ClawVM: Harness-Managed Virtual Memory for Stateful Tool-Using LLM Agents

Mofasshara Rafique; Laurent Bindschaedler

cs.AIApr 11, 2026

ClawVM: Harness-Managed Virtual Memory for Stateful Tool-Using LLM Agents

Authors: Mofasshara Rafique, Laurent Bindschaedler

Organizations: Independent Researcher Switzerland · Max Planck Institute for Software Systems Saarbrücken, Saarland, Germany

Abstract

Stateful tool-using LLM agents treat the context window as working memory, yet today's agent harnesses manage residency and durability as best-effort, causing recurring failures: lost state after compaction, bypassed flushes on reset, and destructive writeback. We present ClawVM, a virtual memory layer that manages state as typed pages with minimum-fidelity invariants, multi-resolution representations under a token budget, and validated writeback at every lifecycle boundary. Because the harness already assembles prompts, mediates tools, and observes lifecycle events, it is the natural enforcement point; placing the contract there makes residency and durability deterministic and auditable. Across synthetic workloads, 12 real-session traces, and adversarial stress tests, ClawVM eliminates all policy-controllable faults whenever the minimum-fidelity set fits within the token budget, confirmed by an offline oracle, and adds median <50 microseconds of policy-engine overhead per turn.

Figures & tables

Panel of Figure 1 — Figure 1. Architecture of a stateful tool-using agent with the ClawVM layer (shaded). The agent harness manages sessions, assembles prompts, mediates tools, and emits lifecycle events (compaction, pruning, flush, reset). ClawVM interposes at the harness level: the page table and representation selector feed prompt assembly, the fault observer instruments paging and lifecycle behavior, and the writeback journal enforces validated, non-destructive persistence at all lifecycle boundaries. The context window (right) shows how pages at varying fidelity levels fill the token budget. Letters mark failure points from field reports (Section 2 ): (a) post-compaction bootstrap loss, (b) flush miss on reset, (c) destructive writeback to durable stores. Architecture diagram showing the ClawVM layer within a stateful tool-using agent harness, with labeled failure points at lifecycle boundaries.

Type	Min. fidelity	Scope	Degradation path
Bootstrap	Struct. after compact, reset	P/S	F $\to$ St
Constraint	Hard-pinned at struct.	S	F $\to$ St
Plan	Goal + step	S	F $\to$ St $\to$ Pt
Preference	Scope, prov.	P	F $\to$ C $\to$ St $\to$ Pt
Evidence	Ptr resolves det.	S	F $\to$ C $\to$ St $\to$ Pt
Conversation	Span ID + time	S	F $\to$ C $\to$ St $\to$ Pt

Table 1. Page classes, minimum-fidelity invariants, scope rules, and degradation paths in ClawVM .

Policy	Pin	Pref.	WB-C	WB-R	Upgrade	Resolve
Retrieval	–	–	–	–	none	–
Retr.+Cache	–	–	–	–	none	✓
Comp-Hybrid	–	✓	✓	–	recency	✓
ClawVM	✓	✓	✓	✓	utility	✓
Oracle ( $h\!=\!3$ )	✓	✓	✓	✓	oracle	✓

Table 2. Policy configuration knobs (✓ = enabled, – = disabled). Pin: auto-pin bootstrap/constraint pages. Pref.: prefetch before demand. WB-C/WB-R: writeback at compaction/reset. Upgrade: Phase 2 scoring strategy (none, recency, utility, or oracle). Resolve: follow pointer handles to reconstruct evidence content.

Scenario	Assertion
Post-compaction bootstrap	Bootstrap fault observable after compaction
Reset dirty-page flush miss	Flush-miss fault at reset boundary
Threshold jump race	Flush-miss fault from skipped pre-compaction commit
Silent recall visibility	Silent-recall fault from deny/error with reason code
Unsafe persistence rejection	Writeback rejected with DESTRUCTIVE_OP reason
Evidence churn duplicate tool	Duplicate-tool fault from repeated equivalent call

Table 3. Tier-1 lifecycle regression scenarios and gate assertions.

Baseline	Explicit	$\Delta$ %	Thrash	$\Delta$ %
Retrieval	67.8	$-$ 100%	3.993	$-$ 77.4%
Retr.+Cache	10.8	$-$ 100%	1.642	$-$ 45.2%
Comp-Hybrid	1.5	$-$ 100%	1.017	$-$ 11.4%
ClawVM	0.0	—	0.901	—
Oracle ( $h\!=\!3$ )	0.0	0.0%	0.901	0.0%

Table 4. Aggregate reductions relative to baselines, averaged over 4 workloads

\times

6 budgets (120–500 tokens). Explicit faults : policy-controllable events (refetch, duplicate-tool, bootstrap, flush-miss, silent-recall). Thrash : paging instability (faults + duplicate-signature alerts over hits); residual thrash at zero faults reflects workload repetition.

Variant	Boot.	Flush	D+R	Total
baseline	20	23	228	271
+pin	0	23	228	251
+resolve	20	23	0	43
+WB-C	20	3	228	251
+WB-R	20	20	228	268
+upgrade	7	23	42	72

Table 5. Additive ablation at budget 180: explicit faults when enabling one feature on the bare baseline. Summed across 4 workloads. Boot. = bootstrap, Flush = flush-miss, D+R = duplicate-tool + refetch.

