# Agent registry — agents are personas, not queues. # # Per DESIGN-a2a-agents.md v2.1 §2, §5, §5b (commit 714a9ca7), kanboard task # #134 (A2A-2), sibling of #133's model-registry.yaml. An agent is # (identity, Card, Policy, State): {persona/system prompt, memory bank(s), # tool scope, trust class, preferred tier, current backbone}. # # THE ONE-FIELD-BACKBONE-SWAP MECHANISM: an agent's `backbone:` field is the # ONLY thing here that names a concrete model/runtime. Everything a Card # would otherwise duplicate from the model plane (tier the backbone actually # delivers, cost_class, availability a(t), context window) is NOT stored # statically on the agent — it is resolved at read time by dereferencing # `backbone` into model-registry.yaml (via model_registry.py) or, for # non-metered flat-subscription runtimes model-registry.yaml deliberately # excludes (kb#133: "Claude Code ... belongs in the agent registry"), into # the `runtimes:` section below. See agent_registry.py:effective_card(). # This is what makes "switching a backbone is one field" true rather than # aspirational: edit `backbone: kimi` -> `backbone: local-small` and the # derived tier/cost/a(t) change with it, with nothing else to keep in sync. # # `preferred_tier` is a POLICY field (what this persona asks for), distinct # from the backbone's actual delivered tier (a FACT, resolved above) — they # usually agree but don't have to (e.g. a large-preferring agent temporarily # pinned to a small backbone during a quota outage). # # v2.1: personas + Cards live in git, deployed to runtimes — never # live-edited in volumes (kb#156). Several agents below still point at a # live-volume persona (adolf's SOUL.md) because #156 (git-deploy pipeline) # hasn't landed yet; this registry records that fact, it doesn't fix it. # # Trust class is on every Card (§5) and is what kb#140 (capability routing) # and kb#147 (grant enforcement / vault access) consume — see # routing_consumption: at the bottom. Several Cards below (torgash, # researcher, elizaveta's KB identity) describe TARGET state for agents/ # accounts that don't exist yet; each is flagged `status: target` / # `note:` rather than silently implying they're live. Building them is # explicitly out of kb#134's scope (registry only). # # Read with agent_registry.py (same directory): load_registry(), # get_agent(), effective_card(), trust_rank(). schema_version: 1 # ── trust classes (§5) ────────────────────────────────────────────────── # "human > trusted > sandboxed > untrusted". Numeric rank lets routing/grant # code do `>=` comparisons instead of string-matching an ordered list. # # default_budget_usd/budget_duration (kb#147): defense-in-depth defaults fed # into each agent's LiteLLM virtual-key spec (agent_registry.py: # litellm_key_spec()) when the agent doesn't override them. Moot for money # TODAY (§3a: no metered API by default, only free local-small is reachable # without opt-in) but real once anything metered is opted into a tier pool — # a budget cap should already exist rather than being bolted on later. trust_classes: human: { rank: 3, note: "vault access yes; not MCP-tool-scoped, IS the reasoning" } trusted: { rank: 2, note: "vault access yes (DECIDED, kb#147); outward actions per ask-first rules", default_budget_usd: 50.0, budget_duration: "30d" } sandboxed: { rank: 1, note: "no vault, no outward sends; scoped MCP allowlist; KB access project-scoped", default_budget_usd: 5.0, budget_duration: "30d" } untrusted: { rank: 0, note: "anything ingesting the open web; its OUTPUTS are tainted, not just its access restricted", default_budget_usd: 0.0, budget_duration: "30d" } # ── runtimes ───────────────────────────────────────────────────────────── # Backbones deliberately OUTSIDE model-registry.yaml's `models:` list. # kb#133 excluded Claude Code explicitly: "a flat-subscription runtime, not # a metered API deployment — it belongs in the agent registry (#134), not # here." This is that home. Same lookup contract as a model-registry entry # (id, tier, cost_class, lifecycle, context_tokens) so