# Functional module taxonomy — openclaw_openclaw

Group: **Agent orchestration frameworks** (`agent_orchestration_frameworks`)

This project has ALREADY been decomposed into functional modules (grounded in
code) by an upstream analysis. Treat the table below as the authoritative module
map for this repository. When localizing the vulnerable module, you MUST pick a
`module_id` from the "Allowed module_id values" section below (use `other` only
if nothing genuinely fits, and then add a `taxonomy_suggestions` entry).

Cross-cutting `module_id`s are shared across all projects; domain `module_id`s
are specific to this project's functional group and are namespaced as
`agent_orchestration_frameworks.<name>`.

## Pre-divided modules of this project

| module_id | project module | code_location |
|---|---|---|
| `api_http_server` | Gateway Control Plane | src/gateway/ |
| `configuration_management` | Configuration System | src/config/ |
| `agent_orchestration_frameworks.agent_execution_loop` | Agent Runtime | src/agents/ |
| `agent_orchestration_frameworks.llm_provider_abstraction` | Model Provider Integration | src/llm/ |
| `agent_orchestration_frameworks.tool_system` | Tools System | src/tools/ |
| `agent_orchestration_frameworks.memory_management` | Context & Memory Management | src/memory/ |
| `agent_orchestration_frameworks.mcp_integration` | MCP Bridge | src/mcp/ |
| `agent_orchestration_frameworks.skills_extension` | Plugin System | src/plugins/ |
| `agent_orchestration_frameworks.skills_extension` | Skills System | src/skills/ |
| `api_gateway_proxy` | Messaging Channels | src/channels/ |
| `background_jobs_scheduling` | Automation & Cron | src/cron/ |
| `agent_orchestration_frameworks.multi_agent_orchestration` | Sub-Agent Orchestration (ACP) | src/acp/ |
| `web_frontend_ui` | Control UI & WebChat | ui/ |
| `web_frontend_ui` | CLI System | src/cli/ |
| `agent_orchestration_frameworks.safety_guardrails` | Security & Sandboxing | src/security/ |
| `web_frontend_ui` | Talk/Voice Mode | src/talk/ |
| `web_frontend_ui` | Native Clients & Device Nodes | apps/ |

## Allowed module_id values

### Domain modules — Agent orchestration frameworks
- `agent_orchestration_frameworks.agent_execution_loop` — Agent Execution Loop: The core runtime that drives the ReAct/think-act-observe cycle, managing the iterative LLM call, tool dispatch, and observation processing loop.
- `agent_orchestration_frameworks.multi_agent_orchestration` — Multi-Agent Orchestration: Coordinates multiple specialized agents as teams, swarms, or sub-agents for task decomposition, delegation, and inter-agent communication.
- `agent_orchestration_frameworks.workflow_pipeline` — Workflow Pipeline: Defines and executes deterministic multi-step agent pipelines with control flow (sequential, parallel, branching, loops) and step-level state management.
- `agent_orchestration_frameworks.tool_system` — Tool System: Framework for defining, registering, discovering, and executing agent-callable tools, including schema generation, lifecycle hooks, and built-in tool libraries.
- `agent_orchestration_frameworks.llm_provider_abstraction` — LLM Provider Abstraction: Unified interface that normalizes differences across 20+ LLM providers for chat completions, streaming, tool calling, and embeddings.
- `agent_orchestration_frameworks.mcp_integration` — MCP Protocol Integration: Implements the Model Context Protocol as client/host/broker to discover and invoke tools from external MCP-compatible servers via stdio, SSE, or HTTP transports.
- `agent_orchestration_frameworks.context_assembly` — Context Assembly & Prompt Construction: Assembles the full system prompt and message list from identity, skills, memory, and environment metadata before each LLM call.
- `agent_orchestration_frameworks.memory_management` — Memory & Knowledge Management: Multi-tier persistent memory (short-term, long-term, episodic, semantic) with vector-based retrieval, fact extraction, and context injection.
- `agent_orchestration_frameworks.sandbox_execution` — Sandbox Execution Environment: Provides isolated, secure environments (Docker, VM, AST interpreter, subprocess) for executing agent-generated code and shell commands.
- `agent_orchestration_frameworks.skills_extension` — Skills & Extension Framework: Modular, declarative SKILL.md-based packages or plugin manifests that extend agent capabilities with domain-specific instructions, workflows, or tool integrations.
- `agent_orchestration_frameworks.safety_guardrails` — Safety & Guardrails: Policy-based pre/post-execution safety layer that validates inputs, blocks dangerous tool calls, detects prompt injection, and enforces permission gates.
- `agent_orchestration_frameworks.agent_conversation_session` — Agent Conversation & Session Management: Manages multi-turn conversation state, history persistence, session identity, context-window compaction, and conversation forking/resumption.
- `agent_orchestration_frameworks.rag_pipeline` — RAG Pipeline: End-to-end Retrieval-Augmented Generation pipeline spanning document ingestion, chunking, embedding, vector storage, retrieval, and response synthesis.

### Cross-cutting modules (shared across all projects)
- `authentication_authorization` — Authentication & Authorization: Verifying caller identity and enforcing access control: login, OAuth/OIDC, JWT/session tokens, API keys, RBAC/ABAC, multi-tenancy isolation, permission gates.
- `secrets_credentials_management` — Secrets & Credentials Management: Secure storage, injection and rotation of API keys, credentials, vaults and provider secrets used by the system.
- `data_persistence_layer` — Data Persistence Layer: General application database / ORM / persistence: schemas, models, migrations, repositories, relational/NoSQL stores, state persistence.
- `caching_layer` — Caching Layer: Caching of responses, embeddings, computations or sessions (in-memory, Redis, semantic cache, memoization) to reduce latency/cost.
- `object_file_storage` — Object & File Storage: Storing and serving binary artifacts, uploads, media, files and blobs (local FS, S3/object storage, artifact stores, virtual filesystems).
- `api_http_server` — API / HTTP Server Layer: The service's own inbound HTTP/REST/gRPC server: routing, controllers, middleware pipeline, request/response lifecycle.
- `api_gateway_proxy` — API Gateway / Proxy: Generic network gateway / reverse proxy / relay that forwards or load-balances traffic to upstream services or tools (NOT LLM-provider routing).
- `messaging_realtime` — Messaging & Real-time Communication: Real-time and asynchronous transport between components/clients: WebSocket, SSE, event bus, pub/sub, message broker, streaming infrastructure.
- `background_jobs_scheduling` — Background Jobs & Scheduling: Asynchronous task execution, job queues, workers, schedulers, cron and distributed task distribution.
- `observability_logging` — Observability, Logging & Audit: Logging, metrics, tracing, telemetry, monitoring, usage tracking and audit trails for the system itself.
- `configuration_management` — Configuration & Bootstrap: Loading and managing configuration/settings/env, feature flags, application bootstrap and lifecycle wiring, CLI entrypoints.
- `web_frontend_ui` — Web Frontend / UI Shell: Presentation layer: web frontend, dashboard, UI component system, desktop (Electron) shell, internationalization/localization.
