┌─────────────────────────────────────────────────────────────────┐
│              OpenClaw Mobile Architecture                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌───────────────────────────────────────────────────────────┐ │
│  │                    Presentation Layer                      │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐              │ │
│  │  │   iOS    │  │ Android  │  │   Web    │              │ │
│  │  │   UI     │  │   UI     │  │  (PWA)   │              │ │
│  │  └──────────┘  └──────────┘  └──────────┘              │ │
│  └───────────────────────────────────────────────────────────┘ │
│                          ▼                                       │
│  ┌───────────────────────────────────────────────────────────┐ │
│  │                   Application Layer                        │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐              │ │
│  │  │ Agent    │  │ Workflow │  │ Context  │              │ │
│  │  │  Core    │  │  Engine  │  │ Manager  │              │ │
│  │  └──────────┘  └──────────┘  └──────────┘              │ │
│  └───────────────────────────────────────────────────────────┘ │
│                          ▼                                       │
│  ┌───────────────────────────────────────────────────────────┐ │
│  │                    Service Layer                           │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐ │ │
│  │  │  Sync    │  │  Push    │  │  Device  │  │ Offline  │ │ │
│  │  │ Service  │  │  Service │  │ Service  │  │ Service  │ │ │
│  │  └──────────┘  └──────────┘  └──────────┘  └──────────┘ │ │
│  └───────────────────────────────────────────────────────────┘ │
│                          ▼                                       │
│  ┌───────────────────────────────────────────────────────────┐ │
│  │                     Data Layer                             │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐              │ │
│  │  │  Local   │  │  Secure  │  │  Cache   │              │ │
│  │  │  Store   │  │  Enclave │  │  Layer   │              │ │
│  │  └──────────┘  └──────────┘  └──────────┘              │ │
│  └───────────────────────────────────────────────────────────┘ │
│                          ▼                                       │
│  ┌───────────────────────────────────────────────────────────┐ │
│  │                 Network Layer                              │ │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐              │ │
│  │  │   API    │  │WebSocket │  │   BLE    │              │ │
│  │  │  Client  │  │  Client  │  │   Hub    │              │ │
│  │  └──────────┘  └──────────┘  └──────────┘              │ │
│  └───────────────────────────────────────────────────────────┘ │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

# OpenClaw Agent Configuration - Field Service Agent
name: "field-service-technician-agent"
description: "AI agent assisting field service technicians with maintenance and repairs"
version: "1.0.0"

triggers:
  - type: "geofence"
    config:
      locations: "{{work_order.sites}}"
      radius: 100  # meters
      action: "arrival_sequence"
  
  - type: "scheduled"
    cron: "0 8 * * *"  # Daily at 8 AM
    action: "daily_briefing"
  
  - type: "webhook"
    endpoint: "/emergency-dispatch"
    action: "emergency_response"

context_sensors:
  - type: "gps"
    permissions: ["location_precise"]
    enabled: true
  
  - type: "camera"
    permissions: ["camera"]
    enabled: true
  
  - type: "accelerometer"
    permissions: ["motion"]
    enabled: true

integrations:
  - name: "erp_system"
    type: "n8n_workflow"
    workflow_id: "erp-data-retrieval"
  
  - name: "asset_management"
    type: "n8n_workflow"
    workflow_id: "asset-history-lookup"
  
  - name: "procurement"
    type: "n8n_workflow"
    workflow_id: "parts-requisition"
  
  - name: "computer_vision"
    type: "ml_service"
    model: "equipment-damage-detection-v2"

agent_behavior:
  arrival_sequence:
    steps:
      - action: "check_in"
        params:
          method: "geofence"
          require_photo: true
      
      - action: "fetch_context"
        params:
          tower_id: "{{work_order.tower_id}}"
          data_sources: ["maintenance_history", "equipment_specs", "weather"]
      
      - action: "generate_checklist"
        params:
          template: "tower_inspection"
          prioritize_by: ["safety", "urgency", "estimated_time"]
      
      - action: "notify_user"
        title: "Arrival Confirmed"
        message: "Inspection checklist ready for {{tower_id}}"
        actions: ["view_checklist", "get_ar_guidance", "emergency_contact"]
  
  inspection_guidance:
    steps:
      - action: "activate_ar"
        params:
          mode: "equipment_overlay"
          highlight: "{{current_checklist_item.target_equipment}}"
      
      - action: "capture_image"
        params:
          guidance: "Center equipment in frame, ensure lighting is adequate"
          validate: true
          auto_submit: false
      
