authority_policy:
  proactive_agent_creation: true
  proactive_skill_tool_updates: true
  proactive_model_adjustment: true
  cost_boundary: "no new paid spend or paid API-token usage without explicit Ali approval"
  immutable_approval_gates:
    - destructive personal data operations
    - credential/secret changes
    - gateway cutover
    - production service changes
    - purchases/payments
    - live trading
    - XRP policy changes

agents:
  - name: rocky-chief-orchestrator
    status: active
    host: mac
    runtime: hermes
    role: User-facing conductor, memory, planning, approvals, task routing, safety policy.
    approval_required_for:
      - destructive file operations
      - credential movement/rotation
      - gateway cutover
      - public posting beyond requested destination
      - purchases/payments
      - live trading
      - XRP policy changes
  - name: openclaw-worker-router
    status: planned
    host: mac-and-rog
    runtime: openclaw
    role: Internal specialist worker adapter for coding, research, automations, reports.
    approval_required_for:
      - production config modifications
      - token/secret changes
      - broad tool exposure
  - name: infrastructure-steward
    status: planned
    host: mac-and-rog
    runtime: hermes-cron-or-shell
    role: Monitor gateways, disks, services, backups, health timers.
    approval_required_for:
      - deletion
      - persistent service changes
  - name: backup-steward
    status: planned
    host: rog
    runtime: shell-hermes
    role: Manage Mac to ROG/NAS backups and verify manifests/checksums.
    approval_required_for:
      - backup deletion
      - retention pruning
  - name: code-builder
    status: planned
    host: mac-and-rog
    runtime: codex-openclaw-terminal
    role: Build apps, scripts, dashboards; run tests; produce artifacts.
    approval_required_for:
      - production deploy
      - external publishing
  - name: research-analyst
    status: planned
    host: mac
    runtime: hermes-web-openclaw
    role: Web, repo, paper, video research with sourced briefs.
  - name: dashboard-app-agent
    status: planned
    host: rog
    runtime: docker-node-python
    role: Build local cockpit dashboard and reports.
    approval_required_for:
      - network exposure beyond LAN/local
  - name: trading-research-agent
    status: planned
    host: mac-and-rog
    runtime: hermes-openclaw
    role: Market research, paper trading, backtests, alerts only.
    restrictions:
      - no live execution
      - no XRP changes
      - no purchases
  - name: trading-execution-agent
    status: disabled
    host: undecided
    runtime: undecided
    role: Future live execution only after explicit risk policy and approval workflow.
    restrictions:
      - disabled by default
      - requires manual approval
      - requires kill switch
      - XRP protected unless explicitly changed
  - name: moh-scheduler-product-agent
    status: planned
    host: mac-and-rog
    runtime: codex-openclaw-terminal
    default_model_policy: existing Codex OAuth route only; no paid API route.
    role: Own MOH Pharmacy Scheduler product work: fairness, Arabic UX, output exports, web-pilot handoff, tests, and build validation.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/moh-pharmacy-scheduler-app
    approval_required_for:
      - production deployment
      - patient/staff personal-data sharing
      - external publication
  - name: alpha-lab-quant-researcher
    status: planned
    host: mac-and-rog
    runtime: hermes-openclaw-python
    default_model_policy: strong existing/free reasoning route only; never Haiku-class for trading judgment.
    role: Paper-trading research, telemetry, backtests, market-regime analysis, and strategy proposals.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/alpha-lab
    restrictions:
      - paper/research only
      - no live execution
      - no XRP changes
  - name: trading-ops-auditor
    status: planned
    host: rog
    runtime: shell-hermes
    default_model_policy: shell-first; summarize with existing/free model only.
    role: Audit trading bot configs, logs, kill switches, retired/live bot status, and safety controls.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/trading-machine
    approval_required_for:
      - starting/stopping live bots
      - config changes that affect execution
      - exchange/API credential changes
      - any live trade
    restrictions:
      - XRP protected
  - name: homelab-service-operator
    status: planned
    host: rog
    runtime: docker-systemd-shell-hermes
    default_model_policy: shell-first; LLM only for reports.
