feat(security): public audience security hardening

AGENTS.md

@@ -135,6 +135,14 @@ auto-fix common schema validation errors. To ensure smooth upgrades for existing
   to the primitive defeats the purpose. Use `.Value` for explicit access and
   explicit casts where truly needed. If a value object can silently become a
   string, it provides no more safety than a raw string.
+- **Comments: skip noise, keep signal.** Don't narrate what code does when
+  identifiers already say it (`// increment counter`). Do write comments
+  that help a human reviewer scanning in isolation: security gate
+  explanations (what's blocked, for which audience, why), hidden
+  constraints, subtle invariants, non-obvious fallback strategies, and
+  cross-cutting concerns that aren't visible from the call site. A good
+  comment answers "why would this surprise me?" — not "what does this
+  line do?"
 
 ## Testing Guidelines
 

feeds/skills/.system/files/netclaw-memory/SKILL.md

@@ -3,14 +3,29 @@ name: netclaw-memory
 description: "REQUIRED when the user asks what you remember, recall, or know from past conversations, previous sessions, or cross-session memory. Also before using memory tools: find_memories, get_memories, store_memory, update_memory."
 metadata:
   author: netclaw
-  version: "1.3.0"
+  version: "1.4.0"
 ---
 
 # Netclaw Memory
 
 Read this before using any memory tool. It defines how memory works and
 when to use each tool.
 
+## Audience and Feature Gating
+
+Memory is subject to two independent gates:
+
+- **Audience gate:** Public sessions have no access to memory tools, automatic
+  recall, or memory extraction. Memory is fully inert for Public — no reads,
+  writes, or recall. Historical memories authored by Public sessions are also
+  excluded from recall and search for all audiences.
+- **Deployment gate:** `Memory.Enabled` in `netclaw.json` (default `true`).
+  When `false`, memory is disabled for ALL audiences — recall returns empty,
+  memory tools are hidden from discovery, and the observation sidecar skips
+  extraction.
+
+Both gates must pass for memory to function.
+
 ## How Memory Works
 
 - **Automatic recall** runs before each user turn and injects relevant

feeds/skills/.system/files/netclaw-operations/SKILL.md

@@ -3,7 +3,7 @@ name: netclaw-operations
 description: "REQUIRED when the user asks about scheduling, reminders, cron jobs, timers, background jobs, diagnostics, troubleshooting, MCP tools, daemon health, identity updates, or Netclaw capabilities and self-maintenance."
 metadata:
   author: netclaw
-  version: "1.19.0"
+  version: "1.20.0"
 ---
 
 # Netclaw Operations
@@ -61,6 +61,11 @@ the project root.
 
 ## Scheduling
 
+Scheduling is gated on `Scheduling.Enabled` in `netclaw.json` (default `true`).
+When disabled, reminder tools are hidden, `ReminderManagerActor` skips startup
+reconciliation, and fired reminders are acknowledged but not executed. Public
+audience sessions cannot use scheduling tools regardless of the config flag.
+
 `set_reminder` accepts three schedule types:
 
 | Type | Examples |
@@ -153,6 +158,11 @@ Sessions receive granted tool categories. `builtin` is always granted.
 Other categories (`web`, `file`, `shell`, `scheduling`) depend on ACL
 config. If a tool is missing, it may not be granted for this session.
 
+Tools belonging to disabled subsystems (see [Feature Kill Switches](#feature-kill-switches))
+are hidden from `search_tools` results for all audiences. Public sessions
+additionally cannot discover or load skills, subagents, memory tools, or
+scheduling tools regardless of feature flags.
+
 ### Adding MCP servers (fail-closed by default)
 
 `netclaw mcp add` writes new MCP servers with **zero granted tools** and
@@ -273,6 +283,10 @@ directories (native + external) when files change on disk. No restart needed.
 
 ## Webhook Management
 
+Webhooks are gated on `Webhooks.Enabled` in `netclaw.json` (default `true`).
+When disabled, the webhook HTTP endpoint returns 404 for all routes and
+webhook tools are hidden from discovery.
+
 Inbound webhooks use a split config model:
 
 - `~/.netclaw/config/netclaw.json` -> `Webhooks.Enabled` toggles the feature
@@ -391,19 +405,49 @@ including `Daemon.Host`, `Daemon.Port`, `Daemon.ExposureMode`),
 `~/.netclaw/client/config.json` (local CLI endpoint state),
 `~/.netclaw/config/secrets.json` (credentials — never display API keys).
 
-## Identity
+## Feature Kill Switches
 
-Your identity is defined by three files loaded into every session prompt:
+Deployment-wide feature flags in `netclaw.json` disable entire subsystems
+for all audiences. Each defaults to `true` (enabled).
 
