Skip to main content
Xerg can receive OpenClaw traces on your own machine, sanitize each protobuf request in memory, and audit the resulting capture without combining it with transcript or log data. This is an optional local path. Transcript audits continue to work without it.

​
Start the collector

The command binds only to 127.0.0.1:4318, prints the exact OpenClaw configuration to use, and waits while you run the workload. Press Ctrl-C to close the capture cleanly and run its audit. Xerg does not change your OpenClaw configuration and never pushes a collector audit automatically. Use another port or capture path when needed:
The official OpenClaw diagnostics-otel plugin must be installed and enabled. Its configuration must keep traces on, metrics and logs off, sampling at 1.0, and every content-capture option off:

​
Audit an existing capture

Without an explicit runtime, --otlp-file implies OpenClaw and is an independent local source. It cannot be combined with log, transcript, Hermes, Claude Code, Cursor, remote, Railway, or other runtime inputs. OTLP captures are never merged with transcripts, which prevents duplicate economics. The separate certified Hermes enrichment form requires --runtime hermes --state-db <file> and is documented under Hermes trace collection. The normal local output and snapshot flags work, including --json, --markdown, --since, --compare, --db, and --no-db.

​
What the capture keeps

The raw protobuf request is never written to disk. Xerg persists only versioned JSONL records containing allowlisted typed fields such as:
  • timestamps and process-scoped keyed hashes for trace, span, parent-span, and tool-call IDs
  • bounded provider, model, API, transport, service, environment, tool, status, and error-category names
  • input, output, cache, and reasoning token counts
  • positive observed cost when a span supplies it; otherwise Xerg estimates cost locally
  • request/response byte counts, durations, time to first byte, and prompt component sizes
  • context-size, tool-execution, and native loop evidence
Xerg rejects all openclaw.content.* attributes plus standard prompt, response, system-instruction, tool-argument, tool-result, input-value, and output-value attributes even if OpenClaw content capture was accidentally enabled. The current OpenClaw exporter normally supplies call-level token usage but not a positive billed-cost field on those trace spans. In that case tokens are observed and dollars are explicitly estimated through Xerg’s local pricing catalog.

​
Limits and recovery

  • 16 MiB maximum per protobuf request
  • 256 MiB maximum sanitized capture size
  • 100,000 decoded spans per capture
  • owner-only capture files (0600) in owner-only directories
  • no overwrite of an existing output path
  • interrupted captures remain auditable; Xerg reports the missing clean-shutdown footer and ignores an incomplete trailing JSONL line
If the port is occupied, choose another with --port. The collector accepts only POST /v1/traces with application/x-protobuf; metrics, logs, JSON, gRPC, and remote binding are intentionally unsupported.

​
Local-only evidence

OpenClaw audits can add two neutral local blocks:
  • toolActivity: execution counts, exact/heuristic association coverage, serialized result bytes, associated model spend, and maximum consecutive calls by tool
  • workloadEconomics: root/descendant run counts, depth, call/spend totals, first-descendant-call economics, and lineage coverage
These blocks are stored only in local summaries and snapshots. They are not finding kinds, recommendations, waste totals, failure gates, Audit Push Payload v3 fields, hosted data, dashboard data, or MCP data.