[Brev][Onboard] OpenClaw onboard web UI shows a red error card with RETRY for benign build warnings from steps that succeeded

## Description

The NemoClaw onboarding web UI served by `nemoclaw-onboard-ui.service` on a Brev launchable renders a red error card with a **RETRY** button under the "Create sandbox" step while onboarding the OpenClaw agent, quoting sandbox image build output `#69 0.449 BEGIN failed--compilation aborted at (eval 1) line 4.`

That build step actually succeeds (`#69 DONE 0.8s`). The image build runs to completion, the sandbox reaches `Phase: Ready`, and onboarding proceeds through all 8 phases. The UI never retracts or supersedes the error card, so the operator is shown a failure for a successful onboarding and is invited to click RETRY, which re-runs `brev-quickstart` and rebuilds the entire sandbox for no reason. Going back to the dashboard and clicking **Chat with Agent** opens a working chat and the agent responds normally, confirming the onboarding the UI flagged as failed actually produced a fully usable agent.

Unlike the related reports for other agents, the flagged text here is **not** never-firing guard text in the Dockerfile: it is genuine output from commands that ran and succeeded. 12 build-output lines across 7 steps trip the UI's error detection, including an INFO-level success message that is flagged only because a *filename* contains the substring `error` (see Actual Result).

Reproduced with agent OpenClaw v2026.7.1. The affected steps are apt and Node steps that do not depend on the inference provider; the run verified here used OpenRouter, and the same `#69` step was reported on a run using NVIDIA Cloud (build).

- **Platform scope:** Reproduced on Brev launchable (Ubuntu 22.04) only; other platforms not tested
- **Regression:** Unknown — earlier versions not tested

## Environment

```text
Device: Brev launchable instance (n2d-standard-4, CPU-only, no GPU)
OS: Ubuntu 22.04.5 LTS (Linux 6.8.0-1064-gcp)
Architecture: x86_64
Node.js: v22.23.2
npm: 10.9.8
Docker: Docker version 29.1.3, build 29.1.3-0ubuntu3~22.04.2
OpenShell CLI: openshell 0.0.85
NemoClaw: nemoclaw v0.0.97
OpenClaw: OpenClaw 2026.7.1 (2d2ddc4)
```

## Steps to Reproduce

1. Create a Brev instance from the NemoClaw launchable and open the onboarding web UI (port 3000) in a browser.
2. Select agent **OpenClaw**, any supported provider and model, sandbox name `my-assistant`.
3. Start onboarding and watch the "Create sandbox" step and the Activity Log.
4. When the image build reaches step `#69` (the apt toolchain-purge step), observe the step status in the UI.
5. Let onboarding run to completion, then on the host run:

```bash
nemoclaw list
nemoclaw my-assistant status
```
6. Back in the onboarding UI, go to the dashboard and click **Chat with Agent**.

## Expected Result

BuildKit progress and build command output are rendered as build progress. The UI reports an error only when a build step actually fails (BuildKit prints its own `ERROR: process "..." did not complete successfully`) or when `brev-quickstart` exits non-zero. A step that reports `DONE` is shown as complete, and a successful onboarding ends in the success state with no RETRY offered.

## Actual Result

A red error card with a RETRY button appears under "Create sandbox" quoting:

```text
#69 0.449 BEGIN failed--compilation aborted at (eval 1) line 4.
```

The card stays on screen while the build continues past that step and onboarding completes:

```text
#69 DONE 0.8s
#112 exporting to image
Sandbox 'my-assistant' created
[7/8] Setting up OpenClaw inside sandbox
[8/8] Policy presets
nemoclaw my-assistant status -> Phase: Ready, Harness: OpenClaw (gateway),
Agent: OpenClaw v2026.7.1, Inference reachable
dashboard "Chat with Agent" -> opens a working chat; the agent responds
normally to interactive prompts
```

12 build-output lines across 7 steps match the UI's error detection. None of them indicates a failure; every one of these steps reported `DONE`:

```text
#69 0.398 BEGIN failed--compilation aborted at (eval 1) line 4.
#72 0.462 Warning: Ignoring extra certs from `/usr/local/share/nemoclaw/corporate-ca.pem`, load failed: error:80000002:...
#76 0.362 Warning: Ignoring extra certs from `/usr/local/share/nemoclaw/corporate-ca.pem`, load failed: error:80000002:...
#76 1.208 (same warning)
#76 1.672 (same warning)
#76 2.040 (same warning)
#79 1.601 (same warning)
#84 0.475 INFO: patched OpenClaw #4434 diagnostics in assistant-error-format-Ccvn1r0A.js
#95 1.677 (same warning)
#95 5.896 (same warning)
#98 1.636 (same warning)
#98 8.166 (same warning)
```

Note `#84`: an INFO-level **success** message is flagged as an error purely because the *filename* it names contains the substring `error` (`assistant-error-format-Ccvn1r0A.js`).

