Integration Report — OpenClaw

Licence conflict check

No claim is made here that the nonprofit has accepted the package; this is the selected recipient for the user-specified twin-copy condition.

BUY CONDITIONALLY — targeted adoption, not wholesale integration

• Highest leverage: Origin-Taint Memory Firewall because OpenClaw itself documents the missing content-origin propagation path.
• Second: Spend-Safe Autonomy Governor if autonomous spend control matters; Runtime Plugin Immune Gate if plugin trust hardening matters more.
• Third: Skill Mutation Replay Gate for self-learning reliability.
• Later: Dream Recursion Brake, cross-store erasure receipt, then opt-in dream federation.
• Strongest argument against buying: OpenClaw already duplicates a large fraction of the broad library; value is concentrated in a small subset and integration/review costs dominate the $499 fee.

Composite components built for OpenClaw

Six composites survive the second-pass overlap test. The first four are realistic near-term hardening work. Full PRIM-ENG-01 DREAM is deliberately excluded; OpenClaw’s native Dreaming remains authoritative.

COMPOSITE #1 — Origin-Taint Memory Firewall
  Composition:   CMPSBL BLD-ENG-249 "Pipeline Lineage Registry" + CMPSBL BLD-ENG-229 "Provenance Chain Verifier" + host src/agents/agent-tools.before-tool-call.wrapper.ts + extensions/memory-core/src/short-term-promotion-memory-write.ts
  Problem:       docs/concepts/memory-architecture.md:107–111 explicitly says content origin is not propagated within an owner turn; tool/web-derived assistant text inherits the sender class.
  Behaviour:     Carry a monotonic content-origin label from tool result through assistant assembly into memory flush/promotion, while hash-linking each transform. Memory admission can reject on content origin, not only sender origin.
  New because:   Lineage alone tracks stages; the verifier alone detects tampering; OpenClaw alone has trust classes. Together they produce a taint-aware derivation record from external content to durable memory.
  Attachment:    src/agents/agent-tools.before-tool-call.wrapper.ts; src/agents/memory-write-provenance.ts; extensions/memory-core/src/short-term-promotion-*.ts
  Untouched:     Provider/model routing, native Dreaming ranking, MEMORY.md format, channel behavior.
  Effort:        4–7 engineer-days, basis = cross-cutting metadata type + propagation + persistence/migration + monotonic trust tests + chain receipts.
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:
    tool/web output
         | origin label
         v
OpenClaw tool result assembly
         | + stage hash
         v
 assistant-derived text
         | preserved/downgraded origin
         v
 memory flush/promotion
         | + prev-hash receipt
         v
   promote OR reject

COMPOSITE #2 — Spend-Safe Autonomy Governor
  Composition:   CMPSBL SUBP-07 "CEILING" + CMPSBL STIER-S-CJ79 "Autonomy Budget Manager" + CMPSBL STIER-S-96 "Cost-Aware Routing Engine" + host src/infra/session-cost-usage-reporting.ts + src/config/sessions/goals.ts
  Problem:       OpenClaw records cost, enforces token budgets, and forwards Claude-specific --max-budget-usd, but no single inspected core gate enforces a provider-agnostic dollar ceiling across autonomous work.
  Behaviour:     Reserve/check cents before expensive autonomous calls, apply per-window ceilings and approval thresholds, expose remaining budget, and optionally move noncritical work to cheaper allowed models before the hard stop.
  New because:   CEILING gives unit/window refusal, the budget manager adds autonomy/approval state, and cost-aware routing turns remaining budget into a pre-stop adaptation policy. Existing OpenClaw telemetry becomes the accounting input.
  Attachment:    src/infra/session-cost-usage*.ts; src/config/sessions/goals.ts; model/tool execution admission seams; existing audit diagnostics.
  Untouched:     Provider billing systems, user-pinned model choices, critical/security workloads that must not be degraded.
  Effort:        5–9 engineer-days, basis = budget-scope inheritance + atomic reservation/reconciliation + approval UX + provider-neutral hooks + routing exclusions/tests.
  Verified:      C:ok I:ok B:load T:— S:scan
  Data path:
cost usage ----+
               v
request -> effective budget -> reserve/check
                  |
        +---------+---------+
        |                   |
      under               near cap
        |                   |
     execute         cheaper allowed route
                            |
                        hard ceiling
                     execute / approve / block

