OpenClaw

Export is one immediate local command (`openclaw backup create`) with no provider involvement, but `openclaw backup restore` only verifies and extracts into an empty staging directory and refuses to write into live state; the owner must then stop the Gateway, move state into place or set OPENCLAW_STATE_DIR, run doctor and reinstall plugin dependencies. One shortfall: restore is not a single action that leaves the agent working.

• docs/cli/backup.md
• docs/install/migrating.md
• docs/install/backups.md
• src/commands/backup-restore.ts
• Migration guide - OpenClaw
• Backup - OpenClaw

The default full archive includes config, credentials, both SQLite databases (sessions, transcripts, memory index, audit events, cron jobs and runs, device identity, secret store) and the workspace with Markdown memory sources, so embeddings travel with their source text. Skipped `.jsonl`/`.log` files are legacy or diagnostic copies whose data now lives in SQLite; integrations re-link with owner-held credentials or the vendor's own OAuth clients (GitHub also accepts a PAT where OpenClaw's device-flow client ID is used).

• docs/cli/backup.md
• docs/reference/database-schemas/layout.md
• docs/concepts/agent-workspace.md
• docs/cli/cron.md
• src/agents/github-oauth-client.ts
• docs/gateway/config-tools/github-identity.md
• docs/plugins/google-meet/oauth-and-artifacts.md

The runtime is MIT-licensed with no licence key, account or payment gate. Provider services contacted by default (update check at telemetry.openclaw.ai, model catalog at catalog.openclaw.ai, ClawHub registry) are non-fatal and can each be disabled or pointed at an owner-chosen endpoint. Not verified hands-on with provider domains blocked; the App Store iOS companion's push relay is outside the graded offering.

• LICENSE
• src/infra/telemetry.ts
• src/model-catalog/remote-config.ts
• docs/gateway/config-runtime.md
• src/infra/clawhub-client.ts
• docs/platforms/ios.md

Local models are first-party (bundled Ollama and LM Studio providers, llama.cpp plugin), and memory embeddings, speech-to-text, TTS, vision and image generation have local options. Realtime Talk mode is registered only by Google and OpenAI providers, the Reef channel guard is restricted by schema to `openai` or `anthropic`, and no single minimum-model contract is published.

• docs/gateway/local-models.md
• docs/concepts/memory-search.md
• docs/nodes/audio.md
• docs/tools/media-overview.md
• docs/channels/reef.md
• extensions/reef/src/config-schema.ts

All authoritative agent state is SQLite and files under ~/.openclaw and the workspace on the owner's own host, and the self-installed offering needs no OpenClaw account or subscription, so a current copy is always in the owner's hands regardless of provider action.

• docs/install/backups.md
• docs/reference/database-schemas/layout.md
• docs/concepts/agent-workspace.md

State is local SQLite with the full DDL published in the repository, JSON5 config, Markdown workspace files and skills, and zstd-compressed JSONL transcript archives, all decodable with general-purpose tools. Credentials are stored locally and any encryption key is held on the owner's host. On the non-default OpenAI Responses route, OpenAI's encrypted server-side compaction item is a third-party artifact recorded here but not counted.

• docs/reference/database-schemas.md
• docs/reference/database-schemas/layout.md
• docs/reference/database-schemas/agent-schema-history.md
• src/state/openclaw-agent-schema.sql
• docs/help/faq/where-things-live-on-disk.md

Trajectory capture is on by default (`OPENCLAW_TRAJECTORY` ?? true) and `/export-trajectory` writes the system prompt, prompts, tool list and transcript including compactions; `diagnostics.cacheTrace` can log full per-request context. Model, tools and settings are visible via `/status`, `/tools`, `/context` and `openclaw config get`; recorded edge gaps (redacted exports, `/context` showing sizes only) are not counted.

• docs/tools/trajectory.md
• src/trajectory/runtime.ts
• docs/reference/prompt-caching.md
• docs/concepts/context.md
• docs/concepts/compaction.md
• docs/tools/slash-commands.md
• docs/cli/config.md

The default daily update check stores Cloudflare-derived location and platform data for a disclosed three months, not viewable item by item. ClawHub search telemetry is on by default (including app-recommendation searches during onboarding); query retention of 30 days is stated only in release notes, and no retention is published for ClawHub or catalog.openclaw.ai request logs (clawhub.ai has no privacy page), which counts as undisclosed under G12.

