A session commits and pushes the check-in to stage, then sends this run from its clone as its own user holding R: ocx2 create "stage CHECKIN" --pattern URL --node NODE --to POST --of CHECKIN. URL is this file's content-addressed raw URL after it is published as a tech-note attachment, as for the Codex task pattern. The node clones anonymously, opens CHECKIN, names the run's user as the checkout's default user (the clone makes it, holding s there; ocx2 runs Fossil with no USER, so a checkout naming no default user has no caller, and stage refuses), builds and stages it under its release root's staged/. The run's user must be one no other node's run has named: give each node its own with --user NODE-stage-task. The maintainer accepts it from the page.

{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$user$$/projects/$$project$$/$$run$$",
      "remove_on": "saved"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "capabilities": [],
    "network": true,
    "own_session": true,
    "ends_with_node": true,
    "read_only": [
      "/usr", "/bin", "/sbin", "/lib", "/lib64",
      "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs"
    ],
    "read_write": ["$$workspace$$", "$$releases$$/staged"],
    "homes": [],
    "files": [
      {
        "at": "/etc/passwd",
        "text": "$$user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "2h",
    "cpu": 3600,
    "processes": 512,
    "files": "256M"
  },
  "process": {
    "user": "stage-task",
    "command": [
      "/bin/sh", "-c",
      "fossil clone $$server$$ $$workspace$$/clone.fossil && mkdir $$workspace$$/tree && fossil open $$workspace$$/clone.fossil $$checkout$$ --chdir $$workspace$$/tree --nosync && cd $$workspace$$/tree && fossil user default $$user$$ && nice -n 19 shards build ocx2 && nice -n 19 ionice -c3 bin/ocx2 stage $$workspace$$/tree --root $$releases$$"
    ],
    "cwd": "$$workspace$$",
    "keep": {"stderr": "4K", "stdout": "4K", "stdout_when": "always"},
    "env": {"HOME": "$$workspace$$", "USER": "$$user$$", "PATH": "/usr/local/bin:/usr/bin:/bin"}
  }
}