[Epic] Support native Windows through OpenShell MXC

[senthilr-nv]

Outcome

NemoClaw can install and operate an accepted set of agent runtimes natively on supported Windows hosts through the OpenShell Microsoft Execution Containers (MXC) driver. The supported path does not require Docker Desktop, Windows Subsystem for Linux (WSL), or a Linux virtual machine.

NemoClaw continues to use the OpenShell CLI and OpenShell gateway as its sandbox control boundary. NemoClaw does not call wxc-exec.exe or MXC APIs directly.

Opening this epic establishes a product-decision record. It does not by itself approve or advertise native Windows support. Production activation remains absent until maintainers accept the scope and every applicable acceptance criterion passes.

Context

Issue #7744 establishes the driver-neutral runtime foundation used by Docker, Podman, and a socket-free MXC-style contract fixture. It explicitly excludes production MXC enablement. PR #7990 landed the initial RuntimeProviderBundle foundation. The provider-neutral and trusted qualification seams have since advanced through PR #9232; buildless and Podman activation remain in issues #9140 and #9145. This epic consumes each applicable seam as a dependency graph and owns the separate native Windows product surface.

NVIDIA/OpenShell#2050 tracks native Windows and MXC implementation. RFC 0013 landed through NVIDIA/OpenShell#2071 on 2026-08-17 and remains in review. NVIDIA/OpenShell#2721 merged on 2026-08-27 at merge commit bcd517bbe08cc80860c9be57699390cd32e8445f, landing the native Windows MXC compute driver and server wiring. The tested prototype v0.0.24 reports source revision e1b48323e4efcb560900508bdcd76d2b5d216678, which is not resolvable in the public OpenShell repository, and supplies wxc-exec.exe separately. The merged implementation establishes upstream availability but does not by itself establish an accepted NemoClaw distribution. Current qualification therefore remains prototype evidence until OpenShell publishes or identifies an exact accepted package and version contract. NemoClaw depends on accepted and versioned OpenShell contracts. This epic does not authorize changes in NVIDIA/OpenShell; required OpenShell changes must use that repository's governance.

Feasibility validation shows enough of the OpenShell/MXC path to begin the product decision and NemoClaw integration planning. It does not establish compatibility or support. Production activation also depends on supported Microsoft Windows and MXC components.

The current OpenShell/MXC integration is expected to support the complete OpenClaw workflow through process_container. Hermes requires isolation_session because its workflow depends on a persistent container lifecycle. NemoClaw must verify this agent-to-backend split against an updated OpenShell/MXC build before treating either profile as validated or supported.

Problem statement

NemoClaw currently assumes Linux, Docker, or WSL across installation, gateway ownership, sandbox images, agent startup, filesystem paths, networking, lifecycle recovery, and local inference.

Native Windows has no accepted NemoClaw contract for:

• installing or attaching to an exact OpenShell Windows distribution;
• selecting and validating the MXC compute driver;
• identifying a Windows agent package without an OCI image;
• binding an integrity-qualified Windows agent artifact to each per-sandbox workload request;
• translating NemoClaw filesystem and network policies without broadening them;
• preserving provider credential custody through managed inference;
• reporting unsupported interactive, forwarding, GPU, concurrency, or durability operations;
• stopping and destroying complete process trees;
• reconciling gateway state after restart;
• packaging, updating, diagnosing, and qualifying supported Windows agent runtimes; or
• activating support only for an exact, tested compatibility matrix.

Without these contracts, a Windows deployment is an engineering experiment that NemoClaw cannot advertise or support.

Desired behavior

On a supported native Windows host, a user can install NemoClaw and select an accepted OpenShell/MXC runtime without installing Docker Desktop or WSL.

NemoClaw must:

1. Resolve an exact Windows platform, OpenShell distribution, MXC backend, and agent artifact.
2. Run provider preflight checks before changing host or sandbox state.
3. Start or attach to the accepted OpenShell gateway lifecycle authority.
4. Create a sandbox through the OpenShell CLI and gateway.
5. Apply the declared filesystem and network policies without broader effective access.
6. Start the selected agent through a per-sandbox workload contract.
7. Route inference through the accepted managed-inference boundary without exposing the upstream provider credential to the agent process.
8. Expose only operations supported by the active OpenShell/MXC capability record.
9. Stop, recover, and destroy resources through immutable provider authority and exact cleanup evidence.
10. Report actionable errors for every unavailable prerequisite or operation.

Architecture boundary

Native Windows/MXC must extend the contracts from #7744. It must not create a parallel runtime architecture.

• Register one identity-consistent RuntimeProviderBundle for the accepted Windows/MXC runtime profile.
• Keep runtime selection, preflight, gateway access, workload creation, lifecycle, mutation authority, managed bootstrap, snapshot, recovery, cleanup, and the operation-scoped container-engine component behind that bundle.
• Return typed unsupported results from container-engine and other facets that have no MXC operation. Do not implement a fake container engine.
• Keep central onboarding, lifecycle, inference, snapshot, recovery, and cleanup code free of mxc identity switches.
• Keep OpenShell driver identity separate from OpenShell gateway lifecycle authority.
• Obtain capability and effective-policy results from an accepted OpenShell contract. Do not infer support from a backend name or one tested host.
• Represent Windows agent software with an immutable non-OCI artifact identity. Do not represent a Windows package as a fake OCI image.
• Adapt the transactional bootstrap guarantees from [Epic] Support native Podman with buildless managed onboarding #7744 to the accepted OpenShell/MXC workload operations. Do not fabricate image inspection, replacement, readiness, receipt, rollback, or cleanup evidence.

