Agent-fleet bootstrap — stand up a human-gated agent backbone for a brand

Receipts

Proven in production.

• OgLife.app — one identity layer across a 17-domain portfolio

  Each brand in the portfolio had its own opt-in, its own chat widget, its own customer record. A customer who liked two brands ended up as two strangers in two databases. OgLife.app is the cross-business identity + preferences + live-chat layer that sits between the brands and the customer — one opt-in, one preferences page, one inbox. Built on Cloudflare Workers + Durable Objects + Neon, with an embeddable 7KB chat widget that any brand storefront drops in.

  • 1 identity layer across 17 brand surfaces
  • 7KB embeddable chat widget

When to use it

Trigger phrases.

Any of these in the user's prompt should invoke this skill in Claude Code.

• Stand up agents for [brand]
• Give this client the approval-queue setup
• Wire Slack into a triage queue
• Agent backbone like BMH / OG Life
• Bootstrap the fleet

What it needs

Required inputs.

• 01The brand's ingest surfaces (Slack channel, contact forms, QR slugs) and who the approvers are
• 02The safe-action whitelist — which action kinds may auto-execute vs. queue for a tap
• 03Data access for the agents (DB, storefront APIs) scoped to the jobs they'll run

The mechanism

Pipeline.

1. 01 · Ingest

   Every inbound becomes a deduped queue row.

   A cron polls the ingest surfaces (BMH + jackiej: Slack every 5 minutes) and writes each item to a triage queue with a unique (source, source_ref) index — the same message can't become two jobs. Forms and QR scans feed the same table.

2. 02 · Classify

   An AI classifier sorts each row into a typed action + review lane.

   Sonnet classifies into a closed set of action kinds (BMH: eight kinds, two lanes — content waits on the brand owner, design on the account owner). Typed actions mean executors are code, not prompt-hope; unclassifiable rows escalate instead of guessing.

3. 03 · Execute behind the gate

   Whitelisted actions apply themselves; everything else waits for a tap.

   A LIVE_SAFE_WHITELIST names the actions allowed to write directly (swap a hero photo, update text on a Puck page). Everything else parks in an approval surface. Owner-only promotion is re-checked server-side on every ship action, and every state transition lands in an append-only audit table.

4. 04 · Own the comms rails

   Push, SMS, and email run on portfolio-owned infrastructure.

   Web push rides the central og_life store (multi-brand, one keypair); SMS consent rows are brand-owned and TCPA-stamped; email is SES/Stalwart with fail-closed bounce suppression. A new brand inherits the rails with a config entry, not a vendor signup.

5. 05 · Escalate the ceiling carefully

   From content actions to code changes — same gate, higher stakes.

   The codegen tier (proven on jackiej.events, Mission 2 Gates 1–2) lets a Slack request become an actual code change built in an isolated git worktree with its own Vercel preview — parked at the same human-approval gate as everything else. The ceiling rises; the contract doesn't.

What lets it fan out

Connector stack.

With all of these MCP connectors wired, the mechanism runs end-to-end without human handoff. Without them, the handoff is a numbered Chrome checklist.

• Slack API (polling cron)

  Available

  Stage 1 — the proven ingest path on BMH + jackiej.events.

• Anthropic API (Haiku router + Sonnet classifier)

  Available

  Stage 2 — classification and drafting across the fleet.

• og_life push + SMS stores

  Available

  Stage 4 — multi-brand comms rails, one ingest secret per brand.

• OpenClaw orchestrator

  Available

  Stages 1–5 — the queue, dispatch, and run-report machinery underneath.

• GitHub MCP

  Partial

  Stage 5 — richer codegen-daemon PR plumbing (worktree flow already works).

Guardrails

Stop conditions.

The skill is predictable because it refuses to expand its own scope.

• stopNothing customer-visible ships without a human tap — the whitelist only covers named-safe internal writes.
• stopEvery agent runs a narrow, named job — no general-purpose 'do things' agent, ever.
• stopEvery state transition is audit-logged append-only; no silent mutations.
• stopCodegen builds only in isolated worktrees — the daemon never touches main.
• stopEdge cases route to the human queue; agents don't guess.