Register a harness
Import:openclaw/plugin-sdk/agent-harness
authBootstrap is intentionally absent from this generic example. Add
authBootstrap: "harness" only when the harness meets the
harness-owned auth bootstrap contract.
Isolated completion
The optionalrunIsolatedCompletionV2(params) capability serves product paths
that require one fresh prompt-only inference call with a literal empty
model-callable tool surface. Core passes provider and model ids, prompts,
deadline controls, and one prepared authorization:
owner: "host"contains the exact transportmodeland resolvedauth.owner: "harness"contains the prepared runtime auth plan and a credential snapshot restricted to the single profile selected for that call. Core owns automatic fallback order and invokes the harness separately for each candidate.
params.assertCurrent() after preparation awaits and
immediately before each credential handoff, inference request, or process start,
including retries.
It revalidates the caller’s live authority and expires when the completion ends.
A thrown assertion ends execution; do not treat it as a credential failure or
retry with another profile. Continue to honor abortSignal; cleanup must remain
available after authority expires.
Return { assistant: AssistantMessage }. Core accepts only terminal text/thinking
content with a stop or length stop reason; tool calls, failed stops, and empty
output are rejected. Title requests set outputTextPolicy: "strict-visible":
keep reasoning separate without recovering ambiguous reasoning as visible text;
an empty visible result is valid. The host-prepared helper maps this policy to
strict parsing before recovery. Omission preserves ordinary recovery behavior.
CLI-backed title calls also allow clean empty output without a silent-reply token;
ordinary CLI calls still reject empty responses.
Older external harnesses may ignore the policy; a final title filter cannot
restore provenance that a harness already discarded, so this is not a universal
reasoning-privacy guarantee. If the harness cannot enforce isolation, omit the capability.
Callers that require isolated completion then fail closed before invoking that
harness; OpenClaw does not replay the request through another runtime.
Plugin callers request isolated execution through
api.runtime.llm.complete({ execution: { mode: "isolated-agent-runtime" } });
the harness callback is the provider-side enforcement SPI, not a second caller
API.
The legacy runIsolatedCompletion(params) host-auth-only capability is
deprecated and remains available for external plugins through 2026-10-12.
Implement V2 for harness-owned or native authentication; OpenClaw never invents
a host credential when only the legacy capability is present.
Native agent servers often have ambient built-in tools even when OpenClaw sends
an empty tool list. Disable and attest those native capabilities for the fresh
turn, use a separate transport that can serialize a true zero-tool request, or
leave the capability unsupported.
Audit evidence follows the same boundary. OpenClaw can record registered plugin
ownership and run admission, but it cannot claim an external native side effect
from an ACP update or transcript. A side effect wholly inside that runtime is
unsupported unless an adapter invokes an OpenClaw-owned callback before the
action. Do not reconstruct the callback from native tool status events.
Delegated execution
A harness owner may setdelegatedExecutionPluginIds to the ids of trusted
plugins that need to execute an existing model-locked session, such as a voice
transport continuing a Codex-backed conversation. This is static owner consent,
not a core allowlist. Keep it narrow.
Delegates receive only work admission and embedded execution. OpenClaw requires
the exact stored session key, store path, and session id; modelSelectionLocked: true; and matching agentHarnessId and agentHarnessRuntimeOverride values.
The run is then scoped through the harness owner. Session creation, patching,
reset, deletion, archive, and Gateway mutation remain owner-only.