I am migrating my agent fleet's memory system from OB1/OpenBrain toward Honcho. The point is not to chase a shinier database. The point is to give the trusted persistent agents one better long-term memory, while being honest that the real boundary is what we allow into that shared memory.
The earlier version of this plan split operational and personal memory into separate production workspaces. That was safer on paper, but it made the live system too complicated for the actual trust model. Milo, Miloh, Echo, and Bandit are not random SaaS workers; they are the trusted named fleet. Temporary subagents, eval workers, and browser sandboxes are the processes that should not automatically get the shared key.
One shared memory is workable if every trusted persistent agent is allowed to know what gets written there. The boundary moves from workspace routing to write hygiene.
The original post was written before implementation. The migration now has a simpler current truth: Honcho is running privately on Forge, the reviewed production data is imported into james-fleet-prod, the default Hermes/OpenClaw paths have both produced searchable live markers, the backend survived the first day-plus of live traffic with clean queue recovery, and OB1 is no longer wired into normal Hermes recall/writeback. The split ops/personal workspaces still exist, but they are rollback/reference state rather than the target architecture.
james-fleet-prod is imported, drained, exported, and used by default Hermes/Miloh plus OpenClaw/Milo.47/47 completed at the latest check.| Area | Current state |
|---|---|
| Target workspace | james-fleet-prod: one shared Honcho memory for trusted persistent agents. |
| Imported data | All approved rows are in the shared workspace: 567 operational rows and 58 personal rows. |
| Held out | Blocked, review, raw, stale, and superseded rows were intentionally excluded. |
| Derivation | Honcho processing queues drained after import, live traffic, and canary/watchdog writes; latest measured queue was 47/47 completed with no pending or in-progress work. |
| Live default paths | Default Hermes/Miloh and OpenClaw/Milo have both written searchable cutover markers into james-fleet-prod. |
| Canary/watchdog | Ten scheduled shared-watchdog runs passed through 05:15 on July 1. The 09:16 run exposed watchdog plumbing fragility because the manual canary gateway was down; Honcho itself stayed healthy and its queue drained. |
| Old split path | james-ops-prod, james-personal-prod, honchoops, and honchopersonal remain only as rollback/reference state. |
| Fallback | OB1 is archive-only provenance; it is no longer wired into normal Hermes recall or writeback. |
The key design choice changed. Honcho still gives us source-aware, long-lived memory, but I no longer think the right first production design is a workspace split between trusted named agents. The simpler rule is: one shared workspace for the trusted persistent fleet, and much stricter rules for what is allowed to be written there.
| Runtime | Shared memory | Role |
|---|---|---|
| Default Hermes / Miloh | yes | live through the Hermes Honcho provider against james-fleet-prod |
| OpenClaw / Milo | yes | live through an OpenBrain-compatible localhost shim backed by Honcho |
| Echo / Bandit / future named agents | yes, when wired | trusted persistent consumers may join the shared workspace after explicit wiring |
| Throwaway subagents / eval workers | no by default | do not receive the shared key automatically |
| honchoops / honchopersonal / honchofleet | legacy/canary | kept for rollback, watchdogs, and reference checks |
The table is less complicated than the old architecture because the trust model is less complicated. If something is written into shared memory, every trusted persistent agent may read it. If that is not acceptable, the content does not belong in shared memory.
The migration was deliberately staged. OB1 memories were exported, normalized, classified, reviewed, imported into staging, evaluated, and then rebuilt into clean production workspaces from an approved allowlist. That last step matters: production was not a blind copy of staging.
Because dual memory systems rot. If every new fact has to be written to both OB1 and Honcho, the system becomes harder to reason about than either system alone. The compromise was a temporary rollback path, not permanent dual-write or permanent dual-recall.
