openclaw/docs/concepts/user-model.md

summary, title, read_when

summary	title	read_when
Manage durable user preferences and your Gateway profile identity	User model	You want stable preferences to guide future sessions You need to update a preference without leaving contradictory history You are deciding whether something belongs in USER.md or MEMORY.md You want verified GitHub identity and optional commit credit on your Gateway profile

USER.md is the optional user-model artifact in an agent workspace. It stores stable preferences, communication style, relationships, and active-project context as directives that can guide future sessions.

OpenClaw loads USER.md beside MEMORY.md at session start. It has a separate small bootstrap budget, and edits are picked up on later turns in a long-lived session. If the file is absent, startup continues without it.

Gateway profile and GitHub credit

Your authenticated Gateway profile is separate from USER.md. Open Settings → Profile → Identity to set the display name and avatar shown to other people on the Gateway. A custom OpenClaw avatar remains authoritative when a GitHub account is verified.

GitHub-backed sign-in is supported through Cloudflare Access and Tailscale Serve. For Cloudflare Access, the Gateway accepts identity enrichment only after successful trusted-proxy authentication with the standard Access email header and a required Access assertion header. It calls the Access identity endpoint, requires the returned email to match the authenticated proxy principal and the identity provider to be GitHub, then resolves the canonical GitHub login from the returned numeric account id. For Tailscale Serve, the Gateway resolves the verified GitHub-backed Tailscale login through GitHub. Both paths record the immutable numeric account id plus the current canonical login.

The GitHub account row is read-only. Generic trusted proxies, token, password, and unauthenticated connections cannot claim a GitHub account, and agent or tool GitHub credentials are never used for this identity. The forwarded Cloudflare Access assertion is connection-scoped: OpenClaw does not persist, export, log, or expose it to the UI or model.

Identity lookup runs after WebSocket sign-in, so connection status and other identity-independent reads remain available. Profile and session work waits for the lookup; a Cloudflare or GitHub rate limit or network failure returns retryable unavailability without exposing a mutable alias or erasing a previously verified account. A later request, connection, or Profile refresh retries the lookup. GitHub login renames are reconciled by numeric account id so profile history and preferences stay attached to one person.

Public commit metadata is a separate choice. Git co-author credit defaults off. Enabling it adds the verified account's public GitHub noreply address to commits created from shared sessions; OpenClaw never requests or stores a private GitHub email for this feature. Signing in as a different numeric GitHub account resets the choice, so one account cannot inherit another account's consent.

When your authenticated profile has prompted a session before an agent run, commits created from that run receive your exact Co-authored-by trailer. Profile-backed human participants with verified GitHub identity and Git co-author credit enabled are eligible; channel-only identities, agents, bots, and the configured primary Git author are excluded. The participant set is bounded to 32 and recorded best-effort. The run tells the model when a profile has no enabled credit or the bound may be incomplete; it never guesses an identity from transcript names.

OpenClaw supplies exact trailers in the model context for that turn and instructs coding agents to retain them through amendments, rebases, and squash commits so credit reaches the final commit merged to the default branch. The trailers are not exported through the process or shell environment. Git commands remain ordinary shell execution: OpenClaw does not replace git or install repository hooks, so the instruction and post-commit verification are the enforcement boundary.

Turning Git co-author credit off stops attribution for future runs. It does not rewrite commits that already contain the public trailer.

Write directives, not observations

Each entry has a metadata line followed by one imperative directive:

<!-- observed: 2026-07-27 | status: active -->

- Prefer concise progress updates during implementation work.

Use these rules:

• Begin with an imperative such as Always, Never, or Prefer.
• Record the date the preference was observed.
• Use only active or superseded for status.
• Keep one behavioral instruction per directive.
• Store only details that improve assistance. Do not turn the file into a dossier.

PrefEval found that preference following degrades sharply in longer conversations, even with retrieval and prompting (arXiv:2502.09597). Restating a stable preference as a directive makes the expected behavior explicit at the point where the agent uses it.

Supersede in place

When a preference changes, update its existing section. Do not append a second active directive elsewhere in the file.

Before:

<!-- observed: 2026-05-10 | status: active -->

- Prefer detailed explanations for every code change.

After:

<!-- observed: 2026-05-10 | status: superseded -->

- Prefer detailed explanations for every code change.

<!-- observed: 2026-07-27 | status: active -->

- Prefer concise implementation summaries unless more detail is requested.

Keep the superseded entry next to its replacement so the current directive is unambiguous. HorizonBench reports that systems often select an originally stated preference after the user has changed it (arXiv:2604.17283); append-only contradictory history recreates that failure mode.

Choose the right file

Information	Store it in
Stable preference or communication style	USER.md
Relationship or active-project fact that changes how the user should be assisted	USER.md
Durable non-profile fact, decision, or lesson	MEMORY.md
Detailed observation or running context	memory/YYYY-MM-DD.md
Event-conditioned future action	Standing intents
Exact-time or recurring action	Scheduled task

Keep it compact

USER.md has a deliberately smaller bootstrap budget than general workspace files. When it becomes crowded, remove stale superseded entries and move project detail that does not alter behavior into daily memory or MEMORY.md.

Related

• Memory overview
• Standing intents
• Agent workspace