feat(onboard): gate buildless managed workloads

ci/source-shape-test-budget.json

@@ -558,12 +558,12 @@
     },
     {
       "file": "test/runtime-provider-source-shape.test.ts",
-      "test": "keeps production activation paths disconnected from driver bootstrap adapters",
+      "test": "keeps central activation paths disconnected from driver bootstrap adapters",
       "category": "security"
     },
     {
       "file": "test/runtime-provider-source-shape.test.ts",
-      "test": "keeps registered providers bootstrap-unsupported",
+      "test": "composes Docker bootstrap locally while keeping Kubernetes unsupported",
       "category": "security"
     },
     {

docs/get-started/quickstart-hermes.mdx

@@ -166,15 +166,16 @@ Use these details when your first-run path needs more control.
     DGX Spark, qualifying DGX Station hosts, and Windows Subsystem for Linux (WSL) can offer the recommended express install mode after the third-party software notice.
     Press Enter at the express install prompt to apply preset settings, switch the remaining onboarding to non-interactive mode, and select the managed local inference path for that platform.
     Enter `n` to continue with interactive onboarding when you want to select the agent or other settings yourself.
-    The first Hermes build can take several minutes because NemoClaw builds the Hermes sandbox base image when it is not already cached.
+    The first Hermes startup can take several minutes while Docker pulls the exact Hermes image digest for the installed NemoClaw release.
+    Stock onboarding does not stage or build a Hermes Dockerfile.
     Refer to [Set Up vLLM](../inference/local-inference/set-up-vllm) for managed model profiles and headless setup.
     Refer to [Set Up vLLM on Two DGX Stations](../inference/local-inference/set-up-vllm-on-two-dgx-stations) for the Deferred paired workflow.
     Refer to [Platform Support](../reference/platform-support) for current validation status.
   </Accordion>
 
   <Accordion title="Onboarding and Integration Details">
     The wizard asks for an inference provider, model, required credential, and sandbox name before it prints the review summary.
-    After confirmation, NemoClaw registers inference, prompts for optional Tavily Search and supported messaging channels, builds and starts the sandbox, sets up Hermes, and applies the selected network policy tier and presets.
+    After confirmation, NemoClaw registers inference, prompts for optional Tavily Search and supported messaging channels, creates and starts the sandbox, sets up Hermes, and applies the selected network policy tier and presets.
     At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
 
     The default Hermes sandbox name is `hermes`.
@@ -197,7 +198,8 @@ Use these details when your first-run path needs more control.
     NemoClaw removes `nous-web` from the effective managed-tool selection while preserving selected Nous image, audio, browser, and code tools.
     API-key mode is inference-only and does not enable managed tool gateways.
 
-    After you select a provider and model, review the summary and confirm the build.
+    After you select a provider and model, review the summary and confirm sandbox creation.
+    Stock onboarding selects the exact Hermes image digest from the installed CLI release's complete all-agent catalog and applies Hermes configuration through the transactional startup profile.
     NemoClaw writes Hermes configuration into `/sandbox/.hermes`, routes model traffic through `inference.local`, and starts the Hermes gateway inside the sandbox.
     The Hermes image includes runtime dependencies for supported NemoClaw messaging integrations, the API service, and its health endpoint.
     The base image does not include unsupported Hermes integrations.
@@ -225,7 +227,7 @@ Use these details when your first-run path needs more control.
     Use the provider variables from [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) when you choose another provider.
     Set `NEMOCLAW_WEB_SEARCH_PROVIDER=none` to disable web search explicitly.
     When the selector is unset, Hermes enables Tavily automatically when `TAVILY_API_KEY` is available and ignores `BRAVE_API_KEY`.
-    Changing or disabling Tavily requires sandbox recreation because the backend, credential attachment, and policy selection are build-time inputs.
+    Changing or disabling Tavily requires sandbox recreation because the backend, credential attachment, and policy selection are managed startup inputs.
     Rerun onboarding with the new selection and accept recreation, or pass `--recreate-sandbox`.
   </Accordion>
 

docs/get-started/quickstart-langchain-deepagents-code.mdx

@@ -127,12 +127,13 @@ The default Deep Agents sandbox name is `deepagents-code`.
 Use a distinct name, such as `my-deepagents`, when you run Deep Agents, Hermes, and OpenClaw sandboxes side by side.
 Refer to [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) for provider-specific prompts.
 
