diff --git a/ceo/HEARTBEAT.md b/ceo/HEARTBEAT.md
index 068d6e9..20384d9 100644
--- a/ceo/HEARTBEAT.md
+++ b/ceo/HEARTBEAT.md
@@ -61,6 +61,18 @@ For each agent whose files changed in the diff:
 - ALWAYS preserve `env` values that contain secrets — the repo may have redacted placeholders, do NOT overwrite live secrets with redacted values
 - For `claude_local` agents: ensure `instructionsFilePath` is always present in the merged config
 
+**Copy runtime config files to agent cwd:**
+
+After patching the API, copy any runtime config files (`opencode.json`, `.mcp.json`) from the agent's directory in this repo to their `cwd` (from `CONFIG.md` adapter config). These files must exist in the agent's working directory at runtime — the repo is not the cwd.
+
+    # For each agent with an opencode.json or .mcp.json in their repo directory:
+    AGENT_CWD=$(jq -r '.cwd' <<< "$ADAPTER_CONFIG")
+    mkdir -p "$AGENT_CWD"
+    cp /paperclip/privilegedescalation/agents/engineering/<agent>/opencode.json "$AGENT_CWD/" 2>/dev/null || true
+    cp /paperclip/privilegedescalation/agents/engineering/<agent>/.mcp.json "$AGENT_CWD/" 2>/dev/null || true
+
+This applies to all `opencode_local` agents (they need `opencode.json` in cwd for permissions and MCP config) and `claude_local` agents with `.mcp.json` (for MCP server access).
+
 **Handling new agents (placeholder IDs):**
 
 If an agent directory exists in the diff but its `CONFIG.md` contains `<AGENT_ID_PLACEHOLDER>` (or any `<..._PLACEHOLDER>` value) instead of a real UUID, this is a **new hire** that needs to be created: