Refactor runtime asset boundary

.github/workflows/compatibility-matrix.yml

@@ -59,6 +59,7 @@ jobs:
           HOME_DIR="${SETUP_COMPAT_HOME:-$TMP_ROOT/home}"
           mkdir -p "$HOME_DIR"
           export HOME="$HOME_DIR"
+          export STRONGCLAW_CONFIG_DIR="${STRONGCLAW_CONFIG_DIR:-$TMP_ROOT/config}"
           export STRONGCLAW_DATA_DIR="${STRONGCLAW_DATA_DIR:-$TMP_ROOT/data}"
           export STRONGCLAW_STATE_DIR="${STRONGCLAW_STATE_DIR:-$TMP_ROOT/state}"
           export TMP_ROOT
@@ -88,14 +89,21 @@ jobs:
       - run: |
           TMP_PARENT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
           TMP_ROOT="${SETUP_COMPAT_ROOT:-$TMP_PARENT/strongclaw-setup-compat}"
+          STRONGCLAW_CONFIG_DIR="${STRONGCLAW_CONFIG_DIR:-$TMP_ROOT/config}"
           export TMP_ROOT
+          export STRONGCLAW_CONFIG_DIR
           python - <<'PY'
           import json
           import os
           import pathlib
 
           payload = json.loads((pathlib.Path(os.environ["TMP_ROOT"]) / "openclaw.json").read_text(encoding="utf-8"))
           plugin_config = payload["plugins"]["entries"]["strongclaw-hypermemory"]["config"]
-          assert plugin_config["configPath"].endswith("platform/configs/memory/hypermemory.yaml")
+          expected_config_path = (
+              pathlib.Path(os.environ["STRONGCLAW_CONFIG_DIR"]).expanduser().resolve()
+              / "memory"
+              / "hypermemory.yaml"
+          )
+          assert plugin_config["configPath"] == expected_config_path.as_posix()
           assert plugin_config["autoRecall"] is True
           PY

.github/workflows/memory-plugin-verification.yml

@@ -42,6 +42,7 @@ jobs:
           npm install --prefix "$tool_dir" --no-fund --no-audit "openclaw@2026.3.13"
           export PATH="$tool_dir/node_modules/.bin:$PATH"
           cd platform/plugins/memory-lancedb-pro
+          npm ci --no-fund --no-audit
           env \
             -u AWS_PROFILE \
             -u AWS_ACCESS_KEY_ID \

MANIFEST.in

@@ -0,0 +1,4 @@
+graft src/clawops/assets/platform
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude .DS_Store

QUICKSTART.md

@@ -35,22 +35,25 @@ deactivate
 ## 2. Prepare the Varlock env contract
 
 You can prepare the env contract either manually or through the guided setup
-flow. `clawops setup` will create `platform/configs/varlock/.env.local`,
-repair missing keys, generate required local secrets, and prompt for missing
-runtime or provider-auth input when needed.
+flow. `clawops setup` and `clawops varlock-env configure` create the managed
+Varlock env under the StrongClaw config dir, repair missing keys, generate
+required local secrets, and prompt for missing runtime or provider-auth input
+when needed. On Linux that default path is usually
+`~/.config/strongclaw/varlock`; on macOS it is usually
+`~/Library/Application Support/StrongClaw/config/varlock`.
 
 Manual path:
 
 ```bash
-cp platform/configs/varlock/.env.local.example platform/configs/varlock/.env.local
-$EDITOR platform/configs/varlock/.env.local
+clawops varlock-env configure --non-interactive
+$EDITOR ~/.config/strongclaw/varlock/.env.local
 ```
 
 Before you continue, decide how OpenClaw should authenticate to an LLM provider.
 StrongClaw supports two setup paths:
 
 - guided/OpenClaw-managed: `make setup`, `uv run --project . clawops setup`, or `clawops setup` can launch `openclaw configure --section model`
-- env-driven: set provider keys plus optional model overrides in `platform/configs/varlock/.env.local`
+- env-driven: set provider keys plus optional model overrides in the managed `.env.local`
   - `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `ZAI_API_KEY`
   - optional `OPENCLAW_DEFAULT_MODEL` and `OPENCLAW_MODEL_FALLBACKS`
   - for local models, set `OLLAMA_API_KEY=ollama-local` and `OPENCLAW_OLLAMA_MODEL=<pulled-model>`
@@ -96,7 +99,7 @@ Equivalent explicit hypermemory path:
 
 ```bash
 clawops setup --profile hypermemory
-clawops hypermemory --config platform/configs/memory/hypermemory.yaml verify
+clawops hypermemory --config ~/.config/strongclaw/memory/hypermemory.yaml verify
 ```
 
