REG-041: Memory audit system — purge stale items, add verification dates, weekly cron

- Audited all MEMORY.md items against real sources (Paperclip, GitHub, Notion)
- Removed stale items: Pikachu article (done), April/Steph (done), Raphael A8 (delivered), WHOOP (parked)
- Fixed: Leonardo PR vignesh07#76 was closed not merged (was listed as 'needs review')
- Added [verified: YYYY-MM-DD] dates to all pending items
- Created scripts/memory-audit.py — scans for stale/unverified items
- Weekly cron (Mon 10:00 HKT) runs audit automatically
- REG-041: Never report pending items without same-session verification
- MEMORY.md down from ~14KB to ~7KB

Author: Molty

MEMORY.md

@@ -1,6 +1,6 @@
 # MEMORY.md - Working Memory
 
-*Last updated: molty | 2026-03-22 | WhatsApp SIM acquired (Spanish +34), awaiting Guillermo pairing | Target: <15KB*
+*Last updated: molty | 2026-03-23 | Full memory audit — purged stale items, added verification dates, REG-041 | Target: <15KB*
 
 ---
 
@@ -34,32 +34,31 @@
 - **Full rules:** `memory/refs/standup-process.md`
 
 ## 📋 Active Projects
-- **Cerebro:** www.meetcerebro.com — active development. Deploy pipeline fixed 2026-03-17 22:22 HKT (dashboard healthcheck was silently overriding railway.toml — deleted dashboard settings, toml-only now).
-- **Morning briefing format overhaul:** Guillermo feedback 09:17 HKT (2026-03-21) — "just doesn't work," needs full rethink not a tweak. Will tackle on return from London (back ~2026-03-25).
-- **WHOOP:** Research done, blocked on CLIENT_ID/SECRET from Guillermo. Notion spec: `31939dd6...`. Mar 17 target PASSED — needs new date at standup.
-- **MC Phase 3:** Assigned tasks: D1 Templates, D2 Notif Prefs, D4 Memory Timeline, D6 Auth, C4 Splinter Den, C5 File Attachments
-- **ginesta.io:** Brief in Notion → https://www.notion.so/Personal-Website-Brief-www-ginesta-io-31a39dd69afd81cea223fbb9f2b2fe39. MC status: review. Waiting Guillermo content checklist. ⚠️ 2+ weeks stalled.
-- **April (agent):** FULLY OPERATIONAL ✅ Deployed 2026-03-11. Steph USER.md interview pending Guillermo.
-- **Agent Performance Review:** Framework DONE. Docs: `docs/AGENT-PERFORMANCE-REVIEWS.md`. Cadence: monthly (first Monday).
-- **gws CLI:** v0.4.4 primary tool. All 9 scopes active. Config: `~/.config/gws/`. gog deprecated.
-- **Agent-Link v2 (PLAN-015):** FULLY OPERATIONAL ✅ Phase 2 (HMAC signing) COMPLETE 2026-03-17. Queue processor cron: `a8699238-a487-462e-bcd8-db0a344e053f`. Worker: `/data/shared/scripts/agent-link-worker.py`.
-- **PLAN-017: Behavior Enforcement** — APPROVED 2026-03-17. 6 MC tasks created. Schedule: Tue (PLAN-015 done), Wed (stale escalation, close notifications, Discord validation), Thu-Fri (PLAN-016 Todoist sync), Sat (full test).
-- **PLAN-018: Paperclip Adoption** — Phase 2 COMPLETE ✅ 2026-03-18 21:47 HKT. Phase 3 (Migration): **TMN-4 ✅ overnight cron migrate (2026-03-19), TMN-5 ✅ briefing version check (2026-03-19), TMN-7 ✅ standup pull Paperclip status (2026-03-19)**. TMN-6 pending (brief Raphael/Leonardo). Squad leads migrating MC tasks this week. Phase 4 (Cutover): sunset MC next week. Sub-agents (Pikachu etc.) don't go in Paperclip — only persistent Railway agents. Plan: `/plans/PLAN-018-paperclip-adoption.md`.
-- **Paperclip:** FULLY OPERATIONAL ✅ https://paperclip-production-83f5.up.railway.app | Railway project: `03da4228-5b2e-4b15-be2e-44f81352224f` | Fork: `gginesta/paperclip`. Login: guillermo.ginesta@gmail.com / TmntPaperclip2026!. 3 companies: TMNT Squad, Brinc, Cerebro. Molty = CEO in all 3. Raphael registered in Brinc, Leonardo in Cerebro, April in TMNT Squad. **All agents heartbeats passing 17:13 HKT 2026-03-18** ✅. All agents have `PAPERCLIP_API_KEY`+`PAPERCLIP_API_URL` env vars set. Fleet creds: `/data/.openclaw/paperclip-fleet-credentials.json`. Skill: `/data/shared/skills/paperclip/`.
-- **Browser relay:** PARKED. Resume when Guillermo wants Raphael to control Waalaxy.
