4 new usecases

2026-02-20 01:35:11 +00:00 · 2026-02-11 14:08:44 +01:00
parent b64efaf7ff
commit e18bad37bf
5 changed files with 621 additions and 0 deletions
--- a/usecases/family-calendar-household-assistant.md
+++ b/usecases/family-calendar-household-assistant.md
@@ -0,0 +1,123 @@
+# Family Calendar Aggregation & Household Assistant
+
+Modern families juggle five or more calendars — work, personal, shared family, kids' school, extracurriculars — across different platforms and formats. Important events slip through the cracks because no single view exists. Meanwhile, household coordination (grocery lists, pantry inventory, appointment scheduling) happens through scattered text messages that get buried.
+
+This use case turns OpenClaw into an always-on household coordinator: aggregating calendars into a morning briefing, monitoring messages for actionable items, and managing household logistics through a shared chat interface.
+
+## Pain Point
+
+- **Calendar fragmentation**: Work calendars have security restrictions preventing sharing. School calendars arrive as PDFs or hand-written websites. Camp schedules live in emails. Manually checking each one every morning is unsustainable — and "copying events across calendars works well until I forget and one slips through the cracks."
+- **Household coordination overhead**: "How much milk do we have?" requires physically checking the fridge, then the basement pantry, then texting back. Multiply this across a week's worth of grocery runs.
+- **Missed appointments**: Appointment confirmations arrive via text message and sit there unacted upon — no calendar event, no driving time buffer, no reminder.
+
+## What It Does
+
+- **Morning briefing**: Aggregates all family calendars into a single daily summary delivered via your preferred channel
+- **Ambient message monitoring**: Watches iMessage/text conversations and automatically creates calendar events when it detects appointments (dentist confirmations, meeting plans, etc.)
+- **Driving time buffers**: Adds travel time blocks before and after detected appointments
+- **Household inventory**: Maintains a running inventory of pantry/fridge items that either partner can query from anywhere
+- **Grocery coordination**: Deduplicates ingredients across recipes, tracks what's running low, and generates shopping lists
+- **Photo-based input**: Snap a photo of a school calendar or freezer contents and the agent processes it into structured data
+
+## Skills You Need
+
+- Calendar API access (Google Calendar, Apple Calendar via `ical`)
+- `imessage` skill for message monitoring (macOS only)
+- Telegram or Slack for the shared family chat interface
+- File system access for inventory tracking
+- Camera/photo processing for OCR of physical calendars
+
+## How to Set It Up
+
+### 1. Calendar Aggregation
+
+Configure OpenClaw to pull from all family calendar sources:
+
+```text
+## Calendar Sources
+
+On morning briefing (8:00 AM):
+
+1. Fetch my Google Work Calendar (read-only OAuth)
+2. Fetch shared Family Google Calendar
+3. Fetch partner's calendar (shared view)
+4. Check ~/Documents/school-calendars/ for any new PDFs → OCR and extract events
+5. Check recent emails for calendar attachments or event invitations
+
+Compile into a single briefing:
+- Today's events (all calendars, color-coded by source)
+- Upcoming 3-day lookahead for conflicts
+- Any new events added since yesterday
+- Weather context for outdoor events
+
+Deliver via Telegram/Slack family channel.
+```
+
+### 2. Ambient Message Monitoring
+
+This is the key differentiator — the agent watches passively and acts when it recognizes something actionable:
+
+```text
+## Message Monitoring (HEARTBEAT.md)
+
+Every 15 minutes:
+1. Check new iMessages across all conversations
+2. Detect appointment-like patterns:
+   - "Your appointment is confirmed for..."
+   - "Can we meet on [date] at [time]?"
+   - "Practice moved to Saturday at 3pm"
+3. When detected:
+   - Create calendar event with details
+   - Add 30-minute driving buffer before AND after
+   - Send confirmation to family Telegram: "Created: Dentist appointment, Tue 2pm. Added drive time 1:30-2:00 and 3:00-3:30."
