A session commits and pushes the check-in to build, then sends this run from its clone as its own user holding `R`: `ocx2 create "stage CHECKIN" --pattern URL --login LOGIN --clone CODE --to POST --of CHECKIN`. LOGIN and CODE name the builder's acting login and its clone's server-code; POST is in the session's thread. URL is this file's content-addressed raw URL after it is published as a tech-note attachment, as for [the Codex task pattern](codex-task.md).

`--of` must be the check-in's full hash. Import refuses a run whose `of` is not that full hash.

The run clones the server anonymously into its workspace, opens CHECKIN and runs `crystal run ci.cr -- build $$workspace$$/release x86_64` in that checkout, niced. The checks install their pinned shards when needed. Only a successful check and build leaves `ocx2`, `release.txt` and `gate.txt` in the workspace's `release/`; the run exits with the build's status. OCX sends those files as unversioned files under `releases/$$run$$/`, each run's own names. On failure they are absent, and OCX records them as missing in `ended.outputs`.

This pattern is for x86_64 builders. Another architecture needs its own pattern: the server will count only a run whose content is a known pattern with only the check-in filled in. The run has no homes or secrets, needs no default Fossil user, writes only in its workspace and ends with its parent. It has two hours of wall time, an hour of CPU per process, 512 processes and files of 256M for the full CI run and build. A person imports the files with `ocx2 import RUN` on the server; [USAGE](../USAGE.md#stage-accept-or-roll-back-a-release) describes import.

```json
{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$process_user$$/projects/$$repository_name$$/$$run$$",
      "remove_on": "saved"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "linux_capabilities": [],
    "network": true,
    "isolate_terminal": true,
    "ends_with_parent": true,
    "read_only": [
      "/usr", "/bin", "/sbin", "/lib", "/lib64",
      "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs"
    ],
    "read_write": ["$$workspace$$"],
    "homes": [],
    "created_files": [
      {
        "at": "/etc/passwd",
        "text": "$$process_user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "2h",
    "cpu": 3600,
    "processes": 512,
    "file_size": "256M"
  },
  "process": {
    "user": "stage-task",
    "command": [
      "/bin/sh", "-c",
      "fossil clone $$server_url$$ $$workspace$$/clone.fossil && mkdir $$workspace$$/tree && fossil open $$workspace$$/clone.fossil $$checkin$$ --chdir $$workspace$$/tree --nosync && cd $$workspace$$/tree && nice -n 19 ionice -c3 crystal run ci.cr -- build $$workspace$$/release x86_64"
    ],
    "cwd": "$$workspace$$",
    "keep": {"stderr": "4K", "stdout": "4K", "stdout_when": "always"},
    "unversioned_files": [
      {"at": "$$workspace$$/release/ocx2", "as": "releases/$$run$$/ocx2"},
      {"at": "$$workspace$$/release/release.txt", "as": "releases/$$run$$/release.txt"},
      {"at": "$$workspace$$/release/gate.txt", "as": "releases/$$run$$/gate.txt"}
    ],
    "env": {"HOME": "$$workspace$$", "USER": "$$process_user$$", "PATH": "/usr/local/bin:/usr/bin:/bin"}
  }
}
```