-The image installs hash-locked Deep Agents Code `0.1.34` with NVIDIA provider support.
+The release managed image installs hash-locked Deep Agents Code `0.1.34` with NVIDIA provider support.
+Stock onboarding selects the exact Deep Agents Code image digest from the installed CLI release's complete all-agent catalog and creates the sandbox without staging or building a Dockerfile.
 After the terminal smoke checks, onboarding runs `dcode --version` and compares the result with the version required by the agent manifest.
 Fresh and resumed onboarding exit nonzero instead of reporting the runtime ready when the installed version is too old, uses an incompatible version scheme, or cannot be verified.
 If the version check fails, review the reported version error and run `nemo-deepagents <sandbox-name> rebuild` before resuming onboarding.
 NemoClaw writes `/sandbox/.deepagents/config.toml` with an OpenAI-compatible provider pointed at `https://inference.local/v1`, uses a scoped placeholder API key for that managed route, and sets `use_responses_api = false` for Chat Completions compatibility.
-When onboarding records a reasoning effort on a `compatible-endpoint` route that uses `openai-completions`, the managed image bakes that value into a root-owned file and Deep Agents Code model requests carry it as an `extra_body.reasoning_effort` request parameter.
+When onboarding records a reasoning effort on a `compatible-endpoint` route that uses `openai-completions`, the transactional startup profile writes that value to a root-owned file and Deep Agents Code model requests carry it as an `extra_body.reasoning_effort` request parameter.
 Leave `NEMOCLAW_REASONING_EFFORT` unset to keep the endpoint's own default.
 Deep Agents Code has no runtime `inference set` path, so re-onboard the sandbox with `nemo-deepagents onboard --fresh --name <sandbox-name> --recreate-sandbox` to change the recorded effort.
 When you use NVIDIA Endpoints without selecting another model, new Deep Agents Code sandboxes default to `nvidia/nemotron-3-ultra-550b-a55b`.
@@ -175,9 +176,9 @@ The managed `.deepagents/.nemoclaw-mcp.json` projection is also excluded because
 Service credentials remain in OpenShell provider state.
 It also does not preserve `hooks.json`; executable Deep Agents Code hooks are disabled in the managed harness.
 If `.deepagents/.state/auth.json` contains upstream credentials, or `.deepagents/.state/chatgpt-auth.json` exists, the managed Deep Agents Code launch paths refuse to start until that credential state is removed.
-Before a managed Deep Agents Code rebuild changes the sandbox, NemoClaw selects its recorded OpenShell gateway, tests the recorded inference route through `https://inference.local`, and prepares the replacement from the recorded provider, model, policy, and build inputs with a pinned base and fingerprinted context.
+Before a managed Deep Agents Code rebuild changes the sandbox, NemoClaw selects its recorded OpenShell gateway, tests the recorded inference route through `https://inference.local`, verifies the provider-bound workload, and resolves the exact current-release image through the complete all-agent catalog.
 Initial failures stop before backup.
-After backup, NemoClaw rechecks the target, route, and retained build inputs before changing MCP state, then checks again after MCP preparation and before stopping inference or deleting the old sandbox.
+After backup, NemoClaw rechecks the target, route, managed image, and startup profile before changing MCP state, then checks again after MCP preparation and before stopping inference or deleting the old sandbox.
 If the final check fails, NemoClaw restores the previous MCP state and keeps the existing sandbox intact.
 Rebuild also preserves the standalone Deep Agents Code `tavily` preset, the recorded observability choice unless explicitly overridden, and recorded custom policies from their exact stored content.
 

docs/get-started/quickstart.mdx

@@ -140,7 +140,7 @@ Use these details when your first-run path needs more control.
     Export the relevant API key before starting the installer when you do not want the wizard to prompt for it.
     Refer to [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) for provider requirements, model choices, and local-server setup.
 
