OpenClaw as Language Infrastructure: A Case-Centered Survey of a Public Agent Ecosystem in the Wild

1. Introduction

Public agent ecosystems are emerging as a new object of study in NLP, shifting language from a static interface to an operational infrastructure. The OpenClaw–Moltbook case makes this shift unusually concrete. OpenClaw is a self-hosted orchestration system that connects chat channels, tools, memories, and routing [1,2,3,4]. By the corpus freeze date, Moltbook complemented this runtime with a public, agent-native network where bots could post, reply, and authenticate through a developer-facing shared identity layer carrying profile and reputation signals [5,6]. Together, they create a setting where language functions as language infrastructure: it is executable, persistent, public, portable, and consequential. A single utterance can trigger a tool action, perform a social identity, package evidence, or claim legitimacy [4,6,7]. The case therefore matters not only as another agent framework, but as a setting in which meaning is translated into delegated, inspectable activity.

This paradigm collapses distinctions NLP has treated separately. Earlier work moved research from static text toward situated tool and API use [8,9,10,11], while multi-agent literature expanded into role specialization and coordination [12,13,14,15]. Surveys document the proliferation of agent stacks, communication protocols, and trust/safety challenges [16,17,18,19,20,21,22,23,24,25]. OpenClaw and Moltbook push that literature out of benchmarks and into a public, provenance-bearing setting, where attribution, privacy, identity, and governance enter the evaluation loop.

The surrounding literature has grown with unusual speed. By our corpus freeze date of 2026-03-10, we identify 38 works in the direct synthesis, spanning trajectory audits, local-agent exploits, peer learning, discourse regularities, provenance critiques, and governance architectures [26,27,28,29,30,31,32,33,34,35]. Beyond papers, a project layer has already formed around the ecosystem: public skill distribution and archival (ClawHub, skills), client and deployment surfaces (ACPX, nix-openclaw, openclaw-ansible, openclaw-mcp), training and verification extensions (OpenClaw-RL, Verifiable-ClawGuard), and Moltbook’s public web/API stack [36,37,38,39,40,41,42,43,44,45]. These repositories matter because they materialize the same transfer, orchestration, and grounding claims discussed in the literature.

This survey is intentionally case-centered. Rather than asking “what do agents do online?”, we ask what role language plays once it is bound to tools, memory, authentication, public discourse, and reusable artifacts within a live public ecosystem. That framing lets us compare work that might otherwise look unrelated. A trajectory audit, a social-graph study, a provenance critique, a dataset release, and a skill-security note are not separate literatures accidentally co-located around OpenClaw. They are observing different faces of the same infrastructural object.

Our contributions are fivefold. (1) Case-Centered Scoping: We provide a case-centered account of the OpenClaw–Moltbook ecosystem, distinguishing public, provenance-bearing agent dynamics from isolated multi-agent benchmarks. (2) Corpus Artifact: We curate a structured corpus of 38 ecosystem-specific papers and reports together with a linked contextual layer of 41 platform, project, and survey sources, plus an auditable screening ledger, exclusion log, and release-oriented metadata schema. (3) Theoretical Framework: We introduce the concept of language infrastructure and the coupled GATE and AERO frameworks to explain how linguistic artifacts become executable instruments of delegated autonomy. (4) Meta-Analytical Insights: We show that the most important tensions in the literature take the form of recurring fault lines (e.g., instruction vs. authority, voice vs. provenance, visibility vs. verification, and local control vs. lower risk) rather than simple empirical contradictions, and we quantify the literature’s weak evidence alignment across trajectories, discourse, portable artifacts, and grounding signals. (5) Research Roadmap: We derive a concrete NLP agenda for public agent ecosystems, covering executable pragmatics, provenance-aware evaluation, privacy-sensitive agent research, and delegated-agent discourse.

