[Feature]: Markdown memory written in session sandboxes does not reach the durable workspace #34

Activity

1. kangclzjc commented on Nov 2, 2026

   

   kangclzjc

   on Nov 2, 2026

   Last edited by kangclzjc

   More actions

   I looked into why the notes never persist, and wanted to share what I found plus a proposal for the "intended architecture" question.

   Why notes don't reach the durable workspace (as of 6b82377)

   • The agent sandbox is mode: all, backend: openshell, workspaceAccess: "ro" (nemoclaw.json#L80-L84), and the OpenShell plugin runs in remote mode (nemoclaw.json#L289). Per the OpenClaw 2026.6.10 sandboxing docs, ro disables write/edit/apply_patch on the agent workspace, and remote mode does not sync sandbox changes back. Notes written in the sandbox are lost with it, and the pre-compaction memory flush has no write path either.
   • Recall itself works. Init-config does not touch memory/, and the native-memory test shows Markdown notes are indexed and survive restarts without network access (chart-render.test.mjs#L101).
   • The persona files are re-copied on every start (openclaw.yaml#L222-L227), while SOUL.md tells the agent "These files are your memory. Read them. Update them." (SOUL.md#L38). The agent cannot do that today.

   Potential Proposal: a deterministic writer with read-only recall

   I would keep the workspace read-only for the agent. A writable workspace would let text from logs, alert annotations or chat messages persist into memory and steer later sessions (memory poisoning), and it would give View sessions a write path. Instead:

   1. A plugin-owned writer, not the agent, appends curated Markdown under workspace/memory/, for example memory/cases/<incident-id>.md. memory-core already indexes it with the configured full-text recall.
   2. The writer only takes records the system already trusts: completed investigations (for example the durable incident records proposed in Add persistent background alert investigation and native-channel report delivery #88 / feat: add Helm-managed native alert automation plugin #89), approval decisions including denial reasons, and operator-confirmed resolutions.
   3. A human review step decides what enters recall. Unreviewed drafts stay out of the index or are clearly marked as unverified.
   4. Each note carries provenance (incident or alert fingerprint, date, cluster, alert name, relevant driver and firmware versions) and a revalidation hint. Notes are structured summaries with secrets redacted, not raw logs.
   5. The agent keeps read-only access through memory_search and memory_get. AGENTS.md already treats operational systems as the source of truth (AGENTS.md#L65), so recalled notes remain hints to re-verify against live systems.
   6. SOUL.md is aligned with this design so it no longer asks the agent to update files it cannot write.

   Memory is shared by every session in a release (UI, Slack and other channels), which is another reason to keep notes as structured summaries. If the notes outgrow flat Markdown, the bundled OpenClaw memory-wiki plugin (provenance, claims, contradictions) could be evaluated as a later step.

   Happy to help prototype the writer if this direction looks reasonable.