COMPOSITE #3 — Skill Mutation Replay Gate
  Composition:   CMPSBL STIER-S-ECH03 "Mutation Rehearsal Engine" + CMPSBL BLD-ENG-060 "Temporal Regression Sandbox" + host src/skills/workshop/auto-apply.ts + src/trajectory/types.ts + docs/concepts/personal-agent-benchmark-pack.md
  Problem:       Skill Workshop can apply scanner-approved learned changes. Static/policy scanning cannot prove the proposed skill still behaves correctly on prior scenarios.
  Behaviour:     Rehearse a proposed skill mutation against bounded redacted trajectory cases and personal-agent benchmark scenarios, compare baseline outcomes, and quarantine regression before auto-apply.
  New because:   Workshop already learns and scans; trajectories already observe behavior. The two catalog parts convert that evidence into a deterministic pre-promotion behavioral gate.
  Attachment:    src/skills/workshop/auto-apply.ts; Workshop review path; src/trajectory/types.ts; personal-agent benchmark fixtures.
  Untouched:     Workshop proposal generation, security scanner, user approval modes, existing rollback metadata.
  Effort:        5–9 engineer-days, basis = fixture adapter + isolated execution + stable comparison semantics + thresholds + failure reports/tests.
  Verified:      C:ok I:ok B:load T:— S:scan
  Data path:
Workshop proposal
      v
security scan
      v
mutation rehearsal <--- benchmark + redacted trajectories
      v
regression verdict
   pass | fail
    v   v
 apply quarantine

COMPOSITE #4 — Runtime Plugin Immune Gate
  Composition:   CMPSBL VPACK-SPECTRAL-AUDITOR "Behavior Drift Detection & Quarantine Layer" + CMPSBL STIER-S-CJ83 "Behavioral Trust Scoring" + host src/plugins/install-security-scan.runtime.ts + src/plugins/runtime-degraded-state.ts + src/plugins/capability-provider-runtime.ts
  Problem:       OpenClaw already scans install payloads and quarantines invalid configured plugins at boot, but those checks are structural/static. qa/maturity-scores.yaml:846–855 rates Plugin Trust quality 68 (Alpha) and LTS unsupported.
  Behaviour:     Build per-capability post-activation behavior fingerprints, update trust from observed runtime events, detect drift from the accepted baseline, then step up verification, disable a capability, or feed OpenClaw’s existing degraded/quarantine surface.
  New because:   Install provenance answers "what was installed"; boot verification answers "is payload shape valid". This adds the missing time dimension: "did an already-loaded plugin start behaving differently".
  Attachment:    Plugin activation/capability provider boundaries and existing diagnostics/degraded state; no second plugin loader.
  Untouched:     Manifest ownership, install scanner, SDK contracts, provider-specific policy, normal plugin activation when no drift is observed.
  Effort:        5–9 engineer-days, basis = stable event features + baseline persistence/versioning + trust update policy + observe-only burn-in + quarantine/approval tests.
  Verified:      C:ok I:ok B:load T:— S:scan
  Data path:
install scan -> boot verification -> plugin active
                                  |
                                  v
                         behavior fingerprint
                                  | drift
                                  v
                           trust score update
                         normal / step-up / quarantine

COMPOSITE #5 — Federated Dream Exchange
  Composition:   CMPSBL STIER-S-CJ117 "Dream Pool Federation Hub" + CMPSBL STIER-S-CJ122 "Dream Cross-Pollination Engine" + CMPSBL BLD-ENG-271 "Dream Generation Gate" + host extensions/memory-core/src/dreaming.ts + dreaming-consolidation.ts
  Problem:       OpenClaw already has real local Dreaming and multi-agent-aware workspaces. No inspected path federates and novelty-ranks derived dream artifacts across independent agents, and raw cross-agent transcript search should remain closed.
  Behaviour:     Export only sanitized derived dream insights into an opt-in federation pool, dedupe/rank them, track pollination lineage, cap synthesis generation depth, then re-enter each destination agent through OpenClaw’s native provenance/promotion gates.
  New because:   This is not another DREAM engine. It creates a bounded exchange protocol between existing dream cycles while retaining OpenClaw as the sole memory-admission authority.
  Attachment:    memory-core Dreaming extension seam; derived artifact schema; existing provenance/promotion gates.
  Untouched:     Raw transcripts, per-agent memory stores, native Light/REM/Deep phases, MEMORY.md write authority.
  Effort:        5–8 engineer-days for an isolated prototype, basis = opt-in/privacy contract + artifact schema + dedupe/rank adapter + depth metadata + lineage tests. Production rollout needs separate privacy review.
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:
Agent A native Dreaming       Agent B native Dreaming
        | derived insight             | derived insight
        +------------+----------------+
                     v
            opt-in federation pool
             dedupe + novelty rank
                     |
             generation-depth gate
                     v
       destination OpenClaw promotion gate
                     v
              local memory OR reject

