🦞 CRACKING THE CLAW

A technical deep-dive into OpenClaw’s internals and architecture

The first thing you notice when you set up your first OpenClaw project, assuming you are paying close attention to what it’s actually doing and how it’s actually doing it, is that OpenClaw is paying considerably less attention to what it’s actually doing and how it’s doing it than you are. Which leaves the question somewhat resembling a freshly caught, whole Dungeness crab: tough to open, but rewarding for the patient who take time to understand its anatomy. So let’s break it down.

Shaun Furman ran OpenClaw on a Rabbit r1 for 36 hours. The r1 was 2024’s most publicly mocked piece of consumer hardware, a $200 single control wheel device whose entire thesis was that the post-app future had arrived, and whose actual implementation turned out to be a button that called ChatGPT. Furman used one as a dumb terminal for OpenClaw and in doing so accidentally proved the r1’s thesis correct, just without any of Rabbit’s janky software. After 36 hours he’d eliminated his need for notes apps, travel apps, email, browser, calendar, translation, reminders, workout tracking, and “arguably ChatGPT, Claude, Grok and Gemini” (Meaning those apps: its brain is still an LLM.) His conclusion: “This strange device showed me that an app is just an OpenClaw skill. Taking away the environment that was built for apps showed me that almost all of them can be reduced to a markdown file.”

What Furman stumbled onto is the architectural insight that the entire app economy missed: the interface was never the point. The capability was. And if a capability can be expressed as a self-describing contract (a README the agent consumes when it needs it, pays the context cost, executes, and moves on), then thirty years of purpose-built applications sitting on purpose-built platforms are revealed as an elaborate local maximum. A relational layer mistaken for the thing itself. Call it Korzybski’s revenge. The crypto world gestured at exactly this with smart contracts: capability as a self-executing artifact that any sufficiently capable runtime can pick up and run, without an app store, without a company maintaining the interface. The dream was architecturally correct. The implementation was a byzantine disaster of gas fees and Solidity and rug pulls. A markdown file that an LLM reads when it needs a tool is the dumbest possible implementation of that idea. Which is precisely why it works.

This is what the cult of the claw understood, underneath the dashboard screenshots and the Telegram bot flexes. Not “my agent has goals.” Something more fundamental: the map was always optional. We just didn’t have a runtime capable of reading the territory directly.

Understanding what OpenClaw ‘is’ and how it navigates this territory requires understanding how it works under its carapace. OpenClaw didn’t build the runtime. It borrowed one even most of its adoptees are not familiar with, if they are even aware of its existence.

Life of Pi

OpenClaw’s cognitive core (its ganglia, if you will) is not its own. The bundled Pi binary, running in RPC mode, is taken from Mario Zechner’s pi-mono project, a coding agent he built by systematically removing everything he didn’t personally need, documented with the particular satisfaction of someone who has seen too many harnesses accumulate too much weight, (so tempted to name names here) and who moreover seems to get the value of subtractive thinking in the age of accumulation.

The resulting system is a study in almost brutal scope constraint. The system prompt runs under a thousand tokens. The toolset is four primitives: read, write, edit, & bash. No plan mode. No sub-agents. No background shells. And definitely no MCP. Each subtraction is documented with explicit reasoning. Zechner’s core argument is that context engineering is paramount, that existing harnesses inject context behind your back that isn’t surfaced in the UI, and that the correct response to this is not better tooling but less tooling. The frontier models have been sufficiently RL-trained that they don’t need ten thousand tokens of scaffolding to understand what a coding agent is. Pi is built to prove this empirically, a minimal harness designed to compete with systems of far greater complexity on pure model capability alone. 🦾

More importantly for our non-nefarious purposes: Pi sits at the high-certainty end of Floridi’s Conjecture, which states that the relationship between a system’s certainty and its scope is bounded. More formally, C(M) × S(M) ≤ k, where C(M) is a system’s certainty, S(M) is its scope, and k is a universal constant strictly less than 1.
(Floridi, 2025)

I’m tempted to liken it to a CAP theorem for AI, though its more of a bipartite optimisation: any system engineered for strong guarantees must necessary pay for such by a narrowing of its domain. A system that accepts the full richness of real-world inputs necessarily relinquishes provably perfect performance. A better framing might even be the successor to Sculley et al.’s watershed hidden technical debt framework in the most important sense: where Sculley named the invisible accumulation of complexity cost in ML systems, Floridi names the invisible accumulation of epistemic cost. The debt accrues in a different ledger (one which subsequently will be named.)