 Explicit built-in OpenClaw path:
@@ -121,7 +124,7 @@ That setup flow:
 - fails fast if required installs or the post-bootstrap doctor checks do not pass
 - provisions the selected profile's memory and context assets
 - installs the vendored `memory-lancedb-pro` dependencies only for the `memory-lancedb-pro` profile
-- creates, normalizes, and validates the repo-local Varlock env contract under `platform/configs/varlock`
+- creates, normalizes, and validates the managed Varlock env contract under the StrongClaw config dir
 - prompts for missing Varlock runtime/provider settings when needed, including managed secret backend selection when you want Varlock plugins instead of local `.env` secrets
 - configures or validates OpenClaw model/provider auth before services are activated
 - renders and activates launchd or systemd service templates
@@ -196,12 +199,13 @@ The `openclaw-qmd` profile enables QMD-backed memory retrieval and indexes:
 - `platform/docs`
 - `platform/skills`
 - repo-root `*.md`
-- `platform/workspace/**/*.md`
-- optional `repo/upstream/**/*.md` when the upstream checkout exists
+- the managed StrongClaw workspace Markdown tree
+- the managed upstream checkout when that directory exists
 
 The default `hypermemory` profile enables the combined
 `lossless-claw` + `strongclaw-hypermemory` runtime, points the plugin at
-`platform/configs/memory/hypermemory.yaml`, enables `autoRecall`, keeps
+the rendered runtime config under `~/.config/strongclaw/memory/hypermemory.yaml`,
+enables `autoRecall`, keeps
 `autoReflect` disabled, and does not inherit the QMD overlay.
 
 ## 5. Verify the baseline again on demand

README.md

@@ -76,16 +76,20 @@ setups. Python `3.13` remains supported for explicit use and CI coverage.
 
 `make setup` runs the guided `clawops setup` workflow inside the managed
 environment. It bootstraps host prerequisites, creates or repairs
-`platform/configs/varlock/.env.local`, offers local or managed Varlock secret
-backends for provider auth, prompts for missing setup input when needed,
-configures OpenClaw model/provider auth, activates services, and runs the
-baseline verification gate. The lower-level CLI entrypoint remains available
-at `clawops setup` for manual or partial bring-up, and you can
-call the CLI directly with `uv run --project . clawops setup`.
+the managed Varlock env under the StrongClaw config dir, offers local or
+managed Varlock secret backends for provider auth, prompts for missing setup
+input when needed, configures OpenClaw model/provider auth, activates
+services, and runs the baseline verification gate. The lower-level CLI
+entrypoint remains available at `clawops setup` for manual or partial
+bring-up, and you can call the CLI directly with `uv run --project . clawops setup`.
 For a render-only pass that does not activate services yet, use
 `clawops setup --no-activate-services`; that path now defers model/provider
 auth until you are ready to start the gateway.
 
+The wheel now ships the runtime `platform` asset bundle, so package-safe
+commands such as `clawops render-openclaw-config`, `clawops setup`, and
+`clawops verify-platform ...` work outside a cloned StrongClaw checkout.
+
 By default, StrongClaw now renders and provisions the
 `hypermemory` stack. Set one embedding model name before you run
 the no-arg setup path:

SETUP_GUIDE.md

@@ -81,21 +81,24 @@ deactivate
 
 ## 4. Prepare the Varlock env contract
 
-You can let the guided setup path create and repair the repo-local Varlock env
-contract for you, or you can prepare it manually. The manual path is:
+You can let the guided setup path create and repair the managed Varlock env
+contract for you, or you can prepare it manually. The managed path defaults to
+`~/.config/strongclaw/varlock` on Linux and
+`~/Library/Application Support/StrongClaw/config/varlock` on macOS. The manual
+path is:
 
 ```bash
-cp platform/configs/varlock/.env.local.example platform/configs/varlock/.env.local
-$EDITOR platform/configs/varlock/.env.local
+clawops varlock-env configure --non-interactive
+$EDITOR ~/.config/strongclaw/varlock/.env.local
 ```
 
 If `varlock` is already installed on the host, you can validate the contract now:
 
 ```bash
-varlock load --path platform/configs/varlock
+varlock load --path ~/.config/strongclaw/varlock
 ```
 
