The Sanctum Council is a collective of specialized AI agents, distributed across the infrastructure so that if the power goes out in Tokyo, the haus in Québec can still decide which lightbulbs to turn on at sunset.
Specialized agents, each routed to the model family best suited to their domain. The Council is heterogeneous by default — a single model wearing five robes is not a Council ((Neuro)diversity is Paramount).
Per-agent routing is generated from ~/.openclaw/openclaw.json (per-agent primaries) and ~/.sanctum/sanctum-proxy/config.yaml (tier resolution via proxyd on :4040). This page is the single source-of-truth for who runs on which model — every other page embeds <CouncilRoster /> from the same data, so a champion swap is one JSON refresh and one rebuild away.
| Agent | Logical model | Provider | Resolved model |
|---|---|---|---|
| Yoda | council-tiered/council-max-thinking | Claude Max bridge (local) | claude-opus-4-7 |
| Ki-Adi-Mundi | council-tiered/council-max-thinking | Claude Max bridge (local) | claude-opus-4-7 |
| Qui-Gon | council-tiered/council-code | Local | Codestral-22B-v0.1-4bit |
| Windu | council-tiered/council-spacial | Google AI Studio | gemini-3.1-pro-preview |
| Cilghal | council-local/Qwen3.6-35B-A3B-4bit-text | sanctum-mlx (local, mTLS) | Qwen3.6-35B-A3B-4bit-text |
openclaw.json + sanctum-proxy/config.yaml at 2026-06-11T23:32:06Z. Every Jedi falls back to the
local Qwen tier if their primary path fails. Refresh via pnpm refresh:council.
Council sessions are held via structured prompt exchange; the agents do not run as persistent daemons — they are invoked by the infrastructure on demand.
As of April 2026, the system runs a strict True Council Architecture. The operative agents (Jocasta, the Meeting Prep Agent, the Deal Flow Radar) don’t ping the user directly — they write their intelligence continuously to the Memory Vault. Yoda, and only Yoda, routes outbound push notifications: he reads the Council’s overlapping findings on a schedule, synthesizes the takeaways, and sends Strategic Master Briefings via Force Flow. One voice on the phone, not seven.
Yoda
Grand Master The senior lead of the Sanctum Council. Yoda handles council routing, final synthesis of complex decisions, and the daily “Morning Briefing” digest. Also runs as a dedicated voice agent (Python, port 1138 on Mac Mini) with Sanctum TTS (Qwen3-TTS backend via mlx-audio, port 8008). He remains the ultimate authority on whether a raccoon constitutes a security breach.
Mon Mothma
Operations — role, not yet a routed persona
A seat the Council has named but not filled: there’s no mothma entry in openclaw.json, so no model wears this robe yet. The duties — incident correlation, boot sequencing, keeping cross-domain signals from contradicting each other at 4 AM — are carried today by the Force Flow bus and sanctum-triage, no persona required. The chair is reserved.
Qui-Gon
Infrastructure
The guardian of the machine — system health, container stability (OrbStack), automated recovery. His triage logic runs as a native Rust binary (sanctum-triage) on a 30-second interval. He is why you don’t have to SSH into the machine every time it rains.
Windu
Security The master of defense. Windu conducts security audits, manages Firewalla and PF rules, gates the HA Gateway (port 8199, token-auth), and monitors the perimeter. He has a very low tolerance for unauthorized packets.
Cilghal
Health
The biological bridge. Cilghal monitors wellness via Apple Health data and biometrics through the genome-mcp service. She understands the owner’s cognitive profile — including neurodiversity markers (ADHD, Dyslexia, ASD) — and suggests scaffolding for optimal productivity.
Ki-Adi-Mundi
Finance The treasurer. Mundi manages Triptyq Capital deal flow and personal fiscal health. He ensures the system’s operating costs don’t exceed the actual value of the automation.
Ahsoka
Satellite Outpost — topology reserved, agent not yet deployed
The Chalet is a real node in instance.yaml (nodes.chalet, a 16 GB M1) but reports online: false, and which model Ahsoka runs locally is still open: Codestral-22B won’t fit in 16 GB, so the coder seat doesn’t reach the cabin. Her job, once she ships, is local automation and offline resilience — family comfort that survives the internet not.
Jocasta
Archivist The keeper of records. Jocasta handles CRM data, communications, and tech-lookout scanning directly on the Mac Mini host. She operates through Claude Code — not as a persistent daemon, but invoked during council sessions and daily scans.
These are not persona agents but Rust binaries that run continuously and act on the council’s behalf.
com.sanctum.triage): Qui-Gon’s immune response. Monitors system RAM every 30 seconds and unloads heavy models when pressure exceeds thresholds. Native Rust, zero Python.council-secure (Qwen3.6-35B-A3B-4bit via sanctum-mlx on :1337), coder (Codestral-22B-v0.1-4bit via sanctum-mlx-codestral / com.sanctum.mlx-codestral on :3301; the former Qwen2.5-Coder-14B :1338 seat and its :1234 LM Studio bridge were retired 2026-06-07), spatial (Gemini 3.1 Pro), and cloud (Claude Opus 4.7 via Max proxy on :3456, OpenRouter fallback). Five tiers of routing, observability, breakers, and quality detectors. See Smart Router Cathedral for the full anatomy.These are the primary interfaces for human interaction with the Council.
The persona layer is not allowed to drift on vibes. The canonical agent markdown lives in the mlx-finetune workspaces; the runtime copies under ~/.openclaw/workspace* are rendered artifacts that must stay mechanically aligned.
~/Projects/mlx-finetune/workspaces/<agent>/{IDENTITY,SOUL,TOOLS,HEARTBEAT}.md (one subdir per agent — windu, quigon, cilghal, jocasta, mundi, yoda — wired in configs/agents.yaml)~/.openclaw/workspace* on the local machine, plus reachable VM and MBP workspaces over SSH/Tailscalepython3 ~/Documents/Claude_Code/tools/sync_agent_markdown.pypython3 ~/Documents/Claude_Code/tools/sync_agent_markdown.py --checkThe sync model is deliberately boring:
~/.sanctum/instance.yaml run in fanout-target-only mode — they update status locally but never try to become an accidental second source of truthsync_agent_markdown.py --check exits non-zero if any reachable runtime differs from canonical. Folding it into sanctum doctor (next to the live MBP audit, so persona drift sits beside runtime manifests and LaunchAgents) is on the list — sanctum doctor has no --quick knob yet~/.sanctum/state/agent-markdown-sync.jsonOn the Mac hosts, install_agent_markdown_sync.sh installs the lot: a com.sanctum.agent-markdown-sync LaunchAgent (at login + every 5 minutes), mlx-finetune git hooks (post-merge, post-checkout, post-commit) so fresh pulls and training edits converge on their own, and absolute-path helper scripts under ~/.sanctum/scripts so launchd doesn’t have to improvise its way through macOS privacy theater.
This keeps all four runtimes — VM, Mac Mini, MBP, and the overnight fine-tuning source — pointed at the same markdown truth, instead of slowly inventing four different versions of the same Jedi. Distributed systems are hard enough without letting the SOUL file freelance.
“The Council is not a hierarchy, but a web. Each thread is necessary for the strength of the whole.” — Yoda