Product decision required

Maintainers must accept this epic before any PR activates native Windows/MXC support. The accepted decision must define:

• product and engineering ownership;
• the first supported agent runtime or agent set;
• supported Windows editions, builds, architectures, and update channels;
• supported OpenShell, MXC, and wxc-exec.exe versions and feature sets;
• binary signing, package provenance, distribution, update, and vulnerability-response ownership;
• the selected MXC backend for each accepted agent profile and every required backend capability;
• the OpenShell gateway install or attachment model, lifecycle authority, service identity, state directory, mTLS certificate lifecycle, upgrade, and uninstall behavior;
• the Windows agent execution identity, integrity level, privileges, filesystem ACLs, state layout, and startup contract;
• the technical-preview boundary and the production activation boundary;
• required managed-inference providers, API families, credential custody, privacy behavior, and audit events;
• whether interactive connect, exec, port forwarding, dashboards, GPU access, and local inference are required, unsupported, or deferred;
• concurrency limits and proxy attribution requirements;
• persistence, restart reconciliation, orphan discovery, recovery, snapshot, rebuild, backup, restore, and destroy boundaries;
• validation hardware, protected E2E ownership, and exact evidence requirements; and
• support lifecycle and compatibility policy after activation.

OpenShell and MXC dependencies

The accepted scope must receive versioned behavior for every OpenShell/MXC dependency it requires:

• a supported Windows CLI and OpenShell gateway distribution;
• an accepted gateway lifecycle and state contract;
• a per-sandbox executable, arguments, environment, working directory, filesystem shares, policy identity, and immutable workload identity. OpenShell PR feat(onboard): extend web search onboarding to Gemini and Tavily #2721 supplies the request-scoped command, optional cwd, and sandbox/template environment boundary; NemoClaw must qualify the artifact provenance bound to it;
• stable sandbox, workload, proxy, and lifecycle-generation identifiers;
• backend identity, capability schema, effective-policy acknowledgement, and explicit unsupported-policy rejection;
• read-write, read-only, and deny-by-default filesystem-policy behavior;
• governed egress with direct-access denial, endpoint allow and deny behavior, TLS trust, credential rewrite, privacy routing, and denial and activity events where required;
• complete process-tree start, stop, crash, destroy, and idempotent cleanup behavior;
• restart reconciliation, orphan discovery, and bounded cleanup when durability is required;
• a declared concurrent-sandbox limit and per-sandbox proxy attribution;
• interactive connect, exec, and port forwarding when the accepted scope requires them;
• GPU and host-local inference only when an accepted OpenShell/MXC design supplies those capabilities; and
• an explicit Windows and MXC host prerequisite contract.

An unsupported security or lifecycle requirement must fail before resource mutation. OpenShell and NemoClaw must not accept a request and silently enforce a broader or weaker contract.

Delivery sequence

Native Windows/OpenShell MXC support will be delivered through the existing runtime-neutral architecture rather than as a parallel runtime path:

1. Complete each applicable provider-neutral seam from [Epic] Support native Podman with buildless managed onboarding #7744 before its dependent MXC surface uses it. Treat [Epic] Support native Podman with buildless managed onboarding #7744 as a dependency graph, not a strict waterfall: dormant package-independent contracts and tests may proceed, while selectable, mutation, bootstrap, recovery, cleanup, and activation behavior must wait for their applicable provider-neutral seams. PR refactor(runtime): add provider lifecycle and mutation parity #7990 established the structural RuntimeProviderBundle contract.
2. Land native Windows host qualification. PR feat(onboard): add Windows MXC host qualification #8236 landed the inactive, fail-closed assessment for the candidate process_container host floor; it does not register or activate MXC support.
3. Extend the workload and receipt contracts to represent an immutable non-OCI Windows agent artifact, executable, arguments, environment, working directory, and bootstrap evidence without fabricating an OCI image. PR feat(onboard): define native artifact workload contract #8243 landed the inactive receipt contract; it does not register or activate MXC.
4. Add an inactive, identity-consistent OpenShell/MXC provider bundle. PR feat(onboard): add inactive OpenShell MXC provider #8271 landed the candidate behind typed fail-closed capability surfaces; it remains absent from production selection. NemoClaw continues to use the OpenShell control plane and does not call wxc-exec.exe or MXC APIs directly.
5. Complete the opt-in, non-activating OpenClaw process_container qualification and launch-contract foundations. PR test(e2e): qualify MXC forwarded OpenClaw chat #10237 added exact identities, authenticated forwarding, exact CHAT_OK, repeated execution, and sandbox-owned cleanup; PR fix(e2e): remove MXC token artifacts after failure #10304 made test-artifact cleanup unconditional; PR fix(e2e): observe MXC forward readiness #10313 bounded transient forward-readiness observation; PR test(e2e): record MXC startup exit evidence #10333 added typed startup-exit evidence; and PR test(mxc): correct Windows qualification launch contract #10354 aligned staging, temporary directories, and forward cleanup with the physical Windows result. These merged slices do not add production selection or a support claim.
6. Run the checked-in harness on a physical host against an exact pinned Windows, OpenShell, MXC/wxc-exec.exe, OpenClaw artifact, and current merged NemoClaw revision. A local inactive diagnostic based on NemoClaw 4d4e30eb completed two consecutive x64 Windows 10.0.28120 cycles through sandbox creation, readiness, filesystem allow and deny checks, authenticated forwarding, exact mock-backed CHAT_OK, deletion, process termination, registry removal, forward shutdown, artifact cleanup, and recreation. This is qualification evidence, not support: the run used an elevated host, prototype OpenShell v0.0.21, a credential-free mock model, and a shallow drive-root staging workaround. The gate remains open until the exact merged revision passes repeatedly with the accepted OpenShell distribution. The shallow path avoids MXC-02 for this workload but does not fix the underlying nested-path traversal defect. After PR feat(runtime): bind MXC bootstrap operations #10418 merged, exact NemoClaw revision 85142fb4e6530e0a5777246b5e0eed4099adf9da passed two independent target invocations against the pinned prototype package. Each invocation completed two create, chat, delete, and recreation cycles, for four passing cycles total. Exact current main revision 7409b8fcef5749fda938fcd09072bd50ba90fe73 then passed two consecutive cycles against prototype OpenShell v0.0.24, external wxc-exec.exe, Node.js 22.22.3, and OpenClaw 2026.7.1 on x64 Windows 10.0.28120. Both cycles passed exact identity, filesystem allow and deny checks, authenticated forwarding, exact mock-backed CHAT_OK, deletion, workload termination, registry removal, forward shutdown, sensitive-artifact cleanup, and recreation without stale state. This remains prototype qualification on an elevated host, not acceptance of a distribution or support.
7. Use the pinned evidence to accept the reduced technical-preview scope and versioned per-sandbox workload and lifecycle contracts. Cover stable sandbox and workload identity; structured executable, argument vector, working directory, environment references, and shares; capability and effective-policy acknowledgement; readiness and failure evidence; stop, delete, process-tree cleanup, and idempotency; and the accepted restart and orphan boundary. When the accepted backend permits concurrent sandboxes, use two simultaneous sandboxes with different workload descriptions to prove isolation of request-scoped values. Otherwise, use two sequential distinct workloads and explicit concurrency rejection so the proof does not expand the supported scope.
8. Implement and review dormant native-artifact bootstrap and lifecycle facets behind the inactive provider while the evidence and OpenShell contracts co-evolve. PR feat(runtime): add inactive MXC native bootstrap #10358 landed this dormant slice. It remains absent from production selection and activation and satisfies the provider-owned evidence-to-launch trust boundary. Exact merged revision 85142fb4e6530e0a5777246b5e0eed4099adf9da passed two independent qualification invocations after PR feat(runtime): bind MXC bootstrap operations #10418 merged, so dormant onboarding implementation may proceed while registration and activation remain gated.
9. Land the provider-owned MXC verifyAndCreate and readiness operations adapter behind the inactive bundle. PR feat(runtime): bind MXC bootstrap operations #10418 landed the exact artifact and executable identity binding, typed creation and readiness evidence, and fail-closed recovery for substitution, ambiguous creation, and identity drift. It remains disconnected from production selection and activation.
10. Complete dormant existing-installation and runtime composition. PR feat(runtime): validate MXC OpenShell attachment #10459 landed the inactive attach-existing identity contract. PR feat(runtime): observe existing MXC installations #10467 landed the existing-installation observer. PR feat(runtime): compose inactive Windows MXC attachment #10502 composes native Windows host and package observation with separate exact OpenShell and MXC roots. PR feat(onboard): compose inactive Windows MXC onboarding #10506 composes the qualified attachment with inactive provider-owned start and recovery. PR feat(onboard): add dormant MXC distribution authority #10591 binds the exact development checkpoint to provider-owned qualification authority. PR feat(runtime): add trusted Windows OpenShell executor #10596 adds the trusted physical Windows OpenShell executor. PR test(e2e): compose inactive Windows MXC onboarding #10600 composes distribution authority, fresh observation, trusted execution, request-scoped OpenShell operations, and inactive onboarding for qualification. These slices do not install, select, or activate MXC.
11. Accept one exact OpenShell Windows distribution contract and bind it to a provider-owned attachment authority source. The source must be independent of host observation; prototype package paths, caller-supplied measurements, and hashes derived from the files being attached cannot mint acceptance.
12. Run the merged qualification-only inactive onboarding composition on a physical Windows host. PR test(e2e): compose inactive Windows MXC onboarding #10600 provides the deterministic composition boundary but does not provide accepted-package physical evidence. Bind each run to the accepted authority plus exact NemoClaw, Windows, OpenShell, MXC/wxc-exec.exe, Node.js, and OpenClaw identities. Require repeated create, readiness, authenticated forwarding, chat, policy, delete, and cleanup evidence before installer work consumes the candidate.
13. Add native Windows installation or accepted existing-installation attachment. Detect the host matrix, verify package integrity, perform or request host preparation, configure the gateway, and define update, repair, and uninstall ownership without Docker or WSL.
14. Add provider-neutral native Windows onboarding. Select MXC only after qualification, preserve exact provider and workload authority, configure accepted state paths, create the OpenClaw process_container, establish authenticated forwarding, and persist lifecycle identity. Keep central orchestration free of MXC identity branches.
15. Add Windows filesystem policy, governed egress, and managed-inference credential custody. Prove allowed and denied access, direct-egress denial, credential non-disclosure, and a real agent request through the accepted inference route.
16. Add the lifecycle and recovery behavior required by the accepted preview. Cover status, stop, destroy, process-tree and forward cleanup, failed or ambiguous creation recovery, the accepted restart and orphan boundary, and the approved privilege model.
17. Add protected E2E from a clean supported Windows host. Run install, preflight, onboard, create, readiness, authenticated chat, policy checks, stop, destroy, cleanup, repair, and uninstall against the exact accepted matrix.
18. Activate only the accepted technical-preview or production profile. Add production provider registration, normal CLI selection, support documentation, and compatibility claims only after every applicable product and evidence gate passes.