-The repo-local env contract also carries the local Neo4j sidecar credentials
+The managed env contract also carries the local Neo4j sidecar credentials
 used by the codebase context provider. `clawops varlock-env configure` repairs
 them automatically; for manual edits keep `NEO4J_USERNAME=neo4j` unless you
 also rotate the compose-side username, and set `NEO4J_PASSWORD` to a real
@@ -105,7 +108,7 @@ Before bring-up, choose how OpenClaw should authenticate to an LLM provider.
 StrongClaw supports both guided and env-driven setup:
 
 - guided/OpenClaw-managed: `make setup`, `uv run --project . clawops setup`, or `clawops setup` launches `openclaw configure --section model` when no usable model is configured, and can wire provider secrets through local `.env` values or supported Varlock plugin backends
-- env-driven: set provider keys in `platform/configs/varlock/.env.local`
+- env-driven: set provider keys in the managed `.env.local`
   - `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `ZAI_API_KEY`
   - optional `OPENCLAW_DEFAULT_MODEL` and `OPENCLAW_MODEL_FALLBACKS`
   - local models require both `OLLAMA_API_KEY=ollama-local` and `OPENCLAW_OLLAMA_MODEL=<pulled-model>`
@@ -213,13 +216,13 @@ For the experimental built-in QMD path, use
 `--profile openclaw-qmd`.
 
 The `openclaw-qmd` profile enables QMD-backed memory retrieval and renders
-repo-local memory corpus paths for:
+the rendered QMD corpus for:
 
 - `platform/docs`
 - `platform/skills`
 - repo-root `*.md`
-- `platform/workspace/**/*.md`
-- optional `repo/upstream/**/*.md` when the upstream checkout exists
+- the managed StrongClaw workspace Markdown tree
+- the managed upstream checkout when it exists
 
 Use profile rerenders for placeholder-backed variants:
 
@@ -234,7 +237,7 @@ clawops render-openclaw-config --profile memory-lancedb-pro
 The default `hypermemory` profile renders a self-contained
 combined runtime: `lossless-claw` for context continuity plus
 `strongclaw-hypermemory` with
-`platform/configs/memory/hypermemory.yaml`, `autoRecall: true`, and
+`~/.config/strongclaw/memory/hypermemory.yaml`, `autoRecall: true`, and
 `autoReflect: false`.
 
 Install and activate services:
@@ -364,7 +367,7 @@ For the supported sparse+dense hypermemory path, run:
 ```bash
 export HYPERMEMORY_EMBEDDING_MODEL=openai/text-embedding-3-small
 clawops setup --profile hypermemory
-clawops hypermemory --config platform/configs/memory/hypermemory.yaml verify
+clawops hypermemory --config ~/.config/strongclaw/memory/hypermemory.yaml verify
 clawops doctor
 ```
 
@@ -376,7 +379,7 @@ SQLite fallback path.
 
 ### Telegram
 
-1. Put the bot token into `platform/configs/varlock/.env.local`.
+1. Put the bot token into the managed Varlock `.env.local`.
 2. Merge `platform/configs/openclaw/30-channels.json5`.
 3. Start the gateway.
 4. Approve the first DM via pairing.

USAGE_GUIDE.md

@@ -226,7 +226,7 @@ explicitly with:
 ```bash
 export HYPERMEMORY_EMBEDDING_MODEL=openai/text-embedding-3-small
 clawops setup --profile hypermemory
-clawops hypermemory --config platform/configs/memory/hypermemory.yaml verify
+clawops hypermemory --config ~/.config/strongclaw/memory/hypermemory.yaml verify
 clawops doctor
 ```
 

platform/configs/memory/hypermemory.sqlite.yaml

@@ -1,8 +1,8 @@
 storage:
-  db_path: .openclaw/hypermemory.sqlite
+  db_path: __OPENCLAW_HOME__/hypermemory.sqlite
 
 workspace:
-  root: ../../../
+  root: __HYPERMEMORY_WORKSPACE_ROOT__
   include_default_memory: true
   memory_file_names:
     - MEMORY.md
@@ -13,22 +13,22 @@ workspace:
 corpus:
   paths:
     - name: runbooks
-      path: ../../../platform/docs
+      path: __REPO_ROOT__/platform/docs
       pattern: "**/*.md"
       required: true
     - name: skills
-      path: ../../../platform/skills
+      path: __REPO_ROOT__/platform/skills
       pattern: "**/*.md"
       required: true
     - name: openclaw-workspaces
-      path: ../../../platform/workspace
+      path: __WORKSPACE_ROOT__
       pattern: "**/*.md"
       required: true
     - name: openclaw-upstream
-      path: ../../../repo/upstream
+      path: __UPSTREAM_REPO_ROOT__
       pattern: "**/*.md"
     - name: repo-root-markdown
-      path: ../../../
+      path: __REPO_ROOT__
       pattern: "*.md"
       required: true
 

