[codex] Add on-demand fusion model routing

[steipete]

Summary

• add clawrouter/fusion, an explicitly selected virtual chat model
• run up to four bounded advisers concurrently, then synthesize with one configured final model
• route every subcall through existing policy, budget, content-retention, readiness, and usage paths
• add an experimental local-openai provider for Ollama, LM Studio, vLLM, and other OpenAI-compatible servers
• add Access → Fusion configuration, discovery/catalog integration, docs, and diagnostics

Design

Fusion is one sparse adviser layer plus one final synthesizer. Adviser failures fail open. Adviser requests are text-only, exclude tool schemas and images, use bounded context/output, and are inserted into the final request as delimited untrusted evidence. The final request preserves the caller's original tools, multimodal content, streaming mode, and output contract.

The default cost-oriented profile pairs local/qwen3:8b with openai/gpt-4.1-mini. Operators can select any registered chat models. A hosted Cloudflare Worker cannot reach laptop loopback, so production local-model use requires a secured network-reachable endpoint or a locally run ClawRouter.

Validation

• node --test worker/test/*.test.mjs — 27 passed
• node --test admin/test/*.test.mjs — 19 passed
• node --test test/*.test.mjs — 43 passed
• Worker and admin TypeScript checks passed
• provider snapshot recompilation is deterministic
• admin Vite production build passed
• real Ollama qwen3:0.6b OpenAI-compatible adviser request returned LOCAL_FUSION_OK
• GitHub CI passed both jobs, including the Worker e2e, provider smoke plan, and Wrangler deploy dry-run

Browser visual QA was unavailable locally because the existing-Chrome bridge is not installed; the production UI build and admin CI job passed.

Operational notes

• each adviser and synthesizer is independently metered and retained under the caller's normal policy
• the local provider records zero upstream API price; hardware and hosting cost remain external
• clawrouter/fusion is advertised only when enabled and the caller can execute the configured synthesizer

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 2, 2026, 6:18 AM ET / 10:18 UTC.

Summary
The PR adds a default-off clawrouter/fusion virtual chat model, local OpenAI-compatible provider support, admin Fusion configuration, discovery/catalog integration, docs, and tests.

Reproducibility: yes. for the review blockers: source inspection shows the catalog/UI advertisement and dynamic local-model pricing paths without needing a live Worker. This PR is a feature, so issue-style reproduction is otherwise not applicable.

Review metrics: 2 noteworthy metrics.

• Feature surface: 30 files, +1012/-30. The PR crosses Worker routing, provider manifests, admin UI, docs, tests, and generated catalog data, so green CI alone does not settle merge safety.
• New routing surfaces: 1 virtual model, 1 provider manifest, 2 admin endpoints. The change adds user-selectable model/provider/configuration behavior that needs upgrade and operator-safety review.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦐 gold shrimp
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Fix the two review findings and add focused Worker/admin regression tests.
• [P1] Add redacted real behavior proof covering the full fusion route and the Access -> Fusion admin flow.
• Get maintainer confirmation that the new core virtual model and local provider surface should land in this repository.

Proof guidance:

• [P1] Needs stronger real behavior proof before merge: The PR body claims a live Ollama adviser check but does not include redacted terminal output, logs, screenshots, or recording proving the full fusion route and Access -> Fusion UI; redact IPs, API keys, phone numbers, non-public endpoints, and other private details, then update the PR body to trigger re-review or ask a maintainer to comment @clawsweeper re-review.

Mantis proof suggestion
A visible admin/browser proof would materially help review because the PR adds a new Access -> Fusion configuration flow and model exposure behavior. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: verify Access -> Fusion saves configuration and Playground/catalog expose clawrouter/fusion only when executable.

Risk before merge

• [P1] The PR body does not yet prove the full fusion request path or Access -> Fusion admin flow in a real setup.
• [P1] Catalog and admin clients can see clawrouter/fusion when the configured synthesizer provider is allowed but not executable, leading to selectable request failures.
• [P1] Dynamic local/* models lose the local provider's zero-price manifest pricing, so budgeted policies can fail with pricing_required.
• [P1] Even after source repairs, adding a core virtual model and local OpenAI-compatible provider is new product/configuration surface that maintainers should explicitly accept.

Maintainer options:

1. Repair readiness and pricing before merge (recommended)
   Gate catalog/UI exposure on executable fusion readiness and make dynamic local/* models inherit the intended zero-price budget behavior or require priced exact models.
2. Accept experimental operator breakage
   Maintainers could intentionally accept unavailable catalog rows and fixed-cost requirements for arbitrary local models as experimental semantics.
3. Pause for product scope
   Because this adds a new core virtual model and provider surface, maintainers can pause until the core-vs-extension direction is confirmed.