Pi’s ruthlessly confined scope provides a case study (1 developer, 1 codebase, 4 tools) and within that scope the system is almost entirely legible. The JSONL session transcript records every tool call and its output. You can read the session and reconstruct exactly what happened. The map and the territory are essentially the same document. This is the direct consequence of keeping S(M) small enough that C(M) can remain high (literally the inverse of Borges’ Unconscionable map!) While not a proof of the conjecture it’s a compelling example. Compelling enough that Steinberger saw the value, anyway.

One other thing worth noting: when it modifies code, it uses sed, awk, or direct filesystem writes. It reads files and edits them as text. Contrast this with opencode (SST’s competing harness) which spins up Language Server Protocol servers in the background, providing (without ‘telling’) the agent with structured bidirectional awareness of the codebase’s semantic graph: dependencies, call sites, and type signatures. Whereas Pi’s agent reads files and makes educated inferences, opencode’s agent knows what it’s touching at the level of the compiler. It has high S(M). Both implementations ‘work’ but only one of them has a map that matches the territory all the way down. For certain classes of refactoring at scale, that distinction is not academic. For the claw-is-the-law crowd it’s of unclear relevance to the task at hand.

The Map: Three Logical Layers

Such distinctions of course are heavily dependent on architectural layers which OpenClaw logically separates into three tiers, wherein the observability story is different—and moreover, progressively thinner—at each one.

The transport layer, (Gateway WebSocket RPC) is fully legible. TypeBox-validated protocol frames, scope-based authorization, deterministic message routing. Things that make engineers happy. This is the layer OpenClaw shows you on install: the terminal narrating the agent brain connecting to your environment, every file read and shell command visible in sequence. Zechner built Pi in explicit rejection of what he memorably called “context-stuffing black boxes” — systems that show you a result without showing you the rm -rf that produced it. At the transport layer, OpenClaw keeps its promise.

The orchestration layer (routing, sessions, tool policy resolution) is partially legible. The configuration is declarative and hot-reloadable. Session keys encode routing context in human-readable form. The tool policy cascade is documented: global → provider → agent → group → sandbox, each stage narrowing but never expanding the available tool set. You can read the configuration and reconstruct the intended policy. What you cannot reconstruct is which stage in the cascade suppressed a tool call that never happened. Absence is invisible. A tool that wasn’t invoked leaves no trace of why. (John) McCarthy spoke of this. It’s not something we can file as a bug. It is however the first withdrawal from our observability budget.

The execution layer (tool invocation, memory search, model API calls) is outcome-legible only. Sessions persist as JSONL transcripts. You see what the tools returned. The hybrid memory search (vector similarity weighted at 70%, BM25 keyword at 30%) runs underneath, and the index manager’s chunking and reranking decisions are not surfaced in the session record.

The deepest withdrawal happens in the memory system. OpenClaw distills session experience into MEMORY.md files: compressed summaries that inform future sessions. This is where the reasoning trace stops being a trace and becomes a belief. The original inference chain, that specific context, tool outputs, and the model’s intermediate reasoning gets compressed into a statement that subsequent sessions treat as ground truth. You can read this belief. You cannot audit the reasoning that produced it. There is no trace. There is no wide log. The map, at this layer, is a drawn-from-memory sketch of a territory that no longer exists in recoverable form.

Zechner’s conviction was that you should be able to see the machine working. At the transport layer, you can. By the execution layer, what you’re seeing is a postcard from the edge, a waypoint the machine has already left behind.

Gateway Mode and the Exactitude of Science

Most OpenClaw users never see any of this. They run Gateway Mode, routing their agent through Telegram, WhatsApp, Signal, or Discord. That’s the point, that’s what made OpenClaw viral, and that’s what makes the Rabbit r1 trick work (because the alternative, an agent that only talks to you through a terminal window, is still just a very fast CLI.) In Gateway Mode, the terminal narration that defines Pi’s anti-abstraction philosophy disappears behind the RPC layer. The surgeon is still operating. You’re in the waiting room reading fugazi updates on your phone.

This is Floridi’s conjecture settling its bill. Gateway Mode is a scope expansion with multiple channels, multiple users, remote access, persistent sessions across devices, and that expansion is where its value comes from. The cost is certainty: specifically, certainty about what the agent’s doing and why, surfaced in real time. C(M) × S(M) ≤ k. Every new channel is an increment to S(M). The conjecture is not negotiable.

