CLAWLINE Methodology

Static, deterministic trust-clinic methodology with evidence-bound outputs and explicit decision precedence.

CLAWLINE_METHOD_V0.5_2026-02-24Updated 2026-02-24T00:00:00.000ZGlossary Crosswalk Origins Whitepaper

Boundaries

Static analysis only. Submitted code is never executed.
No external URL fetching as part of trust evaluation.
Public pages render derived fields and redacted reasons only.
Payload caps and structural limits are enforced before analysis.

Non-Negotiables

No over-claim: integrity remains UNKNOWN/PARTIAL/ABSENT when evidence is insufficient.
Containment-first: FREEZE maps to Review Required (QUARANTINE), not accusatory language.
Deterministic reproducibility: policy version and canonical hashes are embedded in receipts.
Privacy preserving telemetry: source IP and user agent are hashed with server-side salt.

Decision Precedence

1. KILL2. FREEZE3. WARN4. ALLOW

Evidence States

PRESENT

Structured evidence blocks are complete and parseable.

PARTIAL

Evidence exists but is malformed or missing required structural fields.

ABSENT

Required structured evidence is missing.

Pipeline Phases

phase_01_ingress

Ingress Guardrails

Reject oversized/unsafe submissions before policy analysis.

Inputs: Request headers, Payload size, File counts, Length caps, Secret detectors

Outputs: Accepted for analysis or rejected (413/400)

phase_02_structured_parsing

Structured Parsing

Normalize connectors, tools, MCP posture, custody evidence, versions, and schema signals.

Inputs: clawline_disclosure, openclaw_json, structured ABOM/MCP/custody blocks

Outputs: Normalized posture, Evidence grade, Custody grade, Custody verification, Completeness percentage, Missing evidence list

phase_03_posture_scoring

Posture and Mismatch Scoring

Compute declared/required tiers, privilege delta, and clawpath structural risk.

Inputs: Normalized posture, Tier declarations, Capability signatures

Outputs: Declared tier, Required tier, Privilege delta, ClawPath level, Triad boolean

phase_04_meta_signals

Clinic Meta-Signal Detection

Detect campaign patterns without evaluating payload intent text.

Inputs: Hashed source telemetry, Simhash, Window counters

Outputs: CRABS-B10/B11/B12, Campaign score

phase_05_decision_mapping

CRABS -> DAD -> CLAWS

Route deterministic findings to final publish action.

Inputs: CRABS tags, Policy version matrix

Outputs: DAD decision, CLAWS action, Public-safe status label, Receipt payload, Custody decision trace

Policy Matrix (sample)

Condition	CRABS	DAD	CLAWS	Public Label
Custody evidence is invalid	CRABS-S82	DAD-CRT-80	QUARANTINE	Review Required
High-risk posture without custody evidence	CRABS-S80	DAD-CRT-81	QUARANTINE	Review Required
Campaign meta-signals present	CRABS-B10, CRABS-B11, CRABS-B12	DAD-CRT-20	QUARANTINE	Review Required
Required tier exceeds declared by >= 2	CRABS-A21	DAD-CRT-40	QUARANTINE	Review Required
Definition drift detected	CRABS-S62	DAD-CRT-60	QUARANTINE	Review Required
Triad condition without freeze co-factors	CRABS-A72	DAD-WRN-62	PUBLISH_WITH_WARN	Published with Warnings
Evidence incomplete	CRABS-S47, CRABS-S20, CRABS-S21	DAD-WRN-50	PUBLISH_WITH_WARN	Published with Warnings
Custody evidence is unverified	CRABS-S83	DAD-WRN-81	PUBLISH_WITH_WARN	Published with Warnings

Public Language Contract

Use neutral labels in public surfaces: Review Required, Drift Detected, Unpinned, Evidence Missing.
Use neutral custody labels in public surfaces: Unverified provenance, Invalid binding.
Do not make behavioral accusations in public output.
Do not claim CONSISTENT integrity without cross-source evidence.
When evidence is absent or incomplete, output UNKNOWN/PARTIAL/ABSENT states explicitly.

Loading CLAWLINE™ surface...