 CodeRabbit publication recommendation as one CI/publication subsystem.
• Extract the repeated all-agent cohort contract generation into one reviewed helper and replace text scraping with structured buildx imagetools inspect --format data.
• Make publication tests assert semantic commands and parsed workflow structure instead of complete ordered argv or source-text markers.
• Remove the redundant display-agent branch and bound/chunk full-history path expansion.
• Preserve atomic all-agent, linux/amd64, and linux/arm64 publication semantics. No runtime activation.

3.14b — protected all-agent build and multi-architecture qualification

• Protected buildless E2E for OpenClaw, Hermes, and DCode together.
• Qualify direct immutable all-agent cohort publication and exact image-owned entrypoint/layout contracts.
• Produce native linux/amd64 and linux/arm64 image evidence.
• Approve and run protected E2E immediately whenever the exact head/base pair is technically eligible.
• No production activation.

3.14c — protected GPU, local-inference, and recovery qualification

• GPU-backed qualification for the complete all-agent buildless path.
• Host-local Ollama, NIM, and vLLM through inference.local where required by the supported matrix.
• Restart, rebuild, snapshot/restore, clone, rollback, crash recovery, and exact cleanup evidence.
• Name-reuse and incomplete-create failure injection.
• Inject managed root-apply, supervisor, and commit failures, then compare reported onboarding status with independently probed gateway and sandbox state after recovery.
• Approve and run protected E2E immediately whenever the exact head/base pair is technically eligible.
• No production activation.

3.15 — production activation and support documentation

• Wire production onboarding to the validated buildless path.
• Remove automatic stock-Dockerfile fallback while preserving explicit --from.
• Activate only after 3.13 and 3.14a–3.14c exact-head evidence is green.
• Publish the essential architecture, quickstart, runtime-control, platform-support, troubleshooting, and security documentation.
• Split a documentation sweep into 3.16 if the review budget requires it; no public support claim precedes 3.15.

PR 4 series — pluggable native Podman

The preserved #7872 remote and local heads are source references. #7872 remains draft/source material until the PR 3 series reaches activation, then becomes only PR 4.1. The previously uncaptured original-worktree state (28 modified and 10 untracked paths) is preserved exactly by signed local checkpoint 4c8a877996778a0c9aa83d77dca16360f4c5841f at refs/backup/pr4-dirty-wip-exact-20260730; the checkpoint used a temporary index and did not alter that worktree's branch, index, or files.

Dependency chain:

4.1 → 4.2 → 4.3 → 4.4 → 4.5 → 4.6

The architecture review on #7872 is incorporated as design input. Its reviewed head is preserved source material, not the implementation boundary for the rebuilt series. The old monolith's CPU/amd64-first behavior may inform inert internal construction only; it cannot narrow the complete activation gate.

Preserved source extraction map:

Slice	Preserved source material
4.1	45bd5313 provider/plan, gateway, requirements, recovery, authority, doctor, lifecycle, and workload registries; 334c5322 managed-bootstrap provider code; reconstruct the pluggability contract test
4.2	45bd5313 Podman preflight, socket authority, recreate/spec, and lifecycle; use 405179c7 process-global engine selection only as negative design evidence
4.3	dcf6365a watcher, root-apply, and shared-state primitives; 2cee4ed1 create integration; 334c5322 managed-bootstrap adapter and trampoline integration
4.4	2cee4ed1 runtime/snapshot authority; c996fb56 persisted engine identity; replace 334c5322 closure-local provider state with durable records
4.5	405179c7 GPU attachment and host-local Ollama, NIM, and vLLM source material
4.6	45bd5313, 2cee4ed1, and 405179c7 installer, documentation, matrix, and E2E source material, rebuilt for the complete support matrix

4.1 — pluggable runtime registry and capability contract

• Register one complete RuntimeProviderBundle covering plan, capabilities, preflight and doctor, gateway, workload, lifecycle, mutation authority, bootstrap, snapshot, recovery, cleanup, and container engine.
• Reject missing surfaces, duplicate identities, and identity mismatches at registration.
• Opaque provider identity with no central Podman switch.
• Contract test proving a genuinely socket-free in-memory MXC-style provider can register and execute create, discover, inspect, replace, await, commit, rollback, and incomplete-create cleanup.
• No production Podman activation.

4.2 — Podman command adapter, preflight, and CPU lifecycle

• Introduce an explicitly injected, operation-scoped ContainerEngine; remove the process-global active-engine override and prevent Docker-named helpers from translating into Podman commands.
• Native Podman command adapter and exact command/result normalization.
• Installer/preflight detection and supported rootful/rootless CPU lifecycle.
• Exact image identity, create, inspect, start, stop, and provider-owned cleanup.

4.3 — Podman managed startup and bootstrap for all agents

• OpenClaw, Hermes, and DCode together.
• Consume the shared coordinator and image-owned trampoline; do not use privileged post-start podman exec --user 0:0.
• Stage the protected envelope into a stopped replacement and start only through the image-owned trampoline.
• Preserve bootstrap identity through root apply.
• Verify exact runtime/image/spec identity and an image-authored completion receipt.
• No name-only reconnect or fabricated completion state.

