refactor(policy): remove NemoClaw policy lifecycle ownership

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Author: ericksoa

ci/onboard-entry-composition-budget.json

@@ -11,9 +11,8 @@
     "runOnboard.finalizationDeps.verifyDeployment.getMessagingChannels": 1
   },
   "policy": {
-    "createOnboardPolicyApplication.getRecordedPolicyTier": 1,
     "preflightAuthoritativeRebuildTarget": 1,
-    "runOnboard": 5,
+    "runOnboard": 4,
     "sandboxCreateIntentResolver.getAgentPolicyPath": 1
   },
   "provider": {

ci/source-architecture-budget.json

@@ -3,32 +3,31 @@
   "fanIn": {
     "defaultMax": 20,
     "maxByFile": {
-      "src/lib/actions/sandbox/mcp-bridge-contracts.ts": 26,
+      "src/lib/actions/sandbox/mcp-bridge-contracts.ts": 25,
       "src/lib/actions/sandbox/process-recovery.ts": 27,
       "src/lib/adapters/docker/index.ts": 43,
       "src/lib/adapters/openshell/client.ts": 20,
       "src/lib/adapters/openshell/resolve.ts": 27,
       "src/lib/adapters/openshell/runtime.ts": 55,
       "src/lib/adapters/openshell/timeouts.ts": 39,
       "src/lib/agent/defs.ts": 33,
-      "src/lib/cli/branding.ts": 86,
+      "src/lib/cli/branding.ts": 85,
       "src/lib/cli/nemoclaw-oclif-command.ts": 107,
       "src/lib/cli/terminal-style.ts": 43,
       "src/lib/core/json-types.ts": 37,
       "src/lib/core/ports.ts": 89,
       "src/lib/core/shell-quote.ts": 28,
       "src/lib/core/url-utils.ts": 30,
-      "src/lib/core/wait.ts": 38,
+      "src/lib/core/wait.ts": 37,
       "src/lib/credentials/store.ts": 46,
       "src/lib/inference/config.ts": 30,
-      "src/lib/inference/web-search.ts": 21,
       "src/lib/messaging/channels/index.ts": 25,
       "src/lib/onboard/gateway-binding.ts": 52,
       "src/lib/runner.ts": 86,
       "src/lib/security/redact.ts": 54,
-      "src/lib/state/onboard-session.ts": 36,
       "src/lib/state/mcp-lifecycle-lock.ts": 21,
-      "src/lib/state/registry.ts": 101,
+      "src/lib/state/onboard-session.ts": 35,
+      "src/lib/state/registry.ts": 98,
       "src/lib/state/state-root.ts": 21,
       "src/lib/subprocess-env.ts": 24,
       "src/lib/validation.ts": 24
@@ -40,7 +39,7 @@
       "src/lib/actions/inference-set.ts": 32,
       "src/lib/actions/sandbox/connect.ts": 43,
       "src/lib/actions/sandbox/destroy.ts": 29,
-      "src/lib/actions/sandbox/doctor.ts": 29,
+      "src/lib/actions/sandbox/doctor.ts": 27,
       "src/lib/actions/sandbox/gateway-state.ts": 21,
       "src/lib/actions/sandbox/status-snapshot.ts": 19,
       "src/lib/actions/sandbox/policy-channel.ts": 30,
@@ -51,7 +50,7 @@
       "src/lib/inference/local.ts": 22,
       "src/lib/inference/onboard-probes.ts": 21,
       "src/lib/inference/vllm.ts": 21,
-      "src/lib/onboard.ts": 202,
+      "src/lib/onboard.ts": 201,
       "src/lib/onboard/machine/handlers/sandbox.ts": 21,
       "src/lib/policy/index.ts": 23,
       "src/lib/sandbox/config.ts": 22,
@@ -60,9 +59,9 @@
   },
   "allowedCycles": [],
   "maxRootFiles": {
-    "src/lib/onboard": 308,
+    "src/lib/onboard": 307,
     "src/lib/actions": 19,
-    "src/lib/actions/sandbox": 183,
+    "src/lib/actions/sandbox": 182,
     "src/lib/state": 39,
     "src/lib/inference": 63,
     "scripts": 42

