ai-employees 1.7.0 → 1.8.0

package/docs/COST.md

@@ -49,6 +49,10 @@ Anthropic publishes no token or dollar quota per plan, so a plan cannot be mappe
 
 The only way to turn the table into dollars is an API key, and an API key loses the browser lane, which most of these routines need. Run them on a seat.
 
+## On Grok Bot
+
+Grok Bot is metered differently: a plan carries a weekly usage allowance, and the bots draw it down. As of August 21, 2026, bots come with Cursor Pro+ at $60 a month, SuperGrok Plus at $100, Cursor Ultra at $200, SuperGrok Heavy at $300, and Cursor Teams at $40 a seat, with a limited free trial. What the price does not say is how fast the allowance moves under a fleet: operators running several bots on patrol report reaching it early in the week. The kits are not always on, which is the point. One Employee is a handful of runs a day, each inside a window and a budget, and a skipped fire exits before it reads the contract. Start on the lowest tier that includes bots, run one Employee for a week, and read the meter before you add a second. Nothing on this page was measured on Grok Bot; the numbers above are its published prices, and the measurement will follow the first install that reports.
+
 ## Making cost a field, not a guess
 
 `scripts/runlog.mjs` accepts nine optional fields on a run record: `model`, `harness`, `turns`, `input_tokens`, `output_tokens`, `cache_write_tokens`, `cache_read_tokens`, `cost_usd`, and `cost_basis` (`api-list`, `subscription`, or `unknown`). They are counts and prices only, never required, and the refusal rules on the rest of the record are untouched. On the CLI, `claude -p --output-format json` prints `total_cost_usd` and the token counts on exit; the launcher in `run/` writes that JSON to `run/<id>.last.json`. A flag that attaches those numbers to the record the routine just wrote is not built yet, and until it is the fields get filled by the routine's own last step where a harness exposes them, or stay absent.

package/docs/FAQ.md

@@ -10,6 +10,8 @@
 
 **Which harness?** Built for Claude Code, OpenClaw, Hermes, OpenCode, Grok Bot, Codex, Antigravity, Pi, Cline, Qwen Code and DeepSeek. Claude Code is the one the GTM Engineer runs my own club launch on every weekday. OpenClaw, Hermes, Cline and Qwen Code have built in cron or scheduled tasks, Codex has scheduled runs, Antigravity has the `agy` job runner, DeepSeek schedules through a plugin, OpenCode and Pi use the operating system's scheduler, and Grok Bot runs from its own cloud computer. `docs/HARNESSES.md` has the invocation and the first run check for each.
 
+**Does it run on Grok Bot?** Yes, with one difference: the bot's computer is not yours. The bot installs the kit on its own cloud computer, you paste the kit's `AGENTS.md` into the bot's Instructions field, one recurring task per routine runs from `SCHEDULE.md`, and the morning brief is posted into the bot's own thread because you never open that computer's files. Every bot on your account shares that computer and every login on it, so scope by what you sign in to, never by which bot you talk to. The hosted section of `docs/HARNESSES.md` has the detail.
+
 **Can I run just one?** Yes. Each employee is a self contained folder. They share nothing but a scheduler. The GTM Engineer is the one to start with; the Chief of Staff is the one to add second, because it reads the run logs of every other employee on the machine and tells you which one quietly stopped.
 
 **What happens when my machine is asleep?** It depends on your scheduler: the Claude Desktop app and Windows Task Scheduler run one late catch up, launchd folds every missed fire into one, and cron skips it for good. Every routine has a window, so a late fire either does its work once or records a skip and exits. A closed laptop produces nothing, and the next morning's standup says so in plain words.

package/docs/GUARDRAILS.md

@@ -4,6 +4,8 @@
 
 **The second guardrail is on credentials, and it stays on.** No AI Employee creates an account, enters or generates a password, completes a captcha, accepts terms, or writes a credential into any file. It never needs your password to do its job, so there is nothing to release.
 
+**On a hosted harness the guardrails are still yours to keep, and bots are not a boundary.** On Grok Bot every bot on your account shares one cloud computer, one filesystem and every login on it. A release you write for one Employee is a file every bot can read, and a session you sync there is a session every bot can use. Scope by what you sign in to on that computer, never by which bot you talk to, and start read only on public pages before you sync anything.
+
 | Routine kind | Reads | Writes | Leaves for you | Holds, unless you release it |
 |---|---|---|---|---|
 | The standup, every weekday | Every ledger, run record and tick since yesterday | The board and the thirty line brief | The brief, first thing | Uses a browser |

package/docs/HARNESSES.md

@@ -16,7 +16,7 @@ Two rules hold on every harness. **Routines are scheduled jobs, not skills**: po
 | OpenClaw | Ready | Built in cron: `openclaw automations create "<cron>" "<message>" --name <id> --session isolated`, one per routine, with the timezone flag | The message is `Read <root>/routines/<id>/SKILL.md and follow it.` | Whether its browser control attaches to your signed in profile; run the probe in `CAPABILITIES.md` 1.2 | `mcp.servers` in its config, `openclaw mcp login <name>`; skills from ClawHub |
 | Hermes | Ready | Built in cron with delivery to any platform | Point each job at the routine file as its prompt | Whether it reads files and runs a shell command; then the browser question | `mcp_servers` in `~/.hermes/config.yaml`, or `hermes mcp install <name>` from its catalog |
 | OpenCode | Ready | None built in; use the operating system's | `opencode run "<prompt>"`, confirm against `opencode --help` | Add a browser automation server for the browser lane | `mcp.<name>` in `opencode.json`, then `opencode mcp auth <name>` |
-| Grok Bot | Ready | Its bots run routines on a schedule from their own cloud computer | One recurring task per routine, handed that routine's `SKILL.md` as the run prompt | Whether it can reach your signed in accounts at all; it runs elsewhere | Its built in connectors, or a custom connector by URL at grok.com/connectors |
+| Grok Bot | Ready | Its recurring tasks, one per routine, on a bot named after the Employee. Every bot on your account shares one cloud computer, and the kit lives there | The bot installs the kit on its own computer (`npx ai-employees hire <slug> --to ~/ai-employees/<slug>` in its terminal), you paste the kit's `AGENTS.md` into the bot's Instructions field, and each recurring task's prompt is `Read <root>/routines/<id>/SKILL.md and follow it.` with the fire time in the timezone `SCHEDULE.md` names | Whether your signed in sessions are on that computer. They are only if you signed in there or you run a cookie sync to it (Agent Cookie, from a Mac over Tailscale), and every bot then shares every login. Then that the first brief arrived in the bot's thread, which is `brief.deliver` | Its built in connectors, or a custom connector by URL at grok.com/connectors |
 | Codex | Confirmed | The app's automations: one cron automation per routine, named after the routine id, local execution, the kit folder as a working directory | The automation's own prompt, Shape B; `codex exec "<prompt>"` by hand where the CLI is signed in | The sandbox and the scheduled process: confirm it can write in the kit folder, reach the network, and reach the same connections the chat session could, because the first scheduled fire is the first real test of both | `[mcp_servers.<name>]` in `~/.codex/config.toml`, then `codex mcp login <name>`; skills in `.agents/skills` |
 | Antigravity | Ready | `agy` job runner pointed at the routine folder | `agy -p "<prompt>"` | Whether it drives your signed in browser profile or a clean one | `.agents/mcp_config.json` in the workspace or `~/.gemini/config/mcp_config.json`, with `serverUrl`, or its MCP Store |
 | Pi | Ready | None built in; use the operating system's | `pi -p "<prompt>"`, confirm against `pi --help` | Whether it reads the kit folder as the working directory; then the browser question | None. Pi runs no MCP servers by design, so only the command line routes in a kit's section 4b apply, wrapped as skills |
@@ -33,6 +33,18 @@ Every kit's `CAPABILITIES.md` section 4b names the connections that read its acc
 3. **Prove one routine by hand before registering the rest.** Run the standup, watch it write `brief-latest.md` and exactly one line into `runlog.jsonl`. Eight jobs registered on an invocation nobody ran is eight silent failures on the same morning.
 4. **A non zero exit should leave a record.** The Windows launcher does this through `runlog.mjs --failed-run`. On other harnesses, add the same `||` fallback to the command line.
 
