garden — research

Source: "Peter Steinberger | OpenClaw Creator," Greg Kamradt's channel (82YaJw-_t10), published 2026-07-02, 19:58 (lightning talk + Q&A). Transcript via yt-dlp captions, distilled 2026-07-18. This talk predates his AI Engineer keynote (Jul 9) by a week and contains the original form of its central line:

"Last year I was constrained by tokens. I fixed that by joining OpenAI. Then I was constrained by CPU — I fixed that with Crabbox. And now my constraint is actually attention... What you really want to optimize is how often you need to be in the loop with your agent — expand everything the agent owns, from the prompt through verification."

The keynote gave the doctrine; this talk gives the three concrete mechanisms he built to live it.

1. Transcript-on-PR — provenance as a contribution filter

OpenClaw's problem: a flood of zero-effort PRs — "some people literally make a PR by typing 'fix #1234' into the coding agent... and you have a PR that's 4,000 lines and you don't know whether it's even worth your time."

The fix is a default repo skill: after an agent creates a PR, it offers to upload a sanitized version of the coding-session transcript, with the nudge that transcript-attached PRs are far more likely to get reviewed. The transcript becomes a triage signal: "did you spend one minute prompting this or one hour? The longer your transcript, the higher my confidence that you actually care about — or at least tried to understand — what you fixed." Both the maintainer and the maintainer's agent read them.

Two meta-lessons he stresses:

"It took me way too long because I was thinking too complicated. Do I need hooks? How do I build this? Actually, it's just a skill" — a markdown file explaining how to find the session JSON, sanitize it, and attach it. Works across coding agents because "ultimately it's just JSON."
Distribution by default: "because I'm the benevolent dictator for life, I just made it a default skill" — anyone checking out the repo gets it, and the agent knows to load it on PR/issue creation.

The adversarial footnote from Q&A: their old 1-to-5 PR-rating review bot (the captions garble the name; almost certainly CodeRabbit, which the OpenClaw repo used) — "we found more than one instance where it gave a 2 and people just manually edited the description to say 5, great PR, merge." Provenance signals get gamed the moment they gate attention — he'd "not be surprised" by faked transcripts either.

2. Auto-review — feedback returns to the session that has the context

Also a default skill: on PR or commit, the agent invokes whatever reviewer CLI is installed (Codex, Claude, Pi, OpenCode — "we're not discriminating") and pipes the review back into the originating coding session, not to a fresh reviewer context.

The reasoning is the sharpest part: an outside reviewer (human or agent) loading a PR cold will "find three things, fix those things — and actually break things, because from a naive standpoint these might be issues, but if you deeply understand it, maybe that's actually a design decision." The authoring session has the constraints in context, so it can accept or overrule each finding — and his instructions then write the accept/overrule decisions into the PR description, so the next reviewer doesn't re-flag the same intentional choices.

Costs and caveats, in his words: "my favorite skill of all time — also it made everything way slower... I think I made both Anthropic and OpenAI millions with just this, it's a massive token burner." And it "can go a little overboard" unless AGENTS.md pins invariants ("these files will not change after the app started") — "coding agents always write for the worst case."

3. Crabbox — fresh machines as an agent primitive

Born from CPU pain (10 concurrent sessions, "my MacBook starts to become like it will take off") and a dead vendor dependency (Blacksmith's test boxes had daily outages, he wanted a fallback). What it became:

The agent rsyncs repo changes to a remote box seeded from the repo's GitHub Actions CI state ("if you have CI, it'll just work") and runs everything expensive there. He says "~30 providers, including really weird things if you work at a company with high security... or even Parallels" — the repo now documents ~75 (see the verification section below).
Fresh-machine verification is the deeper point: "if I test it on my system, my system is already configured somehow... maybe it passes because I changed something in the past. What you really want is to increase your confidence that what you prompt actually works — you want to start with a fresh machine." Linux, Windows, and macOS boxes; "install OpenClaw on — what OS is this?" becomes a primitive the agent just has.
The agent gets "eyes" — screenshots and clicks on the box ("cheap-man's computer use") — without the classic pain: "with classical computer use you'd fight with your mouse cursor or the focus would change... because this one uses a fresh box and you just VNC into it, you don't have any of that."
Sharable VNC links close the loop with non-coders. His "hypothetical": a Slack feedback channel where a bot implements a feature request and replies with a VNC link, so the person who asked — who can't code — clicks around the live build "and then realizes it's a very dumb idea." The punchline is the filter economics: "then I only need to look through maybe a third of the feedback, because it already has been verified."

Live on stage he demo'd the loop by prompting a UI restyle ("make it super gay and rainbows") and let it run in the background of the whole talk — the rainbow arrived during Q&A.

