Architecture: How much of Phases 1-5 security code is actually wired into ...

Documentation for Sessions

🏗️ Architecture: How much of Phases 1-5 security code is actually wired into ...

Date: 2026-02-18
Time: 13:15:34 UTC
Session: gspace1-116.2
Agent: angular
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

How much of Phases 1-5 security code is actually wired into execution paths?

Task: Vitto vs OpenClaw honest assessment

🎯 Decision Made

Chosen:

~60% wired, ~40% dead code. Audit logging, memory, multi-LLM routing, skill versioning are wired. Prompt injection, rate limiting, circuit breaker, DLQ, hash chain, cost persistence, process sandbox, container sandbox are NOT wired.

Options Considered:

💭 Reasoning

Grep analysis across the entire codebase shows: scanForInjection() has zero callers, ChannelRateLimiterService.check() has zero callers, CircuitBreakerService.execute() has zero callers outside its own file, DeadLetterQueueService.enqueue() has zero callers, HashChainVerifierService.computeHash() has zero callers, CostTrackerService.recordSpending() has zero callers from execution paths, ProcessSandboxService/ContainerSandboxService are never called from run_command tool. All services are properly registered in SecurityModule and injectable — they just need 5-10 lines of glue code each to activate.

📁 Files Involved

🔗 Related

Auto-generated by MCP Smart Consolidation