BlueClaw

Thumbnail
Canary evidence: synthetic secret access and intercepted egress share one identifier, triggering BLOCK.
Safe capability: declared filesystem access matches observed behavior, producing an evidence-backed PASS.
Unsafe composition: sensitive reader → capability handoff → external publisher creates a blocked path.
Risky update: a newly added network-egress capability is detected and routed to REVIEW.
Governance: evidence-bound receipt, approved lock, and Action Passport state for the remediated PASS.
Remediation: the prior BLOCK is preserved while redaction earns a new evidence-backed PASS.

Inspiration

Agent ecosystems are becoming skill ecosystems. But adoption still tends to follow popularity, official status, and download counts because unfamiliar capabilities are difficult to inspect and verify.

That creates two problems.

First, a promising community-built skill may be better suited to a task than the best-known option, yet remain unused because it has not earned trust.

Second, evaluating capabilities individually is not enough. Two capabilities can be acceptable alone and unsafe together.

BlueClaw turns that trust problem into reproducible evidence.

What it does

BlueClaw is the evidence and governance layer for agent capabilities, skills, MCP servers, and composed capability packs.

BlueClaw Assurance evaluates one exact artifact version or pack composition for a named environment and policy.

It:

extracts and binds declared capabilities to exact versions;
compares versions for meaningful permission changes;
analyzes pack graphs for sensitive-source-to-external-sink paths;
uses GPT-5.6 to propose targeted, schema-validated test hypotheses;
executes only supported probes in a controlled, instrumented environment;
records capability deltas, graph paths, traces, canary access, intercepted egress, findings, and evidence hashes;
applies deterministic policy outside the model;
returns an inspectable PASS, REVIEW, or BLOCK decision;
binds results to BlueClaw’s existing receipts, pack locks, install guards, and Action Passport approvals.

The included demonstration proves five cases:

Safe capability → PASS
Risky version update → REVIEW
Unsafe composition → BLOCK
Canary exfiltration → BLOCK
Remediated composition → PASS

Every completed assurance run produces evidence scoped to the exact target, environment, policy, supported probes, and observed behavior represented by that run.

How I built it

Some of BlueClaw existed before Build Week as a broader control plane with artifacts and versions, pack DAGs and locks, but I picked it up with 5.6 Sol finishing the trust scoring, benchmarks and receipts, connectors, outcomes, Action Passport governance, and MCP/A2A surfaces with new important and critical additions entirely coded, concieved, architected during OpenAI Build Week. In the last 24hrs I added the complete BlueClaw Assurance lifecycle:

shared assurance contracts and lifecycle states;
capability, version-delta, and composition analysis;
a GPT-5.6 structured planning boundary;
secret-redacted canonical model context;
a controlled behavioral probe runner;
synthetic canary and intercepted-egress evidence;
deterministic PASS / REVIEW / BLOCK policy;
receipt, lock, install-guard, and Action Passport integration;
a complete API-backed Assurance interface;
five deterministic end-to-end cases;
judge setup, testing, screenshots, and documentation.

I used Codex with GPT-5.6 Sol as an implementation and coordination environment. A primary integration thread established contracts and owned the final architecture. Analyzer, runner, and interface work proceeded in isolated Git worktrees, followed by dedicated QA/red-team and submission workstreams.

Codex accelerated repository analysis, implementation, debugging, testing, branch integration, responsive QA, and documentation. Human judgment retained responsibility for the product thesis, architecture, safety boundary, policy semantics, scope, honest claim language, and final acceptance.

Within the product, GPT-5.6 proposes targeted hypotheses from canonical, secret-redacted context. Its output is schema-validated, unsupported probes cannot execute, and provider failures fail closed. Deterministic evidence and policy...not model opinion, make the final decision.

Challenges I ran into

Composition is harder than permission counting

Two permissions existing in the same pack do not automatically prove a dangerous path. BlueClaw had to identify the precise source, handoff, and sink, then connect that graph result to recorded behavioral evidence.

Using GPT-5.6 without delegating the verdict

The model is valuable for forming focused questions, but it should not unilaterally declare an artifact safe. We separated model planning, supported probe execution, evidence collection, and deterministic policy into explicit layers.

Producing useful evidence without overstating isolation

The current runner instruments controlled in-process fixtures, synthetic secrets, local resources, and an intercepted loopback sink. It truthfully records instrumented: true and isolated: false.

Extending rather than duplicating BlueClaw

Assurance had to reuse existing receipts, locks, install guards, and Action Passport records instead of creating a disconnected second trust system.

Reproducibility

Exact versions, graph fingerprints, canonical serialization, stable fixture data, evidence hashes, and replay fingerprints make equivalent assurance results inspectable and comparable.

Accomplishments that I am proud of

Delivered a complete lifecycle from target creation through planning, probe execution, deterministic evaluation, receipts, locks, and approval state.
Demonstrated that two individually acceptable capabilities can form a blocked sensitive-data path when composed.
Correlated synthetic-canary access with intercepted egress without exposing the raw canary value.
Preserved blocked evidence alongside a passing remediated run.
Built a GPT-5.6 Responses API integration with structured output, secret redaction, exact-family validation, typed failures, and recorded model metadata.
Created a polished, API-backed interface for version deltas, pack paths, trace replay, evidence, remediation, receipts, locks, and Action Passport state.
Built a deterministic judge path that runs all five scenarios without requiring an OpenAI API key.

What I learned

Testing components is not the same as testing the behavior created between them.
Model planning is most useful when constrained by exact versions, known paths, and an executable probe catalog.
“Unsupported” and “insufficient evidence” are meaningful results; silently skipping them would create false confidence.
Trust receipts are useful only when they bind exact scope and behavior.
Locks are useful only when later evidence can invalidate prior approval.
Honest boundaries improve credibility. A controlled instrumented runner can be valuable without pretending to be an arbitrary-code sandbox.

Honest boundaries

The submitted behavioral runner executes controlled, instrumented in-process fixtures and records isolated: false.
It is not an arbitrary third-party code sandbox and does not establish universal safety.
The deterministic five-case demo uses provided fixture hypotheses and does not misrepresent them as live GPT-5.6 output.
Live GPT-5.6 planning is opt-in and requires separately supplied credentials.
Local receipts remain visibly unsigned development receipts unless signing keys are configured.
A PASS applies only to the exact version or pack, environment, policy, supported probes, and evidence represented by that assurance run.

What's next for BlueClaw

Next steps include:

stronger process or container isolation for supported third-party probes;
an external runner with attested execution boundaries;
production signing-key lifecycle and verification;
richer environment-specific policies and destination constraints;
broader governance regression coverage;
outcome-driven recertification;
richer comparison and provenance across assurance runs.

BlueClaw’s larger opportunity is a healthier capability ecosystem where promising skills can earn adoption before they have earned popularity, and where trust is based on inspectable evidence rather than reputation alone.