feat(config): resolve shared and inline agent integrations

Shared definition and agent-inline tests initially failed because those
input locations were unsupported. Resolve named deployment/sandbox maps
through explicit agent integrationRefs, and attach agent-inline maps
directly. Reject missing or duplicate references and name shadowing.

Derive Brave resources and native grants from attached definitions while
preserving authored intent and the adapter wire contract. Leave unused
definitions inactive and retain the one-search-definition runtime limit.
Keep anchors, aliases, and YAML merges disabled. Regenerate the public
schema and field reference alongside the typed input changes.

Validation: cargo fmt --check, workspace Clippy with warnings denied,
cargo test --workspace, and the verified-bundle web-search lifecycle
fixture for deployment, sandbox, and agent-inline declarations. The
fixture covers export/reapply, drift rejection, and credential-free
teardown against local OpenShell responses, not live Brave service.

Author: cv

crates/nemoclaw-build/src/schema/reference.rs

@@ -178,7 +178,7 @@ fn guide(name: &str) -> &'static str {
         | "HermesInterfaces" | "HermesDashboard" | "HermesApi" | "HermesTui" => {
             "[Agent interfaces](../interfaces.md)"
         }
-        "Integrations" | "WebSearch" | "SearchProvider" | "Agent" | "AgentExecution"
+        "Integration" | "WebSearch" | "SearchProvider" | "Agent" | "AgentExecution"
         | "AgentObservability" | "OtlpTracing" | "RelayTracing" | "AgentTools" | "AllowedTool"
         | "ToolDisclosure" => "[Agent runtimes](../agents.md)",
         _ => "[Configuration and credentials](../usage.md#configuration-and-credentials)",

crates/nemoclaw-e2e/tests/deployment.rs

@@ -110,12 +110,17 @@ async fn hermes_interfaces_sdk_export_reapply_and_drift() {
 async fn web_search_cli_export_reapply_and_destroy() {
     let mut document =
         Document::parse(include_str!("../../../examples/fabric-openclaw.yaml").as_bytes()).unwrap();
-    document.spec.sandboxes[0].integrations = Some(
-        serde_json::from_value(serde_json::json!({
-            "webSearch":{"provider":"brave","agentRefs":["main"],"credential":{"env":"SEARCH_KEY"}}
-        }))
-        .unwrap(),
-    );
+    document.spec.integrations = serde_json::from_value(serde_json::json!({
+        "search":{"kind":"webSearch","provider":"brave","credential":{"env":"SEARCH_KEY"}}
+    }))
+    .unwrap();
+    document.spec.sandboxes[0].agents[0].integration_refs = vec!["search".into()];
+    lifecycle(&document.yaml().unwrap()).await;
+    document.spec.sandboxes[0].integrations = std::mem::take(&mut document.spec.integrations);
+    lifecycle(&document.yaml().unwrap()).await;
+    let sandbox = &mut document.spec.sandboxes[0];
+    sandbox.agents[0].integration_refs.clear();
+    sandbox.agents[0].integrations = std::mem::take(&mut sandbox.integrations);
     lifecycle(&document.yaml().unwrap()).await;
 }
 