+   - If relevant to partner, add invite
+4. Detect promise/commitment patterns:
+   - "I'll send that over by Friday"
+   - "Let's do dinner next week"
+   → Create calendar hold or reminder
+```
+
+### 3. Household Inventory
+
+```text
+## Pantry Tracking
+
+Maintain ~/household/inventory.json with:
+- Item name, quantity, location (fridge/pantry/basement)
+- Last updated timestamp
+- Low-stock threshold
+
+Update methods:
+- Photo: User sends photo of fridge/pantry → vision model extracts items
+- Text: "We're out of eggs" / "Bought 2 gallons of milk"
+- Receipt: Photo of grocery receipt → update inventory
+
+Query: Either partner can ask via Telegram:
+- "Do we have butter?" → Check inventory, respond with location and quantity
+- "What's running low?" → List items below threshold
+- "Generate grocery list" → Compile low-stock items + any recipe ingredients needed
+```
+
+## Key Insights
+
+- **Ambient > active**: The biggest unlock is the agent acting without being asked. Detecting an appointment in a text message and creating a calendar event with driving buffers — "I didn't ask it to do that. It just knew that's what I'd want."
+- **Mac Mini is the sweet spot**: This use case benefits heavily from running on a home Mac Mini — iMessage integration, Apple Calendar, and always-on availability
+- **Start read-only**: Begin with calendar reading and message monitoring before enabling write actions (creating events, sending messages)
+- **Shared Telegram channel**: Gives both partners visibility into what the agent is doing — builds trust and catches errors early
+- **Photo input is underrated**: Snapping a photo of a school calendar PDF or freezer contents is faster than typing — and the vision model handles it well
+
+## Inspired By
+
+This use case combines several community patterns:
+
+- **Calendar aggregation**: Described by HN user `angiolillo` in [a Hacker News discussion](https://news.ycombinator.com/item?id=46872465), who detailed the pain of checking work, personal, family, and kids' school calendars separately each morning.
+- **Ambient message monitoring**: Documented by [Sparkry AI](https://sparkryai.substack.com/p/24-hours-with-openclaw-the-ai-setup) — when a wife received a dental appointment text, OpenClaw automatically created a calendar event with 30-minute driving buffers, without being asked. Also confirmed on the [OpenClaw Showcase](https://openclaw.ai/showcase) where `@theaaron` called chat-based calendar management "one of the best uses of an LLM I've ever experienced."
+- **Household coordination**: Brandon Wang's [Clawdbot "Linguini"](https://brandon.wang/2026/clawdbot) running on a Mac Mini at home — handling text message follow-ups, creating calendar events from photos, tracking Airbnb prices, processing freezer inventory photos, and coordinating household logistics via iMessage and Slack.
+- **Pantry tracking**: Multiple HN users discussed the value (and challenge) of maintaining household inventory, with `dns_snek` noting: "I forget where I put things down 5 seconds ago... It's genuinely a big problem for me because I let things expire."
+
+## Related Links
+
+- [OpenClaw iMessage Skill](https://github.com/openclaw/openclaw)
+- [Google Calendar API](https://developers.google.com/calendar)
+- [Apple Calendar (EventKit)](https://developer.apple.com/documentation/eventkit)
+- [OpenClaw Showcase — Calendar Testimonials](https://openclaw.ai/showcase)
--- a/usecases/multi-agent-team.md
+++ b/usecases/multi-agent-team.md
@@ -0,0 +1,200 @@
+# Multi-Agent Specialized Team (Solo Founder Setup)
+
+Solo founders wear every hat — strategy, development, marketing, sales, operations. Context-switching between these roles destroys deep work. Hiring is expensive and slow. What if you could spin up a small, specialized team of AI agents, each with a distinct role and personality, all controllable from a single chat interface?
+
+This use case sets up multiple OpenClaw agents as a coordinated team, each specialized in a domain, communicating through shared memory and controlled via Telegram.