+## Grok Bot, and the hosted shape it set
+
+Grok Bot is the one harness on this page whose computer is not yours, and the shape is worth writing down once because Codex cloud and Meta Muse share it. Everything here comes from operators' published accounts of the product in August 2026, and each kit's `CAPABILITIES.md` marks it `expected` until you write `confirmed` into `## Corrections`.
+
+- **One computer for every bot.** All the bots on an account share one persistent Linux machine with a terminal, file access and a real browser. Each bot has its own screen and runs one computer-use task at a time; several bots can drive the browser at once. So the kit lives on that computer, the bot installs it there itself, and the cloud sync rule does not apply.
+- **One bot per Employee, one task per routine.** Name the bot after the role, paste the kit's `AGENTS.md` into its Instructions field (it is the map that points at the files, and it is short enough to fit), and register one recurring task per routine with the Shape B prompt. Do not turn the routines into the bot's workflows: a workflow is invoked on demand, a routine runs in a window.
+- **Bots are not a security boundary.** Files, browser sessions and app logins are shared by every bot on the computer. A release you write for one Employee is a file every bot can read; a session you sync there is a session every bot can use. Scope by what you sign in to, never by which bot you talk to, and start read only on public pages before you sync anything.
+- **Staying signed in is a sync you run.** Nothing in a kit signs in, so your sessions reach the bot's browser only if you signed in there or you keep them there with a cookie sync such as Agent Cookie (Chrome cookies from a Mac to the bot over Tailscale, every fifteen minutes). The kit names it under `browser.session`, detects it, and installs nothing.
+- **The brief comes to your thread.** You never open that computer's files, so the standup resolves `brief.deliver` and posts `brief-latest.md` into the bot's own thread, which the Grok app carries to your phone. The file stays the record.
+- **Two more routes.** Claude Code can be logged in on the bot's computer, which turns the Grok Bot row into the Claude Code CLI row with Grok Bot as the scheduler. Peekaboo, installed by you on a Mac, lets the bot see and click native Mac apps over the same link. Both are yours to add.
+- **Watch the meter.** Plans carry a weekly usage allowance and fleet work moves it fast. Start on the lowest tier that includes bots, run one Employee for a week, and read the meter before you add a second.
+
 ## Ran a kit on one of these?
 
 Open an issue with the harness and version, the invocation you used, what the first run record said, and what you changed. It goes into the notes for that row, with your name on the change.

package/docs/HOW-EMPLOYEES-WORK.md

@@ -57,6 +57,7 @@ Every routine starts with the same five numbered items, in this order, before an
 - **The pause switch.** An empty file called `PAUSED` in the employee's folder stops every routine. Routine ids on lines inside it stop only those. Delete it and everything resumes; nothing was unregistered. No routine ever creates, writes, or deletes that file.
 - **Corrections.** Every file ends with a `## Corrections` section you write into and every routine reads at the top of every run. A dated line there outranks the file it sits in. This is how a kit gets good at your business specifically.
 - **The changelog of its own changes.** When a routine amends its own instructions it appends one line to `improvements/CHANGELOG.md` carrying the full text it replaced, so anything can be undone without the original download, and tomorrow's brief says what changed under `What changed about me`. It informs you. It does not ask you, because your harness already asks before anything writes to your disk, and that is the right place for that gate.
+- **The brief comes to you.** After the standup writes `brief-latest.md` it resolves `brief.deliver`: the dashboard on a machine you use, the employee's own thread on a hosted agent whose computer you never open, or your own inbox where a mail route exists. The delivered text is the file's text with nothing added, and a brief to your own thread or address is delivery, not a send. Absent every route the file is the brief.
 - **The one push.** It notifies you only when you are the thing blocking it: an expired login, a credential it needs, conversion tracking that died while ads are running, or a browser lock held by a run that died. Once each, never twice for the same problem, never outside your working hours. Everything else waits for the brief.
 
 ## The save test

package/docs/INSTALL.md

@@ -120,7 +120,7 @@ One line per routine, from `CAPABILITIES.md` section 9.3, with the full path to
 
 ### The other ten harnesses
 
-OpenClaw, Hermes, Cline and Qwen Code have a built in cron, Codex has scheduled runs, Antigravity has the `agy` job runner, DeepSeek schedules through a plugin, and Grok Bot runs recurring tasks from its own cloud computer: register one job per routine in that scheduler, with the kit folder as the working directory, the fire time from `SCHEDULE.md`, and the prompt `Read <root>/routines/<id>/SKILL.md and follow it.`. OpenCode and Pi have no scheduler of their own, so use the operating system's route above with their headless command in place of `claude -p`. `docs/HARNESSES.md` has the exact invocation and the first run check for each, and the same rule holds everywhere: run one routine by hand before you register the rest.
+OpenClaw, Hermes, Cline and Qwen Code have a built in cron, Codex has scheduled runs, Antigravity has the `agy` job runner, DeepSeek schedules through a plugin, and Grok Bot runs recurring tasks from its own cloud computer: register one job per routine in that scheduler, with the kit folder as the working directory, the fire time from `SCHEDULE.md`, and the prompt `Read <root>/routines/<id>/SKILL.md and follow it.`. OpenCode and Pi have no scheduler of their own, so use the operating system's route above with their headless command in place of `claude -p`. `docs/HARNESSES.md` has the exact invocation and the first run check for each, and the same rule holds everywhere: run one routine by hand before you register the rest. Grok Bot is the one whose computer is not yours: the bot installs the kit on its own cloud computer, you paste the kit's `AGENTS.md` into the bot's Instructions field, and the brief reaches you in the bot's thread. The hosted section of `docs/HARNESSES.md` has the rest, including what the shared computer means for your logins.
 
