HREVN AgentProof for OpenClaw

AgentProof records hash-only commitments to tool events exposed by native OpenClaw hooks and to Git changes observed during the same run. It also verifies canonical receipts and their recorded file commitments locally.

This collector runs inside the current OpenClaw process and observes the current run. It does not launch a separate agent session.

It contains no Sign, Anchor, HREVN service, HREVN credential, payment, settlement, blockchain operation or direct model API.

Exact boundary

The plugin:

• observes typed tool-call starts and completions;
• transiently reads tool inputs/results to create SHA-256 commitments;
• snapshots tracked plus untracked, non-ignored Git files before and after;
• persists no prompts, model responses, tool parameters/results, source bytes or diffs;
• emits no complete receipt if it observes a known gap;
• provides a local verify command.

OpenClaw hooks are the only tool-observation surface. A tool action for which OpenClaw emits neither start nor completion is undetectable unless it leaves a repository change visible to the snapshots. The collector is in-process and is not an independent witness.

On the validated host, before_tool_call has no default hook timeout, so the first tool waits for the baseline-snapshot attempt. An operator can configure a per-plugin hook timeout; AgentProof does not independently observe that effective override. If it expires, OpenClaw may continue while the plugin-owned attempt is still settling, so the resulting capture must not be treated as complete merely because later hooks arrive.

The unsigned local chain establishes internal consistency relative to retained bytes. Its producer can recompute it. It does not establish authenticity, completeness, truth, quality, safety, compliance, authority, payment entitlement or producer-independent tamper evidence.

Conversation-access permission

OpenClaw requires conversation access before a non-bundled plugin can receive the per-run agent_end boundary:

{
  "plugins": {
    "entries": {
      "hrevn-agentproof": {
        "hooks": {
          "allowConversationAccess": true,
          "allowPromptInjection": false
        }
      }
    }
  }
}

OpenClaw therefore supplies the agent_end event, including conversation data, to the plugin process. AgentProof reads only run/session identity from that event. Its handler does not traverse, hash, log, transmit or persist the messages. This is a property of the tested implementation, not an OS isolation boundary.

Configuration

Both settings are optional, but any supplied path must be absolute:

{
  "plugins": {
    "entries": {
      "hrevn-agentproof": {
        "enabled": true,
        "hooks": {
          "allowConversationAccess": true,
          "allowPromptInjection": false
        },
        "config": {
          "dataDirectory": "/absolute/private/agentproof-data",
          "repositoryPath": "/absolute/git/repository"
        }
      }
    }
  }
}

The default data directory is ~/.openclaw/agentproof. It must be outside the captured repository. When repositoryPath is omitted, the plugin uses the workspace root declared by OpenClaw and records that basis in the receipt.

Read the supported repository profile before enabling Capture.

Host-version behavior

Capture is validated only on OpenClaw 2026.7.1-2. If the package installs and loads on a different runtime, it registers the status command but no Capture hooks. Installation itself has not been tested on another OpenClaw version.

Local Verify remains available because it does not depend on the current live hook contract:

agentproof-openclaw verify \
  --receipt /absolute/path/agent-session.json \
  --repo /absolute/path/repository

MATCH means only that the currently checked file commitments match the receipt. It must not be reported as “authentic”, “complete”, “correct” or “verified work”.

Status

/agentproof-status reports whether Capture is enabled for the current OpenClaw version and repeats the evidence boundary. It does not invoke a model.

Gateway interruption and client fallback

Stopping the Gateway does not necessarily stop the caller. The OpenClaw CLI may retry an interrupted request through its embedded transport, producing a new run with a different runId and separate evidence. Treat that receipt as a different execution, not as completion of the interrupted Gateway run.

Platform

The initial candidate targets macOS and Linux. Publication remains a separate human decision after package validation and the native live gate.