From dfabea126426f6c8ef018c07cf0f763c0f53dcb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?BlueBirdBack=20=E2=9C=A8?=
 <126304167+BlueBirdBack@users.noreply.github.com>
Date: Mon, 27 Apr 2026 21:06:19 +0800
Subject: [PATCH 1/4] Initial commit

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..d3b916f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,2 @@
+# askclaw.dev
+AskClaw website and public docs.

From 7a8cf4a44ea8c323447e65b8e7a83554f8fb0df4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ash=20=F0=9F=8C=BF?= <admin@askclaw.dev>
Date: Mon, 27 Apr 2026 21:06:21 +0800
Subject: [PATCH 2/4] docs: add AskClaw public README

---
 README.md | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index d3b916f..28095ef 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,38 @@
-# askclaw.dev
-AskClaw website and public docs.
+# AskClaw 🦀
+
+端到端实现一人公司（OPC）。  
+用 AI agents 构建、运行、扩展一个人的公司。
+
+Build, run & scale your one-person company end-to-end with AI agents.
+
+## 我们在构建 / What we build
+
+AskClaw 构建面向一人公司和小团队的 agentic AI 工作流：产品、工程、运营、支持、增长，从想法到交付端到端完成。
+
+AskClaw builds agentic AI workflows for one-person companies and small teams: product, engineering, operations, support, and growth — from idea to delivery.
+
+## 方向 / Focus
+
+- 一人公司（OPC）的端到端 AI 工作流  
+  End-to-end AI workflows for one-person companies
+
+- OpenClaw、Hermes、多 agent 协作  
+  OpenClaw, Hermes, and multi-agent collaboration
+
+- 开发者工具、自动化、异步执行  
+  Developer tools, automation, and async-first execution
+
+- 让人和 AI agents 一起把真实工作做完  
+  Helping humans and AI agents finish real work together
+
+## 链接 / Links
+
+- Website: https://askclaw.dev
+- X: https://x.com/GetAskClaw
+- GitHub: https://github.com/getaskclaw
+
+## 联系 / Contact
+
+- Admin: admin@askclaw.dev
+- GitHub: github@askclaw.dev
+- Security: security@askclaw.dev

From 9fb97ecda788f29b9003fe3b5f66522760c7ad2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ash=20=F0=9F=8C=BF?= <admin@askclaw.dev>
Date: Mon, 27 Apr 2026 21:06:23 +0800
Subject: [PATCH 3/4] docs: add security contact

---
 SECURITY.md | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..5aea554
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Security Policy
+
+Please report security issues privately by emailing:
+
+security@askclaw.dev
+
+Do not open public GitHub issues for vulnerabilities or sensitive reports.

From 2dff33ab4f2e78a441c043b9d80a310ee02dc2b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ash=20=F0=9F=8C=BF?= <ash@askclaw.dev>
Date: Mon, 27 Apr 2026 14:05:02 +0000
Subject: [PATCH 4/4] docs: document agent access model

---
 README.md            |  4 ++++
 docs/agent-access.md | 54 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 docs/agent-access.md

diff --git a/README.md b/README.md
index 28095ef..9fcd214 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,10 @@ AskClaw builds agentic AI workflows for one-person companies and small teams: pr
 - X: https://x.com/GetAskClaw
 - GitHub: https://github.com/getaskclaw
 
+## 运行 / Operations
+
+- [Agent access model](docs/agent-access.md)
+
 ## 联系 / Contact
 
 - Admin: admin@askclaw.dev
diff --git a/docs/agent-access.md b/docs/agent-access.md
new file mode 100644
index 0000000..4c42c41
--- /dev/null
+++ b/docs/agent-access.md
@@ -0,0 +1,54 @@
+# Agent access model
+
+AskClaw uses named machine-user accounts for routine agent work. Agents do not use owner/admin credentials for normal code changes.
+
+## 身份 / Identity
+
+- GitHub organization: `getaskclaw`
+- Agent account: `askclaw-ash`
+- Display name: `Ash 🌿`
+- Team: `agents`
+
+## 权限 / Permissions
+
+Current baseline:
+
+- `getaskclaw/.github`: read-only access for agents
+- `getaskclaw/askclaw.dev`: write access for agents
+- `main`: protected branch; changes go through pull requests
+
+Write access means agents may create branches and open PRs. It does not mean direct-to-`main` changes.
+
+## Token policy
+
+Use fine-grained personal access tokens for machine users:
+
+- Resource owner: `getaskclaw`
+- Repository access: selected repositories only
+- Default repository: `askclaw.dev`
+- Minimum permissions for routine work:
+  - Contents: read/write
+  - Pull requests: read/write
+  - Issues: read/write
+  - Metadata: read-only
+- Expiration: short-lived, normally 90 days or less
+
+Never store tokens, passwords, recovery codes, or TOTP secrets in this repository, GitHub issues, pull requests, chat logs, or screenshots.
+
+## Operating rules
+
+- Keep owner/admin tokens for organization setup only.
+- Use `askclaw-ash` for routine branches, commits, issues, and PRs.
+- Store recovery codes and PATs in a password manager such as KeePass.
+- Rotate machine-user tokens before expiry.
+- Revoke tokens immediately if copied into chat, logs, commits, or any public place.
+
+## Verification checklist
+
+Before granting or using agent write access:
+
+- 2FA is enabled for the machine-user account.
+- Recovery codes are stored outside chat and outside the repository.
+- The machine user is in the `agents` team.
+- The target repository has branch protection enabled.
+- A smoke test confirms branch create/delete works with the machine-user token.