Requirements
Source access, runtime, GitHub App, model, sandbox and infrastructure prerequisites for self-hosting.
These requirements describe the engine in son-of-anton-review on feat/cloudflare-native. The expanded operator API lives in son-of-anton-operator-parity on feat/greptile-operator-parity; WorkOS session support lives in anton-ui-trace-parity on feat/trace-api-parity, not the older anton-ui tree. Neither dashboard is required to run the engine.
Source access and licensing
The verified handoff records the GitHub engine repository as private. No LICENSE is present in the checked-out engine; package.json is marked private: true and still names the legacy gilf-pr-system repository URL. Those fields do not grant permission to redistribute. Obtain an authorized checkout and permitted-use terms from the owner before installing. Do not assume an anonymous clone or a publishable fork.
The parity directories are linked Git worktrees. Check the actual branch and resolved path of an existing checkout rather than assuming the directory name means an integrated release. A native deploy does not deploy the parity API.
Checklist
| Requirement | Node | Cloudflare-native |
|---|---|---|
| Authorized engine source and dependencies | Yes | Yes, on the deployment machine |
| Node runtime | Use Node 25, matching the shipped image | OMP Dockerfile pins node:25-bookworm-slim |
| Git and GitHub CLI | Required on the worker host | Installed in the OMP image |
| GitHub clone/fetch credentials | Provision for the service user separately from App publishing credentials | Broker-minted read token and gh credential helper are wired into the container |
| GitHub App ID, key and webhook secret | Yes | Yes, with the App key on the broker only |
| Model provider and authentication | Yes | Yes; OpenRouter is the headless default in the image |
| Validation executor | Explicit E2B, Crabbox or an isolated self-host command | Shipped config selects Cloudflare Sandbox |
| Durable state | Shared SQLite file(s), writable by both processes | D1, Queue, KV and R2 resources |
| Public HTTPS ingress | Proxy/tunnel to the Node server | Main Worker URL |
| Cloudflare deployment tooling | Only for optional remote services | Wrangler, account authorization and working container-image build tooling |
Runtime and storage
The entrypoints import DatabaseSync from node:sqlite; Node 20 is not compatible. The package has no engines check, so npm installation alone is not proof of runtime compatibility. Node 25 matches the checked-in image; this is a concrete runtime choice, not a claim that every other Node release was tested.
The Node runner uses gh repo clone, followed by Git fetch/checkout. A human must arrange restricted authentication for both tools under the worker's OS user. The Node App client authenticates publication, not those subprocesses.
Set an absolute GILF_DB_PATH, create its parent directory, and give both server and worker access. A separate GILF_QUEUE_DB_PATH is optional. With neither a persistent queue path nor a remote queue, each process has its own in-memory queue; they cannot exchange jobs. A remote queue does not replicate the SQLite run store.
Set GILF_REVIEW_WORK_ROOT to a service-owned workspace directory with enough space for the selected concurrency. Source defines no universal RAM, CPU, free-space or throughput minimum. Preserve durable policy, publication and review history in backups; it is not all reconstructible from GitHub.
GitHub App and scope
For review publication and source access, the implementation uses repository permissions contents:read, pull_requests:write, checks:write and metadata read access. The publisher narrows its token requests per operation and repository. The broker's default permission set is not a universal prohibition against other explicitly requested scopes.
Configure these event subscriptions if you want all event families handled by the engine:
pull_request: PR lifecycle and head updates.issue_comment: manual commands on PR conversations.pull_request_reviewandpull_request_review_comment: additional review/competitor context events.
Not every delivery causes a review. Action filters, draft/branch settings, authorization and policy still apply. Node defaults automatic reviews to base branches main and dev, excluding drafts. Native ingress accepts a broader intent stream and the container applies native policy admission.
Install the App only on intended repositories. GILF_REPOS is not a security allowlist: Node uses it to seed stored config, while missing repo config still merges with enabled defaults. The native runtime does not read it. Native unseen repositories instead require explicit enablement under default autoEnableNewRepos=false; see the native runbook.
Use GITHUB_APP_PRIVATE_KEY_PATH for an operator-protected Node key file, or inline GITHUB_APP_PRIVATE_KEY. Inline wins when both are present. Neither entrypoint automatically loads an env file; the quickstart uses Node's explicit --env-file option.
Model
OpenRouter is recommended. Set OPENROUTER_API_KEY and an explicit provider/model pair: GILF_CODEX_PROVIDER=openrouter / GILF_CODEX_MODEL for the checked-in Node entrypoint, or GILF_MODEL_PROVIDER=openrouter / GILF_MODEL for native deployment. The Node runner does not call the modern resolveModelConfig() helper, so its per-provider defaults and role overrides do not describe Node execution. The free-only guard is on unless GILF_OPENROUTER_REQUIRE_FREE=0; paid usage needs deliberate approval. Source examples do not establish current model availability or price.
Alternatives are OpenAI direct, Anthropic direct and Codex CLI. Codex needs an installed, authenticated CLI on Node. The shipped native image points Codex at a failing placeholder, so switching its provider to codex is not sufficient. See Model providers.
Validation compute
| Executor | Prerequisite and limitation |
|---|---|
managed-crabbox | Available crabbox binary, or GILF_CRABBOX_BIN, and a working service configuration. Resolver default when no explicit/legacy selection exists. |
managed-e2b | E2B SDK dependency, E2B_API_KEY and usable sandbox capacity. Set the timeout explicitly. |
managed-cf-sandbox | A wired native Sandbox collector/binding; setting GILF_CF_SANDBOX_ENABLED=1 on Node cannot create it. |
self-host | GILF_SELF_HOST_VALIDATION=1 and GILF_SELF_HOST_EXECUTOR_CMD; the command must actually run code in isolated compute and clean it up. GILF_SELF_HOST_NETWORK declares intent, not enforcement. |
Missing/unknown executors refuse and report missing validation. Do not use GILF_ALLOW_LOCAL_VALIDATION=1 to bypass this boundary for untrusted PRs. E2B network access defaults open in repository config; configure egress deliberately. See Validation executors.
Cloudflare account
The checked-in deployment runbook requires Workers Paid and Containers enabled. Account permissions, region capacity, current commercial requirements and quotas are external prerequisites: have the account owner verify them. No source inspection proves that a particular account can deploy.
Install an approved Wrangler version and confirm its target account. npm ci installs the declared Container/Sandbox SDKs but not Wrangler. Both native config files contain estate-specific IDs; replace those before deploying. The main config is checked in with publication and cron authority live, not shadow.
Provision the bindings in Cloudflare quickstart. A fresh D1 database requires both schema.sql and migration 002 for cron tables. The OMP Dockerfile uses repo-root build context; the Sandbox application has its own Dockerfile.
Network and human approvals
Node listens on PORT, default 8787, and accepts GitHub webhooks at POST /github/webhooks. Use an approved HTTPS endpoint and keep operator routes protected. Outbound access is needed for GitHub API and repository transport, the chosen model provider and sandbox services; this is not an exhaustive domain allowlist for dependency installation.
A human must authorize repository access, App permissions/installation, credential provisioning, infrastructure changes and paid usage. Live publication and scheduler cutover are separate approvals. Agent onboarding names those gates and distinguishes listener health from completed reviews.