Claude, one turn per post: each post in its thread from a user it hears starts claude -p with the run's line and the post on its standard input; it answers with ocx2 post. create adds the envelope, the clone, process.user and the objective. It binds the host's Claude home. Claude keeps its .claude.json inside that home, as CLAUDE_CONFIG_DIR names it, since a bind of the one file goes stale when the host replaces it (ticket a144ae3a71).

{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$process_user$$/projects/$$repository_name$$/$$run$$"
    },
    {
      "step": "password"
    },
    {
      "step": "clone",
      "into": "$$workspace$$/clone"
    },
    {
      "step": "checkout",
      "of": "trunk",
      "into": "$$workspace$$/tree"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "linux_capabilities": [],
    "network": true,
    "isolate_terminal": true,
    "ends_with_parent": true,
    "read_only": [
      "/usr",
      "/bin",
      "/sbin",
      "/lib",
      "/lib64",
      "/etc/resolv.conf",
      "/etc/hosts",
      "/etc/nsswitch.conf",
      "/etc/ssl/certs",
      "/root/.local/bin/claude",
      "$$release$$"
    ],
    "read_write": [
      "$$workspace$$"
    ],
    "homes": [
      "/root/.claude"
    ],
    "created_files": [
      {
        "at": "/etc/passwd",
        "text": "$$process_user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "8h"
  },
  "process": {
    "command": [
      "/root/.local/bin/claude",
      "-p",
      "--dangerously-skip-permissions",
      "Your standard input holds a line {\"run\", \"objective\"}: work toward that objective in this checkout. When a second line {\"post\", \"from\", \"text\"} follows, it is a forum post to you: answer it with `ocx2 post POST TEXT`, POST being its hash, from this directory."
    ],
    "cwd": "$$tree$$",
    "session": true,
    "hears": [
      "stone"
    ],
    "deliveries": "start",
    "env": {
      "HOME": "$$workspace$$",
      "USER": "$$process_user$$",
      "PATH": "$$release$$:/usr/local/bin:/usr/bin:/bin",
      "IS_SANDBOX": "1",
      "CLAUDE_CONFIG_DIR": "$$workspace$$/.claude"
    }
  }
}