Summary
In OpenClaw 2026.4.14, every dreaming narrative phase (light + REM) fails to clean up its subagent session with missing scope: operator.admin. The narrative itself is written to DREAMS.md before the cleanup call runs, so user-visible dreaming output is unaffected — but subagent sessions likely accumulate in the session store until the maintenance sweep prunes them.
Repro
Enable memory-core.dreaming and let the scheduled cron fire. On every run, the gateway log shows:
[plugins] memory-core: narrative session cleanup failed for light phase: missing scope: operator.admin
[plugins] memory-core: narrative session cleanup failed for rem phase: missing scope: operator.admin
(Pair per workspace per dreaming run.)
Root cause (from the compiled bundle)
memory-core/dreaming-narrative.ts calls params.subagent.deleteSession({ sessionKey }) in the finally block of generateAndAppendDreamNarrative. That RPC goes through the gateway subagent layer, which enforces scope via gateway-method-policy.ts:
const RESERVED_ADMIN_GATEWAY_METHOD_PREFIXES = [
"exec.approvals.",
"config.",
"wizard.",
"update."
];
const RESERVED_ADMIN_GATEWAY_METHOD_SCOPE = "operator.admin";
The session-cleanup call appears to resolve to a method matching one of these admin prefixes, so the dreaming subagent — which doesn't carry operator.admin — is rejected.
Suggested fixes
One of:
- Grant memory-core's dreaming subagent
operator.admin scope for its cleanup calls by default.
- Route session cleanup through a non-reserved RPC path.
- Exempt session cleanup from the reserved-admin scope check.
Environment
- OpenClaw 2026.4.14
- Node.js / Linux x86_64
Summary
In OpenClaw 2026.4.14, every dreaming narrative phase (light + REM) fails to clean up its subagent session with
missing scope: operator.admin. The narrative itself is written toDREAMS.mdbefore the cleanup call runs, so user-visible dreaming output is unaffected — but subagent sessions likely accumulate in the session store until the maintenance sweep prunes them.Repro
Enable
memory-core.dreamingand let the scheduled cron fire. On every run, the gateway log shows:(Pair per workspace per dreaming run.)
Root cause (from the compiled bundle)
memory-core/dreaming-narrative.tscallsparams.subagent.deleteSession({ sessionKey })in thefinallyblock ofgenerateAndAppendDreamNarrative. That RPC goes through the gateway subagent layer, which enforces scope viagateway-method-policy.ts:The session-cleanup call appears to resolve to a method matching one of these admin prefixes, so the dreaming subagent — which doesn't carry
operator.admin— is rejected.Suggested fixes
One of:
operator.adminscope for its cleanup calls by default.Environment