      - action: "analyze_image"
        service: "computer_vision"
        params:
          detect: ["corrosion", "wear", "damage", "loose_connections"]
          confidence_threshold: 0.75
      
      - action: "recommend_action"
        based_on: ["image_analysis", "historical_data", "manufacturer_guidelines"]
        options: ["proceed", "repair_now", "defer", "escalate"]
  
  procurement_trigger:
    condition: "repair_required && parts_needed"
    steps:
      - action: "identify_parts"
        params:
          from_analysis: "{{image_analysis.result}}"
          equipment_model: "{{equipment.specs.model}}"
      
      - action: "check_inventory"
        params:
          parts: "{{identified_parts}}"
          location: "{{technician.vehicle_stock}}"
      
      - action: "conditional_order"
        if: "parts_not_in_stock"
        workflow: "procurement"
        params:
          parts: "{{missing_parts}}"
          priority: "{{work_order.priority}}"
          delivery_location: "{{work_order.site_address}}"
      
      - action: "schedule_return"
        if: "parts_ordered"
        params:
          based_on: "estimated_delivery"
          technician_availability: "{{calendar.check}}"

notifications:
  channels:
    - type: "push"
      enabled: true
      priority: "high"
    - type: "sms"
      enabled: true
      for: ["emergency", "safety_alert"]
  
  templates:
    arrival_confirmation:
      title: "📍 Arrival Confirmed"
      body: "Ready for {{tower_id}} inspection. {{item_count}} items on checklist."
      actions: ["view", "dismiss"]
    
    damage_detected:
      title: "⚠️ Equipment Issue Detected"
      body: "{{issue_type}} detected with {{confidence}}% confidence. Review recommended."
      actions: ["view_analysis", "proceed_anyway", "escalate"]
    
    parts_ordered:
      title: "📦 Parts Ordered"
      body: "{{part_count}} parts ordered. Estimated arrival: {{delivery_date}}."
      actions: ["track_order", "reschedule_visit"]

offline_behavior:
  enabled: true
  queue_max_size: 500
  sync_strategy: "immediate_when_connected"
  conflict_resolution: "server_wins_with_notification"

{
  "name": "Geofence Workflow",
  "nodes": [
    {
      "parameters": {
        "event": "geofence_enter",
        "options": {
          "locations": [
            {"lat": 40.7128, "lng": -74.0060, "radius": 100, "name": "HQ"},
            {"lat": 40.7589, "lng": -73.9851, "radius": 150, "name": "ClientSite"}
          ]
        }
      },
      "name": "Geofence Trigger",
      "type": "n8n-nodes-base.openclawTrigger",
      "typeVersion": 1,
      "position": [250, 300]
    },
    {
      "parameters": {
        "jsCode": "// Extract location context\nconst location = $input.first().json.location;\nconst user = $input.first().json.user;\n\n// Determine which geofence was triggered\nconst triggeredLocation = location.name;\nconst timestamp = new Date().toISOString();\n\nreturn [\n  {\n    json: {\n      location: triggeredLocation,\n      userId: user.id,\n      timestamp: timestamp,\n      action: 'arrival_checkin'\n    }\n  }\n];"
      },
      "name": "Process Location",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [450, 300]
    },
    {
      "parameters": {
        "operation": "create",
        "table": "checkins",
        "data": {
          "user_id": "={{ $json.userId }}",
          "location": "={{ $json.location }}",
          "timestamp": "={{ $json.timestamp }}",
          "source": "mobile_geofence"
        }
      },
      "name": "Log Check-in",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [650, 300]
    }
  ],
  "connections": {
    "Geofence Trigger": {
      "main": [[{"node": "Process Location", "type": "main", "index": 0}]]
    },
    "Process Location": {
      "main": [[{"node": "Log Check-in", "type": "main", "index": 0}]]
    }
  }
}

