[morningstarnasser]

Summary

• add an explicit, preview-only talos import path for Hermes and OpenClaw homes
• inspect a small allowlist of profile, memory and Agent Skill files without writing either home
• keep imported text inactive and skip secrets, authority, executable configuration, schedules, sessions and databases
• document the migration boundary and keep all external connector grants separately paired

Security boundary

• absolute, non-overlapping source and target roots
• component-wise O_NOFOLLOW reads and fd-based bounded directory enumeration
• regular, single-link, UTF-8 and size-bounded files only
• secret-like content, symlinks, malformed skills and target conflicts are rejected
• terminal-safe quoted labels; no absolute roots or file bodies in plans
• no apply, activation, credential migration or permission migration

Verification

• focused migration/CLI/site suite twice: 99 passed, 1 skipped
• full suite: 3584 passed, 3 skipped
• public hygiene: passed
• exact four-lock OSV scan: 0 findings
• independent GPT-5.6 security re-review: APPROVE
• git diff --check: passed