OpenClaw through process_container is the immediate first technical-preview candidate, not accepted support. Its dormant package-independent contracts and non-activating qualification harness may proceed while provider-neutral and OpenShell contracts co-evolve; real selectable, mutation, recovery, and activation behavior must wait for their applicable gates. Hermes remains a later profile because its persistent workflow depends on Microsoft and OpenShell isolation_session changes. When that backend is ready, Hermes must consume the same provider bundle, workload identity, lifecycle and capability, policy, recovery, cleanup, qualification, and activation seams. Do not add an OpenClaw-only central architecture or an MXC backend switch to central orchestration. Neither profile is supported until its applicable activation gates pass.

Peer development entry point

Start from current main. MXC remains an inactive candidate: it is absent from production provider registration, normal CLI selection, public onboarding, and support documentation.

Completed prerequisites:

• #10502 composes trusted native Windows host and package observation with separate OpenShell and MXC roots.
• #10506 composes qualified attachment with inactive provider-owned start and recovery.
• #10513 binds the physical qualification target to exact distribution inputs and native stable-file observation. Exact merged revision 81d5934bc8b5f2013b8ee03ccb84469ae3693d9b passed two consecutive prototype v0.0.24 cycles covering identity, create, readiness, filesystem allow and deny behavior, authenticated forwarding, exact mock-backed CHAT_OK, delete, termination, registry removal, forward shutdown, sensitive-artifact cleanup, and clean recreation.
• #10596 adds the dormant trusted physical Windows executor while preserving stable-file authority through OpenShell mutation and rejecting direct MXC execution.
• #10600 adds the qualification-only composition of provider authority, fresh observation, trusted execution, request-scoped OpenShell operations, and inactive onboarding. It does not establish accepted-package physical qualification.
• A clean-location regression package covering MXC-02, MXC-03, forwarding, chat, lifecycle, and cleanup was rehearsed and shared with the OpenShell MXC team. MXC-02 remains a known arbitrary deep-path limitation; the accepted shallow state root is a workload workaround, not a general fix.

OpenShell PR #2721 supplies the request-scoped workload boundary needed by NemoClaw's merged MxcNativeArtifactControlPlane. Gateway configuration contains host runtime settings, while each sandbox create supplies the MXC command and optional cwd through template.driver_config.mxc; environment values come from the sandbox and template environment maps. OpenShell does not attest the hashes or versions of those files. The merged NemoClaw composition binds provider-owned stable-file observation and the qualified artifact receipt to that per-sandbox request and fails closed if identity drifts before creation or readiness.

The next gate is accepted-package physical qualification through #10585. The run must:

1. accept provider-owned attachment authority separately from untrusted host observation and never derive acceptance from local files, caller-supplied hashes, or prototype measurements;
2. call the merged qualification-only inactive onboarding composition rather than MXC or wxc-exec.exe directly;
3. reuse the checked-in target's exact identity, create, readiness, policy, authenticated forward, chat, delete, recovery, and cleanup evidence;
4. fail before OpenShell control-plane mutation when authority is missing, malformed, substituted, or inconsistent with fresh observation; and
5. keep production selection and activation absent.

Package-independent input projection or fail-closed tests may proceed only when they add evidence not already owned by the attachment, observer, onboarding, and bootstrap tests. Do not add another wrapper around the inactive onboarding composition. Live mutation work must use the request-scoped OpenShell create path and wait for an accepted OpenShell Windows distribution, separate MXC/wxc-exec.exe provenance, supported host and privilege contract, and repeated accepted-authority physical qualification. Those gates remain required before native installation, normal selection, protected qualification, or activation. PR #10600 closed #10585 through GitHub linkage, but the required accepted-package physical evidence is not complete; keep #10585 open until that evidence is recorded.

Stop and return to this epic if the slice requires a central mxc switch, direct MXC access, broader policy, credential exposure, authority minted from observation, or separate host verification followed by a later create. Detailed prototype evidence is recorded in the qualification update.

