--- title: AI Team Gap Analysis — May 2026 created: 2026-05-01 type: investigation status: read-only author: claude-code-rr --- # AI Team Gap Analysis — 2026-05-01 ## TL;DR The protocol exists, the vault exists, the rails (auto-sync, Telegram, systemd) exist. **But only 1.5 of 5 agents are actually wired to the vault.** Hermes and OpenClaw OpsMan — the two 24/7 operations agents on the VPS — have **zero** awareness of `HQ-Vault/`. They write to `/home/ccuser/opsman-work/` which isn't a git repo and isn't synced anywhere. Cowork's project root is pointed at a OneDrive scratch dir, not the vault. The repo-level `CLAUDE.md` still identifies whoever opens it as "CC VPS" — outdated. The protocol is solid. The wiring isn't. --- ## 1. Connectedness audit — who actually touches the vault? | Surface | Reads vault? | Writes vault? | Knows AI Team Protocol? | Notes | |---|---|---|---|---| | Rocky | ✅ | ✅ | obviously | sole human operator | | Claude in chat (claude.ai) | ❌ | ❌ | n/a per protocol | Layer 1 only — Rocky pastes outputs | | **Cowork (Claude Desktop)** | ❓ | ❓ | partial | **project root pointed at `OneDrive\Documents\Claude\Projects\obsidian Curator\`, not the vault.** Earlier today wrote `InitialAudit.md` to its sandbox before being redirected. Rocky has to fix this in Claude Desktop project settings (UI-only change). | | **Claude Code (this instance)** | ✅ | ✅ | ✅ | works because cwd is the repo root + I read the protocol mid-session. Repo-level `CLAUDE.md` is stale though — see gap #2. | | Other Claude Code instances | depends on cwd | depends | depends | each instance reads `CLAUDE.md` from its working directory hierarchy | | **Hermes (VPS)** | ❌ | ❌ | ❌ | `/root/.hermes/SOUL.md` + `USER.md` + `TOOLS.md` mention zero `HQ-Vault` paths. Hermes writes to `/home/ccuser/opsman-work/` flat markdown. No git. No vault. | | **OpenClaw OpsMan (VPS)** | ❌ | ❌ | ❌ | Same situation. No vault references in `/root/.clawdbot-opsman/` config. | | Rivet Voice (VPS) | ❌ | ❌ | n/a | not a writing agent — phone AI | **Two of the three "Operations Layer" agents** named in the protocol (Hermes, OpsMan) **have no idea the vault exists.** Their daily-diary entries don't land anywhere persistent except local files on the VPS that aren't even in a git repo. ## 2. Sync mechanics — how data flows (or doesn't) ``` ┌─────────────┐ │ GitHub │ origin/main, mcloughlinmichaelr-debug/rateright-growth └──────┬──────┘ │ ┌───────────────┼───────────────┐ │ git push │ git pull │ ▼ ▼ ▼ ┌────────────┐ ┌───────────┐ ┌─────────────┐ │ Local Win │ │ VPS │ │ Cowork │ │ (Claude │ │ /home/ │ │ (??? — no │ │ Code) │ │ ccuser/ │ │ git client │ │ │ │ rateright-│ │ visible) │ │ │ │ growth/ │ │ │ └────────────┘ └─────┬─────┘ └─────────────┘ │ │ ❌ NO SYNC │ ┌────────▼─────────┐ │ /home/ccuser/ │ │ opsman-work/ │ ← Hermes + OpsMan write here, flat MD, no git │ (NOT a repo) │ └──────────────────┘ ``` ### What works - **VPS ↔ GitHub**: `auto-sync.sh` cron `*/30 * * * *` does `git pull --rebase --autostash` then `git add -A` + `git commit -m "auto-sync: "` + `git push`. Excludes secrets via `git reset -- .env *.env secrets.json`. Two-way, every 30 min. - **Local → GitHub**: I push manually after commits. - **GitHub → Local**: ❌ **No auto-pull on local Windows.** Has to be manual `git pull`. ### What doesn't work - **opsman-work/ is offline.