[codex] Add on-demand fusion model routing

[steipete]

Summary

• add clawrouter/fusion, an explicitly selected virtual chat model
• run up to four bounded advisers concurrently, then synthesize with one configured final model
• route every subcall through existing policy, budget, content-retention, readiness, and usage paths
• add an experimental local-openai provider for Ollama, LM Studio, vLLM, and other OpenAI-compatible servers
• add Access → Fusion configuration, discovery/catalog integration, docs, and diagnostics

Design

Fusion is one sparse adviser layer plus one final synthesizer. Adviser failures fail open. Adviser requests are text-only, exclude tool schemas and images, use bounded context/output, and are inserted into the final request as delimited untrusted evidence. The final request preserves the caller's original tools, multimodal content, streaming mode, and output contract.

The default cost-oriented profile pairs local/qwen3:8b with openai/gpt-4.1-mini. Operators can select any registered chat models. A hosted Cloudflare Worker cannot reach laptop loopback, so production local-model use requires a secured network-reachable endpoint or a locally run ClawRouter.

Validation

• node --test worker/test/*.test.mjs — 27 passed
• node --test admin/test/*.test.mjs — 19 passed
• node --test test/*.test.mjs — 43 passed
• Worker and admin TypeScript checks passed
• provider snapshot recompilation is deterministic
• admin Vite production build passed
• real Ollama qwen3:0.6b OpenAI-compatible adviser request returned LOCAL_FUSION_OK
• GitHub CI passed both jobs, including the Worker e2e, provider smoke plan, and Wrangler deploy dry-run

Browser visual QA was unavailable locally because the existing-Chrome bridge is not installed; the production UI build and admin CI job passed.

Operational notes

• each adviser and synthesizer is independently metered and retained under the caller's normal policy
• the local provider records zero upstream API price; hardware and hosting cost remain external
• clawrouter/fusion is advertised only when enabled and the caller can execute the configured synthesizer

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 5, 2026, 12:06 AM ET / 04:06 UTC.

Summary
The branch adds a default-off clawrouter/fusion virtual chat model, a local OpenAI-compatible provider, Worker routing/configuration, admin Fusion UI, docs, diagnostics, and tests.

Reproducibility: yes. for the review blockers from source inspection: the catalog/admin code gates fusion model insertion on allowed instead of executable readiness, and dynamic local prefix routes drop pricing metadata. I did not run live Worker/admin tests because this review is constrained to read-only inspection.

Review metrics: 3 noteworthy metrics.

• Diff size: 30 files changed, +1012/-30. The branch spans Worker routing, provider manifests, admin UI, docs, generated data, and tests, so review needs cross-surface validation.
• Provider catalog: 1 provider added; smoke count 20 -> 21. Adding a provider affects discovery, wildcard policy coverage, readiness, and operator configuration behavior.
• Prior blockers: 2 still present. The latest ClawSweeper review already identified the catalog-readiness and dynamic-pricing defects on this head.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦐 gold shrimp
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add redacted live proof for a fusion request and the Access -> Fusion configuration flow; terminal output, logs, screenshots, recordings, or linked artifacts are acceptable.
• Gate fusion catalog and admin model entries on executable readiness.
• Preserve pricing metadata for dynamic local/<model> routes.

Proof guidance:

• [P1] Needs stronger real behavior proof before merge: The PR body claims a live Ollama adviser check, but it does not include redacted terminal output, logs, screenshots, a recording, or a linked artifact proving the full fusion route and Access -> Fusion UI after the change. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
A browser proof would materially help verify the new Access -> Fusion admin flow and model visibility behavior. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: verify Access -> Fusion saves config and clawrouter/fusion appears only when executable.

Risk before merge

• [P1] The PR is a draft and the proof gate is still unmet: the body claims a live Ollama check, but no redacted terminal output, logs, screenshot, recording, or linked artifact shows the real fusion route or Access -> Fusion UI after the change.
• [P1] The virtual model is still advertised through catalog/admin paths before the configured synthesizer is executable, so users can select a model that discovery readiness says is unavailable.
• [P1] Dynamic local/<model> routes do not inherit the new local provider's zero-price metadata, which can skew budget reservation and usage records for the advertised default local adviser.
• [P1] This adds a new default-off virtual model, provider manifest, admin config, and routing behavior, so maintainers still need to confirm the product and provider-access direction before landing.

Maintainer options:

1. Repair readiness and pricing first (recommended)
   Gate every fusion catalog/admin model entry on executable readiness, preserve pricing for dynamic local prefix routes, and then require fresh real-behavior proof before merge.
2. Accept the experimental surface explicitly
   Maintainers may choose to own the default-off fusion and local-provider direction, but should document the readiness and pricing caveats they are accepting.
3. Pause for product sponsorship
   If core is not ready to own an ensemble router and local OpenAI-compatible provider, keep the implementation paused until the desired plugin/core boundary is settled.

