Keep paid parent session coordinator-only; pin and document that all implement/review/check subagents use the LAN wwg3-worker endpoint.
Codify authorize → plan → build → review → check → local-only save so Grok Build stays on process without the user naming every slash command.
Bind commit/push/PR safety, gitea_vps-only remote ops, and secret scans in AGENTS.md, with CLAUDE.md and Grok rules so every harness loads them.