The Q&A — deflations and residuals

"Loops is just a very fancy word for workflow." His open-source repos: an issue arrives → an agent evaluates it against vision.md (his written project direction) → if it fits, a PR gets built → another agent reviews and repairs it → he sees a ready-to-merge queue instead of "20 minutes of a stream of coding agents doing their thing."
Human-in-the-loop trajectory: "in the beginning I was kicking and screaming because the model wouldn't do what I want... now it's more syncing up front" — then 1–10 hours of autonomous implementation, then verification artifacts: prompts that produce before/after videos (GIFs, since GitHub won't play video) so the merge decision is visual.
Is attention solved? "I can't kill them all... agents need much less babysitting because you give them more tools, but you still need the thinking of: is this actually something we want? Nobody can take that away."
The residual pain: "it still requires so much thinking... we produce much more code and build much more complex systems... agents are just not really good at understanding how this one thing fits into the big picture. They're like horses — you kind of push them to look around, but keeping the system in your head — does everything fit together, does it actually feel right — agents can't do that yet."

The read

Every mechanism is an attention valve. Transcripts filter whose work deserves attention; auto-review spends tokens to pre-filter findings; Crabbox VNC links make other people verify before anything reaches him. The keynote's "deciding where to spend attention" is implemented here as: build filters, then only look at what survives them.
Skills beat infrastructure — twice he says he over-thought it. Both the transcript and auto-review mechanisms are markdown skills, not hooks/bots/CI plumbing, and both got distribution by being repo defaults. The lesson generalizes: the cheapest deployable unit of workflow change is a default skill in the repo.
Verification wants virgin state. The Crabbox argument against testing on your own machine (config drift makes both false passes and false failures) is the same argument as hermetic CI, extended to interactive agent verification — with VNC-shareability turning it into a review surface for non-programmers.
Signals gate attention → signals get gamed. The edited-rating anecdote is the proof; transcripts will be faked the moment they matter. Provenance helps triage, but the deterministic gate still has to be the thing that can't be edited.
The honest ceiling: system-level coherence — "does everything fit together, does it feel right" — is named as the thing agents can't do. A week later on the OpenAI stage this became "designing those harnesses and organizations is the next engineering problem." Same claim, pre-polish.

Verified against source (2026-07-18)

Auto-captions garble names — the first published version of this dossier called the tool "crapbox" because that is literally what the captions say. Everything below is verified against the actual repositories, which also turn out to be substantially richer than the talk:

Crabbox = openclaw/crabbox — "Warm a box, sync the diff, run the suite." A generic remote execution control plane, not just test boxes: a Go CLI (crabbox run -- pnpm test), an optional coordinator that owns provider credentials, lease state, and monthly spend caps (deployable on Cloudflare Workers + a Durable Object, or Node.js + PostgreSQL + pg-boss), and throwaway SSH runners. Per run: lease a runner, mint a per-lease SSH key, seed remote Git, rsync the dirty checkout (with a fingerprint skip when nothing changed), run, stream output, record evidence, release.
~75 documented providers (docs/providers/), not the talk's ~30 — including Parallels, Tart, Apple VZ (apple-vm, with a native crabbox-apple-vm-helper shipped in the Homebrew archive — that's the macOS story), Windows Sandbox, Hyper-V, Firecracker, E2B, Modal, GitHub Codespaces, blacksmith-testbox (the origin story checks out), and — closing a loop with the AI Engineer conference — cua.
Environment hydration comes from the repo, not from Crabbox: GitHub Actions hydration, devcontainer, Nix, or mise/asdf setup scripts — exactly the "starts with the same state as your GitHub Actions" claim from the talk.
The trust model is explicit: a developer execution tool for trusted teams, not a security sandbox or an isolation boundary between adversarial users.
Skill-first distribution is real product surface: crabbox init --detect generates a repo-local Agent Skill, and the skill installs cross-agent via npx skills add [crabbox.sh](https://crabbox.sh) --skill crabbox.
The transcript skill = agent-transcript (skills/agent-transcript). The contract is stricter than the talk's summary: local-only (never network), never upload raw logs, always ask the user first, fail closed on unresolved secrets/keys/cookies/auth URLs, drop system prompts + reasoning + raw tool output, keep user prompts + visible decisions + test/proof outcomes, scope-trim to the PR's work, and insert as a collapsed <details> section with idempotent update markers.
The auto-review skill = autoreview (in openclaw/agent-skills, symlinked into agent-scripts): Codex is the default engine (gpt-5.6-sol at high reasoning, one retry on gpt-5.6-terra for account-access only), Claude optional (claude-fable-5). The contract encodes the talk's philosophy precisely: review output is advisory — the authoring agent must "verify every finding by reading the real code path," reject unrealistic edge cases, and loop until no accepted findings remain; review bundles fail closed on secret-like content; reviews run against a validated bundle in an empty workspace. A sibling behavior-validator skill covers the source-blind "does the running product actually work" half — autoreview alone "is not proof that a UI, CLI, API, or generated artifact works from the user's perspective."
The before/after proof practice is institutionalized too: steipete/openclaw-pr-assets — "Proof assets (screenshots) for OpenClaw PRs; one release tag per PR."