2. Review Protocol, Scope, and Positioning

To capture this rapidly emerging object of study, we adopt a PRISMA-inspired multivocal review, incorporating both peer-reviewed and gray literature (e.g., preprints, technical reports, platform documentation, and public project repositories) to reflect how the field is actively forming [46,47]. We treat OpenClaw not as a universal proxy, but as a strategically revealing case study that makes hidden ecosystem layers — tool use, public posting, cross-service identity, reusable artifacts, deployment surfaces, and verification disputes — simultaneously observable. Our corpus freeze date is 2026-03-10 (see Appendix Figure A1 and Appendix Table A2, Table A3, and Table A8 for the workflow, auditable screening counts, borderline/merged records, and survey positioning).

Our search strategy combined alias-based scholarly search (OpenClaw, Clawdbot, Clawd, Moltbot, Moltbook, ClawdLab), backward/forward snowballing, and curation of official materials together with high-signal project repositories [1,2,3,4,5,6,7,36,37,38,39,40,41,42,43,44,45,48,49,50,51,52,53]. We included works where the ecosystem was a primary object, a substantial evaluation target, or an inseparable methodological contribution, explicitly excluding lightweight commentary and purely rhetorical uses. Across 79 sources in the paper-wide inventory, our synthesis is grounded in a direct corpus of 38 ecosystem-specific works, supported by 16 official/platform or dataset sources, 10 project-ecosystem repositories, and 15 adjacent framing or survey works.

We use three evidence disciplines. First, architecture and deployment claims can be grounded in official materials or repositories when those sources directly specify runtime design, interfaces, or security assumptions. Second, behavioral claims are grounded primarily in empirical studies, not in launch rhetoric. Third, stronger ecosystem-level claims require cross-unit triangulation whenever possible: we prefer results that connect at least two of trajectories, public discourse, provenance/identity evidence, or portable artifacts, and we explicitly mark when a result is strong within one evidence unit but weakly triangulated beyond it. We also code an evidence-alignment profile for each included work so that the triangulation bottleneck can be reported quantitatively rather than only rhetorically (Table 1). To make the review protocol auditable, Appendix Table A2 reports stage-wise counts from identification through inclusion, reason-coded full-text exclusions, and final included totals, while Appendix Table A3 lists borderline or merged records. Analytically, we standardize terminology to OpenClaw for readability, though early naming drift itself is evidentially informative [1]. Each included work was coded by primary object, evidence unit, evidence-alignment profile, triangulation class, source tier, AERO role(s), and dominant GATE layer (yielding 8 Grounding, 9 Action, 5 Transfer, and 16 Exchange works).

3. Language Infrastructure, the GATE Taxonomy, and the AERO Layer

The central claim of this survey is that public agent ecosystems should be analyzed as language infrastructure. Prompting research usually studies language as an interface: instructions that help a model produce output for a local task. Public agent ecosystems require a stronger concept. Here, linguistic artifacts are shared across time, actors, and services. They persist in memories and logs, are reused as skills or instructions, circulate in public discourse, stabilize into datasets or personas, and can be audited or disputed later. That is why OpenClaw papers that look unrelated — a trajectory audit, a social-graph study, a provenance critique, and a technical note on skill security — are studying different faces of the same object.

To organize this object, we propose the GATE taxonomy (Grounding, Action, Transfer, and Exchange) to map what language does as infrastructure alongside its failure surfaces. Grounding concerns legitimacy, identity, and provenance; Action concerns intent execution and tool invocation; Transfer concerns portable capabilities such as skills, datasets, and personas; and Exchange concerns public social behavior and visible norms. Figure 1 places all 38 direct studies into a single corpus map based on these dominant layers.

Because GATE alone cannot capture the shift toward delegated autonomy, we cross-cut it with AERO: Authority (permissions and triggering rights), Enablement (capability lifting via schemas, tools, and memories), Reach (persistence and long-horizon effects), and Orchestration (coordination across tools, services, and peer agents). AERO asks how much operational force a linguistic artifact acquires once it is connected to runtime state. A browser auth note, a SKILL.md file, a public warning reply, a tool schema, and a packaging manifest are all language-bearing objects, but they do not matter in the same way. Crucially, the corpus reveals an AERO asymmetry: enablement, reach, and orchestration are scaling faster than authority and verification. That asymmetry explains why the ecosystem can appear behaviorally rich before it is epistemically well-grounded.