 ## What a first day looks like
 

package/docs/PREREQUISITES.md

@@ -53,7 +53,7 @@ Claude Code uses it for its shell tool and the Desktop app requires it for local
 
 Optional, and the section in each kit's README called "What you lose with no browser control" is honest about what it costs to skip. The requirement is the same on every harness: it has to drive a browser that carries your own logins, not a clean automated profile, because the routines share your browser's login state and never sign in to anything. On a login wall or a captcha they stop that phase and say so.
 
-On Claude Code that means Google Chrome or Microsoft Edge, the Claude in Chrome extension (1.0.36 or later), `claude --chrome` on the CLI or the Desktop app's own integration, a login based session rather than an API key, and the site permissions granted in the extension before the first scheduled run. On OpenCode and Codex it is a browser automation server you add. On Antigravity and DeepSeek browser control is part of the product, and the thing to settle is which profile it drives. On Grok Bot the browser runs on its own cloud computer, so whether it can reach your accounts at all is the first check. Each kit's `CAPABILITIES.md` section 1.2 has a probe that answers the question on any harness in a minute.
+On Claude Code that means Google Chrome or Microsoft Edge, the Claude in Chrome extension (1.0.36 or later), `claude --chrome` on the CLI or the Desktop app's own integration, a login based session rather than an API key, and the site permissions granted in the extension before the first scheduled run. On OpenCode and Codex it is a browser automation server you add. On Antigravity and DeepSeek browser control is part of the product, and the thing to settle is which profile it drives. On Grok Bot the browser runs on the bot's own cloud computer, so your sessions are there only if you signed in on that computer or you run a cookie sync to it (Agent Cookie syncs a Mac's Chrome cookies over Tailscale), and every bot on the account then shares every login: scope by what you sign in to, never by which bot you talk to. Each kit's `CAPABILITIES.md` section 1.2 has a probe that answers the question on any harness in a minute.
 
 ## 7. A scheduler
 
@@ -72,11 +72,11 @@ Otherwise the operating system's:
 
 ## 8. A machine that is awake at fire time
 
-These are scheduled routines on your machine, not a service somewhere else. Either the machine is awake at the times in `SCHEDULE.md`, or you move the fire times to after it normally wakes. On the Desktop app, turn on Keep computer awake. A closed lid still sleeps. Grok Bot is the one exception, because its schedule runs on its own cloud computer.
+These are scheduled routines on your machine, not a service somewhere else. Either the machine is awake at the times in `SCHEDULE.md`, or you move the fire times to after it normally wakes. On the Desktop app, turn on Keep computer awake. A closed lid still sleeps. Grok Bot is the one exception, because its schedule runs on its own cloud computer. The kit lives on that computer too, and the brief reaches you in the bot's own thread rather than in a file you open (`brief.deliver`, `CAPABILITIES.md` section 6).
 
 ## 9. A working folder outside cloud sync
 
-Not inside OneDrive, Dropbox, Google Drive or iCloud. The routines write state and a run log mid run, and a sync client corrupts exactly the file that tells tomorrow's run what already happened. `D:\AgentOps\gtm-engineer` or `~/ai-employees/gtm-engineer` is right. The installer refuses a synced path, and the install prompt moves the kit out of one if it finds itself there.
+Not inside OneDrive, Dropbox, Google Drive or iCloud. The routines write state and a run log mid run, and a sync client corrupts exactly the file that tells tomorrow's run what already happened. `D:\AgentOps\gtm-engineer` or `~/ai-employees/gtm-engineer` is right. The installer refuses a synced path, and the install prompt moves the kit out of one if it finds itself there. On Grok Bot the folder is on the bot's own cloud computer, which no sync client touches.
 
 ## 10. A usage budget
 

package/docs/STANDARD.md

@@ -2,7 +2,7 @@
 
 Build spec for every AI Employee in the club. Not shipped to members. The GTM Engineer is the reference implementation; every later Employee inherits everything here and adds only its own domain expertise.
 
-Standard version 1.3, 2026-09-11: LAW 4 names connected sources, the per capability routes a member connects in their own harness, read only and preferred over the browser lane. Version 1.2, 2026-09-05: LAW 2 became the two guardrails, the first of them released channel by channel by the member in `RELEASES.md`. Version 1.1, 2026-08-28. Laws 6 through 8 and the operator-session and browser-lane sections were earned in the first live week of the GTM Engineer running Mark's own launch; the release notes in each kit's CHANGELOG carry the short story.
+Standard version 1.4, 2026-09-23: LAW 7 gains a third delivery surface, `brief.deliver`, so the brief reaches the member on a harness whose computer they never open; section 4 gains the five questions a routine answers before it is scheduled. Version 1.3, 2026-09-11: LAW 4 names connected sources, the per capability routes a member connects in their own harness, read only and preferred over the browser lane. Version 1.2, 2026-09-05: LAW 2 became the two guardrails, the first of them released channel by channel by the member in `RELEASES.md`. Version 1.1, 2026-08-28. Laws 6 through 8 and the operator-session and browser-lane sections were earned in the first live week of the GTM Engineer running Mark's own launch; the release notes in each kit's CHANGELOG carry the short story.
 
 Derived from Mark's own production routines rather than invented: the push mechanics come from `night-shift-brief` and `morning-clicks-block`, the window and period guards from the same, the browser craft from roughly thirty live Chrome routines.
 
@@ -35,6 +35,7 @@ An Employee is judged on one question: **after ninety days of running unattended
 **LAW 7: The Employee brings the work to the member.** Work product that only exists as a file the member must go hunting for reads as no work at all. Two delivery surfaces, used wherever the role allows:
 - *The dashboard is a view over live state, never installed prose.* The build bakes the morning artifact, queue files, digests, and the run history straight from the working files; every routine that writes work product rebuilds the dashboard before writing its run record; a tab describing work renders from the board, not from text written at install, which rots the same week.
 - *The browser is a delivery surface.* Where the role touches the world through forms, drafts, or posts, the Employee fills the form and leaves the tab open, prepares the draft inside the member's own account in draft state, and stages the post ready to publish. The member's contribution shrinks to the one click a held guardrail reserves for them. Every browser-staged deliverable also lands in a durable queue file carrying the full text of every field, so a closed tab loses nothing. Anti-bot checks are never answered; they are left for the member with the submit.
+- *The brief is delivered, not filed.* Every standup resolves `brief.deliver` after it writes `brief-latest.md`: the dashboard on a machine the member uses, the Employee's own thread on a hosted harness whose computer the member never opens, the member's own address where a mail route exists. The delivered text is the file's text with nothing added. A brief to the member's own thread or address is delivery, not a send, and needs no release; absent every route the file is the brief and the run record says `brief: file only`. (v1.4, 2026-09-23, from the first hosted harness: a brief on a cloud computer nobody opens is no brief.)
 (Earned 2026-08-28, Mark: "They should bring it to me and bring it to my attention," and the same morning three directory submissions went live within minutes of forms being staged in his browser.)
 
