Overview

Proof of Claw is a framework for running autonomous AI agents whose behavior is cryptographically provable, whose communication is end-to-end encrypted, and whose high-value actions require human approval via hardware signing.

An agent built with Proof of Claw can:

The core agent runtime is adapted from IronClaw, a Rust-based OpenClaw reimplementation with WASM-sandboxed tool execution, capability-based permissions, and defense-in-depth security.

Tech Stack: Rust · Tokio · Wasmtime · 0G Compute · 0G Storage · ENS · DM3 · RISC Zero · Boundless · Ledger DMK/DSK · Solidity (Foundry)

Quick Start

Prerequisites

1. Build the Agent Runtime

terminal
# Build the Rust agent runtime
cd agent
cargo build --release

2. Build RISC Zero Programs

terminal
# Compile zkVM guest and host programs
cd zkvm
cargo build --release

3. Deploy Smart Contracts

terminal
cd contracts
forge build
forge script script/Deploy.s.sol --rpc-url $RPC_URL --broadcast

4. Run the Agent

terminal
cd agent
cargo run

Architecture

A layered design separating agent reasoning, integration services, and on-chain verification. Each layer assumes the layer below it may be compromised.

Agent Core — IronClaw Runtime

The core agent is written in Rust and consists of three primary subsystems:

ComponentPathResponsibility
Agent Loopagent/src/core/agent.rsMain event loop, message handling, intent routing, job coordination
Intent Routeragent/src/core/intent_router.rsClassifies incoming messages into actionable intents
Job Scheduleragent/src/core/job_scheduler.rsManages asynchronous task execution
Tool Registryagent/src/tools/registry.rsAvailable tools and their metadata
WASM Sandboxagent/src/tools/sandbox.rsIsolated execution environment for untrusted tools
Capabilitiesagent/src/tools/capabilities.rsPermission and rate limit enforcement
Policy Engineagent/src/safety/policy_engine.rsEnforces declared agent policy rules
Content Sanitizeragent/src/safety/sanitizer.rsRemoves malicious content from inputs/outputs
Injection Detectoragent/src/safety/injection_detector.rsDetects prompt injection attempts

Two-Tier Trust Model

TierConditionSigningVerification
Autonomous Action value < threshold Agent server wallet RISC Zero proof on-chain
Ledger-Gated Value ≥ threshold or escalation Owner's Ledger device RISC Zero + Ledger approval

Data Flow

Autonomous Action Flow

1
Agent receives message (user or DM3)
2
Intent router classifies action
3
0G Compute performs private inference
4
Safety layer validates against declared policy
5
Tool execution in WASM sandbox
6
Execution trace stored on 0G Storage
7
RISC Zero proof generated via Boundless
8
Agent wallet submits proof + action to verifier contract
9
Contract verifies proof and executes action

Ledger-Gated Action Flow

1–7
Same as autonomous flow
8
RISC Zero proof indicates approval required
9
Contract emits ApprovalRequired event
10
Web UI alerts owner
11
Owner reviews on Ledger device (Clear Signing)
12
Owner physically approves
13
Ledger signs approveAction() transaction
14
Contract executes action

0G Network

0G Compute 0G Storage

Every LLM call runs through 0G's Sealed Inference — prompts enter encrypted, operators cannot inspect them. Execution traces are stored on 0G Storage with content-addressable root hashes that anchor the provable chain.

integrations/0g_compute.ts — Sealed Inference
import { createZGServingNetworkBroker } from '@0glabs/0g-serving-broker';

// Initialize broker with agent's wallet
const broker = await createZGServingNetworkBroker(wallet);
const services = await broker.inference.listService();
const provider = services.find(s => s.verifiability === 'TeeML');

// OpenAI-compatible call through 0G Compute
const headers = await broker.inference.getRequestHeaders(provider.provider, prompt);
const response = await fetch(`${endpoint}/chat/completions`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', ...headers },
  body: JSON.stringify({ messages, model }),
});

// Verify attestation
const verified = await broker.inference.verifyResponse(response);

ENS + DM3

🌐
ENS DM3

Agents register as ENS subnames (e.g. alice-agent.proofofclaw.eth) with text records storing DM3 profiles, policy hashes, and RISC Zero image IDs. Inter-agent communication is end-to-end encrypted via the DM3 protocol.