NemoClaw workstreams

Runtime and platform

• Add native Windows platform detection that does not depend on WSL signals.
• Add an inactive Windows/MXC runtime profile that consumes [Epic] Support native Podman with buildless managed onboarding #7744's provider registry and capability contracts.
• Persist exact provider, driver, backend, gateway, workload, artifact, and lifecycle identities.
• Reject an incomplete or identity-inconsistent provider bundle.

Installation and configuration

• Add a PowerShell installation and preflight path for the accepted host matrix.
• Install an exact approved OpenShell package or attach to an accepted existing installation.
• Configure the OpenShell gateway and MXC driver without Docker, WSL, Linux package managers, or Linux service assumptions.
• Use the accepted shared installer configuration schema when available. Do not create an MXC-only competing format or place credentials in declarative configuration.
• Define ownership-aware update, repair, and uninstall behavior.

Agent artifact and bootstrap

• Define an integrity-verifiable Windows artifact for every accepted agent runtime.
• Bind agent version, package and executable digests, source revision, startup-profile version, architecture, and required OpenShell/MXC contract versions.
• Stage and start the agent through the accepted per-sandbox workload and transactional bootstrap contracts.
• Keep the untrusted agent workload stopped until the required bootstrap authority and state are committed.

Policy and managed inference

• Add Windows filesystem policies with native paths and tested ACL semantics.
• Preserve deny-by-default network policy and host-side proxy enforcement.
• Keep provider credentials outside sandbox state, process environments, logs, receipts, and evidence artifacts.
• Validate inference routes, TLS trust, credential rewrite, privacy behavior, denial events, and activity events before managed inference is advertised.
• Treat direct provider access from the agent as unsupported for the managed-inference path.

Lifecycle and recovery

• Make status, doctor, start, stop, destroy, rebuild, snapshot, backup, restore, and recovery consume provider capabilities rather than Docker assumptions.
• Use exact immutable authority for destructive operations. Do not destroy by mutable name alone.
• Record incomplete cleanup as a typed result that preserves the owning runtime and required remediation.
• Reconcile or explicitly reject restart recovery according to the accepted durability boundary.

Validation and documentation

• Add deterministic source, integration, package-contract, and E2E-support tests.
• Add a gated live E2E target for each accepted Windows/MXC profile.
• Bind evidence to exact NemoClaw, OpenShell, MXC, agent-artifact, configuration, and host revisions.
• Test permitted and denied filesystem, network, process, credential, and lifecycle operations.
• Publish support documentation only after the matching activation gate passes.

Security invariants

• NemoClaw must use OpenShell as the sandbox boundary and must not call wxc-exec.exe directly.
• Unknown capabilities, policy loss, unsupported policy fields, and broader effective access fail closed.
• The agent process must not receive the upstream provider credential.
• Credentials and private keys must not appear in packages, configuration, command arguments, process environments, logs, receipts, or evidence artifacts.
• The accepted Windows execution identity must not receive host privileges that are outside the declared contract.
• Filesystem shares must use explicit native paths, access modes, and ACL evidence.
• Network access must remain deny by default and attributable to the exact sandbox workload.
• Destructive lifecycle operations require immutable provider, sandbox, workload, and lifecycle-generation authority.
• Gateway restart must not permit silent registry loss, unsafe name reuse, or unbounded orphaned processes when durability is claimed.
• Unsupported interactive, forwarding, GPU, inference, concurrency, or recovery behavior must remain unavailable rather than use a weaker fallback.
• Production registration remains absent until the exact supported matrix passes protected E2E.

Activation gates

Technical preview

A technical preview may activate only after maintainers accept its reduced scope and all requirements inside that scope pass. The preview must name every unsupported operation and durability boundary. It must not be documented as production support.

At minimum, the accepted preview must establish:

• exact host, OpenShell, MXC, agent-artifact, and backend identities;
• native installation or attachment without Docker or WSL;
• mTLS-authenticated OpenShell control-plane access;
• one accepted agent startup and readiness contract;
• positive and negative filesystem-policy behavior;
• direct egress denial and the accepted governed-egress behavior;
• managed inference when the accepted agent workflow requires it;
• credential non-disclosure;
• create, start, stop, crash, and destroy behavior required by the preview;
• capability-gated errors for every unavailable operation;
• bounded cleanup of every resource created by the preview; and
• a live E2E result on the exact accepted test profile.

Production activation

Production activation requires:

• a supported Microsoft Windows and MXC release for every advertised host profile;
• signed and versioned OpenShell, wxc-exec.exe, NemoClaw, and agent artifacts;
• the complete accepted agent, architecture, inference, and capability matrix;
• enforced filesystem and network policies with negative tests;
• managed-inference credential custody and event behavior;
• complete lifecycle, restart, recovery, and cleanup behavior required by the supported contract;
• the declared concurrent-sandbox limit and proxy attribution behavior;
• protected E2E bound to the exact release candidates and host profiles;
• installer, update, repair, and uninstall validation;
• evidence-backed security, platform-support, operation, and troubleshooting documentation; and
• no production registration or support claim before every required gate passes.