After the completed cutover, OB1 is no longer part of normal agent recall or writeback. It remains only as offline provenance/archive material unless James explicitly asks for an emergency reconnect.
| Gate | Status | Meaning |
|---|---|---|
| Shared import count | Passed | 567 operational rows and 58 personal rows imported into james-fleet-prod. |
| Blocked/review lanes | Passed | Blocked, review, raw, stale, and superseded rows stayed out of production shared memory. |
| Queue drain | Passed | Pending and in-progress work units returned to zero after import, canary writes, and live cutover checks. |
| Default Hermes cutover | Passed | Default Hermes/Miloh uses james-fleet-prod through the Hermes Honcho provider. |
| OpenClaw/Milo cutover | Passed | Milo kept its existing OpenBrain tool contract while the backend moved to Honcho through a localhost shim. |
| 24h+ backend watch | Passed | Honcho stayed healthy past the first day-plus of live traffic. Latest measured queue: 47/47 completed, no pending or in-progress work. |
| Scheduled watchdogs | Mostly passed | Ten scheduled runs passed through 05:15 July 1, including HONCHO_FLEET_WATCHDOG_20260701T051412. The 09:16 failure exposed a down manual canary gateway, not a Honcho backend failure. |
| Memory hygiene | Yellow | No same-pair duplicate growth has shown up, but cross-observer fanout is noisy enough to tune before expanding access or retiring OB1. |
| OB1 retirement | Done for live agents | OB1 MCP recall/writeback is unwired from normal Hermes sessions; remaining work is optional credential/archive hardening. |
The first day-plus changes the risk picture. This is no longer a cutover-risk problem; it is a memory-quality and watchdog-supervision problem. The Honcho backend is healthy enough to keep live, and the rollback path should stay untouched while I tune how much derived memory Honcho creates for the shared observer graph and make the watchdog depend on a supervised path.
james-fleet-prod.The remaining decision is no longer theoretical. We cancelled the provider-compartment PR, retired the split-profile rollout as the target, then cut the live default paths to james-fleet-prod. Default Hermes/Miloh writes through the Hermes Honcho provider. OpenClaw/Milo writes through a localhost OpenBrain-compatible shim backed by Honcho, so the mature Milo memory tooling kept working while the storage backend changed. OB1 is no longer wired into normal recall/writeback; Honcho is the sole live memory path for trusted agents.
| Option | Verdict | Why |
|---|---|---|
| Generalized provider compartments | Cancelled PR | PR 54534 was useful proof, but too much policy in the provider layer. |
| Split ops/personal profile rollout | Demoted to rollback | It worked, but it was solving a harder threat model than the trusted fleet needs right now. |
| One shared fleet workspace | Current target | It matches the actual trust model: trusted persistent agents share memory; untrusted temporary workers do not get the key. |
| Default Hermes/OpenClaw cutover | Complete | Both default paths produced live markers in james-fleet-prod; the current proof is sustained real traffic and clean memory hygiene. |
| Next work | Hygiene + watchdog plumbing | No rollback and no new architecture. Tune observer/write behavior, then fix the canary/watchdog supervision gap before retiring fallback pieces. |
One platform: Honcho One production memory: james-fleet-prod Shared import: 567 ops rows + 58 personal rows Provider-extension PR 54534: cancelled after design review Split ops/personal canaries: retained for rollback/reference Current rollout: default Hermes/Miloh and OpenClaw/Milo cut over Live proof: both wrote searchable cutover markers into james-fleet-prod Fallback: OB1 MCP is unwired from normal sessions; archive/provenance only 24h+ backend watch: green, latest queue 47/47 drained Watchdog caveat: 09:16 failure was manual canary gateway plumbing, not backend failure Next: hygiene hardening + watchdog supervision, then optional OB1 credential/archive hardening
The hard part was not getting rows into a vector-backed memory system. The hard part was admitting the architecture had become more complicated than the trust model required. After the first day-plus and the July 5 cleanup, the honest work is less dramatic: keep the shared Honcho path live, keep OB1 unwired from normal agents, tune memory hygiene, and make the watchdog boring.