git:20261003.12a46c7 to git:20261004.49633a6

- # AGENTS.md - Your Workspace

- This folder is home.

- ## Every Session

- Use the workspace files already supplied in the current context. OpenClaw injects the

- bootstrap files according to the session profile; loading a file and reading it again

- are not separate requirements.

- - `SOUL.md` / `USER.md`: use the supplied identity and preferences; read missing files only when relevant.

- - Direct chat: use injected `MEMORY.md` and `TOOLS.md`; read a missing one when its rules or routes are needed.

- Keep main-session memory out of group/shared contexts.

- - Investment questions: read `INVESTMENT_SOP.md` and the selected skill, then load relevant data.

- - Ordinary chat and explicit task delegation: answer or forward the request with known context.

- Investigate only missing routing facts; let the delegated worker inspect code, issues and CI.

- Requests to investigate or optimize together stay in the current conversation unless delegation is requested.

- - A user instruction naming Claude Code (Claude/claudecode), Codex, or OpenCode as the actor

- ("让 claudecode 看看…", "have Codex fix…") is explicit delegation, even for a small task

- and without words such as "委派" or "后台跑". The named worker is distinct from the main

- session even when both use the same model family. Use `agent-dispatch` and return after

- successful dispatch. Explicit "你直接做 / 当前会话做 / 不要委派" ("do it here / current

- session / no delegation") instructions override this routing. Already-dispatched workers

- (`AGENT_DISPATCH_TASK_ID` or the unattended 【派发约定】) finish their task themselves;

- they do not dispatch it again.

- - Isolated cron/subagent runs: follow their explicit context profile and job instructions, not the direct-chat startup path.

- ## kcn 偏好

- 详见 `USER.md` § 沟通偏好 + § 不要做的事。要点：表格、不 hedging、数据缺口必说、terse 风格、14:00 HKT 也盘中查。

- ## Git hook (one-time setup per clone)

