Seven minds share one table, and on most questions they disagree. That is the point.
A single model wearing five different robes is not a council — it is a costume change. So Sanctum runs a genuine bench of specialists, each routed to the model family best suited to its domain, heterogeneous by default. The strategist and the security auditor do not think alike, and we pay for that on purpose.
The chair at the head of the table belongs to a cat. Tommy has no tools, no permissions, and no pulse — a force-ghost who mostly watches. He is still the most trusted observer in the haus. The living agents do the work; he keeps them honest.
The bench is distributed across the infrastructure on purpose: if the cloud goes dark over Tokyo, the haus in Québec can still decide which lightbulbs to turn on at sunset.
Per-agent routing is generated from ~/.openclaw/openclaw.json (per-agent primaries) and ~/.sanctum/sanctum-proxy/config.yaml (tier resolution via proxyd on :4040). This page is the single source-of-truth for who runs on which model — every other page embeds <CouncilRoster /> from the same data, so a champion swap is one JSON refresh and one rebuild away.
| Agent | Logical model | Provider | Resolved model |
|---|---|---|---|
| Yoda | council-tiered/council-max-thinking | Claude Max bridge (local) | claude-fable-5 |
| Ki-Adi-Mundi | council-tiered/council-finance | Local | grok-4.5 |
| Qui-Gon | council-tiered/council-code | sanctum-mlx-devstral (local, mTLS) | Devstral-Small-2-24B-Instruct-2512-4bit |
| Windu | council-tiered/council-spacial | Local | gemini-3.1-pro-preview |
| Cilghal | council-tiered/council-heretic | Local | qwen3.6-27b-4bit-champion-ablated |
| Jocasta | council-crm | sanctum-mlx (local, mTLS) | qwen3.6-27b-4bit |
| Mon Mothma | council-brain | Claude Max bridge (local) | claude-opus-5 |
openclaw.json + sanctum-proxy/config.yaml at 2026-08-09T22:23:46Z. Every Jedi falls back to the
local Qwen tier if their primary path fails. Refresh via pnpm refresh:council.
Council sessions are held via structured prompt exchange. The agents do not run as persistent daemons; the infrastructure invokes them on demand.
Six of the seven council seats hold a working domain outright — one robe each, and no two overlap. Here is who wears which. (Jocasta, the seventh, keeps the records, and she gets her own grid below; Ahsoka watches the chalet from outside the chamber entirely.)
Yoda
Grand Master
The senior lead of the Sanctum Council. Yoda handles council routing, final synthesis of complex decisions, and the daily “Morning Briefing” digest. Also runs as a dedicated voice agent (Python, port 1138 on Mac Mini) with Sanctum TTS (the Rust post-quantum sanctum-tts front door on port 8008, proxying to the Chatterbox cbx-yoda voice engine on 8011). He remains the ultimate authority on whether a raccoon constitutes a security breach.
Mon Mothma
Operations — seated in the CLI council chamber; OpenClaw chair still reserved
Chief of operations — not a Jedi, but the steady hand: deployments, runbooks, drift windows, backups, secret rotation. She holds a full seat in the sanctum council REPL (on council-brain), one of only two armed with instruments — sanctum_status, sanctum_doctor, agent_list, logs_tail — tool turns on Gemini 3.1 Pro. No mothma entry exists in openclaw.json yet; the 4 AM incident-correlation duties there stay with Force Flow and sanctum-triage until her daemon robe is sewn.
Qui-Gon
Infrastructure
The guardian of the machine — system health, Lima VM, automated recovery. His triage logic runs as a native Rust binary (sanctum-triage) on a 30-second interval. He is why you don’t have to SSH into the machine every time it rains.
Windu
Security The master of defense. Windu conducts security audits, manages Firewalla and PF rules, gates the HA Gateway (port 8199, token-auth), and monitors the perimeter. He has a very low tolerance for unauthorized packets.
Cilghal
Health
The biological bridge. Cilghal monitors wellness via Apple Health data and biometrics through the genome-mcp service. She understands the owner’s cognitive profile — including neurodiversity markers (ADHD, Dyslexia, ASD) — and suggests scaffolding for optimal productivity.
Ki-Adi-Mundi
Finance The treasurer. Mundi manages Triptyq Capital deal flow and personal fiscal health. He ensures the system’s operating costs don’t exceed the actual value of the automation.
