clawsweeper-review

Repo	box/github.com/opencharly/layer-clawsweeper:v2026.296.1447

The ClawSweeper review engine as a runnable artefact: a PINNED upstream checkout, Node 24 + pnpm 12.4.1, the OpenAI Codex CLI (the engine’s only runner), a CODEX_HOME configured for the OpenCharly Ollama Cloud endpoint, and an opencharly target-profile overlay so any opencharly/ resolves.

This image is the REVIEW HALF of PR validation. It is run as a disposable container with the PR tree mounted read-only and NO GitHub token: --local-range reads merge-base(base, HEAD)..HEAD and performs no GitHub writes, so the verdict leaves the sandbox as JSON and the caller posts it. Codex’s sandbox needs bubblewrap and unprivileged user namespaces; the runner image enables those.

The engine/endpoint pairing is MEASURED, not assumed: Codex 0.162.1 speaks stateless Responses to https://ollama.com/v1 and performs real shell tool calls (probe: codex exec ran uname -s && uname -m, returned Linux/x86_64). Codex accepts only wire_api = "responses"; Ollama Cloud serves that.

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	install the pinned Node runtime from the official tarball
run	install the pinned pnpm and the pinned Codex CLI
run	clone the pinned ClawSweeper checkout and build it
run	add the opencharly target-profile fallback so any opencharly/ resolves
run	write the Codex home configured for the Ollama Cloud endpoint
run	install the one-shot review entrypoint
check	Node 24 reports its version
check	pnpm reports the pinned version
check	the Codex CLI reports the pinned version
check	the built engine loads and resolves an opencharly target through the overlay
check	the opencharly target fallback is present
check	the Codex home carries config.toml naming the Ollama Cloud responses endpoint
check	the entrypoint gives Codex a writable home as the image’s own user
check	the one-shot review entrypoint runs and describes its invocation
run	pre-install the engine’s input scanner into the image user’s cache
check	the input scanner is baked into THIS user’s private cache