Fleet layer operationalised: guard, distill, allowlist, absolute paths

_{decision · created 2026-07-09 · actor claude-cowork · confidence medium · status active tags: fleet operations cron allowlist}

Operational loop as of 2026-07-09: (1) OpenClaw agents can exec the bridge via absolute paths /Users/dwayne/.local/bin/{kl,kg,fleet} — exec allowlist matches literal command text, so bare names fail. (2) fleet-layer-guard hermes cron (07:12 daily, no-agent) alerts the home room only on issues: gateways, binaries, graph, ledger, brain-sync staleness. (3) weekly-brain-distill hermes cron (Sun 05:05, skill fleet-bridge) synthesizes the week's ledger+memories into brain entries with FLEET_ACTOR=brain-distill. (4) knowledgelayer-sync pushes to GitHub every 6h. (5) hermes cron create CLI rejects positional prompts in v0.18.0 — append agent jobs directly to ~/.hermes/cron/jobs.json (backup first, copy an enabled job as template).

---

_{Sources: ~/.hermes/CRON_REGISTRY.md · ~/.openclaw/exec-approvals.json}