OpenClaw Adds a Tool-Free Isolated Completion Boundary

OpenClaw has merged an explicit tool-free isolated completion contract into main. Plugins that need one model judgement can now request a fresh, prompt-only inference call without entering an ordinary agent turn, inheriting session context or exposing an agent tool surface.

This is more than an optimisation. It gives plugin authors a security and reasoning boundary they previously had to approximate: use exactly an authorised model and credential, attach literally zero tools, accept terminal text only, and reject unsupported runtimes rather than silently falling back to a more capable agent path.

The change is merged source work, not proof that a particular packaged release contains it. Operators and plugin developers should match their installation to a containing release or exact revision before relying on the boundary.

Who needs to understand this

• plugin authors using api.runtime.llm.complete for classification, extraction or schema-constrained workflow steps;
• operators enabling the bundled llm-task plugin;
• harness maintainers for Claude CLI, Codex, Copilot, Gemini CLI or native model runtimes;
• security reviewers distinguishing “the prompt did not ask for tools” from “no tools were attached”; and
• deployments that restrict which models or auth profiles plugins may invoke.

If a workflow genuinely needs browsing, shell access, memory or session continuity, isolated completion is the wrong primitive. Use an ordinary governed agent turn and review its tools explicitly.

The contract that landed

The official PR describes a new harness capability for one fresh inference call. The important properties are structural:

1. Fresh prompt context. The call does not reuse the surrounding agent session or transcript.
2. Zero-tool surface. Tools are not merely discouraged in the prompt; none are attached to the call.
3. Exact authorization. Model and authentication selection must pass the runtime’s configured completion policy.
4. Text-only completion. Tool calls, non-text terminal output and other agent-style continuations are rejected.
5. No transparent downgrade. A harness without the capability fails closed instead of routing the request through an ordinary tool-bearing turn.

OpenClaw’s documentation now exposes this through the optional runIsolatedCompletion(params) harness contract and the plugin runtime completion helper. The bundled LLM Task plugin uses the path for single JSON-oriented model steps, optionally followed by schema validation.

Interpretation: isolation belongs in runtime construction, not prompt wording. “Do not call tools” is a behavioural request to a model. An empty tool registry plus output rejection is an enforceable application boundary.

Authorization still matters

Tool-free does not mean unrestricted. A completion can still spend tokens, send prompt data to a provider and select a model or credential with different commercial and privacy consequences.

The merged change adds completion-model policy and controls around authentication-profile override. Operators should therefore review:

• the models permitted for isolated completion;
• whether callers may select an auth profile or must accept the configured default;
• provider data-handling requirements for the prompt content;
• timeout and output limits around workflow retries; and
• audit records that identify the plugin, model and terminal outcome without logging sensitive prompt data.

Do not widen model or credential policy merely because the call has no tools. Exfiltration through model input is still data disclosure even when the model cannot execute a command.

What plugin authors should change

Use isolated completion for bounded transformations where the desired output is final text or JSON: routing labels, extraction, scoring, summarisation or a schema-shaped decision. Keep side effects outside the model call and under ordinary application control.

A safe adoption sequence is:

1. declare the smallest allowed model set;
2. keep auth-profile override disabled unless the caller has a real tenancy requirement;
3. validate JSON against a strict schema and reject extra fields where appropriate;
4. place deterministic size, timeout and retry limits around the call;
5. fail visibly when the selected harness does not support isolation; and
6. test that attempted tool output or a non-text terminal result is rejected rather than coerced.

Do not treat schema validation as proof that the content is true or safe to execute. It proves shape. Values still need domain validation before they become file paths, commands, destinations or financial actions.

Runtime coverage and compatibility

The merged record says the contract was implemented across Copilot, Codex, Claude CLI, Gemini CLI and native runtimes, with unsupported harnesses failing closed. That breadth reduces the temptation for plugins to create provider-specific escape hatches, but it also creates an upgrade boundary for third-party harnesses.

Harness maintainers should implement the documented capability directly and add negative tests for:

• accidental inherited tools;
• reused conversation state;
• model or credential substitution;
• tool-call terminal output;
• mixed or empty output; and
• cancellation and timeout cleanup.

Existing plugins that rely on ambient system prompts, session memory or implicit workspace context may behave differently when moved to the isolated path. That is expected: the absence of ambient context is part of the guarantee. Supply only the context the bounded task actually requires.

Release and evidence limits

OpenClaw Academy reviewed the merged PR and commit records supplied by the official repository collector. Independent web search returned the official PR, landed commit and current documentation for the harness, runtime helper and LLM Task surfaces. Those sources describe fresh context, an empty tool surface, exact authorization, text-only results and fail-closed support.

We did not execute every supported harness or inspect a packaged release containing the merge. Upstream implementation and test claims remain attributed to upstream. Verify the containing version before using isolated completion as a production control.

Bottom line

OpenClaw now has a proper primitive for “ask a model one bounded question” without quietly creating another agent. That is the right design: fewer tools, less ambient context and explicit authorization by construction. Adopt it for pure inference, but keep model access, prompt data and downstream side effects under the same scrutiny as any other external call.