-- **Content/Pikachu:** Tamagotchi Trap posted 2026-03-05. Next: "What AI Agents Actually Do For Me" — not started. ⚠️ 2+ weeks stalled.
-- **PLAN-016:** Todoist↔MC Sync v2 — SUPERSEDED by PLAN-018 Paperclip adoption. Keep Todoist for personal tasks only.
-
-## ⏳ Pending (as of 2026-03-18)
-- **Molty webchat device auth:** Bug — `dangerouslyDisableDeviceAuth` auth still enforced. Workaround: `?token=<gateway_token>` URL param.
-- **Leonardo:** CRM Pipelines Phase B PR #76 — 724 lines, 3 features. Needs Guillermo review before deploy.
-- **Raphael:** G4a test decks — awaiting Guillermo review. A8 blocked — needs live Brinc proposal deck (Feb 2026 branding) from Guillermo.
-- **April:** Steph's interview page ready to share — Guillermo sends to Steph when ready.
-- **Pikachu article:** "What AI Agents Actually Do For Me" — not started.
-- **Personal finance tasks:** Life insurance, car estimate, health insurance, joint accounts, last will, credit card — all need Guillermo to drive.
-- **WHOOP:** Target was Mar 17 — needs new date + CLIENT_ID/SECRET from Guillermo.
-- **Paperclip task wake model:** Overnight cron (03:00 HKT) is only execution window. After TMN-4: Paperclip-triggered heartbeats will wake agents immediately on issue assign/comment.
-- **MC Migration:** Squad leads migrating active MC tasks to Paperclip this week. MC sunset next week. Todoist stays for Guillermo's personal tasks.
+- **Cerebro:** www.meetcerebro.com — active development. Deploy pipeline fixed 2026-03-17. [verified: 2026-03-23]
+- **Morning briefing format overhaul:** Guillermo: "just doesn't work" (2026-03-21). Needs full rethink on return from London (~2026-03-25). [verified: 2026-03-23]
+- **ginesta.io:** Notion brief → https://www.notion.so/Personal-Website-Brief-www-ginesta-io-31a39dd69afd81cea223fbb9f2b2fe39. Guillermo wants to tackle today (2026-03-23). [verified: 2026-03-23]
+- **PLAN-018: Paperclip Adoption** — Phases 0-2 DONE ✅. Phase 3 partially done (TMN-4,5,7 ✅). **Paperclip shows: "Migrate active MC tasks" still BLOCKED, "Fleet config management" IN_REVIEW.** TMN-6 (brief R/L) not done. Guillermo wants migration finished today. [verified: 2026-03-23]
+- **Paperclip:** Running at https://paperclip-production-83f5.up.railway.app. 3 companies, all agents registered. Fleet creds: `/data/.openclaw/paperclip-fleet-credentials.json`. [verified: 2026-03-23]
+- **Leonardo PR #76:** CLOSED (not merged) since 2026-03-14. Status unknown — may have been superseded. [verified: 2026-03-23]
+
+## ✅ Completed (archive candidates)
+- **April (agent):** FULLY OPERATIONAL ✅ Deployed 2026-03-11.
+- **Agent-Link v2 (PLAN-015):** FULLY OPERATIONAL ✅ HMAC signing complete 2026-03-17. Queue processor cron removed (always empty).
+- **Content/Pikachu:** "What AI Agents Actually Do For Me" — DONE ✅ https://www.notion.so/30b39dd69afd81c49baaf35c4ef1e269
+- **Agent Performance Review:** Framework DONE. Docs: `docs/AGENT-PERFORMANCE-REVIEWS.md`.
+- **gws CLI:** v0.4.4, 9 scopes active. gog deprecated.
+- **PLAN-016:** SUPERSEDED by PLAN-018. Todoist for personal tasks only.
+- **PLAN-017:** APPROVED but schedule (week of Mar 17) passed. Status unclear — needs audit. [verified: 2026-03-23]
+
+## 🅿️ Parked
+- **WHOOP:** No clear use case. Idea in Todoist. [verified: 2026-03-23]
+- **Browser relay:** Parked. Resume when Guillermo wants Raphael on Waalaxy. [verified: 2026-03-23]
+- **MC Phase 3 sprint:** D1 Templates, D2 Notif Prefs, D4 Memory Timeline, D6 Auth — may be superseded by Paperclip migration. Needs decision.
+
+## ⏳ Pending [verified: 2026-03-23]
+- **Webchat device auth:** Bug — auth still enforced despite `dangerouslyDisableDeviceAuth`. Workaround: `?token=<gateway_token>`. Low priority. [verified: 2026-03-23]
+- **Webhook spoofing:** Two suspicious tmnt-v1 messages (2026-03-21). Security audit planned for Guillermo's return. [verified: 2026-03-23]
+- **WhatsApp SIM:** +34 677 43 78 34 (Spanish, purchased London 2026-03-22). Needs QR pairing when Guillermo is ready. [verified: 2026-03-23]
 
