# Local Hardening Baseline

## Purpose
Describe the standalone free-mode posture for the dexgate OpenClaw adapter without requiring the SDE PDP runtime.

## Audience
- Self-serve OpenClaw users
- Security reviewers evaluating free plugin mode
- Teams deciding whether to start with local hardening before a paid pilot

## Default Free Posture (developer-free)
The free plugin uses a **developer-free** local hard gate—not a pure read-only wall.

Typically allowed under the free wall (exact tools depend on host wiring):
- Read / search / list workflows
- Limited edit / write under guardrails
- Constrained shell and common test runners

Blocked by default (high-consequence; upgrade CTA, no Passport):
- `git push` / commit-style production mutation
- Deploy-class actions
- Unrestricted shell launchers

Free mode does **not** mint a Passport and does **not** create org-wide governed decision records. Check output should show something like `governed: false` and `source: local-hardening` (or adapter-equivalent free baseline).

## What This Gives You
- Useful standalone hardening with no external PDP dependency
- Everyday coding still works under guardrails
- Clear local blocking of high-risk actions

## What It Does Not Give You
- External PDP authorization
- Scoped Passports for protected executors
- Tenant or license entitlements
- Shared PDP dashboard authorize stream
- Audit-grade governed traces and release evidence

## When To Upgrade
Upgrade to the paid pilot (SDE PDP) when you need:
- Shared monitor and record of agent authorize requests
- Deterministic allow / deny / constrain from an external authority
- Passport evidence and console decision history
- Managed policy lifecycle for production-bound change

## Validation Guidance
Reviewers should confirm:
- The adapter is installed and the free check returns PASS (or equivalent)
- Result is free baseline (`governed: false` / `source: local-hardening`), not a mock paid path
- High-consequence actions are blocked with an upgrade path
- Limited everyday work (read, limited edit, constrained tests) still functions

## Related Resources
- OpenClaw free quickstart: `/docs/openclaw/quickstart/`
- `sample-decision-trace.json`: example governed trace for the **paid** PDP-backed mode
- `governed-release-evidence-pack-template.md`: release evidence structure for the paid mode
- `enterprise-evaluation-kit.md`: evaluation path from free hardening to paid pilot
- Enterprise rollout: `/docs/enterprise-rollout/`