/projects/openclaw-control-plane
OpenClaw Control Plane
A governed, auditable provisioning shell for AI agent runtimes on Railway, separating reusable operating discipline from client-specific automation.
The problem
Deploying and re-deploying an AI agent runtime for each new client normally means manual wizard configuration and untracked drift between instances. Nothing verifies that a live deployment still matches what was intended.
My role
Sole developer and architect — designed and built the provisioning shell, contracts, and deployment discipline end-to-end.
Highlights
- Built an idempotent setup-profile applier that drives a live OpenClaw instance's setup API from a declarative profile, replacing manual wizard configuration for every client onboarding
- Engineered a build-time wrapper patch for scoped state export, cutting a full-instance backup from 541MB to roughly 7MB while preserving exact restore compatibility
- Implemented HMAC-SHA256 GitHub App webhook verification ahead of the proxy's body parser, with a JSON-configured per-repo allowlist gating what can dispatch into an isolated agent turn
- Added live Railway proof checks that verify a deployment's source, runtime settings, and health endpoints against the pinned template, catching infrastructure drift automatically
- Designed a workflow-neutral public core with zero client-specific assumptions baked in, letting private profile repos attach automations after onboarding without touching the shared baseline
Architecture
OpenClaw Control Plane is a TypeScript monorepo that provisions and configures OpenClaw agent runtime instances without becoming the runtime itself. An idempotent setup-profile applier reads a declarative client profile and drives a live instance's own setup API automatically, replacing manual configuration for every onboarding. Build-time wrapper patches add scoped state export/import and verified GitHub App webhook handling ahead of the proxy's body parser, and live Railway 'proof' checks continuously verify a deployment's source, settings, and health against what was intended. The public core stays workflow-neutral, with private agency profile repos attaching client-specific connectors and credentials after onboarding.