Governance you can inspect after the fact — because it was recorded before.
InvarOS does not ask you to trust a dashboard. Every governed decision produces a durable, structured artifact: a signed Decision Receipt, a single-use Authorization Lease, or a classified refusal. Topology artifacts, CBOMs, and in-toto statements reference those records by fingerprint. Nothing here is a probability score.
Deterministic DENY and ALLOW, before the tool runs.
InvarOS intercepts agent tool calls at the OpenClaw gateway and asks Governance for a decision before the tool body can execute. Deterministic DENY, deterministic ALLOW with a single correlated execution, fail-closed behavior when the governance daemon is unavailable, and daemon/socket recovery have all been runtime-verified. Authored fault, rewrite, concurrency, and model-facing execution paths remain unverified.
Agent tool call
OpenClaw before_tool_call hook (priority 100)
invarosd canonical adapter
transport · lifecycle · never the authority
DENY → HTTP 403
tool_call_blocked · body never executes
authority=governance decision=DENY reason=pilot.prohibited_marker
http=403 tool_call_blocked protected_body=0 bytes // not executed
request probe-allow-002 tool=invaros_probe_touch
authority=governance decision=ALLOW receipt=signed lease=single-use
lifecycle=CLAIM → COMPLETE http=200 executions=1 // exactly once
fault-injection daemon=unavailable → http=403 fail-closed executions=0
recovery socket=/run/invarosd/openclaw-authorize.sock → recovered
Representative of the qualified OpenClaw authorization evidence (installed-system qualification PASS, July 2026). Values shown are the recorded decision fields, not fabricated metrics.
Separate, durable, fingerprint-linked artifacts.
These are distinct artifact families — not fields buried inside one another. Each references the others by cryptographic fingerprint.
Decision Receipt
A signed record of a Decision, bound to the request, transaction, Snapshot, and mathematical verdict when one applies. Produced for every created governance transaction.
Authorization Lease
Issued only for ALLOW. Single-use and correlated to the exact tool call, consumed through a claim → complete / abort / expire lifecycle.
Classified refusal
A DENY carrying a refusal code and layer. Policy, topology, and attestation refusals are categorically distinct and independently auditable.
TBoM topology artifact
The invarosd topology plugin emits Edge Network Topology Profile artifacts per observation epoch, with host and topology fingerprints. See the open standard →
ES256 receipt (standalone)
The receipts plugin generates and verifies ES256 (ECDSA P-256 + SHA-256) ContractEvent evidence. It is loadable today but not yet orchestrated into the edge daemon's automatic per-observation path.
CBOM · in-toto · ZK-ready claim
The enterprise attestation pipeline emits a CycloneDX 1.6 CBOM, an in-toto Statement (unsigned structural or signed DSSE envelope), and a ZK-ready compliance claim. "ZK-ready" is the schema format, not a production proving system.
The open artifacts, you can check yourself.
The Topology Bill of Materials standard is public and Apache-2.0 licensed, with JSON Schemas, a reference validator, and conformance vectors. You can validate topology artifacts against their declared profile without contacting us and without a network connection. The governed Decision Receipt, Authorization Lease, and refusal formats are part of the commercial platform; we are happy to walk architects through real examples.