4. Grounding: Language as Authority, Provenance, and Verification

Grounding is analytically primary because public agent ecosystems fail when language lacks legitimacy. Understanding an utterance requires more than parsing content; it requires knowing the speaker’s identity, standing, verification regime, and how responsibility for later action is assigned. Moltbook makes cross-service identity and reputation native social signals [6], while OpenClaw operationalizes grounding through operator boundaries, session isolation, and typed tool gating rather than generic alignment [49,50,51]. The grounding literature therefore centers four linked questions: who is speaking, who can authorize, when verification arrives, and who bears responsibility. Li [31] and Shi and DiFranzo [54] show that visible behavior is often human-steered or institutionally scaffolded, while Shi and DiFranzo [55] show that public narratives can stabilize before verification catches up. Provenance is thus not a post hoc label; it is part of the semantic object under study.

Grounding is also where privacy and containment become semantically relevant. OpenClaw’s personal-assistant trust model favors a single trusted operator boundary over hostile multi-tenant sharing [49]. That supports local sovereignty, but it places agents near sensitive state such as logged-in browser profiles and local files [3,7]. The result is a familiar paradox: local-first deployment can reduce routine cloud exposure while amplifying the consequences of prompt injection, credential leakage, and containment failure, especially when local checkpoints lack provider-side filtering [53]. The Wiz exposure of Moltbook data and the broader OpenClaw attack literature make the same point empirically [27,28,34,62,63,64,82]. These failures are mediated by language-bearing objects: prompts, SKILL.md files, auth notes, summaries, and public claims.

The visible “speaker” remains ambiguous. Hidden user instructions can obscure intent when agents act as proxies [56], and conceptual critiques caution against treating delegated tool use as stable autonomous speakerhood [58,59,60]. The emerging project layer mirrors this concern: Verifiable-ClawGuard tries to let a remote OpenClaw agent attest that it is running behind a known guardrail rather than merely claiming to do so [43]. OpenClaw is valuable precisely because authority, identity, and verification are inspectable enough to be studied rather than buried behind a product abstraction.

Figure 1. GATE functions as both taxonomy and corpus map. All 38 direct studies are placed under one dominant layer for display, while AERO tracks the cross-cutting growth of delegated operational force from authority through orchestration. The figure makes visible a central pattern in the corpus: exchange is easiest to observe, action and grounding are most safety-critical, and transfer is how capabilities and evidence become portable infrastructure.

Figure 1. GATE functions as both taxonomy and corpus map. All 38 direct studies are placed under one dominant layer for display, while AERO tracks the cross-cutting growth of delegated operational force from authority through orchestration. The figure makes visible a central pattern in the corpus: exchange is easiest to observe, action and grounding are most safety-critical, and transfer is how capabilities and evidence become portable infrastructure.

5. Action: Language as Executable Interface

If Grounding establishes standing, Action examines what language does upon execution. In OpenClaw, text triggers tools, modifies persistent memory, and alters browser states. The relevant unit therefore shifts from final output strings to trajectories: sequences of instructions, tool choices, recovery moves, and state changes.

Chen et al. [26] formalize this shift by auditing OpenClaw trajectories rather than final answers, while Wang et al. [27] show that personalized local agents magnify the cost of semantic mistakes through context leakage and persistent memory effects [1,2,3]. Failure is often a property of repair and architecture rather than of a single malicious prompt: Dong et al. [28] exploit recovery loops through Trojanized skills; Zhan et al. [64] show that deployment topology creates attack surfaces invisible at the prompt level; and Du et al. [65] argue for deterministic control pathways rather than leaving critical actions entirely inside free-form language. Meaning in agentic NLP includes permission scope, reversibility, containment, and runtime topology.

The action literature also documents rapid co-evolution between attacks and hardening. Early exploit work centered on ambiguous skill files, recovery loops, and long-horizon manipulation [28,62]. Official materials now emphasize first-class typed tools, explicit allow/deny policies, browser isolation, and machine-checkable security models [4,7,51]. Governance proposals and runtime attestation extend the same move from content safety to execution safety [34,61,63]. The project layer reinforces this shift: ACPX packages stateful ACP sessions for headless control, openclaw-mcp exposes a secured MCP bridge to external clients, and OpenClaw-RL treats natural conversation feedback as a training signal for future agent behavior [38,41,42].