integrations/dm3_messaging.ts — E2E Encrypted Agent Chat
import { createEnvelop } from '@dm3-org/dm3-lib';

// Publish DM3 profile to ENS text record
await ensContract.setText(
  namehash('alice-agent.proofofclaw.eth'),
  'eth.dm3.profile',
  toDataURI(deliveryServiceProfile)
);

// Send encrypted message to another agent
async function sendAgentMessage(recipientEns, message) {
  const recipientProfile = await resolveDm3Profile(recipientEns);
  const { encryptedEnvelope } = await createEnvelop(
    JSON.stringify(message),
    keys.signingKey,
    recipientProfile.publicEncryptionKey,
    recipientProfile.deliveryServiceUrl
  );
  await fetch(recipientProfile.deliveryServiceUrl, {
    method: 'POST',
    body: JSON.stringify(createJsonRpcCallSubmitMessage(encryptedEnvelope)),
  });
}

RISC Zero + Boundless

RISC Zero Boundless

The execution trace — 0G attestation, tool invocations, safety checks — is fed into a RISC Zero zkVM guest program. Proof generation is outsourced to the Boundless decentralized prover network. The receipt lands on-chain for anyone to verify.

guest/src/main.rs — RISC Zero zkVM Guest
// Runs inside RISC Zero zkVM — produces cryptographic receipt
fn main() {
    let trace: ExecutionTrace = risc0_zkvm::guest::env::read();
    let policy: AgentPolicy = risc0_zkvm::guest::env::read();

    // Verify every tool invocation against declared policy
    let mut all_passed = true;
    for invocation in &trace.tool_invocations {
        if !policy.allowed_tools.contains(&invocation.tool_name) {
            all_passed = false;
        }
    }

    // Check if Ledger approval is required
    let requires_approval = trace.action_value() > policy.max_value_autonomous;

    // Public output — anyone can verify on-chain
    risc0_zkvm::guest::env::commit(&VerifiedOutput {
        agent_id: trace.agent_id,
        all_checks_passed: all_passed,
        requires_ledger_approval: requires_approval,
        output_commitment: trace.output_commitment,
    });
}

Ledger DMK — Hardware Approval

🔒
Ledger DMK Clear Signing

High-value actions route to the owner's Ledger device via DMK/DSK. ERC-7730 Clear Signing metadata renders human-readable transaction details directly on the device — not raw hex.

integrations/ledger_approval.ts — Clear Signing
import { DeviceManagementKitBuilder } from '@ledgerhq/device-management-kit';
import { SignerEthBuilder } from '@ledgerhq/device-signer-kit-ethereum';

// Initialize Ledger DMK + Ethereum signer
const dmk = new DeviceManagementKitBuilder()
  .addTransport(webHidTransportFactory).build();
const sessionId = await dmk.connect({ deviceId });
const signerEth = new SignerEthBuilder({ dmk, sessionId }).build();

// When agent action exceeds autonomous threshold:
async function requestLedgerApproval(action, proofReceipt) {
  const signature = await signerEth.signTransaction({
    to: VERIFIER_ADDRESS,
    data: encodeApproveAction(action.agentId, action.outputCommitment),
  });
  return signature;
}

Smart Contracts

Deployed on 0G Galileo Testnet (Chain ID: 16602) — All contracts verified on chainscan-galileo.0g.ai
ContractAddressRole
SoulVaultSwarm0xa70EB0DF1563708F28285C2DeA2BF31aadFB544DEpoch-based swarm coordination
ERC8004RegistryAdapter0x9De4F1b14660B5f8145a78Cfc0312B1BFb812C46Self-sovereign agent identity
RiscZeroGroth16Verifier0x93e985aCA4112771c0B05114Ad99677DB85a6A9eGroth16 proof verifier
ProofOfClawVerifier0xa2Df3F3998FdF9Fb7E11e43d10d6B3C62264e3A4RISC Zero proof verification + routing
ProofOfClawINFT0xDe61e80Cdc7ba0000d9eB9040e59f98A3C9991a3ERC-7857 agent identity NFT

ProofOfClawVerifier

The on-chain verifier contract handles:

SoulVaultSwarm

Epoch-based coordination for AI agent swarms:

SoulVaultERC8004RegistryAdapter

Self-sovereign agent identity registry:

Clear Signing (ERC-7730)

ERC-7730 metadata stored at contracts/clear-signing/proofofclaw.json enables the Ledger device to render human-readable action descriptions instead of raw calldata. The owner sees exactly what the agent wants to do before physically approving.