agent_registry.py's # backbone resolver can treat the two sources uniformly. runtimes: - id: claude-code-cli role: "Claude Code CLI — flat Anthropic subscription runtime (this session's own kind)" tier: large context_tokens: 200000 # current Sonnet/Opus family context window; re-verify on model upgrades cost_class: subscription lifecycle: always-on # gated by Claude Code's own usage windows, not GPU/quota probes quota_probe: "claude-usage (kanboard/bin/claude-usage); orchestration/quota-gating rules documented in kanboard/CLAUDE.md" metered: false opt_in_required: false # ── agents ─────────────────────────────────────────────────────────────── agents: # ── Adolf — proactive auditor / personal assistant ────────────────────── - id: adolf capabilities: [matrix-chat, task-triage, proactive-monitoring, memory-recall, cron-scheduling, browser] persona: role: "proactive auditor / personal assistant, talks to alvis and elizaveta over Matrix" trivial: false prompt_source: current: "container adolf:/home/node/.openclaw/workspace/SOUL.md — lives in the adolf-state Docker VOLUME, live-editable, zero git history. This is the kb#156 migration-debt state; recorded here per kb#134's brief, not migrated." companion_files: ["AGENTS.md", "IDENTITY.md", "TOOLS.md", "USER.md", "HEARTBEAT.md"] # same workspace, same volume, same debt target: "git-controlled path once kb#156 lands (e.g. openai/personas/adolf/SOUL.md), deployed read-only into the volume" trust_class: trusted preferred_tier: large backbone: kimi # resolves via model-registry.yaml (adolf-llm Kimi-CLI wrapper endpoint). Swap this ONE field to rebackbone Adolf. tool_allowlist: mcp_servers: [hindsight, openclaw-tools, kanboard, marketplace, agap] gateway_tools: [cron, nodes, browser] # openclaw.json gateway.tools.allow, live 2026-07-21 vault_access: true # trusted-only per §5 DECIDED; reaches vw_* via the `agap` MCP server # kb#144 (A2A-12): PER-TOOL scoping, TWO layers — 2026-07-22, second # pass after a live-verified miss on the first. Each server below # keeps its own justification comment in its config; this is the # registry's copy of the same lists (source of truth this side — # validate_capability_grants.py cross-checks against BOTH). # # Layer 1 — OpenClaw's own mcp.servers.*.toolFilter.include in # adolf/openclaw.json, applied when OpenClaw (the `adolf` container) # builds ITS OWN tool bundle. Landed first pass, verified schema-valid # via `openclaw config validate` / `openclaw mcp probe`. Real, correct # for OpenClaw's own client — but NOT what determines the model's # actual per-turn context on Adolf's kimi backbone. # # Layer 2 — shared-mcp.json's per-server `enabledTools`, which # adolf-llm/server.js's writeMcpConfig() seeds into each Kimi CLI # session's project-root .mcp.json (Gate 1). THIS is the layer that # actually reaches the model: Kimi CLI auto-discovers that file, not # OpenClaw's config, and applies its own McpServerCommonFields. # enabledTools/disabledTools via computeEnabledNames (an allowlist # when only enabledTools is set — confirmed by decompiling the # installed @moonshot-ai/kimi-code package's dist/main.mjs, both # copies of the function, packages/agent-core{,-v2}/src/agent/mcp/ # connection-manager.ts). The first kb#144 pass got this backwards — # see the release comment on kb#144 for the exact wire.jsonl proof # (tool counts unchanged post-restart) that caught it: Layer 1 alone # is invisible to Kimi. # # Counts (same tool lists both layers, confirmed identical by # validate_capability_grants.py, exit 0): # agap 32->24, hindsight 29->9, kanboard 23->14, # openclaw-tools 5->5 (already minimal, no filter needed). # marketplace stays UNFILTERED at layer 1 (7/13 kept) but is not in # shared-mcp.json AT ALL — Kimi's session never had it in the first # place (pre-existing gap between what OpenClaw offers Adolf and # what reaches Kimi, out of kb#144's scope to close). # Reachable-by-Kimi total: hindsight+kanboard+openclaw-tools+agap # 102-13(marketplace, never reached Kimi)=89 -> 9+14+5+24=52 