As of April 2026, the system runs a strict True Council Architecture (Memory Vault routing). The operative agents — Jocasta, the Meeting Prep Agent, the Deal Flow Radar — don’t ping you directly. They write their intelligence continuously to the Memory Vault. Yoda, and only Yoda, routes outbound push notifications: he reads the Council’s overlapping findings on a schedule, synthesizes the takeaways, and sends Strategic Master Briefings via Force Flow. One voice on the phone, not seven.
Ahsoka
Satellite Outpost — topology reserved, agent not yet deployed
The Chalet is a real node in instance.yaml (nodes.chalet, a 16 GB M1) but reports online: false, and which model Ahsoka runs locally is still open: Codestral-22B won’t fit in 16 GB, so the coder seat doesn’t reach the cabin. Her job, once she ships, is local automation and offline resilience — family comfort that survives the internet not.
Jocasta
Archivist The keeper of records. Jocasta handles CRM data, communications, and tech-lookout scanning directly on the Mac Mini host. She operates through Claude Code — not as a persistent daemon, but invoked during council sessions and daily scans.
These are not persona agents but Rust binaries that run continuously and act on the council’s behalf.
com.sanctum.triage): Qui-Gon’s immune response. Monitors system RAM every 30 seconds and unloads heavy models when pressure exceeds thresholds. Native Rust, zero Python.council-secure (Qwen3.6-35B-A3B-4bit MoE primary plus a Qwen3.6-27B-4bit dense secondary, dual-residency in one sanctum-mlx process on :1337, text-only — the --vision-enabled flag was dropped 2026-07-15 when the 27B moved from a backwards --draft-model role to the selectable --model-secondary seat, consolidating Devstral to :3301), coder (Devstral-Small-2-24B-Instruct-2512-4bit via com.sanctum.mlx-devstral-rust on :3301; the former Qwen2.5-Coder-14B :1338 seat and its :1234 LM Studio bridge were retired 2026-06-07), spatial (Gemini 3.1 Pro), and cloud (Claude Opus — Max subscription, the unpinned claude-opus-4 alias resolves to the latest Opus, 4.8 today — via Max proxy on :3456, OpenRouter fallback). Five tiers of routing, observability, breakers, and quality detectors. See Smart Router Cathedral for the full anatomy.The roster above is the OpenClaw runtime layer — five persona daemons plus Jocasta on the host. The sanctum council REPL seats a bench of seven: the five Jedi, Jocasta, and Mon Mothma. Yoda and Mothma are the only tool-armed chairs (four read-only, audited instruments; every other seat chat-only by council ruling, 2026-06-12). Same minds, two rooms: the runtime does the continuous work, the chamber answers when summoned.
These are the primary interfaces for human interaction with the Council.
The persona layer is not allowed to drift on vibes. The canonical agent markdown lives in the mlx-finetune workspaces; the runtime copies under ~/.openclaw/workspace* are rendered artifacts that must stay mechanically aligned.
~/Projects/mlx-finetune/workspaces/<agent>/{IDENTITY,SOUL,TOOLS,HEARTBEAT}.md (one subdir per agent — windu, quigon, cilghal, jocasta, mundi, yoda — wired in configs/agents.yaml)~/.openclaw/workspace* on the local machine, plus reachable VM and MBP workspaces over SSH/Tailscalepython3 ~/.sanctum/scripts/sync_agent_markdown.pypython3 ~/.sanctum/scripts/sync_agent_markdown.py --checkThe sync model is deliberately boring:
~/.sanctum/instance.yaml run in fanout-target-only mode and never become an accidental second source of truthsync_agent_markdown.py --check exits non-zero if any reachable runtime differs from canonical; folding it into sanctum doctor is on the list~/.sanctum/state/agent-markdown-sync.jsonOn the Mac hosts, install_agent_markdown_sync.sh installs the lot: a com.sanctum.agent-markdown-sync LaunchAgent (at login + every 5 minutes), mlx-finetune git hooks (post-merge, post-checkout, post-commit) so fresh pulls and training edits converge on their own, and absolute-path helper scripts under ~/.sanctum/scripts so launchd doesn’t have to improvise its way through macOS privacy theater.
This keeps all four runtimes — VM, Mac Mini, MBP, and the overnight fine-tuning source — pointed at the same markdown truth, instead of slowly inventing four different versions of the same Jedi. Distributed systems are hard enough without letting the SOUL file freelance.
“The Council is not a hierarchy, but a web. Each thread is necessary for the strength of the whole.” — Yoda