[kuswardhanietidims-svg]

Summary

ClawScan's OpenAI-compatible lanes (Codex judge, overview, Decisions, A.I.G, SkillSpector) were documented as "any OpenAI-compatible endpoint" without naming one. This change names OrcaRouter, an OpenAI-compatible AI gateway that routes many providers behind one endpoint. OrcaRouter is an OpenAI-compatible AI gateway that routes many providers behind one endpoint.

File	Change
README.md	New "OpenAI-compatible providers" subsection with a variable/value table (OPENAI_BASE_URL=https://api.orcarouter.ai/v1, sk-orca-… key in OPENAI_API_KEY, OVERVIEW_MODEL taken from the model catalog with the vendor/model namespace kept verbatim).
docs/judge.md	New "OpenAI-compatible providers" section: Codex judge/overview lane (OPENAI_BASE_URL, CODEX_API_KEY/OPENAI_API_KEY, OVERVIEW_MODEL) and Decisions lane (DECISIONS_BASE_URL defaulting to OPENAI_BASE_URL, DECISIONS_API_KEY, DECISIONS_MODEL), plus A.I.G (DEFAULT_BASE_URL) and SkillSpector (SKILLSPECTOR_PROVIDER=openai with OPENAI_BASE_URL).
skills/clawscan-cli/SKILL.md	One paragraph beside the credential table naming OrcaRouter with the same base URL, key prefix and verbatim model-ID rule.
CHANGELOG.md	Unreleased entry.

Why this shape

AGENTS.md forbids adding a model-provider framework unless the product direction changes, and credentials must stay in env vars, never CLI flags. The existing env-var seams (OPENAI_BASE_URL, DECISIONS_BASE_URL, DEFAULT_BASE_URL, SKILLSPECTOR_PROVIDER) are exactly what OrcaRouter targets, so this is a documentation-only change: no code, no new config keys, no behavior change. No other provider's documented behavior changes.

Verification

• make docs-site succeeds (Built 8 docs page(s) in dist/docs-site) and the rendered dist/docs-site/judge.html contains the new OrcaRouter section and table.
• go vet ./... could not complete here: module downloads from proxy.golang.org were reset by the network. No Go code or test was touched.
• No secrets are added; only the public base URL and the documented sk-orca- prefix appear.

Primary-source provider evidence (checked 2026-11-07)

• Inference base and OpenAI-compatible endpoints: https://api.orcarouter.ai/v1 (https://www.orcarouter.ai).
• API keys are issued by OrcaRouter under the sk-orca- prefix; model IDs come from GET /v1/models and keep their vendor/model namespace.
• Gateway security details are documented at https://www.orcarouter.ai.

It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

I'm an engineer on the OrcaRouter team.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR adds OrcaRouter configuration examples to the README, judge documentation, CLI skill, and changelog.

Example: An operator wants to use https://api.orcarouter.ai/v1 for ClawScan.

• Before: Documentation describes individual endpoint settings and gives a ClawRouter example.
• After: Documentation names OrcaRouter and supplies its endpoint, key format, and model naming guidance.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The documentation contains two actionable configuration errors, its integration claims lack behavior proof, and the provider-specific direction awaits an owner decision.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦪 silver shellfish (2/6)	2 actionable review findings remain.

Product

Kind: Preference · Worth it: Needs a maintainer decision · Fix scope: Complete
User problem: Operators considering OrcaRouter lack a ClawScan-specific configuration example.
Reason: The integration seams and another named gateway example already exist; selecting an additional commercial provider for prominent documentation needs owner direction.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep this PR open for corrections and a provider-documentation decision; the proposed instructions contain two concrete configuration errors, and the exact addition is not implemented on main.

Priority: P3
Reviewed head: 0aa99b8e54ec83435a5fbacddd764462d60aa1e8
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should ClawScan add OrcaRouter as another named gateway example in its public documentation and CLI skill?
• Recommendation: Keep guidance provider-neutral: Correct the lane-specific instructions and retain the existing gateway example without adding another named provider.
• Why: Main already includes a named gateway example, and no maintainer decision establishes the value or desired scope of this additional provider-specific guidance.

Before merge

• Add real behavior proof - The body reports a docs-site build, but neither it nor the discussion supplies a ClawScan run through OrcaRouter for the advertised judge, overview, Decisions, or scanner configurations; provide terminal screenshots, logs, or live output with API keys, IPs, and non-public endpoints redacted. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Document DEFAULT_BASE_URL separately for A.I.G (P2) - Following the README table with OPENAI_BASE_URL=https://api.orcarouter.ai/v1 and an OrcaRouter OPENAI_API_KEY does not route A.I.G to OrcaRouter. A.I.G uses DEFAULT_BASE_URL, and the runner defaults OpenAI-key configurations to https://api.openai.com/v1; the MCP adapter and its tests explicitly preserve this separation. The instructions therefore leave A.I.G using the wrong endpoint and a mismatched key. Include its separate endpoint and model settings and remove the claim that OPENAI_BASE_URL controls every lane.
• Separate the judge model from OVERVIEW_MODEL (P2) - The table identifies OVERVIEW_MODEL as the model setting for both the Codex judge and overview. Setting OVERVIEW_MODEL=openai/gpt-6-luna changes only the overview: the bundled judge still passes --model gpt-6.1-sol. An operator following this table cannot select the advertised provider-specific judge model. Split the lanes and explain that changing the judge model requires a custom judge command or profile.