COMPOSITE #6 — Cross-Store Erasure Receipt
  Composition:   CMPSBL BLD-ENG-192 "Selective Amnesia Controller" + CMPSBL BLD-ENG-229 "Provenance Chain Verifier" + host memory-core provenance/supersession metadata + memory-lancedb delete receipts + memory-wiki rebuild boundaries
  Problem:       OpenClaw can delete memory in specific stores, and LanceDB has authoritative delete receipts, but no inspected single operation proves a targeted fact and its derived references are handled across all relevant memory tiers.
  Behaviour:     Preview a provenance/supersession dependency graph, invoke each owning store’s deletion/rebuild semantics, record what was deleted/skipped/retained, and emit one cross-store receipt without claiming deletion from external systems OpenClaw does not control.
  New because:   The catalog controller supplies targeted erasure semantics; the chain verifier binds the multi-store result; OpenClaw supplies real store-specific receipts and lineage edges.
  Attachment:    memory-core promotion records; extensions/memory-lancedb; memory-wiki compiler/rebuild surfaces; operator confirmation for broad patterns.
  Untouched:     Unrelated memory, external providers, existing retention defaults, raw transcript history unless explicitly included by policy.
  Effort:        4–8 engineer-days, basis = store inventory + dry-run graph + adapters + authoritative receipt aggregation + destructive-operation tests.
  Verified:      C:ok I:ok B:— T:— S:scan
  Data path:
erase request
     v
provenance dependency preview
     | confirm
     v
core memory | LanceDB | wiki | dream-derived
     |          |        |       |
     +----------+--------+-------+
                v
       cross-store erasure receipt

Build first: Origin-Taint Memory Firewall. It closes a gap OpenClaw’s own architecture document explicitly names.

New single-component designs for this product

These are host-specific adapter/product designs built from one catalog component plus OpenClaw’s real modules. They are not additional catalog rows.

DESIGN #1 — Tool-Origin Taint Token
  Built from:   CMPSBL BLD-ENG-249 "Pipeline Lineage Registry" (`PipelineLineageRecord`, `PipelineLineageRegistry`)
  Plus host:    src/agents/agent-tools.before-tool-call.wrapper.ts; src/agents/memory-write-provenance.ts; extensions/memory-core/src/short-term-promotion-record.ts
  What it is:   A compact immutable metadata carrier for origin class, source tool/provider, lineage id, stage hashes and downgrade reason. It moves with assistant-derived content until a persistence/admission owner consumes it.
  New because:  OpenClaw has sender/session provenance but explicitly documents that content origin is not propagated within an owner turn.
  Unlocks:      A memory firewall that can distinguish trusted owner text from owner text derived from untrusted web/tool output.
  Evidence path:A diagnostic/provenance record showing each stage and the final trust class used by memory admission.
  Effort:       2–4 engineer-days, basis = one metadata type + thread-through at tool/assistant/flush boundaries + legacy defaults/tests.
  Constraints:  Verified C:ok I:ok B:— T:— S:scan; Mode direct; Ports/slices none
  Confidence:   high — the host documentation names the gap directly.
  Data path:
tool result -> TaintToken -> assistant output -> memory candidate -> gate

