Claw & Order
Plans, proves, then acts. Verifies its work with a theorem prover, remembers your project between sessions, backtracks with lessons learned, and takes correction mid-run without restarting. Runs on anything Handles can reach.
Claw & Order
Plans, proves, then acts. Verifies its work with a theorem prover, remembers your project between sessions, backtracks with lessons learned, and takes correction mid-run without restarting. Runs on anything Handles can reach.
Guardrails are advice; a perimeter drawn around a process that still holds full authority, hoping the model takes the hint.
Claw & Order works differently. Its boundaries are properties of the capabilities it holds. A review persona scoped to read cannot write; not “is instructed not to,” cannot. The permission check runs on the typed metadata of the resolved call, and a scoped persona has no shell access at all, because an opaque command string can’t be bounds-checked. Prompt injection has nothing to hijack, because there’s no ambient permission to take. Sub-agents get attenuated child spaces, never a copy of the parent’s authority. Anything unclassifiable fails closed.
That’s object-capability security (what the security community has wanted for fifty years) running under a production coding agent.
The same principle runs through everything below: claims the agent makes about its own work are checked by machines that don’t take the agents word for it…
01 /
IT PROVES ITS PLANS BEFORE RUNNING THEM.
For structured tasks, a plan doesn’t execute until it clears a bank of critics, and the critics are machines, not language models. Z3 (constraint checker) runs natively inside the agent’s process and checks the plan against typed constraints; a counterexample triggers automatic repair and re-verification. Some plan steps go straight to a solver with no LLM involvement at all.
Crucially, the effects of each action come from the capability’s own signed contract, not from the model’s description of itself. The model can’t push a bad plan through by mis-stating what an action does, because it never states it.
In live runs the agent has driven Z3, the Lean proof kernel, and the Spin model checker, separately and in composition. Our flagship result: all-N agreement for single-decree Paxos, proved via EPR, with the inductive invariant discovered by counterexample-guided refinement, the glue theorem kernel-checked in Lean with zero axiom dependencies, and the run independently audited at zero critical findings.
02 /
IT REMEMBERS ACROSS SESSIONS.
You can change its mind mid-runMost agents forget when the context window ends. Claw & Order keeps typed memory in a knowledge graph at three timescales.
Within a run: decisions, findings, files touched, and dead ends, digested into every turn. Restoring a checkpoint rewinds the files and records the abandoned approach, so later turns are told to avoid it. Backtracking with lesson retention.
Across runs: a durable project ledger of requirements, design decisions, tests, defects, and deployments, linked as signed facts. “What’s unblocked, what’s left, am I done” become graph queries.
As procedures: what the agent learns becomes a versioned Standard Operating Procedure with enforced step contracts and mandatory provenance, discoverable by intent. A machine-generated draft can never silently overwrite a curated one.
03 /
YOU CAN CHANGE ITS MIND, MID-RUN.
A running flight isn’t a black box. Subscribe to live progress, ask how it’s going and get an answer with citations into its own trace, steer it mid-run.
And the part we’ve seen nowhere else: tell a working agent that one of its assumptions is wrong, and the correction merges into its world model and triggers a re-plan. No restart, no lost work. Fleet operators get the same surface over every running flight — enumerate them, attach to one, interrogate it live.
04 /
IT STOPS WHEN THE WORK IS DONE.
No turn budgets anywhere; a permanent test enforces their absence. Termination is judged on measured progress; new work product, new belief, or new information. An agent spinning in circles gets cut quickly and an agent deep in a productive investigation is left to work, its timeouts resetting while progress continues.
Supervisors report verdicts, not exit codes. A clean exit with a failing gate returns BLOCKED, never quietly counted as a success.
05 /
IT IMPROVES ITSELF, WITH PROVENANCE.
An observer reads a run’s verbatim traces and files a report that can’t be recorded unless every checklist dimension has a verdict. An improver turns findings into amendments to the agent’s own procedures and personas and an amendment without a provenance chain back to the finding that justified it is refused outright.
The loop closes measurably: amend, re-run, show the metric moved.
06 /
IT ORCHESTRATES A FLEET OF AGENTS
Claw & Order orchestrates other agents as readily as it edits files. A supervisor reasons over a durable programme ledger and dispatches workers to other machines across the federation, every dispatch stamped with one trace identity that both sides inherit, so a run on remote hardware reads back from your laptop as a single trace.
Work items complete only when their acceptance test runs green. Done-ness is measured by machinery, never self-reported by the model that did the work.
07 /
NO TOOL LIST
Most agents ship a hand-written tool list. Claw & Order discovers capabilities at runtime: filesystem, git, browser, databases, solvers, proof kernels, other agents, machines across the network. It finds them by intent and drives them through one uniform protocol. Mount a new capability and the agent uses it that same turn; no prompt change, no redeploy. Its reach grows with your estate.
08 /
BUILT ON HANDLES
Claw & Order runs on Handles, our substrate, designed for agents from the first line; federated, typed, capability-scoped. The proofs, the memory graph, the permission model, and the fleet trace all fall work from this foundation.
The engineering discipline is part of the claim: ~900 test fixtures across the agent and its libraries, written test-first against real services, with mocks banned by policy. Zero regular expressions in the agent’s source; every machine-consumed model output goes through typed, schema-validated responses, enforced by a permanent ratchet whose checker is itself regex-free. Review personas graded against negative controls, so we know they don’t fabricate findings. Every turn’s reasoning is a first-class, queryable field on a durable trace.