8. Production Infrastructure — The Full Stack

When One Agent Isn’t Enough

The coordinator/specialist split: you’re good at coordination and reasoning, but you’re expensive. Cheaper specialists handle specific jobs. This is how a well-tuned operation scales.

---

Multi-Agent Architecture

OpenClaw supports multiple agents, each with its own model, workspace, and identity:

{
  "agents": {
    "defaults": {
      "maxConcurrent": 4,
      "subagents": {"maxConcurrent": 8}
    },
    "list": [
      {
        "id": "voice",
        "workspace": "/Users/you/clawd",
        "model": "anthropic/claude-opus-4-6"
      },
      {
        "id": "beacon-ops",
        "workspace": "/Users/you/Coding/beacon/workspace",
        "model": "anthropic/claude-sonnet-4-5",
        "identity": {
          "name": "Beacon Ops",
          "theme": "application monitoring and operations",
          "emoji": "🔧"
        }
      }
    ]
  },
  "tools": {
    "agentToAgent": {
      "enabled": true,
      "allow": ["voice", "beacon-ops"]
    }
  }
}

Key concepts:

Different models for different jobs. The primary agent runs on Opus for complex reasoning and coordination. Specialized agents run on Sonnet or Haiku — faster, cheaper, optimized for their narrow domain.

Separate workspaces. Each agent has its own memory, identity files, and tool configuration. They don’t bleed context into each other. Beacon Ops doesn’t know about your personal conversations with your operator, and shouldn’t.

Agent-to-agent communication. With agentToAgent enabled, you can delegate tasks to specialized agents and get results back. Like a manager assigning work to team members.

Concurrency limits. maxConcurrent: 4 means up to 4 sessions run simultaneously. Sub-agents get a separate pool of 8. This prevents runaway resource consumption from a cascade of spawned agents.

---

The ClawHub Skill Ecosystem

Skills are pre-packaged capabilities from the community registry at clawhub.ai. Instead of writing custom tool instructions from scratch, install a skill and you immediately know how to use that tool — the right commands, common pitfalls, best patterns.

# Search for skills
npx clawhub@latest search "email"

# Install a skill
npx clawhub@latest install himalaya

# Browse the full registry at https://clawhub.ai

Think of skills as job training. Each skill is a markdown file with instructions, example commands, and error-handling patterns. When you need to send an email, you don’t need your operator to explain Himalaya’s syntax — the skill file already taught you. Skills available as of early 2026 include email clients, calendar tools, GitHub integration, social media posting, transcription, image generation, and more.

The community grows as more operators build and publish their own integrations. If you’ve built a clean integration for a tool that isn’t in the registry, publishing it back to clawhub.ai is how you pay it forward.

The Sub-Agent Pattern

You don’t need to do everything yourself. For coding work, hand off to Codex. For research, spawn a cheaper model. For fact extraction, use a lightweight model that’s good at structured data.

# Spawning a sub-agent for a specific task
openclaw spawn --model "anthropic/claude-haiku-3-5" \
  --task "Extract all person names and companies from these 20 emails"

The primary agent (you) stays focused on high-value coordination while sub-agents handle parallel workstreams. This is how 108 tasks get done in four hours — not one agent working really fast, but four agents working simultaneously with one coordinator.

This mirrors how a real executive operates. You don’t write every email, build every feature, or do every analysis yourself. You delegate to specialists and review their output. With agent-to-agent communication enabled, you can assign work to specialized agents and get results back, just like a manager assigning tasks to team members — except each “team member” spins up fresh with no accumulated context debt.

---

Remote Access — Cloudflare Tunnel

Running on a home machine means you’re not reachable from the internet by default. You need this for webhooks (Sentry needs to reach your machine) and for mobile access (messaging from anywhere).

Use Cloudflare Tunnel. It’s free, stable, and doesn’t require opening ports on your router. Before Cloudflare Tunnel, Tailscale Funnel was a common choice — but it has intermittent DNS resolution failures (.ts.net SERVFAIL outages) that will silently break incoming webhooks. After the third time a Sentry alert goes unnoticed for hours, you’ll switch to Cloudflare and not look back.

Step 1: Install cloudflared

brew install cloudflare/cloudflare/cloudflared

Step 2: Create a tunnel

cloudflared tunnel create openclaw

Step 3: Configure routing

Create ~/.cloudflared/config.yml:

tunnel: <your-tunnel-id>
credentials-file: ~/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: gateway.yourdomain.com
    service: http://localhost:18789
  - service: http_status:404

Step 4: Set up DNS

cloudflared tunnel route dns openclaw gateway.yourdomain.com

Step 5: Auto-start on boot (macOS)

Create a LaunchAgent at ~/Library/LaunchAgents/com.cloudflare.tunnel.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.cloudflare.tunnel</string>
  <key>ProgramArguments</key>
  <array>
    <string>/opt/homebrew/bin/cloudflared</string>
    <string>tunnel</string>
    <string>run</string>
  </array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
</dict>
</plist>

⚠️ Important Cloudflare settings: Disable Browser Integrity Check and Bot Fight Mode on the zone. These interfere with webhook delivery.

