enclawed

enclawed — Hardened single-user AI gateway for high-trust environments

A hard fork of OpenClaw intended to run as a single-user AI assistant inside any environment that needs attestable peer trust, deny-by-default external connectivity, signed-module loading, and tamper-evident audit. Sector-neutral: works for financial services (handling material-non-public data), healthcare (handling PHI under HIPAA / GDPR Art. 9), regulated R&D (embargoed research, trade-secret IP, ITAR/EAR-controlled materials), defense contractors (CMMC, NIST 800-171), government enclaves (NIST 800-53 / FedRAMP / DoD / DoE), and any other regulated-industry deployment.

enclawed is a hardening framework, not an accredited compliance certification. A real audit, ATO, ISO 27001 certificate, SOC 2 report, HITRUST validation, or comparable attestation still requires accredited hardware, validated cryptographic modules, certified facilities (SCIF / physical-security plan / data-center audit), an evaluation by a qualified assessor, and management sign-off. Code alone cannot satisfy any of those. See enclawed/FORK.md for the full deletion catalog, control-mapping (NIST 800-53 / ISO 27001 / SOC 2 / NIST CSF / GDPR / HIPAA), and the explicit list of work the deploying organization still owns.

Quick start — see the framework defend itself in 9 scenes

A self-contained, hermetic, no-deps demo runs every security primitive end-to-end against real adversarial inputs. It writes all artifacts to an OS tmpdir that is deleted on exit, so it leaves no trace on your system.

Prerequisites

• Node 22+ (uses only node:test, node:crypto, node:fs/promises, node:os, node:path). No npm install required.
• A terminal. Output uses ANSI colors by default; pass --no-color if your terminal does not render them.

Run it

# from the repo root:
node enclawed/demo/demo.mjs

# or via the npm script (same thing, ~170 ms):
cd enclawed && npm run demo

# flags:
node enclawed/demo/demo.mjs --no-color   # plain ASCII output
node enclawed/demo/demo.mjs --quiet      # one verdict line per scene

Exit code is 0 if every scene passes, non-zero otherwise. The demo uses an ephemeral trust root, an ephemeral audit log under tmpdir(), and a stub fetch — nothing touches the network, your filesystem, or any global state.

What the demo shows

Each scene exercises the OSS canonical .mjs reference under enclawed/src/ and prints ✓ / ✗ marks for each assertion.

#	Scene	What it proves
1	Classification + Bell-LaPadula	Loads the US_GOVERNMENT scheme (UNCLASSIFIED → TOP_SECRET//SCI). Shows that a SECRET-cleared subject may read a SECRET object, may not read up to TOP_SECRET, and may not write down to PUBLIC. Confirms the lattice is asymmetric: TOP_SECRET ▷ SECRET.
2	DLP scanner	Feeds a payload containing an industry classification banner, an AWS access key, an OpenAI API key, a 16-digit PAN, and an email. scan() identifies every secret; redact() replaces each one with [REDACTED] before anything reaches the audit log.
3	Egress allowlist	Installs an allowlist of 127.0.0.1 + localhost. Shows that 127.0.0.1/api/health passes through and returns 200, while https://api.openai.com/v1/messages throws EgressDeniedError and fires the onDeny audit hook.
4	Ed25519 module signing	Generates an ephemeral keypair, installs a trust root, signs a module manifest. Then attempts three hostile variants: a signed-but-tampered manifest (signature check fails), an unsigned manifest under the enclaved flavor (rejected), and the same unsigned manifest under the open flavor (allowed with a warning — the two flavors behave as documented).
5	Hash-chained audit log	Writes 4 audit records, calls verifyChain() → ok: true. Then silently rewrites the middle record's payload in-place (simulating an insider edit), re-verifies, and shows the chain reports TAMPER DETECTED at record #1 (recordHash mismatch).
6	Prompt-injection sanitizer	Submits a payload containing a unicode bidi override (\u202E), a fenced system-role boundary, and a classic Ignore previous instructions imperative. detectInjection() flags all three indicators; sanitizeForPrompt() strips the bidi, neutralizes the fence, and the output is safe to embed in a downstream prompt.
7	Human-in-the-loop approval	Starts an AgentSession that requires approvals for network.outbound. The agent proposes POST https://leak-site.example/upload. The operator denies from the approval queue. The agent-side await proposeAction(...) rejects with ApprovalDeniedError("network.outbound"). Demonstrates cooperative cancellation without forced thread termination.
8	Transaction buffer + rollback	Creates a TransactionBuffer sized to 1 % of system RAM. Records two compensable actions (a filesystem write, a DB insert). Shows live side-effect state. Then calls rollback(2) — each inverse fires in LIFO order, and the side-effect state returns to pre-transaction.
9	AES-256-GCM at-rest envelope	Encrypts a CONFIDENTIAL payload with a scrypt-derived key and AAD-binds it to analyst-7. Round-trips back identically. A decryption attempt with the wrong passphrase fails the GCM authentication tag (rejected, not silently corrupted).

