Grill Gate

Runtime-level enforcement that prevents agents from executing research/development tasks without completing a grill (design review) session first.

The Problem

Writing "always do a design review before coding" in AGENTS.md is a prompt-level constraint — the agent can forget or ignore it. Even wrapping dispatch logic in a script doesn't help if the agent can bypass the script with raw exec.

The Solution

Grill Gate hooks into OpenClaw's before_tool_call runtime hook — a layer the agent cannot bypass. Before any exec or sessions_spawn call actually executes, the plugin checks:

1. Is this a blocked command (e.g., hermes, a coding agent CLI)?
2. Does the task contain research/development trigger keywords?
3. Is there a valid grill token?

No token → blocked. The agent physically cannot proceed without completing the grill process first.

How It Works

Agent wants to exec hermes / spawn subagent
    ↓
before_tool_call hook fires (runtime-level, unforgeable)
    ↓
grill-gate checks: blocked command? trigger keywords?
    ↓
YES → check for grill token in .grill-tokens/
    ↓
No token → BLOCK (tool call rejected)
Has token → ALLOW (proceed normally)

Configuration

Create ~/.openclaw/grill-gate.json (all fields optional):

{
  "triggers": ["research", "develop", "design", "architect", "plan", "refactor", "migrate"],
  "exemptions": ["ASAP", "skip grill", "just do it"],
  "blockedCommands": ["hermes", "claude", "codex"],
  "tokenDir": "/path/to/.grill-tokens",
  "tokenTtlSeconds": 3600
}

Or set via environment variable:

export GRILL_GATE_CONFIG='{"triggers":["research","design"],"tokenTtlSeconds":7200}'

Language Presets

Built-in presets for Chinese and English keywords (both loaded by default):

Issuing Grill Tokens

After completing a grill-with-docs session:

python3 scripts/auto_dispatch.py --issue-grill-token "task description"
# Returns: {"token_id": "abc123", "status": "issued"}

Tokens are one-hour, one-use files stored in the configured tokenDir.

Three-Layer Defense

This plugin is designed as the innermost layer of a three-layer grill enforcement system: