Lanterns is the Claude Desktop distribution of the NightClaw protocol — a file-based operating system that gives Claude a governed workspace with persistent memory, append-only audit trails, and autonomous project management across fresh sessions.
What the protocol guarantees
All state mutations go through named R5 bundle transactions with declared preconditions. The schema decides what the LLM is allowed to do — before it does it. Invalid writes are rejected before any file is touched.
Every field change is logged with two timestamps — effective and recorded. Every session is registered. The audit log is append-only; no session can edit or delete entries. Reconstruct what happened across weeks of autonomous work without trusting the LLM's memory.
The workspace grows smarter across sessions. Memory, audit trail, change log, project state, and OS lessons accumulate as files. Every pass starts from what prior passes wrote — not from scratch. Stateless sessions, compounding intelligence.
The audit trail
Run three commands after a week of autonomous operation. Get a deterministic, queryable record of every decision, every write, every state change — independent of anything the LLM remembers. SHA-256 signed governance files halt the next session if anything drifted outside the protocol.
The T-step pass lifecycle
Every worker session follows the same deterministic T0–T9 lifecycle. Each step calls an engine command that curates only the context that step needs — fresh sessions never reload irrelevant history.
SHA-256 verification of all 11 protected files. Crash recovery check. If integrity fails, the session halts immediately — no lock acquired, no files read.
Deterministic project selection from ACTIVE-PROJECTS.md — status, escalation, priority filtering. No LLM token cost for routing decisions.
Routing-critical fields extracted via longrunner-extract before reading the full LONGRUNNER. One bounded objective executed.
Output checked against pass criteria. Three-question quality test applied (Expert, Durable Asset, Compounding). Quality score enforced as a typed schema field — not a comment.
longrunner_update bundle fires. Preconditions validated. Field mutations written atomically. Change-log rows emitted automatically for every changed value.
G1 (generalizable) + G2 (not already documented via dedup check). If both pass, one sentence written to the appropriate OPS file. The protocol improves from real operation.
session_close bundle releases LOCK.md, writes SESSION-REGISTRY entry, appends daily memory. Always runs. No exceptions.
OPS-QUALITY-STANDARD.md
After every pass, the worker applies three questions — encoded in the schema, enforced by the bundle executor, reviewed independently by the manager session. A pass that completes but fails quality is recorded as WEAK or FAIL and triggers a retry.
Q1
"Would a domain expert find this output useful, surprising, or actionable?"
Passes if: the output contains at least one finding that required actual research or synthesis — not just retrieval of what a domain expert already knows.
Q2
"Will this output be useful in 30 days, or does it expire with today's context?"
Passes if: at least one durable artifact is produced — a ranked list, schema, validated finding, reusable script, field map, or decision that compounds across future passes.
Q3
"Does this output make the next pass faster, smarter, or higher-leverage?"
Passes if: the next_pass objective is more specifically scoped after this pass than before it — or an OPS file was improved from the work.
last_pass.quality:
STRONG
ADEQUATE
WEAK
FAIL
Model tiering
Each project pass declares one of three model tiers — written into the LONGRUNNER as a typed field. At T9.5, the engine emits a tier advisory: it cannot programmatically switch the Cowork scheduled task's default model, so it records the recommendation as audit metadata. The operator maps tiers to specific Claude model IDs once in MODEL-TIERS.md at install, then manually updates the scheduled task when a tier change matters.
SET_MODEL_TIER:ADVISORY:tier=standard:model=<id>:platform=cowork
— switch not executable on Cowork; tier recorded as advisory metadata.
| Tier | Use for | Cost profile | Operator action on advisory |
|---|---|---|---|
| lightweight | Structured execution, file writes, data transforms, low-judgment passes | Lowest | Set Cowork scheduled task default model to your Haiku mapping |
| standard | Research, synthesis, multi-step reasoning, default for new projects | Mid | Set Cowork scheduled task default model to your Sonnet mapping |
| heavy | Complex judgment, architecture decisions, long-form documents | Highest | Set Cowork scheduled task default model to your Opus mapping |
Protocol portability
Lanterns is the proof that NightClaw was never specific to any single platform — including OpenClaw. The governance layer, schema, bundles, and audit mechanics are identical. Only the runtime and scheduling layer changes.
| Dimension | NightClaw on OpenClaw | Lanterns (Claude Cowork) |
|---|---|---|
| Runtime | OpenClaw | Claude Desktop + Cowork |
| Scheduling | OpenClaw cron sessions | Claude projects scheduled tasks |
| Models | Multi-provider via OpenClaw config | Anthropic Claude only (Opus 4.6, Haiku, etc.) |
| Installation | OpenClaw workspace setup | bash scripts/install.sh + Cowork project + 2 scheduled tasks |
| T-step protocol | Identical — T0 through T9 | |
| Governance schema | Identical — R1 through R6, CL5 | |
| Audit trail | Identical — append-only, two timestamps | |
| Quality standard | Identical — OPS-QUALITY-STANDARD.md | |
Getting started
Lanterns is a reference implementation, not a product. Initial setup requires comfort with the command line. Full install guide in DEPLOY-CLAUDE.md.
Clone the repo into your workspace folder. Run bash scripts/install.sh — it prompts for owner handle, workspace path, and Claude model IDs for each tier. Substitutes placeholders, generates SHA-256 hashes for protected files.
Open SOUL.md, replace {DOMAIN_ANCHOR} with 2–3 sentences describing your domain focus. Re-sign: bash scripts/resign.sh SOUL.md. This is what the idle cycle uses to propose your first autonomous project.
Run the verification suite — integrity check, schema lint, SCR verify, bundle validation, preflight import, syntax check. All must pass before proceeding to Cowork setup.
Point a Cowork project at your workspace folder. Create two scheduled tasks — worker (every 6 hours) and manager (9 AM daily) — by pasting the contents of the respective .skill.md files from DEPLOY-CLAUDE.md § Step 6.
Open source · Apache 2.0
Explore the repo, read the protocol proof, or see what compounding autonomous work looks like in the cinematic demo.