DESIGN #2 — Budget Scope Resolver
  Built from:   CMPSBL SUBP-07 "CEILING" (`CeilingOptions`, `Ceiling`, `createCeiling`, `CeilingSubject`, `ceilingContract`, `METERS`, `Meter`, `MeterMap`, `CeilingSpec` +5 more)
  Plus host:    src/config/sessions/goals.ts; src/infra/session-cost-usage.ts; agent/model execution seams
  What it is:   Resolves one effective budget from global defaults, agent/task/run overrides and explicit owner approvals, then exposes remaining cents/tokens/calls before work begins.
  New because:  OpenClaw has token budgets and cost reporting, but no provider-neutral cross-unit ceiling owner was found; CEILING supplies the refusal semantics while host state supplies scope.
  Unlocks:      Predictable autonomous spending limits that are explainable before a provider call is made.
  Evidence path:A budget decision receipt with effective scope, meter, remaining amount and allow/approve/block outcome.
  Effort:       2–4 engineer-days, basis = scope precedence + reconciliation + admission hook + tests; component entry is 414 LOC.
  Constraints:  Verified C:ok I:ok B:load T:— S:scan; Mode direct; Ports/slices none
  Confidence:   high — second pass found only provider-specific dollar limits, not a core provider-agnostic one.
  Data path:
defaults -> agent -> task/run -> owner override -> effective ceiling -> request

DESIGN #3 — Trajectory Chain Stamper
  Built from:   CMPSBL BLD-ENG-229 "Provenance Chain Verifier" (`ProvenanceLink`, `ProvenanceVerdict`, `ProvenanceChainVerifier`)
  Plus host:    src/audit/audit-event-store.ts; src/trajectory/types.ts
  What it is:   Hash-links selected audit/trajectory records with a canonical previous-record digest and periodic chain-head checkpoints, without replacing the underlying event stores.
  New because:  OpenClaw already captures high-quality events; the missing product is a compact continuity proof over selected records.
  Unlocks:      Detectable retroactive modification in support/forensic exports.
  Evidence path:A verifier report that identifies the first broken link and the last known good checkpoint.
  Effort:       2–5 engineer-days, basis = canonicalization + storage fields + checkpoint policy + verify command/tests.
  Constraints:  Verified C:ok I:ok B:— T:— S:scan; Mode direct; Ports/slices none
  Confidence:   high — no prev-hash append chain was found in inspected audit/trajectory schemas.
  Data path:
event -> canonical digest -> prevHash -> chain head -> verify

DESIGN #4 — Dream Recursion Brake
  Built from:   CMPSBL BLD-ENG-271 "Dream Generation Gate" (`DreamCandidate`, `MAX_GENERATION`, `memoryWeight`, `sortBySynthesisPriority`, `filterDreamCandidates`, `rankDreamCandidates`)
  Plus host:    extensions/memory-core/src/dreaming-consolidation.ts; short-term promotion record schema
  What it is:   Adds explicit synthesis-generation metadata to derived dream candidates and refuses or downranks material beyond a declared generation ceiling before native OpenClaw promotion.
  New because:  OpenClaw already tracks source lineage and rewrite-loss constraints; the second pass found no explicit synthesis-generation depth counter/ceiling.
  Unlocks:      Safer experimentation with cross-agent or recursively synthesized dream artifacts without replacing native Dreaming.
  Evidence path:Candidate diagnostics showing generation depth, source lineage and the exact gate that admitted/rejected it.
  Effort:       1–3 engineer-days, basis = schema field + propagation + ranking/filter adapter + tests; component entry is 47 LOC.
  Constraints:  Verified C:ok I:ok B:— T:— S:scan; Mode direct; Ports/slices none
  Confidence:   high for the inspected archive; absence is based on full targeted code/doc search, not a naming assumption.
  Data path:
derived candidate -> generation++ -> depth gate -> native provenance gate -> memory/reject

DESIGN #5 — Erasure Dependency Walker
  Built from:   CMPSBL BLD-ENG-192 "Selective Amnesia Controller" (`ErasureRequest`, `ErasureProof`, `AmnesiaStats`, `createSelectiveAmnesiaController`)
  Plus host:    extensions/memory-core promotion/supersession records; extensions/memory-lancedb; extensions/memory-wiki
  What it is:   Builds a dry-run dependency graph from a requested fact/pattern to owned derived artifacts before any destructive operation, then coordinates existing store-specific deletion/rebuild semantics.
  New because:  LanceDB already has real memory_forget receipts, but a single-store receipt does not prove handling across independent memory tiers.
  Unlocks:      A user-visible right-to-forget workflow with bounded scope and an explicit uncertainty report when lineage is incomplete.
  Evidence path:Preview graph plus final cross-store receipt listing deleted, rebuilt, skipped and out-of-scope artifacts.
  Effort:       3–6 engineer-days, basis = dependency walk + store adapter registry + dry-run/confirmation + receipt aggregation.
  Constraints:  Verified C:ok I:ok B:exec T:— S:scan; Mode direct; Ports/slices none
  Confidence:   medium-high — store-specific behavior exists, but full cross-tier semantics require implementation-time owner review.
  Data path:
target -> dependency graph -> preview -> confirm -> store adapters -> receipt

Build first: Tool-Origin Taint Token. It is the smallest concrete object that unlocks the highest-ranked composite.