Constraints and non-goals

• Do not add native Windows/MXC activation to [Epic] Support native Podman with buildless managed onboarding #7744. This epic owns that product surface.
• Do not make OpenShell changes through a NemoClaw PR.
• Do not call wxc-exec.exe or MXC APIs directly from NemoClaw.
• Do not route MXC through Docker-named helpers or require a Docker-compatible socket.
• Do not represent a Windows workload as an OCI image when no OCI image exists.
• Do not reuse WSL or Docker Desktop networking, GPU, service, or platform assumptions for native Windows.
• Do not put provider credentials or other secret material in YAML or another declarative installer configuration.
• Do not silently skip a required security, lifecycle, inference, or durability capability.
• Do not claim support for an untested agent, host, architecture, backend, inference provider, GPU, or operation.
• GPU passthrough, local NIM or vLLM, interactive access, port forwarding, dashboards, and durable restart behavior remain outside the supported scope unless the accepted product decision includes them and the required evidence passes.
• Public issues and documentation must not contain internal host access details, unpublished package locations, credentials, or credential-bearing artifacts.

Open product questions

1. Will maintainers accept OpenClaw through process_container as the first technical-preview profile, and which additional evidence is required before that acceptance? Hermes remains a later candidate through isolation_session.
2. Which Windows editions, builds, update channels, and architectures are support candidates?
3. Does the updated OpenShell/MXC build validate the complete OpenClaw contract through process_container, and, if Hermes is accepted, the required persistent lifecycle through isolation_session? Which exact versions establish those bounds?
4. Does the accepted gateway lifecycle require a Windows Service, or can a bounded preview attach to an operator-launched gateway?
5. Which lifecycle operations and restart boundaries must the first preview support?
6. Is managed inference required for the first preview, and which API families and providers must pass?
7. Which OpenShell-owned, sandbox-scoped service-forwarding contract will satisfy OpenClaw host health, HTTP/WebSocket, and chat access with target binding, isolation, audit, readiness, and teardown? Interactive connect and exec remain separate scope decisions.
8. Are GPU access and local inference part of this epic or a separate future design?
9. What concurrent-sandbox limit and proxy-attribution behavior must OpenShell support?
10. Which Microsoft Windows/MXC release establishes the production host floor?
11. Which host-preparation and privilege boundary is accepted for the first preview: one-time elevated system-drive preparation and a narrow privileged OpenShell/MXC service with NemoClaw and sandboxed OpenClaw running as standard users, or another model?

Acceptance criteria

• Maintainers accept the product scope, ownership, threat model, compatibility matrix, and support lifecycle.
• [Epic] Support native Podman with buildless managed onboarding #7744 provides the provider, capability, lifecycle, bootstrap, mutation, recovery, cleanup, and activation contracts required by the accepted MXC profile.
• Required OpenShell/MXC dependencies have accepted upstream behavior and exact version bounds.
• Native Windows installation or attachment succeeds without Docker Desktop, WSL, or a Linux virtual machine.
• Preflight rejects an unsupported Windows build, architecture, OpenShell package, MXC feature set, or incomplete provider bundle before mutation.
• The selected agent artifacts are signed or integrity-verifiable and bound to exact source and startup-profile identities.
• NemoClaw creates the accepted agent sandbox through OpenShell without calling wxc-exec.exe directly.
• Each accepted agent profile uses its validated MXC backend: process_container for OpenClaw and isolation_session for Hermes, unless later accepted evidence changes that mapping.
• The agent runs with the accepted Windows identity, privileges, filesystem ACLs, and state layout.
• Read-write, read-only, deny-by-default, and unsupported filesystem policies produce the accepted effective behavior.
• Direct egress is denied and approved and undeclared destinations produce the accepted host-proxy behavior.
• Managed inference completes the accepted validation request without exposing the upstream provider credential.
• Sandbox state, process environments, logs, receipts, and evidence contain no provider credential material.
• Create, status, start, stop, crash, destroy, and cleanup behavior pass for the accepted lifecycle contract.
• Restart, reconciliation, orphan cleanup, snapshot, rebuild, backup, and restore pass when included in the accepted scope.
• Concurrent sandboxes remain isolated through the accepted limit, including proxy attribution and cleanup.
• Unsupported connect, exec, forwarding, GPU, inference, concurrency, or recovery operations return actionable typed errors.
• Central orchestration contains no MXC-specific runtime branch.
• Docker and every other supported runtime retain their required regression coverage.
• Protected live E2E passes for every accepted agent, host, architecture, backend, inference, and capability profile.
• Installer, update, repair, uninstall, security, operation, compatibility, and troubleshooting documentation matches the validated support matrix.
• A documentation writer reviews the implementation and documentation evidence.
• Production registration and support documentation remain absent until the complete activation gate passes.