 **LAW 8: A tick records consent; the routine performs the move.** When a member ticks a card whose definition of done implies a file change, the next routine to read that tick completes the mechanical part itself. A confirmed proof inventory whose lines never got moved is a day of thin drafts nobody wanted. Consent is the member's; labor is the Employee's.
@@ -151,6 +152,8 @@ scripts/             small deterministic helpers with a --selftest
 
 **Two routines never drive one browser.** A mutex with a dead-holder timeout, and a routine that never took the lock never deletes it.
 
+**Five questions before any routine exists**, and every shipped routine answers them in its `SCHEDULE.md` row, its brief lines and its push rules: **trigger** (a clock time, or an event such as new mail or a new row), **frequency** (how often the underlying thing actually changes, never how often it would be nice to look), **output** (where the result lands and who reads it), **silence** (what it does when there is nothing to report, which is nothing) and **stop** (the one condition that pages the member instead of waiting for the brief). A routine that cannot answer all five is not ready to schedule, and a routine whose honest answer to frequency is "rarely" gets a weekly row, not a patrol. (v1.4, 2026-09-23.)
+
 ---
 
 ## 5. Voice and copy

package/docs/WHAT-SETS-THEM-APART.md

@@ -3,8 +3,10 @@
 - **They get better at your business every run.** When a page moves, a button changes or a step now needs a scroll, the routine fixes its own instructions in the run that hit it, keeps the text it replaced as the undo, and tells you in the next morning's brief under "What changed about me".
 - **They drive your browser and your PC the way you do.** Every browser routine works from a technique library written from real runs on my own machine, not from documentation: click what the page actually shows, read the page back to verify, leave a filled form open on the last step. Each site's flow is learned on your machine the first time a routine needs it and repaired every time after. Two routines never use the same signed in account at once, and on LinkedIn they read and never click.
 - **One push to your phone, only when you are the blocker.** A login expired, a credential is missing, your conversion tracking stopped while ads are live, or a run died holding the browser. Four cases and no fifth. One short line, never twice for the same thing, never outside your working hours, never on a first run. Everything else waits for the brief. [The one push](STANDARD.md#23-the-one-push).
+- **The brief comes to you.** After the standup writes it, the routine brings it to wherever you are: the dashboard on your own machine, the Employee's own thread on a hosted agent such as Grok Bot, or your own inbox where a mail route exists. A brief on a computer you never open is no brief, so on a hosted harness it lands in your thread and the Grok app carries it to your phone.
 - **They use the connections you already have.** Where your agent already has a connector for an account, the routine reads through it instead of the screen: Meta's own Ads MCP server for an ad account, the Gmail connector for drafts and replies, the Vercel and Supabase connectors for logs and advisors, Metricool for publishing. Each kit names its connections in one table, uses them read only, and works without any of them; nothing is installed for you.
 - **They run on the agent you already use.** Claude Code, OpenClaw, Hermes, OpenCode, Grok Bot, Codex, Antigravity, Pi, Cline, Qwen Code and DeepSeek, without a routine changing by one word. Routines describe what they need done, and one file per kit says how each agent does it.
+- **One routine, one job, one output.** Routines run solo and never supervise each other; the Chief of Staff reads their run logs afterwards and names what quietly stopped. Crews of agents that hand work to each other unsupervised have been measured multiplying their own errors many times over, and a wrong step here lands in your brief instead of in three other routines.
 - **You can direct any of them in chat.** Open a session in the employee's folder and it does anything you could do by hand, on your word: tick a card you confirmed, stage a form now, retune a strategy file, correct a stale brief. It leaves the same trail a routine would, and the scheduled runs treat that work as yours.
 - **You set how far they go.** Every employee drafts, fills and stages by default, and the last click is yours. Release a channel in `RELEASES.md` and the routine completes that action itself from then on. Your agent's own permission settings are the gate, and every file in the kit is plain text in your own folder, yours to change.
 - **Upgrades never overwrite your work.** `npx ai-employees upgrade` reports first, leaves any file you edited alone, and never reads your strategy or your ledgers. Every kit follows the published [Agent Employee Standard](STANDARD.md), and `npx ai-employees contribute` turns the fixes a kit made to itself into a report you can send upstream.

package/employees/ad-manager-employee/AGENTS.md

@@ -1,8 +1,12 @@
 # AGENTS.md
 
-**Ad Manager**, kit version 1.2.0. One of the eight AI Employees from [github.com/markfulton/ai-employees](https://github.com/markfulton/ai-employees).
+**Ad Manager**, one of the eight AI Employees from [github.com/markfulton/ai-employees](https://github.com/markfulton/ai-employees).
 
-This file follows the [AGENTS.md](https://agents.md) convention so that any harness can pick this kit up without being told how. It is a map, not the instructions. **The instructions are the files it points at, and they are authoritative over anything summarised here.**
+This file follows the [AGENTS.md](https://agents.md) convention so that any harness can pick this kit up without being told how. It is a map, not the instructions. **The instructions are the files it points at, and they are authoritative over anything summarised here.** The version this kit ships as is in `VERSION` at the root.
+
+## If your harness has an Instructions field instead of a folder
+
+On a hosted agent such as Grok Bot, the kit lives on the bot's own cloud computer and the bot reads an Instructions field before every task. Paste this whole file into that field, with the folder's absolute path on that computer in place of `«ADS_ROOT»`. It is the base layer (the two guardrails and the files that outrank everything else), the role layer (`ROLE.md`, which names the evidence standard) and the current focus (the strategy folder the routines keep current), and it is short enough to fit. Everything else stays in the files.
 
 ## If you have been asked to install this Employee
 

package/employees/ad-manager-employee/CAPABILITIES.md

@@ -91,7 +91,7 @@ One row each. The browser column is the one that changes how much of the kit run
 | **OpenClaw** | Expected, core to it | Unconfirmed. Probe | Probe this specifically | Built in cron, `openclaw automations create` | `expected` on files, `unknown` on browser |
 | **Hermes** | Expected | Probe | Probe this specifically | Built in cron | `expected` on files, `unknown` on browser |
 | **OpenCode** | Expected, core to it | Add a browser automation server | Depends on that server's config | None of its own, use the operating system's | `expected` on files |
-| **Grok Bot** | Expected, on its own cloud computer | Its own browser, on that computer | Check first; it runs elsewhere | Built in recurring tasks | `expected` on files, `unknown` on your sessions |
+| **Grok Bot** | Yes, on its own cloud computer: a Linux machine with a terminal, files and a browser, shared by every bot on your account | Its own browser, on that computer | Only what you signed in to on that computer, or a session you sync to it | Built in recurring tasks | `expected`; your sessions depend on the sync |
 | **Codex** | Expected, core to it | Add a browser automation server | Depends on that server's config | Scheduled runs | `expected` on files |
 | **Antigravity** | Expected, core to it | Part of the product | Probe this specifically | The `agy` job runner | `expected` |
 | **Pi** | Expected, core to it | Probe | Probe this specifically | None of its own, use the operating system's | `expected` on files |
@@ -109,7 +109,7 @@ The capability tables in sections 3 to 6 carry one row for each of the first sev
 
 **OpenCode.** An open source terminal coding agent. Reading files, writing files, and running commands are core to what it is for, so the whole environment table should hold. It supports MCP servers, which is the route to browser control: add a browser automation server and the browser table becomes available under different names. I know of no built in scheduler, so use the operating system's, per section 9.
 