4.4 — persisted engine identity and lifecycle recovery

• Persist runtime engine/provider identity.
• Persist mutation authority before the first destructive action and test process restart at every transaction phase.
• Snapshot, rebuild, restore, and restart recovery.
• Durable journal reconstruction and receipt retirement.
• Exact-ID-only destructive mutation; unsafe name cleanup remains quiesced and retained.
• Preserve or fail closed on opaque GPU/CDI state rather than silently converting a clone to CPU.

4.5 — GPU and host-local inference

• Podman CDI/NVIDIA GPU attachment.
• Host-local Ollama, NIM, and vLLM through inference.local.
• Extend the same capability record used by preflight and lifecycle; do not add a parallel GPU or inference registry.
• GPU-backed local inference and GPU snapshot/restore behavior.
• Real agent inference turns for all three agents.

4.6 — native Podman activation, protected E2E, installer, and docs

• Docker unavailable in the native Podman lane.
• OpenClaw, Hermes, and DCode on supported amd64 and arm64 hosts.
• CPU, GPU, local inference, restart, rebuild, snapshot/restore, rollback, and cleanup evidence.
• Installer/preflight validation and evidence-backed support documentation.
• Add the first production Podman registration. One capability record drives preflight, runtime guards, documentation, and protected E2E selection.
• Remove unsupported-runtime rejection and advertise Podman only after the complete exact-head matrix is green.

Test and evidence gates

Product-flow E2E boundary

The stack distinguishes dormant domain construction from changes that can alter a real user journey:

• A slice is domain-only only when exact source-boundary tests prove that no production command, handler, lifecycle path, registry, or selectable provider imports or calls the new behavior. PR3.1 through PR3.5c remain in this category only while that dormancy proof holds.
• PR3.5c establishes the reusable parameterized E2E substrate before lifecycle integration begins.
• Beginning with PR3.6, a slice is presumed product-flow-affecting whenever it changes an existing Docker path or introduces a production caller, provider selection, external mutation, persisted identity, bootstrap application, lifecycle operation, recovery decision, or user-visible result. The PR may claim the narrower domain-only gate only when its exact diff proves those boundaries remain untouched.
• An activation slice makes a new path selectable or supportable. PR3.15 is the buildless activation boundary and PR4.6 is the native Podman activation boundary.

A product-flow-affecting exact head may not merge or ship on unit, contract, or model tests alone. It must pass protected E2E compiled from:

1. a runtime-neutral scenario: agent, user journey, required capabilities, and normalized assertions; and
2. a typed execution profile: provider, platform, architecture, root mode, acceleration, declared capabilities, and runner.

Generic scenario code receives the execution profile through fixtures and must not branch on Docker or Podman. Runtime-specific command execution, readiness, inspection, and cleanup stay in provider fixtures. The matrix compiler:

• binds only compatible scenario/profile pairs;
• treats missing required coverage as a compilation failure rather than a skip;
• records the exact runtime identity, engine version, architecture, managed-image digests, capability record, PR head, and base in evidence;
• groups compatible cases into bounded deterministic host/runtime shards instead of producing a full Cartesian set of parallel jobs; and
• preserves per-case isolation, cleanup, artifacts, and stable IDs inside a shared shard.

The minimum protected gate for a product-flow-affecting slice is:

• one current-production baseline profile for every supported runtime, including a Docker regression path;
• every shipped agent when the changed flow is shared by OpenClaw, Hermes, and DCode;
• every execution profile whose capability implementation changed, such as GPU, snapshot/restore, rootless operation, or host-local inference;
• normalized FSM transition, terminal-state, desired-state, and user-visible-result parity across providers for the same scenario; and
• provider-specific transaction, immutable-identity, rollback, cleanup, and receipt assertions below that common FSM contract.

Before Podman activation, an executable candidate Podman path must join the protected matrix for the PR4 slice that introduces or changes it even though it remains absent from the production selectable registry. After PR4.6, every shared product-flow change must pass both Docker and Podman baseline profiles before it can ship. Provider-specific behavior such as Podman CDI/rootless/SELinux or Docker daemon integration remains a targeted provider scenario and is not multiplied across unrelated runtimes.

Domain-only slices still run all existing repository gates plus focused contract, adversarial, serialization, and dormancy tests; they do not require a fabricated live runtime path. Activation exact heads additionally run the complete declared support matrix below. Nightly or rotating pairwise coverage may broaden non-blocking combinations, but it cannot substitute for the exact-head activation matrix.

Every slice

• exact-base and exact-head local validation;
• typecheck and affected unit/integration tests;
• source-shape and test-size guardrails;
• relevant documentation validation;
• no production activation import for an inert slice; and
• diff audit against the slice's stated subsystem and review budget.

