feat(runtime): add durable host-local inference lifecycle

[ericksoa]

Summary

This B4-E1 slice gives dormant provider-owned host-local inference durable lifecycle authority for OpenClaw, Hermes, and LangChain Deep Agents Code. It persists canonical ownership through onboarding and registry state, fences snapshot and restore mutations, and retires only the exact managed runtime after durable deletion.

Podman remains absent from the production provider registry. No supported workflow is activated, and the hidden, default-off --temp-managed-runtime experiment gate remains intentionally undocumented.

Changes

• Persist and validate the complete secret-free host-local inference receipt on every registry read and write.
• Reserve proved inference-route ownership and carry it through all-agent sandbox registration and same-name recreation.
• Add provider-neutral lifecycle contracts that re-prove exact runtime authority before backup, restore, rebuild, and deletion.
• Fence snapshot publication and restore mutations against receipt drift and stale lifecycle generations.
• Make managed cleanup idempotent across retries, preserve durable ownership after partial failure, and delete only after exact provider-native authority is reconfirmed.
• Keep host-owned inference processes external and reject unsupported MXC lifecycle mutation explicitly without central Podman switches.
• Incorporate the durable-lifecycle source material formerly staged in feat(runtime): complete host-local inference lifecycle #8076 while preserving one review thesis in this PR.

Quality Gates

• Tests added or updated for changed behavior
• All-agent and provider-neutral contract coverage
• Hidden/default-off activation boundary preserved
• Documentation writer review complete
• Exact-head advisor, CI, CodeRabbit, and protected E2E qualification complete

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: This patch extends dormant provider-neutral host-local inference authority into durable registry persistence, snapshot backup and restore fencing, and post-deletion exact managed-runtime retirement. Podman remains absent from the production provider registry, no supported workflow is activated, and the existing hidden, default-off --temp-managed-runtime flag remains intentionally undocumented.
• Agent: Codex Desktop

Verification

• Signed commits and DCO
• 449 changed-file tests passed, plus the focused destroy lifecycle rerun after the exact result-contract fix
• Plugin typecheck, CLI build, CLI typecheck, and focused host-local authority tests passed
• Repository checks, source architecture, test conditionals, source-shape, test-size, diff, formatting, lint, secret scan, and commitlint passed
• Normal commit hooks passed without bypass
• Exact-head GitHub qualification is pending

Exact head: 4fa744cffdbab8b3691df3a770dff5d09fd07333. Stable base-relative patch ID: 3d43b8f38566a87126fdf265b748e561c37ab47b.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[cv]

Clear stale host-local ownership when inference changes to a remote provider. The current route reservation omits hostLocalInferenceReceipt, while the registry preserves the existing field; later destroy, snapshot, or restore can then act on a runtime the sandbox no longer selects. Add a regression that switches from host-local to remote inference and proves the persisted receipt is removed. The stacked branch also has a failing E2E / PR Gate and cannot be approved until its parent and required checks pass.

[prekshivyas]

Addressed the stale host-local inference ownership review at b3e3dcf.

The route reservation now always supplies hostLocalInferenceReceipt. Remote routes persist null, so a local-to-remote switch cannot leave ownership that later lifecycle operations would act on. Added a persisted registry reload regression and an integration assertion for the routed remote path.

Validation:

• registry and route-containment suites: 16/16 passed
• selected host-local integration suites: 50/51 passed; the sole failure is the unchanged local Homebrew formula trust fixture, while the changed remote-route test passes in isolation
• npm run build:cli: passed
• npm run typecheck:cli: passed
• repository commit hooks and pre-push gates: passed

The latest PR commit clears stale host-local ownership on remote-provider transition and adds route-persistence and setup regressions.

[cv]

src/lib/actions/sandbox/destroy-execution.ts:320-326 still permits forcedLocalCleanup when the sandbox has a durable host-local inference receipt. Lines 347-350 then skip runtime retirement, and destroy.ts removes the registry entry. If the gateway is unreachable, destroy --force can therefore leave a managed NIM or vLLM container running while deleting the only exact-runtime ownership record. Preserve the registry entry when host-local ownership exists unless remote deletion is confirmed, or add an authenticated reconciliation path that retains equivalent durable authority. Add a regression that combines gateway-unreachable --force with a managed host-local receipt and proves that ownership is not discarded. Existing host-local destroy tests cover confirmed deletion, shared ownership, retirement failure, and retry, but not this forced-cleanup path.

[prekshivyas]

Addressed the gateway-unreachable --force ownership finding in 264d4279b.

• Forced local cleanup is now disallowed whenever an exact host-local inference authority is present, just as it is for retained MCP ownership or an unconfirmed shields relock.
• The failed destroy returns before local cleanup/registry removal and reports that host-local ownership was preserved, with recovery guidance that explicitly says --force cannot discard it.
• Added a combined managed host-local receipt + gateway-unreachable + --force regression. It proves the operation fails closed, local cleanup does not run, and exact runtime retirement is not attempted until deletion can be confirmed.

Validation:

• focused destroy suites: 30 passed
• CLI build
• CLI typecheck
• targeted pre-commit hooks
• changed-range pre-push hooks

@cv please re-review the exact head.

The latest PR commit preserves durable host-local inference ownership when forced local cleanup cannot confirm gateway deletion. The submitted blocker no longer applies.

[ericksoa]

Superseded by #9123. This PR branch contains stale, unrelated ancestry: 385 commits across 154 files. It will not be merged. B4-E1 continues in #9123 with two commits and 34 files.