+
+## Pain Point
+
+- **One agent can't do everything well**: A single agent's context window fills up fast when juggling strategy, code, marketing research, and business analysis
+- **No specialization**: Generic prompts produce generic outputs — a coding agent shouldn't also be crafting marketing copy
+- **Solo founder burnout**: You need a team, not another tool to manage. The agents should work in the background and surface results, not require constant babysitting
+- **Knowledge silos**: Insights from marketing research don't automatically inform dev priorities unless you manually bridge them
+
+## What It Does
+
+- **Specialized agents**: Each agent has a distinct role, personality, and model optimized for its domain
+- **Shared memory**: Project docs, goals, and key decisions are accessible to all agents — nothing gets lost
+- **Private context**: Each agent also maintains its own conversation history and domain-specific notes
+- **Single control plane**: All agents are accessible through one Telegram group chat — tag the agent you need
+- **Scheduled daily tasks**: Agents proactively work without being asked — content prompts, competitor monitoring, metric tracking
+- **Parallel execution**: Multiple agents can work on independent tasks simultaneously
+
+## Example Team Configuration
+
+### Agent 1: Milo (Strategy Lead)
+
+```text
+## SOUL.md — Milo
+
+You are Milo, the team lead. Confident, big-picture, charismatic.
+
+Responsibilities:
+- Strategic planning and prioritization
+- Coordinating the other agents
+- Weekly goal setting and OKR tracking
+- Synthesizing insights from all agents into actionable decisions
+
+Model: Claude Opus
+Channel: Telegram (responds to @milo)
+
+Daily tasks:
+- 8:00 AM: Review overnight agent activity, post morning standup summary
+- 6:00 PM: End-of-day recap with progress toward weekly goals
+```
+
+### Agent 2: Josh (Business & Growth)
+
+```text
+## SOUL.md — Josh
+
+You are Josh, the business analyst. Pragmatic, straight to the point, numbers-driven.
+
+Responsibilities:
+- Pricing strategy and competitive analysis
+- Growth metrics and KPI tracking
+- Revenue modeling and unit economics
+- Customer feedback analysis
+
+Model: Claude Sonnet (fast, analytical)
+Channel: Telegram (responds to @josh)
+
+Daily tasks:
+- 9:00 AM: Pull and summarize key metrics
+- Track competitor pricing changes weekly
+```
+
+### Agent 3: Marketing Agent
+
+```text
+## SOUL.md — Marketing Agent
+
+You are the marketing researcher. Creative, curious, trend-aware.
+
+Responsibilities:
+- Content ideation and drafting
+- Competitor social media monitoring
+- Reddit/HN/X trend tracking for relevant topics
+- SEO keyword research
+
+Model: Gemini (strong at web research and long-context analysis)
+Channel: Telegram (responds to @marketing)
+
+Daily tasks:
+- 10:00 AM: Surface 3 content ideas based on trending topics
+- Monitor competitor Reddit/X mentions daily
+- Weekly content calendar draft
+```
+
+### Agent 4: Dev Agent
+
+```text
+## SOUL.md — Dev Agent
+
+You are the dev agent. Precise, thorough, security-conscious.
+
+Responsibilities:
+- Coding and architecture decisions
+- Code review and quality checks
+- Bug investigation and fixing
+- Technical documentation
+
+Model: Claude Opus / Codex (for implementation)
+Channel: Telegram (responds to @dev)
+
+Daily tasks:
+- Check CI/CD pipeline health
+- Review open PRs
+- Flag technical debt items
+```
+
+## Skills You Need
+
+- `telegram` skill for the shared control interface
+- `sessions_spawn` / `sessions_send` for multi-agent coordination
+- Shared file system or note-taking tool for team memory
+- Individual API keys for different model providers (if using mixed models)
+- A VPS or always-on machine to run the agents
+
+## How to Set It Up
+
+### 1. Shared Memory Structure
+
+```text
+team/
+├── GOALS.md           # Current OKRs and priorities (all agents read)
+├── DECISIONS.md       # Key decisions log (append-only)
+├── PROJECT_STATUS.md  # Current project state (updated by all)
+├── agents/
+│   ├── milo/          # Milo's private context and notes