Buildless activation

• all three agents;
• linux/amd64 and linux/arm64;
• immutable candidate image digests from the exact stack;
• real onboarding with no stock Dockerfile build;
• nonroot agent identity;
• restart, rebuild, snapshot/restore, clone, backup, recovery, and rollback;
• exact bootstrap receipt and shared-state commit;
• GPU/local-inference proof where required; and
• existing Docker, macOS, WSL, gateway-isolation, messaging, and security regressions remain green.

Podman activation

• native Podman with Docker unavailable;
• all three agents;
• supported amd64 and arm64 environments;
• rootful/rootless and user-namespace behavior where supported;
• networking, volumes, SELinux labeling, and exact cleanup;
• NVIDIA CDI GPU attachment;
• host-local Ollama, NIM, and vLLM;
• real GPU-backed inference turns;
• persisted identity, restart, rebuild, snapshot/restore, crash recovery, rollback, and name-reuse failure injection; and
• installer/preflight and documentation evidence.

Protected E2E evidence must bind the exact PR head and current base. Stale stacked-base evidence is not sufficient. Protected E2E is approved and dispatched immediately when technically eligible; no additional authorization wait is required.

Review, labels, and release cadence

• Push and open each completed slice only after its exact local review boundary and tests pass; do not use placeholder PRs or republish a monolithic head.
• Preserve strict sequential bases through the full PR3 and PR4 chain so no predecessor merge strands an unrebased descendant.
• Do not merge any PR without explicit maintainer instruction; no admin or ordinary merge occurs tonight.
• PRs refactor(onboard): separate compute driver from gateway launcher #7747 and ci(images): publish validated managed OCI images #7756 are merged and carry the live v0.0.99 release label.
• PR feat(onboard): add managed startup profile schema #7946 is merged as 37f6a8a650ff500f7054bae8d36b00e7b42edd41 and carries v0.0.100.
• PR feat(onboard): map and coordinate startup profiles #7960 is merged as 64d68281064b760232694a3150f13d060a28936f and carries v0.0.100.
• Refreshed heads feat(onboard): apply startup profiles in managed images #7961 13932b9b, feat(onboard): add managed shared-state transactions #7969 51114100, fix(onboard): harden managed startup contracts #7973 7d51947c, fix(runtime): close prior review debt #7976 771f48c4, test(e2e): add cross-runtime execution foundation #7988 4788d287, and refactor(runtime): add provider lifecycle and mutation parity #7990 75730cf0 carry the live v0.0.100 target. feat(onboard): apply startup profiles in managed images #7961/feat(onboard): add managed shared-state transactions #7969/fix(onboard): harden managed startup contracts #7973/fix(runtime): close prior review debt #7976/test(e2e): add cross-runtime execution foundation #7988/refactor(runtime): add provider lifecycle and mutation parity #7990 are fully green on those exact heads, including protected E2E.
• Every further slice targets v0.0.100 only after its exact head is conflict-free and fully green; base/head refreshes rerun the exact protected evidence before merge readiness.
• There is no cap on the number of simultaneously open clean stack PRs. Open and push every completed, locally validated slice as soon as it has the correct predecessor base; do not hold reviewable work merely to limit open-PR count.
• Later slices are distributed across subsequent live release buckets according to the verified live bucket; open-PR count does not determine release-bucket placement.
• Verify the live tag/label bucket before assigning any downstream release.
• Apply needs: review only when the PR has no standing approval. An existing approval remains standing across current-main or stacked-base refreshes.
• After a predecessor changes or merges, refresh the next PR onto the live base and rerun exact-head CI, protected E2E, advisors, CodeRabbit, and exact-head receipts without discarding a standing approval.
• Protected E2E is run or monitored immediately whenever technically eligible; no additional authorization pause is permitted.
• Do not mark buildless or Podman supported before the corresponding final activation gate is green.

Scope boundaries

In scope:

• buildless managed onboarding for all shipped agents;
• complete immutable images and atomic all-agent publication;
• driver-neutral lifecycle and transactional bootstrap;
• Docker and native Podman providers;
• amd64 and arm64;
• snapshot, clone, rebuild, backup, restore, durable recovery, and exact cleanup;
• Podman GPU access and host-local Ollama, NIM, and vLLM;
• a socket-free MXC-style contract fixture; and
• evidence-backed installer and documentation changes.

Out of scope:

• arbitrary privileged commands or secret injection through startup profiles;
• OpenClaw-only or Docker-compatibility-only Podman support;
• production MXC enablement;
• Kubernetes behavior changes beyond regression preservation;
• any mutation in NVIDIA/OpenShell without separate explicit approval; and
• claiming support for an untested runtime, host, architecture, GPU, or inference combination.

Definition of done

The epic closes only when the incremental stack has landed in order; Docker and native Podman launch OpenClaw, Hermes, and DCode through the same driver-neutral contracts; stock managed onboarding performs no Dockerfile build; Podman passes the complete multi-architecture GPU and Ollama/NIM/vLLM matrix; lifecycle and crash recovery are durable; unsafe name-only deletion is impossible; protected exact-head E2E is green; and installer/support documentation matches the shipped evidence.