OpenClaw memory architecture

Most memory systems fail at the write, not the read. OpenClaw's architecture takes that seriously: retrieval over notes is competitive with far heavier designs, so the effort goes into deciding what earns a place in long-term memory and proving where it came from. Here is the whole system, from the five principles to the poisoning defence they add up to.

Principles and tiers

• Five rules shape everything: no hidden state, because the model only remembers what is written to inspectable files; writing is the hard part, so curation moves off the reply path into a background pass; the write path is the security boundary, because content scanning cannot catch poisoned facts reliably; gates are deterministic with model judgment used only inside them; and failures never block replies, because every memory step in the reply path has a timeout, a fallback or both.
• The tiers are instructions written by humans and always injected, a curated core of long-term memory and the user file written by consolidation and injected when provenance is eligible, an episodic tier of daily notes and transcripts that is never injected but searchable, a prospective tier of standing intents and scheduled jobs that surfaces only when a trigger fires, and a review tier of diary entries meant for people.
• The boundary that matters is between curated and episodic: curated files are small, normally in context and written only through gated consolidation, while episodic files are large, append-friendly and reachable only through explicit search or the escalation lane, and nothing crosses without passing the promotion gates.
• Every indexed entry carries provenance in database columns rather than prose: an origin class from a closed set of owner, agent, untrusted and system, the kind of session it came from, and an observed timestamp with a supersession key so newer observations retire older ones instead of piling up beside them; classification is conservative and never defaults to owner.

A fact recalled one hundred times stays one fact.

The write path and its gates

Durable memory has exactly one primary writer, the dreaming consolidation pass, and everything else feeds it: the agent appends observations to daily notes while working, the pre-compaction flush saves unwritten context, and ended sessions contribute their transcripts as evidence. Two hygiene rules keep the pipeline clean. Cron, heartbeat and sub-agent sessions produce no durable candidates at all, and content that was injected from memory is structurally marked so it is never re-extracted as new memory. Promotion then passes two gates in sequence. The deterministic gate ranks candidates by retrieval relevance, recall frequency, query diversity, recency, multi-day recurrence and conceptual richness, and excludes untrusted or system origins before any prompt is built, which is a precondition rather than a score penalty. The consolidation step then sends gated candidates plus the current file to a model turn that merges duplicates, retires superseded entries and keeps source anchors, and its output is accepted only if it validates, fits the budget and does not lose more than a bounded fraction of existing entries.

Recall in two lanes

• Lane one costs nothing: the curated files load at session start when their provenance is eligible and refresh per turn within budgets, ranked search multiplies hybrid relevance by an exponential recency decay with a thirty-day half-life and an importance multiplier assigned once at write time, and short trigger phrases attached to entries are matched by a fast lexical and vector prefilter, injecting at most three strongly matching entries per turn as hidden context.
• Auto-injection is restricted to the curated tier as a security property rather than a tuning choice: daily notes and transcripts never auto-inject regardless of match strength, and remain reachable only through explicit search tools or the escalation lane.
• Lane two is the blocking recall sub-agent, which runs by default only when the message shows recall intent and lane one produced no strong hit, because temporal and multi-hop questions are exactly where flat retrieval is weakest; an always mode restores unconditional recall and an off mode disables the lane.

OpenClaw memory overview is the practical guide to these files and OpenClaw dreaming the pass that owns promotion.

Why poisoning fails here

Memory is the persistence layer an injection attack wants, so the defence is structural rather than detective. Origin labels live in columns written by classification code and never parsed out of memory text, so prose claiming to be from the owner does not become owner content. Untrusted content can be stored, indexed and explicitly searched, but it is barred from the curated core and from auto-injection, and the only paths into the prompt wrap it in untrusted framing. Taint propagates through consolidation, so untrusted material cannot launder itself through a daily note and a theme reflection. Content origin also propagates within a turn: once a tool result declares network-sourced content, every assistant message after it in that turn is treated as untrusted until the next user message. Finally, every consolidation writes a summary and a pre-image trail, so what entered long-term memory, and from where, stays reviewable. OpenClaw active memory is the escalation lane and The OpenClaw user model the preference layer this architecture keeps separate.

On Diali

On Diali each customer runs their own assistant with its workspace and index on a persistent volume, which is the boundary this architecture assumes; daily snapshots and one-click restore are available through the Backups add-on (included on Max). Hosted OpenClaw on Diali describes the hosted assistant and Diali security the controls around it.

• Provenance is a column, not a sentence in the file.
• Cron and heartbeat sessions never produce durable memories.
• Untrusted content is searchable but never auto-injected.