Codex Delegation Gateway for OpenClaw

A fail-closed OpenClaw plugin that routes attended programming tasks to Codex or Claude workers without handing either worker control-plane authority.

The repository contains two bounded components:

• gateway/: the OpenClaw plugin and deterministic dynamic-routing policy.
• quota-state/: an optional producer that projects quota and provider-auth status into a small, identity-free JSON snapshot.

What the policy enforces

• OpenClaw remains the only task control plane.
• Fable is excluded from the programming executor pool.
• High-risk work is Codex max or wait; it never falls through to Claude.
• Claude is eligible only when both quota and official provider-auth evidence are fresh and usable; refreshable OAuth is accepted only through a complete bounded logical-model availability attestation.
• The final 10% of a quota window is protected from reset-time and balancing incentives.
• A reset within six hours has priority over weekly balancing.
• Weekly balancing follows a seven-day linear burn trajectory ending at a 10% reserve, with a five-point hysteresis band.
• Missing, stale, malformed, or contradictory evidence fails closed.
• Automatic interception remains disabled by default.

The policy is advisory only after all hard safety, capability, authentication, and risk gates pass. It does not grant deployment, service-control, credential, publishing, or trading authority.

Requirements

• Node.js 22 or newer
• Python 3.11 or newer for the optional quota snapshot producer
• OpenClaw 2026.7.1-2 for the SDK contract validated by this release

Test

npm test

The test suite covers routing precedence, stale and expired auth evidence, weekly trajectory balancing, reset urgency, reserve protection, high-risk routing, output sanitization, and the OpenClaw SDK boundary.

Install the plugin

Copy gateway/ to an OpenClaw extension directory and configure it through OpenClaw's plugin configuration interface. The plugin defaults to disabled and requires explicit paths, narrow allowed roots, and Owner-only attended invocation.

The quota producer is optional. If used, point --checker at a local command that returns the expected bounded Codex quota report, and write the result to a private state location:

python3 quota-state/bin/update-quota-state.py \
  --checker /path/to/check_codex_quota.py \
  --state /private/path/quota-state.json \
  --openclaw /path/to/openclaw

The state file contains only remaining percentages, reset timestamps, health, and a bounded provider-auth fact. It must not contain raw OAuth responses, profile identifiers, email addresses, tokens, or credentials.

Security model

Read gateway/CONTRACT.md for the full integration contract and SECURITY.md for reporting guidance.

This project intentionally ships no production paths, account identities, session keys, worker state, quota snapshots, credentials, or deployment configuration.

License

MIT