adolf: bearer-authenticate the agap MCP server, fix audio config schema

openclaw.json now sends `Authorization: Bearer ${AGAP_MCP_TOKEN}` to the agap
MCP server, which requires it as of kb#180. The token is injected from
openai/.env via docker-compose.yml and only substituted here, never inlined.
It maps to agent id `adolf`, which is also what the kb#147 vault gate reads.

Fixes tools.media.audio, which had been added but never restart-validated:
the per-entry `apiKey: "not-needed"` is rejected by the schema
("tools.media.audio.models.0: Invalid input"), and an invalid config makes the
gateway refuse to start outright -- adolf crash-looped on the first restart
after the block landed. The old comment claimed the schema requires a
non-empty apiKey; it is the opposite, apiKey is not a valid per-entry key at
all. Isolated with `openclaw config validate` against the running image
(2026.6.11): {provider, model} and {provider, model, baseUrl} validate, and
adding apiKey alone reproduces the failure. baseUrl is kept -- that is the
per-entry override pointing the openai-shaped provider at the local
faster-whisper server. Provider auth follows the normal model auth order per
docs/nodes/audio.md, and faster-whisper-server has no auth to satisfy anyway.

Two lessons encoded in the comments: `enabled: false` does NOT exempt an entry
from schema validation, and a config edit is not done until a restart boots
healthy -- this sat invalid but latent because the running gateway still held
an older loaded config. The block stays enabled: false; turning STT on is
still a kb#175/#191 decision (GTX 1070 co-residency).

Also adds the proactive-prioritization and todoist-capture design notes and
the vw-mcp prototype.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

adolf/README.md

@@ -11,6 +11,16 @@ gateway configuration**.
   the `openai` compose project's own tree.
 - Model backend: `adolf-llm` container (Kimi-CLI wrapper) on `:8010`
 
+## Memory
+
+Adolf's long-term memory is being **migrated from Cognee to Hindsight** (a single
+self-hosted container, `:8888` REST + built-in MCP, `:9999` UI). It stays wired in
+the same two ways: as a **tool** (Hindsight's built-in MCP in `openclaw.json`
+`mcp.servers.hindsight`) and as **forced hooks** (the `hindsight-memory` OpenClaw
+plugin: `before_prompt_build`→recall inject, `agent_end`→retain). Authoritative
+plan and target architecture: **[`HINDSIGHT-MIGRATION.md`](./HINDSIGHT-MIGRATION.md)**
+(kanboard *Adolf* tasks H1–H5). Until those land, the running stack is still Cognee.
+
 ## Config source of truth
 
 The gateway config is **`openclaw.json` in this directory**. It is bind-mounted
@@ -109,3 +119,32 @@ To **revoke** access, remove the ID from `allowFrom` and restart.
 > Matrix accounts themselves are created on the Synapse homeserver
 > (`mtx.alogins.net`) — see the AgapHost wiki **Matrix** page. The allow-list
 > here only controls which existing Matrix users Adolf will talk to.
+
+## Matrix device identity (kb#67)
+
+Adolf's Matrix login used **password auth with no pinned `device_id`**
+(`MATRIX_PASSWORD` in `openai/.env`). Every time OpenClaw's own credential
+cache (in the `adolf-state` volume) was missing — first boot, a lost/rebuilt
+volume — a fresh password login minted a **brand-new Matrix device** with no
+cross-signing, leaving dead ghost devices behind and risking new encrypted
+DMs getting keys shared to a device that no longer exists.
+
+Fix: `openai/.env` now also pins `MATRIX_ACCESS_TOKEN` + `MATRIX_DEVICE_ID` to
+Adolf's current live device (`TIANDTKUZJ`, cross-signed; token in Vaultwarden
+as `MATRIX_ADOLF_GATEWAY_TOKEN`). OpenClaw's matrix extension prefers a
+configured access token over password login
+(`extensions/matrix/src/matrix/client/config.ts` `resolveMatrixAuth`), so as
+long as that token stays valid, restarts — even after a volume loss — reuse
+the same device instead of minting a new one. `MATRIX_PASSWORD` stays set as
+a manual-recovery fallback only (unset `MATRIX_ACCESS_TOKEN` to force a fresh
+password login if the token is ever revoked).
+
+Cross-signing for `@bot` is already bootstrapped automatically by OpenClaw's
+matrix extension (`extensions/matrix/src/matrix/sdk/crypto-bootstrap.ts`) —
+no separate setup needed.
+
+If the pinned token is ever revoked/rotated, get a fresh one bound to the
+*same* device by logging in with `device_id` explicitly set to `TIANDTKUZJ`
+(Synapse reuses an existing device when its id is given in `/login`, instead
+of creating a new one), then update `MATRIX_ACCESS_TOKEN` in `openai/.env`
+and Vaultwarden's `MATRIX_ADOLF_GATEWAY_TOKEN`.