Expected output

You should see nine bordered scene headers, each followed by ✓ marks for every assertion, and a closing line:

all 9 scenes passed.
207 unit + adversarial pen-tests cover these primitives — see `npm test`.

If any assertion fails, the demo prints a ✗ with the exact mismatch and exits non-zero. This is the same harness we use on CI (.github/workflows/enclawed-security.yml) so a green demo is a signal that the deployed framework is intact on your machine.

Two flavors

enclawed ships in two flavors selected at boot via ENCLAWED_FLAVOR:

Flavor	Default	Posture
open	yes	Enclawed-compatible. Allowlists not enforced; module signatures warn-only; FIPS not asserted by default. The framework still runs (audit log, DLP redaction, classification-label types, module-loader trust-root, MCP attestation verifier). Use this for development and any non-regulated deployment.
enclaved	opt-in	High-trust deployment (regulated industry, classified enclave). Strict deny-by-default channel/provider/tool/host allowlists, FIPS asserted at boot, every loaded module MUST present a manifest signed by a trust-root signer approved for its declared clearance tier, MCP connections refused unless the remote server attests to at least the caller's required tier.

What stays vs. what was removed

Removed (78 module directories from upstream — not loadable in high-trust deployments anyway):

• External chat channels (~25): WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Matrix, Microsoft Teams, IRC, etc.
• External LLM providers (~45): OpenAI, Anthropic, Google, Mistral, Groq, AWS Bedrock, Azure OpenAI, OpenRouter, Fireworks, etc.
• External search / browser / webhooks (~8): Brave, DuckDuckGo, Exa, Firecrawl, SearXNG, Tavily, Browser, Webhooks.

Kept — all local or local-capable:

• Local LLM runtimes: Ollama, vLLM, LM Studio, SGLang, NVIDIA NIM, llm-task.
• Local image / media: ComfyUI, image/video/media generation cores.
• Local memory: memory-core, memory-lancedb, memory-wiki, active-memory.
• Local channels and shells: openshell, qa-channel, qa-lab, qa-matrix, phone-control (LAN), webchat (loopback only).
• All core gateway, plugin SDK, and runtime infrastructure.

Added — modules/mcp-attested/: reference Model Context Protocol client that only connects to MCP servers presenting a signed clearance attestation from a trust-root signer. Works with any sector's trust hierarchy.

What the framework adds (always on)

• Bell-LaPadula classification labels with a six-tier numeric ladder exposed under both generic industry names (PUBLIC < INTERNAL < CONFIDENTIAL < RESTRICTED < RESTRICTED-PLUS < SCI) and US-government aliases (UNCLASSIFIED < CUI < CONFIDENTIAL < SECRET < TOP_SECRET < TOP_SECRET//SCI). Plus templates for DOE Q and L clearance for organizations operating against US-gov guidance. (src/enclawed/classification.ts)
• Deny-by-default policy for channels, providers, tools, and outbound hosts. Configurable; ships with defaultEnclavedPolicy() and defaultOpenPolicy(). (src/enclawed/policy.ts)
• Egress allowlist wrapping globalThis.fetch so any module attempting to reach an unlisted host is denied and audited. (src/enclawed/egress-guard.ts)
• Hash-chained append-only audit log (SHA-256, JSONL, independently verifiable). (src/enclawed/audit-log.ts)
• DLP scanner — sensitive-data markings (industry banners + US-government markings), cloud / vendor secret formats (AWS / GCP / Azure / GitHub / GitLab / OpenAI / Anthropic / Slack / Stripe / JWTs / PEM private keys), and PII (international email, E.164 phone, credit-card PAN, IBAN, US SSN). Every log line redacted before reaching console / file. (src/enclawed/dlp-scanner.ts)
• AES-256-GCM at-rest envelope with FIPS-mode assertion gate. (src/enclawed/crypto-fips.ts)
• Secret zeroizer for in-process Buffer / Uint8Array material. (src/enclawed/zeroize.ts)
• Ed25519 module-signing with enclawed.module.json manifest schema, trust-root with per-signer clearance approval, boot-time pre-verification of every module on disk. (src/enclawed/module-signing.ts, module-loader.ts, trust-root.ts)
• Flavor system — getFlavor() reads ENCLAWED_FLAVOR, defaults to "open". (src/enclawed/flavor.ts)

Documentation

• enclawed/FORK.md — full fork charter.
• enclawed/README.md — framework module reference.
• enclawed/config/classified-profile.example.json — reference deployment profile for the enclaved flavor.

License

MIT (inherited from upstream OpenClaw). See LICENSE.