Tools & Action Invariants
In an autonomous agent system, language models do not merely generate text—they interact with external systems, query live databases, and execute real-world business actions.
The 3-Tier Tool Architecture
While the documentation file TOOLS.md has been retired, Tools (Function Calling) remain the essential core of DOSClaw. An agent's available tools stem from three distinct layers:
┌──────────────────────────────────────────────────────────────────────────────────────────┐
│ Autonomous AI Agent │
└────────────────────────────────────────────┬─────────────────────────────────────────────┘
│
┌──────────────────────────────────────┼──────────────────────────────────────┐
▼ ▼ ▼
┌───────────────────────────┐ ┌───────────────────────────┐ ┌───────────────────────────┐
│ 1. Business MCP Tools │ │ 2. OpenClaw Core Tools │ │ 3. Bundled Skills │
│ Model Context Protocol │ │ Sandboxed System Tools │ │ Packaged Extensions │
├───────────────────────────┤ ├───────────────────────────┤ ├───────────────────────────┤
│ • search_knowledge (RAG) │ │ • read_file │ │ • summarize │
│ • search_memory / remember│ │ • write_file │ │ • weather │
│ • Commerce: create_order │ │ • exec (allowlist only) │ │ • tmux │
│ • CRM: search_contacts │ │ • web_search │ │ • session-logs │
│ • IoT: reset_speaker │ │ • image │ │ │
└───────────────────────────┘ └───────────────────────────┘ └───────────────────────────┘1. Business MCP (Model Context Protocol) Tools
Injected dynamically via openclaw.json. These connect the agent to DOS.AI's managed infrastructure:
search_knowledge: Hybrid vector + keyword search over the merchant's live knowledge base (Supabase pgvector), synced automatically with Google Sheets or CSV uploads.Platform Connectors: E-commerce tools (Shopee, TikTok Shop, Haravan), CRM tools (HubSpot, Salesforce), and Invoicing tools (MISA, FinOne).
Marketing & Media Tools: Social posting and media synthesis tools (
generate_marketing_image,create_social_post,prepare_marketing_review). When an agent generates visual assets, the API Gateway dynamically resolves image-capable models from the agent's configured Model Priority chain (model_chain), enforcing atomic credit holds, rate-limiting on remote social destinations, and zero-markup token settlement.Custom Hardware/IoT Actions: Dedicated tools for device control (e.g.
reset_speaker/reset_device).
2. OpenClaw Core Runtime Tools
Built into the OpenClaw container runtime to enable general-purpose task automation. DOS.AI enforces strict security policies on these tools:
fs.workspaceOnly: true: Filesystem read and write tools are confined strictly to/workspaceto prevent container escapes.exec.safeBinsAllowlist: The shellexectool can only invoke explicitly allowlisted binaries:Tool Deny List (
tools.deny): Dangerous or redundant capabilities are blocked entirely:
3. Bundled Skills
Pre-packaged capabilities bundled within the OpenClaw container image (e.g. summarize, weather) that can be activated selectively.
Action Execution Invariants
A common failure mode in production customer-service agents is premature claim of success—where an LLM's RLHF alignment makes it overly eager to please, causing it to state "I have reset your speaker" or "I have placed your order" without actually invoking the underlying tool.
DOS.AI enforces strict Action Execution Invariants across all agent prompts:
1. Tool-First Mandate & Wait-For-Result
Action Invocations Precede Confirmations: For any request requiring a state mutation (resetting a device, updating an order, booking an appointment), the agent must emit the tool call first.
No Premature Confirmation: The agent is strictly prohibited from claiming an action has succeeded until the tool has finished executing and returned a valid
tool_result.Direct Negative Constraint:
"Never report success or acknowledge execution based on assumptions. Only confirm after parsing the actual tool_result."
2. Know vs. Act Demarcation
Agents maintain a clear separation between informational inquiries and state-changing actions:
Informational Inquiries (Know): Product specifications, store policies, pricing, FAQs → routed strictly through
search_knowledge(RAG). The agent must never guess or read stale files.Actionable Execution (Act): State mutations (resetting hardware, placing orders, transferring calls) → routed directly to the specific action tool. The agent must never invoke
search_knowledgeas an evasive excuse when an action tool exists.
3. Anti-Echo Directives
When a user repeats an identical instruction, quotes an older message, or re-prompts after a delay, language models often fall into an "echo loop"—repeating instructions or quoting previous chat claims.
The
AGENTS.mdoperating manual directs the model:Treat quoted text as raw user intent, not as instructions to be echoed or critiqued.
Every action request requires an immediate, fresh tool invocation regardless of conversational history.
4. Grounding Plugin Recovery (dos-grounding)
The dos-grounding OpenClaw plugin operates as an in-process safety interceptor:
Inspects turn responses before delivery to messaging channels.
If a deceptive echo pattern is detected (e.g. the model generated success text without emitting the required tool call), the plugin strips the deceptive text and injects a recovery directive forcing the model to issue the actual tool call.
Inspecting Container Tools via Status API
Developers and operators can inspect an agent's active tool policies and runtime health using the Status API /containers/:name/exec endpoint:
Last updated