Next step before merge

• [P1] This needs contributor proof and maintainer product judgment; the remaining source blockers are concrete, but the proof gate makes this a human-review path rather than an automated repair marker.

Security
Cleared: No concrete security or supply-chain regression was found in the diff; provider secrets remain configuration-driven, and adviser requests deliberately omit tools and images.

Review findings

• [P2] Gate fusion catalog rows on executable readiness — worker/discovery.ts:82-83
• [P2] Preserve pricing for dynamic local models — providers/local-openai.provider.yaml:46-51

Review details

Best possible solution:

Land this only after fusion is advertised strictly when executable, dynamic local routes preserve intended pricing metadata, the contributor adds redacted live proof for the route and UI, and a maintainer accepts the new core routing/config surface.

Do we have a high-confidence way to reproduce the issue?

Yes for the review blockers from source inspection: the catalog/admin code gates fusion model insertion on allowed instead of executable readiness, and dynamic local prefix routes drop pricing metadata. I did not run live Worker/admin tests because this review is constrained to read-only inspection.

Is this the best way to solve the issue?

No: the proposed direction is plausible, but the current PR is not yet the best mergeable solution because it advertises unavailable fusion routes, misprices dynamic local models, and lacks inspectable real-behavior proof.

Full review comments:

• [P2] Gate fusion catalog rows on executable readiness — worker/discovery.ts:82-83
  This still adds the virtual provider to /v1/catalog whenever the aggregator policy is allowed, even if fusion.readiness.executable is false. That leaves clawrouter/fusion visible to client catalogs and the admin picker while the configured synthesizer cannot actually run; require executable readiness before advertising the model/provider.
  Confidence: 0.9
• [P2] Preserve pricing for dynamic local models — providers/local-openai.provider.yaml:46-51
  The new provider declares zero API pricing for local/default, but the documented default adviser local/qwen3:8b is resolved through the local/ prefix path, where modelRoute synthesizes a model with pricing_ref: null and pricing: null. That makes budget and usage accounting fall back instead of using the intended local pricing; copy the template pricing for dynamic local routes or register priced local models explicitly.
  Confidence: 0.88

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f3b733f801ae.

Label changes

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P2: This is a normal-priority feature PR with concrete merge blockers but default-off behavior and limited immediate blast radius.
• merge-risk: 🚨 compatibility: The PR adds new provider/catalog/config behavior and currently exposes fusion in some catalogs before it is executable.
• merge-risk: 🚨 auth-provider: Fusion routes subcalls through configured provider access and readiness paths, and the current gating can misrepresent whether the configured provider route is usable.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body claims a live Ollama adviser check, but it does not include redacted terminal output, logs, screenshots, a recording, or a linked artifact proving the full fusion route and Access -> Fusion UI after the change. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; the relevant guidance is to keep the data-plane hot path provider-neutral, avoid upstream secrets/raw prompt logging, validate provider manifests, and run focused Worker/admin validation for touched surfaces. (AGENTS.md:1, f3b733f801ae)
• Current main does not already implement the feature: Searching current main for the fusion model, local-openai provider, and FusionConfig found no matches, so the PR is not obsolete on main. (f3b733f801ae)
• PR surface: The proposed commit changes 30 files with 1012 insertions and 30 deletions across Worker routing, provider manifests, admin UI, docs, generated provider snapshot, and tests. (dde681cb53e9)
• Prior review continuity: The latest completed ClawSweeper review on the same head SHA raised two P2 blockers and a real-behavior proof gate; both source blockers are still present in the same head. (dde681cb53e9)
• Fusion catalog advertised before executable: /v1/catalog inserts the virtual clawrouter provider whenever the fusion row is allowed, even when fusion.readiness.executable is false; the admin model picker also adds clawrouter/fusion on allowed alone. (worker/discovery.ts:82, dde681cb53e9)
• Dynamic local model pricing is dropped: The new local provider declares zero API pricing on local/default, but current dynamic prefix routing synthesizes local/<model> routes with pricing_ref: null and pricing: null, so the advertised default local/qwen3:8b does not inherit that pricing. (providers/local-openai.provider.yaml:46, dde681cb53e9)

Likely related people:

• Peter Steinberger: Git history and blame show repeated recent work on the TypeScript Worker data plane, provider readiness/catalog routing, provider manifests, and admin console surfaces touched by this PR. (role: recent area contributor; confidence: high; commits: 61cba0807c1e, d9432ba2f297, e33fdacbbf80; files: worker/proxy.ts, worker/discovery.ts, worker/providers.ts)
• Vincent Koc: Git history shows earlier discovery/provider work, including discovery endpoint awareness and provider-manifest additions, adjacent to the routing and manifest behavior reviewed here. (role: adjacent historical contributor; confidence: medium; commits: 113ff5a8db5e, 80344cf23a4a; files: worker/discovery.ts, providers)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-02T10:18:43.049Z sha dde681c :: needs real behavior proof before merge. :: [P2] Gate fusion catalog rows on executable readiness | [P2] Preserve pricing for dynamic local models