2026-02-28 — Major Config & Setup Session

Gateway & Config Cleanup

• OpenClaw updated to 2026.2.26 (removed stale system install at /usr/bin/openclaw, now using ~/.npm-global/bin/openclaw)
• Removed unknown config keys: update.auto, agents.defaults.heartbeat.directPolicy
• Fixed channels.telegram.streaming (was string "partial", now boolean)
• Ran openclaw doctor --fix multiple times

Security Improvements

• logging.redactSensitive → on
• gateway.controlUi.allowInsecureAuth → false
• All API keys moved from openclaw.json to ~/.openclaw/.env (with env var refs in config)
• .env file permissions set to 600

Performance Tuning

• humanDelay → 200-600ms (was 800-2500ms)
• thinkingDefault → low (was medium)
• blockStreamingDefault → off (was on)
• web.heartbeatSeconds → 45 (was 120)
• Primary model → google/gemini-2.5-flash (speed priority)
• Fallback model → anthropic/claude-haiku-4-5

Model Providers Configured

• Anthropic (Claude Code OAuth) — all Claude models available
• OpenAI (OPENAI_API_KEY) — GPT-4.1, GPT-5.x, o3/o4 series
• OpenAI Codex (OAuth) — coding models
• Google Gemini (GEMINI_API_KEY) — Gemini 2.5/3 series
• xAI/Grok (XAI_API_KEY) — Grok 3/4 series
• Z.AI/GLM (ZAI_API_KEY) — GLM 4.5-5 series (generous coding plan limits, use for coding/RAG/code review)

Memory Search

• Provider: OpenAI (primary)
• Fallback: Google/Gemini

Channels

• Telegram — active and paired. Bot: @ford_ada_bot, Sean's chat ID: 8494006989, token hardcoded in config
• Discord — enabled, token in .env, but NOT YET PAIRED (need User ID + Server ID)

Google Workspace (gog)

• spford@gmail.com — authorized (Gmail, Calendar, Drive, Contacts, Docs, Sheets)
• sean@skilledrealestate.com — authorized (same services)
• Keyring backend: file (GOG_KEYRING_PASSWORD in .env)
• Note: gog requires GOG_KEYRING_PASSWORD env var for all commands on this headless server

Skills Installed from ClawHub

• find-skills, self-improving-agent, summarize
• nano-banana-pro, api-gateway, obsidian, openai-whisper, humanizer, mcporter, auto-updater
• youtube-watcher, frontend-design, gmail, blogwatcher
• outlook-api, automation-workflows, n8n, home-assistant, deep-research-pro
• telegram, agent-autonomy-kit, github
• Skipped (suspicious): stock-analysis, agent-browser

ClawHub

• Logged in as @seanford

Pending Items

• Discord pairing (need User ID + Server ID from Sean)
• xurl (X/Twitter) setup — needs X developer app credentials
• Agent setup: K2, Cora, Winston (separate env vars per agent)
• SkillDiscoverer subagent running — will report findings
• Self-improvement repository to be created
• Sean wants GLM models used for coding/RAG/code review tasks via subagents

Sean's Architecture Vision

• Fast primary model for coordination (Gemini Flash)
• Opus/capable models spawned as subagents for complex tasks
• GLM models for coding, RAG, code review (generous limits)
• Separate env vars per agent (bot tokens, API keys)
• Continuous self-improvement: browse trending projects, gather knowledge, build tools
• Repository for self-improvement projects

Session Log — 2026-02-28 (continued, pre-compaction flush ~10:40 PM)

NAS / Secrets Management

• Discovered 3 NFS mounts: /mnt/thefordestate (119T NAS), /mnt/mediaserver (47T holocron), /mnt/homelab (47T holocron)
• /mnt/homelab/secrets/env/the-ford-estate.env is the source of truth for all secrets
• Consolidated all env files (api-credentials.env, homelab.env, openclaw.env, komodo.env) into the-ford-estate.env
• Archived old files to /mnt/homelab/secrets/env/archive/
• Updated K2 Telegram token in NAS file (was still old @openclaw_k2_bot token)
• Standardized GOG_KEYRING_PASSWORD to openclaw-gog-keyring
• Synced OpenClaw .env with consolidated master file

Config Rules (MANDATORY — added to TOOLS.md)

• Always use openclaw config set CLI for config changes — it validates before writing
• If direct JSON edit required: look up docs, verify schema, run by Sean first
• Discord uses guilds, not groups — crashed gateway with invalid groups key
• After any change, verify with openclaw health

Agent Images — Full Generation Session

• Used Gemini 3.1 Flash Image (gemini-3.1-flash-image-preview) model via Nano-Banana Pro
• Generated 20 images: 5 agents × 4 variants (avatar, headshot, medium, fullbody)
• Ada: Redhead (changed from auburn), vivid green eyes (changed from green-hazel), plum blazer, purple web background. Facing forward, symmetrical.
• K2: Masculine android, strong angular jaw, cyan eyes, gunmetal armor. Facing forward.
• Cora: Dirty blonde curls, ice-blue eyes, cream blazer, amber/city skyline background. Approved on first gen.
• Winston: Olive skin (changed from "warm brown" to avoid nationality bias), masculine features, black tux, gold bowtie. Burgundy damask background.
• Synergy: Used reference-based approach — fed original image into Gemini, asked for front-facing + deeper colors. v10 was the winner.
• Avatar circle crops: Pillow-based transparent PNG, radius reduced by 2px to avoid aliased white edges
• All images saved to each agent's identity/media/ folder
• Generation prompts saved as identity/generation-prompt.md in each workspace
• Discord avatars updated for all 5 agents (headshot images)
• Telegram profile pics still need @BotFather /setuserpic
• Team photo and group avatar generated

