refactor(sandbox): remove Shields from core

.agents/skills/_shared/controlled-words.md

@@ -163,7 +163,6 @@ other literal identifiers.
 | `OpenShell gateway` | Technical noun | The host service that owns credentials, coordinates sandbox lifecycle, and proxies approved traffic. | agent gateway, gateway when the type is unclear |
 | `port forward` | Technical noun or verb | A connection that maps a host port to a service inside a sandbox, or the act of creating that connection. | tunnel when no general tunnel exists |
 | `provider profile` | Technical noun | An OpenShell declaration of one service provider's credentials, endpoints, allowed binaries, and access policy. | inference profile, provider settings |
-| `runtime provider state mutation` | Technical noun | A bounded, provider-mediated protection transition or restore operation whose selected state, projection digest, active fence, and recovery contract are explicit. | state mutation without the runtime provider modifier, lifecycle mutation |
 | `runtime setting` | Technical noun | A value applied when a process or sandbox runs. | build-time setting, runtime config |
 | `sandbox image` | Technical noun | The built image used to create an agent sandbox. | base image, container |
 | `sandbox registry` | Technical noun | NemoClaw state that records managed sandboxes and their selected agent types. | image registry, container registry |
@@ -229,7 +228,6 @@ other literal identifiers.
 | `filesystem policy` | Technical noun | Rules that control sandbox access to filesystem paths. | file permissions when the complete policy is intended |
 | `least privilege` | Technical noun | Grant only the access required for the stated operation. | minimal permissions, locked down |
 | `link-local address` | Technical noun | An IP address valid only on the directly connected network segment. | local address, private IP address |
-| `lockdown` | Technical noun | The protected filesystem, process, and restrictive network-policy posture restored by Shields up. | hardening, shields when the resulting posture is intended |
 | `loopback address` | Technical noun | An IP address that refers to the same network host. | localhost when an address is intended, local address |
 | `network namespace` | Technical noun | The operating-system isolation boundary for network devices, routes, and sockets. | network sandbox, container network |
 | `policy` | Technical noun | Enforceable rules that allow, deny, or constrain an operation. Name the policy type at first use. | configuration, settings |
@@ -245,9 +243,6 @@ other literal identifiers.
 | `sandbox boundary` | Technical noun | The isolation boundary between sandbox processes and host or external resources. | container boundary, security boundary without naming the sandbox |
 | `seccomp` | Technical noun or adjective | Linux system-call filtering enforced for sandbox processes. | syscall sandbox, seccomp-BPF in general prose |
 | `secret` | Technical noun or adjective | Sensitive authentication or cryptographic material that must not be exposed. | credential when the value is not used for authentication |
-| `Shields down` | Product state or command name | The temporary state that relaxes selected NemoClaw lockdown controls. | permissive state, unlocked mode |
-| `shields-down window` | Technical noun | The bounded time during which Shields down remains active before automatic restoration. | maintenance window, unlock period |
-| `Shields up` | Product state or command name | The state that enforces NemoClaw lockdown controls. | secure mode, locked state |
 | `trust boundary` | Technical noun | A boundary across which data or control changes its trust assumptions. | security boundary without naming the trust change |
 | `trusted` | Adjective | Explicitly accepted as an input, identity, or component within a named trust boundary. | safe, secure |
 | `untrusted` | Adjective | Not accepted as authoritative or safe without validation at a named trust boundary. | unsafe, external |

.agents/skills/nemoclaw-maintainer-cross-issue-sweep/checks/fingerprint-extraction.md

@@ -65,8 +65,8 @@ Fingerprint JSON shape:
 ```json
 {
   "pr": 2851,
-  "files": ["src/lib/shields.ts", "Dockerfile.base"],
-  "symbols": ["normalize_mutable_config_perms", "applyStateDirLockMode"],
+  "files": ["src/lib/sandbox/mutable-config-perms.ts", "Dockerfile.base"],
+  "symbols": ["normalize_mutable_config_perms", "repairMutableConfigPerms"],
   "error_strings": ["EACCES on .openclaw"],
   "primary_issue": 2681
 }

.agents/skills/nemoclaw-maintainer-cross-issue-sweep/relationship-rules.md

@@ -18,7 +18,7 @@ The PR resolves the issue or enables follow-up work on the changed code.