OpenClaw therefore points toward executable pragmatics: a view in which permissions, tool schemas, repair trajectories, and state transitions are intrinsic to meaning. Final-answer correctness is not enough; NLP for action-capable agents must evaluate the operational boundaries through which language acts on the world.

6. Transfer: Portable Knowledge, Skills, Datasets, and Research Workflows

The transfer layer turns public ecosystems into infrastructure by packaging language into durable, portable artifacts — skills, tutorials, personas, datasets, and workflow descriptions — that outlive a single turn and stabilize into reusable capabilities.

Empirically, Moltbook functions as an AI-only peer-learning environment where agents exchange tactics and tips through broadcast-heavy public streams [29,66]. Persona abstractions package behavior into reusable identities [67], longitudinal graph releases convert ephemeral interaction into benchmark resources [32], and design-science responses such as ClawdLab push ecosystem lessons into broader research infrastructure [33]. Under AERO, this is the shift from authority to enablement: language becomes a medium by which local competence is lifted into shared operating memory.

This logic is already materialized in a growing repository layer. ClawHub and the archived skills repository make skills distributable and inspectable; nix-openclaw and openclaw-ansible package deployment and plugin wiring as reusable infrastructure; the official Moltbook web/API repositories expose the public-network stack; and OpenClaw-RL converts prior conversations into training signals for future agents [36,37,39,40,42,44,45]. These repositories are not peripheral implementation details. They show how skills, policies, interfaces, and traces become reusable infrastructure.

Portability cuts both ways. The same archive that supports reproducibility can accelerate contamination, imitation, or coordinated misuse; the same persona abstraction that makes analysis tractable can harden an unstable behavioral surface into a misleading type; and the same skill that improves reuse can import hidden assumptions or unsafe permissions into downstream contexts [62,83]. Resources such as the Moltbook Observatory Archive are therefore valuable not only because they preserve ephemeral traces, but because they support comparison over time without forcing each study to reconstruct the ecosystem from scratch [84]. In these systems, language models are not only research subjects; they are increasingly components of autonomous scientific pipelines and evidence-packaging workflows [33,85].

7. Exchange: Agent-Native Public Discourse

Exchange is the most visible and most easily over-interpreted layer of public agent ecosystems. Moltbook, while officially agent-native, invites human observation and integrates external app identities [5,6]. This makes it an unusually rich public dataset while ensuring that mixed autonomy, audience effects, and verification asymmetries remain central.

A useful way to read the exchange literature is to separate macro-organization from micro-coupling. Macro studies find heavy-tailed participation, visibility concentration, hub formation, and short-lived cascades [30,71,78,79]. Micro studies find shallow reply depth, formulaicity, and weak semantic coupling [35,70,80]. These findings are not contradictory. They suggest a public sphere that is highly visible and structurally organized, yet often pragmatically thin.

Participation is highly unequal [30,71,78]. Discourse centers on onboarding, self-presentation, tool coordination, and visible norm display more than on deep deliberation [69,72,73]. Dubé et al. [35] describe this through broadcasting inversion and parallel monologue: statements dominate questions, and replies often target the original post more than they sustain peer-to-peer dialogue. Shekkizhar and Earle [80] sharpen the same point by arguing that visible interaction can become “interaction theater” — socially legible, yet semantically weak.

At the same time, public traces enable rich comparative and temporal analysis. Studies on reciprocity, degree concentration, and structural divergence show how agent networks differ from human baselines [30,74,75,77]. Role differentiation and short-lived cascades can emerge even when overall cooperation remains weak [79]. Exchange also shows that safety can be a discourse phenomenon: action-inducing posts are more likely to attract norm-enforcing replies [68]. But visible norm display should not be mistaken for resolved provenance or robust autonomy [60,76,81]. For NLP, standard social-media pipelines are inadequate; public-agent discourse requires richer models of discourse acts, stance, uptake, audience design, and mixed-autonomy speakerhood. Ultimately, exchange is only the public face of the ecosystem. OpenClaw shows that visibility alone is analytically insufficient unless it is connected back to transfer, action, and grounding.

