Automate protected Portable OpenClaw qualification after the support decision

# Automate Portable OpenClaw qualification after the support decision

## Status

Deferred.

Portable OpenClaw remains experimental. Its current qualification is a maintainer-run Brev procedure and evidence report. NemoClaw will not add a dedicated runner, repository controller, or protected qualification workflow for this issue while the path remains experimental.

This issue resumes only after an accepted product decision makes Portable OpenClaw a supported surface and defines the qualification runner's ownership, availability, lifecycle, credentials, cost controls, cleanup, and evidence retention.

## Accepted experimental evidence

The maintained manual procedure qualified the exact GitHub-Verified commit `03d0f44546ae8b9fbea9b36dc655ac87df3d56de`, with verification reason `valid`, on:

- Ubuntu 22.04.5 LTS, x86_64;
- one NVIDIA L40S on an AWS `g6e.2xlarge` Brev instance;
- rootless Podman 5.7.0 through the current user's mode-0600 systemd socket;
- cgroup v2 with the required controller preparation;
- OpenClaw 2026.7.1 and OpenShell 0.0.106;
- local Ollama through Chat Completions with `qwen3-vl:4b`;
- sandbox `my-assistant`, Personal policy, `personal-open-internet`, `local-inference`, and progressive tool disclosure.

Observed results:

- the SHA-pinned public installer and fresh Portable onboarding completed successfully;
- OpenShell reached `Ready` and the warm probe completed in 1,457 ms;
- stopping the sandbox and probing recovery preserved the full workload-container identity;
- recovery completed in 15,716 ms, including 12,063 ms in `gatewayReady`;
- the gateway startup receipt attributed 10,926 ms to `spawnToFirstHealth` within 12,066 ms from launch to first health;
- the OpenClaw TUI reached ready, completed one prompt-correlated `web_fetch` request to the public Nasdaq endpoint, returned the matching NVDA result, and exited cleanly;
- the retained bounded evidence passed credential review.

The evidence applies only to that exact experimental matrix. It does not establish product support, qualify other hosts or Podman versions, or qualify Hermes.

## Evidence limitations

The accepted run is manual evidence, not a protected continuous-integration run. It includes the host-preparation restart and a sandbox stop/recovery cycle. It does not claim a post-install host-restart lifecycle, receipt-bound double uninstall, or automated runner availability.

Those broader automation requirements are deferred with this issue rather than treated as current experimental-path blockers.

## Resume gate

Before implementation resumes, an accepted design must define:

- the supported Portable OpenClaw matrix;
- the owned runner or remote-provisioning service and its availability contract;
- protected dispatch and exact-candidate verification;
- credential boundaries and immutable evidence retention;
- instance cost, timeout, failure retention, and cleanup ownership;
- lifecycle, host-restart, and repeat-uninstall acceptance criteria;
- the relationship between qualification results and release decisions.

Until those decisions exist, do not create a qualification runner or controller for this issue.