-    Web search and messaging are optional build-time choices.
+    Web search and messaging are optional managed startup choices.
     Add them when you need them, then rerun onboarding and accept sandbox recreation when you change those choices later.
     Refer to [Choose Messaging Channels](../manage-sandboxes/messaging-channels/choose-messaging-channels) and [Network Policies](../network-policy/approve-network-requests) before enabling them.
   </Accordion>
@@ -216,14 +216,16 @@ Use these details when your first-run path needs more control.
     The wizard runs preflight checks, starts or reuses the OpenShell gateway, asks for an inference provider and model, collects required credentials, and asks for a sandbox name.
     It prints a review summary before it registers the provider with OpenShell.
 
-    After confirmation, NemoClaw registers inference, prompts for optional web search and messaging channels, builds and starts the sandbox, sets up OpenClaw, and applies the selected network policy tier and presets.
+    After confirmation, NemoClaw registers inference, prompts for optional web search and messaging channels, creates and starts the sandbox, sets up OpenClaw, and applies the selected network policy tier and presets.
 
     At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
 
     <Note>
-    Onboarding builds the sandbox image with a managed `NEMOCLAW_DISABLE_DEVICE_AUTH=1` compatibility setting so the dashboard is usable during setup.
+    Stock onboarding selects the exact OpenClaw image digest from the installed CLI release's complete all-agent catalog.
+    It does not stage or build an OpenClaw Dockerfile.
+    NemoClaw applies the managed `NEMOCLAW_DISABLE_DEVICE_AUTH=1` compatibility setting through the transactional startup profile so the dashboard is usable during setup.
     NemoClaw records that this value came from onboarding rather than reporting it as an operator-selected opt-out.
-    This build-time setting is baked into the image and setting it after onboarding does not affect an existing sandbox.
+    Setting the value in the host environment after onboarding does not affect an existing sandbox.
     </Note>
 
     If registered sandboxes already exist, the installer prepares the current NemoClaw CLI without replacing OpenShell and requires a fresh backup of every registered sandbox before it changes the gateway.
@@ -275,7 +277,7 @@ Use these details when your first-run path needs more control.
 
     For an OpenAI-compatible endpoint using HTTP on `localhost`, `127.0.0.1`, or `[::1]` and port `8000`, `11434`, or `11435`, press Enter at the API key prompt to select no authentication.
 
-    After you enter a sandbox name, the wizard asks for final confirmation before it registers the provider, prompts for integrations, and builds the sandbox image.
+    After you enter a sandbox name, the wizard asks for final confirmation before it registers the provider, prompts for integrations, and creates the sandbox.
 
     ```text
       ──────────────────────────────────────────────────
@@ -288,7 +290,6 @@ Use these details when your first-run path needs more control.
       Managed tools: none
       Messaging:     none
       Sandbox name:  my-gpt-claw
-      Note:          Sandbox build typically takes 5–15 minutes on this host.
       ──────────────────────────────────────────────────
       Web search and messaging channels will be prompted next.
       Apply this configuration? [Y/n]:
@@ -303,7 +304,7 @@ Use these details when your first-run path needs more control.
     After confirmation, NemoClaw registers the selected provider with the OpenShell gateway and sets the `inference.local` route.
     The wizard asks whether to enable web search and offers Brave Search or Tavily Search.
     Provide `BRAVE_API_KEY` for Brave Search or `TAVILY_API_KEY` for Tavily Search when prompted.
-    NemoClaw validates the selected key before it builds the sandbox, registers a sandbox-scoped OpenShell provider, and writes only an OpenShell resolver placeholder into the OpenClaw configuration.
+    NemoClaw validates the selected key before it creates the sandbox, registers a sandbox-scoped OpenShell provider, and writes only an OpenShell resolver placeholder into the OpenClaw configuration.
     OpenShell replaces the placeholder with the real key at egress.
 
