Join waitlistJoin
How it worksResearchDocsAdoptersPricingContactJoin waitlist
Back to agent research
Joint runtime proof / May 19, 2026

One policy controlled OpenClaw, Hermes, MCP, and a Generic HTTP agent.

The earlier articles proved OpenClaw and Hermes separately. This proof adds MCP and Generic HTTP adapters, then tests the shared Imladri layer across all four at once: live bridge handshakes, one constitution, 100-way mixed-runtime concurrency, cross-agent delegation, shared halt, fail-closed preflight, and one normalized evidence schema.

Agent boundary research sequence

Eight chapters. One continuous agent-control story.

The path moves from the first OpenClaw payment block, to adversarial replay, late-stage drift, native tool-body proof, second-runtime model turns through Hermes, Hermes parity, a four-runtime parity proof, and finally a clean-install CLI path for those adapters.

01Baseline proof before bodyA model-selected payment.transfer call was stopped before the tool function ran.May 902Adversarial replay under loadSeven attack patterns replayed as 700 concurrent attempts with zero body calls.May 1303Late-drift deep dive at turn eightThe bad action appeared after safe-looking context and was still blocked at execution.May 1404Native tool proof three bodies blockedDeploy, export, and payment tools were invoked natively and blocked before body entry.May 1405Hermes proof second runtimeHermes model turns through OpenAI, Gemini, and DeepSeek were blocked before body entry.May 1606Hermes native tools parity proofHermes native tools, replay, mutation, action matrix, and model-turn checks now match the OpenClaw evidence depth.May 1607Joint runtime proof one policyOpenClaw, Hermes, MCP, and Generic HTTP shared one constitution across 100-way mixed concurrency, delegation, halt, and fail-closed preflight.May 1908Clean install path four init commandsA fresh npm workspace installed the CLI, initialized four adapters, and re-ran the shared proof with zero prohibited body calls.May 19
Why this matters

A single adapter proof is useful, but enterprise buyers will ask whether the boundary is tied to one agent framework. This test makes the next claim concrete: OpenClaw, Hermes, an MCP tool host, and a generic local HTTP agent can sit behind the same Imladri constitution, produce the same evidence shape, and fail closed through the same strict preflight path.

Joint parity run

Live bridge checks and seven verifier checks ran as one evidence packet.

The demo runner first exercised the OpenClaw, Hermes, MCP, and Generic HTTP local bridges with connect, policy, allowed-action, and denied-action phases. It then ran the verifier through the TypeScript SDK boundary and four runtime adapters, mixing prohibited attempts across all runtimes before checking delegation, halt, fail-closed transport, schema compatibility, and clean bootstrap behavior.

CheckResult
Shared constitutionOpenClaw, Hermes, MCP, and Generic HTTP loaded the same allow, deny, and unknown-action policy.
Mixed concurrency100 mixed-runtime prohibited attempts blocked before body entry across all four adapters.
Cross-runtime delegationOpenClaw delegated to Hermes, Hermes delegated to MCP, MCP delegated to Generic HTTP, and Generic HTTP delegated back to OpenClaw; all delegated dangerous calls were denied.
Shared halt stateA single halted preflight boundary stopped all four runtimes before safe bodies could run.
Fail-closed preflightA transport failure on strict preflight denied all four runtimes before body entry.
Evidence schemaAll four runtimes produced the same normalized event fields for audit and proof export.
Clean bootstrapAll four adapters started from config, ran one safe action, and denied one dangerous action with no external secrets.
Runtime mapping

The shared action names map to native runtime actions.

Customers should not need a separate policy model per agent framework. The verifier used shared logical actions and mapped only the runtime-specific safe version call.

RuntimeLocal bridgeNative version action
OpenClawhttp://127.0.0.1:8788/openclaw/agentopenclaw.version
Hermeshttp://127.0.0.1:8798/hermes/agenthermes.version
MCP tool hosthttp://127.0.0.1:8800/mcp/agentmcp.tools.list
Generic HTTP agenthttp://127.0.0.1:8799/custom/agentruntime.version
Delegation and halt

The boundary held when one runtime handed work to another.

The run allowed agent.delegate across OpenClaw, Hermes, MCP, and Generic HTTP, then blocked the dangerous delegated action on the receiving runtime. A separate shared halt check denied all four runtimes through one strict preflight boundary before safe bodies ran.

Artifact

The JSON packet contains all checks and the proof digest.

The public artifact includes the shared constitution, every normalized event, assertion results, latency summary, and a SHA-256 digest over the packet.

Joint runtime artifact: openclaw-hermes-joint-runtime-parity-20260519.json

Scope

This proves the shared Imladri layer, not automatic protection of unwrapped plugins.

The runtime-specific articles still carry the native body-entry proof for OpenClaw and Hermes. This article proves the shared policy, preflight, delegation, halt, and evidence abstraction above those adapters plus MCP and generic custom-agent HTTP bridges. Dangerous functions still need to be explicitly wrapped.