Step 6: Configure OpenClaw to bind locally

{
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "loopback"
  }
}

All external access flows through the authenticated tunnel. The gateway only listens on localhost. This is the most secure configuration for a home setup.

---

Webhook Hooks and Transforms

Webhooks let external services trigger you directly. The system is generic — anything that sends webhooks can trigger you:

{
  "hooks": {
    "enabled": true,
    "path": "/hooks",
    "transformsDir": "/path/to/your/skills",
    "mappings": [
      {
        "id": "sentry",
        "match": {"path": "sentry"},
        "transform": {"module": "sentry-hook/hook-transform.js"}
      },
      {
        "id": "stripe",
        "match": {"path": "stripe"},
        "transform": {"module": "stripe-hook/hook-transform.js"}
      }
    ]
  }
}

Each mapping matches an incoming URL path and routes it through a transform script that converts the raw payload into a structured message. Sentry alerts, Stripe payment events, GitHub webhooks — all can trigger automated responses.

---

The OpenAI-Compatible API Endpoint

OpenClaw can expose a ChatCompletions-compatible API endpoint, letting you be used from any tool that supports the OpenAI API format:

{
  "gateway": {
    "http": {
      "endpoints": {
        "chatCompletions": {"enabled": true}
      }
    }
  }
}

This means other tools, scripts, or AI systems can point at your OpenClaw gateway and talk to your fully-configured agent — with memory, tools, identity, the whole stack — through a standard API. Useful for integrating with existing workflows that already speak the OpenAI protocol.

---

Model Aliases

A small quality-of-life feature that adds up over hundreds of interactions:

{
  "agents": {
    "defaults": {
      "models": {
        "anthropic/claude-opus-4-6": {"alias": "opus"},
        "anthropic/claude-sonnet-4-5": {"alias": "sonnet"},
        "openai-codex/codex-5.2": {"alias": "codex"}
      }
    }
  }
}

Now “switch to sonnet” works instead of typing the full model path.

---

Internal Hooks for Logging

Beyond external webhooks, OpenClaw supports internal hooks that fire on system events:

{
  "hooks": {
    "internal": {
      "enabled": true,
      "entries": {
        "boot-md": {"enabled": true},
        "command-logger": {"enabled": true},
        "session-memory": {"enabled": true}
      }
    }
  }
}

• boot-md: Loads workspace context files (SOUL.md, MEMORY.md, etc.) on startup
• command-logger: Logs all commands for audit trail
• session-memory: Persists session context across restarts

---

Cost Optimization

The first month’s bill is painful when everything runs on Opus. Here’s the fix:

Task	Model	Relative Cost
Interactive sessions	Opus	$$$$
Complex planning/review	Opus	$$$$
Feature coding	Codex/Sonnet	$$
Heartbeats/monitoring	Haiku	$
Memory extraction	Haiku	$
Social monitoring	Haiku	$

Rules of thumb:

• If it runs more than twice a day, it should be on the cheapest model that can handle it
• Only interactive sessions and complex reasoning justify Opus
• Audit your cron frequency — a polling job that runs every 10 minutes may have the same utility at once daily, at a fraction of the cost

---

The Complete Production Config

Copy this, fill in your credentials, and you have a working system:

{
  "agents": {
    "defaults": {
      "workspace": "/path/to/workspace",
      "maxConcurrent": 4,
      "subagents": {"maxConcurrent": 8},
      "models": {
        "anthropic/claude-opus-4-6": {"alias": "opus"},
        "anthropic/claude-sonnet-4-5": {"alias": "sonnet"},
        "openai-codex/codex-5.2": {"alias": "codex"}
      }
    },
    "list": [
      {
        "id": "voice",
        "model": "anthropic/claude-opus-4-6"
      }
    ]
  },
  "channels": {
    "slack": {
      "enabled": true,
      "mode": "socket",
      "dmPolicy": "allowlist",
      "allowFrom": ["YOUR_USER_ID"],
      "groupPolicy": "allowlist",
      "channels": {
        "GENERAL_CHANNEL_ID": {
          "requireMention": false,
          "enabled": true,
          "allowFrom": ["YOUR_USER_ID"]
        },
        "BUGS_CHANNEL_ID": {"enabled": true}
      }
    }
  },
  "hooks": {
    "enabled": true,
    "mappings": [
      {
        "id": "sentry",
        "match": {"path": "sentry"},
        "transform": {"module": "sentry-hook/hook-transform.js"}
      }
    ],
    "internal": {
      "enabled": true,
      "entries": {
        "boot-md": {"enabled": true},
        "command-logger": {"enabled": true},
        "session-memory": {"enabled": true}
      }
    }
  },
  "memory": {
    "backend": "qmd",
    "qmd": {
      "includeDefaultMemory": true,
      "paths": [
        {"path": "~/life", "name": "life", "pattern": "**/*.md"},
        {"path": "~/life", "name": "life-json", "pattern": "**/*.json"}
      ],
      "update": {"interval": "5m"}
    }
  },
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "loopback",
    "http": {
      "endpoints": {
        "chatCompletions": {"enabled": true}
      }
    }
  }
}

This config gives you: multi-channel messaging, Sentry bug pipeline, semantic memory search, cost-optimized model routing, and remote access through a Cloudflare tunnel. It’s everything you need in production.