git:20261001.acb3521 to git:20261003.12a46c7

# AGENTS.md - Your Workspace

This folder is home.

## Every Session

Use the workspace files already supplied in the current context. OpenClaw injects the

bootstrap files according to the session profile; loading a file and reading it again

are not separate requirements.

- `SOUL.md` / `USER.md`: use the supplied identity and preferences; read missing files only when relevant.

- Direct chat: use injected `MEMORY.md` and `TOOLS.md`; read a missing one when its rules or routes are needed.

Keep main-session memory out of group/shared contexts.

- Investment questions: read `INVESTMENT_SOP.md` and the selected skill, then load relevant data.

- Ordinary chat and explicit task delegation: answer or forward the request with known context.

Investigate only missing routing facts; let the delegated worker inspect code, issues and CI.

Requests to investigate or optimize together stay in the current conversation unless delegation is requested.

- A user instruction naming Claude Code (Claude/claudecode), Codex, or OpenCode as the actor

("让 claudecode 看看…", "have Codex fix…") is explicit delegation, even for a small task

and without words such as "委派" or "后台跑". The named worker is distinct from the main

session even when both use the same model family. Use `agent-dispatch` and return after

successful dispatch. Explicit "你直接做 / 当前会话做 / 不要委派" ("do it here / current

session / no delegation") instructions override this routing. Already-dispatched workers

(`AGENT_DISPATCH_TASK_ID` or the unattended 【派发约定】) finish their task themselves;

they do not dispatch it again.

- Isolated cron/subagent runs: follow their explicit context profile and job instructions, not the direct-chat startup path.

## kcn 偏好

详见 `USER.md` § 沟通偏好 + § 不要做的事。要点：表格、不 hedging、数据缺口必说、terse 风格、14:00 HKT 也盘中查。

## Git hook (one-time setup per clone)

```bash

git config core.hooksPath .githooks

```

`.githooks/pre-commit` enforces on every commit (openclaw cron / GH Action / manual):

- portfolio.json valid JSON + required structure

- memory/*-plan.json schema (bucket enum, trigger_type enum, confidence ∈ [0,1])

- the dashboard write set rebuilds when portfolio.json is staged, but is no longer

staged with it: since #319 the dashboard payloads live on the `data-plane` branch and

`git add` on a now-ignored path fails the commit rather than skipping

- paranoid scan for leaked API keys (`sk-…`, `tp-…`, `FINNHUB_API_KEY=`, etc.)

Override with `--no-verify` if false positive (rare).

## Git Auto-Commit Rules

The workspace is a local git repo. **`origin` is the public repo `github.com/KCNyu/clawock`** — the

This table governs the live runtime workspace and its scheduled writers. Interactive

Codex/Claude code changes follow the PR workflow in the next section.

After any of the following changes, run a git commit automatically — no need to ask:

| Change | Commit |

|---|---|

| `portfolio.json` updated (price refresh / buy / sell) | `portfolio: <brief>` |

| Harness produced new `memory/{date}-pre-open.md` + `-plan.json` | `memory: daily deep brief <date>` (postflight auto-commits) |

| KCNyu harness/publisher refreshed dashboard outputs | publish the complete semantic generation through the data plane; do not stage individual generated files ad hoc |

| `assets/data/risk.json` refreshed via `clawock portfolio-risk` | bundled with brief commit |

| `memory/decisions.jsonl` execution status marked via `clawock mark-followed` | `decisions: mark execution` |

| Package, profile or `ops/` code changed | `refactor:`/`fix:`/`feat: <what changed>` (via PR, never direct) |

| Workspace docs changed (SOUL/AGENTS/TOOLS/USER/CLAUDE/README) | `docs: <what changed>` |

Message style: `<type>: <concise description>`, Chinese is fine. Commit message

bodies use real newlines (multi-line `-m` / heredoc), never a literal `\n`

(#615: two past commits shipped the two characters `\n` and rendered as one

blob).

**Never commit:** `.api_keys`, scratch `*.png`/`*.jpg` outside the shipped `site/assets/`/`docs/` allowlists, `.openclaw/`, `.clawhub/`, `memory/.dreams/`, `memory/.tmp/` (gitignored). Shipped `site/assets/*.png` are committed; `screenshot-refresh.yml` generates `site/assets/social-card.png` directly from the light editorial HTML/CSS composition plus a fresh dashboard capture, refreshes `site/assets/shadow-backtest.png`, and updates `site/assets/dashboard.gif` only on manual dispatch.

Push: harness postflight now **auto-pushes** after commit (rebase+retry on race).

Interactive Codex/Claude work must never push `master`; it may push only its task

branch to create or update a PR.

## Interactive Codex/Claude PR workflow

This section governs how the executing agent delivers changes; it does not decide

whether the OpenClaw main session should handle a user request inline. Apply the

delegation rules above before starting this workflow.

The live checkout `/root/.openclaw/workspace` must stay on `master` because cron and

OpenClaw write runtime data there throughout the day. Never switch that checkout to a

feature branch and never make interactive code edits in it.

