[vincentkoc]

Summary

• add maintainer setup baseline files for this repository\n- add CODEOWNERS, CodeQL, stale automation, and Crabbox support; existing repo-local autoreview skill was left intact

Verification

• git diff --check
• ruby YAML.load_file for added/changed YAML files
• actionlint for added/changed workflow files
• private-data scan for added/changed non-skill setup files
• verified Crabbox skill SHA-256 matches openclaw/openclaw: ed512c0b0385fae7f6c5c14a7e9e6236ab68936506687a99ca976873492bdc43

Runtime tests were not run; this is setup, policy, and workflow metadata only.

[clawsweeper]

Codex review: found issues before merge.

Latest ClawSweeper review: 2026-05-22 15:06 UTC / May 22, 2026, 11:06 AM ET.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR adds CODEOWNERS, CodeQL, stale automation, .crabbox.yaml, a Crabbox hydrate workflow, and a Crabbox agent skill.

Reproducibility: not applicable. as a user bug. The PR risks are source-reproducible from the proposed workflow and skill lines plus the current package.json script surface.

PR rating
Overall: 🧂 unranked krab
Proof: 🌊 off-meta tidepool
Patch quality: 🧂 unranked krab
Summary: The patch is not quality-ready while security-sensitive runner selection and copied validation commands remain unresolved.

Rank-up moves:

• Constrain the hydrate workflow to fixed Crabbox runner labels before any checkout or install step.
• Rewrite the Crabbox skill for acpx’s real package scripts and workflows.
• Get explicit maintainer approval or split out CodeQL and stale automation policy changes.

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Not applicable: This is a member-authored draft maintainer setup PR, so the external contributor real-behavior proof gate does not apply.

Risk before merge

• The hydrate workflow can execute a manually selected ref on a manually selected self-hosted runner label before that label is constrained.
• The Crabbox skill is copied from a broader OpenClaw setup and references commands/workflows absent from acpx, so it would mislead maintainer validation.
• The PR enables repository policy automation, including stale closure and CodeQL changes, after a maintainer already said this baseline should not land as-is.

Maintainer options:

1. Pause or close the baseline (recommended)
   Keep this draft paused or close it unless maintainers explicitly reopen a narrowed replacement, because the current discussion says it should not land as-is.
2. Split safe setup pieces
   Move CODEOWNERS, Crabbox, CodeQL, and stale automation into separate PRs so each policy and runner boundary can be reviewed independently.
3. Accept policy automation explicitly
   Maintainers may intentionally accept stale closure and CodeQL duplication only after confirming the repo-level policy and expected check behavior.

Next step before merge
Human maintainer review is needed because the PR was reopened after a closure decision and still contains security-sensitive workflow and repository automation policy choices.

Security
Needs attention: The new self-hosted hydrate workflow broadens the repository code-execution boundary and should be constrained before merge.

Review findings

• [P1] Restrict hydrate jobs to Crabbox runners — .github/workflows/crabbox-hydrate.yml:35
• [P2] Replace copied OpenClaw Crabbox commands — .agents/skills/crabbox/SKILL.md:39

Review details

Best possible solution:

Split the baseline into maintainer-approved pieces, and only land Crabbox after runner labels and commands are acpx-specific while stale and CodeQL policy are explicitly confirmed.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a user bug. The PR risks are source-reproducible from the proposed workflow and skill lines plus the current package.json script surface.

Is this the best way to solve the issue?

No. The safer maintainable path is to split the setup work and constrain the Crabbox workflow and skill before any automation policy is enabled.

Label justifications:

• P2: This is a normal-priority maintainer setup PR with concrete workflow and automation blockers but limited acpx runtime blast radius.
• merge-risk: 🚨 security-boundary: The new hydrate workflow can run a manually selected ref on a manually selected self-hosted runner label.
• merge-risk: 🚨 automation: The PR adds CodeQL, stale closure, and Crabbox validation automation whose behavior is not yet aligned with current acpx policy and commands.
• rating: 🧂 unranked krab: Current PR rating is 🧂 unranked krab because proof is 🌊 off-meta tidepool, patch quality is 🧂 unranked krab, and The patch is not quality-ready while security-sensitive runner selection and copied validation commands remain unresolved.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is a member-authored draft maintainer setup PR, so the external contributor real-behavior proof gate does not apply.

