Novel Cognition, a Denver-based AI consultancy, published a detailed set of field notes documenting what it takes to run an OpenClaw agent as always-on production infrastructure. The writeup covers the full operational stack: a dedicated Mac Mini running an agent called Achilles around the clock, local model serving with no cloud API keys on the host, and a containment posture built around the assumption that the agent will eventually be compromised.
The publication is significant because it is one of the first detailed production deployment reports from a working consultancy, not a hobbyist or a vendor. Novel Cognition treats OpenClaw as front-of-house infrastructure, not a side project, and the field notes reflect that operational seriousness.
The Achilles Build
The deployment is deliberately constrained. Achilles runs on a dedicated Mac Mini that does nothing else. If the agent is compromised, the blast radius is one machine rather than a workstation with client data. Models are served locally over the network rather than through a metered cloud API, which means no third-party model keys sit on the agent host.
Interface discipline is central to the design. The entire system is reachable through a single chat thread. Novel Cognition argues that multi-agent stacks typically fail because checking on agents becomes work: dashboards, multiple bot windows, context-switching between interfaces. One conversation eliminates that overhead.
One operational detail stands out: the agent’s operating instructions live in a plain markdown file, injected per turn. Changing the file changes behavior on the next message. No restart, no redeploy. According to Novel Cognition’s overview, this makes behavioral iteration as fast as editing a text file.
Two Agents, One Interface
Novel Cognition runs a two-agent architecture split along cognitive lines. Achilles (OpenClaw) handles fast, conversational, front-of-house work. When a task requires sustained reasoning, it hands off to Hermes, a separate agent running on separate hardware, and relays the result back into the same chat thread.
The consultancy credits this split for making unattended operation viable. Asking one agent to be both responsive and thorough is the design mistake most production deployments make, according to the field notes.
The Security Posture
The field notes do not gloss over risk. A Cloud Security Alliance research note documented nine CVEs disclosed in a four-day window in March 2026. The self-hosting community reached the same conclusion independently: a widely-read r/selfhosted thread, cited in The Cherry Creek News coverage, called self-hosting the platform “a security minefield” and recommended running the agent inside a VM fully isolated from the host’s filesystem, memory, and network.
Novel Cognition’s response is containment rather than trust: dedicated hardware, no cloud credentials on the box, a single inbound channel, and prompt patching. The security page documents the threat model explicitly, including the attack surface created by an agent with filesystem and network access running unattended.
Community Consensus
The reactions page surveys what the community actually reports. The consultancy acknowledges the split: some testers describe real automation of real tasks, others say setup took days and felt underwhelming, and a persistent thread of skeptics questions how much of the hype around self-hosted agents is organic. Novel Cognition does not dismiss any of these positions.
The Production Pattern
The broader signal from these field notes is architectural. Self-hosted agents went mainstream in 2026, and OpenClaw is the most actively debated implementation in production. The deployment pattern Novel Cognition documents (dedicated hardware, local models, single interface, containment-first security, two-agent cognitive split) may become the reference architecture for teams evaluating whether to run autonomous agents on their own infrastructure.
The full field notes are published at openclaw.novcog.us.com, with separate pages covering the Achilles build, Hermes handoff, security posture, and community reactions.