** Hermes' and OpsMan's work product never reaches GitHub. Files include: `AGENTS.md`, `HEARTBEAT.md`, `IDENTITY.md`, `Jobs/`, `SOUL.md`, `TOOLS.md`, `USER.md`, `daily/`, `health-log/`, `lessons-learned/`, `lfcs-standards/`, `notes/`, `openclaw-investigation-report.md`, `openclaw-proposed-changes.md`, `photos/`. **None of this is backed up. None of this is in the vault.** - **5 docs trapped on VPS `/root/`** from today's work — never made it to the vault: `vps-state-2026-05-01.md` (98 lines), `cheatsheet.md` (33), `retirement-log.md` (37), `skill-audit-2026-05-01.md` (56), `hermes-investigation-report.md` (311 lines, the original Hermes self-audit). - **Cowork's project root** writes to OneDrive sandbox not the vault. Earlier today this caused the stranded `obsidian Curator/_System/InitialAudit.md` issue. ## 3. Gap analysis — what's missing ### P0 — Foundation (without these the protocol is decorative) **G1. Cowork's project working directory.** Currently `C:\Users\mclou\OneDrive\Documents\Claude\Projects\obsidian Curator\`. Should be `C:\Users\mclou\rateright-growth-deploy\HQ-Vault\` (or repo root if Cowork needs git access). UI-only fix in Claude Desktop project settings. **Rocky has to do this — I can't reach Claude Desktop config.** **G2. Repo-level `CLAUDE.md` is stale.** Says "You are **CC VPS** — the always-on Claude Code instance on the RateRight VPS." But Claude Code instances run from many places (your laptop, the VPS, future contributors). Multi-identity conflict: Claude Code on local Windows reads this and gets miscued. References hibernated systems (Rivet/Clawdbot 8-agent fleet, `/root/.openclaw/` as gateway). Fix: replace with a small stub that says "this is the rateright-growth repo. The vault is at `HQ-Vault/`. Read `HQ-Vault/_System/CLAUDE.md` first, then your project's `_Brain/CLAUDE.md`." Move the VPS-specific content into `HQ-Vault/11_OpsMan_LFCS/_Brain/CLAUDE.md` (which is currently a stub). **G3. Local auto-pull.** VPS auto-pulls every 30 min. Local Windows doesn't. If Hermes commits an `_AgentLog/` entry from the VPS at 3am, your local view is stale until you manually `git pull`. Solution: a Windows scheduled task or PowerShell loop that does `git pull --ff-only` every 30 min on the local repo. ### P1 — Operations agents into the vault **G4. Hermes has zero vault awareness.** - `SOUL.md` doesn't mention `HQ-Vault`. - `USER.md` doesn't mention the protocol or daily-note format. - `TOOLS.md` doesn't have a "git commit/push to vault" recipe. - Config doesn't bind any path to the vault. - Internal cron jobs (am-lookahead, eod-summary etc — at `/root/.hermes/cron`) write to `/home/ccuser/opsman-work/daily/` flat markdown. Fix path: 1. Update `/root/.hermes/SOUL.md` to add a "Write protocol" section pointing at `HQ-Vault/11_OpsMan_LFCS/_AgentLog/hermes-{date}.md` and `HQ-Vault/01_Daily/{today}.md`. 2. Update `/root/.hermes/USER.md` and `TOOLS.md` with the boot sequence + commit format. 3. Migrate (or symlink) `/home/ccuser/opsman-work/daily/` → `/home/ccuser/rateright-growth/HQ-Vault/11_OpsMan_LFCS/_AgentLog/` so Hermes' existing diary writes auto-flow to git via `auto-sync.sh`. 4. Update Hermes' internal cron scripts to commit + push after writing (or rely on `auto-sync.sh`'s 30-min cycle). **G5. OpsMan has zero vault awareness.** Same situation. Same fix pattern. OpsMan also needs to know the protocol. **G6. The 5 trapped docs on `/root/`.