Next step before merge

• [P1] The PR needs contributor proof plus maintainer product judgment; the source blockers are actionable, but the insufficient real-behavior proof gate makes this a human-review path rather than an automated repair marker.

Security
Cleared: No concrete secret-handling or supply-chain regression was found; the local endpoint exposure risk is operator-controlled and documented.

Review findings

• [P2] Gate fusion catalog rows on executable readiness — worker/discovery.ts:83
• [P2] Preserve pricing for dynamic local models — providers/local-openai.provider.yaml:24

Review details

Best possible solution:

Repair readiness-gated advertisement and dynamic local-model budget semantics, add full route/admin real behavior proof, then let maintainers decide whether this default-off fusion/provider surface belongs in core.

Do we have a high-confidence way to reproduce the issue?

Yes for the review blockers: source inspection shows the catalog/UI advertisement and dynamic local-model pricing paths without needing a live Worker. This PR is a feature, so issue-style reproduction is otherwise not applicable.

Is this the best way to solve the issue?

No; the current patch is not the best landing shape because advertised availability and budget behavior do not match the documented/proxy behavior. The safer path is to fix those semantics and add focused regression coverage before product acceptance.

Full review comments:

• [P2] Gate fusion catalog rows on executable readiness — worker/discovery.ts:83
/v1/models only lists clawrouter/fusion when the fusion row is executable, but /v1/catalog inserts the virtual provider/model as soon as the configured synthesizer provider is allowed. In the allowed-but-missing-config or disabled-provider case, catalog clients and the admin model picker can offer a model that the proxy cannot run. Please gate this catalog entry, and the UI injection that consumes the same entitlement, on fusion.readiness.executable.
  Confidence: 0.88
• [P2] Preserve pricing for dynamic local models — providers/local-openai.provider.yaml:24
  The provider advertises arbitrary local/<model> ids and the default fusion adviser is local/qwen3:8b, but current prefix routing creates those dynamic models with pricing: null; only exact local/default has the zero-price row. On a monthly-budgeted policy without a fixed request cost, reserveBudget rejects these advisers with pricing_required, so the documented local default silently fails open instead of participating. Please make dynamic local models inherit the intended local pricing or require/configure a priced exact model.
  Confidence: 0.84

Overall correctness: patch is incorrect
Overall confidence: 0.82

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d39ef9cfa07f.

Label changes

Label justifications:

• P2: This is a broad but default-off feature addition with concrete correctness blockers and limited blast radius before operators enable it.
• merge-risk: 🚨 compatibility: The new catalog/provider behavior can expose a selectable model that fails under common readiness or budget configurations.
• merge-risk: 🚨 auth-provider: The PR changes provider routing and model choice semantics through a virtual model and dynamic local OpenAI-compatible model ids.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body claims a live Ollama adviser check but does not include redacted terminal output, logs, screenshots, or recording proving the full fusion route and Access -> Fusion UI; redact IPs, API keys, phone numbers, non-public endpoints, and other private details, then update the PR body to trigger re-review or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its Worker/provider-neutral routing, budget enforcement, secret-handling, and validation guidance is relevant to this PR. (AGENTS.md:1, d39ef9cfa07f)
• PR scope: The PR changes 30 files with 1012 additions and 30 deletions across Worker routing, provider manifests, generated provider data, admin UI, docs, and tests. (dde681cb53e9)
• Fusion catalog readiness mismatch: /v1/models gates fusion on executable readiness, but /v1/catalog inserts the fusion provider/model whenever the virtual row is merely allowed. (worker/discovery.ts:83, dde681cb53e9)
• Admin model picker readiness mismatch: The admin catalog hook prepends clawrouter/fusion when the virtual provider is allowed, without checking executable readiness. (admin/src/hooks/use-catalog.ts:25, dde681cb53e9)
• Dynamic local model pricing mismatch: The new provider advertises arbitrary local/<model> ids, while prefix-routed dynamic models inherit pricing: null from modelRoute; only exact local/default has the zero-price row. (providers/local-openai.provider.yaml:24, dde681cb53e9)
• Budgeted policies reject flat fallback pricing: Current main rejects flat-fallback model costs on monthly-budgeted policies with pricing_required, so dynamic local/qwen3:8b can fail despite the intended zero-price local provider behavior. (worker/accounting.ts:20, d39ef9cfa07f)

Likely related people:

• steipete: Current main blame and history show Peter Steinberger introduced and recently refactored the TypeScript Worker proxy/discovery/provider routing and admin console domains that this PR extends. (role: feature-history owner; confidence: high; commits: 61cba0807c1e, d9432ba2f297, f50252f718ff; files: worker/proxy.ts, worker/discovery.ts, worker/providers.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.