CNAT · Internal Planning

Bruce → Stack Wiring Plan

Connecting the OpenClaw agent (Bruce, @OCBruce_bot) to CNAT's real systems — safely, reversibly, and with room to grow. Drafted 2026-07-16.

What Bruce actually is

Bruce is a full OpenClaw agent framework on Hostinger VPS 1507037 (Docker), reachable over Telegram (@OCBruce_bot) and Tailscale SSH. It gains capabilities three ways:

MCP servers — openclaw mcp add connects it to any Model Context Protocol server (Supabase, GHL, Hostinger, GitHub…). This is our primary integration path — no custom code, per-server access control, one command to add or remove.
Skills — 57 bundled skills (16 ready): github, gog (Gmail/Calendar/Drive), coding-agent (delegate to Claude Code), blogwatcher (feed monitoring), 1password, diagram-maker, and more.
Built-in tools — bash/shell, file read/write, headless browser, Telegram messaging.

Model: anthropic/claude-sonnet-4-6.

Two realities we design around

Bruce is not stable yet. The uid perm-flip (.openclaw → uid 1001, locking out the node/1000 gateway) still recurs even after deleting its cron jobs and disabling the sandbox — it was broken again when I checked today. A perm-guard heals it, but that's a bandaid. Wiring the stack onto an unstable base is pointless — stability is Phase 0.

Bruce currently can't touch your real data. Its only Supabase key is for bruce-shared, not cnat-internal (which powers File Bot / hotsheet / search / commissions). That's a good safety default: nothing we do can hurt production data until we deliberately grant it — and we'll grant it narrowly.

Phased rollout

Phase 0

Stabilize the foundation (prerequisite)

Goal: Bruce runs 48h with no perm-flip and no manual healing.

Pin the flip source. Crons are gone and the sandbox is off, yet it still flips — prime suspect is the 30-min heartbeat running an isolated turn. Reproduce, confirm, and either disable the heartbeat (Bruce is on-demand, doesn't need it) or force it into the main session.
Decide on the guard — keep the continuous perm-guard as an intentional safety net, or remove it if the source is eliminated.
Shrink attack surface — revisit the docker.sock mount and remove the broken WhatsApp channel.

Phase 1

Read-only data — the mobile data assistant

How: openclaw mcp add the cnat-internal Supabase MCP — but with a dedicated read-only Postgres role, never the full service key. This is the single most important safety control: Bruce gets SELECT on what it needs and nothing else.

Value (text Bruce from anywhere): "how many S817 listings closed this month?", "pull the hotsheet for 76244", "what's KP's premium YTD?"

Blast radius: zero writes possible → cannot hurt anything.

Phase 2

CRM read (GHL)

openclaw mcp add the GHL unified proxy (ghl.cnattitle.tech/mcp), scoped to read ops first (search contacts, read conversations). "What's this contact's last activity?", "any unread messages in the S817 inbox?"

Phase 3

Guarded actions (human-in-the-loop)

Draft, don't send: Bruce drafts a message/email and shows it to you; you approve. Safe writes (create a task/note, trigger a specific n8n workflow, kick a deploy). Anything customer-facing requires your explicit confirmation — nothing auto-sends.

Phase 4

Advanced capabilities (opt-in, later)

coding-agent — delegate real dev tasks to a background Claude Code worker ("add a column to the hotsheet and open a PR").
blogwatcher / research — monitor competitor sites + market feeds, summarize to Telegram (the digest done right).
Google Workspace — read/triage Gmail, Calendar, Drive. Plus GitHub triage, diagrams, monitoring alerts.

Safety model — "won't hurt anything"

Least-privilege credentials. Bruce gets a read-only DB role for real data (never the production service key). Writes added table-by-table, deliberately, later.
Isolation is already in our favor. Bruce runs on its own VPS — it can't directly touch the sites, File Bot, or hotsheet code. The only ways it could hurt something are shared data and delivery, and both are scoped/read-only-first above.
Human-in-the-loop for anything outbound. No auto-sends to customers, ever, until you explicitly promote a workflow.
One MCP at a time, reversible. openclaw mcp add → test → keep, or openclaw mcp remove → gone. No big-bang.
Audit trail. Confirm Bruce's tool/MCP calls are logged so we can see what it did.

Capability shortlist (ranked for CNAT)

Capability	How	Value	Phase
Mobile data assistant	Supabase MCP (read-only)	Query the whole business from your phone	1
CRM lookup	GHL proxy MCP (read)	Contact / lead / inbox status on demand	2
Draft-and-approve outreach	GHL MCP (guarded write)	Bruce writes, you approve, it sends	3
Trigger ops (deploy/sync/report)	n8n MCP / webhooks	"Run the orders sync", "redeploy X"	3
Market/competitor monitoring	blogwatcher skill	The digest done right — signal, not busy-work	4
Delegate coding	coding-agent skill	Background dev tasks + PRs	4
Email/calendar triage	gog skill	Gmail / Calendar / Drive from Telegram	4

Decisions I need before building

OK to create a dedicated read-only Postgres role on cnat-internal for Bruce? Recommended over sharing any service key.
Which of the 5 GHL accounts may Bruce see, and read-only to start? Recommended: yes, read-only.
Perm-flip fix: try eliminating it in-place (disable heartbeat) vs. a Hostinger ticket vs. accept the guard. Recommended: try disable-heartbeat first.
Confirm Phase 1 (mobile data assistant) is what we build first? Highest value, lowest risk.

Sequencing: Phase 0 stabilize → Phase 1 read-only data → prove value → Phase 2 GHL read → Phase 3 guarded actions → Phase 4 advanced. Each phase is independently useful and reversible.

Internal planning document · Community National Title · not indexed.