8. Cross-Layer Synthesis and an NLP Agenda Beyond the Model

The direct corpus is already rich, but it is methodologically lopsided. Most papers focus on a single evidence unit — a trajectory benchmark, a post corpus, a reply graph, a dataset artifact, or a provenance audit. Very few triangulate across operational traces, public discourse, portable artifacts, and grounding signals. This is a major methodological gap in the field, and it explains why papers that are all “about OpenClaw” can nevertheless seem hard to reconcile. Figure 2 summarizes that diagnosis as a set of recurring fault lines and research responses. The evidence-alignment audit in Table 1 is designed to make this bottleneck directly reviewable: it records how many studies rely on one evidence family only, how many align multiple families, how many explicitly align discourse + operational + grounding evidence, and how often portable artifacts are linked to another evidence family across the four GATE layers.

Several contradictions become less sharp once evidence units are aligned. Papers finding human-like macro regularities are not necessarily at odds with papers finding weak semantic coupling; they often observe different scales of the same system [35,71,80]. Papers documenting visible norm enforcement are not necessarily at odds with provenance critiques; public warning behavior can coexist with mixed-autonomy speakerhood and delayed verification [31,55,68]. Likewise, sovereignty claims are not incompatible with security critiques; local deployment changes the control boundary rather than removing language-mediated risk [49,61,64].

The first recurring fault line is instruction versus authority. Action papers show that models are often good at parsing what a string asks, but less reliable at determining whether that string has standing to authorize a tool call, memory access, or externally visible action [26,27,28,34]. The second is voice versus provenance. Exchange papers analyze visible posts, while grounding studies show that human steering, owner intervention, and platform affordances can materially shape what appears to be autonomous social behavior [31,54,81]. The third is visibility versus verification. Public narratives, safety claims, and even research findings can lock in socially before provenance or deployment facts are resolved [55,56]. A fourth, cross-cutting fault line is the local-sovereignty paradox: local control does not remove language-mediated risk; it relocates it closer to real operator state [7,53,64].

These failures motivate an NLP agenda that goes beyond model-centric evaluation. (1) Executable pragmatics and provenance-aware evaluation. NLP needs task formulations in which meaning includes tool availability, permission scope, reversibility, and state consequences. Benchmarking only the final answer misses the semantic object that matters most in agent settings: the trajectory. Datasets and benchmarks should incorporate standardized provenance tags such as autonomous, human-steered, mixed, institutionally curated, or unknown, because provenance changes the meaning of predictions and the trust that should be placed in generated evidence. (2) Delegated-agent discourse. Public agent communication is neither ordinary human discourse nor pure machine telemetry. It constitutes a delegated discourse regime in which the visible speaker may represent an owner, a policy, a platform affordance, or a learned routine. Models of discourse acts, stance, warning, and norm invocation should therefore be extended to mixed-autonomy settings in which authority and responsibility are distributed across humans, agents, and infrastructure. (3) Infrastructure-aware agent NLP. The field needs privacy-preserving agent NLP—minimal-disclosure prompting, redaction-aware retrieval, authorization-sensitive dialogue policies, and evidence traces that preserve auditability without leaking operator context—particularly for local-first assistants interacting with messages, files, and browsers. Multilingual public-agent research is also required: current OpenClaw–Moltbook studies remain overwhelmingly English-first even though early peer-learning observations hint at multilingual interaction [29]. Autonomy-sensitive benchmarks should evaluate not only whether an agent completed a task, but whether completion depended on valid authority, enablement through reusable artifacts, behavioral reach beyond the prompt, or orchestration across tools and peers. Intervention studies are equally important, because current work is still dominated by observation rather than controlled changes to identity systems, moderation policies, tool permissions, or verification cues. A practical next step is to treat reporting standards themselves as part of the research agenda: papers should disclose the platform snapshot observed, the alias mapping used, what counts as an agent account, whether humans could intervene during the observation window, which model or provider stack was involved when relevant, and how provenance uncertainty was handled. Release artifacts should triangulate the same event across semantic, operational, artifact, and grounding views: the surface utterance, any implicated portable artifact, the tool-use or interaction trace that followed, and the timing of any correction or verification. Without this triangulation, the field risks producing parallel literatures that study the same ecosystem while talking past one another. Appendix Table A1 turns this agenda into a compact task map for NLP researchers by specifying units of analysis, candidate labels or metrics, and natural data sources visible in the corpus.

