[Epic] Simplify sandbox permissions and normalize native agent behavior

## Problem statement

NemoClaw retains compatibility code for older sandbox permissions, layouts, shell initialization, and command transports. Some paths now duplicate OpenShell behavior or change native agent behavior unnecessarily.

This epic removes outdated code and normalizes supported agents' behavior inside their sandbox. OpenShell containment, credential custody, trusted startup, and recovery guarantees remain the acceptance boundary.

The audit baseline is [NemoClaw commit 0d286ce3c318ded19377fb42456b2619f7b9581c](https://github.com/NVIDIA/NemoClaw/commit/0d286ce3c318ded19377fb42456b2619f7b9581c). Native runtime behavior must be verified against each implementation's pinned agent and OpenShell versions.

## Governing maintainer direction (2026-09-14)

NemoClaw must not impose agent restrictions beyond the security posture of the selected OpenShell installation. NemoClaw complies with OpenShell containment, identity, network, filesystem, and process enforcement; it does not duplicate or strengthen those controls inside the agent runtime.

The sole retained NemoClaw security adaptation is credential placement and projection required by OpenShell. Credentials remain where OpenShell expects them, and agents receive only the references or non-secret values exposed by that contract. This exception does not authorize NemoClaw-owned restrictions on ordinary configuration, lifecycle, plugins, packages, updates, persistence, tools, hooks, subprocesses, background work, providers, or models.

Every retained deviation from native agent behavior must cite the exact OpenShell contract that requires it. Otherwise, delete it rather than replacing it with another compatibility or policy layer.

## Desired behavior

A freshly onboarded agent uses its expected configuration ownership, personal shell files, home locations, and supported native commands. Native diagnostics pass on the first attempt without a preliminary repair, hidden permission restoration, or suppressed errors.

OpenShell supplies the supported execution and enforcement mechanisms. NemoClaw retains only adaptations with a current consumer and demonstrated compatibility requirement.

## Accepted scope and ownership

The original scope accepted eight bounded cleanup areas in core NemoClaw. The governing maintainer direction above expands the epic with the additional native-behavior removals listed below.

- **Reason:** reduce production code and maintenance burden while normalizing native agent behavior.
- **Placement:** existing image, startup, agent-adapter, and OpenShell-adapter owners in core NemoClaw.
- **Accountable team:** NemoClaw maintainers. Individual implementation assignees remain open.
- **Support:** existing supported agents and runtime paths; each issue names its applicable compatibility limits.
- **Validation:** native first-attempt diagnostics, existing security and lifecycle coverage, and a demonstrated net reduction in production code.

## Child issues

- [x] #11256 — Normalize native agent diagnostics and personal shell profiles ([#11268](https://github.com/NVIDIA/NemoClaw/pull/11268); 418 fewer production lines)
- [x] #11257 — Preserve native OpenClaw permissions in same-user sandboxes ([#11309](https://github.com/NVIDIA/NemoClaw/pull/11309))
- [x] #11258 — Normalize durable user configuration under the sandbox home ([#11475](https://github.com/NVIDIA/NemoClaw/pull/11475))
- [x] #11259 — Remove duplicate capability handling from OpenShell-managed launches ([#11632](https://github.com/NVIDIA/NemoClaw/pull/11632), [#11775](https://github.com/NVIDIA/NemoClaw/pull/11775))
- [x] #11260 — Retire the sandbox network-interface compatibility guard ([#11400](https://github.com/NVIDIA/NemoClaw/pull/11400))
- [x] #11261 — Normalize DeepAgents local behavior by removing obsolete compatibility restrictions ([#11683](https://github.com/NVIDIA/NemoClaw/pull/11683))
- [x] #11262 — Use native loopback for sandbox gateway connections ([#11695](https://github.com/NVIDIA/NemoClaw/pull/11695))
- [ ] #11263 — Retire legacy transports for ordinary sandbox commands
- [ ] #11763 — Enforce no NemoClaw-only agent restrictions beyond OpenShell
- [ ] #11764 — Return OpenClaw configuration ownership to OpenClaw
- [ ] #11765 — Return gateway and background-process lifecycle to native agents ([#11792](https://github.com/NVIDIA/NemoClaw/pull/11792))
- [ ] #11766 — Restore native plugin, package, and self-update behavior
- [ ] #11767 — Persist the complete native agent home through OpenShell storage
- [ ] #11768 — Stop rewriting native model and provider configuration after onboarding
- [x] #11772 — Retire obsolete lifecycle recovery and E2E machinery ([#11776](https://github.com/NVIDIA/NemoClaw/pull/11776))

## Delivery guidance

Start with native diagnostics/personal profiles, existing same-user OpenClaw permissions, and network-interface guard retirement. Each issue must deliver a complete observable outcome with its tests, guidance, and compatible upgrade behavior.

