Problem Statement

Autonomous reminder sessions cannot read or write files from the workspaces directory even though {workspaces_dir} is declared in the top-level GlobalReadRoots configuration. The daemon's autonomous session trust zone has a silent fallback bug — it only honors session-specific roots ({session_dir}, {project_dir}) and an undocumented "configured autonomous roots" path. It ignores GlobalReadRoots.

Exact Configuration

File: netclaw.json (top-level Tools object):

{
  "configVersion": 1,
  "Tools": {
    "GlobalReadRoots": [
      "{skills_dir}",
      "{identity_dir}",
      "{workspaces_dir}"
    ]
  },
  "Workspaces": {
    "Directory": "/home/netclaw/.netclaw/workspaces"
  }
}

Resolved paths:

• {workspaces_dir} → /home/netclaw/.netclaw/workspaces
• {skills_dir} → (resolved at runtime)
• {identity_dir} → (resolved at runtime)

The problem: GlobalReadRoots works for main sessions but NOT for autonomous sessions.

Evidence

File Read Errors (4 occurrences)

At 15:20 UTC, session reminder_gotowebinar-triage-automation-v2_1782400811846 attempted to read dedup state:

Tool call: file_read (call=call_f118a59c3bda414f9b429639) 
Path: /home/netclaw/.netclaw/workspaces/gotowebinar-last-run.json
Result: Error: autonomous session may only access files inside its session directory, project directory, or configured autonomous roots.

Shell Path Denied

At 15:22 UTC, the agent tried to find the state file:

Tool call: shell_execute
Command: find /home/netclaw -name "gotowebinar-last-run.json"
Result: Tool access denied: shell_path_outside_trust_zone

What the Agent Did Instead

Because it couldn't read the workspace file:

1. Searched via MCP tool (TextForge) — which works, MCP tools aren't blocked by file trust zones
2. Found 7 registration threads from 5 registrants
3. Attempted to spawn code-analyst sub-agents for CRM lookup
4. Never wrote the state file (no file_write success to /workspaces/)
5. Never sent Slack notification (no completion signal sent)
6. Session ended mid-processing without completion signal → stuck forever

Main Session vs Autonomous Session Comparison

Why This Is Likely a Bug, Not a Config Issue

1. GlobalReadRoots exists and documents shared roots — The config has a GlobalReadRoots array explicitly at the top level of the Tools object. The intent appears to be "these paths are readable by ALL sessions." If autonomous sessions were meant to have separate roots, the config should have a dedicated AutonomousReadRoots or SessionRoots array.

2. No documented autonomous-specific config — There is no configuration section for autonomous session roots. The error message mentions "configured autonomous roots" but there is nowhere in netclaw.json to configure them.

3. Variables resolve correctly — {workspaces_dir} resolves to /home/netclaw/.netclaw/workspaces in the config. The agent isn't getting a "variable not resolved" error — it's getting a "not in trust zone" error.

4. Main sessions work — The same variable {workspaces_dir} works for main sessions, proving the variable resolution is correct.

5. No separate ReadFiles.Mode for autonomous — The AudienceProfiles.Personal.ReadFiles has "Mode": "All" which should override all restrictions. Autonomous sessions run under the Personal audience but the autonomous boundary (boundary:trusted-instance) seems to add an additional layer that ignores GlobalReadRoots.

Impact

This affects ALL autonomous reminder sessions, not just specific ones. Any reminder that:

• Needs to read/write files outside the session directory
• Uses set_working_directory
• Reads state/configuration from workspace paths

...will fail or degrade gracefully. The agent will use MCP tools as a fallback but cannot maintain state or persist results.

Suggested Fixes

Fix 1: Bug Fix — Make GlobalReadRoots Apply to Autonomous Sessions

Modify the daemon to check GlobalReadRoots when validating autonomous file access, not just {session_dir} and {project_dir}.

Fix 2: Add Autonomous-Specific Root Configuration

{
  "Tools": {
    "GlobalReadRoots": ["{skills_dir}", "{identity_dir}", "{workspaces_dir}"],
    "AutonomousReadRoots": [
      "{workspaces_dir}"
    ],
    "AutonomousWriteRoots": [
      "{workspaces_dir}"
    ]
  }
}

Fix 3: Use Session Directory for State Files (Workaround)

Move state files into the session directory structure where autonomous sessions have full access, then copy/merge with workspace file after completion in post-processing.

Related

• This bug is a root cause of the duplicate execution guard bug (Bug: autonomous reminder sessions permanently block duplicate guard due to missing session timeout #1492) — sessions that hit this error never complete, causing the duplicate guard to block permanently.
• See also fix(tools): unblock non-interactive shell + webhook provenance + autonomous filesystem zone (#1244) #1250 (fix Bug: Non-interactive channels always fail with shell_no_trust_zone_roots #1244) — autonomous zone clamp was added in this PR, may be the code path that introduced this regression.