** Should live in `HQ-Vault/11_OpsMan_LFCS/_AgentLog/` (or `_Brain/`). Specifically: - `hermes-investigation-report.md` → `_AgentLog/hermes-2026-04-30-self-audit.md` - `vps-state-2026-05-01.md` → `_Brain/VPS-State-2026-05-01.md` - `cheatsheet.md` → `_Brain/Restart-Cheatsheet.md` - `retirement-log.md` → `_AgentLog/retirement-log.md` - `skill-audit-2026-05-01.md` → `_AgentLog/hermes-skill-audit-2026-05-01.md` These are valuable but invisible to anyone reading the vault. ### P2 — Discipline **G7. Append-only isn't enforced.** The protocol says daily notes / `_Log.md` / `_AgentLog/` are append-only. Nothing actually checks this — an agent could rewrite history. Solution: a pre-commit hook (or post-commit verifier) that checks no lines were *removed* from these files in the diff. Could live at `/scripts/check-append-only.sh` and run from `auto-sync.sh` before commit. **G8. `vault-verify.py` not wired into `auto-sync.sh`.** The verifier exists at `/scripts/vault-verify.py` but only runs when I manually invoke it. Should run before every `auto-sync.sh` push and abort/alert on failure. One-line addition. **G9. No daily digest / "where are we" surface.** The protocol's "comeback protocol" exists in writing but nothing automates it. After a 4-hour gap, Rocky has to open Obsidian and read 5+ files. A `/scripts/comeback.sh` that pulls last 14 days dailies + every `_Log.md` + every `_AgentLog/`, formats per the protocol's "Stalled / Hot / Promised / Autonomous / Pick up first" structure, would replace 30 minutes of reading with 30 seconds. ### P3 — Concurrency / conflict **G10. Conflict-handling never tested.** Protocol says append-only files merge cleanly, content files halt to `Conflicts.md`. Hasn't been exercised. Worth a deliberate test: have two agents append to the same `_Log.md` from different machines simultaneously, verify the merge. Have two agents try to edit `ROADMAP.md` concurrently, verify the second halts cleanly. **G11. Lane-rule enforcement is honour-system.** Protocol says one Project Management agent per project folder at a time. Nothing prevents two Claude Code instances in different terminals from editing `10_RateRight/Operations/` simultaneously. Could add a simple lockfile: `_System/Locks/{project}-{layer}.lock` containing the agent name + PID, checked at session start. ### P4 — Smooth-as-butter **G12. No commands / shortcuts for the protocol writes.** Per protocol every session needs daily note + project log + (sometimes) agent log. Currently every agent writes them by hand. A small CLI helper (`/scripts/journal.sh "session-summary"`) that auto-formats heading, appends to today's daily, and adds a backlinked one-liner to project `_Log.md` — would remove ~80% of the friction. **G13. No team status dashboard.** Per AI Team Protocol, "Cowork curator runs scheduled passes." Cowork is on Rocky's desktop, not on cron. So the curator never runs without Rocky manually triggering. Worth a `/scripts/curator-prep.sh` on the VPS that gathers everything Cowork needs (recent dailies, orphan list, broken links, frontmatter audit) into `_System/CuratorQueue.md` overnight, so when Rocky runs Cowork in the morning, the work is already laid out. **G14. No "is the team healthy?" probe.** Health snapshot covers VPS services. Nothing covers vault health: are dailies being written? Is `_Log.md` growing? Are agents committing on cadence? Could be a daily 21:00 cron that produces a one-page "team health" report. **G15. Operations agents don't know about each other's writes.