AI Sprint: OpenClaw — Session 1 (Infrastructure, Not Agent: the Seven Documents, 1-Click VPS, and Model Routing)

INTELLIGENCE LAYER (who the agent is and knows): user.md — you, in depth: role, timezone, goals, working style, tone, strengths and weaknesses ('it may know you better than your partner'); identity.md — the agent's name, personality, and voice (including 'hit me back if I'm wrong' personas); soul.md — values, ethics, hard limits, decision style — the document he tweaks most, with the standing rule dictated to every editing session: 'DON'T TOUCH SOUL.MD,' because the agent CAN edit its own files and will 'decide to change itself'; memory.md — contacts, projects, recurring tasks, emerged preferences, appended by asking ('add my working hours to memory.md') and AUDITED every 2-3 months because unused memory DECAYS — the agent scans top-to-bottom, so bloat is a per-query token tax.

EXECUTION LAYER (what it may do): tools.md — per-tool scope written as instructions ('read and fetch email, draft and show me, DON'T SEND'; calendar: block slots I name); heartbeat — cron-style proactive jobs (daily brief at 10 AM, weather, budget alerts) with the warning that heartbeats quietly consume tokens — he hit his limit mid-experiment; bootstrap — the boot-sequence greeting, optional. Beyond seven: 'don't stick to seven — I have ~15 in Ghost Ops. I call it agent DNA. That is my secret.' Permissions.md, security.md, even wife.md — documents are the personality, boundary, and knowledge system.

WHERE it runs is a security and uptime decision before a cost one. Local: free, but the agent shares your filesystem ('that is how I realized it is very dangerous — then I started removing access'), dies when the laptop sleeps, and cron jobs misfire. Mac mini: $500 of dedicated hardware. VPS: ~$10-12/month, 24/7, isolated in Docker, reachable from anywhere. Beginner path: HOSTINGER 1-CLICK MANAGED (~$11/mo; optional Nexos AI model credits ~$6, Oxylabs web-search credits free tier) — zero terminal, bot token in, dashboard out; its stated ceiling is the point ('no terminal access, no API keys, no deep config — you WILL feel that pain in 2-3 weeks, and then you're ready for self-managed Hetzner,' Day 2's topic).

The interface is TELEGRAM by design: BotFather creates unlimited free bots ('WhatsApp gets people banned; bot creation is hard there'), and the session's most practical minutes are the pairing failure everyone hits: if the DM policy sits on 'pairing' and the code never approves, go Settings → Communications → Channels → Telegram → DM policy → ALLOWLIST, fetch your numeric ID from user info bot, add it, SAVE. Front end stays front end; the browser gateway/dashboard (workspace files, sessions, cron, usage, config) is the back end — 'I like to keep the chat clean.'

OpenClaw burns tokens structurally — 'even a small message does a lot of repeated work at the back end' — so cost control is ROUTING, not restraint. His production split (Ghost Ops telemetry): SONNET 4.5 for genuinely complex reasoning ('users do at most ~3 complex tasks a day — that's what I measured'), HAIKU 3.5 for summaries and the daily-planner class of work, MINIMAX for plain conversation (chosen partly because he's a dev-program member — 'use any local model'). Configure it by telling the agent the routing WITH EXAMPLES of what complex/summary/chat mean, then audit by asking the bot 'which model did you use for that?' and correcting.

Two vendor mechanics nobody advertises: the NEXOS DEFAULT TRAP — Hostinger's bundled model access defaults to the premium 5.2; screenshot the model list, ask the chat to decode the codes, and switch the default down. And the ANTHROPIC TIER HACK — API rate limits are tiered by cumulative top-up: ~$40 total auto-promotes to tier 2 (Sonnet ~20k → ~450k tokens/min-class limits; tier 3 at ~$200) — 'I was hitting the limit constantly and NOBODY talks about this.' Finally the AUTH MAP: API keys = pay-per-token, no ceiling, safe; OAuth (subscription plans) = flat and capped but ban-risky — Google bans permanently ('paying subscribers, no warning, no appeal — user lost Gmail and Drive'), Anthropic is officially silent while some accounts get blocked, OpenAI explicitly allowed ChatGPT-plan OAuth from March 7. 'Start with OpenAI; Anthropic at your own risk; Google, don't.'

The threat tour, each with a story: CLAWHUB MALWARE — a skills marketplace shipped skills with injected malware; conclusion: 'if marketplace skills aren't safe, create your own' (the daily-planner demo doubled as proof that a useful skill is one pasted document). PROMPT INJECTION — hostile instructions hidden in content the agent reads; the Chevrolet Texas chatbot manipulated into agreeing to sell a car for $1 is the teaching case, and every new channel (Gmail especially) is attack surface: 'people can access your agent through mails.' TOKEN HYGIENE — the gateway token controls everything; never share, never commit. ACCOUNT ISOLATION — fresh Gmail, fresh number or Telegram for the agent; never your primary accounts.

The rollout discipline that binds it: READ-ONLY FIRST — start automations in read-only mode, expand permissions only after the pattern is tested; limit the home directory; no root unless expressly needed; review skill manifests before install; audit the reasoning logs in the gateway; keep a KILL SWITCH. His own standard is the credibility: Ghost Ops remains unlaunched ('I can get sued') behind a nightly 6 AM security-audit agent that files red-flag/yellow-flag reports. 'Every step you take, look 360 degrees, then take the next step.'