Deterministic governance layer for OpenClaw tool execution. Enforces tool allowlists, deny patterns, path allowlists, risk tiers, dry-run mode, and escalation tracking via the before_tool_call hook. Every decision is logged for audit. Production-hardened with 88 tests and three deadlock classes fixed.

OpenClaw 工具执行的确定性治理层，通过 before_tool_call 钩子强制执行工具允许列表、拒绝模式、路径允许列表、风险等级、预演模式和升级追踪。所有决策均被记录以供审计。经过 88 项测试验证，并修复了三类死锁问题，适用于生产环境。