** If Hermes appends to `11_OpsMan_LFCS/_AgentLog/` and OpsMan needs to react, OpsMan doesn't currently see the new entry — its config doesn't even know the path. Needs cross-agent awareness: at start of each cycle, agents read each other's recent `_AgentLog/` entries. --- ## 4. Recommended order to close gaps | # | Gap | Effort | Who does it | |---|---|---|---| | 1 | G1 — Cowork project root → `HQ-Vault/` | 2 min UI click | **Rocky** | | 2 | G2 — Replace stale repo `CLAUDE.md` | 10 min | claude-code-rr | | 3 | G3 — Local auto-pull scheduled task | 15 min | claude-code-rr | | 4 | G6 — Migrate 5 trapped `/root/` docs into vault | 20 min | claude-code-rr | | 5 | G8 — Wire `vault-verify.py` into `auto-sync.sh` | 10 min | claude-code-rr | | 6 | G7 — Append-only pre-commit hook | 30 min | claude-code-rr | | 7 | G4 — Hermes vault awareness (SOUL, USER, TOOLS update + opsman-work/daily migration) | 1-2 hr | claude-code-rr (with Rocky's review) | | 8 | G5 — Same for OpsMan | 1-2 hr | claude-code-rr | | 9 | G12 — `/scripts/journal.sh` helper | 30 min | claude-code-rr | | 10 | G9 — `/scripts/comeback.sh` digest | 1 hr | claude-code-rr | | 11 | G13 — `/scripts/curator-prep.sh` overnight gather | 1 hr | claude-code-rr | | 12 | G14 — Vault-health daily snapshot | 30 min | claude-code-rr | | 13 | G10 — Conflict test (deliberate clash) | 30 min | claude-code-rr | | 14 | G11 — Lockfile mechanism | 1 hr | claude-code-rr (after G10 result) | | 15 | G15 — Cross-agent awareness in boot sequence | folded into G4/G5 | n/a | **~8-10 hours of work to go from "protocol exists on paper" to "team runs smooth as butter."** The two highest-leverage items are **G4 (Hermes into vault)** and **G6 (move trapped docs in)** — those alone close most of the actually-felt friction. Everything else is polish. --- ## 5. Specific risks worth knowing - **`auto-sync.sh` is aggressive.** It does `git add -A` then commits everything every 30 min as `auto-sync: `. If an agent makes a half-finished edit on the VPS, it gets committed and pushed. No staging, no review. Mitigation: `vault-verify.py` as a pre-commit gate (G8). - **Hermes' internal cron jobs run inside Hermes.** When Hermes is down, the LFCS scheduled tasks (am-lookahead, eod-summary) silently miss. The watchdog catches the *gateway* being down but doesn't probe whether last cron actually ran. Worth adding to G14 (vault-health probe). - **No backup of `opsman-work/`.** Months of LFCS daily diaries, photos, dockets, lessons-learned, sit on the VPS only. If the VPS dies, that's gone. Should be in the vault (= in git = in GitHub = backed up). --- ## 6. What "smooth as butter" looks like 1. Rocky walks in, runs `comeback.sh` → 30 seconds, gets the 5-section sit-rep 2. Cowork opens, project root is the vault, Cowork sees today's daily + last 7 days, ready to curate 3. Claude Code instance starts in `10_RateRight/`, reads `CLAUDE.md` chain (repo → `HQ-Vault/_System/` → `_Brain/`), knows exactly what it can and can't do 4. Hermes processes a worker reply on Telegram, writes diary to `11_OpsMan_LFCS/_AgentLog/hermes-2026-05-15.md`, `auto-sync.sh` commits it 30 min later, Rocky reads it on his phone in Obsidian by lunch 5. OpsMan watchdog catches a stripe webhook fail, writes to its `_AgentLog/`, alerts Rocky via Telegram, Rocky's morning sit-rep flags it as "Hot" 6. Cowork's curator runs scheduled at 8 PM nightly, prunes inbox, archives stale, reports to `CuratorLog.md`, Rocky reviews in 5 min after dinner 7. `vault-verify.py` runs at every commit, halting if anything's broken, surfacing it as a Telegram alert That's where the protocol points. We're maybe 30% of the way there. The remaining 70% is mostly wiring, not new design.