agent-claw/open-questions-resolved.md

Open Questions — Final Research Findings

Updated 2026-05-04 after research pass

---

Q1: Direct Code Deployment vs Container — ✅ RESOLVED

CodeZip is the default and recommended path. No Docker needed.

The AgentCore CLI scaffolds CodeZip by default:

agentcore create --name MyAgent --framework Strands --model-provider Bedrock --build CodeZip
agentcore deploy   # AWS CodeBuild packages it; no local Docker required

Container mode is opt-in (--build Container). Q4 (ARM64 Dockerfile) is moot for initial build.

---

Q2: Secrets in the Container — ✅ RESOLVED (with known limitation)

AgentCore Runtime env vars are plaintext only today. GitHub issue #396 (filed ~April 2026) requests ECS-style valueFrom Secrets Manager references — not yet implemented.

Recommended pattern: IAM role + SDK fetch at startup

import boto3, os

def load_secrets():
    sm = boto3.client('secretsmanager')
    secret = sm.get_secret_value(SecretId='openclaw/agent/keys')
    os.environ['BRAVE_API_KEY'] = secret['SecretString']
    # etc.

# Call once at module load → cached for the 6-8hr warm session
load_secrets()

The container's IAM execution role grants Secrets Manager access. Runs once per session start — negligible cost. Don't pass secrets through the invocation payload.

---

Q3: AgentCore Memory Pricing — ✅ RESOLVED (low risk for personal scale)

Pricing structure confirmed:

• Long-term retrieval: billed per retrieve request
• Built-in strategy model costs (extraction + consolidation): included in Memory pricing (confirmed by AWS re:Post)
• Storage: per GB

Exact per-event and per-GB rates not yet clearly published (still preview pricing). At personal assistant scale (~100 turns/day), cost will be pennies. Validate after first test deployment.

---

Q4: ARM64 Container Build — ✅ RESOLVED (moot, but documented)

Superseded by CodeZip (Q1). If container mode ever needed:

FROM --platform=linux/arm64 ghcr.io/astral-sh/uv:python3.11-bookworm-slim
WORKDIR /app
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-cache
COPY agent.py ./
EXPOSE 8080
CMD ["uv", "run", "uvicorn", "agent:app", "--host", "0.0.0.0", "--port", "8080"]

Build: docker buildx build --platform linux/arm64 -t <ecr-uri>:latest --push .

⚠️ Hard requirement: ARM64 only. x86 image → ValidationException: Architecture incompatible on CreateAgentRuntime.

---

Q5: Region + Model — ✅ RESOLVED

Region: us-east-1 (broadest service availability, aligns with existing AWS work)

Models (Bedrock cross-region inference, us. prefix):

Use	Model ID	Notes
Main agent	us.anthropic.claude-3-7-sonnet-20250219-v1:0	Primary workhorse
Heartbeats	us.anthropic.claude-3-5-haiku-20241022-v1:0	Fast, cheap
Experiment	us.anthropic.claude-sonnet-4-*	Sonnet 4 now on Bedrock (1M ctx preview)

Strands defaults to Bedrock + Sonnet when AWS creds are present. No extra config needed for basic setup.

---

Q6: Self-Managed Memory Strategy — ⚠️ NOT SUPPORTED YET

Finding: AgentCore CLI issue #677 (March 26, 2026): "AgentCore memory does not currently support self-managed strategies." Docs describe it; CLI doesn't implement it.

Impact: The "bring your own Lambda extraction pipeline" pattern is blocked via CLI.

What still works:

• ✅ Built-in strategies: SUMMARIZATION, USER_PREFERENCE, SEMANTIC — fully supported, automatic
• ✅ Strands AgentCoreMemorySessionManager — auto-stores turns, handles extraction
• ✅ BatchCreateMemoryRecords API directly — works for explicit writes, bypasses CLI

Recommended mitigation:

• Use built-in strategies for automatic extraction (covers ~90% of MEMORY.md value)
• Add write_memory_record as an agent tool that calls BatchCreateMemoryRecords directly
• This gives explicit "remember this" control without the self-managed strategy pipeline

@tool
def write_memory_record(content: str, namespace: str = "/curated/daniel/") -> str:
    """Explicitly write an important fact or lesson to long-term memory."""
    memory_client.batch_create_memory_records(
        memoryId=MEMORY_ID,
        memoryRecords=[{"content": {"text": content}, "namespace": namespace}]
    )
    return f"Written to memory: {content[:50]}..."

---

Summary

#	Question	Status	Decision
1	Direct code deploy vs container	✅	Use CodeZip — no Docker
2	Secrets in container	✅	IAM role + SDK fetch at startup
3	Memory pricing	✅	Unknown exact rates, low risk at personal scale
4	ARM64 Dockerfile	✅	Moot (CodeZip), documented for reference
5	Region + model	✅	us-east-1, Claude Sonnet (cross-region)
6	Self-managed memory trigger	✅	Use built-in + BatchCreateMemoryRecords as tool

All open questions resolved. Ready for Phase 0 spike.