ClawVM: Harness-Managed Virtual Memory for Stateful Tool-Using LLM Agents

This paper introduces ClawVM, a harness-managed virtual memory layer that ensures deterministic and auditable state durability for LLM agents by enforcing typed page residency and validated writeback, thereby eliminating policy-controllable failures with negligible overhead.

The Gist

Imagine you are a highly intelligent personal assistant (an AI agent) trying to manage your entire life: your emails, your calendar, your smart home, and your work projects. You ask this assistant to plan a complex week, and it starts working.

But here's the problem: The assistant has a very small "working desk" (the context window). It can only hold a few pages of notes at once. As the conversation gets longer, the assistant has to throw old notes away to make room for new ones.

In current AI systems, this "throwing away" process is messy and unreliable. It's like a chaotic intern who:

1. Forgets important rules: They might throw away your instruction to "never schedule meetings on Tuesdays" just to save space.
2. Loses progress: If you ask them to reset the conversation, they might wipe out their entire to-do list without saving it to a notebook first.
3. Overwrites things: They might accidentally scribble over a crucial note with a new one, destroying the original data.

This leads to the AI getting confused, repeating the same tasks, or forgetting what it was supposed to do.

Enter ClawVM: The "Smart Filing System"

The paper introduces ClawVM, which acts like a super-organized, rule-abiding Virtual Memory Manager for these AI assistants. Instead of letting the AI randomly decide what to keep or throw away, ClawVM sits between the AI and its memory, acting like a strict but helpful Librarian or Project Manager.

Here is how it works, using simple analogies:

1. The "Typed Pages" (Organized Folders)

Instead of a giant pile of loose papers, ClawVM treats every piece of information as a labeled folder (a "page").

• The Rule: Some folders are "Critical" (like your "Do Not Disturb" rules). These must stay on the desk, even if the desk is full.
• The Magic: If the desk gets too crowded, the Librarian doesn't just throw the folder away. They shrink it down!
  • Full Version: "Meeting at 2 PM with John to discuss the Q3 budget."
  • Compressed Version: "2 PM: John, Q3 budget."
  • Pointer Version: Just a sticky note saying "See File #402 in the cabinet."
  • Key Point: The AI can always get the full details back if it needs them, but it saves space by using the smaller version when possible.

2. The "Minimum Fidelity" (The Safety Net)

Every folder has a minimum quality setting.

• Constraint Folders: "Never schedule on Tuesdays." The Librarian says, "This can never be shrunk below a specific size. It must always be readable."
• Evidence Folders: "The email from the boss." If the desk is full, this can be shrunk to a pointer, but the system guarantees it can be retrieved instantly.
• The Result: The AI never loses the essence of critical instructions, even when it's under pressure.

3. The "Validated Writeback" (The Double-Check Save)

In old systems, when the AI finishes a task, it might try to save its notes to a hard drive. Sometimes, the AI gets interrupted, or the "save" button is skipped, and all the work is lost.

• ClawVM's Approach: Before the AI moves to the next step (or resets), the Librarian performs a strict check.
  • "Did you write this down correctly?"
  • "Are you trying to overwrite something important?"
  • "Is this a destructive change?"
• If the answer is "No" or "Dangerous," the Librarian rejects the save and logs an error. This ensures that when the AI comes back tomorrow, nothing is missing or corrupted.

4. The "Fault Observer" (The Alarm System)

If the AI does forget something or if the system runs out of space, ClawVM doesn't just let it happen silently. It sounds an alarm.

• Instead of the AI quietly failing, the system says: "Hey! We lost the 'Tuesday Rule' because the desk was too full. We need to fix the policy."
• This makes it easy for developers to see exactly why the AI failed and fix the rules, rather than guessing.

Why Does This Matter?

The researchers tested this system with real-world scenarios (like coding, debugging, and planning).

• Without ClawVM: The AI made mistakes, repeated tasks, and forgot instructions about 68 times per session on average.
• With ClawVM: The AI made zero of these specific memory mistakes. It remembered everything it was supposed to, even when the "desk" was tiny.

The Bottom Line

Think of ClawVM as the difference between a chaotic student cramming for an exam (who forgets half the notes) and a professional project manager with a color-coded, backed-up, and rule-enforced filing system.

It doesn't make the AI "smarter" in terms of intelligence; it just makes the AI reliable. It ensures that the AI's memory is durable, auditable, and safe, so you can trust it to handle complex, long-term tasks without losing its mind.

Technical Summary

1. Problem Statement

Stateful tool-using Large Language Model (LLM) agents (e.g., coding assistants, personal agents) operate over extended durations, accumulating state across hundreds of tool calls and multiple sessions. These agents rely on the model's context window as scarce working memory, while storing transcripts and artifacts in durable backing stores.

Current agent harnesses (the software layer managing the agent's lifecycle) treat memory residency and durability as best-effort heuristics. This leads to three recurring failure modes:

1. Residency Failures: Critical state (e.g., active plans, constraints) is silently dropped during context summarization (compaction) or session resets.
2. Durability Failures: "Dirty" state (uncommitted changes) is lost when the runtime resets the context without flushing it to durable storage, or when flushes are bypassed.
3. Observability Failures: Failures are silent; the system cannot distinguish between "no data found," "access denied," or "backend error," making debugging impossible.