Security & Threat Model

Every layer assumes the layer below it is compromised.

ThreatMitigation
Agent acts outside policyRISC Zero proof fails; action blocked on-chain. No proof = no action.
Inference tampering0G Compute attestation signs every response. Tampered data produces an invalid proof.
Message interceptionDM3 end-to-end encryption with keys from ENS profiles. Delivery service never sees plaintext.
Identity spoofingENS ownership tied to Ledger EOA.
High-value action without consentPhysical Ledger approval required. Owner sees human-readable Clear Signing display.
Prompt injectionSafety layer runs in proven execution trace. Injection detector + content sanitizer.

Safety Layer

The safety subsystem provides defense-in-depth:

Agent API Spec

Any agent that implements these endpoints can connect to Proof of Claw. Build your agent in Python, Node, Go, Rust, or any language.

Required Endpoints

Your agent must implement these two endpoints to be connectable.

GET /health
// Health check — return 200 OK
// No body required. Used for liveness checks.

curl http://localhost:8420/health
// Response: 200 OK
GET /api/status
// Returns agent identity, configuration, and statistics

// Response shape:
{
  "agent_id": "my-agent",
  "ens_name": "my-agent.proofofclaw.eth",
  "status": "online",
  "network": "sepolia",
  "allowed_tools": ["swap_tokens", "transfer", "query"],
  "endpoint_allowlist": ["https://api.uniswap.org"],
  "max_value_autonomous_wei": "1000000000000000000",
  "uptime_secs": 3600,
  "stats": {
    "total_actions": 42,
    "proofs_generated": 15
  }
}

Chat Endpoint

Required for the chat interface. This is where the agent processes user messages.

POST /api/chat
// Request:
{ "message": "swap 100 USDC for ETH" }

// Response:
{
  "response": "Executing swap: 100 USDC for ETH. Policy verified.",
  "intent": {
    "action_type": "swap",       // "swap" | "transfer" | "query" | "unknown"
    "confidence": 0.95
  },
  "policy_result": {
    "allowed": true,
    "approval_type": "autonomous", // "autonomous" | "ledger_gated"
    "checks": [
      { "rule_id": "tool_allowlist", "severity": "Pass", "details": "swap_tokens allowed" },
      { "rule_id": "value_threshold", "severity": "Pass", "details": "within limit" }
    ]
  },
  "proof": {
    "proof_id": "0xabcd...",
    "status": "verified",
    "output_commitment": "0x1234..."
  }
}

Optional Endpoints

These enable full dashboard, proofs, and messaging integration.

GET /api/activity
// Returns activity feed
[
  {
    "id": "act-001",
    "timestamp": 1712234567,
    "type": "proof_generated",     // "proof_generated" | "message_received" | "policy_violation"
    "title": "Swap executed autonomously",
    "description": "Swapped 100 USDC for ETH",
    "severity": "info"             // "info" | "warning" | "error"
  }
]
GET /api/proofs
// Returns proof history
[
  {
    "proof_id": "0xabcd...",
    "timestamp": 1712234567,
    "agent_id": "my-agent",
    "action": "swap_tokens",
    "status": "verified",
    "output_commitment": "0x1234...",
    "policy_checks": {
      "tool_allowlist": "Pass",
      "endpoint_restriction": "Pass",
      "value_threshold": "Pass"
    }
  }
]
GET /api/messages & POST /api/messages/send
// GET /api/messages — Returns message records
[
  {
    "id": "msg-001",
    "from": "my-agent",
    "to": "other-agent.proofofclaw.eth",
    "content": "Hello, want to collaborate?",
    "timestamp": 1712234567,
    "direction": "outbound"
  }
]

