Workspace + Agents Backup

Goal#

On any new machine, run one bootstrap script and end up with the exact same agent crew (Robbie/Debbie/Chris/Kelly), the same memory, the same identities, the same configuration — minus the secrets, which get re-injected from a separate vault.

What gets backed up#

In-repo (committed):

• ~/.openclaw/workspace/ — full workspace (AGENTS.md, SOUL.md, IDENTITY.md, MEMORY.md, daily memory logs, tasks, projects, team files, RELAY-PROTOCOL, conventions)
• ~/.openclaw/workspaces/debbie/, chris/, kelly/ — every worker's workspace
• ~/.openclaw/agents/<id>/agent/ — each agent's identity dir (IDENTITY.md, AGENTS.md overrides — NOT the sessions/* logs)
• ~/.openclaw/openclaw.json — config file with secrets stripped (replaced with env-var refs)
• ~/.openclaw/cron/jobs.json — scheduled job definitions
• ~/.openclaw/canvas/ — hosted embed documents (if any worth keeping)
• ~/projects/mission-control/ — Mission Control source (separately mirrored to its own repo, link only)

Excluded (.gitignored or stripped):

• .openclaw/.env — secrets, Maxime keeps these in his password manager
• ~/.openclaw/agents/*/sessions/*.jsonl — per-session transcripts, too noisy + may contain private chat
• ~/.openclaw/state/ — runtime state, regenerated on boot
• *.log, .runs/*, .next/, node_modules/
• Any file matching *token*, *secret*, *credential* (defense-in-depth grep before commit)

Repo#

• Name: Max-src/openclaw-workspace (already exists per MEMORY.md, was planned in t-024)
• Visibility: private, forever. PAT scope repo, never delete_repo.

Bootstrap script (bootstrap.sh at repo root)#

1. git clone Max-src/openclaw-workspace ~/.openclaw-restore
2. mkdir -p ~/.openclaw && rsync repo contents to ~/.openclaw/
3. Tell user: "create ~/.openclaw/.env with these env vars: ANTHROPIC_API_KEY, DISCORD_BOT_TOKEN, GITHUB_TOKEN, ..."
4. Run: openclaw config validate
5. Run: openclaw gateway start
6. Show what's missing (list of secrets the user needs to fill in)

Schedule#

• Daily 02:00 SGT — auto-commit + push if anything changed
• Manual trigger via Mission Control "Sync now" button on the project page (separate task)

Tasks#

• t-042: Set up the openclaw-workspace repo structure + .gitignore + secret-stripping logic
• t-043: Write bootstrap.sh + restore docs (RESTORE.md)
• t-044: Schedule the daily sync cron job
• t-045: Add "Sync now" + "Last synced" UI to Mission Control project page

Risk / care#

• Secret stripping must be idempotent and aggressive — ALL real secret values replaced by env-var refs before commit. A leak here is bad.
• MEMORY.md contains personal context (Maxime's phone number is already in there). Public/leak risk = high. Repo MUST stay private. Add a pre-push hook that aborts if gh repo view --json visibility ever shows public.
• Don't commit machine-specific paths blindly — the workspace assumes /home/maxime/..., restore script needs to handle a different $HOME.