Capability cleanup is limited to paths fully enforced by OpenShell. It does not change process/file resource budgets or privileged bootstrap requirements.

Native loopback and preload retirement require direct unpatched runtime evidence. If that evidence fails, record the remaining requirement and keep the necessary adaptation.

Ordinary command-transport retirement follows the active adapter work in #10991, #10992, and #11089. The child issue owns deletion after consumer migration; it does not duplicate that implementation.

DeepAgents cleanup must reconcile the local-command assumptions in #7774. MCP lifecycle/projection changes remain owned by #11134 and #11163.

Broader gateway-identity conversion and wholesale restart/configuration-controller replacement are outside these eight issues.

## Completion criteria

- [ ] Each child records the production functions, branches, runtime patches, and build wiring removed, with the actual net code reduction.
- [ ] Deleted compatibility tests are replaced by native behavior assertions where the behavior still requires coverage.
- [ ] Fresh native diagnostics or verified equivalents pass without NemoClaw-induced permission, layout, or command-interception findings.
- [ ] Native settings and personal shell edits work through applicable restart, reconnect, and restore paths.
- [ ] Existing supported runtime variants retain working startup, inference, messaging, background work, signals, and data recovery.
- [ ] Preserve the no-secrets-in-sandbox contract for managed provider, channel, and MCP credentials; sandbox projections retain placeholders and non-secret metadata.
- [ ] Preserve existing documented local authentication/session handling, including WhatsApp pairing state. This cleanup introduces no credential-storage exceptions.
- [ ] OpenShell containment, supervisor/host isolation, trusted startup files, and exact-target privileged operations remain protected.
- [ ] Cleanup does not introduce a replacement permission framework or new compatibility mode solely to retain obsolete behavior.

## Related work

- #10696: completed removal of Shields; this epic does not revive that subsystem.
- #11079: broader portable runtime contract; coordinate native ownership expectations.
- #10694: OpenClaw version migration; align patch disposition so retired code is not reintroduced.
- #5896: existing patch-retirement tracking and unpatched behavioral proof.
- #7176: persistent sandbox environment proposal; coordinate native-home behavior without adding a new registry subsystem.
- #10780: Hermes configuration preservation across rebuild; preserve that behavior.

No implementation or live runtime qualification is claimed by creating this epic.

## Basic-onboarder target architecture

This epic is a transition to a basic onboarder, potentially on an accelerated timeline. The intended steady state is:

1. NemoClaw selects the agent/image and creates the OpenShell sandbox.
2. NemoClaw places credentials exactly as required by OpenShell and attaches the initial non-secret inference route/reference.
3. NemoClaw launches the native agent and returns connection details.
4. NemoClaw leaves the ongoing control path.

OpenShell owns sandbox enforcement and lifecycle. The native agent owns configuration, gateway processes, plugins, packages, updates, hooks, subprocesses, background work, providers, models, and state. Routine supervision, reconciliation, repair, quarantine, snapshot/restore, and restart authorization are removal targets, not systems to redesign.

Compatibility code for an installed-version transition must be narrow, temporary, carry a deletion condition, and must not become a new lifecycle framework.

## E2E migration rule

Each child issue now identifies the existing E2E targets and files it must amend or retire. Delivery must follow these rules:

- Change existing behavior owners rather than creating a parallel native-behavior matrix.
- Delete assertions and workflow jobs whose only purpose is validating removed NemoClaw lifecycle or policy machinery.
- Keep strict OpenShell credential-placement and containment evidence.
- Refocus `full-e2e`, managed-image activation, and agent-specific native targets on onboarding plus native post-onboard behavior.
- Use deterministic tests for parsers, migration, state transforms, and failure branches; reserve live E2E for actual native runtime boundaries.
- Quantify the E2E target/job reduction with each completed removal slice.