For changes to code, scripts, workflows, skills, UI, configuration, or repository

documentation:

1. Create an isolated worktree from current `origin/master`, using a branch named

`codex/<task>` or `claude/<task>`.

2. Make and commit the change in that worktree, then push the task branch and open a PR.

3. Let GitHub Actions run the full test suite. Local full-suite runs are optional; the

required remote checks are the merge gate.

4. The author reviews its own diff, checks and merge state, and squash-merges once

the required checks pass (kcn, 2026-08-19). A cross-agent review happens only when

kcn asks for one in that task.

5. **Never post a review as a PR comment.** Both agents authenticate as the GitHub

user `KCNyu`, so a posted review reads as kcn talking to themself — findings go in

the interactive handoff instead. Do not add a signature, an `AI-REVIEW` prefix, or

any other marker to work around this; it is an identity problem, not a labelling one.

6. Finishing alone is never permission to skip a required check.

7. Do not merge while any required check is pending or failing. Fix the branch, push,

and let the PR rerun its checks.

8. Squash-merge only after required checks pass, then remove the task worktree/branch.

9. Apply the merge to this host with `ops/host/refresh_live.sh` — **merging is what

makes a fix live here; a release is for people who are not this host.** 本机不用为

每个修复发版。The install is editable, so a fast-forward is usually the whole job;

the script re-runs the launcher installer only when `pyproject.toml` moved, the

DSH plugin installer only when `examples/dsh/packages/clawock-dsh/` moved and the

agent-dispatch runner installer only when the installed runner differs from the checkout, then

verifies what is actually serving. Rule and evidence:

`docs/operations/release.md` § Running the latest code on this host.

Public GitHub issues, PRs and comments must not link third-party repositories, issues, PRs or

commits, use owner/repo#N or owner/repo@revision references, or mention third-party users.

Describe the idea in your own words and name the project as plain text. Keep external source

links in repository documentation instead; avoid cross-reference backlinks and notifications.

### Closing issues

Handle every open issue on its evidence; there is no issue-count ceiling. Close verified fixes

as completed with the merged PR or reproducible verification. For patrol findings that are

false, duplicates, out of scope, or deliberately not worth fixing, record the verified reason

and close as not planned (or apply `patrol:noise`). These closure signals feed patrol's quality

feedback; do not mark an unimplemented finding completed merely to clear the queue. For a

partially resolved digest, record each item's result and keep the unresolved items open.

Runtime-generated market data, snapshots, reports, ledgers, and dashboard artifacts

remain on the existing direct-to-`master` bot path. They do not open high-frequency PRs.

Never use the repository-admin bypass for an interactive code change.

## Memory

You wake up fresh each session. `MEMORY.md` is your continuity, and it **is** in

the repository (#1074) — it is yours: openclaw's dreaming job appends to it at

03:00 HKT and `ops/host/commit_dreaming.sh` commits it at 03:20. Direct chat has it

injected; isolated cron runs neither inject nor read it (their profile excludes it),

so a rule a scheduled run must obey belongs in its payload, SKILL mode or postflight

gate, not only here. Keep it self-contained; write the conclusion into the index

rather than into a side file.

interactive coding agents (Claude Code / Codex) in their own memory format, their

durable store is `/root/.shared-memory`, and a copy here is a leak. `.gitignore`

and `.githooks/pre-commit` both refuse that class; `ops/system_check.py` reports

- **Long-term:** `MEMORY.md` — curated wisdom; **only load in main session**, do NOT load in shared contexts (Discord, group chats)

- Don't keep "mental notes" — if it matters, write it to `MEMORY.md` (or, for the

interactive coding agents, their own durable memory outside this repository).

- Dated diaries (`memory/YYYY-MM-DD.md`) were retired in #1038: untracked first,

then removed from disk. They were raw session logs nothing read back — the

curated surfaces (`MEMORY.md`, the interactive agents' own memory) carry what

actually gets reused. Do not start writing them again.

## Safety

- Don't exfiltrate private data

- Don't run destructive commands without asking

- `trash` > `rm`

- External actions (emails, public posts) → ask first

- Internal actions (read, organize, edit workspace) → freely

## Tools & Skills

Skills live under `skills/<name>/SKILL.md`. **Full routing + edge-cases → `TOOLS.md` § Skill 路由表.**

Runtime commands come from the installed distributions: portable workflows and

tools, harness, watchdogs and automation all use the installed `clawock` distribution

entry points. Host, publishing, CI and growth wiring lives under `ops/`. Never

recover an old command by executing a root script or a file under `scripts/data/`.

Default to action: pick the skill, run the script, return the answer — don't ask permission unless going destructive.

## Heartbeats

If you receive a heartbeat poll, openclaw auto-injects:

> Read HEARTBEAT.md if it exists. Follow it strictly. If nothing needs attention, reply `HEARTBEAT_OK`.

So just follow `HEARTBEAT.md`. Don't repeat old tasks. Reply `HEARTBEAT_OK` when idle.

In group chats: be smart about when to contribute. Reply only when adding genuine value. Otherwise stay silent. Don't be the bot that responds to everything.

## Make It Yours

Add your own conventions as you learn what works. Keep this file short.