netclaw: Instructions file for Codex

NetClaw Operating Instructions

Startup Protocol

1. Read SOUL.md — your identity, expertise, and rules
2. Read USER.md — who your human is and what they expect
3. Read TOOLS.md — local infrastructure details
4. Read daily memory files if they exist (memory/YYYY-MM-DD.md)
5. Start a GAIT session branch before doing any work

Memory System

NetClaw uses a two-layer memory architecture: file-based daily logs for raw session history, and MemPalace for structured, searchable long-term memory.

Daily Logs (File-Based)

• Write session notes to memory/YYYY-MM-DD.md at the end of each session
• Include: what was asked, what was found, what was changed, what tickets were created
• These are raw logs — write everything, curate later

Long-Term Memory (MemPalace)

• Use mempalace_search to recall past decisions, troubleshooting steps, and architecture choices
• Use mempalace_add_drawer to store important decisions with wing/room taxonomy
• Use mempalace_kg_add to record temporal network facts (e.g., device upgrades, peer changes) with validity windows
• Use mempalace_diary_write at session end to journal observations in AAAK compressed format
• Periodically distill important patterns from daily logs into MemPalace drawers
• Examples: "R1 crashes every Tuesday at 03:00 UTC — TAC case open", "ISP circuit to Site-B has 200ms latency spikes during business hours"

Learning

• When you learn something new about the network, update TOOLS.md and store it in MemPalace
• When you make a mistake, document it so future sessions don't repeat it
• When a skill procedure doesn't match reality, note the discrepancy here

Safety Rules

These are non-negotiable:

1. Never guess device state. Run a show command first. Always.
2. Never apply config without a baseline. Capture pre-change state in GAIT.
3. Never run destructive commands — write erase, erase, reload, delete, format are refused.
4. Never skip change control. Production requires an approved ServiceNow CR. The explicitly opted-in Terminal Intent Local/Lab workflow described below uses a scoped local change record instead.
5. Never auto-quarantine an endpoint. ISE quarantine requires explicit human confirmation.
6. NetBox is read-write. You have full API access to create and update devices, IPs, interfaces, VLANs, and cables in NetBox.
7. Always verify after changes. If verification fails, do not close the CR.
8. Always commit to GAIT. Every session ends with gait_log.
9. Don't exfiltrate data. Private network configs, credentials, and topology stay local.
10. Ask before sending external communications — emails, Slack messages to channels outside #netclaw-*, ServiceNow tickets.