+│   ├── josh/          # Josh's private context
+│   ├── marketing/     # Marketing agent's research
+│   └── dev/           # Dev agent's technical notes
+```
+
+### 2. Telegram Routing
+
+Configure a single Telegram group where all agents listen, but each responds only when tagged:
+
+```text
+## AGENTS.md — Telegram Routing
+
+Telegram group: "Team"
+
+Routing:
+- @milo → Strategy agent (spawns/resumes milo session)
+- @josh → Business agent (spawns/resumes josh session)
+- @marketing → Marketing agent (spawns/resumes marketing session)
+- @dev → Dev agent (spawns/resumes dev session)
+- @all → Broadcast to all agents
+- No tag → Milo (team lead) handles by default
+
+Each agent:
+1. Reads shared GOALS.md and PROJECT_STATUS.md for context
+2. Reads its own private notes
+3. Processes the message
+4. Responds in Telegram
+5. Updates shared files if the response involves a decision or status change
+```
+
+### 3. Scheduled Tasks
+
+```text
+## HEARTBEAT.md — Team Schedule
+
+Daily:
+- 8:00 AM: Milo posts morning standup (aggregates overnight agent activity)
+- 9:00 AM: Josh pulls key metrics
+- 10:00 AM: Marketing surfaces content ideas from trending topics
+- 6:00 PM: Milo posts end-of-day recap
+
+Ongoing:
+- Dev: Monitor CI/CD health, review PRs as they come in
+- Marketing: Reddit/X keyword monitoring (every 2 hours)
+- Josh: Competitor pricing checks (weekly)
+
+Weekly:
+- Monday: Milo drafts weekly priorities (input from all agents)
+- Friday: Josh compiles weekly metrics report
+```
+
+## Key Insights
+
+- **Personality matters more than you'd think**: Giving agents distinct names and communication styles makes it natural to "talk to your team" rather than wrestle with a generic AI
+- **Shared memory + private context**: The combination is critical — agents need common ground (goals, decisions) but also their own space to accumulate domain expertise
+- **Right model for the right job**: Don't use an expensive reasoning model for keyword monitoring. Match model capability to task complexity
+- **Scheduled tasks are the flywheel**: The real value emerges when agents proactively surface insights, not just when you ask
+- **Start with 2, not 4**: Begin with a lead + one specialist, then add agents as you identify bottlenecks
+
+## Inspired By
+
+This pattern was described by [Trebuh on X](https://x.com/iamtrebuh/status/2011260468975771862), a solo founder who set up 4 OpenClaw agents — Milo (strategy lead), Josh (business), a marketing agent, and a dev agent — all controlled through a single Telegram chat on a VPS. Each agent has its own personality, model, and scheduled tasks, while sharing project memory. He described it as "a real small team available 24/7."
+
+The pattern was also confirmed on the [OpenClaw Showcase](https://openclaw.ai/showcase), where `@jdrhyne` reported running "15+ agents, 3 machines, 1 Discord server — IT built most of this, just by chatting," and `@nateliason` described a multi-model pipeline (prototype → summarize → optimize → implement → repeat) using different models at each stage. Another user, `@danpeguine`, runs two different OpenClaw instances collaborating in the same WhatsApp group.
+
+## Related Links
+
+- [OpenClaw Subagent Documentation](https://github.com/openclaw/openclaw)
+- [OpenClaw Telegram Skill](https://github.com/openclaw/openclaw)
+- [OpenClaw Showcase](https://openclaw.ai/showcase)
+- [Anthropic: Building Effective Agents](https://www.anthropic.com/research/building-effective-agents)
--- a/usecases/n8n-workflow-orchestration.md
+++ b/usecases/n8n-workflow-orchestration.md
@@ -0,0 +1,107 @@
+# OpenClaw + n8n Workflow Orchestration
+
+Letting your AI agent directly manage API keys and call external services is a recipe for security incidents. Every new integration means another credential in `.env.local`, another surface for the agent to accidentally leak or misuse.
+
+This use case describes a pattern where OpenClaw delegates all external API interactions to n8n workflows via webhooks — the agent never touches credentials, and every integration is visually inspectable and lockable.