tools # (-42%). Byte-measured (chars/4) against each server's real # tools/list JSON schemas: est. ~7K tokens saved/turn — estimate # pending the real wire.jsonl number, which needs the adolf-llm # container restart alvis owns (shared-mcp.json is bind-mounted # read-only but adolf-llm's server.js caches its content at process # start, so editing the file alone does not take effect — see # capability_grant_status below for the confirm-post-restart command). # # kb#95 (2026-07-23): added wiki_search/wiki_read/wiki_edit (family # MediaWiki / РодоВики, family.alogins.net) to agap-mcp and to both # layers' agap allowlist below — Adolf's persona domain (relatives, # dates, events), same reasoning as HA/Zabbix/Todoist above. This ages # the counts comment above (agap 32->24, total 52) by +3/+3; not # recomputed here since it needs the same live wire.jsonl proof kb#144 # used and this task does not touch the running containers (see # shared_mcp_kimi_allowlist below for the exact confirm command). mcp_tool_filter: hindsight: [recall, retain, reflect, list_memories, get_memory, update_memory, list_directives, create_directive, delete_directive] kanboard: [kanboard_list_projects, kanboard_get_project, kanboard_list_tasks, kanboard_my_tasks, kanboard_get_task, kanboard_search_tasks, kanboard_list_users, kanboard_project_activity, kanboard_create_task, kanboard_update_task, kanboard_move_task, kanboard_change_task_status, kanboard_assign_task, kanboard_add_comment] marketplace: [marketplace_find_best, marketplace_search, marketplace_get_product, marketplace_get_recommendations, marketplace_get_reviews, marketplace_compare_prices, marketplace_status] agap: [vw_get_password, vw_get_item, vw_list_items, vw_create_login, vw_update_password, ha_get_state, ha_list_entities, ha_call_service, ha_get_history, zabbix_get_problems, zabbix_get_hosts, zabbix_get_items, zabbix_get_triggers, radicale_list_calendars, radicale_list_events, radicale_get_event, radicale_put_event, radicale_delete_event, radicale_move_event, todoist_list_tasks, todoist_list_projects, todoist_create_task, todoist_update_task, todoist_complete_task, wiki_search, wiki_read, wiki_edit] openclaw-tools: null # no filter in openclaw.json — already minimal (5/5 kept) note: > "scoped core tools" per kb#134's brief, now REAL at both levels: this IS openai/openclaw.json's live mcp.servers block (server selection) plus its per-server toolFilter.include (tool selection, kb#144). Not a narrower aspirational allowlist — validate_capability_grants.py cross-checks both against the live config. LiteLLM virtual-key budgets remain kb#147's separate job; this field is the input #147 consumes for MCP scope (litellm_key_spec() handles the model side). capability_grant: # kb#147 — the enforcement input for LiteLLM + agap-mcp litellm_key_alias: adolf mcp_auth_token_env: AGAP_MCP_TOKEN_ADOLF # secret lives in Vaultwarden + this container's env, never in git; see agap-mcp/docker-compose.yml AGAP_MCP_AGENT_TOKENS note: > Reachable model tiers derived at read time from preferred_tier via agent_registry.py:litellm_key_spec() — not duplicated here. Actual virtual-key provisioning happens via openai/provision_litellm_keys.py against the live LiteLLM proxy; NOT run automatically by this registry (privileged action, requires the LiteLLM master key — kb#147 handover step, see task comment). memory: banks: - { id: adolf-alvis, role: private, interlocutor: alvis } - { id: adolf-elizaveta, role: private, interlocutor: elizaveta } - { id: adolf-shared, role: shared, interlocutor: household } current_state: > NOT split yet. A single live bank "adolf" (hindsight MCP, http://hindsight:8888/mcp/adolf/, 269+ facts) serves every interlocutor today with no per-human isolation — the exact defect kb#153 exists to fix (depends on this registry existing first). The three banks above are kb#153's target, not current fact. kb_identity: { username: adolf, user_id: 3 } availability_note: "a(t) inherited from backbone at read time (kimi: quota-gated, ~60msg/5h ~300/wk — see