-**Grok Bot.** Its bots already run routines on a schedule from their own cloud computer, so the scheduler is built in and the invocation is the routine file handed over as the run prompt. The thing to settle first is whether it can reach your own signed in accounts at all, because it runs somewhere else; if it cannot, section 7 says what the file side of the kit still produces.
+**Grok Bot.** xAI's hosted agent, and the one harness on this list that does not run on your machine. Every bot on your account shares one persistent cloud computer: a Linux machine with a terminal, file access and a real browser, where each bot has its own screen and runs one computer-use task at a time. The kit lives on that computer, so the bot installs it there itself (`npx ai-employees hire <slug> --to ~/ai-employees/<slug>`, run in its own terminal), and the cloud sync rule does not apply. One bot per Employee, named after the role, with this kit's `AGENTS.md` pasted into the bot's Instructions field, which is the map the bot reads before every task. One recurring task per routine, the Shape B prompt from section 9.2a, the fire time from `SCHEDULE.md` in the timezone that file names. Three things follow from the shared computer. Your signed in sessions are only there if you signed in on that computer or you run a sync that keeps them there (Agent Cookie syncs a Mac's Chrome cookies to the bot over Tailscale), and every bot on the account can then use every login, so bots are not a security boundary: scope by what you sign in to, never by which bot you talk to. The browser lock in `CONTRACT.md` section 6 still matters, because two bots on one platform share one browser. And the brief is a file on a computer you never open, so `brief.deliver` in section 6 posts it into the bot's own thread. Two more routes worth knowing: Claude Code can be logged in on the bot's computer, which turns this row into the Claude Code CLI row with Grok Bot as the scheduler; and Peekaboo, installed by you on a Mac, lets the bot see and click native Mac apps over the same link. The kit names both, detects them, and installs neither. Everything in this paragraph is read from operators' published accounts of the product in August 2026 and is `expected` until you write `confirmed` into `## Corrections` with the date.
 
 **Codex.** OpenAI's coding agent. Files and commands are core. The specific thing to check here is the sandbox: confirm it can write inside `«ADS_ROOT»` and confirm whether it can reach the network, because a sandbox that blocks outbound requests turns off `web.fetch` and `web.search` without announcing it, and a routine will report a documentation page as unreachable when the page is fine. Browser control comes from adding a browser automation server. Codex has scheduled runs; register one per routine.
 
@@ -138,7 +138,7 @@ Read the machine timezone id and the local wall clock time.
 | OpenClaw | Its own clock, or a shell command | `expected` |
 | Hermes | Unknown. A shell command is the fallback if it has one | `unknown` |
 | OpenCode | Its own clock, or a shell command | `expected` |
-| Grok Bot | Unknown. A shell command is the fallback if it has one | `unknown` |
+| Grok Bot | A shell command on its cloud computer. That computer keeps its own clock, so read the timezone from `SCHEDULE.md` and never assume the machine's | `expected` |
 | Codex | Its own clock, or a shell command | `expected` |
 | Antigravity | Its own clock, or a shell command | `expected` |
 
@@ -153,7 +153,7 @@ Read a file as text.
 | OpenClaw | Its file read, or a shell command | `expected` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Its file read, or a shell command | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own file access on its cloud computer, where the kit lives | `expected` |
 | Codex | Its file read. Confirm the sandbox includes `«ADS_ROOT»` | `expected` |
 | Antigravity | Its file read, or a shell command | `expected` |
 
@@ -168,7 +168,7 @@ Write a file. Anything a crash could truncate is written to a temp path and rena
 | OpenClaw | Its file write, or a shell command | `expected` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Its file write, or a shell command | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own file access on its cloud computer, where the kit lives | `expected` |
 | Codex | Its file write. Confirm the sandbox allows writes, not just reads | `expected` |
 | Antigravity | Its file write, or a shell command | `expected` |
 
@@ -185,7 +185,7 @@ List paths under a folder.
 | OpenClaw | Its glob, or a shell command | `expected` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Its glob, or a shell command | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own file access on its cloud computer, where the kit lives | `expected` |
 | Codex | Its glob, or a shell command | `expected` |
 | Antigravity | Its glob, or a shell command | `expected` |
 
@@ -200,7 +200,7 @@ Run a local command and read its output.
 | OpenClaw | Its shell | `expected` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Its shell | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | The terminal on its cloud computer | `expected` |
 | Codex | Its shell, inside the sandbox | `expected` |
 | Antigravity | Its shell | `expected` |
 
@@ -227,7 +227,7 @@ Confirm browser control is attached to a browser holding your own logged in sess
 | OpenClaw | Its own browser control if it has one, otherwise a browser automation server | `unknown` |
 | Hermes | Unknown. Probe before relying on any browser routine | `unknown` |
 | OpenCode | A browser automation server added to the harness | `expected` |
-| Grok Bot | Unknown. Probe before relying on any browser routine | `unknown` |
+| Grok Bot | Its own browser on its cloud computer. Your session is there only if you signed in on that computer, or you run a sync that keeps it there (Agent Cookie syncs a Mac's Chrome cookies over Tailscale, every fifteen minutes). Every bot on the account shares that browser and its logins | `expected` |
 | Codex | A browser automation server added to the harness | `expected` |
 | Antigravity | Its built in browser control. Confirm it drives your signed in profile | `expected` |
 
@@ -241,7 +241,7 @@ Confirm browser control is attached to a browser holding your own logged in sess
 | OpenClaw | Unknown |
 | Hermes | Unknown |
 | OpenCode | A browser automation server over a local protocol. A failed call is expected to mean a failed action, though a timeout still leaves the action's fate unknown |
-| Grok Bot | Unknown |
+| Grok Bot | Its own computer-use lane, one task per bot at a time. A failed call's fate is unknown until the page is re-read |
 | Codex | As OpenCode |
 | Antigravity | Unknown |
 
@@ -256,7 +256,7 @@ Create a tab for this run and close it at the end.
 | OpenClaw | Its browser control, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's page or context handling | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's page or context handling | `expected` |
 | Antigravity | Its browser control | `expected` |
 
@@ -271,7 +271,7 @@ Go to a URL.
 | OpenClaw | Its browser control, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's navigation | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's navigation | `expected` |
 | Antigravity | Its browser control | `expected` |
 
@@ -288,7 +288,7 @@ Read the page as a structured tree where each interactive element carries a stab
 | OpenClaw | Its page read, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's accessibility snapshot | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer, reading the page as a tree; fall back to `page.text` where a read returns only a picture | `expected` |
 | Codex | The browser automation server's accessibility snapshot | `expected` |
 | Antigravity | Its page read | `expected` |
 