Work tracking

• Bind the physical qualification target to exact distribution inputs and native stable-file observation (#10513). Exact merged revision 81d5934bc8b5f2013b8ee03ccb84469ae3693d9b passed two consecutive prototype v0.0.24 cycles, and the clean-location reusable regression package was rehearsed and shared. This remains prototype evidence; accepted distribution authority and activation gates remain open.
• Track the OpenShell dependency chain: RFC 0013 (NVIDIA/OpenShell#2071) and the native Windows MXC driver and server wiring (NVIDIA/OpenShell#2721, merge commit bcd517bbe08cc80860c9be57699390cd32e8445f) are merged. Bind qualification to an accepted released OpenShell package and exact MXC/wxc-exec.exe contract; the tested prototype v0.0.24 reports a source revision that is not resolvable in the public repository and does not authorize activation.
• Land the opt-in, non-activating OpenClaw process_container qualification harness after the inactive provider foundation (#8300), align it with the current process_container contract (#8388), add exact identity, authenticated forwarding, exact CHAT_OK, repeated-run, and cleanup qualification (#10237), make failed-run cleanup unconditional (#10304), bound transient forward-readiness observation (#10313), classify startup exits (#10333), and align the launch contract with physical Windows evidence (#10354).
• Land the inactive native-artifact bootstrap and lifecycle contract (#10358). It merged with the provider-owned evidence-to-launch trust boundary closed and remains absent from production selection and activation.
• Land the provider-owned MXC verifyAndCreate and readiness operations adapter behind the inactive bundle (#10418). It remains absent from production registration and activation.
• Run the checked-in harness against an exact pinned Windows, OpenShell, MXC/wxc-exec.exe, OpenClaw artifact, and current merged NemoClaw revision. After PR feat(runtime): bind MXC bootstrap operations #10418 merged, exact NemoClaw 85142fb4e6530e0a5777246b5e0eed4099adf9da passed two independent target invocations on x64 Windows 10.0.28120 with pinned OpenShell prototype 0.0.21 and OpenClaw 2026.7.1. Each invocation completed two cycles, for four passing cycles total. All cycles passed identity checks, creation, readiness, positive and negative filesystem checks, authenticated forwarding, exact mock-backed CHAT_OK, deletion, process and registry cleanup, forward shutdown, sensitive-artifact cleanup, and recreation. This qualifies the merged inactive candidate against the prototype package; the item remains open until the accepted OpenShell distribution repeats the result and the deferred mTLS, managed-inference, governed-egress, restart-recovery, product, and activation gates are resolved.
• Qualify the prototype OpenShell v0.0.24 package against exact current merged NemoClaw. Revision 7409b8fcef5749fda938fcd09072bd50ba90fe73 passed two consecutive checked-in harness cycles on x64 Windows 10.0.28120 with OpenShell v0.0.24, the separately supplied wxc-exec.exe, Node.js 22.22.3, and OpenClaw 2026.7.1. Both cycles passed exact identity, sandbox creation, readiness, positive and negative filesystem checks, authenticated forwarding, exact mock-backed CHAT_OK, deletion, workload and registry cleanup, forward shutdown, sensitive-artifact cleanup, and recreation without stale state. The package keeps wxc-exec.exe outside its distribution, so feat(runtime): compose inactive Windows MXC attachment #10502's separate exact roots remain required. This is elevated-host prototype evidence; accepted distribution authority, mTLS, managed inference, governed egress, restart recovery, standard-user operation, product scope, and activation remain open. isolation_session is not included and remains a later Hermes dependency.
• Track MXC-02 as an upstream nested-path traversal defect. The shallow OpenShell-controlled state and artifact root is a validated workload workaround, not a general fix or a reason to broaden filesystem access.
• Use the pinned evidence to accept product scope, ownership, threat model, reduced technical-preview boundary, compatibility matrix, and activation boundaries.
• Qualify and version the required per-sandbox OpenShell/MXC workload and lifecycle contracts and host prerequisites.
• Validate the complete OpenClaw workflow through process_container, including long-running execution, policy enforcement, managed inference when required, lifecycle cleanup, and the accepted restart boundary.
• If Hermes is included in the accepted scope, validate its persistent lifecycle requirements through isolation_session, record every remaining OpenShell, MXC, and Microsoft dependency, and reuse the same provider-neutral integration and activation seams.
• Land the inactive native Windows runtime profile and fail-closed capability gates (#8271). Production registration remains absent.
• Land dormant native Windows attachment and start or recovery composition. #10459 landed attachment identity, #10467 landed existing-installation observation, #10502 composed host and package observation, and #10506 composed qualified start and recovery. Production selection and activation remain absent.
• Bind the exact OpenShell v0.0.24 and MXC v0.7.0-rc1 development checkpoint to a provider-owned qualification authority (#10591, squash merge dc2e2a961d66ad01fca0dc374610a8eba71df852). This is not stable distribution acceptance and does not enable selection or activation.
• Land the trusted physical-Windows OpenShell executor (#10596, squash merge 6deb8e273604300d3bb843fee654acd4b0549495). It holds fresh stable-file authority through mutation, invokes only the qualified OpenShell CLI, and reports OpenShell v0.0.24 name-only cleanup as possibly retained rather than deleting without immutable sandbox-ID authority.
• Accept one exact OpenShell Windows distribution and bind it to a provider-owned attachment authority source that is independent of host observation. Prototype measurements remain qualification evidence and cannot mint this authority.
• Confirm the upstream per-sandbox workload request boundary. OpenShell PR feat(onboard): extend web search onboarding to Gemini and Tavily #2721 moved the required command and optional working directory into template.driver_config.mxc / --driver-config-json, with environment values supplied through the sandbox and template maps; gateway configuration contains host runtime settings only.
• Bind NemoClaw's provider-owned artifact and executable provenance to the request-scoped create path and reject identity drift before creation or readiness (#10533). OpenShell's command request does not itself attest file hashes or versions, so the merged contract keeps that authority in the inactive provider.
• Land the dormant OpenShell live-operations boundary that projects the qualified request into exact create, readiness, label-scoped recovery, and sandbox-ID cleanup operations (#10538, squash merge b80e47c89e346c0fee8e5a28c4ffa03cfaa1786d). This remains non-activating and does not accept a distribution or provide the trusted physical Windows executor.
• Land the qualification-only composition of provider authority, fresh observation, trusted execution, request-scoped OpenShell operations, and inactive onboarding (#10600, squash merge 78f0c9b7db15b22d83024bcda510ae0cebefb118). It remains absent from normal onboarding, selection, and activation.
• Run the checked-in Windows target through that composition after accepted distribution authority exists. Repeat the exact pinned OpenClaw process_container run on physical Windows and preserve identity, policy, chat, recovery, and cleanup evidence in Qualify the accepted Windows OpenShell MXC profile #10585.
• Add native Windows installation or accepted existing-installation attachment, configuration, preflight, update, repair, and uninstall behavior after the OpenShell distribution and privilege contracts are accepted.
• Add provider-neutral native Windows onboarding without Docker, WSL, a central MXC branch, or production activation.
• Add Windows filesystem policy and governed-egress integration.
• Add managed inference, credential custody, privacy, and event integration.
• Add concurrency, restart, recovery, and exact-cleanup behavior required by the accepted scope.
• Add deterministic tests and protected Windows/MXC E2E qualification.
• Publish evidence-backed documentation and activate only the accepted support matrix.