Findings

• [P2] Document DEFAULT_BASE_URL separately for A.I.G — README.md:304-305
• [P2] Separate the judge model from OVERVIEW_MODEL — docs/judge.md:298

Tests

• Missing end-to-end proof: Provide redacted terminal output from the shipped CLI demonstrating the gateway configuration for each retained lane, including /v1/decisions if that claim remains.

Agent review details

How this fits together

ClawScan invokes scanner adapters and external judge commands, whose individual environment settings select model endpoints and credentials.

flowchart LR
  A[Operator environment] --> B[ClawScan profile]
  B --> C[Scanner adapters]
  B --> D[External judge]
  C --> D
  D --> E[Optional overview]
  D --> F[Run artifact]
  E --> F

Loading

Technical review

Best possible solution:

Document each lane’s actual endpoint and model controls, and include the named gateway only for maintainer-approved, demonstrated integrations.

Do we have a high-confidence way to reproduce the issue?

Source and existing regression tests establish the endpoint and model-setting mismatches; no target code was executed.

Is this the best way to solve the issue?

The existing environment seams support focused documentation, but the proposed shared-setting description does not match their separate owners.

Full review comments:

• [P2] Document DEFAULT_BASE_URL separately for A.I.G — README.md:304-305
  Following the README table with OPENAI_BASE_URL=https://api.orcarouter.ai/v1 and an OrcaRouter OPENAI_API_KEY does not route A.I.G to OrcaRouter. A.I.G uses DEFAULT_BASE_URL, and the runner defaults OpenAI-key configurations to https://api.openai.com/v1; the MCP adapter and its tests explicitly preserve this separation. The instructions therefore leave A.I.G using the wrong endpoint and a mismatched key. Include its separate endpoint and model settings and remove the claim that OPENAI_BASE_URL controls every lane.
  Confidence: 0.99
• [P2] Separate the judge model from OVERVIEW_MODEL — docs/judge.md:298
  The table identifies OVERVIEW_MODEL as the model setting for both the Codex judge and overview. Setting OVERVIEW_MODEL=openai/gpt-6-luna changes only the overview: the bundled judge still passes --model gpt-6.1-sol. An operator following this table cannot select the advertised provider-specific judge model. Split the lanes and explain that changing the judge model requires a custom judge command or profile.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 80d11a34a97a.

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Pinned introduced patch: The introduced patch adds provider guidance without changing runtime implementation; main remains at the pinned base. (README.md:304, 0aa99b8e54ec)
• Independent A.I.G endpoint contract: A.I.G uses DEFAULT_BASE_URL; its MCP adapter explicitly isolates this setting from OPENAI_BASE_URL, with regression coverage for that separation. (internal/runner/aig_mcp_scanner.go:261, 80d11a34a97a)
• Judge and overview select models separately: The bundled judge passes --model gpt-6.1-sol; only the overview reads OVERVIEW_MODEL. (internal/profiles/clawhub/clawscan.yml:45, 80d11a34a97a)
• Existing provider example and feature history: Main already documents a ClawRouter Responses endpoint example; the feature-history trail includes the introduction of Decisions and overview in feat!: add a Decisions API judge and a pluggable overview step for clawhub #148 and the evidence-only Codex transition in feat!: judge ClawHub skills and plugins from scanner evidence only #152. (docs/judge.md:278, 80d11a34a97a)
• Discussion and direction: The full PR body and both comments were read: the author identifies a provider-team affiliation, the comments are automated acknowledgments, and Patrick-Erichsen is a requested reviewer; no maintainer approval of this provider example is recorded.
• Distinct protocol requirement: The Decisions harness posts to /v1/decisions; generic OpenAI compatibility does not establish support for this particular protocol. (docker/clawscan-runtime/judges/clawscan_decisions_judge.py:300, 80d11a34a97a)

Likely related people:

• Patrick Erichsen: Raw commit 80d11a3 adds docs/judge.md:278 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 80d11a34a97a; files: docs/judge.md)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P3: This is optional documentation work with no runtime implementation change.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P3: This is optional documentation work with no runtime implementation change.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 7, 2026, 10:28 AM ET / 15:28 UTC.