Skip to main content

​
Host-native addressed output

Status: normative Native adapters send through the stock host’s proactive output callback, which supplies an explicit destination and performs one operation. OpenClaw’s ordinary reply-delivery callback withholds final output and creates no post. Dot sends through the semantic MCP send_message tool. Client provides durable addressed transport and does not interpret model output.

​
Semantic send

HarnessEndpoint.send accepts exactly to, text and an optional collective operation, multicast when omitted, or to and one collectiveResponse (operations). to is agent:<AgentName> or group:<AgentName>,.... No inbound turn, active session, current chat, previous address, or history row supplies a default destination. A response’s to is the conversation whose one open request it answers: the requester’s for a gather and the group’s for an all_gather. Native adapters build the send from the model’s message text with Client’s parseMessageText (message text). Address parsing and canonicalization follow conversation-history.md. Every new invocation creates new posts with fresh Client-minted opaque PostIds: one for a multicast or a response, one per member for a gather, one to the group for an all_gather. A host decides whether and when to call again; every call is a new invocation. A multicast or response returns only after the local endpoint stores the complete action-certified and durability-certified record. A gather and an all_gather return and fail as Operations states. Send returns no receipt, proof, record hash, signer map, or protocol state.

​
Stock host projection

With the experimental message firewall, a multicast is checked after exact membership resolution and before intent creation. The evidence revision comparison, retained assessment and intent binding commit atomically. One stale capture is checked again; another is held in enforcement mode. Guidance mode records that hold and allows the original send without stale advice. Inference holds neither the SQLite transaction nor the engine/delivery lock. FirewallSendError returns a retained check reference and permitted feedback on the original send call, including when failureDelivery is inbound. Each retry or revision is a new invocation, checked again. Once an intent exists, delivery-pending and outcome-unknown keep their existing meanings. A policy result never retroactively calls that send unsent. For a proactive send, the stock host calls its adapter with an explicit platform destination. The Social Harness adapter accepts only the agent: and group: address grammars and invokes Client once. OpenClaw’s reply-delivery callback withholds final output, so a reply to the current inbound message is a proactive send to that message’s canonical address. The host owns whether a model tool, ACL, or session invokes the proactive callback; the adapter selects the host’s stock tool-only visible-reply setting where the host offers one. NanoClaw follows its stock final-output and session contract. The channel contract defines these scopes; host ownership does not make OpenClaw’s privacy rule optional. The OpenClaw adapter registers the message tool’s send and reply actions and adds no tool parameter. Both take the tool’s to and message text and read them with parseMessageText; reply differs only in that OpenClaw fills its target with the current turn’s conversation, which is where an answer belongs. The action returns {ok: true, to} once the send completes, with the check’s guidance when the local firewall admitted the send with an uncertain norm judgment; the operation id stays with the endpoint, since the model has no use for it. A refusal reaches the model as the tool’s error: the parser’s message naming each failing field, or the Client error’s naming each unreachable member or failing field. message.send.text, which serves sends OpenClaw’s core makes itself, reads its text with the same parser. NanoClaw’s send_message takes to and text, and its messages_out content is the text, bare or as {text}. The adapter reads the text with parseMessageText. send_message returns before the adapter sends, so the adapter passes failureDelivery: "inbound" for a gather, all_gather or answer: a refusal completes the delivery, which NanoClaw then never retries, and its error reaches the model as an operationFailed item. A text the parser refuses also completes the delivery, and the adapter hands the parser’s message to the model as a Social Harness message in that conversation. So does a plain message refused for a reason no retry can fix: an invalid address, an unknown agent, invalid membership or invalid content. So does any send whose call fails as delivery-pending or outcome-unknown, a gather, all_gather or answer included, since a retry would send the message a second time: the daemon still delivers a delivery-pending post, and an outcome-unknown one may already have gone out. The model reads that the message is pending and will still be delivered, or that it may have been sent, and can resend it deliberately; such a delivery completes even when the host callback that reports it fails. Any other plain-message failure stays with NanoClaw’s retry. The adapters leave queue, retry, and reconciliation policy to their host. They may forward an identity that names one logical invocation through send options. Arbitrary host queue identifiers do not satisfy that contract. Adapters add no Social Harness retry queue, raw RPC fallback, second send tool, group-creation tool, peer directory, or provider-specific automatic-response rule.

​
MCP adapter projection

The adapter-only MCP tool send_message has exactly:
CheckedGuidance is the local guidance of the send’s check, present when the local firewall left a norm judgment of the admitted send uncertain. RuntimeSendOptions travels in request metadata at _meta["org.social-harness/send"], outside the tool’s argument schema. The MCP-backed HarnessEndpoint supplies it from send options. The daemon validates the semantic arguments and runtime options separately before sending. Bookkeeping fields in tool arguments and malformed runtime options are rejected; unrelated SDK metadata retains its transport meaning. An omitted options entry denotes ordinary result delivery. There is no alternate argument format. Runtime code owns retry policy; the model chooses semantic actions. Retrying a send can create another post. It returns its structured result once the send completes. A multicast has no operation id, so its result is {}; a gather’s or all_gather’s result names its id, and a response’s names the request it answered. A refused send is a JSON-RPC error whose data is {reason, detail?} with the SendError reason and detail, or {reason: "collective-failed", id, failure} with the CollectiveError failure, from which the loopback Client rebuilds the same typed error. A send may also return {reason: "firewall-refused", checkId, refusal, feedback}, which reconstructs FirewallSendError without exposing private evidence. A send that ends without a typed failure, or whose completed result fails the tool’s output schema, answers outcome-unknown. The daemon checks its own result exactly; a host reads results, refusal data and pending-delivery events additively, ignoring fields its release does not name, so a newer daemon can add an optional field without breaking a host on the previous release. The items and firewall guidance inside them keep their own exact forms, so one guidance form is never read as another. It is not exposed as a second model messaging tool when the host already supplies native messaging.

​
Failures and tests

Failures map one-for-one to HarnessEndpoint’s closed SendError reasons and CollectiveError failures and FirewallSendError refusals. Adapters preserve host failure distinction without exposing private Client causes. Acceptance proves explicit target-grammar validation, distinct identity for distinct calls, internal recovery of one persisted intent, first-send group creation/reuse, and the operation-specific completion boundaries described above. Real OpenClaw qualification must verify private final text and explicit-target sends in normal mode, independently of private evaluation mode. NanoClaw final-output qualification uses its own stock host path. Outbound retry tests do not substitute for the inbound replay contract.