nemoclaw/src/blueprint/runner-identity.test.ts

@@ -19,8 +19,7 @@ import {
   MATCHING_INFERENCE_ROUTE_LISTING,
   MATCHING_RUNTIME_PROVIDER_LISTING,
   providersV2EnabledResult,
-  resultWithBlueprintPolicyAuthority,
-  sandboxIdentityResult,
+  resultWithBlueprintPolicy,
   sequentialCommandResult,
   successResult,
   TEST_SANDBOX_POLICY,
@@ -51,6 +50,7 @@ vi.mock("node:fs", async (importOriginal) => {
     openSync: memory.openSync,
     readFileSync: memory.readFileSync,
     renameSync: memory.renameSync,
+    unlinkSync: memory.unlinkSync,
     writeFileSync: memory.writeFileSync,
     readdirSync: memory.readdirSync,
     realpathSync: memory.realpathSync,
@@ -110,7 +110,7 @@ function responseQueue(
     const fallback = responses.get(command)?.shift() ?? fallbacks.get(command) ?? success;
     return fallback.exitCode === undefined
       ? fallback
-      : resultWithBlueprintPolicyAuthority(args, {
+      : resultWithBlueprintPolicy(args, {
           ...fallback,
           exitCode: fallback.exitCode ?? 1,
         });
@@ -179,7 +179,7 @@ describe("blueprint identity wrapper", () => {
     realpaths.clear();
     vi.clearAllMocks();
     mockExeca.mockImplementation(async (_command: string, args: string[]) =>
-      resultWithBlueprintPolicyAuthority(
+      resultWithBlueprintPolicy(
         args,
         args.join(" ") === "settings get --global --json" ? providersV2Enabled : success,
       ),
@@ -409,145 +409,6 @@ describe("blueprint identity wrapper", () => {
     ).not.toContain("refresh configure");
   });
 