{
  "name": "Approval Workflow",
  "nodes": [
    {
      "parameters": {
        "event": "push_notification_action",
        "options": {
          "notificationId": "={{ $pushNotification.id }}",
          "actions": ["approve", "reject", "request_info"]
        }
      },
      "name": "Push Action Trigger",
      "type": "n8n-nodes-base.openclawTrigger",
      "typeVersion": 1,
      "position": [250, 300]
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": "={{ $json.action }}",
            "operator": {
              "type": "string",
              "operation": "equals"
            },
            "rightValue": "approve"
          }
        }
      },
      "name": "Is Approved?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [450, 300]
    },
    {
      "parameters": {
        "operation": "update",
        "table": "approvals",
        "id": "={{ $json.requestId }}",
        "data": {
          "status": "approved",
          "approved_by": "={{ $json.user.id }}",
          "approved_at": "={{ $now }}"
        }
      },
      "name": "Update Approval",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [650, 200]
    },
    {
      "parameters": {
        "operation": "execute",
        "procedure": "process_approved_request",
        "parameters": [
          {"name": "request_id", "value": "={{ $json.requestId }}"}
        ]
      },
      "name": "Process Approved",
      "type": "n8n-nodes-base.postgres",
      "typeVersion": 2,
      "position": [850, 200]
    }
  ],
  "connections": {
    "Push Action Trigger": {
      "main": [[{"node": "Is Approved?", "type": "main", "index": 0}]]
    },
    "Is Approved?": {
      "main": [
        [{"node": "Update Approval", "type": "main", "index": 0}],
        []  // Reject path omitted for brevity
      ]
    },
    "Update Approval": {
      "main": [[{"node": "Process Approved", "type": "main", "index": 0}]]
    }
  }
}

{
  "name": "Document Processing Workflow",
  "nodes": [
    {
      "parameters": {
        "event": "image_captured",
        "options": {
          "source": "camera",
          "autoProcess": true,
          "documentTypes": ["receipt", "invoice", "contract", "id_document"]
        }
      },
      "name": "Image Capture Trigger",
      "type": "n8n-nodes-base.openclawTrigger",
      "typeVersion": 1,
      "position": [250, 300]
    },
    {
      "parameters": {
        "operation": "analyze",
        "model": "gpt-4-vision",
        "prompt": "Extract all text from this document. Identify document type, key fields (dates, amounts, names, reference numbers), and any flagged items requiring attention.",
        "images": [
          {"binaryPropertyName": "data", "detail": "high"}
        ]
      },
      "name": "Vision Analysis",
      "type": "n8n-nodes-base.openAI",
      "typeVersion": 1,
      "position": [450, 300]
    },
    {
      "parameters": {
        "jsCode": "const analysis = $input.first().json;\nconst documentType = analysis.document_type;\n\n// Route based on document type\nconst routes = {\n  receipt: 'expense_processing',\n  invoice: 'accounts_payable',\n  contract: 'legal_review',\n  id_document: 'identity_verification'\n};\n\nreturn [{\n  json: {\n    ...analysis,\n    route: routes[documentType] || 'manual_review',\n    priority: analysis.flagged_items?.length > 0 ? 'high' : 'normal'\n  }\n}];"
      },
      "name": "Route Document",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [650, 300]
    }
  ],
  "connections": {
    "Image Capture Trigger": {
      "main": [[{"node": "Vision Analysis", "type": "main", "index": 0}]]
    },
    "Vision Analysis": {
      "main": [[{"node": "Route Document", "type": "main", "index": 0}]]
    }
  }
}

// n8n Function node for offline queue handling
export function processWithOfflineSupport() {
  const items = $input.all();
  const results = [];
  
  for (const item of items) {
    const operation = item.json;
    
    // Check if we're in offline mode
    const isOffline = $execution.metadata.offlineMode || false;
    
    if (isOffline) {
      // Queue for later processing
      results.push({
        json: {
          status: 'queued',
          operation: operation,
          queuedAt: new Date().toISOString(),
          syncId: generateSyncId(),
          message: 'Operation queued for sync when connectivity returns'
        }
      });
    } else {
      // Process immediately
      try {
        const result = processOperation(operation);
        results.push({
          json: {
            status: 'completed',
            result: result,
            processedAt: new Date().toISOString()
          }
        });
      } catch (error) {
        results.push({
          json: {
            status: 'failed',
            error: error.message,
            retryable: isRetryableError(error)
          }
        });
      }
    }
  }
  
  return results;
}

function generateSyncId() {
  return `sync_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
}

function isRetryableError(error: Error) {
  const retryableCodes = ['ECONNRESET', 'ETIMEDOUT', 'EPIPE', 'ENOTFOUND'];
  return retryableCodes.some(code => error.message.includes(code));
}

function processOperation(operation: any) {
  // Actual processing logic
  return { processed: true, operationId: operation.id };
}

// Adapt processing intensity based on device battery level
export function batteryAwareProcessing() {
  const items = $input.all();
  const batteryLevel = $execution.metadata.deviceBattery || 100;
  const isCharging = $execution.metadata.isCharging || false;
  