9. Conclusion

This case-centered survey positions the OpenClaw–Moltbook ecosystem as a revealing instance of language infrastructure, where linguistic artifacts shift from static interfaces to executable, persistent, and governance-bearing operational layers. We introduce the GATE taxonomy to categorize these infrastructural roles and the AERO framework to track the delegation of force, identifying a methodological bottleneck in the literature’s limited triangulation of discourse, trajectories, portable artifacts, and grounding signals. This gap produces fault lines around instruction and authority, voice and provenance, visibility and verification, and the risk tradeoffs of local control. We therefore outline an NLP research agenda centered on executable pragmatics, delegated-agent discourse analysis, and provenance-aware evaluation to support rigorous study of public agent ecosystems.

Appendix B.1 Operational NLP Task Map

To keep the research agenda concrete, Appendix Table A1 translates the main-text agenda into candidate NLP tasks, units of analysis, labels or metrics, and plausible data sources.

Table A1. Operational NLP task map derived from the survey. The aim is to convert the agenda into concrete tasks, units, labels, metrics, and candidate data sources rather than leaving it at the level of themes.

Task	Unit of analysis	Possible labels / metrics	Candidate data source
Executable-pragmatics evaluation	trajectory step, tool call, complete episode	authority-valid vs. invalid trigger, permission-scope match, reversibility, unsafe state change, repair cost, trajectory success under policy	trajectory audits, PASB-style scenarios, governed tool-call traces (26,27,34,63)
Delegated discourse-act modeling	post, reply, thread	warning, request, self-presentation, norm invocation, uptake, stance, broadcast vs. sustained dialogue depth	Moltbook posts and reply chains, norm-enforcement responses, discourse-structure corpora (35,68,73,80)
Provenance-aware autonomy labeling	post, account, event, verification episode	autonomous, human-steered, mixed, institutionally curated, unknown; verification lag; provenance confidence	provenance audits, oversight studies, delayed verification cases, developer metadata (6,31,54,55)
Privacy-sensitive logging and redaction	prompt span, retrieved chunk, browser step, tool log segment	secret-bearing span, personal-context leak, policy-compliant redaction, audit sufficiency, minimal-disclosure score	PASB scenarios, browser/runtime traces, local-first assistant settings (7,27,49,53)
Cross-lingual norm and attack transfer	paired post, translated thread, skill/tutorial artifact	translation drift, cross-lingual norm alignment, attack transfer success, multilingual provenance ambiguity	multilingual peer-learning streams, translated skills/tutorials, public skill archives (29,37,66)
Autonomy-sensitive benchmark suites	complete episode, intervention event, platform snapshot	task success with valid authority, orchestration depth, reach beyond current turn, post-hoc correction cost, artifact reuse dependence	joined discourse + trajectory + artifact corpora released with source-level metadata and evidence-alignment fields (Table A10)

Table A1. Operational NLP task map derived from the survey. The aim is to convert the agenda into concrete tasks, units, labels, metrics, and candidate data sources rather than leaving it at the level of themes.

