feat(prorl): openclaw combined image + live-model rollout validation

glm-5.1 is incompatible with hermes (#241), so add Dockerfile.prorl-openclaw
(FROM clawbench-harbor-runtime + openclaw harness) and validate a live-model
rollout: glm-5.1 x openclaw launches and drives the browser at scale (one task:
233 actions / 1545 requests) end-to-end in the container, interceptor armed,
verifier emitting a real reward.json. Rewards 0.0 across sampled tasks (glm
doesn't complete the target actions — the auth-wall; a model-capability result,
not a pipeline defect; 0.0 is a valid negative RL signal). Docs updated.

Author: reacher-z

docs/prorl-rl-env.md

@@ -118,6 +118,23 @@ Two requirements this surfaced (both handled): `prepare-task.py` needs
 persona resume from `resume_template.json` (now baked into `Dockerfile.prorl`
 and uploaded in `submit.py`).
 
+### Live-model rollout (glm-5.1 × openclaw)
+
+glm-5.1 is incompatible with hermes (#241, the agent crashes on startup), so an
+**openclaw** combined image (`Dockerfile.prorl-openclaw`) was built and run with
+glm-5.1 as the policy. Result: the harness **launches and drives the browser at
+scale** — one task (v2-1097) produced **233 actions / 1545 requests** in a single
+episode — with the interceptor armed and the verifier emitting a real
+`reward.json`. So the environment produces a genuine (trajectory, reward) unit
+from a *live acting model*, end-to-end in a real container.
+
+Rewards were `0.0` across the sampled tasks: glm-5.1 browses extensively but does
+not complete the target actions (the credential/auth-wall — the dominant failure
+mode ClawBench measures; even gemini scored only ~29%). This is a
+model-capability result, not a pipeline defect, and `0.0` is a valid negative RL
+signal. A *passing* reward needs a stronger policy (frontier keys) or a training
+loop — the runbook below.
+
 Not validated here (needs a live *acting* model + a GPU/vLLM/trainer fleet): a
 *task-completing* rollout (non-zero reward) and GRPO training. In the dev-box run
 the reward was `0.0` because the only live key (glm-5.1) is incompatible with the

src/clawbench/prorl/Dockerfile.prorl-openclaw

@@ -0,0 +1,22 @@
+# Combined ClawBench image for Polar RL rollouts, using the openclaw harness
+# (glm-5.1 is incompatible with hermes, #241, but works on other harnesses).
+# FROM the Harbor runtime image + an openclaw harness layer installed as
+# /run-harness.sh. Build context = src/clawbench.
+FROM node:24-slim AS node-runtime
+
+FROM clawbench-harbor-runtime
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+RUN PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install -g openclaw@2026.3.13
+RUN find /usr/local/lib/node_modules/openclaw/dist -name '*.js' -exec \
+    sed -i 's/"--autoConnect"/"--browserUrl",process.env.CLAWBENCH_BROWSER_CDP_URL/g' {} +
+
+COPY runtime/harnesses/openclaw/setup-openclaw.sh /setup-openclaw.sh
+COPY runtime/harnesses/openclaw/run-openclaw.sh /run-harness.sh
+COPY runtime/harnesses/openclaw/usage-emitter.py /usage-emitter.py
+COPY runner/run_support/resume_template.json /app/src/harbor/resume_template.json
+COPY prorl/run-prorl.sh /run-prorl.sh
+RUN chmod +x /setup-openclaw.sh /run-harness.sh /usage-emitter.py /run-prorl.sh