Agent install guide

Wire the dashboard to workers you control.

The dashboard should not hold OAuth tokens, API keys, or publishing power. Hermes and agent workspaces do the work, then return drafts to the CMO OS for review.

Hermes

Daily-driver runtime

Primary

Use Hermes as the credential and workflow owner. It can hold tokens, run profiles, expose REST contracts, and coordinate recurring work without leaking secrets into the dashboard.

1Install Hermes locally or on a controlled host
2Connect model providers and platform tools inside Hermes
3Expose only scoped REST endpoints to Tendril admin routes

hermes gateway start

OpenClaw

Parallel specialist workbench

Advanced

Use OpenClaw for named specialist agents, workspaces, memory, delivery queues, and multi-agent briefs when the CMO OS needs more than one worker.

1Create named agents for content, SEO, PR, and analyst work
2Mount product-specific workspaces
3Send completed assets back through the CMO artifact callback

openclaw workspace run neural-forge-cmo

Hive

Continuity layer

Required for learning

Use Hive to manage agent memory, swarm routing, and confirmed brand facts. This keeps future drafts from starting cold.

1Read the hive at worker boot
2Write raw learnings after meaningful work
3Promote durable lessons through the curator flow

memory-hive digest --week

CMO worker bridge

This is how the site can “talk to Codex” in production: the site queues a request, an external worker performs the task, then the worker uploads the finished artifact.

No auto-publishing

Create request

The admin CMO form writes a queued request to `/api/admin/cmo/requests`.

Worker pickup

A Hermes/Codex worker can poll Redis or receive `CMO_AUTOMATION_WEBHOOK_URL` events.

Asset return

The worker posts the finished draft to `/api/admin/cmo/artifacts/receive` using a worker secret.

Human approval

Returned assets stay `needs_review` until manually approved inside the CMO OS.

Secret hygiene

Store API keys and OAuth tokens inside Hermes or Vercel environment variables, never in page content, browser local storage, or returned artifacts. The dashboard only receives scoped work requests and finished draft files.

Tendril