Tools

@knolo/tools is the published host-agnostic service behind the read-only adapters. It pins a local V5 image by file SHA-256 and state root, checks the policy root at load, and writes a replayable query receipt before search results return.

Caller identity is an argument of search, get, verify, status, and readAuthorizedMount. The host must supply that identity from its own configuration. Tool arguments are not a caller.

readAuthorizedMount returns the mounted image after the caller is allowed and the mount principal may query chunk objects. Deny wins, then allow, then the policy default.

Query receipts stay openclaw-knolo-query-v1 with ids prefixed qr_. An unwritable audit directory fails with AUDIT_UNAVAILABLE and the host returns no result. Mount failures use ACCESS_DENIED, IMAGE_INVALID, IMAGE_UNAVAILABLE, NOT_FOUND, QUERY_INVALID, or STATE_ROOT_MISMATCH.

The published package requires Node 20 or newer and @knolo/core ^6.0.0. It does not download images, open a network connection, or import KAR, Cortex, coverage, or composition.

Published @knolo/tools@0.2.0 is npm latest and can append knolo-mcp-evidence-receipt-v1 receipts (er_ ids) for the @knolo/mcp@0.2.0 evidence tools. A clean install of @knolo/openclaw@0.1.0 does not resolve that version: its range ^0.1.0 stays on 0.1.0.