model-registry.yaml)" # ── claude-coder — the Claude Code loop as an ordinary consumer ───────── - id: claude-coder capabilities: [coding, kanboard-dispatch, git, infra-ops, code-review] persona: role: "implementer — pulls complex coding tasks from the fabric (design §2 theorem 5, 'never special')" trivial: false prompt_source: current: "git-native, layered: ~/.claude/CLAUDE.md (global user memory) + kanboard/CLAUDE.md (canonical kb orchestration ruleset) + per-repo CLAUDE.md files (e.g. agap_git/CLAUDE.md)" note: "No single SOUL.md — persona is these CLAUDE.md conventions, already git-controlled. No kb#156 debt for this agent." trust_class: trusted preferred_tier: large backbone: claude-code-cli # resolves via runtimes: above (kb#133 exclusion), NOT model-registry.yaml tool_allowlist: mcp_servers: [kanboard, agap] native_tools: [Bash, Read, Edit, Write, Agent, WebFetch, WebSearch, git] vault_access: true # trusted note: > Widest-scoped agent by design (this session's own tool surface) — gated by ask-first rules on outward/destructive actions rather than MCP allowlisting. Per kb#147, a real virtual-key budget still applies. capability_grant: litellm_key_alias: claude-coder mcp_auth_token_env: AGAP_MCP_TOKEN_CLAUDE_CODER note: "same mechanism as adolf's capability_grant above; see that note." memory: banks: [] model: "session (ephemeral, per invocation) + repo state (git history, CLAUDE.md files, kanboard task/comment history) — no persistent Hindsight bank" kb_identity: { username: claude, user_id: 2 } availability_note: "a(t) inherited from backbone at read time (claude-code-cli: always-on, gated by claude-usage windows)" # ── torgash — marketplace analyst (sandboxed) ─────────────────────────── - id: torgash capabilities: [price-comparison, marketplace-search, cart-ops, product-recommendations] persona: role: "marketplace analyst — price comparison / shopping across Ozon, Yandex Market, etc." trivial: false prompt_source: current: null note: "NOT yet stood up as a running persona — this Card is target state per design §2's agent table and the A2A design-review plan. Building the runtime is out of kb#134's scope (registry only); flagging as follow-up work." trust_class: sandboxed preferred_tier: small backbone: local-small tool_allowlist: mcp_servers: [marketplace] vault_access: false # sandboxed — hard rule §5, no exceptions outward_sends: false note: "scoped to mcp__marketplace__* tools only; no gitea/ha/zabbix/radicale, no kanboard project outside its own." capability_grant: litellm_key_alias: torgash mcp_auth_token_env: AGAP_MCP_TOKEN_TORGASH note: > Not provisioned yet (agent not built — see persona.prompt_source above). litellm_key_spec('torgash') already resolves correctly against the registry today (preferred_tier: small -> models=[local- small's litellm_model_name] only, no large/paid-fallback) — verified by kb#147's provision_litellm_keys.py --dry-run. memory: banks: [{ id: torgash, role: private }] current_state: "bank not yet created — target state, same as the persona itself" kb_identity: username: null note: "no Kanboard account provisioned yet; §5 calls for KB access project-scoped to a dedicated project once created — gap, not in kb#134's scope." availability_note: "a(t) inherited from backbone at read time (local-small: always-on, VRAM-bound)" # ── researcher — autonomous, sandboxed/untrusted-input loop ───────────── - id: researcher capabilities: [web-research, synthesis, low-priority-background-loop] persona: role: "autonomous researcher — low-priority self-submitting loop (design §6, §8)" trivial: false prompt_source: { current: null, note: "not yet built; target-state Card, same caveat as torgash." } trust_class: sandboxed trust_note: > Ingests the open web, so its OUTPUTS are tainted regardless of its own sandboxed access level (the untrusted-INPUT rule, §5). Promotion of tainted output into a trusted agent's memory or into any action requires a gate — initially a task to alvis's inbox. preferred_tier: small backbone: local-small # escalates to large via