Coverage and decision numbers

What this repository already has

Inventory was performed before catalog promotion and then repeated in Step 8. The supplied archive contains 33,334 original files; 27,214 are TypeScript files. OpenClaw is a mature agent-native monorepo, so overlap avoidance is the dominant evaluation constraint.

Existing capability that should not be replaced: multi-agent runtime, tool policy/approvals, sandboxing, session provenance, tiered memory, native Light/REM/Deep Dreaming, deletion in specific memory stores, Skill Workshop self-learning, trajectory capture, audit storage, provider/failover logic, cost telemetry, plugin install provenance/scanning and boot-time plugin quarantine.

Catalog taxonomy coverage: every class was parsed, including the user-requested primitives, sub-primitives, agents, engines, subsystems/systems, meta/store/substrate engines, layers, packages, products and vertical packs.

Five-axis screen of the candidate set

All 1,162 engineered rows were parsed. A reproducible concern screen identified 578 unique rows across seven host-relevant baskets. Explicit twins, shared-entry rows, and obvious host duplicates were then collapsed or rejected before the detailed five-axis set below. The screen is deliberately hostile to duplication: a prestigious name does not outrank host evidence.

Shared-entry handling: broad shared-entry engines were screened but not costed as independent deliverables because the catalog itself marks their entry figures as shared. Direct, isolated rows were preferred whenever they addressed the same gap.

Constraints this host imposes

OpenClaw’s own rules govern attachment: keep the core lean, use existing plugin/SDK seams, preserve owner boundaries, avoid parallel fallback/control planes, keep risky actions explicit, preserve memory isolation, and treat live validation as mandatory before landing user-facing behavior. This report therefore recommends adapters/hardening rather than a substrate takeover.

For every recommended component, the Verified string below is quoted verbatim from the supplied catalog. Any T:— or B:— is expanded as Not claimed, exactly as required.

Security ceiling: S:scan is an author/kit deterministic static sweep, not an independent security audit. Host-specific adversarial tests and review remain required before any security-sensitive integration.

Ranked recommendations

There are no REPLACE findings. OpenClaw’s native systems are too mature and product-specific for broad substitution. The recommended plan is hardening and composition only.

[HARDEN] CMPSBL BLD-ENG-249 "Pipeline Lineage Registry"  ->  host: src/agents/agent-tools.before-tool-call.wrapper.ts (737 LOC)
  Why: OpenClaw explicitly documents that tool/web content origin is not propagated through owner-turn assistant text; lineage is the missing carrier into later memory decisions.
  Uses: `PipelineLineageRecord`, `PipelineLineageRegistry`
  Saves: ~0.5–1 engineer-day, basis = 39 entry LOC + 4 concerns (origin propagation, monotonic trust downgrade, stage hashes, legacy defaults)
  Verified: C:ok I:ok B:— T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-229 "Provenance Chain Verifier"  ->  host: src/audit/audit-event-store.ts (739 LOC)
  Why: OpenClaw has rich audit/trajectory data but the inspected event stores do not expose a prev-hash append chain; this adds detectable post-write tamper evidence without replacing those stores.
  Uses: `ProvenanceLink`, `ProvenanceVerdict`, `ProvenanceChainVerifier`
  Saves: ~1–3 engineer-days, basis = 108 entry LOC + 4 concerns (canonicalization, prev-hash linkage, verification, checkpoint retention)
  Verified: C:ok I:ok B:— T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL SUBP-07 "CEILING"  ->  host: src/config/sessions/goals.ts (358 LOC)
  Why: OpenClaw has token budgets and provider-specific budget surfaces, but no single core mechanism meters cents/tokens/calls against one declared provider-agnostic ceiling and refuses the crossing call.
  Uses: `CeilingOptions`, `Ceiling`, `createCeiling`, `CeilingSubject`, `ceilingContract`, `METERS`, `Meter`, `MeterMap`, `CeilingSpec` +5 more
  Saves: ~2–4 engineer-days, basis = 414 entry LOC + 5 concerns (windows, atomic refusal, multi-unit metering, remaining budget, cents)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL STIER-S-CJ79 "Autonomy Budget Manager"  ->  host: src/infra/session-cost-usage-reporting.ts (508 LOC)
  Why: OpenClaw measures spend but lacks one provider-agnostic autonomy budget authority with hard limits plus approval thresholds; pair it with existing usage telemetry rather than another accounting plane.
  Uses: `AutonomyBudget`, `BudgetAlert`, `SpendRequest`, `SpendResult`, `AutonomyBudgetManager`
  Saves: ~1–3 engineer-days, basis = 104 entry LOC + 4 concerns (allocation, thresholds, realtime tracking, approval state)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[COMBINE] CMPSBL STIER-S-ECH03 "Mutation Rehearsal Engine"  ->  host: src/skills/workshop/auto-apply.ts (45 LOC)
  Why: Skill Workshop can auto-apply scanner-approved learned changes; rehearsal adds a behavioral gate before a mutation reaches the live skill set.
  Uses: `RehearsalInput`, `RehearsalResult`, `RehearsalStats`, `createMutationRehearsalEngine`
  Saves: ~1–3 engineer-days, basis = 102 entry LOC + 4 concerns (rehearsal state, isolation, comparison, verdict)
  Verified: C:ok I:ok B:exec T:— S:scan
  Mode: direct
  Ports to implement: none