 
 ### Example A — incidental closure (direct evidence)
 
-PR description: "fix EACCES when shields-down user writes config"
+PR description: "fix EACCES when a sandbox user writes config"
 PR diff: adds `chmod g+w` to `.openclaw` directory at startup
 Candidate issue #2810: "Telegram preset writes fail intermittently after sandbox rebuild"
 Issue body cites: "EPERM on `.openclaw/credentials/telegram.json`"

.agents/skills/nemoclaw-maintainer-runtime-provider/references/activation-and-qualification.md

@@ -39,17 +39,16 @@ sequence. Re-read the exported constants before authoring the declaration.
 
 ## Complete Activated Bundle
 
-Activation requires all 14 surfaces to report `supported: true`. It also requires:
+Activation requires all 13 surfaces to report `supported: true`. It also requires:
 
 - host-local inference, direct lifecycle, and workload cleanup capabilities;
 - exact-digest managed images for Linux AMD64 and ARM64;
 - `require-managed` selection and no legacy Dockerfile builds;
 - accepted current managed-image startup and capability contract versions;
 - Ollama, NVIDIA NIM, and vLLM services in canonical order;
 - the complete canonical mutation-operation sequence;
-- state mutation contract version 2;
 - backup, restore, and managed-profile restore;
-- operation-scoped identities for all six engine scopes; and
+- operation-scoped identities for all five engine scopes; and
 - release-installer qualification with Docker unavailable.
 
 If a provider cannot truthfully meet this profile, keep it as a candidate. When a real provider

.agents/skills/nemoclaw-maintainer-runtime-provider/references/api-contract.md

@@ -9,7 +9,7 @@ source of truth.
 
 ## Registration Unit
 
-`RuntimeProviderBundle` is the sole registration unit. It contains one identity and these 14
+`RuntimeProviderBundle` is the sole registration unit. It contains one identity and these 13
 surfaces:
 
 | Surface | Candidate registration contract |
@@ -22,7 +22,6 @@ surfaces:
 | `hostLocalInference` | Optional for a candidate. Lists services and creates a provider-owned operation. |
 | `lifecycle` | Optional for a candidate. Implements start, started-state verification, stop hooks, and channel-stop transport. |
 | `mutationAuthority` | Optional for a candidate. Lists the state-changing operations that the provider authorizes. |
-| `stateMutation` | Optional for a candidate. Implements the versioned fenced state-mutation transaction. |
 | `bootstrap` | Optional for a candidate. Binds provider-owned create, readiness, and create-recovery operations for its workload type. |
 | `snapshot` | Optional for a candidate. Implements versioned preflight, capture, restore validation, and restore. |
 | `recovery` | Optional for a candidate. Reconciles one persisted sandbox with its runtime. |
@@ -95,24 +94,11 @@ evidence must use the handle for provider-owned, idempotent recovery. Creation e
 not match the plan cannot authorize plan-only recovery or removal and must report that the resource
 may remain. Separated measurement and creation do not satisfy this contract.
 
-### Mutation authority and state mutation
+### Mutation authority
 
 Mutation authority lists only operations that the provider implements. The current operation set
 is defined by `RuntimeProviderMutationOperation`.
 
-State mutation contract version 2 is a bounded transaction:
-
-1. `acquire()` validates a frozen, digested plan and returns a fence.
-2. `assertFenced()` revalidates the active fence before publication.
-3. `publish()` records publication under the fence.
-4. `rollback()` restores the declared rollback posture after failure.
-5. `activate()` returns fresh service evidence for the lifecycle generation.
-6. `release()` retires the fence after activation and ledger verification.