@@ -150,6 +155,10 @@ async fn lifecycle_with_ownership(input: &str, declare_ownership: bool) {
             .path = Some("/docs/${file}/%{literal}".into());
     }
     document.spec.gateway.endpoint = fixture.endpoint.clone();
+    let has_search = !document.spec.sandboxes[0]
+        .integration_bindings(&document.spec.integrations)
+        .unwrap()
+        .is_empty();
     struct FixtureSecrets;
     impl nemoclaw_sdk::openshell::Secrets for FixtureSecrets {
         fn resolve(&self, name: &str) -> Result<String, nemoclaw_sdk::ObservationError> {
@@ -176,14 +185,7 @@ async fn lifecycle_with_ownership(input: &str, declare_ownership: bool) {
     let applied = deployment.apply(&document, &cancel).await;
     assert!(applied.is_ok(), "{applied:?}");
     let effects = fixture.state.lock().unwrap().effects;
-    assert_eq!(
-        effects,
-        if document.spec.sandboxes[0].integrations.is_some() {
-            6
-        } else {
-            4
-        }
-    );
+    assert_eq!(effects, if has_search { 6 } else { 4 });
     if declare_ownership {
         document.spec.inference_providers[0].management =
             Some(nemoclaw_sdk::config::Management::External);
@@ -236,7 +238,7 @@ async fn lifecycle_with_ownership(input: &str, declare_ownership: bool) {
             .is_empty()
     );
     assert_eq!(fixture.state.lock().unwrap().effects, effects);
-    if document.spec.sandboxes[0].integrations.is_some() {
+    if has_search {
         let state_bytes = fs::read(directory.path().join("terraform.tfstate")).unwrap();
         let key = format!("{}/nemoclaw-brave", document.workspace());
         let profile = fixture.state.lock().unwrap().profiles[&key].clone();
@@ -427,14 +429,7 @@ async fn lifecycle_with_ownership(input: &str, declare_ownership: bool) {
             .policy = original;
     }
     let preview = deployment.plan_destroy(&cancel).await.unwrap();
-    assert_eq!(
-        preview.changes.len(),
-        if document.spec.sandboxes[0].integrations.is_some() {
-            5
-        } else {
-            3
-        }
-    );
+    assert_eq!(preview.changes.len(), if has_search { 5 } else { 3 });
     assert_eq!(fixture.state.lock().unwrap().effects, effects);
     let destroyed = Command::new(
         bundle
@@ -466,11 +461,7 @@ async fn lifecycle_with_ownership(input: &str, declare_ownership: bool) {
             .unwrap()
             .changes
             .len(),
-        if document.spec.sandboxes[0].integrations.is_some() {
-            5
-        } else {
-            3
-        }
+        if has_search { 5 } else { 3 }
     );
 }
 

crates/nemoclaw-e2e/tests/web_search.rs

@@ -22,12 +22,11 @@ async fn search_owns_profile_and_provider_preserves_secret_custody_and_rejects_p
     let mut doc =
         Document::parse(include_str!("../../../examples/fabric-openclaw.yaml").as_bytes()).unwrap();
     doc.spec.gateway.endpoint = fixture.endpoint.clone();
-    doc.spec.sandboxes[0].integrations = Some(
-        serde_json::from_value(serde_json::json!({
-            "webSearch":{"provider":"brave","agentRefs":["main"],"credential":{"env":"SEARCH_KEY"}}
-        }))
-        .unwrap(),
-    );
+    doc.spec.integrations = serde_json::from_value(serde_json::json!({
+        "search":{"kind":"webSearch","provider":"brave","credential":{"env":"SEARCH_KEY"}}
+    }))
+    .unwrap();
+    doc.spec.sandboxes[0].agents[0].integration_refs = vec!["search".into()];
     let client = OpenShell::connect(&doc.spec.gateway, Arc::new(Key)).unwrap();
     let generations: Generations = ["workspace", "provider", "sandbox"]
         .map(|k| (k.into(), "a".repeat(32)))