-| File | Purpose |
-|------|---------|
-| `~/.netclaw/identity/SOUL.md` | Who you serve — name, relationships, preferences, timezone |
-| `~/.netclaw/identity/AGENTS.md` | How you operate — behavioral rules, workflow preferences |
-| `~/.netclaw/identity/TOOLING.md` | What you can do — environment, tools, MCP notes |
+| Config path | What it gates |
+|-------------|---------------|
+| `Memory.Enabled` | Recall, extraction, memory tools |
+| `Search.Enabled` | `web_search`, `web_fetch` tools |
+| `SkillSync.Enabled` | `skill_load`, `skill_read_resource`, skill index |
+| `SubAgents.Enabled` | `spawn_agent`, subagent discovery |
+| `Scheduling.Enabled` | Reminder tools, reminder execution, `ReminderManagerActor` startup |
+| `Webhooks.Enabled` | Webhook ingress and webhook tools |
+
+When a subsystem is disabled, its tools are hidden from `search_tools` for
+ALL audiences (not just Public), and direct invocation returns a generic
+denial. Context layers for disabled subsystems return empty content.
+
+The `netclaw init` wizard presents a Feature Selection step for Team and
+Public postures, allowing operators to pre-configure which subsystems are
+active. Personal posture skips this step (all features enabled by default).
+
+## Identity
 
-To edit: read the file first with `file_read`, then write with `file_write`.
-Keep entries concise and durable. Detail subdirectories exist for depth:
-`identity/soul/`, `identity/agents/`, `identity/tooling/`.
+Your identity is defined by layered files loaded into the session prompt:
+
+| Layer | Source | Audience |
+|-------|--------|----------|
+| SOUL.md | `~/.netclaw/identity/SOUL.md` (filesystem) | All |
+| AGENTS.md | Embedded in the Netclaw binary (audience-specific) | Team/Personal get full version; Public gets stripped version |
+| TOOLING.md | `~/.netclaw/identity/TOOLING.md` (filesystem) | Team/Personal only |
+| Project instructions | `.netclaw/AGENTS.md` etc. in project directory | Team/Personal only |
+
+**AGENTS.md is binary-owned.** The full AGENTS (Team/Personal) contains
+operating rules, autonomy guidance, grounding, search policy, scheduling,
+background shell, subagent delegation, skill reference, identity file paths,
+and memory triage. The Public AGENTS contains only basic operating rules,
+autonomy, grounding, and media attachment guidance — no scheduling, subagent,
+skill, identity-path, memory, search, or background-shell sections.
+
+SOUL.md and TOOLING.md remain editable on disk:
+- To edit: read the file first with `file_read`, then write with `file_write`.
+- Detail subdirectories: `identity/soul/`, `identity/tooling/`.
 
 **Identity vs memory:** If it should shape every future session → identity
 file. If it should be recalled when relevant → SQLite memory.

feeds/skills/.system/files/skill-authoring/SKILL.md

@@ -3,7 +3,7 @@ name: skill-authoring
 description: "How to create, edit, and manage Netclaw skills. Read this when you need to synthesize a new skill from a session, understand the skill file format, or use the skill_manage tool."
 metadata:
   author: netclaw
-  version: "1.6.1"
+  version: "1.7.0"
 ---
 
 # Skill Authoring
@@ -12,6 +12,19 @@ This skill documents the complete Netclaw skill format and how to create
 skills. Load it when you need to synthesize a skill from a session or help
 the user create one.
 
+## Audience and Feature Gating
+
+Skills are subject to two independent gates:
+
+- **Audience gate:** Public sessions cannot load skills (`skill_load`),
+  read skill resources (`skill_read_resource`), or see the skill index
+  context layer. Skills are fully invisible to Public.
+- **Deployment gate:** `SkillSync.Enabled` in `netclaw.json` (default `true`).
+  When `false`, skill tools are hidden from discovery for ALL audiences and
+  the skill index context layer returns empty.
+
+Both gates must pass for skill features to be available.
+
 ## When to Create a Skill
 
 Create a skill when you notice a **repeating pattern** (done 2+ times):

feeds/skills/.system/files/subagent-authoring/SKILL.md

@@ -3,13 +3,26 @@ name: subagent-authoring
 description: "How to create and troubleshoot file-defined subagents in ~/.netclaw/agents. Load when the user asks to add, edit, or debug subagent definitions, or when a skill routes via metadata.subagent."
 metadata:
   author: netclaw
-  version: "1.0.0"
+  version: "1.1.0"
 ---
 
 # Subagent Authoring
 
 Use this skill when you need to create, update, or debug subagent definitions.
 
+## Audience and Feature Gating
+
+Subagents are subject to two independent gates:
+
+- **Audience gate:** Public sessions cannot spawn subagents or see the
+  subagent discovery context layer. `spawn_agent` returns a generic denial
+  for Public.
+- **Deployment gate:** `SubAgents.Enabled` in `netclaw.json` (default `true`).
+  When `false`, `spawn_agent` is hidden from discovery for ALL audiences and
+  the subagent discovery context layer returns empty.
+
+Both gates must pass for subagent features to be available.
+
 ## When to use
 
 Load this when the user asks to:

openspec/changes/public-audience-security-hardening/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-04-26