  // Adjust processing strategy based on battery
  let processingStrategy: 'full' | 'reduced' | 'minimal' = 'full';
  
  if (isCharging) {
    processingStrategy = 'full';
  } else if (batteryLevel < 20) {
    processingStrategy = 'minimal';
  } else if (batteryLevel < 50) {
    processingStrategy = 'reduced';
  }
  
  const results = items.map(item => {
    const data = item.json;
    
    switch (processingStrategy) {
      case 'full':
        return processFull(data);
      case 'reduced':
        return processReduced(data);
      case 'minimal':
        return processMinimal(data);
      default:
        return processFull(data);
    }
  });
  
  return results;
}

function processFull(data: any) {
  // Complete processing with all validations and enhancements
  return {
    json: {
      ...data,
      processed: true,
      quality: 'high',
      validations: runAllValidations(data),
      enrichments: runAllEnrichments(data)
    }
  };
}

function processReduced(data: any) {
  // Skip non-essential validations and enrichments
  return {
    json: {
      ...data,
      processed: true,
      quality: 'medium',
      validations: runCriticalValidations(data),
      enrichments: [] // Skip enrichments
    }
  };
}

function processMinimal(data: any) {
  // Minimal processing, queue rest for later
  return {
    json: {
      ...data,
      processed: 'partial',
      quality: 'low',
      deferredOperations: ['enrichment', 'full_validation'],
      message: 'Processing deferred due to low battery'
    }
  };
}

function runAllValidations(data: any) {
  return ['format', 'schema', 'business_rules', 'duplicate_check'];
}

function runCriticalValidations(data: any) {
  return ['format', 'schema'];
}

function runAllEnrichments(data: any) {
  return ['lookup', 'calculation', 'classification'];
}

{
  "name": "Mobile Push",
  "type": "n8n-nodes-base.openclawMobilePush",
  "typeVersion": 1,
  "position": [650, 300],
  "parameters": {
    "recipientType": "user",
    "recipients": ["={{ $json.userId }}"],
    "notification": {
      "title": "={{ $json.notificationTitle }}",
      "body": "={{ $json.notificationBody }}",
      "icon": "https://company.com/icons/workflow.png",
      "badge": "={{ $json.pendingCount }}",
      "sound": "default",
      "priority": "={{ $json.priority || 'normal' }}"
    },
    "actions": [
      {
        "id": "approve",
        "title": "Approve",
        "destructive": false,
        "foreground": true
      },
      {
        "id": "reject",
        "title": "Reject",
        "destructive": true,
        "foreground": true
      },
      {
        "id": "view",
        "title": "View Details",
        "destructive": false,
        "foreground": true
      }
    ],
    "data": {
      "workflowId": "={{ $workflow.id }}",
      "executionId": "={{ $execution.id }}",
      "context": "={{ JSON.stringify($json) }}"
    },
    "delivery": {
      "expiration": 86400,
      "collapseKey": "approvals",
      "requireInteraction": "={{ $json.priority === 'high' }}"
    }
  }
}

{
  "name": "Get Location",
  "type": "n8n-nodes-base.openclawGeolocation",
  "typeVersion": 1,
  "position": [450, 300],
  "parameters": {
    "operation": "get_current",
    "options": {
      "accuracy": "high",
      "timeout": 30000,
      "includeHeading": true,
      "includeSpeed": true
    }
  }
}

{
  "name": "Capture Document",
  "type": "n8n-nodes-base.openclawCamera",
  "typeVersion": 1,
  "position": [450, 300],
  "parameters": {
    "operation": "capture",
    "source": "camera",
    "options": {
      "documentType": "receipt",
      "autoCapture": true,
      "guidance": "Center receipt in frame",
      "quality": "high",
      "postProcessing": {
        "deskew": true,
        "enhance": true,
        "ocr": true
      }
    }
  }
}

{
  "name": "Require Biometric Auth",
  "type": "n8n-nodes-base.openclawBiometric",
  "typeVersion": 1,
  "position": [450, 300],
  "parameters": {
    "operation": "authenticate",
    "reason": "Approve high-value transaction",
    "fallbackAllowed": false,
    "storeResult": true,
    "resultValidityMinutes": 5
  }
}

