Configuration

{
  "schema_version": 2,
  "captured_at": "2026-04-17T18:21:09Z",
  "mode": "repair",
  "outcome": "failed",
  "exit_code": 1,
  "passed": 12,
  "failed": 0,
  "warned": 1,
  "skipped": 2,
  "summary": {"passed": 12, "failed": 0, "warned": 1, "skipped": 2},
  "checks": [
    {"status": "warn", "label": "Splunk HEC", "detail": "queue depth 4200/5000"}
  ],
  "repair_summary": {
    "planned": 0,
    "applied": 1,
    "failed": 0,
    "blocked": 1,
    "manual": 0,
    "noop": 0,
    "declined": 0,
    "requires_confirmation": 0
  },
  "repairs": [
    {"repair_id": "doctor.gateway.service.reconcile", "state": "blocked"}
  ]
}

config_version: 8             # strict current schema; upgrade migrates supported v7 files

claw:
  mode: claudecode             # single-connector mode; setup aliases select this with --connector.
                               # Set to `multi` automatically when more than one
                               # connector is active (see guardrail.connectors below).
                               # This value is mirrored to the OTel resource attr
                               # `defenseclaw.claw.mode`.

gateway:
  host: 127.0.0.1              # upstream agent gateway host (OpenClaw/ZeptoClaw fleet link)
  port: 18789                  # upstream agent gateway port
  api_port: 18970              # gateway REST API port (hooks + TUI dial this)
  api_bind: ""                 # REST API bind override; normally 127.0.0.1 when empty
  config_reload:
    mode: hot                  # hot | restart; omitted means hot

# One observability graph owns collection, local history, routing, redaction,
# sampling, metrics policy, and every optional destination. Defaults collect
# all logs/traces/metrics, persist collected logs to SQLite, and export every
# capability of an enabled destination unredacted when send/routes are omitted.
# Galileo's omitted preset policy is additionally restricted to the generated
# available galileo-rich-v2 trace-family membership.
observability:
  resource:
    attributes:
      service.name: defenseclaw-gateway
      deployment.environment.name: production
  trace_policy:
    sampler: parentbased_always_on
    semantic_profile: defenseclaw-genai-rich-v1
  metric_policy:
    export_interval_seconds: 60
    temporality: delta
  local:
    path: ~/.defenseclaw/audit.db
    judge_bodies_path: ~/.defenseclaw/judge_bodies.db
    retention_days: 90
  # Omit defaults/buckets for full-fidelity collection. List only deliberate
  # overrides; a route cannot resurrect a signal disabled at collection.
  buckets:
    diagnostic:
      collect: {logs: false, traces: false, metrics: false}
    model.io:
      redaction_profile: content
  redaction_profiles:
    soc:
      extends: sensitive
      detectors: [pii, credentials, secrets]
      field_classes:
        content: detect
        evidence: detect
        path: hash
        credential: remove
  destinations:
    - name: local-observability
      kind: otlp
      protocol: grpc
      endpoint: 127.0.0.1:4317
      network_safety: {allow_private_networks: true}
      # Omitted send/routes means every bucket and all OTLP capabilities:
      # logs, traces, and metrics. Profile resolves per bucket; model.io uses
      # content above and every other omitted bucket inherits none.
    - name: galileo
      kind: otlp
      preset: galileo
      protocol: http/protobuf
      endpoint: https://api.galileo.ai/otel/traces
      batch: { scheduled_delay_ms: 1000 }
      headers:
        Galileo-API-Key: {env: GALILEO_API_KEY}
        project: defenseclaw
        logstream: production
      # Keep send/routes omitted for the compiler-owned traces-only route whose
      # event_names equal the generated available Galileo family membership.
      # Explicit send/routes replace that filter and express operator intent.
    # More optional destinations join the same graph. Splunk HEC is logs-only.
    - name: org-splunk
      kind: splunk_hec
      endpoint: https://splunk.example.com/services/collector/event
      token_env: SPLUNK_ACCESS_TOKEN
      index: defenseclaw
      send:
        signals: [logs]
        buckets: [compliance.activity, security.finding, enforcement.action]
        redaction_profile: soc