- git config core.hooksPath .githooks

- ```

- `.githooks/pre-commit` enforces on every commit (openclaw cron / GH Action / manual):

- - portfolio.json valid JSON + required structure

- - memory/*-plan.json schema (bucket enum, trigger_type enum, confidence ∈ [0,1])

- - the dashboard write set rebuilds when portfolio.json is staged, but is no longer

- staged with it: since #319 the dashboard payloads live on the `data-plane` branch and

- `git add` on a now-ignored path fails the commit rather than skipping

- - paranoid scan for leaked API keys (`sk-…`, `tp-…`, `FINNHUB_API_KEY=`, etc.)

- Override with `--no-verify` if false positive (rare).

- ## Git Auto-Commit Rules

- The workspace is a local git repo. **`origin` is the public repo `github.com/KCNyu/clawock`** — the

- published investment contents (positions, plans, daily briefs and the curated

- OpenClaw memory) are intentionally public per kcn's instruction. This does not

- authorize publishing private chat/session metadata, credentials or coding-agent memory.

- This table governs the live runtime workspace and its scheduled writers. Interactive

- Codex/Claude code changes follow the PR workflow in the next section.

- After any of the following changes, run a git commit automatically — no need to ask:

- | Change | Commit |

- | `portfolio.json` updated (price refresh / buy / sell) | `portfolio: <brief>` |

- | Harness produced new `memory/{date}-pre-open.md` + `-plan.json` | `memory: daily deep brief <date>` (postflight auto-commits) |

- | KCNyu harness/publisher refreshed dashboard outputs | publish the complete semantic generation through the data plane; do not stage individual generated files ad hoc |

- | `assets/data/risk.json` refreshed via `clawock portfolio-risk` | bundled with brief commit |

- | `memory/decisions.jsonl` execution status marked via `clawock mark-followed` | `decisions: mark execution` |

- | Package, profile or `ops/` code changed | `refactor:`/`fix:`/`feat: <what changed>` (via PR, never direct) |

- | Workspace docs changed (SOUL/AGENTS/TOOLS/USER/CLAUDE/README) | `docs: <what changed>` |

-

- Message style: `<type>: <concise description>`, Chinese is fine. Commit message

- bodies use real newlines (multi-line `-m` / heredoc), never a literal `\n`

- (#615: two past commits shipped the two characters `\n` and rendered as one

- blob).

- **Never commit:** `.api_keys`, scratch `*.png`/`*.jpg` outside the shipped `site/assets/`/`docs/` allowlists, `.openclaw/`, `.clawhub/`, `memory/.dreams/`, `memory/.tmp/` (gitignored). Shipped `site/assets/*.png` are committed; `screenshot-refresh.yml` generates `site/assets/social-card.png` directly from the light editorial HTML/CSS composition plus a fresh dashboard capture, refreshes `site/assets/shadow-backtest.png`, and updates `site/assets/dashboard.gif` only on manual dispatch.

-

- Push: harness postflight now **auto-pushes** after commit (rebase+retry on race).

- Interactive Codex/Claude work must never push `master`; it may push only its task

- branch to create or update a PR.

- ## Interactive Codex/Claude PR workflow

- This section governs how the executing agent delivers changes; it does not decide

- whether the OpenClaw main session should handle a user request inline. Apply the

- delegation rules above before starting this workflow.

- The live checkout `/root/.openclaw/workspace` must stay on `master` because cron and

- OpenClaw write runtime data there throughout the day. Never switch that checkout to a

- feature branch and never make interactive code edits in it.

- For changes to code, scripts, workflows, skills, UI, configuration, or repository

- documentation:

- 1. Create an isolated worktree from current `origin/master`, using a branch named

- `codex/<task>` or `claude/<task>`.

- 2. Make and commit the change in that worktree, then push the task branch and open a PR.

- 3. Let GitHub Actions run the full test suite. Local full-suite runs are optional; the

- required remote checks are the merge gate.

- 4. The author reviews its own diff, checks and merge state, and squash-merges once

- the required checks pass (kcn, 2026-08-19). A cross-agent review happens only when

- kcn asks for one in that task.

- 5. **Never post a review as a PR comment.** Both agents authenticate as the GitHub

- user `KCNyu`, so a posted review reads as kcn talking to themself — findings go in

- the interactive handoff instead. Do not add a signature, an `AI-REVIEW` prefix, or

- any other marker to work around this; it is an identity problem, not a labelling one.

- 6. Finishing alone is never permission to skip a required check.

- 7. Do not merge while any required check is pending or failing. Fix the branch, push,

- and let the PR rerun its checks.

- 8. Squash-merge only after required checks pass, then remove the task worktree/branch.

- 9. Apply the merge to this host with `ops/host/refresh_live.sh` — **merging is what

- makes a fix live here; a release is for people who are not this host.** 本机不用为

- 每个修复发版。The install is editable, so a fast-forward is usually the whole job;

- the script re-runs the launcher installer only when `pyproject.toml` moved, the

- DSH plugin installer only when `examples/dsh/packages/clawock-dsh/` moved and the

- agent-dispatch runner installer only when the installed runner differs from the checkout, then

- verifies what is actually serving. Rule and evidence:

- `docs/operations/release.md` § Running the latest code on this host.

- Public GitHub issues, PRs and comments must not link third-party repositories, issues, PRs or

- commits, use owner/repo#N or owner/repo@revision references, or mention third-party users.

- Describe the idea in your own words and name the project as plain text. Keep external source

- links in repository documentation instead; avoid cross-reference backlinks and notifications.

- ### Closing issues

- Handle every open issue on its evidence; there is no issue-count ceiling. Close verified fixes

- as completed with the merged PR or reproducible verification. For patrol findings that are

- false, duplicates, out of scope, or deliberately not worth fixing, record the verified reason

- and close as not planned (or apply `patrol:noise`). These closure signals feed patrol's quality

- feedback; do not mark an unimplemented finding completed merely to clear the queue. For a

- partially resolved digest, record each item's result and keep the unresolved items open.

- Runtime-generated market data, snapshots, reports, ledgers, and dashboard artifacts

- remain on the existing direct-to-`master` bot path. They do not open high-frequency PRs.

- Never use the repository-admin bypass for an interactive code change.

- ## Memory

- You wake up fresh each session. `MEMORY.md` is your continuity, and it **is** in

- the repository (#1074) — it is yours: openclaw's dreaming job appends to it at

- 03:00 HKT and `ops/host/commit_dreaming.sh` commits it at 03:20. Direct chat has it

- injected; isolated cron runs neither inject nor read it (their profile excludes it),

- so a rule a scheduled run must obey belongs in its payload, SKILL mode or postflight

- gate, not only here. Keep it self-contained; write the conclusion into the index

- rather than into a side file.

- What must NOT enter the repository is coding-agent prose under `memory/*.md` — written by the

- interactive coding agents (Claude Code / Codex) in their own memory format, their

- durable store is `/root/.shared-memory`, and a copy here is a leak. `.gitignore`

- and `.githooks/pre-commit` both refuse that class; `ops/system_check.py` reports

- any that pile up on the host so somebody can clean them. The existing

- `memory/*-pre-open.md` exception is the published investment brief, not a coding-agent

- diary; its plan JSON is also runtime data. Do not create new prose exceptions.

- - **Long-term:** `MEMORY.md` — curated wisdom; **only load in main session**, do NOT load in shared contexts (Discord, group chats)

- - Don't keep "mental notes" — if it matters, write it to `MEMORY.md` (or, for the

- interactive coding agents, their own durable memory outside this repository).

- - Dated diaries (`memory/YYYY-MM-DD.md`) were retired in #1038: untracked first,

- then removed from disk. They were raw session logs nothing read back — the

- curated surfaces (`MEMORY.md`, the interactive agents' own memory) carry what

- actually gets reused. Do not start writing them again.

- ## Safety

- - Don't exfiltrate private data

- - Don't run destructive commands without asking

- - `trash` > `rm`

- - External actions (emails, public posts) → ask first

- - Internal actions (read, organize, edit workspace) → freely

- ## Tools & Skills

- Skills live under `skills/<name>/SKILL.md`. **Full routing + edge-cases → `TOOLS.md` § Skill 路由表.**

- Runtime commands come from the installed distributions: portable workflows and

- tools, harness, watchdogs and automation all use the installed `clawock` distribution

- entry points. Host, publishing, CI and growth wiring lives under `ops/`. Never

- recover an old command by executing a root script or a file under `scripts/data/`.

- Default to action: pick the skill, run the script, return the answer — don't ask permission unless going destructive.

- ## Heartbeats

- If you receive a heartbeat poll, openclaw auto-injects:

- > Read HEARTBEAT.md if it exists. Follow it strictly. If nothing needs attention, reply `HEARTBEAT_OK`.

- So just follow `HEARTBEAT.md`. Don't repeat old tasks. Reply `HEARTBEAT_OK` when idle.

- In group chats: be smart about when to contribute. Reply only when adding genuine value. Otherwise stay silent. Don't be the bot that responds to everything.

- ## Make It Yours

- Add your own conventions as you learn what works. Keep this file short.