rosclaw

What ROSClaw is built to do

ROSClaw is a runtime and control plane for embodied agents, not another agent framework and not a replacement for ROS 2. Its stated job is to ground AI actions into a physical body, fail closed when something is wrong, execute with evidence, and return an auditable receipt. Northbound clients include Codex, Claude Code, OpenClaw, and other agents. Southbound systems include ROS 2, the Model Context Protocol, vendor SDKs, simulators, and robot controllers. The canonical action path binds an intent to a body and capability, applies policy and authorization, arbitrates physical resources, dispatches to a driver, and returns an evidence bearing ExecutionReceipt. Memory and self evolution are described as asynchronous consumers of that evidence, never a substitute for it. The project is explicit that no model output should directly control a robot, and it treats a request as different from execution and execution as different from completion. Completion requires evidence. The README frames this as missing infrastructure between high level AI agents and the physical world, where gravity, friction, latency, and torque limits all matter. The firstboot wizard installs a CLI and can run headless with a profile that disables telemetry. The rosclawd daemon is the only supported control plane entry point for agent driven physical work, and the README stresses that an agent cannot self approve the single audited permit a daemon UID may issue.

Safety model and execution modes

The core safety rule in ROSClaw is that no model output should directly command a robot. A provider produces a structured action proposal, and the sandbox or firewall checks it against the active body model and safety policy. The decision is one of allow, modify, block, or require human confirmation. The daemon, called rosclawd, authenticates the peer and matches an expiring, use bounded permit to the body snapshot, the explicit capability, and the exact action intent. ActionGateway then acquires an exclusive resource lease and dispatches a daemon owned executor. Driver acknowledgements, observations, verification, and artifacts are assembled into a receipt. The project defines several execution modes: FIXTURE for explicit synthetic data that is never valid for real runs, DRY_RUN for static policy checks, REPLAY for recorded evidence, SIMULATION for physics backed execution, SHADOW as a defined contract, and REAL for fail closed operation. The README states that REAL deployments still require site specific device access controls and that credential isolation must live outside the agent process. The project calls itself research infrastructure and says it does not replace certified industrial safety systems. It recommends testing in simulation first and keeping emergency stops engaged with human supervision at all times. Every action carries a finite deadline and a renewable lease, and session loss applies the declared orphan policy so a dropped connection cannot leave a physical actuator stuck mid motion.

Modules, tools, and maturity

ROSClaw is written in Python and supports versions 3.11 through 3.13, with the isolated LeRobot runtime and the bundled RH56 reference policy plugin requiring Python 3.12 or newer. Its core runtime modules cover the lifecycle and configuration, an event bus for topic routing, a provider for capability routing and schema enforcement, a sandbox for safety validation, a practice module for timeline capture, a memory module for an experience graph, and an auto module for proposals and experiments. A Darwin module runs multi seed benchmarks and regression checks, and a skill registry tracks version and lineage. The README documents a JSON CLI for daemon status, session creation, and security checks, plus trace commands that render a causal span tree across runtime, provider, MCP, and sandbox boundaries. Hardware MCP servers can be installed from declarative manifests with a dry run preview, and a Hub pipeline enforces payload hashes, detached Ed25519 signatures, and safe archive extraction. The project is alpha software and the README lists exactly which paths are simulation verified, component verified, or still pending independent hardware acceptance, rather than claiming broad real robot readiness. The bundled trust store is intentionally empty so production trust roots must be provisioned by the operator.

Editorial conclusion

ROSClaw is released under the MIT license and, at the time of writing, the repository recorded 186 stars and was last updated on 2026-08-24.