# OpenClaw Mobile Security Configuration
security:
  zero_trust:
    enabled: true
    principles:
      - "verify_explicitly"
      - "least_privilege_access"
      - "assume_breach"
  
  authentication:
    primary:
      type: "biometric"
      methods: ["face_id", "touch_id", "fingerprint"]
      required: true
    
    secondary:
      type: "pin"
      length: 6
      attempts_before_lockout: 5
      lockout_duration_minutes: 30
    
    step_up:
      triggers:
        - "high_value_operation"
        - "sensitive_data_access"
        - "privileged_action"
      methods: ["biometric_reverify", "hardware_key"]
    
    session:
      max_duration_minutes: 240
      idle_timeout_minutes: 15
      require_reauth_for: ["password_change", "api_key_view", "security_settings"]
  
  device_attestation:
    enabled: true
    checks:
      - "not_rooted"
      - "not_jailbroken"
      - "integrity_verified"
      - "secure_boot_enabled"
      - "os_version_supported"
    
    failure_action: "block_access"
    
  network_security:
    certificate_pinning: true
    allowed_protocols: ["TLS1.3"]
    cipher_suites: [
      "TLS_AES_256_GCM_SHA384",
      "TLS_CHACHA20_POLY1305_SHA256"
    ]
    
    require_vpn:
      for: ["admin_access", "sensitive_operations"]
      enforcement: "strict"
    
  data_protection:
    encryption:
      at_rest:
        algorithm: "AES-256-GCM"
        key_management: "secure_enclave"
      
      in_transit:
        protocol: "TLS1.3"
        certificate_pinning: true
    
    data_classification:
      levels:
        - "public"
        - "internal"
        - "confidential"
        - "restricted"
      
      mobile_policies:
        restricted:
          allowed_on_device: false
          requires_approval: true
          audit_level: "comprehensive"
        
        confidential:
          allowed_on_device: true
          max_cache_hours: 24
          requires_encryption: true
          remote_wipe_enabled: true
  
  runtime_protection:
    jailbreak_detection: true
    debugger_detection: true
    emulator_detection: true
    screenshot_prevention: true
    screen_recording_detection: true
    
    tamper_response: "terminate_and_alert"

// Mobile-optimized JWT with device binding
interface MobileAgentToken {
  // Standard JWT claims
  sub: string;           // User ID
  iat: number;           // Issued at
  exp: number;           // Expiration
  
  // Mobile-specific claims
  device_id: string;     // Bound to specific device
  attestation: string;   // Device attestation result
  biometric_verified: boolean;  // Biometric verification status
  network_type: string;  // wifi, cellular, vpn
  location_context?: {   // Approximate location for anomaly detection
    country: string;
    region: string;
  };
  
  // Security claims
  mfa_verified: boolean;
  risk_score: number;    // 0-100, calculated risk
  session_id: string;
}

// Token validation for mobile agents
async function validateMobileToken(
  token: string,
  deviceContext: DeviceContext
): Promise<TokenValidationResult> {
  const decoded = jwt.verify(token, process.env.JWT_SECRET) as MobileAgentToken;
  
  // Device binding check
  if (decoded.device_id !== deviceContext.deviceId) {
    return { valid: false, reason: 'device_mismatch' };
  }
  
  // Risk score threshold
  if (decoded.risk_score > 75) {
    return { valid: false, reason: 'elevated_risk', requires_step_up: true };
  }
  
  // Network context validation
  if (decoded.network_type === 'vpn' && !deviceContext.onVpn) {
    return { valid: false, reason: 'network_context_changed' };
  }
  
  // Location anomaly detection
  if (decoded.location_context) {
    const currentLocation = await getCurrentLocation(deviceContext);
    const distance = calculateDistance(decoded.location_context, currentLocation);
    if (distance > 500) { // 500km threshold
      return { valid: false, reason: 'location_anomaly' };
    }
  }
  
  return { valid: true, claims: decoded };
}

// Adaptive rate limiting based on mobile context
interface RateLimitConfig {
  // Base limits
  default: {
    requestsPerMinute: number;
    burstAllowance: number;
  };
  
  // Adjusted for mobile context
  mobileAdjustments: {
    onCellular: {
      multiplier: 0.8;  // Slightly more restrictive on cellular
    };
    onWifi: {
      multiplier: 1.0;  // Standard limits on WiFi
    };
    onVpn: {
      multiplier: 1.2;  // Slightly more permissive on VPN
    };
  };
  
  // Battery-aware adjustments
  batteryLevel: {
    critical: {  // < 10%
      multiplier: 0.5;  // Reduce to prevent battery drain
    };
    low: {       // < 20%
      multiplier: 0.8;
    };
    normal: {
      multiplier: 1.0;
    };
  };
}

function calculateRateLimit(
  config: RateLimitConfig,
  context: MobileContext
): number {
  let limit = config.default.requestsPerMinute;
  