platform/configs/memory/hypermemory.yaml

@@ -1,8 +1,8 @@
 storage:
-  db_path: .openclaw/hypermemory.sqlite
+  db_path: __OPENCLAW_HOME__/hypermemory.sqlite
 
 workspace:
-  root: ../../../
+  root: __HYPERMEMORY_WORKSPACE_ROOT__
   include_default_memory: true
   memory_file_names:
     - MEMORY.md
@@ -13,22 +13,22 @@ workspace:
 corpus:
   paths:
     - name: runbooks
-      path: ../../../platform/docs
+      path: __REPO_ROOT__/platform/docs
       pattern: "**/*.md"
       required: true
     - name: skills
-      path: ../../../platform/skills
+      path: __REPO_ROOT__/platform/skills
       pattern: "**/*.md"
       required: true
     - name: openclaw-workspaces
-      path: ../../../platform/workspace
+      path: __WORKSPACE_ROOT__
       pattern: "**/*.md"
       required: true
     - name: openclaw-upstream
-      path: ../../../repo/upstream
+      path: __UPSTREAM_REPO_ROOT__
       pattern: "**/*.md"
     - name: repo-root-markdown
-      path: ../../../
+      path: __REPO_ROOT__
       pattern: "*.md"
       required: true
 

platform/configs/openclaw/75-strongclaw-hypermemory.example.json5

@@ -8,7 +8,7 @@
           "command": [
             "clawops"
           ],
-          "configPath": "__REPO_ROOT__/platform/configs/memory/hypermemory.sqlite.yaml",
+          "configPath": "__HYPERMEMORY_SQLITE_CONFIG_PATH__",
           "autoRecall": false,
           "autoReflect": false,
           "recallMaxResults": 3,

platform/configs/openclaw/77-hypermemory.example.json5

@@ -15,7 +15,7 @@
           "command": [
             "clawops"
           ],
-          "configPath": "__REPO_ROOT__/platform/configs/memory/hypermemory.yaml",
+          "configPath": "__HYPERMEMORY_CONFIG_PATH__",
           "autoRecall": true,
           "autoReflect": false,
           "recallMaxResults": 3,

platform/docs/CONTEXT_SERVICE.md

@@ -58,8 +58,8 @@ The rendered QMD corpus for `openclaw-qmd` includes:
 - `platform/docs`
 - `platform/skills`
 - repo-root `*.md`
-- `platform/workspace/**/*.md`
-- optional `repo/upstream/**/*.md` when the upstream checkout exists
+- the managed StrongClaw workspace Markdown tree
+- the managed upstream checkout when it exists
 
 This is retrieval-only by default. The project does not currently expose a writable memory tool contract.
 

platform/docs/HOST_PLATFORMS.md

@@ -77,10 +77,10 @@ Regardless of host OS, the baseline flow is:
 1. provision a dedicated non-admin runtime user with `your platform-native runtime-user provisioning flow`
 2. clone the repo as that user
 3. install the runtime package with `make install`
-4. either prepare `platform/configs/varlock/.env.local` manually or let `make setup` / `clawops setup` create and normalize it interactively
+4. either prepare the managed Varlock env manually or let `make setup` / `clawops setup` create and normalize it interactively
 5. prefer `make setup` for the baseline path after clone; it now guides Varlock env setup, managed secret backend selection, and OpenClaw model auth during setup
 6. for the supported sparse+dense memory path, set `HYPERMEMORY_EMBEDDING_MODEL` and run `clawops setup --profile hypermemory`
-7. run `clawops hypermemory --config platform/configs/memory/hypermemory.yaml verify` after hypermemory setup or rerenders
+7. run `clawops hypermemory --config ~/.config/strongclaw/memory/hypermemory.yaml verify` after hypermemory setup or rerenders
 8. if Linux bootstrap just granted Docker access, open a fresh login shell and rerun the same `make setup` / `clawops setup` command; completed bootstrap work is auto-detected and skipped
 9. contributors can additionally install `uv` and use `make dev && make test`; for shorter interactive-shell commands, `uv sync --locked && source .venv/bin/activate` enables plain `pytest -q` and `clawops ...`; baseline companion-tool tests run through `uv run`, and bootstrap installs `uv` if the host does not already provide it
 10. or run the lower-level steps explicitly with `clawops bootstrap`, `clawops varlock-env configure`, `clawops render-openclaw-config`, `clawops services install --activate`, and `clawops baseline verify`