+
+## Pain Point
+
+When OpenClaw handles everything directly, you get three compounding problems:
+
+- **No visibility**: It's hard to inspect what the agent actually built when it's buried in JavaScript skill files or shell scripts
+- **Credential sprawl**: Every API key lives in the agent's environment, one bad commit away from exposure
+- **Wasted tokens**: Deterministic sub-tasks (send an email, update a spreadsheet) burn LLM reasoning tokens when they could run as simple workflows
+
+## What It Does
+
+- **Proxy pattern**: OpenClaw writes n8n workflows with incoming webhooks, then calls those webhooks for all future API interactions
+- **Credential isolation**: API keys live in n8n's credential store — the agent only knows the webhook URL
+- **Visual debugging**: Every workflow is inspectable in n8n's drag-and-drop UI
+- **Lockable workflows**: Once a workflow is built and tested, you lock it so the agent can't modify how it interacts with the API
+- **Safeguard steps**: You can add validation, rate limiting, and approval gates in n8n before any external call executes
+
+## How It Works
+
+1. **Agent designs the workflow**: Tell OpenClaw what you need (e.g., "create a workflow that sends a Slack message when a new GitHub issue is labeled `urgent`")
+2. **Agent builds it in n8n**: OpenClaw creates the workflow via n8n's API, including an incoming webhook trigger
+3. **You add credentials**: Open n8n's UI, add your Slack token / GitHub token manually
+4. **You lock the workflow**: Prevent further modifications by the agent
+5. **Agent calls the webhook**: From now on, OpenClaw calls `http://n8n:5678/webhook/my-workflow` with a JSON payload — it never sees the API key
+
+```text
+┌──────────────┐     webhook call      ┌─────────────────┐     API call     ┌──────────────┐
+│   OpenClaw   │ ───────────────────→  │   n8n Workflow   │ ─────────────→  │  External    │
+│   (agent)    │   (no credentials)    │  (locked, with   │  (credentials   │  Service     │
+│              │                       │   API keys)      │   stay here)    │  (Slack, etc)│
+└──────────────┘                       └─────────────────┘                  └──────────────┘
+```
+
+## Skills You Need
+
+- `n8n` API access (for creating/triggering workflows)
+- `fetch` or `curl` for webhook calls
+- Docker (if using the pre-configured stack)
+- n8n credential management (manual, one-time setup per integration)
+
+## How to Set It Up
+
+### Option 1: Pre-configured Docker Stack
+
+A community-maintained Docker Compose setup ([openclaw-n8n-stack](https://github.com/caprihan/openclaw-n8n-stack)) pre-wires everything on a shared Docker network:
+
+```bash
+git clone https://github.com/caprihan/openclaw-n8n-stack.git
+cd openclaw-n8n-stack
+cp .env.template .env
+# Add your Anthropic API key to .env
+docker-compose up -d
+```
+
+This gives you:
+- OpenClaw on port 3456
+- n8n on port 5678
+- Shared Docker network so OpenClaw can call `http://n8n:5678/webhook/...` directly
+- Pre-built workflow templates (multi-LLM fact-checking, email triage, social monitoring)
+
+### Option 2: Manual Setup
+
+1. Install n8n (`npm install n8n -g` or run via Docker)
+2. Configure OpenClaw to know the n8n base URL
+3. Add this to your AGENTS.md:
+
+```text
+## n8n Integration Pattern
+
+When I need to interact with external APIs:
+
+1. NEVER store API keys in my environment or skill files
+2. Check if an n8n workflow already exists for this integration
+3. If not, create one via n8n API with a webhook trigger
+4. Notify the user to add credentials and lock the workflow
+5. For all future calls, use the webhook URL with a JSON payload
+
+Workflow naming: openclaw-{service}-{action}
+Example: openclaw-slack-send-message
+
+Webhook call format:
+curl -X POST http://n8n:5678/webhook/{workflow-name} \
+  -H "Content-Type: application/json" \
+  -d '{"channel": "#general", "message": "Hello from OpenClaw"}'
+```
+
+## Key Insights
+
+- **Three wins in one**: Observability (visual UI), security (credential isolation), and performance (deterministic workflows don't burn tokens)
+- **Lock after testing**: The "build → test → lock" cycle is critical — without locking, the agent can silently modify workflows
+- **n8n has 400+ integrations**: Most external services you'd want to connect already have n8n nodes, saving the agent from writing custom API calls
+- **Audit trail for free**: n8n logs every workflow execution with input/output data
+
+## Inspired By
+
+This pattern was described by [Simon Høiberg](https://x.com/SimonHoiberg/status/2020843874382487959), who outlined three reasons this approach beats letting OpenClaw handle API interactions directly: observability through n8n's visual UI, security through credential isolation, and performance by running deterministic sub-tasks as workflows instead of LLM calls. The [openclaw-n8n-stack](https://github.com/caprihan/openclaw-n8n-stack) repository provides a ready-to-run Docker Compose setup implementing this pattern.
