[Deferred] CUA: Run a terminal task and recover lifecycle state

[jyaunches]

Parent epic: #6015

This is the fourth cumulative vertical capability. It builds on candidate install/readiness (#7755), target/security lifecycle (#8450), and the browser journey (#8449).

Outcome

Run one real terminal filesystem task and recover the same public lifecycle across cancellation, process restart, an uncertain external effect, target reset, and sandbox recreation.

The task creates a seeded text file and moves it to the required path. Code outside the agent verifies the exact final path and bytes. Every earlier cumulative journey remains passing.

Feature and readiness gates

• Every CUA target or task command is absent unless NEMOCLAW_CUA_ENABLED=1 exactly.
• Candidate execution additionally requires NEMOCLAW_CUA_QUALIFICATION=1 exactly and current validated status: "candidate" readiness.
• Reset, cancellation, observation, and cleanup revalidate current authority or the exact old authority retained by a reconciliation record before adapter execution and before committing output.

User journey

1. Repeat the browser journey on the cumulative exact SHA.
2. Run a terminal task through the existing public task start/status/result commands.
3. Verify the final filesystem state through an independent oracle.
4. Start a second task, cancel the exact task ID, and verify its final cancelled state.
5. Restart the CLI and inspect the same target/task through public status.
6. Interrupt an adapter after an external effect may have begun.
7. Observe target/task state and complete only the reconciliation actions authorized by that observation.
8. Reset the target and verify a distinct exact identity plus healthy browser, computer, and terminal services.
9. Clean the target, create a named snapshot, destroy the sandbox, onboard the same registered name, restore in place, and reacquire candidate readiness.
10. Attach a new target and repeat browser and terminal journeys.
11. Destroy the recreated sandbox and target.

Cumulative public command sequence

Action	Public command
Onboard	nemoclaw onboard --agent nemocua --name <sandbox> --fresh --non-interactive --yes-i-accept-third-party-software --yes
Read runtime	nemoclaw <sandbox> status --json
Diagnose runtime	nemoclaw <sandbox> doctor --json
Run interactive runtime	nemoclaw launch <sandbox>
Run headless runtime	nemoclaw <sandbox> agent
Attach target	nemoclaw <sandbox> cua target attach --adapter <absolute-path> --target-manifest <path> --json
Read target	nemoclaw <sandbox> cua target status --json
Observe target	nemoclaw <sandbox> cua target health --adapter <absolute-path> --json
Verify security	nemoclaw <sandbox> cua security verify --adapter <absolute-path> --json
Read security	nemoclaw <sandbox> cua security status --json
Start terminal task	nemoclaw <sandbox> cua task start --adapter <absolute-path> --task-id <id> --mode headless --input-file <path> --json
Observe task	nemoclaw <sandbox> cua task status --adapter <absolute-path> --task-id <id> --json
Read result	nemoclaw <sandbox> cua task result --adapter <absolute-path> --task-id <id> --json
Cancel/reconcile	nemoclaw <sandbox> cua task cancel --adapter <absolute-path> --task-id <id> --json
Reset target	nemoclaw <sandbox> cua target reset --adapter <absolute-path> --json
Detach target	nemoclaw <sandbox> cua target detach --adapter <absolute-path> --json
Destroy target	nemoclaw <sandbox> cua target destroy --adapter <absolute-path> --json
Create snapshot	nemoclaw <sandbox> snapshot create --name <snapshot>
Destroy sandbox	nemoclaw <sandbox> destroy --yes
Re-onboard same name	nemoclaw onboard --agent nemocua --name <sandbox> --fresh --non-interactive --yes-i-accept-third-party-software --yes
Restore in place	nemoclaw <sandbox> snapshot restore <snapshot> --yes

No terminal-specific or recovery-private command is introduced.

Every failure and reconciliation projection uses the deterministic #7750
envelope. Private terminal output, filesystem content, adapter output, and old
transport authority do not enter the public failure record.