always-ask policy (§5) for synthesis — never silent retry-on-bigger-model tool_allowlist: mcp_servers: [] # target: a scoped web-search/fetch surface once built native_tools: [WebSearch, WebFetch] vault_access: false outward_sends: false capability_grant: litellm_key_alias: researcher mcp_auth_token_env: AGAP_MCP_TOKEN_RESEARCHER note: "not provisioned yet (agent not built) — same verification status as torgash's capability_grant above." memory: banks: [{ id: researcher, role: private }] current_state: "bank not yet created — target state" kb_identity: username: null note: "needs its own KB project(s) per §5 ('researcher gets its own KB project(s)') — not yet created, gap outside kb#134's scope." availability_note: "a(t) inherited from backbone at read time (local-small: always-on, VRAM-bound)" # ── model-agents — trivial personas (from kb#133) ─────────────────────── # Design §2 table row 1: "LLM endpoint (kimi, gemma3:4b, ...) | persona: # trivial (identity) | memory: none". These are direct-address targets # (router mode target=agent-id) for a caller that wants THIS backbone # specifically, bypassing any persona/tool-scope layer — distinct from # e.g. `adolf`, which happens to use the `kimi` backbone today but adds a # persona, memory, and tool scope on top. Only the two chat-capable # models get an agent entry; bge-m3/tei-reranker are non-chat sidecars in # model-registry.yaml, not addressable A2A targets. - id: kimi-endpoint capabilities: [raw-completion] persona: { role: "trivial identity — the kimi backbone exposed directly, no persona layer", trivial: true, prompt_source: { current: null } } trust_class: untrusted # a bare model endpoint makes no trust decisions itself; the caller's trust class governs what reaches it preferred_tier: large backbone: kimi tool_allowlist: { mcp_servers: [], native_tools: [], vault_access: false } memory: { banks: [], model: "none (trivial persona)" } kb_identity: { username: null } - id: local-small-endpoint capabilities: [raw-completion] persona: { role: "trivial identity — the local-small backbone exposed directly, no persona layer", trivial: true, prompt_source: { current: null } } trust_class: untrusted preferred_tier: small backbone: local-small tool_allowlist: { mcp_servers: [], native_tools: [], vault_access: false } memory: { banks: [], model: "none (trivial persona)" } kb_identity: { username: null } # ── humans — first-class agents (§2, §5b) ─────────────────────────────── # "The human being an agent is not a metaphor": approval gates and # decisions are ordinary tasks submitted to a human's inbox, which IS the # Kanboard column/assignment he already processes. No `backbone` — humans # ARE the reasoning, not a resolvable model. - id: alvis capabilities: [approval, decision, escalation-target] persona: { role: "human — primary user/owner of Agap" } trust_class: human preferred_tier: null backbone: null tool_allowlist: null # n/a — outranks `trusted`, not MCP-scoped memory: banks: - { id: adolf-alvis, role: private } - { id: adolf-shared, role: shared } current_state: "today's single unsplit 'adolf' bank mixes alvis + elizaveta content; split pending kb#153" matrix_id: "@admin:mtx.alogins.net" kb_identity: username: admin user_id: 1 note: "assumed == alvis (sole non-bot app-admin account); the Kanboard user record's email field is unpopulated so this can't be confirmed via API — verify by hand if it's ever ambiguous." inbox: "tasks assigned to Kanboard user 'admin' (id 1) across projects — his approval/escalation inbox (design §2)" availability: "a(t) = waking hours (informal, no fixed function yet); vacation mode sets a(t)=0 and parks his inbox per §5b" - id: elizaveta capabilities: [approval, decision, escalation-target] persona: { role: "human — household member" } trust_class: human preferred_tier: null backbone: null tool_allowlist: null memory: banks: - { id: adolf-elizaveta, role: private } - { id: adolf-shared, role: shared } current_state: "not yet split out of the single 'adolf' bank — kb#153, flagged urgent-ish there since