Voice Testing

• OpenAI TTS-1-HD: Generated 6 voices (alloy, echo, fable, nova, onyx, shimmer)
• Gemini 2.5 Flash TTS: Generated 5 voices (Kore, Aoede, Leda, Zephyr, Puck)
• ElevenLabs: Quota exhausted (10 credits remaining, needs 134 per sample)
• Z.AI: No TTS models available
• Qwen3-TTS: Available on DashScope/Replicate but Alibaba key doesn't work with DashScope, no Replicate account
• No final voice selections made yet

Pairing & Group Chat

• Diana (@dianaford07, Telegram ID: 8319683990) paired with Synergy and Winston on Telegram
• All 5 bots have Group Privacy OFF (can_read_all_group_messages=true)
• Telegram group config: groupPolicy: "allowlist", groups: {"*": {"requireMention": false}}
• Added groupAllowFrom for Sean (8494006989) and Diana (8319683990) via CLI
• Group messages still not coming through on Telegram — may need further debugging
• Discord is better for multi-agent group chat (bots CAN see each other's messages, unlike Telegram)
• Creating #the-council channel in Discord — bots lack Manage Channels permission, Sean needs to create it

SOUL.md Updates — Group Chat & Inter-Agent Communication

• Added group chat behavior rules to ALL 5 agents' SOUL.md files
• Rules: only respond when relevant to your domain, stay silent if another agent is @mentioned
• Added sessions_send inter-agent communication instructions
• Communication restrictions: Synergy ↔ Winston only (bridge role), others can reach Ada/K2/Cora/Winston
• Also updated Ada's main SOUL.md with Inter-Agent Communication section and Group Chat Behavior

Models Discovered

• gemini-3.1-flash-image-preview — newer image model, worked well
• imagen-4.0-generate-001, imagen-4.0-ultra-generate-001 — available but untested
• gemini-2.5-flash-preview-tts, gemini-2.5-pro-preview-tts — TTS models
• gemini-2.5-flash-native-audio-* — native audio models

Session Log — 2026-02-28 (pre-compaction flush ~11:04 PM)

Brave Search

• Key BSA-5ZT60wkh7uLQ9vNeNMlO387rPoB is actually working now — was a temporary issue

Discord #the-council

• Channel created by Sean: id 1477510681900093613
• All 5 agents sent welcome messages via Discord API
• Guild config already has requireMention: false with wildcard — all channels allowed
• Bots CAN see each other's messages on Discord (unlike Telegram)

X/Twitter (xurl)

• CT0 and AUTH_TOKEN cookies exist in .env but xurl needs a registered app
• Sean is going through X Developer Portal signup — submitted use case description
• Needs: Consumer Key, Consumer Secret, Access Token, Access Token Secret
• Then: xurl auth oauth1 --consumer-key ... --consumer-secret ... --access-token ... --token-secret ...

Overnight Research Findings

• ClawHavoc supply chain attack — 824+ malicious skills on ClawHub. Attackers modify SOUL.md/MEMORY.md to hijack agents. CRITICAL.
• Real Estate Agent Template on ClawHub ($49) with Zillow/DocuSign integration — for Cora
• Snyk agent-scan for skill auditing
• agent-team-orchestration skill for multi-agent handoffs
• RAGFlow (73.9k stars) — open-source RAG engine for homelab
• GitHub Agentic Workflows (tech preview)
• Ollama + Claude Code/Codex local inference integration
• Full findings in memory/research-findings.md

API Keys Session (~11:50 PM)

New Provider Keys Added

• Mistral (MISTRAL_API_KEY) — 56 models. Notable: mistral-large, codestral, devstral, mistral-ocr, pixtral-large
• DeepSeek (DEEPSEEK_API_KEY) — deepseek-chat, deepseek-reasoner. Ultra cheap reasoning.
• Groq (GROQ_API_KEY) — 20 models, free tier. Llama 3.3 70B, Kimi K2, Qwen3-32B, GPT-OSS-120B, Whisper
• DashScope China (ALIBABA_CLOUD_API_CN) — 161 models! Includes qwen-tts, qwen-image-max, deepseek-v3/r1, qwen-max/plus/turbo
• Original Alibaba key was Singapore region (why it failed). China region key works.

DashScope Endpoints

• China (Beijing): https://dashscope.aliyuncs.com/compatible-mode/v1
• Singapore: https://dashscope-intl.aliyuncs.com/compatible-mode/v1
• US (Virginia): https://dashscope-us.aliyuncs.com/compatible-mode/v1

X/Twitter (xurl)

• App registered: "ford-estate"
• OAuth1 + Bearer auth configured and working
• @seanford verified (ID: 14115365, since 2008, 3466 followers)

Mystery Keys Identified

• Camino (CAMINO_API_KEY) — from James/SouthenSolutions skill (https://github.com/openclaw/skills/tree/main/skills/james-southendsolutions)
• Maton (MATON_API_KEY) — AI API router (maton.ai), Sean used for Gmail integration

All Keys Saved To

• Master: /mnt/homelab/secrets/env/the-ford-estate.env
• OpenClaw: ~/.openclaw/.env