Summary

• Implement the AgentKit provider side of the external-verification contract accepted in OpenClaw RFC #15.
• Classify each protected tool invocation in the plugin, while OpenClaw owns approval identity, reviewer authorization, timeout, cancellation, retry generations, and the final first-answer-wins decision.
• Present production World ID QR/link challenges with @worldcoin/idkit-core 4.2.2 and complete only the exact host-issued attempt.
• Store proof-free, exact-session trust grants only after successful host completion; storage exhaustion fails closed without scheduling trust that could appear after a session reset.
• Keep signed AgentKit delegation on a one-use loopback resource. Delegation currently fails closed when Gateway TLS is enabled and status reports that limitation accurately.
• Make World request setup, polling, AgentBook lookup, and completion error paths cancellation- and retry-safe.
• Companion focused OpenClaw contract PR: feat(approvals): add external verification contract openclaw/openclaw#113517

Invocation-time policy

AgentKit decides from the concrete before_tool_call invocation whether to skip the gate, offer only allow-once, or offer allow-once plus exact-session trust. Once OpenClaw creates an attempt, the choice is immutable and AgentKit cannot widen it during completion.

Verification

• git diff --check
• pnpm build
• pnpm test:hitl
• pnpm test:openclaw-hitl -- human
• pnpm test:openclaw-hitl -- delegation
• pnpm pack:check
• CI builds against the prepared dependent OpenClaw runtime slice feat/external-verification-runtime; #113517 is intentionally the smaller contract-only first PR.
• Both real Gateway lanes passed denial, verify-once, session trust, session reset/idle/daily boundaries, fresh retry, isolated approvals, late denial, invalid proof, and graceful shutdown.
• Fresh branch autoreview found the deferred-grant/session-reset race; the fix removed background persistence, and the final $autoreview --mode local pass was TruffleHog-clean with no accepted/actionable findings (0.94 confidence).

Physical production World App proof

The flow was tested in a disposable OpenClaw home and isolated Gateway/TUI with a connected physical Pixel 3 (Android 12) running production World App 1.0.121.

• Allow once: an ordinary user prompt asked OpenClaw to run a protected marker command. The TUI displayed the native selector and World QR. World App showed the expected relying party plus Human and Unique Human requests. After approval, the exact blocked command resumed and the proof-free ledger recorded allow-once, succeeded, plugin-completion, and completion_applied=1.
• Deny: the protected command did not execute and no stdout was produced.
• Retry: an expired/failed ceremony left the approval retryable; a fresh generated request succeeded.
• Session trust: Verify and trust completed physically, the second matching command in the same OpenClaw session ran without another approval, and the ledger contained one approval plus a host grant authorization.
• Isolation: the same protected action in a new OpenClaw session produced a fresh approval; denial again prevented execution.

No World proof, RP signing key, broker credential, connector token, or user identifier is stored in the repository or included in this PR.

Behavior addressed: AgentKit can attest an external ceremony only through the exact OpenClaw host-issued attempt while preserving host ownership of authorization and lifecycle state.

Real environment tested: Source AgentKit and OpenClaw in an isolated Gateway/TUI, physical Pixel 3, Android 12, and production World App 1.0.121.

Exact steps or command run after this patch: Start the isolated Gateway/TUI, prompt OpenClaw to run a protected printf marker, select Verify once or Verify and trust, scan the generated QR in World App, approve the requested proofs, then inspect terminal output and the proof-free SQLite approval/attempt records.

Evidence after fix: The physical app completed the ceremony, the blocked command resumed only afterward, same-session trust reused exactly once without creating another approval, and a new session was gated independently.

Observed result after fix: Allow-once, denial, expired-request retry, physical session trust, same-session reuse, and cross-session isolation all behaved as the RFC requires.

What was not tested: No package publish, release, or version bump was performed. Gateway-TLS delegation remains intentionally unsupported and fails closed; human World QR approval works through the configured hosted production broker.

Tracking issue: openclaw/openclaw#82336