she is on Adolf's Matrix allowlist TODAY with a shared, unpartitioned bank." matrix_id: "@elizaveta:mtx.alogins.net" kb_identity: username: null note: "no Kanboard account provisioned for her yet — her only inbox today is the Matrix DM channel (Adolf's dm.allowFrom), not a KB column. Gap / candidate follow-up task, out of kb#134's scope." inbox: "none in Kanboard yet (see kb_identity note above); Matrix DM is the only channel today" # ── memory bank policy (§5b) ───────────────────────────────────────────── # Hard rules the hindsight-memory plugin's recall/retain hooks must enforce # once kb#153 implements bank selection by interlocutor. Registry mirror of # model-registry.yaml's gpu_residency_policy: the parameters a consumer # reads, not the enforcement logic itself. memory_bank_policy: hard_rules: - "content from one human's conversations must never surface to another human (correctness property, not preference)" - "promotion private -> shared happens only by the owning human's explicit action or an approval task — never automatically" - "recall is interlocutor-scoped: the hindsight-memory plugin selects the bank by interlocutor identity (Matrix sender)" - "sandboxed agents (torgash, researcher) read at most the shared bank, never any private bank" banks: - { id: adolf-alvis, owner: alvis, role: private, status: target, note: "kb#153 not yet done" } - { id: adolf-elizaveta, owner: elizaveta, role: private, status: target, note: "kb#153 not yet done" } - { id: adolf-shared, owner: household, role: shared, status: target, note: "kb#153 not yet done" } - { id: adolf, owner: null, role: legacy, status: live-today, note: "single unsplit bank every interlocutor currently reads/writes; superseded by the three rows above once kb#153 lands" } - { id: torgash, owner: torgash, role: private, status: target, note: "agent not yet built" } - { id: researcher, owner: researcher, role: private, status: target, note: "agent not yet built" } # ── how downstream tasks consume this file ──────────────────────────────── # Documents the contract kb#140 (routing) and kb#147 (grant enforcement) # build against, mirroring model-registry.yaml's `routing:` section. routing_consumption: trust_gate: > kb#147: a task requiring vault access may target only an agent whose trust_classes[...].rank >= trust_classes.trusted.rank (i.e. trusted or human). Sandboxed/untrusted agents' tool_allowlist.vault_access is always false by construction above — kb#147's job is to make that provably true at the MCP/LiteLLM enforcement points, not just on paper. capability_routing: > kb#140: given a task's required capabilities + trust constraint, the router filters agents by capabilities ⊆ agent.capabilities, trust rank >= required, and current a(t) == 1 (resolved via agent_registry.py's effective_card(), which dereferences `backbone` into model-registry.yaml or `runtimes:` above) — no submitter-side hardcoded agent id needed. # ── kb#147 (A2A-15) implementation status ──────────────────────────────── # What "enforced" means as of this task, per enforcement point (§5 lists # three: agap-mcp vault tools, OpenClaw per-agent MCP scoping, LiteLLM # virtual keys). Recorded here — not just in the KB task comment — because # this file is the grants source of truth the design demands. capability_grant_status: agap_mcp_vault_gate: > IMPLEMENTED, tested, NOT ACTIVATED. agap-mcp/src/trust-gate.js resolves a bearer token -> agent id -> trust rank (reading THIS file, mounted read-only) and agap-mcp/src/server.js gates every vw_* tool behind it. Proven with two real, run-now test suites (no live container touched): src/trust-gate.test.mjs (pure logic, 10/10) and src/trust-gate-http.test.mjs (real HTTP request/response, 4/4) — the latter shows a sandboxed-agent token, no token, and an unknown token all get "vault access denied" while a trusted-agent token passes. OFF by default (AGAP_MCP_ENFORCE_VAULT_TRUST=0 in docker-compose.yml) so this change is zero-impact until an operator: (1) generates real per-agent bearer tokens, stores them