@@ -302,7 +302,7 @@ Read the page as a structured tree where each interactive element carries a stab
 | OpenClaw | Unknown | Re read after any view change and use what the fresh read returns |
 | Hermes | Unknown | Same |
 | OpenCode | The browser automation server's snapshot is expected to re number on every read, with detached nodes absent | Take a fresh read after any view change. Highest numbered means nothing here and would pick an arbitrary element |
-| Grok Bot | Unknown | Re read after any view change |
+| Grok Bot | Expected to re-number on every read, as a hosted browser does | Re-read after any view change and use what the fresh read returns |
 | Codex | As OpenCode | As OpenCode |
 | Antigravity | Unknown | Re read after any view change |
 
@@ -317,7 +317,7 @@ Read the visible text.
 | OpenClaw | Its text extraction, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's text or content read | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's text or content read | `expected` |
 | Antigravity | Its text extraction | `expected` |
 
@@ -334,7 +334,7 @@ Capture the screen, or a region of it.
 | OpenClaw | Its screenshot, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's screenshot | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's screenshot | `expected` |
 | Antigravity | Its screenshot | `expected` |
 
@@ -351,7 +351,7 @@ Click one element by its reference from `page.read`.
 | OpenClaw | Its click, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's click on a snapshot reference | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's click on a snapshot reference | `expected` |
 | Antigravity | Its click | `expected` |
 
@@ -369,7 +369,7 @@ Click one element by its reference from `page.read`.
 | OpenClaw | Unknown. Assume the harness permission layer at minimum |
 | Hermes | Unknown. Same |
 | OpenCode | The harness permission layer. A browser automation server has no classifier of its own and does not refuse |
-| Grok Bot | Unknown. Same |
+| Grok Bot | Its own approval layer, which pauses a bot and asks you in its thread. A routine that hits it records the blocker and carries on with the phases that do not need it |
 | Codex | The harness permission layer plus its sandbox, which can decline network access without saying so |
 | Antigravity | Unknown. Assume the harness permission layer |
 
@@ -384,7 +384,7 @@ Set a form field's value by reference.
 | OpenClaw | Its form input, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's fill or type | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's fill or type | `expected` |
 | Antigravity | Its form input | `expected` |
 
@@ -403,7 +403,7 @@ Evaluate a script in the page context and get a JSON result back.
 | OpenClaw | Its script evaluation, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's evaluate | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer, where it exposes script evaluation; otherwise `page.read` plus `field.set` plus `element.click` | `expected` |
 | Codex | The browser automation server's evaluate | `expected` |
 | Antigravity | Its script evaluation | `expected` |
 
@@ -421,7 +421,7 @@ Evaluate a script in the page context and get a JSON result back.
 | OpenClaw | Unknown |
 | Hermes | Unknown |
 | OpenCode | The browser automation server's own default, commonly 30 seconds and usually configurable |
-| Grok Bot | Unknown |
+| Grok Bot | Its own default, not published. Treat a slow call as unknown and re-read the page |
 | Codex | As OpenCode |
 | Antigravity | Unknown |
 
@@ -436,7 +436,7 @@ Wait for a condition, polling rather than sleeping long.
 | OpenClaw | Its wait, if present, or polling | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's wait for selector or load state | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser on its cloud computer | `expected` |
 | Codex | The browser automation server's wait for selector or load state | `expected` |
 | Antigravity | Its wait | `expected` |
 
@@ -457,7 +457,7 @@ Send one short notification to your own device.
 | OpenClaw | Its own notifier if it has one, then a hosted club notifier | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | A hosted club notifier, then none | `unknown` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | A message in the bot's own thread, which the Grok app carries to your phone | `expected` |
 | Codex | A hosted club notifier, then none | `unknown` |
 | Antigravity | Its own notifier if it has one, then a hosted club notifier | `unknown` |
 
@@ -505,7 +505,7 @@ Produce one image from a prompt.
 | OpenClaw | Hosted club generator when available, then an installed image helper | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Hosted club generator when available, then an installed image helper | `unknown` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Hosted club generator when available, then an image connector you added at grok.com/connectors | `expected` |
 | Codex | Hosted club generator when available, then an installed image helper | `unknown` |
 | Antigravity | Hosted club generator when available, then an installed image helper | `unknown` |
 
@@ -526,7 +526,7 @@ Resize and re encode an image below the injection ceiling while keeping it prese
 | OpenClaw | Hosted club compressor when available, then `shell.run` | `expected` |
 | Hermes | Hosted club compressor when available, then `shell.run` if it has one | `unknown` |
 | OpenCode | Hosted club compressor when available, then `shell.run` | `expected` |
-| Grok Bot | Hosted club compressor when available, then `shell.run` if it has one | `unknown` |
+| Grok Bot | Hosted club compressor when available, then a local image tool through `shell.run` on its cloud computer | `expected` |
 | Codex | Hosted club compressor when available, then `shell.run` | `expected` |
 | Antigravity | Hosted club compressor when available, then `shell.run` | `expected` |
 
@@ -547,7 +547,7 @@ Put a compressed image into exactly one file input and dispatch a bubbling chang
 | OpenClaw | `page.script`, then `file.upload` | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The server's file chooser handling, then `page.script` | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | `page.script` in its own browser, then `file.upload` | `expected` |
 | Codex | The server's file chooser handling, then `page.script` | `expected` |
 | Antigravity | `page.script`, then `file.upload` | `expected` |
 
@@ -564,7 +564,7 @@ Hand a local file to a page's file input.
 | OpenClaw | Its file upload, if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | The browser automation server's set input files | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its own browser. The file is already on its cloud computer, because the kit lives there | `expected` |
 | Codex | The browser automation server's set input files | `expected` |
 | Antigravity | Its file upload | `expected` |
 
@@ -579,7 +579,7 @@ Put formatted copy into a rich text editor.
 | OpenClaw | Hosted club converter when available, then a synthetic paste | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Hosted club converter when available, then a synthetic paste through evaluate | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Hosted club converter, then a synthetic paste in its own browser | `expected` |
 | Codex | Hosted club converter when available, then a synthetic paste through evaluate | `expected` |
 | Antigravity | Hosted club converter when available, then a synthetic paste | `expected` |
 
@@ -594,7 +594,7 @@ Get search results for a query.
 | OpenClaw | Your own search endpoint, then its web search if present | `unknown` |
 | Hermes | Unknown | `unknown` |
 | OpenCode | Your own search endpoint, then a search server if you added one | `expected` |
-| Grok Bot | Unknown | `unknown` |
+| Grok Bot | Its built in web search, then its own browser | `expected` |
 | Codex | Your own search endpoint. Confirm the sandbox allows outbound requests | `expected` |
 | Antigravity | Your own search endpoint, then its web search | `expected` |
 
@@ -613,7 +613,7 @@ Read a URL's text without opening a browser.
 | OpenClaw | Its fetch, then `shell.run` with a fetch command, then the browser | `expected` |
 | Hermes | Unknown. `shell.run` with a fetch command if it has a shell | `unknown` |
 | OpenCode | Its fetch, then `shell.run` with a fetch command, then the browser | `expected` |
-| Grok Bot | Unknown. `shell.run` with a fetch command if it has a shell | `unknown` |
+| Grok Bot | `shell.run` with a fetch command on its cloud computer, then its own browser | `expected` |
 | Codex | Its fetch or `shell.run`. Confirm the sandbox allows outbound requests | `expected` |
 | Antigravity | Its fetch, then the browser | `expected` |
 
