Require Grok orchestrator with local wwg3-worker for product work.

Keep paid parent session coordinator-only; pin and document that all
implement/review/check subagents use the LAN wwg3-worker endpoint.

.grok/rules/execution-loop.md

@@ -14,13 +14,14 @@ Authorize → Plan (if needed) → Build → Review → Check → Local commit (
 
 1. **No product implementation** until the user says **build** or **implement**. Docs/design/agent-rules work is fine without that.
 2. **Do not require the user to restate process.** If they authorize a slice, run plan (when needed) → build → independent review → check yourself.
-3. **Review + check** on multi-file / non-trivial work. Prefer `/review --local` and `/check-work`. Equivalent: read-only reviewer subagent + verifier subagent / `make verify`. Same agent editing and saying “LGTM” is not enough.
-4. **Commit only when asked.** **Never push, open/merge PR, or tag** unless the user explicitly orders it. User owns `git push` by default.
-5. **Scope lock.** Implement only the authorized slice. No drive-by packages, no silent redesign of `design/` SSOT.
-6. **Subagents:** implementers edit; reviewers/explorers/verifiers are read-only. Parallel writers use worktrees. Inject product hard rules into every implementer prompt.
-7. **Multi-PR / execute-plan:** only with a PR Plan DAG; `--dry-run` first when using execute-plan; this product → no Graphite default, no auto-PR, no push/merge unless user overrides in writing. Remote MCP = **gitea_vps** only.
-8. **Stop** when the slice is done, blocked on a user decision, or would require secrets / destructive git / forge mistakes — report, do not steamroll.
-9. **Platform-first:** `nemohermes` / `openshell` only; no parallel control API; no owner terminal/Docker instructions; no agent pay / silent send.
+3. **Grok parent = orchestrator only.** All product work (implement / review / check / explore / fix) runs on local **`wwg3-worker`** subagents. See `local-worker.md`.
+4. **Review + check** on multi-file / non-trivial work via **worker** subagents (`model: "wwg3-worker"`). Prefer `/review` + `/check-work` patterns that spawn workers. Parent self-LGTM is not enough.
+5. **Commit only when asked.** **Never push, open/merge PR, or tag** unless the user explicitly orders it. User owns `git push` by default.
+6. **Scope lock.** Implement only the authorized slice. No drive-by packages, no silent redesign of `design/` SSOT.
+7. **Subagents:** `model: "wwg3-worker"` always (unless user overrides). Implementers edit; reviewers/explorers/verifiers read-only. Parallel writers use worktrees. Inject product hard rules into every worker prompt.
+8. **Multi-PR / execute-plan:** only with a PR Plan DAG; `--dry-run` first; no Graphite default, no auto-PR, no push/merge unless user overrides. Workers stay on `wwg3-worker`. Remote MCP = **gitea_vps** only.
+9. **Stop** when the slice is done, blocked on a user decision, local worker is down, or secrets / destructive git / forge mistakes would be required — report, do not steamroll onto paid Grok.
+10. **Platform-first:** `nemohermes` / `openshell` only; no parallel control API; no owner terminal/Docker instructions; no agent pay / silent send.
 
 ## Tiny exception
 

.grok/rules/local-worker.md

@@ -0,0 +1,29 @@
+# Local worker + Grok orchestrator (mandatory)
+
+Full SSOT: `AGENTS.md` → **Orchestrator vs local worker (mandatory)**.
+
+## Split
+
+| Role | Model | Job |
+|------|-------|-----|
+| Parent session (composer) | Grok (`grok-4.5` / session default) | Orchestrate only |
+| Every subagent / workflow child | **`wwg3-worker`** (local endpoint) | **All product work** |
+
+## Orchestrator MUST
+
+- Spawn workers with `model: "wwg3-worker"` for explore / plan / implement / review / check / fix.
+- Inject product rails + authorized slice into every worker prompt.
+- Sequence the execution loop; talk to the user; enforce no push unless asked.
+- If local endpoint fails: **stop and report** — do not finish the work on paid Grok.
+
+## Orchestrator MUST NOT
+
+- Implement product code (`write` / `search_replace` / bulk codegen) in the parent when a worker should.
+- Omit `model` / use cloud models for workers without an explicit user override for that task.
+- Use the local worker as the parent orchestrator model.
+
+## Exceptions (parent only)
+
+Agent-rules edits (`AGENTS.md`, `.grok/rules/*`), pure Q&A, orientation reads, git inspect, local commit **when user asks**, kill/stop subagents, true one-line nits requested in-chat.
+
+When unsure → **delegate to `wwg3-worker`**.