Control online

Cloudflare

State: Durable Object
Placement: provider adapters
Content capture: off

Fleet composition / Cloud control

Fleet

Create child core

New claw

Claw name Intended user subject Intended user label Identity source Deployment target Appliance profile Inference model Slack connection Direct messages Group visibility Child log level

One claw, one core.Creates a dedicated Gateway, state root, pairing store, and OS identity. Nothing is cloned from another claw.

Generation-fenced rollout

Apply policy

A

Managed fieldsInference, Slack enabled state, native DM/group access, and child log level

B

Never changesCredentials, OAuth, pairing, sessions, memory, agent directories

Policy Version Canary

Target claws

Select a policy and target claws, then preview the field-level changes.

Immutable managed policy

New policy

Each save creates an immutable version. Applying an older version is the rollback path. Secrets and identity state are outside the policy boundary.

Policy name Description Primary model Fallback models Slack connection Direct-message visibility Group visibility Child log level

Native access onlyVisibility is expressed through each child’s existing OpenClaw DM pairing and group allowlist settings. Crabhelm adds no parallel user ACL.

Unverified batch create

Add maintainer labels

Paste one GitHub-style label per line. These labels are not verified against GitHub and use manual identities; use authenticated GitHub import for stable numeric identities. Native user pairing still happens inside each child.

Maintainer labels

Deployment target Appliance profile Inference model Slack connection Direct messages Group visibility Child log level

Partial successEach claw is independently persisted and reconciled. Failed handles remain visible in the result; successful claws are not rolled back.

Authenticated member discovery

Import from GitHub

Preview organization members, a team, or repository maintainers. GitHub numeric IDs become stable intended-user identities; no GitHub credentials are copied into child cores.

Organization Source Team slug Organization role

Preview the source before choosing recipients.

Deployment target Appliance profile Inference model Slack connection Direct messages Group visibility Child log level

Existing permissions remain native.Import creates desired child cores. Recipients still cannot chat until their child’s Slack connection and native DM pairing are complete.

Cloud control plane

Connect operator

Use the Crabhelm operator token. It authenticates control-plane requests and is never sent to agent machines.

Operator token