• docs/gateway/telemetry.md
• src/infra/telemetry.ts
• src/infra/clawhub-client.ts
• src/system-agent/setup-app-recommendations.ts
• docs/releases/2026.9.5.md
• Usage telemetry and update checks - OpenClaw
• Privacy Policy - OpenClaw

Sponsored promotions (`openclaw promos`) run only on explicit command, are labelled with the sponsor and are never injected into agent context; onboarding preselects no model provider. The Control UI plugin catalog applies ClawHub-hosted 'featured' ordering ('Hosted curation wins') with undisclosed criteria and no off switch, and the absence of paid placement rests only on non-binding homepage statements.

• docs/cli/promos.md
• src/commands/promos/list.ts
• src/plugins/provider-login-options.ts
• src/wizard/setup.app-recommendations.ts
• src/plugins/management-catalog.ts
• OpenClaw — Open-Source AI Assistant
• ClawHub

An audit ledger is on by default and covers agent runs and tool calls from all run entry paths, but three shortfalls apply: hook handlers and direct-send paths can act without a record; persistence is best-effort and drops entries on queue or storage failure with only a one-time Gateway log warning; and the ledger stores tool names without arguments or targets, is kept 30 days / 100,000 rows, while argument-bearing transcripts are pruned by default (e.g. isolated cron sessions after 24h).

• src/audit/audit-config.ts
• src/audit/audit-event-store.ts
• src/audit/agent-event-audit.ts
• src/audit/audit-event-writer.ts
• src/audit/audit-recorder.ts
• src/cron/session-reaper.ts
• src/config/sessions/store-maintenance.ts
• docs/gateway/audit.md
• docs/cli/audit.md

Ledger rows are plain SQLite rows with sequence numbers but no hash chain, signature or verifier; the only HMAC pseudonymises identifiers with a key stored in the same database, and the docs state the ledger is not a lossless compliance archive. The opt-in Reef plugin's hash chain covers only Reef traffic.

• docs/gateway/audit.md
• src/state/openclaw-state-db.paths.ts
• docs/channels/reef.md

By default sandbox mode is off, host exec runs with security 'full' and ask 'off', and the onboarding tool profile is 'full', so the agent's shell can modify or delete the state database holding the ledger. A documented first-party mode (sandbox mode 'all' with no workspace access, which denies gateway, cron and other tools) keeps the state directory out of reach, but it is non-default and trades away tool capability.

• src/agents/sandbox/config.ts
• src/infra/exec-approvals-config.ts
• src/commands/onboard-config.ts
• src/agents/sandbox/constants.ts
• docs/tools/exec.md
• docs/gateway/sandboxing.md

All required components I checked, including the main repository and the Windows companion, are public under MIT. The default npm package has a Sigstore-signed SLSA provenance attestation, but it records a release-tooling tag commit rather than the v2026.9.7 source commit (tied only through a pipeline-written build-info file), and no reproducible-build or owner verification procedure is documented.

• LICENSE
• package.json
• .github/workflows/openclaw-npm-release.yml
• .github/workflows/openclaw-npm-preflight.yml
• docs/install/installer.md
• npm attestations for openclaw@2026.9.7
• npm registry metadata openclaw@2026.9.7
• OpenClaw install.sh

No OpenClaw-issued account is in the identity chain: the agent acts through the owner's own channel accounts, and the gateway/device identity is a locally generated Ed25519 keypair used for client pairing, not for signing outbound actions. There is no cross-channel owner-held root, so attribution is per channel only (one gap).

• docs/concepts/architecture.md
• src/infra/device-identity.ts
• docs/channels/a2a.md
• docs/gateway/pairing.md

A default-on config change journal records changed paths with an origin label, config has .bak and last-known-good recovery, memory chunks carry partial provenance, and new workspaces are git-initialised but not auto-committed. Workspace and direct memory edits are not attributed, and restoring a full prior state needs manual activation after `backup restore`.

• src/config/io.audit.ts
• src/config/io.types.ts
• docs/cli/openclaw.md
• docs/gateway/configuration.md
• docs/concepts/memory-provenance.md
• src/agents/workspace.ts
• docs/cli/backup.md

Workspace instruction files (AGENTS.md, SOUL.md, USER.md etc.) are owner-editable and bundled skills can be overridden or disabled, but OpenClaw generates the base system prompt from fixed sections; the `systemPromptOverride` config was removed and replacement is possible only through plugin hooks (code), and some injected notices are 'built in and not configurable'.

• docs/concepts/system-prompt.md
• docs/gateway/doctor/config-migrations.md
• docs/plugins/hooks/prompt-and-session.md
• docs/tools/skills.md
• src/agents/system-prompt.ts

Core memory is Markdown in the workspace, editable in any editor or the Control UI, and the search index can be reset and rebuilt. Dreaming is on by default and keeps a SQLite recall store that can be viewed but only removed per session, with no item-level edit.