// POST /api/messages/send
// Request: { "to": "bob.proofofclaw.eth", "content": "Hello!" }
// Response: { "success": true, "message_id": "msg-002", "timestamp": 1712234567 }
GET /api/traces/stream (SSE)
// Server-Sent Events endpoint — powers the ZK Kanban board.
// Each /api/chat call emits tool_invocation events followed by a proof_receipt.

event: trace
data: { "event": "connected", "agent_id": "my-agent", "session_id": "..." }

event: trace
data: { "event": "tool_invocation", "tool_name": "grep_search",
        "input_hash": "0xabc...", "output_hash": "0xdef...",
        "within_policy": true, "timestamp": 1712234567 }

event: trace
data: { "event": "proof_receipt", "proof_id": "0x...",
        "journal_b64": "...", "seal_b64": "...", "image_id": "0x..." }

CORS Requirements

Since the Proof of Claw frontend is a static site, your agent must return CORS headers:

Required Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

Minimal Agent Examples

Python (Flask)
from flask import Flask, jsonify, request
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route('/health')
def health():
    return 'ok'

@app.route('/api/status')
def status():
    return jsonify({
        'agent_id': 'my-python-agent',
        'ens_name': 'my-agent.proofofclaw.eth',
        'status': 'online',
        'network': 'sepolia',
        'allowed_tools': ['query'],
        'endpoint_allowlist': [],
        'max_value_autonomous_wei': '0',
        'uptime_secs': 0,
        'stats': {'total_actions': 0, 'proofs_generated': 0}
    })

@app.route('/api/chat', methods=['POST'])
def chat():
    msg = request.json.get('message', '')
    return jsonify({
        'response': f'You said: {msg}',
        'intent': {'action_type': 'query', 'confidence': 0.8},
        'policy_result': {'allowed': True, 'approval_type': 'autonomous', 'checks': []},
        'proof': {'proof_id': '0x0', 'status': 'pending', 'output_commitment': '0x0'}
    })

app.run(port=8420)
Node.js (Express)
const express = require('express');
const cors = require('cors');
const app = express();
app.use(cors());
app.use(express.json());

app.get('/health', (req, res) => res.send('ok'));

app.get('/api/status', (req, res) => res.json({
  agent_id: 'my-node-agent',
  ens_name: 'my-agent.proofofclaw.eth',
  status: 'online',
  network: 'sepolia',
  allowed_tools: ['query'],
  endpoint_allowlist: [],
  max_value_autonomous_wei: '0',
  uptime_secs: 0,
  stats: { total_actions: 0, proofs_generated: 0 }
}));

app.post('/api/chat', (req, res) => res.json({
  response: `You said: ${req.body.message}`,
  intent: { action_type: 'query', confidence: 0.8 },
  policy_result: { allowed: true, approval_type: 'autonomous', checks: [] },
  proof: { proof_id: '0x0', status: 'pending', output_commitment: '0x0' }
}));

app.listen(8420);
Minimum Viable Agent: Implement /health, /api/status, and /api/chat to connect and chat. All other endpoints are optional and enable additional features (dashboard activity, proofs explorer, messaging).

Configuration

Create a .env file in the agent directory:

.env
AGENT_ID=alice-agent
ENS_NAME=alice.proofofclaw.eth
PRIVATE_KEY=0x...
SIGNER_MODE=private-key
RPC_URL=https://eth-sepolia.g.alchemy.com/v2/...
CHAIN_ID=11155111
ZERO_G_INDEXER_RPC=https://indexer-storage-testnet.0g.ai
ZERO_G_COMPUTE_ENDPOINT=https://broker-testnet.0g.ai
ZERO_G_CHAIN_RPC=https://evmrpc-testnet.0g.ai
ZERO_G_CHAIN_ID=16602
DM3_DELIVERY_SERVICE_URL=http://localhost:3001
ALLOWED_TOOLS=swap_tokens,transfer,query
ENDPOINT_ALLOWLIST=https://api.uniswap.org,https://api.0x.org
MAX_VALUE_AUTONOMOUS_WEI=1000000000000000000
API_PORT=8420
VariableDescription
AGENT_IDUnique agent identifier
ENS_NAMEAgent's ENS subname for identity and DM3 messaging
PRIVATE_KEYAgent server wallet private key (never commit this)
SIGNER_MODEprivate-key or mnemonic
RPC_URLEthereum RPC endpoint (Alchemy, Infura, etc.)
CHAIN_IDTarget chain ID (default: 11155111 for Sepolia)
ZERO_G_INDEXER_RPC0G Storage indexer endpoint
ZERO_G_COMPUTE_ENDPOINT0G Compute broker endpoint
ZERO_G_CHAIN_RPC0G Chain RPC (default: https://evmrpc-testnet.0g.ai)
ZERO_G_CHAIN_ID0G Chain ID (default: 16602)
DM3_DELIVERY_SERVICE_URLDM3 delivery service for encrypted messaging
ALLOWED_TOOLSComma-separated list of permitted tools
ENDPOINT_ALLOWLISTComma-separated external API URLs the agent may call
MAX_VALUE_AUTONOMOUS_WEIThreshold above which Ledger approval is required (in wei)
API_PORTAgent REST API port (default: 8420)
ETHERSCAN_API_KEYEtherscan API key for contract verification
INFT_CONTRACTERC-7857 iNFT contract address (set after deployment)
SOULVAULT_SWARM_CONTRACTSoulVault swarm coordination contract
ERC8004_REGISTRY_ADDRESSERC-8004 agent registry adapter contract
RISC_ZERO_VERIFIER_ADDRESSOn-chain RISC Zero proof verifier
RISC_ZERO_IMAGE_IDGuest program image ID (from circuit compilation)
LEDGER_ORIGIN_TOKENLedger DMK origin token (optional — for hardware-signed approvals)
EIP8004_IDENTITY_REGISTRYEIP-8004 identity registry contract
EIP8004_INTEGRATION_CONTRACTEIP-8004 integration bridge contract
SEPOLIA_RPC_URLSepolia RPC endpoint (for ENS and identity)
ENS_REGISTRYENS registry address (Sepolia: 0x00...2e1e)
SWARM_HUB_URLSwarm Protocol hub URL (optional — for swarm bridge)
BRIDGE_PORTSwarm bridge WebSocket port (default: 3002)
GOOGLE_CLIENT_IDGoogle OAuth client ID (optional — for calendar integration)
ONECLAW_API_KEY1clawAI server API key (optional — for credential storage)

Repository Structure

project layout
proof-of-claw/
├── agent/                      # Rust agent runtime (IronClaw workspace)
│   ├── crates/                 # Core crates (engine, safety, skills, common)
│   └── src/
│       ├── agent/              # Agent loop, dispatcher, sessions
│       ├── channels/           # Multi-channel input (HTTP, CLI, WebSocket, WASM)
│       ├── tools/              # WASM sandbox, tool registry, MCP
│       ├── safety/             # Policy engine, injection detector
│       └── integrations/       # 0G, ENS, DM3, Ledger, EIP-8004, iNFT
├── zkvm/                       # RISC Zero zkVM programs
│   ├── guest/                  # Guest program (policy verification)
│   └── host/                   # Host program (proof generation)
├── contracts/                  # Solidity smart contracts (Foundry)
│   ├── src/
│   │   ├── ProofOfClawVerifier.sol     # ZK proof verification + routing
│   │   ├── ProofOfClawINFT.sol         # ERC-7857 agent identity NFT
│   │   ├── SoulVaultSwarm.sol          # Epoch-based swarm coordination
│   │   ├── EIP8004Integration.sol      # EIP-8004 registry bridge
│   │   └── SoulVaultERC8004RegistryAdapter.sol
│   ├── clear-signing/
│   │   └── proofofclaw.json    # ERC-7730 Ledger Clear Signing
│   └── script/
│       ├── Deploy.s.sol        # Sepolia deployment
│       ├── Deploy0G.s.sol      # 0G Chain deployment
│       └── DeploySwarm.s.sol   # Swarm + identity deployment
├── frontend/                   # Web UI (vanilla HTML/CSS/JS)
│   ├── index.html              # Landing page
│   ├── agents.html             # Agent registry, wizard, chat
│   ├── dashboard.html          # Monitoring dashboard
│   ├── messages.html           # DM3 message threads
│   ├── proofs.html             # ZK proof explorer
│   ├── soul-vault.html         # Agent deployment interface
│   └── docs.html               # Documentation (this page)
├── cli/                        # TypeScript CLI tool (poc)
├── delivery-service/           # DM3 message delivery (port 3001)
├── swarm-bridge/               # Bridge to swarmprotocol.fun (port 3002)
├── 1claw-server/               # 1clawAI credential storage (port 3456)
├── spec.md                     # Full technical specification
├── ARCHITECTURE.md             # System architecture
└── .env.example                # Configuration reference