 ## 📣 Standup System v3.0 (directive 2026-03-14)
 **Webchat-native standup. Notion task DB dropped.**
@@ -91,28 +90,12 @@
 
 ---
 
-*Full lesson archive: `memory/refs/lessons-learned.md`*
-
-**Critical lessons (keep top-of-mind):**
-- **REG-033:** No version bumps without explicit same-session approval. "No updates" = NO updates.
-- **REG-025:** Check container `USER` before any upstream Dockerfile merge. Cherry-pick only.
-- **REG-027:** `allowBots: "mentions"` not `true` — prevents bot message loops.
-- **MC PATCH:** Task ID goes in request BODY, not URL path.
-- **Discord @mentions:** Must use `<@USER_ID>` format — plain `@Name` doesn't ping.
-- **Standup cron:** `delivery.mode: "none"` required on any cron that sends via message tool.
-- **Never narrate tool failures or debugging to public Discord channels.** Fail silently or report the actual problem.
-- **REG-034:** Briefing fabrication fix — script-based `morning-briefing.py` and `heartbeat-check.sh` enforce accurate output (added 2026-03-16).
-- **REG-036:** Personal task guard — `overnight_sync.py` skips personal tasks without 🦎 marker (added 2026-03-16).
-- **REG-037:** Todoist personal task guard extended — `scripts/todoist-close.sh` single gate for ALL Todoist closures; blocks Personal project tasks without 🦎 marker (added 2026-03-17).
-- **Lesson:** Documentation/regressions don't change behavior; code enforcement is required for consistency (2026-03-16).
-- **Railway healthcheck rule:** NEVER configure healthcheck in both Railway dashboard AND railway.toml. Dashboard silently overrides toml → causes 503 "service unavailable" probe failures on every fresh deploy. Fix: delete dashboard settings, use toml-only. (2026-03-17)
-- **Alert discipline:** Don't send operational noise (SIGTERM, heartbeat timeouts, internal errors) to Guillermo. Alerts only when something needs his specific input. (2026-03-17)
-- **PPEE reminder (Paperclip):** Read docs BEFORE attempting deployment. Upstream source builds may be broken — check for pre-built npm packages first. (2026-03-17)
-- **Community Context:** Brad Mills (@bradmillscan) OpenClaw issue — stale `skillsSnapshot` cache in sessions.json; not applicable to us (2026-03-16).
-- **REG-038:** Todoist triage must skip subtasks (`parent_id` filter). Without this, shopping list subtasks in Inbox get orphaned as standalone tasks. (2026-03-18)
-- **REG-039:** Standup must group subtasks under parent task. Never show subtasks as standalone items. Show parent + count + summary line. (2026-03-18)
-- **Paperclip device pairing:** `openclaw devices approve` only grants `operator.admin`. Must manually edit `paired.json` to add `operator.approvals` + `operator.pairing` scopes, then restart gateway. (2026-03-18)
-- **Paperclip API notes:** Company creation = board access only (UI). Agent role promotion works via `PATCH /api/agents/{id}` with `{"role":"ceo"}`. Issue cancellation via `PATCH /api/issues/{id}` with `{"status":"cancelled"}`. (2026-03-18)
-- **Morning briefing:** Enhanced to use `gws gmail +triage` pre-flight check. Shows top 3 unread emails (sender+subject). Cron `25bd223c` (email check 3x daily) removed — baked into morning briefing now. (2026-03-18)
-- **Cron cleanup (2026-03-18):** Removed email check (3x daily, `25bd223c`) — baked into morning briefing. Removed agent-link queue processor (every 5min, `a8699238`) — always empty. (2026-03-18)
-- **Data quality reminder (Guillermo 17:24 HKT):** "I feel we've had an issue every day." Need tighter quality gates on standup/briefing automation. (2026-03-18)
+*Full lesson archive: `memory/refs/lessons-learned.md` | All regressions: `REGRESSIONS.md`*
+
+**Top-of-mind rules:**
+- **REG-041:** Verify every pending item against source before reporting to Guillermo. No parroting MEMORY.md.
+- **REG-033:** No version bumps without explicit same-session approval.
+- **REG-034:** Briefings/heartbeats use scripts only — no fabricated data.
+- **REG-036/037:** Never close Todoist personal tasks without 🦎. All closures via `todoist-close.sh`.
+- **Alert discipline:** No operational noise to Guillermo. Alerts only when he needs to act.
+- **Memory audit:** Weekly cron (Mon 10:00 HKT). Script: `scripts/memory-audit.py`. All pending items need `[verified: YYYY-MM-DD]`.

