docs: add GRC_Claw to external project review

docs/receipts/T3MP3ST-pxpipe-GRC_Claw-review-20260705.json

@@ -0,0 +1,75 @@
+{
+  "schema": "fable.external_project.review.v1",
+  "createdAt": "2026-07-05T14:05:00.000Z",
+  "taskLabel": "T3MP3ST-pxpipe-GRC_Claw-review",
+  "task": "Review T3MP3ST (autonomous red-teaming), pxpipe (token compression), and GRC_Claw (GRC automation) for fable-agent applicability",
+  "source": {
+    "classification": "external-project-review",
+    "items": [
+      "https://github.com/elder-plinius/T3MP3ST",
+      "https://github.com/teamchong/pxpipe",
+      "https://github.com/AAH20/GRC_Claw"
+    ],
+    "contentVerified": true,
+    "liveVerification": "GitHub API metadata + raw README fetched at review time"
+  },
+  "externalProjectReviews": [
+    {
+      "repo": "elder-plinius/T3MP3ST",
+      "stars": 815,
+      "license": "AGPL-3.0",
+      "description": "Multi-agent offensive-security meta-harness for autonomous red-teaming",
+      "keyFindings": [
+        "verify-claims pattern (24/24 green) — identical to fable-agent's receipt-first philosophy",
+        "Keyless — uses local agent as backbone, same as fable-agent's model-agnostic pipeline",
+        "90.1% pass@1 on XBEN security benchmark",
+        "AGPL-3.0 — copyleft, cannot merge code"
+      ],
+      "safeToVendor": false,
+      "decision": "learn-only — verify-claims validates fable-agent's approach"
+    },
+    {
+      "repo": "teamchong/pxpipe",
+      "stars": 2364,
+      "license": "MIT",
+      "description": "Cut Fable 5 token usage by rendering text context as images (~59-70% lower bill)",
+      "keyFindings": [
+        "~3.1 chars per image-token vs ~1 char per text-token on dense content",
+        "10/10 SWE-bench Lite both arms at -65% request size",
+        "Lossy: 13/15 hex strings on Fable 5, 0/15 on Opus — silent confabulations",
+        "Escape hatch for byte-exact content (keeps lossy items as text)"
+      ],
+      "safeToVendor": true,
+      "decision": "advisory — token compression relevant but lossy nature requires careful routing"
+    },
+    {
+      "repo": "AAH20/GRC_Claw",
+      "stars": 2,
+      "license": "MIT",
+      "description": "ISO 42001-compliant agentic AI governance engine — swarm harness, anti-swarm WAF, MAVLink/UAS compliance, a2zsoc.com bridge",
+      "keyFindings": [
+        "Massive scope — 90 packages, 375+ cross-framework mappings, Terraform provider, VS Code extension, MCP server",
+        "Primarily a GRC (Governance, Risk, Compliance) platform, not an agent harness",
+        "Relevant package: Agent Policy Firewall + agent attestation ledger for MCP/AI tool calls",
+        "Commercial A2Z SOC hosted platform — the OSS chassis is the inspectable engine",
+        "Very early (2 stars) but well-structured with CLI, SDK, MCP server"
+      ],
+      "relevantPatterns": [
+        "Agent Policy Firewall — governs tool calls, model routing, memory (same problem fable-agent solves)",
+        "Agent attestation ledger — logs model/tool/memory decisions without exposing sensitive data",
+        "Evidence graph with verifier network — similar to fable-agent's receipt verification"
+      ],
+      "safeToVendor": true,
+      "decision": "advisory — GRC_Claw's agent policy firewall and attestation ledger are directly relevant to fable-agent's governance pattern"
+    }
+  ],
+  "fableAgentAlignment": [
+    "All three repos validate fable-agent's approach from different angles:",
+    "T3MP3ST: verify-claims pattern = receipt-first philosophy",
+    "pxpipe: token compression for pipeline context (repo maps, tool docs)",
+    "GRC_Claw: Agent Policy Firewall + attestation ledger = same governance problem"
+  ],
+  "skipped": ["actual integration or vendoring", "benchmark comparisons", "deploy actions"],
+  "deployAttempted": false,
+  "autoPatchProven": false
+}