## Analysis

1. BuildKit writes its progress lines and the stdout/stderr of each RUN step to stderr, prefixed `#NN {elapsed} {text}`.
2. `onboard-ui/lib/services/nemoclaw.ts`, `parseOnboardStderr()`, emits a hard `{type:"error"}` event for any stderr line matching `/\b(error|failed)\b/i` (the full pattern also covers `unauthorized`, `forbidden`, `authentication`, invalid api key, upstream unavailable). There is no exclusion for build output and no notion of whether the step later reported `DONE`, so a single benign warning permanently marks the whole "Create sandbox" step as failed.
3. For OpenClaw the matching text is ordinary command output rather than Dockerfile guard text:
- `#69`: `apt-get autoremove --purge` removes `libgdbm6t64` and `libgdbm-compat4t64`, which leaves debconf's Perl unable to load `Debconf/Log.pm`; debconf prints a warning ending `BEGIN failed--compilation aborted`. apt then completes the removal, the step's final checks (`ps --version`, `chattr`, `tmux`) pass, and the step reports `DONE`.
- The repeated Node warning `Ignoring extra certs ... load failed` comes from an empty `/usr/local/share/nemoclaw/corporate-ca.pem` when `NEMOCLAW_CORPORATE_CA_B64` is not set.
- `#84` is an INFO success line whose payload is a filename containing `error`.

**Suggested fix:** in `parseOnboardStderr()`, skip BuildKit lines (`/^#\d+\s/`), or only raise an error on BuildKit's own `ERROR: process "..." did not complete successfully` marker and on a non-zero child exit code. This case cannot be fixed by rewording Dockerfile guard text, because the matching strings come from third-party command output.

Secondary observations, noted for completeness and **not** the subject of this report: the `autoremove` in step `#69` breaking debconf's Perl, and the empty `corporate-ca.pem` producing 10 identical Node warnings, are both build noise worth cleaning up independently.

## Related Bugs / not duplicate of

Issues #8101 (LangChain Deep Agents Code) and #8105 (Hermes Agent) report the same UI symptom, but in those cases the matching text is never-firing guard text inside the agent Dockerfile.

This report is filed separately because the trigger is different in kind: the matching strings here are genuine output from third-party commands (apt, debconf, Node) and from an INFO success message naming a file whose name contains `error`. A per-agent workaround of rewording Dockerfile guard text would fix #8101 and #8105 but would **not** fix this. The `parseOnboardStderr()` change suggested above resolves all three.

## Logs

Onboarding UI service log (host names removed), showing the flagged output and the successful continuation of the same build:

```text
[onboard] #69 0.296 The following packages will be REMOVED:
[onboard] #69 0.296 libgdbm-compat4t64* libgdbm6t64*
[onboard] #69 0.398 debconf: Perl may be unconfigured (Can't locate Debconf/Log.pm in @INC ...
[onboard] #69 0.398 BEGIN failed--compilation aborted at (eval 1) line 4.
[onboard] #69 0.398 ) -- aborting
[onboard] #69 0.429 0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
[onboard] #69 0.532 Removing libgdbm-compat4t64:amd64 (1.24-2) ...
[onboard] #69 0.559 Removing libgdbm6t64:amd64 (1.24-2) ...
[onboard] #69 0.589 Processing triggers for libc-bin (2.41-12+deb13u3) ...
[onboard] #69 0.751 ps from procps-ng 4.0.4
[onboard] #69 DONE 0.8s
[onboard] #112 exporting to image
[onboard] * Sandbox 'my-assistant' created
[onboard] [7/8] Setting up OpenClaw inside sandbox
[onboard] [8/8] Policy presets
```

Anyone who plans to fix one of #8101, #8105 and #8109 should consider to fix them altogether.

Read onboard-ui/lib/services/nemoclaw.ts and inspect parseOnboardStderr(), focusing on how BuildKit stderr lines become error events. Reproduce the OpenClaw onboarding flow or review the provided logs, then verify that benign lines do not create a persistent RETRY card while genuine failures and non-zero exits still do.

Written by the indexing model from the issue text.