-  it("establishes the policy receipt before the first identity mutation", async () => {
-    process.env.OKTA_CLIENT_ID = "client-id";
-    process.env.OKTA_REFRESH_TOKEN = "refresh-secret";
-    process.env.OKTA_CLIENT_SECRET = "client-secret";
-    responseQueue([
-      [
-        "provider get acme-okta-runtime",
-        [
-          failureResult("provider not found"),
-          ...Array.from({ length: 4 }, () => ({
-            exitCode: 0,
-            stdout: matchingProvider,
-            stderr: "",
-          })),
-        ],
-      ],
-    ]);
-
-    await actionApply("default", blueprint({ identity: oktaIdentity() }));
-
-    const commands = mockExeca.mock.calls.map(([, args]) => (args ?? []).join(" "));
-    const createIndex = commands.indexOf(
-      "sandbox create -g test-gateway --from openclaw --name test-sandbox --policy /tmp/nemoclaw-test-policy.yaml --forward 18789",
-    );
-    const firstReceiptValidation = commands.indexOf(
-      "sandbox get -g test-gateway test-sandbox",
-      createIndex + 1,
-    );
-    const firstIdentityMutation = commands.indexOf(
-      "provider create --name acme-okta-runtime --type okta-runtime-v1 --runtime-credentials",
-    );
-    expect(createIndex).toBeGreaterThan(-1);
-    expect(firstReceiptValidation).toBeGreaterThan(createIndex);
-    expect(firstIdentityMutation).toBeGreaterThan(firstReceiptValidation);
-  });
-
-  it("stops before identity mutation when the receipt sandbox identity changes", async () => {
-    process.env.OKTA_CLIENT_ID = "client-id";
-    process.env.OKTA_REFRESH_TOKEN = "refresh-secret";
-    process.env.OKTA_CLIENT_SECRET = "client-secret";
-    const identityResult = sequentialCommandResult("sandbox get -g test-gateway test-sandbox", [
-      sandboxIdentityResult("test-sandbox"),
-      sandboxIdentityResult("test-sandbox", "replacement-id"),
-    ]);
-    mockExeca.mockImplementation(
-      async (_command: string, args: string[]) =>
-        identityResult(args) ??
-        resultWithBlueprintPolicyAuthority(
-          args,
-          args.join(" ") === "settings get --global --json" ? providersV2Enabled : success,
-        ),
-    );
-
-    await expect(actionApply("default", blueprint({ identity: oktaIdentity() }))).rejects.toThrow(
-      /receipt does not match the live sandbox policy/u,
-    );
-    const commands = mockExeca.mock.calls.map(([, args]) => (args ?? []).join(" "));
-    expect(commands).not.toContain(
-      "provider create --name acme-okta-runtime --type okta-runtime-v1 --runtime-credentials",
-    );
-    expect(commands).not.toContain("sandbox provider attach test-sandbox acme-okta-runtime");
-  });
-
-  it("validates the policy receipt before inference-provider reuse inspection", async () => {
-    process.env.OKTA_CLIENT_ID = "client-id";
-    process.env.OKTA_REFRESH_TOKEN = "refresh-secret";
-    process.env.OKTA_CLIENT_SECRET = "client-secret";
-    responseQueue([
-      ["provider get test-provider", [failureResult("gateway configuration not found")]],
-    ]);
-
-    await expect(actionApply("default", blueprint({ identity: oktaIdentity() }))).rejects.toThrow(
-      /Failed to inspect inference provider 'test-provider'.*gateway configuration not found/u,
-    );
-    const commands = mockExeca.mock.calls.map(([, args]) => (args ?? []).join(" "));
-    const receiptValidation = commands.indexOf("sandbox get -g test-gateway test-sandbox");
-    const providerInspection = commands.indexOf("provider get test-provider");
-    expect(receiptValidation).toBeGreaterThanOrEqual(0);
-    expect(providerInspection).toBeGreaterThanOrEqual(0);
-    expect(receiptValidation).toBeLessThan(providerInspection);
-    expect(commands).not.toContain(
-      "provider create --name acme-okta-runtime --type okta-runtime-v1 --runtime-credentials",
-    );
-  });
-  it.each([
-    ["not configured", "Gateway inference:\n\n  Not configured\n"],
-    [
-      "OpenShell v0.0.99 ANSI not configured",
-      [
-        "\u001b[1mInference:\u001b[0m",
-        "",
-        "  Not configured",
-        "",
-        "\u001b[1mSystem inference:\u001b[0m",
-        "",
-        "  Not configured",
-        "",
-      ].join("\n"),
-    ],
-    [
-      "configured for a different model",
-      matchingInferenceRoute.replace("Model: test-model", "Model: other-model"),
-    ],
-  ])("sets the requested route when the reused route is %s", async (_label, routeOutput) => {
-    process.env.OKTA_CLIENT_ID = "client-id";
-    process.env.OKTA_REFRESH_TOKEN = "refresh-secret";
-    process.env.OKTA_CLIENT_SECRET = "client-secret";
-    responseQueue([
-      [
-        "sandbox get test-sandbox",
-        [{ exitCode: 0, stdout: "Name: test-sandbox\nPhase: Ready", stderr: "" }],
-      ],
-      [
-        "provider get test-provider",
-        [{ exitCode: 0, stdout: matchingInferenceProvider, stderr: "" }],
-      ],
-      ["inference get", [{ exitCode: 0, stdout: routeOutput, stderr: "" }]],
-      [
-        "provider get acme-okta-runtime",
-        [
-          failureResult("provider not found"),
-          ...Array.from({ length: 4 }, () => ({
-            exitCode: 0,
-            stdout: matchingProvider,
-            stderr: "",
-          })),
-        ],
-      ],
-    ]);
-
-    await actionApply("default", blueprint({ identity: oktaIdentity() }));
-
-    const commands = mockExeca.mock.calls.map(([, args]) => (args ?? []).join(" "));
-    expect(commands).toContain("inference set --provider test-provider --model test-model");
-    expect(
-      commands.indexOf("inference set --provider test-provider --model test-model"),
-    ).toBeLessThan(commands.indexOf("sandbox provider attach test-sandbox acme-okta-runtime"));
-  });
-
   it("reuses the ANSI-formatted OpenShell v0.0.99 inference route", async () => {
     process.env.OKTA_CLIENT_ID = "client-id";
     process.env.OKTA_REFRESH_TOKEN = "refresh-secret";
@@ -1036,9 +897,9 @@ describe("blueprint identity wrapper", () => {
       }),
     });
     const policyResult = sequentialCommandResult(POLICY_BOUNDARY_COMMAND, [
-      resultWithBlueprintPolicyAuthority(POLICY_BOUNDARY_COMMAND.split(" "), success),
+      resultWithBlueprintPolicy(POLICY_BOUNDARY_COMMAND.split(" "), success),
       {
-        ...resultWithBlueprintPolicyAuthority(POLICY_BOUNDARY_COMMAND.split(" "), success),
+        ...resultWithBlueprintPolicy(POLICY_BOUNDARY_COMMAND.split(" "), success),
         stdout: JSON.stringify({
           scope: "sandbox",
           sandbox: "test-sandbox",
@@ -1053,7 +914,7 @@ describe("blueprint identity wrapper", () => {
     mockExeca.mockImplementation(async (_command: string, args: string[]) =>
       args.join(" ") === "provider get test-provider"
         ? { exitCode: 0, stdout: matchingInferenceProvider, stderr: "" }
-        : (policyResult(args) ?? resultWithBlueprintPolicyAuthority(args, success)),
+        : (policyResult(args) ?? resultWithBlueprintPolicy(args, success)),
     );
 