Full review comments:

• [P1] Restrict hydrate jobs to Crabbox runners — .github/workflows/crabbox-hydrate.yml:35
  The workflow_dispatch input is used directly in runs-on while the job also checks out a caller-selected ref and runs pnpm install. Please constrain this to the intended Crabbox runner labels or validate the label before checkout/install so a manual dispatch cannot target an arbitrary self-hosted runner.
  Confidence: 0.91
• [P2] Replace copied OpenClaw Crabbox commands — .agents/skills/crabbox/SKILL.md:39
  The skill tells maintainers to run pnpm crabbox:run and later references pnpm test:changed/pnpm check:changed, but those scripts do not exist in acpx. Please either add the acpx command surface this skill requires or rewrite it around commands that exist in this repo.
  Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.9

Security concerns:

• [high] Unbounded self-hosted runner dispatch — .github/workflows/crabbox-hydrate.yml:35
  A manual dispatcher can choose the self-hosted runner label and ref, then the job checks out code and runs install steps on that runner; this should be limited to the intended Crabbox runner pool before merge.
  Confidence: 0.88

What I checked:

• Maintainer discussion signal: A maintainer comment at chore: add maintainer setup baseline #339 (comment) says this draft baseline is not wanted as-is and cites failing duplicate CodeQL checks before the PR was reopened.
• Hydrate runner selection: The proposed hydrate workflow uses a workflow_dispatch input directly in runs-on, while the same job checks out a caller-selected ref and runs dependency install steps. (.github/workflows/crabbox-hydrate.yml:35, 750c0519943b)
• Copied Crabbox skill commands: The added skill tells maintainers to run OpenClaw-style Crabbox commands such as pnpm crabbox:run and later references changed-check scripts. (.agents/skills/crabbox/SKILL.md:39, 750c0519943b)
• Current acpx script surface: Current main defines check, test, test:coverage, and related scripts, but not crabbox:run, test:changed, or check:changed. (package.json:37, a9a5bee83ea0)
• Stale automation policy change: The PR would automatically mark and close issues and PRs after short inactivity windows, which is a repository policy change rather than a purely mechanical setup file. (.github/workflows/stale.yml:20, 750c0519943b)
• Current workflow history: Current CI workflow history points to Peter Steinberger as the original workflow author and Bob as the recent Slophammer CI constraint contributor for the central automation surface. (.github/workflows/ci.yml:90, 994fc6c9cf13)

Likely related people:

• steipete: Current CI workflow blame attributes the core check matrix to Peter Steinberger, and the PR discussion includes steipete's maintainer decision that this baseline should not land as-is. (role: workflow introducer and reviewer signal; confidence: high; commits: 994fc6c9cf13; files: .github/workflows/ci.yml, .github/workflows/release.yml)
• Bob: Git history shows Bob recently added Slophammer constraints to the CI matrix, which is adjacent to this PR's workflow and setup automation changes. (role: recent automation contributor; confidence: medium; commits: c26e99c8bcd0; files: .github/workflows/ci.yml, slophammer.yml)
• vincentkoc: Current-main blame shows Vincent Koc introduced the repo-local autoreview skill, and this PR adds another .agents/skills entry that overlaps that maintainer tooling area. (role: recent agent-skill contributor; confidence: medium; commits: 2f696709507e; files: .agents/skills/autoreview/SKILL.md, .agents/skills/crabbox/SKILL.md)

Codex review notes: model gpt-5.5, reasoning high; reviewed against a9a5bee83ea0.

[clawsweeper]

ClawSweeper PR egg

🔥 Warming up: real-behavior proof passed; findings, security review, or rank-up moves are still in progress.

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

• Merged PRs are hatchable.
• Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
• Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

What is this egg doing here?

• Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
• The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
• Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
• The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
• Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

[steipete]

Closing per maintainer decision. This draft baseline PR is not something we want to land as-is, and the current duplicate CodeQL checks are failing.

Thanks for the contribution.