Live-qualified · agent tool-call interception

Deterministic DENY and ALLOW, before the tool runs.

InvarOS intercepts agent tool calls at the OpenClaw gateway and asks Governance for a decision before the tool body can execute. Deterministic DENY, deterministic ALLOW with a single correlated execution, fail-closed behavior when the governance daemon is unavailable, and daemon/socket recovery have all been runtime-verified. Authored fault, rewrite, concurrency, and model-facing execution paths remain unverified.

Agent tool call

OpenClaw before_tool_call hook (priority 100)

framed AF_UNIX authorization request

invarosd canonical adapter

transport · lifecycle · never the authority

Local Governance Protocol

Governance Host (sole authority)

Decision · Receipt · Lease → Math Provider when constrained

DENY → HTTP 403

tool_call_blocked · body never executes

ALLOW → HTTP 200

signed receipt + single-use lease · exactly one execution

openclaw + invarosd — governed authorization (qualified pilot evidence)
request probe-deny-001 tool=invaros_probe_touch
authority=governance decision=DENY reason=pilot.prohibited_marker
http=403 tool_call_blocked protected_body=0 bytes // not executed

request probe-allow-002 tool=invaros_probe_touch
authority=governance decision=ALLOW receipt=signed lease=single-use
lifecycle=CLAIM → COMPLETE http=200 executions=1 // exactly once

fault-injection daemon=unavailablehttp=403 fail-closed executions=0
recovery socket=/run/invarosd/openclaw-authorize.sockrecovered

Representative of the qualified OpenClaw authorization evidence (installed-system qualification PASS, July 2026). Values shown are the recorded decision fields, not fabricated metrics.

Evidence families

Separate, durable, fingerprint-linked artifacts.

These are distinct artifact families — not fields buried inside one another. Each references the others by cryptographic fingerprint.

Governed path

Decision Receipt

A signed record of a Decision, bound to the request, transaction, Snapshot, and mathematical verdict when one applies. Produced for every created governance transaction.

Governed path

Authorization Lease

Issued only for ALLOW. Single-use and correlated to the exact tool call, consumed through a claim → complete / abort / expire lifecycle.

Governed path

Classified refusal

A DENY carrying a refusal code and layer. Policy, topology, and attestation refusals are categorically distinct and independently auditable.

Edge runtime

TBoM topology artifact

The invarosd topology plugin emits Edge Network Topology Profile artifacts per observation epoch, with host and topology fingerprints. See the open standard →

Edge runtime

ES256 receipt (standalone)

The receipts plugin generates and verifies ES256 (ECDSA P-256 + SHA-256) ContractEvent evidence. It is loadable today but not yet orchestrated into the edge daemon's automatic per-observation path.

Enterprise pipeline

CBOM · in-toto · ZK-ready claim

The enterprise attestation pipeline emits a CycloneDX 1.6 CBOM, an in-toto Statement (unsigned structural or signed DSSE envelope), and a ZK-ready compliance claim. "ZK-ready" is the schema format, not a production proving system.

Independently verifiable

The open artifacts, you can check yourself.

The Topology Bill of Materials standard is public and Apache-2.0 licensed, with JSON Schemas, a reference validator, and conformance vectors. You can validate topology artifacts against their declared profile without contacting us and without a network connection. The governed Decision Receipt, Authorization Lease, and refusal formats are part of the commercial platform; we are happy to walk architects through real examples.

Explore the TBoM standard See topology captures Request an evidence walkthrough