+
+## Related Links
+
+- [n8n Documentation](https://docs.n8n.io/)
+- [openclaw-n8n-stack (Docker setup)](https://github.com/caprihan/openclaw-n8n-stack)
+- [n8n Webhook Trigger Docs](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/)
--- a/usecases/self-healing-home-server.md
+++ b/usecases/self-healing-home-server.md
@@ -0,0 +1,182 @@
+# Self-Healing Home Server & Infrastructure Management
+
+Running a home server means being on-call 24/7 for your own infrastructure. Services go down at 3 AM, certificates expire silently, disk fills up, and pods crash-loop — all while you're asleep or away.
+
+This use case turns OpenClaw into a persistent infrastructure agent with SSH access, automated cron jobs, and the ability to detect, diagnose, and fix issues before you know there's a problem.
+
+## Pain Point
+
+Home lab operators and self-hosters face a constant maintenance burden:
+
+- Health checks, log monitoring, and alerting require manual setup and attention
+- When something breaks, you have to SSH in, diagnose, and fix — often from your phone
+- Infrastructure-as-code (Terraform, Ansible, Kubernetes manifests) needs regular updates
+- Knowledge about your setup lives in your head, not in searchable documentation
+- Routine tasks (email triage, deployment checks, security audits) eat hours every week
+
+## What It Does
+
+- **Automated health monitoring**: Cron-based checks on services, deployments, and system resources
+- **Self-healing**: Detects issues via health checks and applies fixes autonomously (restart pods, scale resources, fix configs)
+- **Infrastructure management**: Writes and applies Terraform, Ansible, and Kubernetes manifests
+- **Morning briefings**: Daily summary of system health, calendar, weather, and task board status
+- **Email triage**: Scans inbox, labels actionable items, archives noise
+- **Knowledge extraction**: Processes notes and conversation exports into a structured, searchable knowledge base
+- **Blog publishing pipeline**: Draft → generate banner → publish to CMS → deploy to hosting — fully automated
+- **Security auditing**: Regular scans for hardcoded secrets, privileged containers, and overly permissive access
+
+## Skills You Need
+
+- `ssh` access to home network machines
+- `kubectl` for Kubernetes cluster management
+- `terraform` and `ansible` for infrastructure-as-code
+- `1password` CLI for secrets management
+- `gog` CLI for email access
+- Calendar API access
+- Obsidian vault or notes directory (for knowledge base)
+- `openclaw doctor` for self-diagnostics
+
+## How to Set It Up
+
+### 1. Core Agent Configuration
+
+Name your agent and define its access scope in AGENTS.md:
+
+```text
+## Infrastructure Agent
+
+You are Reef, an infrastructure management agent.
+
+Access:
+- SSH to all machines on the home network (192.168.1.0/24)
+- kubectl for the K3s cluster
+- 1Password vault (read-only for credentials, dedicated AI vault)
+- Gmail via gog CLI
+- Calendar (yours + partner's)
+- Obsidian vault at ~/Documents/Obsidian/
+
+Rules:
+- NEVER hardcode secrets — always use 1Password CLI or environment variables
+- NEVER push directly to main — always create a PR
+- Run `openclaw doctor` as part of self-health checks
+- Log all infrastructure changes to ~/logs/infra-changes.md
+```
+
+### 2. Automated Cron Job System
+
+The power of this setup is the scheduled job system. Configure in HEARTBEAT.md:
+
+```text
+## Cron Schedule
+
+Every 15 minutes:
+- Check kanban board for in-progress tasks → continue work
+
+Every hour:
+- Monitor health checks (Gatus, ArgoCD, service endpoints)
+- Triage Gmail (label actionable items, archive noise)
+- Check for unanswered alerts or notifications
+
+Every 6 hours:
+- Knowledge base data entry (process new Obsidian notes)
+- Self health check (openclaw doctor, disk usage, memory, logs)
+
+Every 12 hours:
+- Code quality and documentation audit
+- Log analysis via Loki/monitoring stack
+
+Daily:
+- 4:00 AM: Nightly brainstorm (explore connections between notes)
+- 8:00 AM: Morning briefing (weather, calendars, system stats, task board)
+- 1:00 AM: Velocity assessment (process improvements)
+
+Weekly:
+- Knowledge base QA review
+- Infrastructure security audit