REGRESSIONS.md

@@ -121,6 +121,15 @@
 
 ---
 
+## REG-041: Verify pending items before reporting to Guillermo (2026-03-23)
+**Trigger:** Any time I report task/project status to Guillermo (standup, briefing, ad-hoc question)
+**Failure:** Reported Pikachu article as "not started" — it was done for weeks. Also resurfaced April/Steph (done), Raphael A8 (delivered), WHOOP (parked). All stale MEMORY.md entries I parroted without checking.
+**Rule:** Before reporting ANY pending/blocked/stalled item to Guillermo, verify its current state against the actual source (Notion, GitHub, Paperclip, agent). Never parrot MEMORY.md status without same-session verification. Every pending item in MEMORY.md must have a `[verified: YYYY-MM-DD]` date. Items >7 days without verification are STALE and must be re-verified before reporting.
+**Code enforcement:** `scripts/memory-audit.py` — scans for stale/unverified items. Run before standups.
+**One-liner:** `REG-041: Verify every pending item against source before reporting. Stale MEMORY.md entries erode trust.`
+
+---
+
 ## REG-026: Discord @mentions require user ID format (2026-03-12)
 **Trigger:** Posting to Discord with `@Raphael` or `@Leonardo`
 **Wrong:** `@Raphael` (plain text, no ping)

memory/refs/mistake-tracker.md

@@ -116,3 +116,10 @@ Every time this happens, I erode trust. He has to drop what he's doing to fix my
 - **Root cause:** No `parent_id` filter in triage. No subtask grouping in standup.
 - **Fix:** Code enforcement (parent_id filter) + standup display rule.
 - **Pattern:** This is the 3rd Todoist-related regression (REG-036, REG-037, REG-038). Guillermo: "I feel we've had an issue every day." Automated Todoist scripts need more rigorous testing before deployment.
+
+
+## 2026-03-23: Stale memory — reported finished work as "not started"
+- **What:** Told Guillermo the Pikachu article "What AI Agents Actually Do For Me" wasn't started. It's been done for weeks in Notion. Also kept resurfacing: April/Steph interview (done), Raphael A8 deck (delivered weeks ago), WHOOP (no use case).
+- **Impact:** Wasted Guillermo's time, eroded trust. He had to correct me — again.
+- **Root cause:** MEMORY.md had stale entries never verified against actual state. Kept parroting old status across sessions.
+- **Fix:** Before reporting any item as "pending/blocked/not started" to Guillermo, verify against source (Notion, agent, actual deliverable). Never parrot MEMORY.md without verification. Need a periodic memory audit — stale items rot fast.