# Top-level LLM block. Written by `defenseclaw setup llm` (and copied
# into per-component blocks via the `--inherit-from` machinery). The
# `role` field decides who consumes this block at resolve time:
#   - `unified` (default): every component that does not declare its
#     own `llm:` reads from here.
#   - `agent`: guardrail.judge.llm stays empty and inherits through
#     the unified merge — proxy connectors only.
#   - `judge`: writes guardrail.judge.llm directly, leaves the top
#     level alone — useful for hook-based connectors that already
#     route the agent's traffic elsewhere.
# See `defenseclaw setup guardrail --llm-role judge_only|judge_and_agent`
# for the connector-aware variant.
llm:
  provider: anthropic          # anthropic | openai | bedrock | vertex_ai | azure | custom
  model: claude-sonnet-4-5
  api_key_env: DEFENSECLAW_LLM_KEY
  base_url: ""                 # optional override; LiteLLM picks a default per provider
  role: unified                # unified | agent | judge
  instance_name: ""            # binds to a ~/.defenseclaw/custom-providers.json entry; required with provider: custom
  region: ""                   # generic regional hint (Bedrock / Vertex); provider-specific sub-blocks below take precedence
  # forward_custom_headers controls whether the guardrail gateway
  # forwards inbound HTTP headers from the agent to the upstream LLM
  # provider on both /v1/chat/completions and the passthrough path
  # (/v1/responses, /v1/messages, Bedrock/Gemini native, ...). Default
  # is on; set to false to suppress all inbound header copying so the
  # upstream only sees the canonical Authorization the gateway re-mints
  # from the secrets sidecar. A small blocklist (proxy-hop, auth, host,
  # X-DC-*, X-DefenseClaw-*, W3C trace context) plus RFC 7230 /
  # printable-ASCII validation and 64-header / 32 KiB caps apply
  # regardless.
  forward_custom_headers: true

  # Provider-specific sub-blocks. Only the one matching `provider`
  # is consulted; the others may exist as leftover state from a
  # previous setup and are ignored at resolve time.
  bedrock:
    region: us-east-1
    auth_mode: iam_credentials # api_key | iam_credentials | profile | instance_role
    access_key_env: AWS_ACCESS_KEY_ID
    secret_key_env: AWS_SECRET_ACCESS_KEY
    session_token_env: AWS_SESSION_TOKEN
    profile_name: ""
    inference_profile: us.     # optional model-id prefix
    deployment_aliases: {}     # alias -> model-id, populated by --bedrock-deployment

  vertex:
    project_id: acme-prod-vertex
    region: us-central1
    auth_mode: service_account # service_account | adc | workload_identity
    service_account_json_env: GOOGLE_APPLICATION_CREDENTIALS

  azure:
    endpoint: https://my-resource.openai.azure.com
    api_version: 2024-10-21
    auth_mode: api_key         # api_key | managed_identity
    deployment_aliases: {}     # model -> deployment, populated by --azure-deployment-alias

  # Inline TLS posture for self-signed or internal endpoints. Both
  # `ca_cert_pem` and `insecure_skip_verify` exist so the gateway
  # never has to read another file at request time; `doctor` warns
  # when both are set on the same block.
  tls:
    ca_cert_pem: ""            # PEM bundle inlined from --tls-ca-cert-file
    insecure_skip_verify: false

guardrail:
  enabled: true
  connector: claudecode        # actively enforced connector
  mode: action                 # observe | action
  scanner_mode: local          # local | remote | both
  rule_pack_dir: ~/.defenseclaw/policies/guardrail/default  # path; --rule-pack picks the bundled profile dir
  port: 4000                   # guardrail proxy port
  block_message: ""            # custom; empty -> default
  detection_strategy: regex_only  # regex_only | regex_judge | judge_first

  cisco:
    endpoint: ""
    api_key_env: CISCO_AI_DEFENSE_API_KEY
    timeout_ms: 5000