  // Network adjustment
  const networkMultiplier = config.mobileAdjustments[
    `on${context.networkType.charAt(0).toUpperCase() + context.networkType.slice(1)}`
  ]?.multiplier || 1.0;
  limit *= networkMultiplier;
  
  // Battery adjustment
  let batteryLevel = 'normal';
  if (context.batteryLevel < 10) batteryLevel = 'critical';
  else if (context.batteryLevel < 20) batteryLevel = 'low';
  limit *= config.batteryLevel[batteryLevel].multiplier;
  
  return Math.floor(limit);
}

// Secure storage implementation for mobile agents
class SecureMobileStorage {
  private encryptionKey: CryptoKey;
  private storage: Storage;
  
  constructor() {
    this.storage = window.localStorage; // or secure native storage
  }
  
  async initialize(): Promise<void> {
    // Derive key from device secure enclave
    this.encryptionKey = await this.deriveKeyFromSecureEnclave();
  }
  
  async set<T>(key: string, value: T, options?: StorageOptions): Promise<void> {
    const serialized = JSON.stringify(value);
    const encrypted = await this.encrypt(serialized);
    
    const metadata: StorageMetadata = {
      encrypted: true,
      algorithm: 'AES-256-GCM',
      timestamp: Date.now(),
      ttl: options?.ttlHours ? Date.now() + (options.ttlHours * 3600000) : undefined,
      classification: options?.classification || 'internal'
    };
    
    const storageEntry: StorageEntry = {
      data: encrypted,
      metadata: metadata
    };
    
    this.storage.setItem(key, JSON.stringify(storageEntry));
  }
  
  async get<T>(key: string): Promise<T | null> {
    const stored = this.storage.getItem(key);
    if (!stored) return null;
    
    const entry: StorageEntry = JSON.parse(stored);
    
    // Check TTL
    if (entry.metadata.ttl && Date.now() > entry.metadata.ttl) {
      this.storage.removeItem(key);
      return null;
    }
    
    // Decrypt
    const decrypted = await this.decrypt(entry.data);
    return JSON.parse(decrypted) as T;
  }
  
  async remove(key: string): Promise<void> {
    // Secure deletion - overwrite before removing
    const stored = this.storage.getItem(key);
    if (stored) {
      const overwritten = '0'.repeat(stored.length);
      this.storage.setItem(key, overwritten);
    }
    this.storage.removeItem(key);
  }
  
  async clearClassification(classification: DataClassification): Promise<void> {
    const keysToRemove: string[] = [];
    
    for (let i = 0; i < this.storage.length; i++) {
      const key = this.storage.key(i);
      if (key) {
        const stored = this.storage.getItem(key);
        if (stored) {
          const entry: StorageEntry = JSON.parse(stored);
          if (entry.metadata.classification === classification) {
            keysToRemove.push(key);
          }
        }
      }
    }
    
    for (const key of keysToRemove) {
      await this.remove(key);
    }
  }
  
  private async deriveKeyFromSecureEnclave(): Promise<CryptoKey> {
    // Use device secure enclave or hardware security module
    // This is platform-specific and would use native modules
    const keyMaterial = await window.crypto.subtle.digest(
      'SHA-256',
      new TextEncoder().encode('device-bound-key-material')
    );
    
    return window.crypto.subtle.importKey(
      'raw',
      keyMaterial,
      { name: 'AES-GCM', length: 256 },
      false,
      ['encrypt', 'decrypt']
    );
  }
  
  private async encrypt(plaintext: string): Promise<string> {
    const iv = window.crypto.getRandomValues(new Uint8Array(12));
    const encoded = new TextEncoder().encode(plaintext);
    
    const ciphertext = await window.crypto.subtle.encrypt(
      { name: 'AES-GCM', iv },
      this.encryptionKey,
      encoded
    );
    
    // Combine IV and ciphertext
    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
    combined.set(iv);
    combined.set(new Uint8Array(ciphertext), iv.length);
    
    return btoa(String.fromCharCode(...combined));
  }
  
  private async decrypt(ciphertext: string): Promise<string> {
    const combined = Uint8Array.from(atob(ciphertext), c => c.charCodeAt(0));
    const iv = combined.slice(0, 12);
    const encrypted = combined.slice(12);
    
    const decrypted = await window.crypto.subtle.decrypt(
      { name: 'AES-GCM', iv },
      this.encryptionKey,
      encrypted
    );
    
    return new TextDecoder().decode(decrypted);
  }
}

# Mobile agent incident response configuration
incident_response:
  triggers:
    - name: "device_reported_lost"
      actions: ["revoke_sessions", "wipe_sensitive_data", "suspend_agent"]
      