Practitioners currently rely on configuration tweaks and external memory plugins, but these lack an enforceable contract to guarantee that critical state survives lifecycle transitions (compaction, pruning, reset).

2. Methodology: ClawVM Design

The authors propose ClawVM, a virtual memory layer integrated directly into the agent harness. It treats the harness as an "OS kernel" for agent state, enforcing deterministic memory management.

Core Concepts

• Typed Pages: Agent state is modeled as "pages" with stable identifiers, scope (session vs. project), and provenance. Unlike free-form text, pages are typed records (e.g., Bootstrap, Constraint, Plan, Evidence).
• Minimum-Fidelity Invariants: Each page type has a defined minimum fidelity level required for correctness. For example, "Constraint" pages must never degrade below a structured representation, while "Evidence" can degrade to a pointer if the full data is retrievable.
• Multi-Resolution Representations: To handle token budget pressure, pages can exist at four fidelity levels:
  1. Full: Verbatim text.
  2. Compressed: Token-reduced text (e.g., via LLMLingua-2).
  3. Structured: Typed fields sufficient to satisfy invariants.
  4. Pointer: A resolvable handle to external storage.
     Crucially, these representations are generated at ingestion time, not on demand, allowing the system to choose the best fit without runtime LLM calls.

Key Mechanisms

1. Deterministic Selection Policy:
   • Phase 1 (Hard Constraints): Installs all hard-pinned pages (e.g., system instructions) and minimum-required representations. If the budget cannot fit the minimum set, an observable fault is raised immediately.
   • Phase 2 (Greedy Upgrades): Uses a utility-based knapsack algorithm to upgrade pages (Pointer $\to$ Structured $\to$ Compressed $\to$ Full) based on marginal utility per token, considering recency, scope, and recompute cost.
2. Observable Fault Model:
   • ClawVM defines specific fault types (e.g., Refetch, Duplicate-Tool, Bootstrap Loss, Flush-Miss, Silent-Recall).
   • Instead of silent failures, the system raises observable faults with reason codes, making failures diagnosable and replayable.
3. Validated Writeback Protocol:
   • Persistence is treated as a three-phase transaction: Staging (typed updates), Validation (checking schema, scope, and non-destructive semantics), and Scoped Commit.
   • This prevents destructive overwrites and ensures dirty state is committed at every lifecycle boundary (compaction, reset).

3. Key Contributions

1. A Virtual Memory Contract for Agents: Formalizes agent state management using typed pages, minimum-fidelity invariants, and multi-resolution representations under a strict token budget.
2. An Observable Fault Model: Makes memory management decisions auditable by distinguishing between policy failures (preventable) and physical insufficiency (unavoidable).
3. Lifecycle-Complete Persistence: Introduces a staged, validated writeback protocol that guarantees dirty state is committed before destruction at any lifecycle boundary.
4. Prototype & Evaluation: A fully functional prototype integrated with OpenClaw-derived harnesses, evaluated against synthetic, real-world trace, and adversarial workloads.

4. Experimental Results

The authors evaluated ClawVM against baselines including Retrieval-only, Retrieval+Cache, and a Practitioner-Configured Compaction+Retrieval (Comp-Hybrid) baseline.

• Fault Elimination:
  • Across 24 configurations (4 workloads $\times$ 6 token budgets), ClawVM reduced policy-controllable faults to zero.
  • Compared to the Comp-Hybrid baseline (which had a mean of 1.5 faults), ClawVM eliminated all faults, including bootstrap faults (lost protocols) and flush-miss faults (lost state on reset).
  • At the tightest budget (120 tokens), the baseline incurred 26 faults, while ClawVM incurred 0.
• Generalization:
  • Tested on 12 real-session traces from coding agents (e.g., Claude Code). ClawVM maintained 0 explicit faults, whereas the retrieval baseline had a median of 51 faults.
  • In 30 synthetic task-level replays, ClawVM achieved 100% task success (defined as zero structural faults), while the baseline dropped to 76.7% at tight budgets.
• Overhead:
  • The policy engine adds a median of < 50 $\mu$s per turn, with negligible memory footprint (< 83 KB).
• Robustness:
  • Ablation studies showed that Pointer Resolution, Auto-Pinning, and Lifecycle Writeback are the critical features. The specific upgrade heuristic (Utility vs. LRU) matters less for fault elimination, provided the structural constraints are met.
  • An offline oracle with future knowledge confirmed that ClawVM's online policy achieves the optimal fault count (zero headroom remaining).

5. Significance

• Paradigm Shift: Moves agent memory management from "best-effort heuristics" to deterministic enforcement, similar to how Operating Systems manage physical memory.
• Reliability: Solves the "silent failure" problem in long-running agents, ensuring that critical constraints and plans are never lost due to context window limits.
• Auditability: Provides a clear mechanism to diagnose why an agent failed (e.g., "Bootstrap page missing after compaction") rather than attributing it to model hallucination.
• Practicality: Demonstrates that high-reliability state management is achievable with minimal overhead and without retraining models or replacing retrieval backends.

The paper concludes that while semantic correctness (fact-checking) remains outside the scope, ClawVM successfully solves the structural reliability issues that currently plague stateful LLM agents.