     await expect(actionRollback("provider-authority-drift")).rejects.toThrow(
@@ -1076,10 +937,7 @@ describe("blueprint identity wrapper", () => {
         policy_authority: managedPolicyAuthorityReceipt(),
       }),
     });
-    const matchingPolicy = resultWithBlueprintPolicyAuthority(
-      POLICY_BOUNDARY_COMMAND.split(" "),
-      success,
-    );
+    const matchingPolicy = resultWithBlueprintPolicy(POLICY_BOUNDARY_COMMAND.split(" "), success);
     const policyResult = sequentialCommandResult(POLICY_BOUNDARY_COMMAND, [
       matchingPolicy,
       matchingPolicy,
@@ -1098,7 +956,7 @@ describe("blueprint identity wrapper", () => {
     ]);
     mockExeca.mockImplementation(
       async (_command: string, args: string[]) =>
-        policyResult(args) ?? resultWithBlueprintPolicyAuthority(args, success),
+        policyResult(args) ?? resultWithBlueprintPolicy(args, success),
     );
 
     await expect(actionRollback("sandbox-authority-drift")).rejects.toThrow(
@@ -1167,7 +1025,9 @@ describe("blueprint identity wrapper", () => {
       attachment_created: false,
     });
 
-    await expect(actionRollback(plan.run_id)).rejects.toThrow(/mutable sandbox and provider names/u);
+    await expect(actionRollback(plan.run_id)).rejects.toThrow(
+      /mutable sandbox and provider names/u,
+    );
     expect(store.get(`/fakehome/.nemoclaw/state/runs/${plan.run_id}/rolled_back`)).toBeUndefined();
   });
 
@@ -1209,7 +1069,9 @@ describe("blueprint identity wrapper", () => {
       attachment_created: true,
     });
 
-    await expect(actionRollback(plan.run_id)).rejects.toThrow(/mutable sandbox and provider names/u);
+    await expect(actionRollback(plan.run_id)).rejects.toThrow(
+      /mutable sandbox and provider names/u,
+    );
     expect(store.get(`/fakehome/.nemoclaw/state/runs/${plan.run_id}/rolled_back`)).toBeUndefined();
   });
 

nemoclaw/src/blueprint/runner-mock-fixtures.ts

@@ -89,6 +89,9 @@ export function inMemoryFsMethods(store: Map<string, RunnerFsEntry>, options?: I
       store.set(destination, entry);
       store.delete(source);
     }),
+    unlinkSync: spy((target: string) => {
+      if (!store.delete(target)) return missingEntry(target);
+    }),
     readdirSync: (p: string) => {
       const prefix = p.endsWith("/") ? p : `${p}/`;
       const entries = new Set(

nemoclaw/src/blueprint/runner-name-validation.test.ts

@@ -18,7 +18,7 @@ import {
 } from "./runner-mock-fixtures.js";
 import {
   minimalBlueprint,
-  resultWithBlueprintPolicyAuthority,
+  resultWithBlueprintPolicy,
   successResult,
   TEST_SANDBOX_POLICY,
   TEST_SANDBOX_POLICY_PATH,
@@ -47,6 +47,7 @@ vi.mock("node:fs", async (importOriginal) => {
     openSync: memory.openSync,
     readFileSync: memory.readFileSync,
     renameSync: memory.renameSync,
+    unlinkSync: memory.unlinkSync,
     writeFileSync: memory.writeFileSync,
     readdirSync: memory.readdirSync,
   };
@@ -128,7 +129,7 @@ describe("blueprint name validation (fail-closed integration)", () => {
     vi.clearAllMocks();
     vi.spyOn(process.stdout, "write").mockImplementation(stdout.write);
     mockExeca.mockImplementation(async (_command: string, args: string[]) =>
-      resultWithBlueprintPolicyAuthority(args, successResult()),
+      resultWithBlueprintPolicy(args, successResult()),
     );
   });