-7. `recover()` returns a durable active fence after controller restart, or `null`.
-
-The serialized plan is bounded JSON for a fixed provider helper. Do not accept arbitrary commands,
-scripts, or callbacks through the state-mutation surface.
-
 ### Snapshot, recovery, and cleanup
 
 Snapshot contract version 1 binds preflight, runtime receipt, lifecycle state, lifecycle
@@ -140,7 +126,6 @@ A supported `containerEngine` surface declares one identity for each implemented
 - `gateway-inspection`
 - `host-local-inference`
 - `sandbox-lifecycle`
-- `state-mutation`
 - `workload-cleanup`
 
 Each identity contains an operation, engine ID, and display name. Provider-specific command

.agents/skills/nemoclaw-maintainer-runtime-provider/references/implementation-and-review.md

@@ -34,7 +34,7 @@ portable profile are different product paths.
 5. Implement immutable workload receipt acceptance.
 6. Implement bootstrap, start, started-state verification, stop, and privileged control.
 7. Implement inference service authority and credential redaction where applicable.
-8. Implement fenced state mutation, snapshot, restore, and restart recovery.
+8. Implement snapshot, restore, and restart recovery.
 9. Implement side-effect-free cleanup planning, authority revalidation, removal, and absence
    confirmation.
 10. Persist the provider identity and prove each later operation resolves the same bundle.
@@ -73,7 +73,6 @@ Test at least these provider-bound failures when applicable:
 - endpoint or socket authority drift between operation scopes;
 - runtime handle, lifecycle generation, or ownership mismatch;
 - timeout, nonzero status, partial publication, and controller restart;
-- state-mutation rollback and active-fence recovery;
 - snapshot source and target provider mismatch;
 - cleanup with missing, shared, ambiguous, or changed ownership;
 - credential redaction from logs, receipts, and artifacts; and
@@ -94,7 +93,7 @@ A provider PR is not approval-ready until the review can answer each question:
 - Do unsupported candidate surfaces state reasons?
 - Does activation enter through the qualification-backed composition seam?
 - Does protected evidence bind the candidate, base, workflow, job, attempt, and artifact?
-- Do state mutation, recovery, and cleanup fail closed on authority drift?
+- Do recovery and cleanup fail closed on authority drift?
 - Do focused checks pass for the commit under review?
 - Does the complete supported E2E matrix pass for that same commit?
 - Are ownership, compatibility, security, and upgrade obligations documented?

.coderabbit.yaml

@@ -144,7 +144,7 @@ reviews:
           state/backup invariants, and cover failure, recovery, rebuild, and resume
           behavior without bypassing the public action boundary.
 
-    - path: "src/lib/{security,credentials,shields}/**"
+    - path: "src/lib/{security,credentials}/**"
       instructions: &security-boundary |
         Treat this as a security boundary.
