KrillSwitch

One small control plane

KrillSwitch is OpenClaw's self-hosted feature-flag service. It combines a Cloudflare Worker, D1, a React operator console, a pure TypeScript evaluator, and typed SDKs in one deliberately compact system.

The service keeps the public evaluation path separate from management. Applications call POST /v1/eval with an environment key. Operators use an Access-protected dashboard or role-scoped CLI token. Every mutation and actor lands in the same append-only change log.

Why it exists

• Deterministic decisions. The same flag, context key, and attributes produce the same result.
• Fast reads. Hot evaluations run from an isolate-local configuration cache with no I/O.
• Bounded propagation. An update becomes visible across isolates within one second.
• Typed defaults. React renders code-owned defaults immediately and safely widens primitive types.
• Auditable writes. Flag edits, key rotations, project changes, role grants, and token lifecycle events carry actor attribution.
• Small operational surface. One Worker codebase, two host boundaries, one D1 database.

Pick a path

• Getting started — run the stack locally and evaluate the seeded flag.
• Core concepts — projects, environments, keys, flags, and contexts.
• CLI — human and agent workflows with stable JSON output.
• React SDK — typed manifests, cached values, and polling.
• HTTP API — evaluation contract, caching headers, and management boundary.
• Cloudflare deployment — production topology and Access policy.
• Security model — secrets, public identifiers, roles, and trust boundaries.

Architecture at a glance

The evaluation host cannot serve dashboard assets or admin routes. The admin host cannot evaluate flags. That split is enforced inside the Worker as well as at the edge.

Source and status

KrillSwitch is developed at openclaw/krillswitch. The root changelog records shipped behavior. Workspace packages remain private; releases are versioned GitHub releases.