ClawQLAgents
Agents that decide when to act. Interfaces they build for the moment. Audit trails that prove everything.
Agentic infrastructure for regulated production work — event-driven sessions, structured institutional recall, hardware-verified execution, and a WORM trail on every action. Mechanism-proven on OpenBench mini-firm Calderwood & Harkness tasks (B-7).
Built for production, not demo loops
Apache 2.0 core · Event-driven, not prompt-driven · OpenBench mini-firm proven · TEE-ready from day one
No human starts the session. No developer builds the interface. Everything is recorded.
The agent loop that doesn’t wait for you
Every other agent platform requires a human to start the session. ClawQL agents start themselves.
- 01
Listen
clawql-streams
A stream_subscribe call points at any event source — WebSocket feed, NATS subject, webhook, cron, API on an interval, or QR stream from an air-gapped system. The agent waits.
- 02
Decide
Significance filter
When an event arrives, the significance filter evaluates whether it warrants an agent session. Below threshold — logged and discarded. Above threshold — agent spawns automatically.
- 03
Act
Full ClawQL tool surface
memory_recall pulls prior context. Structured ontology queries enumerate exact entities — no near-misses. execute acts on connected backends. Every action writes to the WORM trail before acknowledgment.
- 04
Converge
Ouroboros
The Ouroboros loop iterates until Seed acceptance criteria are met. The agent does not stop because it ran out of turns. It stops when it is done.
- 05
Surface
/mcp-ui
When a human decision is required, the agent scaffolds a browser interface for that moment — forms from the exact decision needed, HTMX, no frontend project. The choice is logged to WORM.
Institutional knowledge that closes sets, not approximates them
Semantic recall returns what looks relevant. Structured ontology recall returns what matches — exactly, with no extras.
Harvey AI published the Calderwood & Harkness failure mode: agents retrieve near-misses and stop confidently, missing exhaustive institutional criteria. We rebuilt that failure in OpenBench as a mini-firm harness (B-7), then fixed it structurally with ontology-typed recall — reproducible GitHub Actions runs, not Harvey LAB criterion pass rates.
Without ontology
Keyword / semantic recall
The agent calls memory_recall, gets near-miss results, writes an answer. Any false positive scores zero. The task fails even though the agent “did the right thing.”
With ontology
Structured predicate recall
{
"query": "matters with escrow and non-compete clauses",
"schema": "legal.Matter",
"filters": {
"escrowPct": { "gte": 10 },
"nonCompeteMonths": { "gt": 18 }
},
"confidenceMinimum": "EXTRACTED"
}Exact five-of-five. No near-misses. Two turns. O(1) at any corpus size.
OpenBench B-7.1 fair same-files (mini-firm) — run 31255172649
| Arm | Score | Matters found | Retrieval path |
|---|---|---|---|
| ClawQL on | 3/3 (1.0) | 5/5 | structured_predicate |
| ClawQL off | 0/3 | 0/5 | could not complete |
| No memory | 0/3 | 0/5 | could not complete |
CQE — ClawQL's open entity definition format — is how the decision gets written down. The legal Matter pack ships with the platform. Lending, government, and surveillance packs follow the same format.
Anything to MCP. MCP to anything.
ClawQL Core turns any API into an MCP tool. mcp-api-adapter exposes any MCP server on eight surfaces — including /mcp-ui.
A gRPC service talks to a GraphQL consumer. A blockchain node becomes agent-callable. A government audit system streams records through a QR optical channel — no network path, air gap structurally preserved.
Eighth surface
/mcp-ui — Swagger UI for MCP
Auto-generated HTMX browser interface from the tool catalog. Every tool becomes a form. Results render inline. No JavaScript framework. No build step. Since Core ingests any API into MCP, /mcp-ui becomes a browser UI for every connected source — and agents can scaffold situation-specific forms when they need a human decision.
clawql-tee — hardware-verified agent execution
For regulated environments where the operator itself cannot be trusted.