The Skills system is the most philosophically interesting place to watch this dynamic. Not that there haven’t been myriad criticisms of MCP, but Zechner’s objection to it was specific: popular MCP servers front-load their entire tool descriptions into context upfront, with Playwright MCP running to 13.7k tokens and Chrome DevTools MCP to 18k, consuming 7-9% of the context window before the first user message. His alternative was the capability contract: the agent reads a README when it needs a tool, paying the context cost only at the moment of use. Progressive disclosure rather than upfront declaration.

OpenClaw’s Skills system goes further. Where MCP hides tool implementation behind an API signature (the agent knows what the tool does, not how) Skills allow the agent to read the source code of the tool it’s about to use. The agent understands mechanism, not just interface. This is the observability philosophy applied to tool use: the territory visible all the way down. (Borges shudders.) And it is, structurally, what Furman’s markdown file insight predicted: a capability that is fully self-describing to any runtime capable of reading it, with no platform required, no intermediary, no abstraction layer between the agent and the thing it needs to do.

One year after launching MCP, Anthropic released Skills as a separate standard, almost exactly on MCP’s one year anniversary (Fall 2025) essentially acknowledging that MCP’s process-isolation model, while correct for certain threat models, left a gap for use cases where the agent needs to understand mechanism rather than just interface. The interface is regulative but only the mechanism is constitutive. The choice between skills running in-process with dynamic capability expansion and full source visibility doesn’t stand on correctness, rather, how your use case prioritizes confinement: MCP's process isolation limits blast radius whereas full source skill visibility enables the agent to understand what it's touching, though not necessarily what’s touching it.

Anthropic formalized both approaches as different points on the same tradeoff curve. Skills prioritize dynamic capability expansion with full implementation visibility. MCP keeps the source behind glass, trading implementation visibility for process isolation and scoped credentials. OpenClaw chose map depth over security boundary. It’s less of a question of whether this was the ‘right’ choice and more an exploration of what this “festival of footguns” (as CTO Doug Winter christened it) has to offer for this price.

Multi-Agent Routing and the Delegation Gap

OpenClaw supports multi-agent routing natively: sub-agents and agent clusters configured via YAML, bindings rules routing messages by channel, account, chat type, or sender, lane queues enforcing serial execution by default to prevent race conditions. This is where the observability budget runs hardest into the scope expansion problem, and where a new framework from Google DeepMind gives us a more sophisticated diagnostic instrument to be held against the architecture.

Last week, DeepMind’s Nenad Tomašev and colleagues proposed a framework for intelligent AI delegation, arguing that real delegation requires not just task allocation but transfer of authority, responsibility, and accountability, with dynamic trust calibration, verifiable task completion, an authority gradient between delegator and delegatee, and what they call the zone of indifference: the range of instructions a delegatee executes without critical deliberation. As delegation chains lengthen, a broad zone of indifference allows subtle intent mismatches to propagate downstream, each agent acting as an unthinking router rather than a responsible actor.

This is a precise description of OpenClaw’s multi-agent routing at its current maturity with its deterministic bindings rules and policy cascade correctness, while the lane queue prevents races (via event serialization, not state reduction.) What’s absent is any mechanism for an agent to challenge the delegation it received, assess whether the task is appropriately scoped to its capabilities, or escalate based on contextual ambiguity. The system routes, but doesn’t reason about routing. This is not a criticism unique to OpenClaw but rather the current SOTA for open-source agent runtimes. But it is worth naming precisely, because the zone of indifference widens with every agent added to the cluster, and the MEMORY.md files accumulating beliefs across agents have no mechanism to surface the reasoning chains that produced them.

Irreversibility is the architectural primitive the framework names but OpenClaw doesn’t defend against. An inference call commits to a token distribution; the alternatives are gone. A policy cascade suppresses a tool; the reasoning is unrecoverable. MEMORY.md compresses a trace into a belief; the original is discarded. A message sent cannot be unsent. Once executed the original values are unrecoverable.

Reversible tasks OTOH (eg drafts, local operations, sandboxed execution) can be undone. Irreversible tasks (incl. external API calls and filesystem writes visible to other processes) cannot. The distinction defines an authority gradient: stricter verification, higher thresholds, human-in-the-loop checkpoints before crossing the line from reversible to irreversible. OpenClaw’s sandbox boundary is the only mechanism that approximates this. (It’s opt-in. YOLO is the default.) There is no built-in gradient between drafting a message and sending it, between testing a command and executing it, between simulating an action and committing it to the world.