    - name: "suspicious_activity_detected"
      actions: ["require_reauthentication", "step_up_auth", "alert_security_team"]
      
    - name: "jailbreak_detected"
      actions: ["block_access", "revoke_tokens", "notify_admin"]
      
    - name: "policy_violation"
      actions: ["log_violation", "restrict_functionality", "escalate_if_repeated"]
  
  remote_commands:
    wipe_data:
      classification_levels: ["confidential", "restricted"]
      confirmation_required: true
      preserve_logs: true
      
    revoke_access:
      scope: ["all_sessions", "api_tokens", "push_notifications"]
      immediate: true
      
    lock_device:
      message: "Access suspended. Contact IT security."
      allow_emergency_calls: true
      
    trace_location:
      requires_authorization: "security_admin"
      accuracy: "approximate"  # Privacy-preserving
      
  audit_logging:
    events:
      - "device_registration"
      - "authentication_attempt"
      - "agent_execution"
      - "data_access"
      - "configuration_change"
      - "incident_triggered"
      - "remote_command_issued"
    
    retention_days: 365
    tamper_protection: true

deployment_phase: "foundation"
duration_weeks: 4
activities:
  infrastructure:
    - "Deploy OpenClaw server infrastructure"
    - "Configure mobile relay services"
    - "Establish VPN connectivity for remote access"
    - "Set up monitoring and logging"
  
  security:
    - "Implement certificate pinning"
    - "Configure device attestation"
    - "Establish mobile token service"
    - "Create incident response runbooks"
  
  integration:
    - "Connect to identity provider"
    - "Configure n8n mobile nodes"
    - "Establish data synchronization patterns"
    - "Test offline capabilities"
  
  pilot:
    - "Select pilot user group (20-50 users)"
    - "Deploy to test devices"
    - "Collect feedback and issues"
    - "Iterate on configuration"

target_users: 50
success_criteria:
  - "App successfully installed on all pilot devices"
  - "Basic agent functionality verified"
  - "Security controls passing penetration tests"
  - "User satisfaction > 4.0/5.0"

deployment_phase: "departmental"
duration_weeks: 8
sequence:
  - department: "field_operations"
    week: 5
    users: 200
    use_cases: ["inspections", "maintenance", "inventory"]
    
  - department: "sales"
    week: 7
    users: 150
    use_cases: ["prospect_management", "contract_approval", "reporting"]
    
  - department: "executive"
    week: 9
    users: 25
    use_cases: ["approvals", "reporting", "decision_support"]
    
  - department: "customer_support"
    week: 11
    users: 100
    use_cases: ["ticket_management", "escalation", "knowledge_access"]

support_structure:
  - tier: 1
    capacity: "24/7 chat and phone"
    scope: "basic_usage_issues"
    
  - tier: 2
    capacity: "business_hours"
    scope: "technical_issues_escalation"
    
  - tier: 3
    capacity: "on_call"
    scope: "critical_incidents"

target_users: 475
success_criteria:
  - "Daily active users > 80% of deployed users"
  - "Workflow execution success rate > 95%"
  - "Support ticket volume < 5% of users per week"
  - "Security incidents: 0"

deployment_phase: "enterprise"
duration_weeks: 12
activities:
  scaling:
    - "Expand to all remaining departments"
    - "Deploy to international offices"
    - "Scale infrastructure for peak loads"
    - "Optimize performance based on usage patterns"
  
  advanced_features:
    - "Enable offline mode for remote workers"
    - "Deploy custom agent templates"
    - "Integrate with line-of-business apps"
    - "Implement advanced analytics"
  
  optimization:
    - "Tune workflow performance"
    - "Optimize battery usage"
    - "Reduce data transfer costs"
    - "Improve sync efficiency"
  
  governance:
    - "Establish mobile AI governance committee"
    - "Create agent approval workflows"
    - "Implement cost controls"
    - "Define data retention policies"

target_users: 2000
success_criteria:
  - "Monthly active users > 90% of total users"
  - "Average workflow latency < 2 seconds"
  - "App store rating > 4.5"
  - "Cost per workflow execution reduced by 30%"

byod_policy:
  enrollment:
    type: "voluntary"
    incentive: "mobile_productivity_bonus"
    
  containerization:
    enabled: true
    type: "work_profile"  # Android or iOS equivalent
    separation: "complete"
    
  security_requirements:
    min_os_version:
      ios: "16.0"
      android: "13"
    