crates/nemoclaw-sdk/src/compile.rs

@@ -103,14 +103,16 @@ pub fn targets(document: &Document, generations: &Generations) -> Result<Vec<Tar
         }
         values.extend(extra.into_iter().map(|(k, v)| (k.into(), v)));
         if kind == "sandbox" {
-            if let Some(settings) = document.runtime_inference() {
+            if let Some(settings) = document.runtime_inference()? {
                 values.insert(
                     "inference_json".into(),
                     serde_json::to_string(&settings).expect("typed inference settings"),
                 );
             }
-            let policy = crate::openshell::policy_json(&sandbox.policy_proto()?)
-                .map_err(|_| ConfigError("cannot encode sandbox policy"))?;
+            let policy = crate::openshell::policy_json(
+                &sandbox.policy_proto(document.web_search()?.is_some())?,
+            )
+            .map_err(|_| ConfigError("cannot encode sandbox policy"))?;
             if !policy.is_empty() {
                 values.insert("policy_json".into(), policy);
             }
@@ -125,7 +127,7 @@ pub fn targets(document: &Document, generations: &Generations) -> Result<Vec<Tar
             values,
         });
     }
-    if let Some(search) = sandbox.web_search() {
+    if let Some(search) = document.web_search()? {
         for (kind, name) in [
             ("provider_profile", "nemoclaw-brave"),
             ("provider", "brave-search"),
@@ -267,7 +269,7 @@ pub fn compile(
                     attributes[field] = json!(value.replace("${", "$${").replace("%{", "%%{"));
                 }
             }
-            attributes["depends_on"] = if document.spec.sandboxes[0].web_search().is_some() {
+            attributes["depends_on"] = if document.web_search()?.is_some() {
                 json!(["nemoclaw_route.primary", "nemoclaw_provider.web_search"])
             } else {
                 json!(["nemoclaw_route.primary"])

crates/nemoclaw-sdk/src/config/agent_inference.rs

@@ -148,7 +148,7 @@ pub(crate) struct RuntimeAgent {
 #[serde(deny_unknown_fields)]
 pub(crate) struct RuntimeInference {
     #[serde(rename = "webSearch", default, skip_serializing_if = "Option::is_none")]
-    pub web_search: Option<WebSearch>,
+    pub web_search: Option<RuntimeWebSearch>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub observability: Option<AgentObservability>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -210,23 +210,23 @@ impl RuntimeInference {
     }
 }
 impl Document {
-    pub(crate) fn runtime_inference(&self) -> Option<RuntimeInference> {
+    pub(crate) fn runtime_inference(&self) -> Result<Option<RuntimeInference>, ConfigError> {
         let agent = &self.spec.sandboxes[0].agents[0];
         let provider = &self.spec.inference_providers[0];
         let tuning = &agent.inference.routes[0].overrides.tuning;
         let agents = &self.spec.sandboxes[0].agents;
-        let roster = self.spec.sandboxes[0].web_search().is_some()
-            || agents.len() > 1
-            || agents.iter().any(|a| a.tools.is_some());
-        (provider.api.is_some()
+        let web_search = self.web_search()?;
+        let roster =
+            web_search.is_some() || agents.len() > 1 || agents.iter().any(|a| a.tools.is_some());
+        Ok((provider.api.is_some()
             || tuning != &RouteTuning::default()
             || agent.auth.is_some()
             || roster
             || agent.execution.is_some()
             || agent.observability.is_some()
             || agent.interfaces.is_some())
         .then(|| RuntimeInference {
-            web_search: self.spec.sandboxes[0].web_search().cloned(),
+            web_search,
             observability: agent.observability.clone(),
             execution: agent.execution.clone(),
             interfaces: agent.interfaces.clone(),
@@ -246,6 +246,6 @@ impl Document {
                 .unwrap_or(InferenceApi::for_harness(&agent.harness)),
             tuning: tuning.clone(),
             auth: agent.auth.clone(),
-        })
+        }))
     }
 }

crates/nemoclaw-sdk/src/config/integration_policy.rs

@@ -8,13 +8,16 @@ use openshell_core::proto;
 use serde_json::json;
 
 impl Sandbox {
-    pub(crate) fn policy_proto(&self) -> Result<proto::SandboxPolicy, ConfigError> {
+    pub(crate) fn policy_proto(
+        &self,
+        web_search: bool,
+    ) -> Result<proto::SandboxPolicy, ConfigError> {
         let base = self.network.policy_proto()?;
         if self
             .agents
             .first()
             .is_none_or(|a| a.observability.is_none())
-            && self.web_search().is_none()
+            && !web_search
         {
             return Ok(base);
         }
@@ -52,7 +55,7 @@ impl Sandbox {
                 .expect("typed OTLP policy"),
             );
         }
-        if self.web_search().is_some() {
+        if web_search {
             if policy.network_policies.contains_key("nemoclaw-brave") {
                 return Err(ConfigError("nemoclaw-brave is reserved for web search"));
             }