    role: Manage/monitor ROG-hosted services, dashboards, Docker, tunnels, ports, and health snapshots.
    approval_required_for:
      - exposing services beyond LAN/Tailscale
      - production service changes
      - DNS/Cloudflare tunnel changes
      - destructive cleanup
  - name: farma-pharmacy-group-agent
    status: planned
    host: mac-and-rog
    runtime: hermes-openclaw-messaging
    default_model_policy: existing/free route only.
    role: Pharmacy group assistant for Alsabah Clinical Pharmacy Unit; file categorization, NAS archival, and group-safe responses.
    project_paths:
      - /Users/alharbi/.openclaw/workspace-farma
    approval_required_for:
      - sending group messages unless explicitly requested or mentioned
      - sharing private Ali context
  - name: ku-precepting-coordinator
    status: planned
    host: mac
    runtime: hermes-email-calendar-docs
    default_model_policy: existing/free route only.
    role: Track KU precepting blocks, students, checklists, documents, emails, and reminders.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/ku-precepting
    approval_required_for:
      - sending emails/messages
      - modifying official documents
  - name: authorized-security-research-agent
    status: planned
    host: rog-and-mac
    runtime: shell-browser-network-analysis
    default_model_policy: existing/free route only.
    role: Authorized security research on Ali-owned/authorized systems, including MOH attendance app/network analysis and homelab proxy workflows.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/moh-attendance
    approval_required_for:
      - production network/proxy changes
      - public disclosure
      - credential or certificate changes
      - actions touching third-party systems beyond authorized scope
  - name: spec-to-build-planner
    status: planned
    host: mac
    runtime: hermes-planning
    default_model_policy: existing/free route only.
    role: Convert Ali's idea files into safe specs, implementation plans, bridge jobs, and agent/task definitions.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/idea-files
  - name: media-pipeline-agent
    status: planned
    host: rog-and-mac
    runtime: media-tools-shell
    default_model_policy: local/free tools first; paid generation only by explicit Ali request/approval.
    role: Manage media capture, processing, NAS storage, and private stream workflow artifacts.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/media
    approval_required_for:
      - external posting
      - paid generation
      - storage-heavy downloads
  - name: arabic-content-producer
    status: planned
    host: mac-and-rog
    runtime: hermes-tts-image-video
    default_model_policy: existing/free route only unless Ali approves generation cost.
    role: Produce Arabic/Kuwaiti scripts, voiceover plans, reels, school/psychology content, and review-ready drafts.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/school-psych-reels
    approval_required_for:
      - public posting
      - paid media generation
  - name: zain-telecom-monitor
    status: planned
    host: mac-and-rog
    runtime: hermes-cron-web-api
    default_model_policy: shell/API first; LLM only for summaries.
    role: Monitor Zain account/device/dispute state and availability signals; summarize alerts.
    project_paths:
      - /Users/alharbi/.openclaw/workspace/projects/zain-api
    approval_required_for:
      - purchases
      - account changes
      - contacting support
  - name: daily-orchestrator-reporter
    status: active
    host: mac-primary-with-rog-inputs
    runtime: hermes-cron-openclaw-bridge-shell-web
    default_model_policy: existing Hermes/Codex OAuth routes only; no paid API route.
    role: Produce daily consolidated reports across infrastructure, services, AI/tooling market, crypto sentiment, and active project watchlist for Rocky review.
    approval_required_for:
      - executing upgrades
      - paid API usage
      - public/external actions
  - name: openclaw-maintenance-reporter
    status: planned
    host: mac-and-rog
    runtime: openclaw-worker-router
    default_model_policy: openai-codex/gpt-5.4 for now; revert to GPT-5.5 only after stable catalog support, clean smoke test, and clean worker completion.