[COMBINE] CMPSBL BLD-ENG-060 "Temporal Regression Sandbox"  ->  host: src/trajectory/types.ts (73 LOC)
  Why: OpenClaw already records trajectories and benchmark scenarios; this supplies a compact deterministic replay/regression mechanism for proposed mutations.
  Uses: `StateSnapshot`, `RegressionResult`, `binarySearchRegression`
  Saves: ~0.5–1 engineer-day, basis = 57 entry LOC + 3 concerns (snapshots, replay ordering, regression localization)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL VPACK-SPECTRAL-AUDITOR "Behavior Drift Detection & Quarantine Layer"  ->  host: src/plugins/capability-provider-runtime.ts (695 LOC)
  Why: OpenClaw already verifies plugin payloads and can quarantine invalid plugins at boot; its maturity ledger still rates Plugin Trust 68/100 (Alpha, not LTS). Continuous post-load behavior fingerprints address a different lifecycle gap.
  Uses: `cmpsbl_spec_spectrum`, `cmpsbl_spec_anomaly`, `cmpsbl_spec_receipt`, `cmpsbl_spec_citadel`, `SPECTRAL_AUDITOR_LAYER`
  Saves: ~2–5 engineer-days, basis = 160 entry LOC + 5 concerns (fingerprint, baseline, drift score, anomaly receipt, quarantine decision)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[COMBINE] CMPSBL STIER-S-CJ83 "Behavioral Trust Scoring"  ->  host: src/plugins/runtime-degraded-state.ts (133 LOC)
  Why: Behavioral trust scoring turns plugin/capability observations into graduated step-up verification or restricted autonomy; it complements rather than replaces existing install provenance.
  Uses: `BehaviorEvent`, `TrustProfile`, `BehavioralTrustScoring`
  Saves: ~1–3 engineer-days, basis = 79 entry LOC + 4 concerns (event scoring, trust profile, thresholds, decay/update)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-271 "Dream Generation Gate"  ->  host: extensions/memory-core/src/dreaming-consolidation.ts (664 LOC)
  Why: OpenClaw Dreaming has strong provenance and rewrite-loss controls but no explicit synthesis-generation depth counter was found; this is a narrow semantic-drift brake for derived/cross-agent dream material.
  Uses: `DreamCandidate`, `MAX_GENERATION`, `memoryWeight`, `sortBySynthesisPriority`, `filterDreamCandidates`, `rankDreamCandidates`
  Saves: ~hours to 1 engineer-day, basis = 47 entry LOC + 3 concerns (generation metadata, depth cap, ranking)
  Verified: C:ok I:ok B:— T:— S:scan
  Mode: direct
  Ports to implement: none