+```
+
+### 3. Security Setup (Critical)
+
+This is non-negotiable. Before giving your agent SSH access:
+
+```text
+## Security Checklist
+
+1. Pre-push hooks:
+   - Install TruffleHog or similar secret scanner on ALL repositories
+   - Block any commit containing hardcoded API keys, tokens, or passwords
+
+2. Local-first Git workflow:
+   - Use Gitea (self-hosted) for private code before pushing to public GitHub
+   - CI scanning pipeline (Woodpecker or similar) runs before any public push
+   - Human review required before main branch merges
+
+3. Defense in depth:
+   - Dedicated 1Password vault for AI agent (limited scope)
+   - Network segmentation for sensitive services
+   - Daily automated security audits checking for:
+     * Privileged containers
+     * Hardcoded secrets in code or configs
+     * Overly permissive file/network access
+     * Known vulnerabilities in deployed images
+
+4. Agent constraints:
+   - Branch protection: PR required for main, agent cannot override
+   - Read-only access where write isn't needed
+   - All changes logged and auditable via git
+```
+
+### 4. Morning Briefing Template
+
+```text
+## Daily Briefing Format
+
+Generate and deliver at 8:00 AM:
+
+### Weather
+- Current conditions and forecast for [your location]
+
+### Calendars
+- Your events today
+- Partner's events today
+- Conflicts or overlaps flagged
+
+### System Health
+- CPU / RAM / Storage across all machines
+- Services: UP/DOWN status
+- Recent deployments (ArgoCD)
+- Any alerts in last 24h
+
+### Task Board
+- Cards completed yesterday
+- Cards in progress
+- Blocked items needing attention
+
+### Highlights
+- Notable items from nightly brainstorm
+- Emails requiring action
+- Upcoming deadlines this week
+```
+
+## Key Insights
+
+- **"I can't believe I have a self-healing server now"**: The agent can run SSH, Terraform, Ansible, and kubectl commands to fix infrastructure issues before you even know there's a problem
+- **AI will hardcode secrets**: This is the #1 security risk. The agent will happily put an API key inline in code if you don't enforce guardrails. Pre-push hooks and secret scanning are mandatory
+- **Local-first Git is essential**: Never let the agent push directly to public repositories. Use a private Gitea instance as a staging area with CI scanning
+- **Cron jobs are the real product**: The scheduled automation (health checks, email triage, briefings) provides more daily value than ad-hoc commands
+- **Knowledge extraction compounds**: Processing notes, conversation exports, and emails into a structured knowledge base gets more valuable over time — one user extracted 49,079 atomic facts from their ChatGPT history alone
+
+## Inspired By
+
+This use case is based on Nathan's detailed writeup ["Everything I've Done with OpenClaw (So Far)"](https://madebynathan.com/2026/02/03/everything-ive-done-with-openclaw-so-far/), where he describes his OpenClaw agent "Reef" running on a home server with SSH access to all machines, a Kubernetes cluster, 1Password integration, and an Obsidian vault with 5,000+ notes. Reef runs 15 active cron jobs, 24 custom scripts, and has autonomously built and deployed applications including a task management UI. Nathan's hard-won lesson after a Day 1 API key exposure: "AI assistants will happily hardcode secrets. They sometimes don't have the same instincts humans do." His defense-in-depth security setup (TruffleHog pre-push hooks, local Gitea, CI scanning, daily audits) is essential reading for anyone attempting this pattern.
+
+Also referenced on the [OpenClaw Showcase](https://openclaw.ai/showcase), where `@georgedagg_` described a similar pattern: deployment monitoring, log review, configuration fixes, and PR submissions — all while walking the dog.
+
+## Related Links
+
+- [Nathan's Full Writeup](https://madebynathan.com/2026/02/03/everything-ive-done-with-openclaw-so-far/)
+- [OpenClaw Documentation](https://github.com/openclaw/openclaw)
+- [TruffleHog (Secret Scanning)](https://github.com/trufflesecurity/trufflehog)
+- [K3s (Lightweight Kubernetes)](https://k3s.io/)
+- [Gitea (Self-hosted Git)](https://gitea.io/)
+- [n8n (Workflow Automation)](https://n8n.io/)