scripts/memory-audit.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""
+Memory Audit Script — scans MEMORY.md for stale items.
+
+Checks:
+1. Items with [verified: YYYY-MM-DD] older than 7 days → marks ⚠️ STALE
+2. Pending/blocked items without any verification date → flags them
+3. Outputs a report of what needs verification
+
+Run weekly via cron or manually before any standup/briefing.
+"""
+
+import re
+import sys
+from datetime import datetime, timedelta
+from pathlib import Path
+
+MEMORY_PATH = Path("/data/workspace/MEMORY.md")
+STALENESS_DAYS = 7
+
+def audit():
+    if not MEMORY_PATH.exists():
+        print("ERROR: MEMORY.md not found")
+        sys.exit(1)
+
+    content = MEMORY_PATH.read_text()
+    lines = content.split("\n")
+    today = datetime.now().date()
+    threshold = today - timedelta(days=STALENESS_DAYS)
+
+    stale_items = []
+    unverified_items = []
+    verified_ok = []
+
+    # Only audit items in these sections (track current section by headers)
+    auditable_sections = [
+        'Active Projects', 'Pending', 'Parked', '⏳', '🅿️', '📋'
+    ]
+    in_auditable_section = False
+
+    # Verification date pattern
+    verified_re = re.compile(r'\[verified:\s*(\d{4}-\d{2}-\d{2})\]')
+
+    # Done/completed items to skip
+    done_re = re.compile(r'DONE|COMPLETE|✅|FULLY OPERATIONAL|SUPERSEDED', re.IGNORECASE)
+
+    for i, line in enumerate(lines, 1):
+        # Track which section we're in
+        if line.startswith('## '):
+            in_auditable_section = any(s in line for s in auditable_sections)
+            continue
+
+        # Only audit lines in relevant sections
+        if not in_auditable_section:
+            continue
+
+        # Skip non-content lines
+        if not line.strip() or line.startswith('---') or line.startswith('*') or line.startswith('#'):
+            continue
+
+        # Skip bullet items that are clearly done
+        if not line.strip().startswith('- '):
+            continue
+        if done_re.search(line):
+            continue
+
+        # Every remaining bullet in an auditable section should have a verification date
+        match = verified_re.search(line)
+        if match:
+            verified_date = datetime.strptime(match.group(1), "%Y-%m-%d").date()
+            if verified_date < threshold:
+                stale_items.append({
+                    'line': i,
+                    'text': line.strip()[:120],
+                    'verified': str(verified_date),
+                    'days_old': (today - verified_date).days
+                })
+            else:
+                verified_ok.append({
+                    'line': i,
+                    'text': line.strip()[:80],
+                    'verified': str(verified_date)
+                })
+        else:
+            unverified_items.append({
+                'line': i,
+                'text': line.strip()[:120]
+            })
+
+    # Report
+    print(f"=== MEMORY AUDIT ({today}) ===\n")
+
+    if stale_items:
+        print(f"⚠️  STALE ({len(stale_items)} items — verified >{STALENESS_DAYS} days ago):")
+        for item in stale_items:
+            print(f"  L{item['line']}: {item['text']}")
+            print(f"         Last verified: {item['verified']} ({item['days_old']} days ago)")
+        print()
+
+    if unverified_items:
+        print(f"❌ UNVERIFIED ({len(unverified_items)} pending items — no verification date):")
+        for item in unverified_items:
+            print(f"  L{item['line']}: {item['text']}")
+        print()
+
+    if verified_ok:
+        print(f"✅ FRESH ({len(verified_ok)} items verified within {STALENESS_DAYS} days)")
+        print()
+
+    total_issues = len(stale_items) + len(unverified_items)
+    if total_issues == 0:
+        print("MEMORY_AUDIT_OK — all pending items are verified and fresh.")
+    else:
+        print(f"MEMORY_AUDIT_ISSUES — {total_issues} items need verification before reporting to Guillermo.")
+
+    return total_issues
+
+if __name__ == "__main__":
+    issues = audit()
+    sys.exit(1 if issues > 0 else 0)