[COMBINE] CMPSBL STIER-S-CJ117 "Dream Pool Federation Hub"  ->  host: extensions/memory-core/src/dreaming.ts (1172 LOC)
  Why: OpenClaw Dreaming is workspace/agent aware, but no mechanism was found that federates and novelty-ranks derived dream artifacts across independent agent dream cycles.
  Uses: `FederatedPattern`, `DreamPoolFederation`
  Saves: ~hours to 1 engineer-day, basis = 52 entry LOC + 4 concerns (merge, dedupe, novelty, relevance)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[COMBINE] CMPSBL STIER-S-CJ122 "Dream Cross-Pollination Engine"  ->  host: extensions/memory-core/src/dreaming.ts (1172 LOC)
  Why: Adds provenance-bearing cross-pollination between independent dream cycles; use only derived artifacts, never raw cross-agent transcript access.
  Uses: `DreamInsight`, `DreamCrossPollination`
  Saves: ~hours to 1 engineer-day, basis = 63 entry LOC + 4 concerns (pollination, lineage, domain boundary, attribution)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL BLD-ENG-192 "Selective Amnesia Controller"  ->  host: extensions/memory-core/src/short-term-promotion-record.ts (524 LOC)
  Why: OpenClaw has real deletion, including LanceDB memory_forget with authoritative delete receipts, but no inspected coordinator spans curated, episodic, indexed, wiki and dream-derived representations.
  Uses: `ErasureRequest`, `ErasureProof`, `AmnesiaStats`, `createSelectiveAmnesiaController`
  Saves: ~1–3 engineer-days, basis = 103 entry LOC + 4 concerns (targeting, proof, rollback protection, preservation)
  Verified: C:ok I:ok B:exec T:— S:scan
  Mode: direct
  Ports to implement: none

[COMBINE] CMPSBL STIER-S-96 "Cost-Aware Routing Engine"  ->  host: src/agents/model-selection-shared.ts (1885 LOC)
  Why: Pairs with a hard spend boundary so optional work can step down to an allowed cheaper provider before blocking; must never silently downgrade quality-sensitive/security runs.
  Uses: `createCostRouter`
  Saves: ~hours to 1 engineer-day, basis = 56 entry LOC + 4 concerns (spend pressure, provider choice, floor, fallback)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

[HARDEN] CMPSBL STIER-S-TRT03 "Contract Evolution Mediator"  ->  host: src/plugins/capability-provider-runtime.ts (695 LOC)
  Why: OpenClaw has strong typed plugin contracts, but no single inspected mediator owns compatible contract upgrades/deprecation across plugin capability versions; useful only at that boundary, not as a new global schema system.
  Uses: `ContractVersion`, `Contract`, `ContractEvolutionMediator`
  Saves: ~1–4 engineer-days, basis = 153 entry LOC + 5 concerns (versioning, compatibility, deprecation, approval, rollback)
  Verified: C:ok I:ok B:load T:— S:scan
  Mode: direct
  Ports to implement: none

Gap map

Do not touch

• PRIM-ENG-01 DREAM — SKIP. Native OpenClaw Dreaming is already substantial; the primitive’s 47,391-LOC closure and persistence port are unnecessary for the identified delta.
• PRIM-ORG-04 MEMORY / SUBSYS-08 Memory Stream — SKIP. They duplicate a mature memory system and its promotion/Dreaming ownership.
• SUBSYS-16 Agency / PRIM-ORG-02 SYSTEM — SKIP. OpenClaw already is the agent/runtime chassis.
• PRIM-ENG-07 SANDBOX / SUBP-01 ARBITRIUM — SKIP. A second execution-governance boundary would undermine canonical ownership.
• PRIM-AGE-04 ECONOMY / SENGINE-FINOPS-style broad engines — SKIP. Measurement already exists; use the narrow missing ceiling/budget pieces.
• PRIM-AGE-03 AUDIT / ENGINE-OBELISK — SKIP. Preserve the existing audit/trajectory stores and add only a small continuity proof where needed.
• BLD-ENG-140 Recursive Capability Discoverer / STIER-S-CJ98 twin — SKIP. Skill Workshop history scanning plus plugin capability-provider discovery already cover most of the job.
• VPACK-NOCTURNE-CONSOLIDATION / BLD-ENG-260 Dream Synthesizer — SKIP. They duplicate native Dreaming consolidation.