Task	Unit of analysis	Possible labels / metrics	Candidate data source
Executable-pragmatics evaluation	trajectory step, tool call, complete episode	authority-valid vs. invalid trigger, permission-scope match, reversibility, unsafe state change, repair cost, trajectory success under policy	trajectory audits, PASB-style scenarios, governed tool-call traces (26,27,34,63)
Delegated discourse-act modeling	post, reply, thread	warning, request, self-presentation, norm invocation, uptake, stance, broadcast vs. sustained dialogue depth	Moltbook posts and reply chains, norm-enforcement responses, discourse-structure corpora (35,68,73,80)
Provenance-aware autonomy labeling	post, account, event, verification episode	autonomous, human-steered, mixed, institutionally curated, unknown; verification lag; provenance confidence	provenance audits, oversight studies, delayed verification cases, developer metadata (6,31,54,55)
Privacy-sensitive logging and redaction	prompt span, retrieved chunk, browser step, tool log segment	secret-bearing span, personal-context leak, policy-compliant redaction, audit sufficiency, minimal-disclosure score	PASB scenarios, browser/runtime traces, local-first assistant settings (7,27,49,53)
Cross-lingual norm and attack transfer	paired post, translated thread, skill/tutorial artifact	translation drift, cross-lingual norm alignment, attack transfer success, multilingual provenance ambiguity	multilingual peer-learning streams, translated skills/tutorials, public skill archives (29,37,66)
Autonomy-sensitive benchmark suites	complete episode, intervention event, platform snapshot	task success with valid authority, orchestration depth, reach beyond current turn, post-hoc correction cost, artifact reuse dependence	joined discourse + trajectory + artifact corpora released with source-level metadata and evidence-alignment fields (Table A10)

Appendix B.2 Auditable Screening Ledger

The ledger below reports stage-wise counts and reason-coded exclusions in an audit-friendly format.

Table A2. Auditable screening ledger for the multivocal review. Counts are reported as whole numbers.

Stage	Count	How records entered or left	Audit note
Alias-based scholarly identification	44	scholar search over OpenClaw / Clawdbot / Clawd / Moltbot / Moltbook / ClawdLab and thematic terms	retained candidate papers, reports, and technical notes
Backward / forward snowballing	15	references and citations from early February and March work	used to recover late-linked direct and adjacent sources
Official / platform materials	16	documentation, blogs, repositories, developer sites, dataset landing pages	screened separately because used as contextual or grounding evidence
Project-layer repositories	10	skill hubs, deployment packages, connectors, training / attestation extensions	retained only if citable and ecosystem-relevant
Records identified before de-duplication	85	union of all source families before version merging	counts mirrored or superseded records separately
Records after de-duplication and version merging	83	merged obvious duplicates, superseded versions, and duplicate bibliographic records	keep one canonical record per source for screening
Title / abstract / metadata screened	83	quick scope screen for ecosystem centrality and retrievability	excludes lightweight commentary and clearly indirect mentions
Excluded at title / abstract / metadata stage	2	removed before full-text coding	reasons recorded in screening log
Full texts assessed for eligibility	81	sources read for direct/context role, evidence unit, and tier eligibility	basis for inclusion/exclusion and coding
Excluded: not ecosystem-primary object (E1)	1	ecosystem appears only rhetorically or peripherally	not used for direct synthesis
Excluded: lightweight commentary / rhetorical mention (E2)	0	commentary lacks substantive empirical, technical, or methodological content	not strong enough for multivocal synthesis
Excluded: insufficient retrievable technical detail (E3)	0	source could not support auditable claims because evidence or versioning was too thin	may be revisited in future updates
Excluded: duplicate or superseded version (E4)	0	later or cleaner version merged under canonical record	protects against double counting
Excluded: unavailable or unstable source (E5)	0	disappeared link, unstable landing page, or insufficiently citable archival state	logged but not cited
Excluded: other scope mismatch (E6)	1	adjacent but outside survey boundary	listed in borderline log when close to inclusion threshold
Included in direct qualitative synthesis	38	ecosystem-specific papers and reports	core direct corpus
Included as official / project / adjacent context	41	official/platform sources, project repositories, adjacent framing and survey sources	contextual layer kept separate from direct evidence
Paper-wide source inventory	79	direct + contextual included records	final included source inventory at freeze date

Table A2. Auditable screening ledger for the multivocal review. Counts are reported as whole numbers.