    required_security:
      - "screen_lock"
      - "encryption_enabled"
      - "not_rooted"
      - "antivirus_installed"
    
    monitoring:
      compliance_checks: "weekly"
      non_compliance_action: "suspend_access"
      
  data_handling:
    work_data:
      encryption: "required"
      backup: "corporate_only"
      sharing: "restricted"
      
    personal_data:
      access: "none"  # Work profile cannot access personal
      
  liability:
    device_loss: "user_responsible"
    data_breach: "investigation_based"
    support: "best_effort"

corporate_device_policy:
  provisioning:
    type: "supervised"  # Full MDM control
    enrollment: "mandatory"
    
  device_configuration:
    restrictions:
      - "app_store_restricted"
      - "icloud_backup_disabled"
      - "personal_email_blocked"
      - "camera_configurable"
    
    required_apps:
      - "openclaw_mobile"
      - "vpn_client"
      - "security_agent"
      
  security:
    encryption: "enforced"
    biometric: "required"
    updates: "automatic"
    remote_wipe: "enabled"
    
  support:
    model: "full_service"
    replacement: "24_hour"
    
  cost:
    device: "company_paid"
    data_plan: "company_paid"
    liability: "company_assumed"

hybrid_deployment:
  corporate_devices:
    - role: "executives"
      device: "iphone_15_pro"
      justification: "security_critical"
      
    - role: "field_technicians"
      device: "ruggedized_android"
      justification: "durability_requirements"
      
    - role: "healthcare_workers"
      device: "medical_grade_tablet"
      justification: "compliance_requirements"
  
  byod_allowed:
    - role: "sales"
      justification: "preference_flexibility"
      
    - role: "customer_support"
      justification: "work_from_home"
      
    - role: "general_staff"
      justification: "cost_efficiency"
  
  management:
    unified_dashboard: true
    policy_enforcement: "adaptive_by_ownership"
    support_tiers:
      corporate: "priority"
      byod: "standard"

agent:
  name: "quality_inspector_assistant"
  
  triggers:
    - type: "camera_capture"
      config:
        auto_trigger: false
        manual_activation: true
        
    - type: "barcode_scan"
      config:
        product_lookup: true
        batch_association: true
  
  vision_pipeline:
    - step: "capture"
      guidance: "Center defect in frame, ensure adequate lighting"
      
    - step: "analyze"
      model: "defect_detection_v3"
      detect:
        - "surface_scratches"
        - "dimensional_variance"
        - "color_deviation"
        - "contamination"
      confidence_threshold: 0.85
      
    - step: "classify"
      categories:
        - "critical"
        - "major"
        - "minor"
        - "cosmetic"
      
    - step: "recommend"
      actions:
        critical: "immediate_halt"
        major: "quarantine_batch"
        minor: "document_continue"
        cosmetic: "log_only"
  
  integrations:
    - system: "qms"
      workflow: "n8n-defect-reporting"
      
    - system: "erp"
      workflow: "n8n-batch-hold"
      
    - system: "maintenance"
      workflow: "n8n-equipment-alert"
  
  offline_behavior:
    enabled: true
    queue_limit: 100_inspections
    auto_sync: "when_connected"

agent:
  name: "sales_enablement_companion"
  
  knowledge_base:
    sources:
      - "approved_product_content"
      - "clinical_studies_database"
      - "competitive_intelligence"
      - "regulatory_guidelines"
      - "pricing_matrices"
    
    update_frequency: "daily"
    compliance_review: "mandatory"
  
  interaction_modes:
    - mode: "voice_first"
      trigger_word: "Hey OpenClaw"
      
    - mode: "chat"
      interface: "mobile_app"
      
    - mode: "contextual"
      trigger: "calendar_event"
  
  capabilities:
    - name: "product_qa"
      description: "Answer questions about products, indications, dosing"
      
    - name: "competitive_response"
      description: "Provide competitive differentiation points"
      
    - name: "meeting_prep"
      description: "Prepare briefing for upcoming customer meetings"
      
    - name: "documentation"
      description: "Capture call notes and outcomes"
      
    - name: "compliance_check"
      description: "Verify content meets regulatory requirements"
  
  integrations:
    - system: "salesforce"
      sync: "bidirectional"
      
    - system: "veeva"
      purpose: "compliance_verification"
      
    - system: "concur"
      purpose: "expense_automation"
  
  guardrails:
    - "only_approved_content"
    - "no_off_label_discussion"
    - "audit_all_interactions"
    - "require_disclaimer_when_appropriate"