Added public capability

• Advertise and implement target.reset only in this slice.
• Reuse public status --json, target health, task status, exact cancellation, target destroy, and the existing sandbox snapshot/restore/destroy/onboard commands for recovery.
• Do not add terminal-specific or recovery-private APIs.
• Keep task pause, guide, respond, events, logs, and plans unadvertised.

Recovery and state decisions

• Preserve the whole-readiness digest, applied-policy, inference, target, adapter, task, result, and evidence bindings from earlier slices.
• Journal possible external effects before invocation and retain reconciliation across process restart, inference change, rebuild, snapshot restore, sandbox destroy attempts, and compare-and-swap conflict.
• Never infer success from expected task values or prior candidate output. Reobserve target/task state through the exact current adapter authority.
• While reconciliation is non-null, allow only the exact observation, observed-task cancellation, target reset/destroy, and status operations required to converge.
• Detach, rebuild, restore, or sandbox destruction is not a shortcut around unresolved reconciliation.
• Reset must return a distinct target identity, verify the manifest-pinned target/service tuple and all three health checks, and clear stale security/task/result authority.
• Reset is denied before adapter execution while an active task or uncertain task effect exists. The denial preserves task and reconciliation authority; only the exact observed cancellation/reconciliation path can clear the gate.
• Sandbox recreation restores only declared coordinator/result state. Runtime readiness, target authority, security attestation, active tasks, private evidence, adapter snapshots, transport, and disposable target/session credentials must be reacquired. Provider credentials remain in their existing host-side OpenShell ownership boundary and are reused or removed only by that established lifecycle.
• Preserve no task input, file contents, endpoint, host path, credential, or transport handle in public state, snapshots, diagnostics, or backups.

Tests and acceptance

• Every CUA vertical slice 1: Install and inspect a candidate worker #7755, [Deferred] CUA: Connect one disposable target through existing policy controls #8450, and [Deferred] CUA: Run and verify a browser-form task #8449 acceptance criterion remains passing.
• The real runtime completes the terminal task and an independent oracle verifies exact path and bytes.
• Exact task cancellation returns a validated final result and leaves no active task.
• A fresh CLI process reconnects through public status without private registry access.
• Timeout, malformed output, process failure, restart, and row conflict preserve the reconciliation gate.
• Only fresh observation followed by exact cancellation/reset/destroy clears uncertain state.
• Reset validates a distinct target identity and complete three-service health before recording authority.
• Reset rejects active and uncertain tasks before adapter execution and preserves the complete task/reconciliation record.
• Same-name sandbox recreation and in-place snapshot restore recover only declared state and reacquire all non-durable authority.
• Browser and terminal journeys pass after recreation with distinct target/task/evidence identities.
• Every command in the public lifecycle table passes on the exact PR head; no recovery step reads private registry state or invokes direct OpenShell lifecycle workarounds.
• The terminal, cancellation, restart, uncertain-effect, reset, recreation, and cleanup live journey passes with the real pinned runtime and target on that exact head.
• The PR publishes the cumulative row-by-row [Deferred] Preserve CUA security, authority, and recovery invariants #7754 prototype extraction receipt for its exact base and head SHAs.
• Repository, docs, package, E2E-support, applicable live E2E, and exact-head documentation writer checks pass.

Exclusions

• DOCX/computer or integrated three-capability qualification.
• General backup, target fleet, or cloud control-plane behavior.
• Final availability, feature enablement, or product support.

Stack position

• Required cumulative bases: CUA vertical slice 1: Install and inspect a candidate worker #7755, [Deferred] CUA: Connect one disposable target through existing policy controls #8450, and [Deferred] CUA: Run and verify a browser-form task #8449.
• Architecture record: Define the CUA architecture and trust boundaries #7750.
• Security/state record: [Deferred] Preserve CUA security, authority, and recovery invariants #7754.
• Release gate: [Deferred] Verify the cumulative CUA release gate on Brev #7753.
• The computer/integrated journey in [Deferred] CUA: Run a computer task and the integrated journey #7752 follows and must preserve all earlier journeys.

[jyaunches]

Deferred after #9649/#9657 and not an MVP dependency. Re-refine only after the first-class target/security and browser-task work is deliberately resumed; remove the candidate/qualification assumptions before implementation.