Warren's model defaults are stronger than any rule written in AGENTS.md. The Practitioner Gate stops relying on instructions the model can override and moves enforcement into OpenClaw's plugin hook system — where it is deterministic, not persuadable.
What changes in Warren's behavior when this is live. The gate does not add capabilities — it removes a default failure mode.
web_search before synthesis — not after.The model can ignore a rule. It cannot ignore middleware that runs around it. The gate injects mode-specific instructions before the prompt is built and validates claims after the message is produced — two boundaries the model does not control.
The problem is not a missing rule. The problem is the layer enforcement lives in.
Warren's model defaults — produce confident output, be helpful, don't say "I don't know" — are stronger than behavioral rules in AGENTS.md / SOUL.md. Adding more rules made it worse. Gate 1 Q1 asks "does the answer already exist somewhere?" — the current implementation uses a domain whitelist as proxy (code/infra/ops tasks), not a direct answer to that question. A code task can involve something Warren has never seen; a positioning question may already have been decided in a prior meeting. The proxy is conservative: when uncertain, it assumes the answer does not exist and defaults to Practice mode.
Move enforcement from behavioral rules (weakest) to middleware / architectural (strongest), using OpenClaw's plugin hook system. Two layers:
Deterministic regex validators on the message_sending hook detect unverified external claims and confidence-without-investigation.
Reactive — flags after production. Catches failures; does not change behavior.
The before_prompt_build hook classifies inbound tasks and injects mode-specific instructions before the model processes the prompt.
Proactive — forces Investigation mode for non-Library tasks, before a single token is generated.
Each row ties a gate in Tony's PRD to its literal question, the implementation choice, the hook it runs on, and honest status. Proxies are marked as proxies.
| PRD Gate | Tony's Question (literal) | Implementation | Hook | How it works | Status |
|---|---|---|---|---|---|
| Gate 1, Q1 | "Does the answer already exist somewhere?" | Proxy v0.1: domain whitelist (code / infra / ops / memory). ⚠️ This is a proxy — not the real question. Code tasks can involve unknowns. Positioning tasks may already be decided. Conservative: when uncertain, assumes answer does NOT exist. | before_prompt_build |
Matches whitelist → Library Mode. No match → assumes NO → Q2. | 🟡 Tested 28/29, not deployed |
| Gate 1, Q2 | "Is someone currently seeing something about this that hasn't been articulated yet?" | Proxy: sender is Tony / Joana and message contains direction? | before_prompt_build |
YES → Practice Mode. NOT SURE → default Practice. | 🔴 Needs design |
| Gate 1, Q1=NO + Q2=NO | Category 3: Practice-Initiated, Library-Executed | Thread has prior direction from Practitioner. | before_prompt_build |
Injects "Direction already set. Execute. Do not reframe." | 🔴 Needs design |
| Gate 1, fallback | "Not sure" on any question | Conservative default. | before_prompt_build |
Tony PRD: "when uncertain, default to human involvement." → Practice Mode. | 🟢 By design |
| Gate 2 | Model & Effort Selection — Judgment vs Execution | Prompt injection, not model routing. Judgment = "stop, load full context, see target." Execution = "direction set, execute." | before_prompt_build |
Inject reasoning-level instructions based on Gate 1 classification. | 🟡 Designed, not deployed |
| Gate 3 | Review Routing — Tier A / Tier B | Annotation on output. | message_sending |
Append "[Review: Tier A — accuracy]" or "[Review: Tier B — judgment]". | 🔴 Needs design |
| Signal 1 | Warren's Novelty Flag | Cross-reference: Gate 1 classified as non-Library + no web_search / web_fetch in session tool calls → flag. |
message_sending + state |
Requires shared state between before_prompt_build and message_sending via in-memory Map keyed by ctx.runId. |
🟡 SDK confirmed, not built. Caveat: ctx.runId on message_sending hooks is documented as available "when available" — may be absent in edge cases (system-originated runs, durable delivery). Fallback: key by ctx.sessionKey + timestamp. |
| Signal 2 | Reviewer Pattern Mismatch | UI — human clicks "Pattern Mismatch". | N/A | Dashboard / review UI feature. | 🔴 Out of scope |
| Signal 3 | "Something's Off" button | UI — human input. | N/A | Dashboard / review UI feature. | 🔴 Out of scope |
| Signal 4 | Falsification Valve | Before flagging comfort class, check inverse. | message_sending |
Extension of comfort-class validator. | 🔴 Needs design |
Two new validators added to the quality-gate plugin. Both enabled by default in annotate mode.
quality-gate plugin.
Detects claims about vendors with negative / comparative language that lack a verifiable URL or a web_search within ±5 lines.
Detects absolute certainty phrases without verifiable evidence within ±10 lines.
Both validators are enabled by default in annotate mode — they flag and annotate rather than block, so nothing is silently dropped while the gate is proven on real traffic.
The validators were run against two real artifacts on the same topic. One was written by Warren under old defaults; one by a human working carefully.
Source artifact: /home/spark1/.openclaw/media/soc-for-ai-prd-v1.md — 40KB, 723 lines, saved to disk. Validators run against the real artifact.
no vendor can credibly sell independence from itself— categorical claim, no verification.
Palo Alto Networks cannot do— claim about competitor capability, no web search.
is not 'Kindo does what Prisma AIRS does'— positioning against AIRS without verifying capabilities.
This is exactly the category Gartner defined— "exactly" without link to document.
That frame is wrong— declares frame wrong without investigating the alternative.
fundamentally different architectural position— structural claim about competitor without verification.
Same topic, same capabilities analyzed. Zero flags from either validator. Why:
15 regex patterns tested against 29 real inbound messages from Aug 13–14. The critical metric is not raw accuracy — it is the direction of the errors.
0 False Positives — Library assigned when it should be Practice. CRITICAL: zero dangerous misclassifications.
1 False Negative — Practice assigned when it should be Library. SAFE: over-cautious. Warren investigates unnecessarily; it does not fabricate.
The one miss: Are you working on Tony's request?
classified as Practice (should be Library) — safe direction.