Fully DO-compatible runtime supporting AMD SEV-SNP, Intel TDX, and AWS Nitro Enclaves. Hardware attestation proves what software is running. Vault releases secrets only after verification. GPU confidential computing keeps weights and inputs away from the host. Audit leaves the TEE through a QR optical channel — fountain codes, encryption, HMAC, Merkle verification.
| Layer | What it proves |
|---|---|
| Cosign binary attestation | Binary is exactly clawql-tee vX.Y, unmodified |
| WASM capability sandbox | Tool code cannot access undeclared capabilities |
| Attestation-gated virtual keys | Model API access only after hardware verification |
| WORM audit trail | Every action recorded before acknowledgment, RPO=0 |
| QR air-gap transport | Audit reaches verifier via a channel the operator cannot influence |
| GPU confidential computing | Model weights and inputs never exposed to the host |
Correctness by Construction — Erlang · OxCaml · SPARK applied to clawql-tee →
What changes when the infrastructure is right
- 01
Agents that initiate
Managed platforms wait for a human to start a session. Streams wakes agents when events cross the significance threshold — compliance deadlines, staking drops, outcome divergence. Humans review decisions, not prompts.
- 02
Recall that closes sets
Semantic similarity cannot enforce a predicate. CQE schemas and ontology.db structured filters enumerate exact sets — every match, no extras, O(1) at any corpus size.
- 03
Auditability you can prove
Merkle-chained WORM, LTX replication with RPO=0, hardware attestation via clawql-tee, and QR export to an air-gapped examiner is not a log file. It is a verifiable record of what the agent decided and what the human chose.
Enterprise agent deployments for regulated industries
Hardened OpenClaw, Hermes, Pi, and Goose agents — running in clawql-tee, preconfigured with ClawQL's 32-module security curriculum. Structured recall is mechanism-proven on OpenBench mini-firm (B-7); Harvey LAB firm-knowledge remains the next evidence tier.
The security and advanced capabilities are only possible because of ClawQL.
| Tier | Price | What's included |
|---|---|---|
| Self-Serve Helm | $299/month | Helm chart, four agents, security defaults, configuration presets |
| Managed Deployment | $999/month | ClawQL-managed infrastructure, direct support channel |
| Enterprise TEE | from $3,500/month | clawql-tee, hardware attestation, WORM audit, QR export, SLA, DPA/BAA |
Every session makes the next one better
Passing traces become SFT data. Paired pass/fail traces become DPO pairs. Verifiable rewards feed GRPO when ground truth is automatic. Better sessions grow the dataset that fine-tunes the next run.
OpenBench mini-firm traces already close a local loop: structured-predicate wins become preferred SFT/DPO arms. When a Harvey LAB firm-knowledge ledger exists, that third-party scoreboard becomes the next ground truth for the fine-tune that improves the next result — it is not published yet.
Start where the agent need is loudest
Domain vertical packages are plugin presets — CQE schemas, domain tools, and workflows — not separate products.
Legal
Matter ontology, institutional knowledge enumeration, client preference reconstruction — OpenBench B-7 mechanism-proven
Government
Outcome accountability, Arweave-anchored baselines, FOIA-ready document vault, state auditor API
Lending
Income doc processing, LOS updates, fair lending compliance audit trail
Surveillance
ALPR abuse pattern monitoring, chain of custody for footage, authentication challenge documentation
Events
Live event and concert management, ticket and venue agent automation
Built for examiners
Sovereignty and auditability are defaults — not a separate enterprise pack negotiated after the pilot.
- Self-hosted or air-gapped
Apache 2.0 core. Full agent stack on your cluster. No forced SaaS data plane.
- WORM audit per action
Merkle-chained, LTX-replicated with RPO=0. Every tool call, inference call, and human decision.
- ATR scoping
Agents can only call tools declared in their scope. Panguard enforces at tool-call time. Fail-closed.
- Cosign-signed images
Kyverno admission enforcement on the cluster. Unsigned images never run.
- clawql-tee
Hardware attestation for AMD SEV-SNP, Intel TDX, and AWS Nitro Enclaves. GPU confidential computing. QR air-gap audit export.
- 32-module security curriculum
Documented, reproducible, publicly available at docs.clawql.com/security.
$29/month to start. $3,500/month for enterprise TEE.
Self-host free on Apache 2.0, or start a 14-day Developer trial. One MCP endpoint on every tier — same URL when you upgrade.
Streams loop and TEE specs: clawql-streams · clawql-tee · /mcp-ui
Is this the agent infrastructure you’ve been looking for?
Engineering and compliance teams: start with the gateway and memory. When you need structured ontology recall, Streams event triggers, or clawql-tee for regulated environments — it's the same endpoint, no second vendor conversation.