 

.github/workflows/e2e.yaml

@@ -335,7 +335,7 @@ jobs:
             fi
             larger_runner="${LARGER_RUNNER_LABEL}"
           fi
-          runner_routing="$(jq -cn --arg standard "ubuntu-latest" --arg larger "${larger_runner}" '{"channels-stop-start-hermes":$larger,"common-egress-agent":$larger,"hermes-discord":$larger,"hermes-e2e":$larger,"hermes-inference-switch":$larger,"hermes-shields-config":$larger,"mcp-bridge-deepagents":$larger,"mcp-bridge-hermes":$larger,"mcp-bridge-openclaw":$standard,"rebuild-hermes":$larger,"rebuild-hermes-stale-base":$larger,"security-posture-hermes":$larger}')"
+          runner_routing="$(jq -cn --arg standard "ubuntu-latest" --arg larger "${larger_runner}" '{"channels-stop-start-hermes":$larger,"common-egress-agent":$larger,"hermes-discord":$larger,"hermes-e2e":$larger,"hermes-inference-switch":$larger,"mcp-bridge-deepagents":$larger,"mcp-bridge-hermes":$larger,"mcp-bridge-openclaw":$standard,"rebuild-hermes":$larger,"rebuild-hermes-stale-base":$larger,"security-posture-hermes":$larger}')"
           printf 'runner_routing=%s\n' "${runner_routing}" >> "${GITHUB_OUTPUT}"
 
       - id: candidate_authorization

.github/workflows/podman-cpu-proof.yaml

@@ -25,8 +25,6 @@ on:
       - "src/commands/internal/uninstall/run-plan.ts"
       - "src/lib/state/portable-uninstall-retirement.ts"
       - "src/lib/state/registry/lock.ts"
-      - "src/lib/onboard/runtime-provider/container-state-mutation.ts"
-      - "src/lib/onboard/runtime-provider/docker-state-mutation.ts"
       - "src/lib/onboard/experimental/portable-host-preparation*.ts"
       - "src/lib/onboard/experimental/portable-profile.ts"
       - "src/lib/onboard/runtime-provider/podman*.ts"

.github/workflows/sandbox-images-and-e2e.yaml

@@ -417,60 +417,6 @@ jobs:
         if: always()
         shell: bash
         run: bash .github/scripts/docker-auth-cleanup.sh
-  state-dir-guard-metadata:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    needs: [build-sandbox-images, build-hermes-sandbox-image]
-    env:
-      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/state-dir-guard-metadata
-      E2E_TARGET_ID: state-dir-guard-metadata
-      NEMOCLAW_RUN_LIVE_E2E: "1"
-      NEMOCLAW_OPENCLAW_TEST_IMAGE: nemoclaw-production
-      NEMOCLAW_HERMES_TEST_IMAGE: nemoclaw-hermes-production
-    steps:
-      - *checkout
-
-      - *setup-node
-
-      - *install-root-dependencies
-
-      - name: Download OpenClaw production image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: isolation-image
-          path: /tmp
-
-      - name: Download Hermes production image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: hermes-isolation-image
-          path: /tmp
-
-      - name: Load production images
-        run: |
-          set -euo pipefail
-          gunzip -c /tmp/isolation-image.tar.gz | docker load
-          gunzip -c /tmp/hermes-isolation-image.tar.gz | docker load
-          docker image inspect nemoclaw-production >/dev/null
-          docker image inspect nemoclaw-hermes-production >/dev/null
-
-      - name: Install filesystem metadata tools
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends acl attr
-          command -v setfacl getfacl setfattr getfattr >/dev/null
-
-      - name: Run installed state-dir guard metadata test
-        timeout-minutes: 15
-        run: |
-          npx vitest run --project e2e-live \
-            test/e2e/live/state-dir-guard-metadata.test.ts \
-            --silent=false --reporter=default
-
-      - name: Upload state-dir guard metadata artifacts
-        if: always()
-        uses: ./.github/actions/upload-e2e-artifacts
   build-sandbox-images-arm64:
     if: inputs.run_arm64
     runs-on: ubuntu-24.04-arm

.pre-commit-config.yaml

@@ -269,7 +269,10 @@ repos:
         pass_filenames: false
         files: ^(agents/hermes|bin|scripts|src|test|tools|nemoclaw-blueprint/scripts)/.*\.(ts|tsx|mts|cts|json)$|^\.agents/skills/nemoclaw-maintainer-day/scripts/(check-gates|shared)\.ts$|^nemoclaw/src/(lib/subprocess-env|blueprint/private-networks)\.ts$|^(package(-lock)?\.json|tsconfig\.cli\.json|vitest\.config\.ts)$
         stages: [pre-push]
-        priority: 10
+        # build:cli now removes all stale dist output. When package or script
+        # inputs select both hooks, run this reader after tsc-js finishes its
+        # clean rebuild instead of racing the deleted output tree.
+        priority: 20
 
   # ── post-merge / post-checkout: warn about stale compiled dist/ ───────────
   # See #1958 — dist/ is gitignored, so git pull / checkout can leave stale