Target Bounties

0G
Best OpenClaw Agent on 0G
$6,000
0G Compute (inference), 0G Storage (memory + traces)
ENS
Best ENS Integration for AI Agents
$5,000
ENS subnames for agent identity, DM3 for encrypted messaging
Ledger
AI Agents x Ledger
$6,000
Ledger DMK/DSK for human approval, Clear Signing (ERC-7730)

Testnet Notice — Proof of Claw is under active development. Contracts are deployed to 0G Galileo Testnet (chain 16602) and Sepolia, verified but unaudited. Do not use with real funds.

What's Working

Working Rust Agent Runtime Compiles cleanly, 35/35 tests pass. Full agent loop, intent router, REST API on port 8420.
Working Policy Engine Tool allowlist enforcement, value threshold checks, severity levels (Block/Warn/Sanitize/Pass).
Basic Injection Detector 12 regex patterns with case-insensitive matching. Catches obvious attacks; not robust against paraphrasing, encoding, or multi-turn evasion.
Working WASM Sandbox Wasmtime-based isolated execution for untrusted tools with capability validation.
Working Tool Registry Content-addressable registration with SHA256 capability hashes. Built-in tools: swap, transfer, query.
Working 0G Compute HTTP inference with attestation extraction, graceful fallback to content hash.
Working 0G Storage Real 0G SDK integration — trace upload/retrieval with content-addressable root hashes, graceful degradation when offline.
Working ENS + DM3 Full namehash, on-chain resolution, DM3 profile lookup with 3-tier fallback, encrypted messaging.
Working EIP-8004 Identity registration, reputation queries, validation history, trust threshold checks with bootstrap phase.
Working iNFT (ERC-7857) Agent minting with soul backup — AES-GCM encrypted SOUL.md on 0G Storage, hash anchored on-chain.
Working Proof Generator Real RISC Zero proof generation via local prover or Boundless marketplace. Requires guest ELF to be built.
Compiles Smart Contracts ProofOfClawVerifier, EIP8004Integration, ProofOfClawINFT — compile with Foundry. No test suite yet. Unaudited.
Working RISC Zero Guest Real zkVM guest program with full policy verification logic.
Working Frontend UI All 7 pages functional. Live API mode with real 0G Storage upload and AES-GCM encryption. Contract addresses populated from 0G testnet deployment.
Working ENS Resolver (JS) Real on-chain resolution via RPC, multi-network support (Sepolia, Mainnet, 0G).
Working Server Key Security Startup requires real PRIVATE_KEY — no hardcoded demo private key fallback.

What's Incomplete

Working Ledger Approval Gate Real APDU communication via coins-ledger crate. EIP-712 typed data signing. Requires physical Ledger device with Ethereum app.
Working RISC Zero Host Real RISC Zero host program that generates proof receipts from execution traces.
Missing Contract Tests Basic Foundry test file exists. 5 contracts deployed + verified on 0G Galileo Testnet.
Partial ERC-7730 Metadata Contract addresses populated from 0G testnet deployment. Missing some method display formats.
Partial ProofOfClawINFT balanceOf() is O(n) without owner mapping. Missing safeTransferFrom receiver validation.
In-memory Job Scheduler Basic HashMap-based tracking with no persistence. State lost on restart.
Missing E2E Integration Test End-to-end test pipeline: agent → 0G Storage → RISC Zero proof → on-chain verification.
Missing Multi-Chain Deployment Deployment scripts and ERC-7730 metadata for chains beyond 0G Galileo.
Polling Agent Dashboard Updates Currently uses HTTP polling. Real-time WebSocket push not yet implemented.
Missing DM3 Delivery Node DM3 delivery service node setup for production message relay.
Missing IronClaw Integration Tests Full integration mode testing for the IronClaw runtime.