Mission#

Set up the Max-src/openclaw-workspace private repo so we can sync the workspace + agent identities to GitHub safely. The repo MUST stay private. Secret values MUST never reach a commit.

What lives in the repo#

Under repo root:

• workspace/ ← mirror of ~/.openclaw/workspace/ (everything except .runs/, .trash/, .next/, node_modules/)
• agents/<id>/agent/ ← each agent's identity dir (IDENTITY.md, AGENTS.md overrides, SOUL.md if present) — NO sessions/*.jsonl
• workspaces/<id>/ ← each worker's workspace folder (Debbie, Chris, Kelly)
• config/openclaw.json ← sanitized copy of ~/.openclaw/openclaw.json with all secrets replaced by env-var refs
• cron/jobs.json ← scheduled job definitions (these contain no secrets but verify before commit)
• bootstrap.sh ← the restore script (see t-043)
• RESTORE.md ← human-readable restore guide
• .gitignore ← the safety net

.gitignore (strict)#

# Runtime / generated
.runs/
.trash/
.next/
node_modules/
*.log
.DS_Store

# Secrets — defense in depth
.env
.env.*
*token*
*secret*
*credential*
*api_key*
*apikey*

# Per-session transcripts (too noisy + privacy)
agents/*/sessions/
workspaces/*/sessions/
.openclaw/agents/*/sessions/

Secret-stripping logic#

When syncing ~/.openclaw/openclaw.json → config/openclaw.json, recursively walk the JSON and replace any value matching:

• apiKey keyed string → { "source": "env", "provider": "default", "id": "<UPPER_SNAKE_KEY>" }
• token keyed string → same env-ref pattern
• Anything looking like sk-*, long base64 strings ≥32 chars in suspicious keys → env ref
• For any { source: env, ... } shape → keep as-is (already a ref)

A pre-commit hook MUST grep the staged files for likely secrets one more time and abort if found:

git diff --cached | grep -E "(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|xoxb-)"

Acceptance criteria#

• Repo Max-src/openclaw-workspace exists, is private, has the structure above
• .gitignore covers all listed paths
• A test commit of the current workspace state has zero secret values in any file
• git config --local includes a pre-commit hook that runs the secret regex check
• Repo visibility check (gh repo view --json visibility) returns PRIVATE
• README at the repo root explains what this repo is and points to RESTORE.md

Files / locations#

• Repo: Max-src/openclaw-workspace
• Local mirror: ~/.openclaw-backup/ (Chris's working dir for sync — outside the workspace itself to avoid feedback loops)

Notes#

• t-024 (older task) was the original placeholder for this; refresh it once t-042-t-045 ship.
• Don't touch the actual ~/.openclaw/ files when syncing — read only, write to the mirror dir, then push.