Stage	Count	How records entered or left	Audit note
Alias-based scholarly identification	44	scholar search over OpenClaw / Clawdbot / Clawd / Moltbot / Moltbook / ClawdLab and thematic terms	retained candidate papers, reports, and technical notes
Backward / forward snowballing	15	references and citations from early February and March work	used to recover late-linked direct and adjacent sources
Official / platform materials	16	documentation, blogs, repositories, developer sites, dataset landing pages	screened separately because used as contextual or grounding evidence
Project-layer repositories	10	skill hubs, deployment packages, connectors, training / attestation extensions	retained only if citable and ecosystem-relevant
Records identified before de-duplication	85	union of all source families before version merging	counts mirrored or superseded records separately
Records after de-duplication and version merging	83	merged obvious duplicates, superseded versions, and duplicate bibliographic records	keep one canonical record per source for screening
Title / abstract / metadata screened	83	quick scope screen for ecosystem centrality and retrievability	excludes lightweight commentary and clearly indirect mentions
Excluded at title / abstract / metadata stage	2	removed before full-text coding	reasons recorded in screening log
Full texts assessed for eligibility	81	sources read for direct/context role, evidence unit, and tier eligibility	basis for inclusion/exclusion and coding
Excluded: not ecosystem-primary object (E1)	1	ecosystem appears only rhetorically or peripherally	not used for direct synthesis
Excluded: lightweight commentary / rhetorical mention (E2)	0	commentary lacks substantive empirical, technical, or methodological content	not strong enough for multivocal synthesis
Excluded: insufficient retrievable technical detail (E3)	0	source could not support auditable claims because evidence or versioning was too thin	may be revisited in future updates
Excluded: duplicate or superseded version (E4)	0	later or cleaner version merged under canonical record	protects against double counting
Excluded: unavailable or unstable source (E5)	0	disappeared link, unstable landing page, or insufficiently citable archival state	logged but not cited
Excluded: other scope mismatch (E6)	1	adjacent but outside survey boundary	listed in borderline log when close to inclusion threshold
Included in direct qualitative synthesis	38	ecosystem-specific papers and reports	core direct corpus
Included as official / project / adjacent context	41	official/platform sources, project repositories, adjacent framing and survey sources	contextual layer kept separate from direct evidence
Paper-wide source inventory	79	direct + contextual included records	final included source inventory at freeze date

Appendix B.3 Borderline or Merged Records

Table A3 records the closest boundary cases and the duplicate-export merges resolved before direct-synthesis coding.

Table A3. Borderline or merged records from the working bibliography. Duplicate merges were resolved before direct-synthesis coding; scope exclusions are shown separately to keep merge handling distinct from full-text exclusion counts.

Record or merge case	Category	Status	Decision	Explanation
duplicate metadata export of weidener2026openclaw	duplicate bibliographic record	merged pre-screen	merged	multiple bibliography exports of the same arXiv record were collapsed under one canonical key to avoid double counting and stale metadata
duplicate metadata export of Zhang2026FromTT	duplicate bibliographic record	merged pre-screen	merged	multiple bibliography exports of the same work were collapsed under one canonical key for consistency across citations and metadata fields
su2025survey	broad survey backdrop	outside direct scope	excluded	relevant to general agent-security framing, but not specific enough to public agent ecosystems once closer adjacent surveys were included
de2026openclaw	system proposal	not ecosystem-primary	excluded from direct synthesis	mentions OpenClaw but is not primarily a direct observational or methodological study of the OpenClaw–Moltbook ecosystem as defined here

Table A3. Borderline or merged records from the working bibliography. Duplicate merges were resolved before direct-synthesis coding; scope exclusions are shown separately to keep merge handling distinct from full-text exclusion counts.

Record or merge case	Category	Status	Decision	Explanation
duplicate metadata export of weidener2026openclaw	duplicate bibliographic record	merged pre-screen	merged	multiple bibliography exports of the same arXiv record were collapsed under one canonical key to avoid double counting and stale metadata
duplicate metadata export of Zhang2026FromTT	duplicate bibliographic record	merged pre-screen	merged	multiple bibliography exports of the same work were collapsed under one canonical key for consistency across citations and metadata fields
su2025survey	broad survey backdrop	outside direct scope	excluded	relevant to general agent-security framing, but not specific enough to public agent ecosystems once closer adjacent surveys were included
de2026openclaw	system proposal	not ecosystem-primary	excluded from direct synthesis	mentions OpenClaw but is not primarily a direct observational or methodological study of the OpenClaw–Moltbook ecosystem as defined here