Best possible solution:

Land the QA wrapper and metadata refactor after required CI finishes, with any extra full Docker lane proof captured as maintainer release validation rather than a code repair.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a QA coverage and Docker lane refactor, not a bug report with a current-main failure to reproduce. The relevant check is whether the updated scenario metadata and wrapper paths remain valid.

Is this the best way to solve the issue?

Yes: the PR uses the existing QA script-scenario contract and existing Docker E2E shell entrypoints instead of inventing a new runner. The only remaining uncertainty is full Docker lane execution, not the code shape.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0ce10d779302.

Label changes:

• add P3: This is a low-risk maintainer-authored QA/test coverage cleanup with no product behavior change or confirmed user-facing regression.
• add merge-risk: 🚨 automation: The diff changes QA Lab scenario metadata and Docker E2E script dispatch paths, so merge correctness depends on automation behavior beyond ordinary source compilation.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a maintainer-authored PR, so the external-contributor real-behavior-proof gate does not apply; the PR body still lists targeted command evidence and CI includes passing proof checks.

Label justifications:

• P3: This is a low-risk maintainer-authored QA/test coverage cleanup with no product behavior change or confirmed user-facing regression.
• merge-risk: 🚨 automation: The diff changes QA Lab scenario metadata and Docker E2E script dispatch paths, so merge correctness depends on automation behavior beyond ordinary source compilation.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a maintainer-authored PR, so the external-contributor real-behavior-proof gate does not apply; the PR body still lists targeted command evidence and CI includes passing proof checks.

PR surface:

Tests +7, Other +167. Total +174 across 19 files.

What I checked:

• Live PR state: Live GitHub data shows this PR is open, authored by RomneyDa, labeled maintainer, mergeable but unstable while some broad checks were still running, with no human review comments yet. (5cb8c23edfac)
• QA lane wrapper diff: The PR head adds five new Docker lane keys to the existing scripts/qa/docker-e2e-lane.ts wrapper while preserving the current spawn-through-bash contract. (scripts/qa/docker-e2e-lane.ts:10, 5cb8c23edfac)
• Docker harness mount contract: Current main already mounts test/e2e/qa-lab into /app/test/e2e/qa-lab:ro, so moving Docker client harnesses under that subtree is consistent with the Docker E2E harness path contract. (scripts/lib/docker-e2e-package.sh:260, 0ce10d779302)
• Scenario schema compatibility: The QA Lab scenario schema supports native script executions with repo-root-relative path and optional args, and requires dotted coverage IDs under coverage.primary/secondary. (extensions/qa-lab/src/scenario-catalog.ts:78, 0ce10d779302)
• Taxonomy coverage IDs exist: The Docker and Raspberry Pi coverage IDs used by the new scenarios already exist in taxonomy.yaml, including docker.first-run-onboarding, docker.compose-network-access, and docker.backed-agent-sandbox-support. (taxonomy.yaml:6350, 0ce10d779302)
• Current Docker setup test coverage: Current main already has Docker setup assertions around image build args, onboarding command shape, token redaction, and gateway config writes; the PR only extends the asserted first-run note coverage in that existing test. (src/docker-setup.e2e.test.ts:383, 0ce10d779302)

Likely related people:

• RomneyDa: Authored and merged the adjacent QA Docker lane wrapper work in chore: fold release upgrade Docker lanes into QA #97689, and live PR search shows several recent merged QA coverage PRs by the same author. (role: recent QA/Docker lane contributor; confidence: high; commits: 5327340a09ed, c563c6f171d4; files: scripts/qa/docker-e2e-lane.ts, qa/scenarios/runtime/*docker*.yaml)
• wyf027: The shallow checkout blames the existing Docker QA scenario and Docker E2E harness files to commit 63fe5c74021d00721fb62a309d838e6883e6b73c; the commit title is unrelated, so this is useful only as a low-confidence routing signal from available local history. (role: shallow-history current-line owner; confidence: low; commits: 63fe5c74021d; files: qa/scenarios/runtime/docker-compose-setup.yaml, scripts/lib/docker-e2e-package.sh, scripts/e2e/agent-bundle-mcp-tools-docker-client.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.