Agent install guide

Wire the dashboard to workers you control.

The dashboard should not hold OAuth tokens, API keys, or publishing power. Hermes and agent workspaces do the work, then return drafts to the CMO OS for review.

Hermes

Daily-driver runtime

Primary

Use Hermes as the credential and workflow owner. It can hold tokens, run profiles, expose REST contracts, and coordinate recurring work without leaking secrets into the dashboard.

  1. 1Install Hermes locally or on a controlled host
  2. 2Connect model providers and platform tools inside Hermes
  3. 3Expose only scoped REST endpoints to Tendril admin routes
hermes gateway start

OpenClaw

Parallel specialist workbench

Advanced

Use OpenClaw for named specialist agents, workspaces, memory, delivery queues, and multi-agent briefs when the CMO OS needs more than one worker.

  1. 1Create named agents for content, SEO, PR, and analyst work
  2. 2Mount product-specific workspaces
  3. 3Send completed assets back through the CMO artifact callback
openclaw workspace run neural-forge-cmo

Hive

Continuity layer

Required for learning

Use Hive to manage agent memory, swarm routing, and confirmed brand facts. This keeps future drafts from starting cold.

  1. 1Read the hive at worker boot
  2. 2Write raw learnings after meaningful work
  3. 3Promote durable lessons through the curator flow
memory-hive digest --week

CMO worker bridge

This is how the site can “talk to Codex” in production: the site queues a request, an external worker performs the task, then the worker uploads the finished artifact.

No auto-publishing
01

Create request

The admin CMO form writes a queued request to `/api/admin/cmo/requests`.

02

Worker pickup

A Hermes/Codex worker can poll Redis or receive `CMO_AUTOMATION_WEBHOOK_URL` events.

03

Asset return

The worker posts the finished draft to `/api/admin/cmo/artifacts/receive` using a worker secret.

04

Human approval

Returned assets stay `needs_review` until manually approved inside the CMO OS.

Secret hygiene

Store API keys and OAuth tokens inside Hermes or Vercel environment variables, never in page content, browser local storage, or returned artifacts. The dashboard only receives scoped work requests and finished draft files.