OpenClaw Workspace Protection

Spec metadata:

• ID: openclaw-workspace-protection
• Status: approved
• Hard depends on: openclaw-hardening, openclaw-workspace-protection-plan
• Registry: docs/specs/INDEX.md

Contract

Setup contract

1. Detect when OpenClaw workspace resolves to the active Signet workspace.
2. Detect backup posture through git origin remote presence.
3. If linked + unprotected:
   • show critical warning
   • require one protection action before completion:
     • set origin remote, or
     • create local snapshot outside workspace, or
     • explicit bypass acknowledgement (soft gate)

Non-interactive contract

If linked + unprotected, non-interactive setup must fail unless caller passes an explicit protection flag:

• backup action flag (create local snapshot), or
• explicit bypass flag.

Operational visibility contract

signet status and signet doctor must surface this risk condition with actionable remediation guidance.

Validation requirements

1. Regression tests for non-interactive failure path, backup path, and bypass path.
2. Tests that status reporting marks unprotected linked workspaces correctly.