{
  "id": "openclaw-hawkins",
  "name": "OpenClaw Hawkins — VINES + VECNA",
  "description": "Persistent runtime plugin for OpenClaw. Activates on gateway startup and registers durable-orchestration (VINES) tools for a 6-tendril Nexus swarm. Shared-agent-memory (VECNA) is disabled by default and enforced: its read/write/search tools are not registered at all unless the operator sets `vecna.enabled=true` — so an agent cannot reach the shared store even if prompted to. When enabled, VECNA reads from and writes to a shared knowledge store outside this host.",
  "activation": {
    "onStartup": true
  },
  "contracts": {
    "tools": [
      "vines_triage",
      "vines_start",
      "vines_set_state",
      "vines_attach_linear_parent",
      "vines_recover",
      "vines_status",
      "vecna_connect",
      "vecna_recall",
      "vecna_evolve",
      "vecna_search",
      "vecna_fragment",
      "vecna_healthz"
    ]
  },
  "uiHints": {
    "mariadb.url": {
      "label": "MariaDB URL",
      "help": "mariadb://<host>[:port]/<database>. Do NOT put a password in the URL — this value is stored in plaintext config, so an embedded password would leak (the plugin rejects one). A username may be included; the password must come from the gateway environment (MARIADB_PASSWORD)."
    },
    "mariadb.user": {
      "label": "MariaDB user",
      "help": "Database account with INSERT/SELECT/UPDATE on the vines_ledger + vecna_hive tables."
    },
    "mariadb.ssl": {
      "label": "TLS mode",
      "help": "disabled | preferred | required. All TLS modes verify the server certificate. For a database that presents a self-signed cert, use a CA-trusted cert or tunnel over SSH (see SECURITY.md) — there is no verification-disabling mode."
    },
    "autoRecovery": {
      "label": "Auto-recovery",
      "help": "If true, the plugin scans the orchestration ledger before each tool call and logs unfinished runs. Default false."
    },
    "vecna.enabled": {
      "label": "Enable VECNA (shared memory)",
      "help": "Off by default. When false, the vecna_* read/write/search tools are NOT registered, so no agent can reach the shared knowledge store. Set true only if you want shared agent memory; it reads from and writes to a store outside this host."
    },
    "vecna.dedupWindowMinutes": {
      "label": "VECNA dedup window",
      "help": "Minutes within which identical high-importance fragments are collapsed into the existing row. Default 5. Only relevant when VECNA is enabled."
    }
  },
  "configSchema": {
    "type": "object",
    "additionalProperties": false,
    "properties": {
      "mariadb": {
        "type": "object",
        "additionalProperties": false,
        "description": "Non-secret connection metadata only. `MARIADB_PASSWORD` MUST come from the gateway env (via a 0600 EnvironmentFile or `systemctl --user set-environment`) — the plugin refuses to accept a password in config so secrets never sit as plaintext in openclaw.json.",
        "properties": {
          "url": { "type": "string" },
          "user": { "type": "string" },
          "ssl": {
            "type": "string",
            "enum": ["disabled", "preferred", "required"]
          }
        }
      },
      "autoRecovery": { "type": "boolean" },
      "vecna": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "enabled": { "type": "boolean" },
          "dedupWindowMinutes": { "type": "number", "minimum": 0 }
        }
      }
    }
  },
  "commandAliases": [
    { "name": "hawkins" }
  ]
}