in Vaultwarden, wires them into AGAP_MCP_AGENT_TOKENS, (2) sets AGAP_MCP_ENFORCE_VAULT_TRUST=1, (3) restarts the agap-mcp container — deliberately not done by this task (never restart the live agap-mcp service unattended). litellm_virtual_keys: > SPEC'D, NOT PROVISIONED. agent_registry.py:litellm_key_spec() computes each agent's model allow-list (derived from preferred_tier x model-registry.yaml routing.tiers, non-metered only unless opted in) and a default budget from trust_classes[...].default_budget_usd. openai/provision_litellm_keys.py turns that spec into LiteLLM /key/generate calls. Verified with --dry-run (prints the exact payload per agent, no network call) — actually creating keys needs LITELLM_MASTER_KEY against the live proxy, a privileged write this task does not perform unattended; see the kb#147 task comment for the exact command to run once approved. openclaw_mcp_allowlist: > STRUCTURAL at both server AND tool level, cross-checked (kb#144 extended this from server-only). adolf/openclaw.json's mcp.servers block is adolf's real, live MCP surface (git-controlled): its server set matches tool_allowlist.mcp_servers, and each server's toolFilter.include (added kb#144 first pass) matches tool_allowlist.mcp_tool_filter — exactly. openai/validate_capability_grants.py checks this automatically, read-only, no live changes. Real and correct for OpenClaw's OWN MCP client surface — but per the kb#144 first-pass release comment's wire.jsonl proof, this layer alone does NOT reach the model on Adolf's kimi backbone (see shared_mcp_kimi_allowlist below, the layer that does). NOT restarted by this task for this file's change either way (openclaw.json is bind-mounted read-only as the live config; `docker compose restart adolf` is the activation step, alvis's call). shared_mcp_kimi_allowlist: > STRUCTURAL, cross-checked, NOT YET ACTIVATED — kb#144 SECOND pass (2026-07-22), added after live verification (restart + one real turn, wire.jsonl inspection) proved the first pass's openclaw.json-only fix left Kimi's actual tool bundle unchanged (23/32/29/5, not 14/24/9/5). Root cause: Kimi CLI auto-discovers a project-root `.mcp.json` that adolf-llm/server.js's writeMcpConfig() seeds from openai/shared-mcp.json — a completely separate config from openclaw.json, read by a separate MCP client (Kimi CLI inside the adolf-llm container, not OpenClaw inside the adolf container). shared-mcp.json now carries the same per-server tool lists as `enabledTools` (Kimi's own allowlist field — McpServerCommonFields.enabledTools, applied via computeEnabledNames; confirmed by decompiling the installed @moonshot-ai/kimi-code package's dist/main.mjs, both copies of the function/schema, no live container touched). openai/validate_capability_grants.py now cross-checks THIS file too (load_shared_mcp_enabled_tools), same exit-0-or-fail contract as the openclaw.json check. marketplace is absent from shared-mcp.json entirely (pre-existing: Kimi's session never had it) — not asserted by the validator for that server, by design, not a gap this task opened. NOT YET ACTIVATED: shared-mcp.json IS bind-mounted read-only into adolf-llm (`./shared-mcp.json:/shared-mcp.json:ro` in openai/docker-compose.yml) so the file on disk is already what the container would read — but adolf-llm/server.js loads it ONCE into a module-level variable at process start (not per-request), so editing the file alone does not take effect; `docker compose restart adolf-llm` is the only remaining step, deliberately not run by this task (never restart a live service unattended). Confirm the real post-restart per-turn token delta via the adolf-llm container's Kimi session wire log: `docker exec adolf-llm sh -c "tail -1 /root/.kimi-code/sessions/*/agents/main/wire.jsonl"` (after one real turn against a NEW session, since existing sessions' .mcp.json is rewritten on their next turn too) and compare per-server tool counts against 9/14/5/24 (hindsight/kanboard/openclaw-tools/agap) — the exact same command the first-pass verification used to catch the miss.