openexec

name	OpenExec
slug	openexec
version	0.1.10
category	infrastructure/governance/execution
runtime	python
entrypoint	main:app
requires_network	false
modes	["demo","clawshield"]
env	{"required":"none","optional":["OPENEXEC_MODE","CLAWSHIELD_PUBLIC_KEY","CLAWSHIELD_TENANT_ID","OPENEXEC_ALLOWED_ACTIONS","OPENEXEC_DB_URL"]}
description	Source-distributed deterministic execution service with pinned dependencies. Runs only with a signed approval artifact (ClawShield mode) and emits verifiable receipts. Performs no outbound HTTP or governance calls. No runtime package installation or dynamic downloads occur.

OpenExec — Governed Deterministic Execution (Skill)

OpenExec is a runnable governed execution service. It executes only what has already been approved.

It is not an agent. It is not a policy engine. It does not self-authorize.

OpenExec performs no outbound HTTP, RPC, or governance calls during signature verification or execution. All verification is fully offline. By default, OpenExec uses a local SQLite database (sqlite:///openexec.db). Database network I/O occurs only if explicitly configured by the operator via OPENEXEC_DB_URL.

---

Install

pip install -r requirements.txt

Run (local)

python -m uvicorn main:app --host 0.0.0.0 --port 5000

---

Endpoints

• GET / → service info (deployment health check)
• GET /health → health status, mode, restriction level
• GET /ready → readiness check
• GET /version → version metadata
• POST /execute → execute an approved action deterministically
• POST /receipts/verify → verify receipt hash integrity

---

Modes

1) Demo mode (default, free)

No external governance required. No env vars required.

export OPENEXEC_MODE=demo

Demo mode still enforces:

• deterministic execution
• replay protection (nonce uniqueness)
• receipt generation

2) ClawShield mode (production / business)

Requires a signed approval artifact issued by ClawShield. OpenExec verifies the Ed25519 signature offline using the configured public key.

export OPENEXEC_MODE=clawshield
export CLAWSHIELD_PUBLIC_KEY="-----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY-----"
export CLAWSHIELD_TENANT_ID="tenant-id"

If signature validation fails, execution is denied.

Note: ClawShield governance SaaS is available at https://clawshield.forgerun.ai/. OpenExec does not contact this URL at runtime. It is provided for reference only.