fix(fabric): stop agents when removing their attachment

[HOYALIM]

Closes #13234.

Failure

Removing fabric_agent forgot its binding while its agent kept running with the configuration applied. The image bridge had no configuration-free stop operation.

Decision

Add fabric-agent stop --agent NAME --expected-generation GENERATION. The provider observes the sandbox identity and agent generation, then sends one stop request. The image host stops its runtime and clears its configuration under the existing generation guard. Removal leaves the sandbox and agent files in place.

An absent sandbox needs no exec. An unsupported or unconfirmed stop fails removal and retains the attachment; older images receive rebuild guidance. Existing six-operation catalogs remain readable, while rebuilt images advertise stop as a seventh operation. Unknown or duplicate operations remain rejected.

Validation

Tested source: 749125f3efe1f47221775858e4a50e929451d60e, based on 530313aec1637c488ea73c969a7c947aad53b60a. The new stop regression was observed failing before implementation.

Boundary	Observed result
Remove a configured agent through OpenTofu	Agent configuration cleared; sandbox retained; subsequent apply does not repeat removal
Sandbox already absent	Attachment removed without another exec
Image lacks stop	Removal fails with guidance; attachment and configuration retained
Stale generation or native stop failure	Image regression tests preserve the existing runtime association
Repeat a confirmed stop	No-op with stable generation

The OpenTofu cases use the pinned CLI and compiled providers against the fake OpenShell gateway. The image checks below execute the containerized bridge/reference adapter; they do not stand in for a live OpenShell deployment.

Environment and command	Result
macOS ARM64, Rust 1.98.1: CARGO_BUILD_JOBS=2 NEXTEST_TEST_THREADS=4 cargo ci --full	All steps passed: formatting, Clippy, build, 1,488 unit tests, 4 doctests, schemas, bundle, 148 lifecycle tests. 185 unit and 40 lifecycle tests skipped by their profiles.
Linux ARM64 image: AGENT_PLATFORM=linux/arm64 docker buildx bake reference-tests	25 passed; test networking disabled
Linux ARM64 image: AGENT_PLATFORM=linux/arm64 docker buildx bake lint unit-tests	Ruff clean; 81 passed, 2 conditional skips
target/ci-runner/debug/nemoclaw-build images qualify nc-pr13234:dummy --lifecycle dummy --require-ready	8 command-interface tests passed
target/debug/nemoclaw-build docs --check; Node 24.21.0 target/debug/nemoclaw-build fern check	Documentation check passed; Fern 0 errors, authenticated published-redirect check skipped

The qualified local image is sha256:06dc942a3b6bceece36a588df095fda40ceb3121e9b2078a2826aab748206522 (linux/arm64, Docker 29.8.2). It was built with the repository's images build command; no image was published.

An initial full run exposed a truncation fault left enabled in the existing Pi test's healthy teardown. The test now ends that fault after asserting the failed plan preserved state. An unrelated OpenShell test initially timed out with eight workers and passed with four; no timeout or budget was raised. macOS timing budgets are reported only, and some binary budgets were exceeded.

Linux/Windows native CI and the Linux-only live Docker/kind suites are deferred to the matching CI runners. GPU inference, a live agent backend and credentialed deployment were not exercised locally. This is functional evidence, not a performance claim.

Signed-off-by: Ho Lim subhoya@gmail.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cv]

Closing as superseded, and thank you for the careful work: the failure analysis and the boundary table were thorough.

Two changes made it unnecessary:

• feat(fabric-provider): stop the Fabric agent when fabric_agent is removed #13298, merged on 16 October, already fixed Stop the Fabric agent when fabric_agent is removed #13234: removing fabric_agent stopped the agent through the bridge host's existing prepare operation, which used Fabric's own stop, without a new bridge operation.
• feat: run agents through Fabric's fabric-agent-ctl #13379 then replaced NemoClaw's own Fabric bridge with Fabric's fabric-agent-ctl sandbox host. image/fabric/fabric.py, bridge_protocol.py, bridge_contract.py and crates/fabric-provider/src/bridge.rs no longer exist. Removing an agent now calls fabric-agent-ctl stop, and the sandbox is replaced when its agent changes, since Fabric runs one runtime per sandbox.