  # When `judge.llm` is omitted, the judge inherits from the top-level
  # `llm:` block. Populate it explicitly to point the judge at a
  # different backend (e.g. an internal Bedrock instance) without
  # changing what the agent talks to.
  judge:
    enabled: false
    model: anthropic/claude-sonnet-4-20250514
    api_base: ""
    api_key_env: DEFENSECLAW_LLM_KEY
    llm: {}                    # same shape as top-level `llm:` above

  hilt:
    enabled: false
    min_severity: HIGH         # stored uppercase; CLI accepts high|medium|low|critical

  # Multi-connector overlay. One gateway can enforce guardrail policy for
  # several hook connectors at once; each key under `connectors` is a
  # connector name (codex, claudecode, antigravity, ...) carrying a
  # subset of the guardrail knobs above. Every field is OPTIONAL and
  # inherits the global `guardrail.*` value when unset. The singular
  # `guardrail.connector` above keeps working for single-connector
  # installs; this map is purely additive. Proxy connectors (openclaw,
  # zeptoclaw) cannot appear here — multi-connector is hook-only.
  # Managed by `defenseclaw setup <connector>` (choosing "Add") and the
  # `defenseclaw guardrail ... --connector X` command group.
  connectors:
    codex:
      enabled: true            # pointer field: omit = inherit (enabled); false = explicitly off
      mode: action             # observe | action; inherits guardrail.mode when unset
      hook_fail_mode: closed   # open | closed; inherits guardrail.hook_fail_mode
      block_message: ""        # custom; inherits guardrail.block_message
      rule_pack_dir: ~/.defenseclaw/policies/guardrail/strict  # inherits guardrail.rule_pack_dir
      hilt:
        enabled: true
        min_severity: HIGH
    claudecode:
      mode: observe            # only logs; everything else inherits the global default

# Notifier webhooks remain separate from telemetry routing.
webhooks:
  - name: oncall-slack
    type: slack
    enabled: true
    url: https://hooks.slack.com/services/T000/B000/XXX
    secret_env: ""             # optional HMAC for `type: generic`
    min_severity: HIGH

{
  "providers": [
    {
      "name": "acme-internal-bedrock",
      "base_provider_type": "bedrock",
      "base_url": "https://llm.internal:8443",
      "domains": ["llm.internal"],
      "env_key": "ACME_BEDROCK_KEY",
      "allowed_request_types": ["chat", "embedding"],
      "available_models": ["us.anthropic.claude-sonnet-4-6"],
      "request_path_overrides": {
        "chat": "/openai/v1/chat/completions"
      },

      "tls": {
        "ca_cert_pem": "-----BEGIN CERTIFICATE-----\n...",
        "insecure_skip_verify": false
      },

      "bedrock": {
        "region": "us-east-1",
        "auth_mode": "iam_credentials",
        "access_key_env": "AWS_ACCESS_KEY_ID",
        "secret_key_env": "AWS_SECRET_ACCESS_KEY",
        "session_token_env": "AWS_SESSION_TOKEN",
        "profile_name": "",
        "inference_profile": "us.",
        "deployment_aliases": {
          "fast": "anthropic.claude-3-haiku-20240307-v1:0"
        }
      },

      "vertex": {
        "project_id": "acme-prod-vertex",
        "region": "us-central1",
        "auth_mode": "service_account",
        "service_account_json_env": "GOOGLE_APPLICATION_CREDENTIALS"
      },

      "azure": {
        "endpoint": "https://my-resource.openai.azure.com",
        "api_version": "2024-10-21",
        "auth_mode": "api_key",
        "deployment_aliases": {
          "gpt-4o": "prod-gpt4o-eus"
        }
      }
    }
  ]
}

defenseclaw-gateway policy reload