refactor: remove unwired Station primitive

[steipete]

Summary

• Remove the 904-line internal/station package. It was unreachable dead code: no package imported it, no CLI command exposed it, and its default feature gate rejected every phase as not yet enabled.
• Delete the Station profiles and agent-runtime bridge roadmap pages, then remove or rewrite every remaining reference without disturbing valid Agent Skill, one-shot harness, or hermetic-evidence documentation.
• Preserve the original VISION.md framing and entire Lifecycle Safety section verbatim, then add the product boundary for remote execution, evidence, quality, non-goals, and autonomous contributions around it. The vision change is additive to the maintainer-authored safety policy.
• Link the vision from the root README and docs index, and keep integration status terminology consistent after removing the contract-only runtime roadmap.
• Add an Unreleased changelog note for the clarified public scope. No release files, version numbers, runtime configuration, or secret handling changed.

Scope boundary

The original VISION.md Lifecycle Safety rules remain word-for-word identical to main, including exact ownership proof, conflict-safe adoption, fail-closed lifecycle behavior and claim metadata, and zero-residue live proof for funded or remote providers.

The additive agent boundary says:

Crabbox is used by agents; it does not orchestrate agents. Agents, harnesses,
and orchestrators are callers. Crabbox provisions disposable remote machines,
runs commands on them, and returns evidence.

The explicit non-goals include:

• supervising or hosting long-running agent runtimes inside the box;
• delivering model credentials into leases or brokering model or API
  credentials into sandboxes on behalf of an agent.

Verification

• gofmt -w $(git ls-files '*.go') — clean.

• go vet ./... — exit 0 locally.

• go test -race ./... — exit 0 on configured Blacksmith Testbox tbx_01kyq9mz4jtdn33f49t1457ngy; hosted run: https://github.com/openclaw/crabbox/actions/runs/30468595344

  ok  github.com/openclaw/crabbox/internal/cli  253.531s
  ok  github.com/openclaw/crabbox/internal/providers/xcpng  52.882s
  ok  github.com/openclaw/crabbox/scripts  1.008s
  blacksmith run summary sync=delegated command=11m39.37s total=11m41.282s exit=0
  Testbox tbx_01kyq9mz4jtdn33f49t1457ngy stopped (completed)
  

  The local runner exhausted temporary disk while linking the race suite. The final hosted run used a private runner home/config with normal 022 file semantics so the permission-hardening fixtures exercised their intended modes.

• scripts/check-docs.sh — exit 0 after the review fixes.

  checked 236 markdown files: internal links ok
  built docs site: dist/docs-site
  tests 14
  pass 14
  fail 0
  normalized navigation counts across 231 pages; 79 providers
  

• node scripts/build-docs-site.mjs — built docs site: dist/docs-site.

• diff -u <(git show origin/main:VISION.md) <(sed -n '1,10p' VISION.md) — no output; the original vision block is preserved verbatim.

• Exhaustive searches for station, Station, station-profiles, agent-runtime-bridge, stationProfile, modelAccess, and ModelAccess found no legacy references. The additive VISION non-goals intentionally describe agent-runtime supervision and model credentials in plain language.

• Structured autoreview after the review fixes: clean, no accepted or actionable findings.

Real binary proof:

$ go build -trimpath -o bin/crabbox ./cmd/crabbox
$ ./bin/crabbox station
unexpected argument station
station invocation exit_code=2
PASS: built CLI has no Station command

Related issues

• Add a run-a-harness-in-the-box mode (agent runtime) #530
• Roadmap: Station profiles for supervised agent workloads and reasoning access #193

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 29, 2026, 1:09 PM ET / 17:09 UTC.

ClawSweeper review

What this changes

This PR deletes the unreachable, disabled Station prototype and its roadmap pages, then documents Crabbox as a remote execution-and-evidence layer rather than an in-box agent-runtime host.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep this PR open for an explicit product-direction decision. The code removal appears technically sound and is supported by real CLI proof, but it also removes the only in-repository Station and agent-runtime contract while both linked proposals remain open.

Priority: P2
Reviewed head: fb9fe0848e37f055bc6c79fc8b6357b5fc5f7103
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The removal and validation evidence are strong, but merge readiness depends on an unresolved product-boundary decision rather than a patch defect.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The PR contains after-fix terminal proof from a built CLI showing that the removed Station command is unavailable, alongside hosted race-test and documentation-check output.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR contains after-fix terminal proof from a built CLI showing that the removed Station command is unavailable, alongside hosted race-test and documentation-check output.
Evidence reviewed	5 items	Current-main Station surface: The PR deletes the Station package from the current base revision, whose package documentation describes it as a disabled-by-default primitive with no supervisor, lease wiring, or credential-delivery implementation. Open roadmap remains: #193 remains open and defines Station as the next lifecycle primitive, including the security and product decisions required before any model-access work. Open runtime proposal remains: #530 remains open and requests a harness-in-the-box mode that overlaps the bridge documentation removed by this PR.
Findings	None	None.
Security	None	None.