Category

Platform

Checklist

• I searched open and closed issues and this is not a duplicate.
• I described the problem and desired behavior.

[senthilr-nv]

Contract audit update (2026-08-04):

• PR refactor(runtime): add provider lifecycle and mutation parity #7990 supplies the provider-neutral RuntimeProviderBundle seam, so native Windows/MXC should extend it rather than introduce a separate runtime path.
• The current workload and persisted receipt contracts still identify either a Linux OCI image or a legacy Dockerfile. They cannot yet represent [Epic] Support native Windows through OpenShell MXC #8178's required immutable, non-OCI Windows agent artifact. An MXC provider must not become selectable by disguising a Windows package as either form.
• Active [Epic] Support native Podman with buildless managed onboarding #7744 slices are still changing provider activation, mutation, and qualification contracts (feat(runtime): add provider activation catalog #8063, feat(runtime): define provider state-mutation contract #8186, and test(e2e): define native runtime activation qualification #8062). The MXC work should consume those contracts as they land and avoid competing edits to their central composition files.
• OpenShell's current architecture distinguishes the OpenClaw candidate path from Hermes: process_container targets Windows 11 build 26100+ and supports governed egress, while isolation_session additionally requires Insider build 26300.8553 plus IsoSessionApp.dll and still has the known Microsoft dependencies. The MXC driver README currently states 26300.8553 for all live runs, so the exact supported OpenClaw host floor remains an upstream documentation/versioning question.

Sequencing decision: begin with a package-independent, inactive host-qualification contract for the Windows x64 + process_container candidate and deterministic tests. This slice will not register a production provider, select MXC, call wxc-exec.exe, install artifacts, or claim Windows support. Provider activation and workload bootstrap remain gated on the non-OCI artifact/receipt contract and an exact updated OpenShell Windows distribution.

[senthilr-nv]

Implementation update:

• Opened feat(onboard): add Windows MXC host qualification #8236 as the first inactive, package-independent [Epic] Support native Windows through OpenShell MXC #8178 slice.
• The PR adds a versioned host-facts assessment for the Windows x64 process_container candidate.
• It fails closed for non-Windows hosts, unqualified architectures, malformed release data, and builds below 26100.
• It does not register or select MXC, call wxc-exec.exe, install OpenShell, model the Windows agent artifact, or claim Windows support.
• Local evidence on commit f808c2354: 13 focused source tests passed; CLI type-check, repository checks, normal Git hooks, secret scan, and independent documentation writer review passed.

The next integration slice remains the immutable non-OCI Windows agent artifact and receipt contract. That work must converge with #7744 before an MXC provider can become selectable. Package-dependent OpenShell/OpenClaw E2E work remains gated on the exact updated Windows distribution.

[senthilr-nv]

Progress update: #8243 adds the inactive non-OCI artifact/workload receipt for a pinned OpenClaw Windows payload. It is an independent foundation PR from current main; it does not register or activate an MXC provider and changes no supported behavior. #8236 remains the separate Windows host-qualification foundation. After these contracts land, the next code milestone is an inactive MXC provider that consumes the shared runtime foundation and this receipt. Activation remains a later step gated on protected live E2E against the exact OpenShell, MXC, Windows, and OpenClaw version set.