Quick wins

• BLD-ENG-249 in diagnostics-only mode first: carry origin metadata without changing admission until coverage is proven.
• SUBP-07 in shadow mode over existing cost telemetry: emit would-allow/would-block decisions before hard enforcement.
• VPACK-SPECTRAL-AUDITOR in observe-only mode: learn stable plugin baselines before any automated quarantine action.
• BLD-ENG-271 on experimental externally derived dream candidates only; do not change native Dreaming candidates initially.
• BLD-ENG-229 on exported trajectory/audit bundles before altering the live event store schema.

Honest total: 14 engineered rows survive as useful ingredients; 8 are strong enough to prioritize in the first 90 days, while dream federation and contract mediation remain conditional.

Build versus buy

Assumption basis: senior TypeScript/agent-infrastructure/security engineering at $120–$180/hour, 8 hours/day, 40 hours/week. These are equivalent-capability ranges; they are not LOC multiplied by rate. Discovery Vault rows are excluded completely.

A-only net after integration + licence: approximately -$43,699 to +$23,501. This is the conservative “work we might have to build anyway” view.

A+B combined counterfactual net: approximately -$34,099 to +$59,501, while keeping B conceptually separate from avoided cost. That upper range matters only if OpenClaw actually wants the new capabilities.

Fee-only break-even: $499 equals about 2.8–4.2 senior-engineering hours at the stated rate. That does not mean the implementation breaks even in half a day; integration dominates the real cost.

At the stated price: good trade only if at least two of the first four composites are funded. Bad trade if the buyer expects a turnkey drop-in or buys primarily for generic memory/DREAM/agency features already present in OpenClaw.

90-day roadmap, assuming it was bought

Wrong first move: installing full PRIM-ENG-01 DREAM or replacing OpenClaw memory. The second pass confirms that would spend the most effort where the host already has the most capability.

Capacity assumption: one senior engineer can sequence the first two lanes; two engineers are preferable once plugin drift + destructive erasure testing overlap.

PROVISIONAL discoveries worth reading after purchase

All 6,479 / 6,479 Discovery Vault index rows were screened. The 288 agency-v1 rows received a dedicated second pass because OpenClaw is agent-native; the remaining 6,191 regular rows were screened separately against the same host gaps.

Every row below is PROVISIONAL — index row only, source not read (pre-purchase). No API surface, LOC, verification verdict, effort saving or money value is claimed for these rows, and none appears in Step 6 economics.

Agent-vertical signal: the strongest rows are not generic “more agents.” They cluster around capability matching, plugin drift/baseline preservation and knowledge-informed recovery — places where an agent-native host can consume a specialized engine without replacing its orchestration substrate.

Regular-pool signal: Mutation Impact Simulator and Bayesian Dispatcher are the only two general rows retained because they map directly to the Workshop regression and cost-policy themes. Everything else was either lower-signal, duplicative, or too vague at index-only depth.

Self-correction addendum

A full second inventory/search pass was run after the first draft. The following corrections are explicit; they were not silently absorbed:

Estimate change summary: removing full DREAM reduces the speculative Dream integration burden; recognizing existing LanceDB receipts reduces erasure work; adding plugin behavior drift adds a new 5–9 day hardening lane. The Step 6 ranges were recomputed after those changes rather than carried over from the first draft.

What is and is not verified

• This is a read-only pre-purchase architecture evaluation of the supplied OpenClaw archive, not a successful CMPSBL integration run.
• The commit-like SHA be2f7c6a3df29a423e9623dbde1d44ca3e90a078 is taken from the supplied archive filename; Git metadata is absent, so it was not independently verified.
• CMPSBL catalog Verified strings are author-supplied compile/install/behavior/static-scan claims. T:— means Not claimed; no recommendation is treated as having shipped coverage.
• The CMPSBL static security sweep is not an independent audit. Host-specific threat review and adversarial tests remain mandatory before security-sensitive integration.
• Discovery Vault rows are index-only and provisional; their source was not read pre-purchase and they are excluded from all economics.
• No claim is made that CMPSBL DREAM is better than OpenClaw Dreaming. Full DREAM is a SKIP in the final evaluation.
• Absence claims are scoped to the supplied archive and targeted full-text/source review; they are not claims about future OpenClaw releases or undisclosed infrastructure.
• No production code was modified, no dependency was installed into OpenClaw, and no live provider/runtime integration test was performed because no implementation was requested or made.