Add Brain Memory integration example

[onurkarali]

Description

Adds examples/brain-memory/ — an integration example that gives a NemoClaw-managed OpenClaw agent persistent, cross-session memory via the hosted Brain Memory remote MCP server.

NemoClaw sandboxes run with deny-by-default egress, so OpenClaw's zero-install remote-MCP path (openclaw mcp add brain-memory --url https://mcp.brainmemory.ai/mcp --auth oauth) fails out of the box: both the MCP JSON-RPC calls and the OAuth login flow are denied. This example ships the OpenShell network-policy preset that allowlists exactly what the integration needs, plus a setup guide.

What's included

• examples/brain-memory/README.md — guide covering: apply the policy preset → register the MCP server + OAuth login → optional deeper integration via the openclaw-brain-memory memory-slot plugin, with verification steps, a durability note (sandbox is disposable; memory lives in Brain Cloud), and troubleshooting
• examples/brain-memory/policies/brainmemory-policy.yaml — egress policy preset for nemoclaw <sandbox> policy-add --from-file, opening POST /mcp (MCP JSON-RPC) and GET /** (OAuth discovery/login) on mcp.brainmemory.ai:443, with commented-out optional endpoints for syncing a sandbox-local brain via Brain Cloud or a private git remote
• One row in the root README example catalog

Verification status (up-front honesty)

• The remote MCP endpoint and OAuth flow are live and in use by OpenClaw installs today.
• TODO: the policy preset has not yet been applied to a live NemoClaw sandbox by the author. The binaries: paths carry explicit VERIFY comments because they depend on the sandbox image, and the example README states this plainly in a "Verification Status" section. Happy to iterate with a maintainer who has a sandbox handy.

Verification

• python scripts/check_license_headers.py --check examples/brain-memory/policies/brainmemory-policy.yaml — the added YAML carries an SPDX header and passes. (Repo-wide --check currently reports pre-existing misses under examples/retail-assistant/, which this PR does not touch.)
• git diff --check
• Relevant example setup or syntax checks — the policy YAML parses (yaml.safe_load); no shell or Python scripts are added, so there are no bash -n / py_compile targets
• Live NemoClaw sandbox run — TODO, see verification status above

Release And Compliance

• No secrets, local .env files, private certificates, snapshots, or token caches are included.
• Third-party dependency changes are reflected in THIRD-PARTY-NOTICES — none needed: this PR vendors no third-party code; the optional npm plugin is user-installed and only documented, not distributed here.
• Public documentation is free of internal-only links or private workspace details.
• Commits include DCO sign-off (git commit -s).

Authors

Onur Karalı — Omelas / Brain Memory

[onurkarali]

Verification update: the preset has now been exercised against a live NemoClaw sandbox (v0.0.73, OpenShell 0.0.71, default docker image) — the open TODO from the original submission is resolved in b855b45.

Probe matrix (from inside the sandbox):

Probe	Result	Proves
curl → mcp.brainmemory.ai, before policy-add	CONNECT refused (403)	deny-by-default egress
curl, after policy-add	CONNECT refused (403)	binaries: least-privilege enforced (curl deliberately not allowlisted)
node fetch(), after policy-add	HTTP response	policy admits exactly the intended binary to exactly the intended host

Also verified: the preset loads cleanly ("Policy version N loaded"), re-applies identically after a sandbox rebuild (which resets policies — now noted in Troubleshooting), and the binaries: path /usr/local/bin/node is correct for the default image (node v22.22.2) — the former VERIFY comment is resolved.

One honest remaining limit, now documented in the example's Verification Status: the in-sandbox OAuth login flow can't be exercised on stock NemoClaw yet because v0.0.73 pins OpenClaw 2026.5.27, which predates the openclaw mcp add/login/probe CLI. The connector's OAuth + memory tools are verified end-to-end on host OpenClaw 2026.6.11; the documented flow applies as written once NemoClaw ships OpenClaw ≥ 2026.6.

[pastorsj]

@onurkarali Thanks for this contribution. Our goal with NemoClaw is to show examples of new agents being deployed in OpenShell. This PR is showing us a way to connect an existing Hermes or OpenClaw with BrainMemory, which is not our goal here. I really enjoyed reading through the library and I believe there is a place for this integration to happen, but it should be happening at the agent harness level. I would highly recommend an integration with Hermes or OpenClaw (or both!). That would have more impact and would allow users to choose this as an option for memory. Thank you again.