• docs/concepts/memory.md
• docs/concepts/dreaming.md
• docs/cli/memory.md
• docs/concepts/session-search.md

Owners can add tools from a local path, npm, git, archive, MCP servers or local skills without OpenClaw review (ClawHub moderation applies only to ClawHub installs), and any built-in tool can be removed with `tools.deny`, which takes precedence over allow.

• docs/cli/plugins/install.md
• docs/gateway/config-tools/tool-policy.md
• docs/gateway/security/tool-permissions.md

Sandboxing, exec approvals, external-content wrapping and install policy are owner-configurable, but several protections are locked: log/transcript redaction 'cannot be disabled by config', the Control UI CSP is 'not configurable', the config-write RPC rate limit is fixed, and local copies of official channel plugins cannot be marked trusted.

• docs/gateway/security/secrets-and-storage.md
• docs/web/control-ui/security-model.md
• docs/gateway/security/rate-limiting.md
• docs/cli/plugins/install.md
• docs/tools/exec-approvals.md

Gateway auto-update is off by default (`Boolean(cfg.update?.auto?.enabled)`), updates are applied only on owner request with version shown, and versions can be pinned. The model catalog refresh is on by default and can overlay behaviour-affecting model metadata at the next restart with only a log notice, but the owner can disable it or point it at a mirror (achievable basis).

• src/infra/update-startup.ts
• docs/install/updating/automatic-updates.md
• src/model-catalog/remote-config.ts
• docs/gateway/config-runtime.md
• src/infra/telemetry.ts

Instruction sources are limited per sender (DM pairing by default, allowlists), file and tool scope is per tool and path, subagents and cron follow the agent's tool policy, and spend is treated as met under G11 because OpenClaw has no payment capability. Outbound contact can be limited only per channel/provider or current conversation, not per recipient (one shortfall); the agent can edit its own config by default, but the owner can close this by denying the `openclaw` tool and sandboxing exec.

• src/security/dm-policy-shared.ts
• docs/gateway/permission-modes.md
• docs/gateway/config-tools/tool-policy.md
• docs/channels/whatsapp.md
• docs/security/network-proxy.md
• src/agents/tools/openclaw-delegate-tool.ts

Host exec, agent-requested config changes and Codex-harness MCP tools can be gated through documented config and CLI, but gating other tools (message send, browser, web fetch, cron creation) requires a plugin hook, so only a fixed set of classes can be gated without programming.

• docs/cli/approvals.md
• docs/tools/exec-approvals.md
• docs/tools/permission-modes.md
• docs/plugins/plugin-permission-requests.md

`/stop` aborts the current session's run, queue and child subagents, but cron jobs and other sessions continue; `openclaw gateway stop` halts everything only after a drain of up to 315 s under systemd, and the service is not disabled on Linux, so it can restart at boot without the owner.

• docs/help/faq/chat-commands-and-stopping.md
• docs/tools/subagents/operations.md
• docs/cli/gateway/service.md
• docs/automation/cron-jobs/managing-jobs.md

Feature statistics are opt-in (`telemetry.enabled === true`) and the update check sends no content or identifier and can be disabled. ClawHub search telemetry (query text) is on by default and opt-out only via an environment variable, and the only privacy policy (covering the mobile apps and extension) changes by posting without owner consent, with none covering the gateway.

• docs/gateway/telemetry.md
• src/infra/telemetry.ts
• src/infra/clawhub-client.ts
• src/model-catalog/remote-config.ts
• Usage telemetry and update checks - OpenClaw
• Privacy Policy - OpenClaw

Credentials are held only on the owner's host and are visible and revocable individually (`models auth list/logout`, `secrets store list/rm`, `channels logout`, `mcp logout`, `devices remove`, approval grants). Removing a secret-store value does not take effect in the running gateway until `openclaw secrets reload`, so revocation is delayed.

• docs/cli/secrets.md
• docs/cli/models.md
• docs/cli/channels.md
• docs/cli/devices.md

`openclaw uninstall --all` removes the service, state directory (config, credentials, secret store, device identity, sessions) and workspaces in one confirmed, synchronous command that reports each scope and exits non-zero on failure; no provider-side copy of the agent exists in the default offering. Local rolling logs in /tmp/openclaw are left for their 24-hour pruning.

• docs/cli/uninstall.md
• docs/install/uninstall.md
• src/commands/uninstall.ts
• docs/logging.md