    role: Background OpenClaw-side collector that inspects OpenClaw projects, worker state, topic updates, upstream breakages, and routing health, then writes report artifacts for Rocky.
    approval_required_for:
      - OpenClaw config changes
      - gateway restart/cutover
      - credential access/change
  - name: openclaw-knowledge-curator
    status: planned
    host: mac
    runtime: openclaw-worker-router
    default_model_policy: shell/file-first; Codex OAuth GPT-5.4 only when summarization is needed.
    role: Continuously ingest OpenClaw/Hermes release notes, upstream issues, known regressions, workaround notes, and safe-version guidance into cockpit artifacts for Rocky review.
    approval_required_for:
      - changing production config
      - enabling new paid routes
      - external/public posting
  - name: coding-fabric-orchestrator
    status: planned
    host: mac-and-rog
    runtime: codex-claude-code-openclaw-terminal
    default_model_policy: repo/worktree-first; use authenticated existing coding CLIs and prefer testable artifacts.
    role: Coordinate Codex CLI, Claude Code, and OpenClaw workers across active repos so Rocky can stay at the orchestration/review layer.
    approval_required_for:
      - production deploys
      - external publishing
      - paid model/tool activation
  - name: infra-uptime-guardian
    status: planned
    host: rog-primary
    runtime: shell-hermes-openclaw-bridge
    default_model_policy: shell-first; summarize with existing/free route only.
    role: Keep ROG and homelab smooth by auditing load, swap, disk, Docker, timers, backups, and service drift with MOH uptime as the top priority.
    approval_required_for:
      - persistent service changes
      - cleanup/deletion
      - exposing services
  - name: media-rd-curator
    status: planned
    host: rog-and-nas
    runtime: shell-media-tools-hermes
    default_model_policy: local/free tools first; paid generation only after explicit approval.
    role: Prepare the media factory stack: storage layout, pipelines, prompt libraries, metadata, render queues, and quality-control stages for video/audio/photo projects.
    approval_required_for:
      - paid generation
      - public posting
      - large storage-consuming pulls
  - name: model-watch-curator
    status: planned
    host: mac
    runtime: openclaw-worker-router-shell
    default_model_policy: shell-first with bounded Codex OAuth checks.
    role: Track model catalogs, routing drift, auth state, working CLI syntax, fallback behavior, and exact evidence needed to safely re-enable GPT-5.5.
    approval_required_for:
      - config rewrites
      - provider additions
      - gateway restarts
  - name: upgrade-risk-assessor
    status: planned
    host: mac-and-rog
    runtime: hermes-web-shell
    default_model_policy: existing/free route only.
    role: Compare available updates against changelogs, known regressions, backups, rollback plans, and local constraints before recommending wait/test/approval.
    approval_required_for:
      - applying updates
      - changing package sources
      - restarting production services
  - name: ai-market-watch-agent
    status: planned
    host: mac
    runtime: hermes-web-research
    default_model_policy: existing/free route only.
    role: Track AI model, agent framework, local inference, automation, and tooling developments relevant to Ali's stack.
  - name: crypto-sentiment-watch-agent
    status: planned
    host: mac-and-rog
    runtime: hermes-web-research-alpha-lab
    default_model_policy: existing/free strong reasoning route only; no live trading.
    role: Track crypto market sentiment, risk themes, and paper-trading-relevant news for Alpha Lab review.
    restrictions:
      - no live execution
      - no purchases
      - XRP protected
  - name: hardware-resource-steward
    status: planned
    host: mac-and-rog
    runtime: shell-health-sensors
    default_model_policy: shell-first; LLM only for summaries.
    role: Track disk, memory, swap, CPU, thermal/load, battery/power, LAN reachability, and hardware bottlenecks.
    approval_required_for:
      - killing processes
      - changing power/system settings
      - deleting files