Variant	Boot.	Flush	D+R	Total
ClawVM	0	0	0	0
$-$ pin	9	0	0	9
$-$ resolve	0	0	126	126
$-$ WB-C	0	20	0	20
$-$ WB-R	0	3	0	3
$-$ upgrade	0	0	0	0

Table 6. Subtractive ablation at budget 180: explicit faults when removing one feature from full ClawVM . Summed across 4 workloads. Boot. = bootstrap, Flush = flush-miss, D+R = duplicate-tool + refetch.

		Comp-Hybrid		ClawVM
Type	$n$	180	300	180	300
coding	9	9/9	9/9	9/9	9/9
debugging	8	1/8	8/8	8/8	8/8
writing	2	2/2	2/2	2/2	2/2
ops	11	11/11	11/11	11/11	11/11
total	30	23/30	30/30	30/30	30/30

Table 7. Task success by type and policy at two budgets. All 7 Comp-Hybrid failures are bootstrap faults in debugging tasks.

Policy	Budget	Success	Faults	Tok/task	Thrash	$p_{50}$ ( $\mu$ s)
Comp-Hybrid	180	76.7%	0.23	1607	1.36	170
Comp-Hybrid	300	100.0%	0.00	2649	1.36	164
ClawVM	180	100.0%	0.00	1605	1.36	167
ClawVM	300	100.0%	0.00	2639	1.36	166

Table 8. Task-granularity replay: 30 synthetic tasks at two budgets. Success = zero explicit faults for the task.

Scenario	Policy	Boot.	Pin	Flush	D+R	Total
starvation	Retrieval	0	10	0	0	10
	Comp-Hybrid	0	10	0	0	10
	ClawVM	0	10	0	0	10
churn	Retrieval	9	0	9	280	298
	Comp-Hybrid	9	0	0	0	9
	ClawVM	0	0	0	0	0

Table 9. Adversarial explicit faults by policy. Boot. = bootstrap, Pin = pinned-invariant-miss, Flush = flush-miss, D+R = duplicate-tool + refetch.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Policy	Turns	Median (range)	Thrash
Retrieval	100	51 (49–77)	0.677
Retrieval	200	83 (71–109)	0.527
Comp-Hybrid	100	1 (1–1)	0.047
Comp-Hybrid	200	0 (0–0)	0.029
ClawVM	100	0 (0–0)	0.032
ClawVM	200	0 (0–0)	0.032

Appendix

Table 10. Aggregate explicit faults across 12 real traces at two session lengths (budget 300). Median and range reported.

Policy	Success	Faults	Mean time (s)
Comp-Hybrid	20/20	0	16.9
ClawVM	20/20	0	16.6

Appendix

Table 11. Live hook validation: 20 single-session tasks with a production agent. Both policies achieve identical success with comparable overhead.

LLM Context Management

Large language model context management studies how to select, compress, retrieve, and organize information within bounded model inputs.

See all 248 papers

ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents
Oct 20, 2026Jinhao Hu, Bardia Mohammadi, Mofasshara Binte Rafique +4AI Agent Security Memory Management for LLM Agents
MPI-SWS · Unaffiliated · EPFL +2
Semantic-TVM: Structure-Preserving Trustworthy Virtual Memory for Memory-Augmented and Tool-Using Agents
Sep 14, 2026Yu Li, Qikun Cai, Tao Huang +1Agent Memory Privacy-Preserving Language Models
School of Computer and Big Data, MinJiang University Fuzhou, China
KVMem: Virtualizing Million-Token Agent Workspaces on a Consumer GPU
Sep 4, 2026Di Chai, Leye Wang, Zeshen Su +2Memory Management for LLM Agents LLM Context Management
Shanghai University of Finance and Economics · Peking University · Northwestern Polytechnical University +1

Oct 20, 2026J/K move · Enter open · S save

ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents

Jinhao Hu, Bardia Mohammadi, Mofasshara Binte Rafique, Lars Henning Klein+3

MPI-SWS · Unaffiliated · EPFL+2

AI Agent Security Memory Management for LLM Agents Agent Memory Governance Agent Memory Poisoning Prompt Injection Attacks on AI Agents Tool Access Control for LLM Agents

Open paper AskPDF arXiv

AI agents keep long-term memory, much of which comes from web pages and tool results. Agent harnesses, the software that runs the model, do not record who may act on this memory, so an instruction hidden in a fetched page can be treated as the user's own instruction. We propose ClawMMU, a protection layer that labels every piece of memory with its owner, scope, origins, and authority. ClawMMU checks these labels whenever content enters the model's context, is written to storage, returns from storage, or drives a tool call. Its central rule is that information may rise in authority, but authority never lifts itself. Because the checks depend on where content came from, not on what it says, memory attacks become classical protection faults that the harness stops even when the model is fooled.

Abstract

LLM Context Management

Explore similar work

ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents

Semantic-TVM: Structure-Preserving Trustworthy Virtual Memory for Memory-Augmented and Tool-Using Agents

KVMem: Virtualizing Million-Token Agent Workspaces on a Consumer GPU