blueclaw
Boundaries

Known gaps

These are the places where the boundary above does not hold as stated.

  • With terminal.posixHelperPath empty there is no projection. Requester tools fail closed, and any command the guardrail still runs runs as the daemon user.
  • The virtual-session scripted harness (internal/e2e/virtual_session.go) uses DirectWorkspaceActorFactory, which has no projection, because one scenario in one workspace has no second person to isolate. A deployment must never use it.
  • The POSIX separation tests need root and an installed helper, so an ordinary go test ./... skips them. They run on Linux and macOS when BLUECLAW_TEST_POSIX_HELPER or BLUECLAW_TEST_POSIX_HELPER_PATH is set (tests/integration/).
  • The admin API (/admin/api/*) has no session authentication of its own; it rejects cross-origin mutating requests, and the persona, schedule-tool and learning endpoints require a signed assertion. Keep the listen address on loopback or behind something that authenticates.

Capability authorization

Capability authorization is the per-person check on which capability operations a requester may invoke.

Model-written wording

Model-written wording is the rule that every sentence a person reads from the agent comes from a model.