How this fits together

Crabbox callers acquire remote leases, execute commands or jobs, and receive logs, artifacts, status, and cleanup evidence. Station was a proposed layer above leases for durable supervised workloads and an eventual agent-runtime bridge.

flowchart LR
  Caller[Developer, CI, or agent] --> CLI[Crabbox CLI]
  CLI --> Lease[Remote lease]
  Lease --> Run[Command or job execution]
  Run --> Evidence[Logs, artifacts, status]
  Station[Proposed Station layer] --> Lease
  Station --> Runtime[Long-running harness]
  Scope[Vision and docs] --> Caller

Loading

Decision needed

Question	Recommendation
Should Crabbox permanently exclude supervised in-box agent runtimes and any scoped model-credential delivery path, despite the still-open Station and harness-runtime proposals?	Retain the roadmap pending direction: Keep the Station and agent-runtime contract pages until maintainers explicitly decide whether this capability is rejected, deferred, or moved elsewhere.

Why: The branch is technically coherent, but it changes the repository’s future product and security boundary rather than only deleting an unused implementation seam.

Before merge

• Resolve merge risk (P1) - Merging would remove the only repository contract for the open Station and agent-runtime directions, making a future reversal harder and obscuring the previously documented lifecycle and credential-safety constraints.
• Complete next step (P2) - A maintainer must resolve the Station and agent-runtime product boundary before this otherwise focused removal can safely merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Removed surface	904 Go lines and 349 roadmap-documentation lines removed	The PR removes both the inactive implementation seam and the detailed contract for the overlapping open proposals.
Review scope	19 files changed; 129 additions and 1,358 deletions	The change spans code, product vision, security guidance, integration documentation, and release notes.

Merge-risk options

Maintainer options:

1. Confirm product direction before merge (recommended)
   Pause the PR until maintainers decide whether to preserve or permanently retire the linked Station and agent-runtime roadmap.
2. Approve the scope change and resolve the proposals
   Accept the deletion only with an explicit decision that the linked capabilities are no longer part of Crabbox’s intended roadmap.

Technical review

Best possible solution:

Either explicitly reject the Station and in-box harness direction and close or redirect the two linked proposals, or retain their roadmap and security-contract documentation until maintainers select a successor design.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR removes an unreachable disabled package and changes product documentation rather than addressing a current runtime bug. The submitted terminal proof does demonstrate the intended absence of a station CLI command after the change.

Is this the best way to solve the issue?

Unclear: removing unreachable code is a narrow solution, but removing the linked roadmap and security contract is not the best resolution until maintainers decide whether the open product direction is rejected or merely deferred.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f7c915578a6c.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: This is a material but non-urgent product-boundary cleanup with no demonstrated active runtime outage.
• merge-risk: 🚨 other: Green tests do not decide whether removing the documented future Station and agent-runtime direction is an intended repository-wide product change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR contains after-fix terminal proof from a built CLI showing that the removed Station command is unavailable, alongside hosted race-test and documentation-check output.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR contains after-fix terminal proof from a built CLI showing that the removed Station command is unavailable, alongside hosted race-test and documentation-check output.

Evidence

What I checked:

• Current-main Station surface: The PR deletes the Station package from the current base revision, whose package documentation describes it as a disabled-by-default primitive with no supervisor, lease wiring, or credential-delivery implementation. (internal/station/station.go:1, f7c915578a6c)
• Open roadmap remains: Roadmap: Station profiles for supervised agent workloads and reasoning access #193 remains open and defines Station as the next lifecycle primitive, including the security and product decisions required before any model-access work.
• Open runtime proposal remains: Add a run-a-harness-in-the-box mode (agent runtime) #530 remains open and requests a harness-in-the-box mode that overlaps the bridge documentation removed by this PR.
• After-fix behavior proof: The PR body includes a real built-binary invocation where ./bin/crabbox station exits with an unexpected-argument error, directly demonstrating that no Station command remains. (cmd/crabbox, fb9fe0848e37)
• Scope-preservation follow-up: VISION.md: The latest branch commit states that the existing Lifecycle Safety text was preserved while adding the narrower product boundary; this reduces accidental policy churn but does not resolve whether the removed roadmap should be rejected. (VISION.md:1, fb9fe0848e37)

Likely related people:

• steipete: Authored the three commits on this PR that remove the Station surface and define the proposed product boundary. (role: current Station and scope contributor; confidence: medium; commits: 10aece0126e8, 4c504c88dd19, fb9fe0848e37; files: internal/station/config.go, internal/station/gate.go, VISION.md)
• zozo123: Authored the still-open Station roadmap that this PR would remove from the repository’s documented direction. (role: adjacent roadmap author; confidence: low; files: docs/features/station-profiles.md)
• stubbi: Authored the still-open harness-in-the-box proposal whose contract documentation is removed by this PR. (role: adjacent runtime-proposal author; confidence: low; files: docs/features/agent-runtime-bridge.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain an explicit maintainer decision on the linked Station and agent-runtime proposals before removing their contract documentation.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-07-29T16:18:37.556Z sha 4c504c8 :: needs maintainer review before merge. :: none