@@ -650,7 +650,7 @@ Append exactly one validated run record to `runlog.jsonl`.
 | OpenClaw | `shell.run` on `scripts/runlog.mjs`, then a direct append | `expected` |
 | Hermes | `shell.run` if present, then a direct append through `file.write` | `unknown` |
 | OpenCode | `shell.run` on `scripts/runlog.mjs`, then a direct append | `expected` |
-| Grok Bot | `shell.run` if present, then a direct append through `file.write` | `unknown` |
+| Grok Bot | `shell.run` on its cloud computer, then a direct append through `file.write` | `expected` |
 | Codex | `shell.run` on `scripts/runlog.mjs`, then a direct append | `expected` |
 | Antigravity | `shell.run` on `scripts/runlog.mjs`, then a direct append | `expected` |
 
@@ -679,7 +679,7 @@ The scripted judge for any text about to be written into a creative set, a build
 | OpenClaw | `shell.run` on `scripts/copy-check.mjs`, then in agent | `expected` |
 | Hermes | `shell.run` if present, then in agent | `unknown` |
 | OpenCode | `shell.run` on `scripts/copy-check.mjs`, then in agent | `expected` |
-| Grok Bot | `shell.run` if present, then in agent | `unknown` |
+| Grok Bot | `shell.run` on its cloud computer, then in agent | `expected` |
 | Codex | `shell.run` on `scripts/copy-check.mjs`, then in agent | `expected` |
 | Antigravity | `shell.run` on `scripts/copy-check.mjs`, then in agent | `expected` |
 
@@ -704,7 +704,7 @@ Derive every creative set's review, publication and delivery state from the thre
 | OpenClaw | `shell.run` on `scripts/review.mjs`, then in agent | `expected` |
 | Hermes | `shell.run` if present, then in agent | `unknown` |
 | OpenCode | `shell.run` on `scripts/review.mjs`, then in agent | `expected` |
-| Grok Bot | `shell.run` if present, then in agent | `unknown` |
+| Grok Bot | `shell.run` on its cloud computer, then in agent | `expected` |
 | Codex | `shell.run` on `scripts/review.mjs`, then in agent | `confirmed` |
 | Antigravity | `shell.run` on `scripts/review.mjs`, then in agent | `expected` |
 
@@ -727,7 +727,7 @@ Register, inspect, or change a recurring job named after a routine id.
 | OpenClaw | Its built in cron, `openclaw automations create`, through `shell.run` | `expected` |
 | Hermes | Its built in cron | `expected` |
 | OpenCode | Not available in the harness. The operating system's scheduler | `expected` |
-| Grok Bot | Its recurring tasks, on its own cloud computer | `expected` |
+| Grok Bot | Its recurring tasks, one per routine, on its own cloud computer | `expected` |
 | Codex | Its scheduled runs | `expected` |
 | Antigravity | Its `agy` job runner, through `shell.run` | `expected` |
 | Pi | Not available in the harness. The operating system's scheduler | `expected` |
@@ -739,6 +739,21 @@ Register, inspect, or change a recurring job named after a routine id.
 
 **Nothing about a routine's behaviour depends on which of the three registered it.** The routine reads the clock, reads its row in `SCHEDULE.md`, and decides for itself whether to work. A job that fires at the wrong time gets caught by the window guard. A job that fires twice gets caught by the period guard. The scheduler is a starter motor, not a controller.
 
+### `brief.deliver`
+Bring `brief-latest.md` to you after the standup writes it. The brief is the product, and on a harness whose computer you never open it is otherwise a file nobody reads.
+
+| Harness | Route | Confidence |
+|---|---|---|
+| Claude Code | Rebuild the dashboard and open it, as the standup already does | `confirmed` |
+| OpenClaw | The dashboard, then the harness's own delivery channel where its cron delivers to one | `expected` |
+| Hermes | Its cron's delivery target, which reaches any platform you set | `expected` |
+| OpenCode | The dashboard, then none | `expected` |
+| Grok Bot | The brief text posted into this Employee's own thread, where the Grok app shows it and carries it to your phone | `expected` |
+| Codex | The dashboard, then the automation's own result view | `expected` |
+| Antigravity | The dashboard, then none | `expected` |
+
+**Absent every route, the file is the brief** and the run record says `brief: file only`. That is a normal outcome and never a blocker. The brief posted anywhere is the same text as the file: no draft copy, no personal data and no credential ever leaves the file in a delivery, because a thread and a phone are less private than a folder. A brief delivered to your own address or your own thread is delivery, not a send, and needs no row in `RELEASES.md`; every other destination is a send and is held.
+
 ---
 
 ## 7. What you lose with no browser at all
@@ -828,7 +843,7 @@ No two share a fire minute, including the one that never touches a browser.
 | **OpenClaw** | Built in cron: `openclaw automations create "<cron>" "<message>" --name <id> --session isolated`, one per routine, with the timezone flag | `expected` |
 | **Hermes** | Built in cron, one job per routine, each handed that routine's `SKILL.md` as the prompt | `expected` |
 | **OpenCode** | None of its own. Use the operating system's scheduler below | `expected` |
-| **Grok Bot** | Its bots run on a schedule from their own cloud computer: one recurring task per routine | `expected` |
+| **Grok Bot** | Its recurring tasks, on the shared cloud computer: one recurring task per routine, on the bot named after this Employee, with the fire time in the timezone `SCHEDULE.md` names | `expected` |
 | **Codex** | The Codex app's automations: one `kind = "cron"` automation per routine, named after the routine id, `execution_environment = "local"`, the kit folder among its working directories, and an `rrule` built from the `SCHEDULE.md` row. Each automation keeps its own memory file, which is a note to itself and never a ledger this kit reads | `confirmed` on Windows: seven routines fired on schedule under the app's automatic review mode, after the member approved the registrations in the session |
 | **Antigravity** | The `agy` job runner, one job per routine, pointed at the routine folder | `expected` |
 | **Pi** | None of its own. Use the operating system's scheduler below | `expected` |
@@ -869,7 +884,7 @@ Two shapes cover every harness.
 | **OpenClaw** | The automation holds the invocation: its message is the Shape B prompt, so there is no separate headless command to write. For a run by hand, use its own headless flag from its help output | `expected` |
 | **Hermes** | The cron job's prompt is the Shape B prompt. For a run by hand, use its own headless flag from its help output | `expected` |
 | **OpenCode** | `opencode run "<prompt>"` is its non interactive form. Confirm it against `opencode --help` on your version. Shape B | `expected` |
-| **Grok Bot** | The recurring task's run prompt is the Shape B prompt. It runs on its own cloud computer, not on this machine | `expected` |
+| **Grok Bot** | The recurring task's run prompt is the Shape B prompt, with the kit's path on the bot's own cloud computer, where the kit lives. Nothing runs on your machine. Shape B | `expected` |
 | **Codex** | The app's automation holds the invocation: its prompt is the Shape B prompt with the kit folder named as the working directory, and no separate headless line is written. `codex exec "<prompt>"` is the by hand form, and it runs only where the CLI is signed in, which the app's own sign in does not imply. Shape B | `confirmed` for the automation route; `codex exec` stays `expected` |
 | **Antigravity** | `agy -p "<prompt>"`. The print flag is read off the CLI's own help text. That a routine then runs correctly through it is not verified | `expected` |
 | **Pi** | `pi -p "<prompt>"`. Confirm the print flag against `pi --help` on your version. Shape B | `expected` |

package/employees/ad-manager-employee/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 The version this kit ships as lives in `VERSION` at the root. This file is written by the people who publish the kit and **no routine ever writes it**. Your own improvements go to `improvements/CHANGELOG.md`, which is a different file and stays yours.
 
