- show the audit-log path

Persistent operations require conversational approval in interactive mode unless

you pass `--yes` for a one-shot command:

you pass `--yes` for a direct command:

- write config

- run `config set`

## Model-Assisted Planner

Crestodian always starts in deterministic mode. Once a valid OpenClaw model is

configured, local Crestodian can make one bounded model call for fuzzy commands

that the deterministic parser does not understand.

Crestodian always starts in deterministic mode. For fuzzy commands that the

deterministic parser does not understand, local Crestodian can make one bounded

planner turn through OpenClaw's normal runtime paths. It first uses the

configured OpenClaw model. If no configured model is usable yet, it can fall

back to local runtimes already present on the machine:

- Claude Code CLI: `claude-cli/claude-opus-4-7`

- Codex app-server harness: `openai/gpt-5.5` with `embeddedHarness.runtime: "codex"`

- Codex CLI: `codex-cli/gpt-5.5`

The model-assisted planner cannot mutate config directly. It must translate the

request into one of Crestodian's typed commands, then the normal approval and

audit rules apply. Crestodian prints the model it used and the interpreted

command before it runs anything.

command before it runs anything. Configless fallback planner turns are

temporary, tool-disabled where the runtime supports it, and use a temporary

workspace/session.

Message-channel rescue mode does not use the model-assisted planner. Remote

rescue stays deterministic so a broken or compromised normal agent path cannot

pnpm test:docker:crestodian-rescue

```

Configless local planner fallback is covered by:

```bash

pnpm test:docker:crestodian-planner

```

An opt-in live channel command-surface smoke checks `/crestodian status` plus a

persistent approval roundtrip through the rescue handler:

```bash

pnpm test:live:crestodian-rescue-channel

```

Fresh configless setup through Crestodian is covered by:

```bash