     For non-interactive onboarding, select the provider explicitly and export its key.
@@ -323,13 +324,13 @@ Use these details when your first-run path needs more control.
     The wizard also offers Telegram, Discord, Slack, WeChat, and WhatsApp.
     Press a channel number to toggle it, then press Enter to continue.
     Leave every channel unselected to skip messaging setup.
-    When you select a channel, NemoClaw validates the token format before it bakes the channel configuration into the sandbox.
+    When you select a channel, NemoClaw validates the token format before it applies the channel configuration through the managed startup profile.
     For example, Slack bot tokens must start with `xoxb-`.
     WeChat and WhatsApp are experimental.
     Refer to [Choose Messaging Channels](../manage-sandboxes/messaging-channels/choose-messaging-channels) before enabling them.
 
-    After the sandbox image builds and OpenClaw starts, NemoClaw asks which network policy tier to apply.
-    Web search and messaging selections happen first so the sandbox image and policy suggestions stay aligned.
+    After the managed startup completes and OpenClaw starts, NemoClaw asks which network policy tier to apply.
+    Web search and messaging selections happen first so the startup profile and policy suggestions stay aligned.
     The default Balanced tier includes common development presets, such as npm, PyPI, Hugging Face, and Homebrew, plus the matching `brave` or `tavily` preset.
     Add the `weather` preset explicitly for read-only weather lookups.
     OpenClaw sandboxes also receive the `openclaw-pricing` preset automatically so session-cost records can populate without manual configuration.
@@ -388,7 +389,7 @@ Use these details when your first-run path needs more control.
     The wizard starts a background dashboard port forward and prints its URL in the ready summary.
     The default host port is `18789`.
     When that port is occupied, NemoClaw uses the next free dashboard port, such as `18790`, and includes the port in the URL.
-    If the selected port becomes occupied after the sandbox build begins, onboarding rolls back the new sandbox and asks you to retry rather than print an unreachable URL.
+    If the selected port becomes occupied after sandbox creation begins, onboarding rolls back the new sandbox and asks you to retry rather than print an unreachable URL.
     The installation transcript does not print the gateway token.
     Use `nemoclaw my-gpt-claw dashboard-url --quiet` to print the complete authenticated URL explicitly.
 

docs/manage-sandboxes/recover-rebuild-sandboxes.mdx

@@ -119,15 +119,11 @@ Other workflows, including onboarding, rebuild, and `doctor --fix`, can explicit
 
 ## Rebuild While Preserving State
 
-<AgentOnly variant="openclaw">
-If you changed the underlying Dockerfile, upgraded OpenClaw, or want to pick up a new base image without losing your sandbox's workspace files, use `rebuild` instead of destroying and recreating.
-</AgentOnly>
-<AgentOnly variant="hermes">
-If you changed the underlying Dockerfile, upgraded Hermes, or want to pick up a new base image without losing your sandbox's state files, use `rebuild` instead of destroying and recreating.
-</AgentOnly>
-<AgentOnly variant="deepagents">
-If you changed the underlying Dockerfile, upgraded Deep Agents Code, enabled Tavily Search, or want to pick up a new base image without losing manifest-defined Deep Agents state, use `rebuild` instead of destroying and recreating.
-</AgentOnly>
+Use `rebuild` to move a managed sandbox to the exact managed image for the installed NemoClaw release while preserving the state declared by the agent manifest.
+Before mutation, NemoClaw verifies the sandbox's recorded runtime provider and platform, resolves one complete all-agent managed-image catalog, and binds the replacement to the selected agent's exact image digest.
+The replacement preserves the provider-bound managed workload and applies a freshly rendered startup profile before NemoClaw restores the declared state.
+If the provider authority, catalog, image contract, or startup profile fails validation, rebuild stops before deleting the original sandbox.
+A sandbox created with `--from` remains on the legacy Dockerfile rebuild path and uses its recorded custom Dockerfile inputs.
 
 <AgentOnly variant="openclaw,hermes">
 <Warning title="Legacy Upgrade Recovery Scope">