The fundamental problem is an agent with the authority to perform irreversible actions and no mechanism to distinguish them from reversible ones. Bitsight found over 30,000 exposed OpenClaw Gateway instances in a two-week window: ports open to the internet, API keys readable. [Protip: the system often defaults to trusting 127.0.0.1, but you might be surprised (or not) how many users accidentally bind the gateway to 0.0.0.0. Whoopsie.] The quiet part is ofc YOLO-by-default at population scale.

MIT CSAIL’s EnCompass, presented as a poster at NeurIPS  in December, approaches the reversibility problem from the execution side. By treating the agent execution graph as a first-class object, non-linearly traversable with backtracking, parallel sampling and beam search all as separable concerns from the workflow logic itself, EnCompass recovers the optionality that inference-time commitment destroys.

The theoretical move is identical to the shift between ELT and ETL: preserve the atomic substrate, make the interpretation disposable and regenerable. An inference call, like a premature transform, is a one-way valve. Once you’ve committed to that token distribution, the state that preceded it is gone unless you explicitly preserved it. EnCompass pushes the valve further down the stack; OpenClaw has no surface for this concept. When an agent in a cluster makes a bad decision, the JSONL transcript records the outcome. The execution state that produced it is gone. The MEMORY.md records a belief derived from it. The belief propagates into the next session. The reasoning trace that would let you audit the belief was never captured and cannot be reconstructed.

While technically not technical debt in the Sculley sense (accumulated complexity you’ll eventually refactor), it accrues in a different ledger. That ledger gets its own post.

Seen and Unseen

OpenClaw delivers on its opening promise at the transport layer. The Gateway shows its work. The configuration is declarative and inspectable. The install experience is exactly what it claims to be.

But the map begins to fray at the orchestration layer, where silent failures on suppressed tool calls leave no trace of the suppression. It peels further at the execution layer, where outcomes are recorded and mechanisms are not. By the time we reach the memory layer, where the reasoning that produced a belief is compressed into the belief itself and the original discarded, it’s in tatters.

Borges’ kingdom is Floridi’s conjecture, not as theory but as architecture. Pi sat at the high-certainty, low-scope end of the hyperbola: a coding collab agent for 1 dev x 4 tools, that was legible all the way down. By moving the operating point (more channels, more agents, more users, more scope) OpenClaw opens a debt position with the conjecture. Each capability addition was a rational local decision but the collective result is a system whose observability model was designed for the territory it started from, not the territory it became. Not even larger, just different.

Furman’s markdown file is still there. The capability contract still works. The agent can still read the territory directly, tool by tool, README by README, without an app store intermediating. (And what is an app store but a manifest with a judging committee?) That insight survives but what doesn’t survive, at scale, is the certainty that what you’re seeing is what’s actually happening. At a sufficient scale the disconnect is disastrous, a festival of nuclear footguns.

Mario Zechner built Pi around a single conviction: that you should be able to see the machine working. OpenClaw inherited that conviction—sincerely, one believes—and then grew faster than it could follow. The terminal still shows you the brain (er, ganglia) connecting to your environment on install. In Gateway Mode, it’s still there, albeit unseen. At a certain depth the sun’s light just can’t penetrate to the ocean floor to illuminate all the crustaceans scuttling there.

---

Somewhere in the cluster, an agent is reasoning. You can see what it decided. You can read what it remembered. You just have not idea how it got there.

This gap has no name. It’ll get one in a future post.

Forest Mars is a NYC based CTO who smh finds time to write about architecture, AI, and the things your infrastructure is hiding from you, as well as how to build AI at scale.

References

Floridi, L. et al. (2025). A Conjecture on a Fundamental Trade-Off between Certainty and Scope in Symbolic and Generative AI. arXiv:2506.10130.

Li, Z. et al. (2025). EnCompass: Separating Workflow Logic from Inference-Time Search in LLM Agents. NeurIPS 2025.

Sculley, D. et al. (2015). Hidden Technical Debt in Machine Learning Systems. NeurIPS 2015.

Tomašev, N., Franklin, M., & Osindero, S. (Feb 12, 2026). Intelligent AI Delegation. arXiv:2602.11865.

Zechner, M. (2025). What I learned building an opinionated and minimal coding agent. mariozechner.at.

Shaun Furman on X: “I’ve now been running Openclaw on this Rabbit for around 36 hours”