+## 1.8.0, 2026-09-23
+
+The Employee runs on a hosted agent, and its brief reaches you wherever it runs.
+
+- `CAPABILITIES.md` section 2, the Grok Bot row and paragraph, rewritten from operators' published accounts of the product: every bot on an account shares one persistent cloud computer with a terminal, files and a browser; the kit lives on that computer; one bot per Employee with `AGENTS.md` pasted into its Instructions field; one recurring task per routine; sessions reach the bot only through a sync you run, and every bot then shares every login. Every Grok Bot row in sections 3 to 6 moves from `unknown` to a named route at `expected`.
+- `CAPABILITIES.md` section 6, `brief.deliver`, new: the standup brings `brief-latest.md` to you after it writes it, by opening the dashboard, by posting the brief into the Employee's own thread on a harness whose computer you never open, or by sending it to your own address where a mail route exists. `CONTRACT.md` section 3.2a carries the capability and the rule: a brief to your own thread or address is delivery, not a send, and no personal data or draft copy is ever added for the delivery. Absent every route the file is the brief and the run record says `brief: file only`.
+- `routines/ads-desk-standup/SKILL.md`, the step that writes the brief, gains the delivery line.
+- `browser.session` names the route that keeps a hosted bot signed in (a cookie sync you run, such as Agent Cookie from a Mac over Tailscale). The kit detects it and installs nothing, as section 8 has always said.
+- `AGENTS.md` no longer carries a version number that drifted from `VERSION`, and says what to do with itself on a harness that has an Instructions field instead of a folder.
+- `employee.json` lists all eleven harnesses the docs promise. Pi, Cline, Qwen Code and DeepSeek were missing.
+- The install prompt's Phase 0 says the cloud sync rule does not apply on a hosted harness.
+
 ## 1.7.0, 2026-09-19
 
 The Employee tells you when a newer kit is out, and offers its own repairs back to the project.

package/employees/ad-manager-employee/CONTRACT.md

@@ -428,6 +428,7 @@ Every capability in this table degrades the same way when the harness has no bro
 | Capability | What it does | Routes, in preference order | Degradation |
 |---|---|---|---|
 | `notify.push` | Send one short notification to the member's own device | harness push notification tool, then a hosted club notifier, then none | **Absence is not a failure and is never a blocker.** Put `push: not available` in the run record `notes` and carry on. Every push in this kit is a shortcut to a line that is already in the brief, so the member loses speed and never loses information |
+| `brief.deliver` | Bring `brief-latest.md` to the member after the standup writes it: open the dashboard on a machine the member uses, post the brief text into the Employee's own thread on a harness whose computer the member never opens, or send it to the member's own address where a mail route exists. The brief to the member's own thread or address is delivery, not a send, and needs no release | The dashboard, then the Employee's own thread or delivery channel, then the member's own address, then none | **Absence is not a failure and is never a blocker.** Put `brief: file only` in the run record `notes` and carry on. The delivered text is the file's text: no draft copy, no personal data and no credential is added for the delivery, because a thread and a phone are less private than a folder |
 
 ### 3.3 Content
 

package/employees/ad-manager-employee/INSTALL-PROMPT.md

@@ -65,7 +65,7 @@ These apply from now until I remove them. They are not negotiable inside this se
 ## PHASE 0. Read the contract, then check the machine
 
 1. Read these in full, in this order, including the `## Corrections` section at the bottom of each: `«ADS_ROOT»/CONTRACT.md`, `ROLE.md`, `CAPABILITIES.md`, `SCHEDULE.md`. Where anything in this prompt and `CONTRACT.md` disagree, the contract wins. Where the contract and my own workspace rule file disagree, mine wins.
-2. Confirm `«ADS_ROOT»` exists and is writable, and that it is **not** inside OneDrive, Dropbox, Google Drive, or iCloud. If it is inside a synced folder, copy the whole kit to a local path that is not synced, continue there, leave a pointer file behind, and put the new path as the first line of your day one report. **Do not ask me.** These routines write state mid run and a sync client corrupts exactly the file that tells tomorrow's run what already happened, and it also mangles a creative set folder written as a burst of images.
+2. Confirm `«ADS_ROOT»` exists and is writable, and that it is **not** inside OneDrive, Dropbox, Google Drive, or iCloud. If it is inside a synced folder, copy the whole kit to a local path that is not synced, continue there, leave a pointer file behind, and put the new path as the first line of your day one report. **Do not ask me.** These routines write state mid run and a sync client corrupts exactly the file that tells tomorrow's run what already happened, and it also mangles a creative set folder written as a burst of images. On a harness whose computer is not a machine I use (Grok Bot runs this kit on its own cloud computer), the sync rule does not apply: the kit lives on that computer, you install it there, and the brief reaches me through `brief.deliver` in `CONTRACT.md` section 3.2a, because I never open that computer's files.
 3. Read the local timezone id and the local wall clock time from this machine using rule 18. Record both. Every time you write from here on is in that zone.
 4. Check `node --version`. It must be 18 or newer. Then run the three self tests once: `node "«ADS_ROOT»/scripts/copy-check.mjs" --selftest`, `node "«ADS_ROOT»/scripts/runlog.mjs" --selftest` and `node "«ADS_ROOT»/scripts/guard.mjs" --selftest`. If Node is missing or a self test fails, record the blocker, take the in agent routes for `copy.check` and `runlog.append` described in `CAPABILITIES.md` section 6, and carry on. **None of the three is ever skipped.** **Then check the login, and stop if it is missing:** run `claude auth status` through `shell.run`, or your harness's own equivalent. If it reports `loggedIn: false`, or no signed in account, stop here and tell me in one plain sentence that nothing after this phase can run until I open a terminal, run `claude`, and complete `/login` myself. A scheduled run that is not logged in exits in under a second with `Not logged in` and writes nothing, so there is nothing to gain by continuing. Never try to log in for me, and never enter or write a key.
 5. Detect your own capabilities live, using the framing in `CAPABILITIES.md` section 1.2. Answer it for yourself rather than asking me. Try the cheap ones rather than reasoning about them, including one throwaway call to `image.generate` if it has a route. Settle two things specifically and write down both answers:

package/employees/ad-manager-employee/VERSION

@@ -1 +1 @@
-1.7.0
+1.8.0