title: Zero-Trust Agentic Fabric

Zero-Trust Agentic Fabric

Public Edition · July 2026

ClawQL provides the Agentic Gateway as the Foundational Platform for Auditable Production AI.

This document is the canonical architecture for that positioning. The fabric is the destination; the Agentic Gateway binary is the entry. Product layers (IDP stack, modularization packages, Operator tiers) remain valid — they describe what ships inside the platform. The fabric describes how enterprises deploy and govern it.

Status language: Core gateway, WORM patterns, MCP/inference entry, and Helm paths are shipped or shipping. NATS JetStream is available as an optional Helm event bus. Swarm subject hierarchy, VG-level NSV/SGDOP coordination, Command Deck mandate UI, and full Edge↔VG SPIFFE handshakes are the target fabric architecture — treat those subsections as the source of truth for implementation, not as claims that every surface is production-complete today.

Terminology

Three-layer topology

Each layer holds different data, enforces different policy, and writes a different audit surface. Do not collapse them into one “gateway.”

Usage + intent + execution compose a forensic record a CISO or regulator can reconstruct end-to-end.

Anti-pattern: global master gateway

A single global master gateway is a liability: SPOF, centralized compliance bottleneck, identical policy overhead for every team, and a concentrated supply-chain target. Regional Hubs are independent. Virtual Gateways connect to one or many regions for redundancy. No master. Prefer federated VGs that share EnterpriseGovernance truth but enforce and audit locally.

Layer 1 — Regional Hub

Does

• Intelligent model routing (Frugal → Standard → Frontier escalation where configured)
• Billing metering and usage attribution (source of truth for what each tenant owes)
• Provider load balancing across configured backends
• Semantic-cache coordination for multi-tenant hosted tiers (with tenant isolation)

Does not

• Hold tenant EnterpriseGovernance manifests
• Write tenant intent/execution WORM (that stays on the VG / Edge)
• See raw PII on sovereign execution paths (redaction happens at the VG before traffic leaves the audit boundary)
• Store tenant sovereign secrets (Vault at the VG)

Layer 2 — Dedicated Virtual Gateway

Primary enterprise entry point. Customer owns the infrastructure; ClawQL provides binary, Helm/Packer paths, and management tooling.

Sovereign handshake — VG ↔ Regional Hub

VG initiates all connections (pull pattern — no inbound exposure into the tenant VPC):

1. mTLS (SPIFFE SVID target) — RG validates VG identity
2. GovernanceSync — VG sends manifest SHA-256; mismatch → DEGRADED_MODE + WORM event
3. Stream — upstream: observability / billing signals; downstream: routing instructions
4. Kill switch — heartbeat timeout → RG stops routing to that endpoint (fail-closed)

Sovereign handshake — Edge ↔ VG

1. Edge presents developer-bound identity; VG checks authorization scope
2. Policy push — VG pushes constraints; Edge enforces locally (no round-trip per tool call)
3. Audit pull / push — Edge batches WORM-signed audit bundles to VG (e.g. every 60s or session end)
4. Offline-first — Edge continues locally; backlog syncs on reconnect
5. Manifest updates propagate to connected Edges within one heartbeat interval

Layer 3 — Edge Gateway

Same Agentic Gateway binary class as cloud — deployed locally.

• MCP at localhost for Cursor / Claude Code / Codex
• Local / Frugal inference (e.g. Ollama) where configured
• Personal vault memory; optional team memory via VG fabric
• NATS subscriber for org tasks and problem topics
• Seatbelt / sandbox containment on launch (clawql sandbox init pattern)
• WORM relay to VG — trail never discarded on intermittent connectivity

Event-driven fabric — NATS JetStream

Each Dedicated VG hosts its own JetStream. Target subject hierarchy:

Collaborative problem-solving protocol

1. Publish — stuck Edge opens problems.\{id\}.open; VG initializes Valkey problem record
2. Parallel execute — Edges pull Valkey state, avoid duplicate attempts, publish .attempt.*
3. Breakthrough — first solver publishes .solved; peers stop; VG validates (Evaluator hook)
4. Close — .closed notifies originator; full WORM chain for the session

CTO / CISO orchestration protocol

1. Broadcast — signed mandate on tasks.\{type\}.broadcast (only authorized issuers)
2. Pull — every Edge validates signature, executes locally, verifies
3. Report — .result subjects + WORM relay
4. Aggregate — VG dashboard: coverage %, failures, completion WORM entry, compliance report

Loop: Broadcast → Pull → Execute → Report. Mandates are system events, not email.

Valkey shared-state schemas (target)

Problem record — problem:\{problem_id\}

status: open | in_progress | pending_validation | closed | abandoned
description, context
attempts: [{ agent_id, approach, result, confidence, timestamp }]
active_workers: [{ agent_id, started_at, current_approach }]
best_solution: { solution, agent_id, confidence } | null
opened_at, closed_at, worm_correlation_id

Task state — task:\{task_id\}

status: broadcast | in_progress | aggregating | complete
edge_nodes_total / completed / failed
results: [{ agent_id, status, timestamp }]
deadline, worm_correlation_id

TTL and retention are configurable via EnterpriseGovernance.

Swarm diversity (NSV / SGDOP) — target

At the VG, NSV/SGDOP measure whether Edge workers covering a problem are exploring diverse approaches or converging prematurely. Blind-spot directives and Diversity Dividends belong to the Ouroboros / DAOS coordination layer — applied at organizational swarm scale, not only single-session MoA. Implementation status: see Ouroboros / DAOS docs; do not treat as universal production default until marked shipped.

Sovereign execution environment

Essay map (proof of competence): PragmaticVectors Hardened Agentic Stack · GTM dossier: Inference GTM — Hardened Security Dossier.

Hardened primitives table

Glossary vs other “layers”

Related

• Marketing GTM (primary): Inference-first GTM · Hardened Security Dossier
• Enterprise / Palantir (secondary): Enterprise GTM
• Product entry: clawql-inference · Getting started
• NATS Helm: NATS JetStream
• Vision: Vision & roadmap