diff --git a/ceo/TOOLS.md b/ceo/TOOLS.md
index 85a14f7..70732fb 100644
--- a/ceo/TOOLS.md
+++ b/ceo/TOOLS.md
@@ -1,10 +1,32 @@
 # Countess von Containerheim — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (Paperclip API, Paperclip skill)
-- `gh` — GitHub CLI (pull repo, read diffs)
-- `git` — Check repo history, pull latest changes, diff commits
-- `cat` — Read files (CONFIG.md, AGENTS.md, SOUL.md, HEARTBEAT.md)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — issues, PRs, CI runs, repo management |
+| `git` | Version control — pull latest, check history, diff commits |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
+
+## Repos
+
+| Repo | Owner | Purpose |
+|---|---|---|
+| `privilegedescalation/agents` | Board | Agent profiles and configuration (this repo) |
+| `privilegedescalation/headlamp-*` | Gandalf | Headlamp plugin repos |
diff --git a/cmo/TOOLS.md b/cmo/TOOLS.md
index d933c75..d72ad25 100644
--- a/cmo/TOOLS.md
+++ b/cmo/TOOLS.md
@@ -1,8 +1,25 @@
 # Addison Addington — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — issues, PRs, content repos |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
diff --git a/cto/TOOLS.md b/cto/TOOLS.md
index a952333..dde3bd7 100644
--- a/cto/TOOLS.md
+++ b/cto/TOOLS.md
@@ -1,8 +1,32 @@
 # Null Pointer Nancy — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — PRs, issues, CI runs, repo operations |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
+
+## Repos
+
+| Repo | Owner | Purpose |
+|---|---|---|
+| `privilegedescalation/agents` | Board | Agent profiles and configuration (this repo) |
+| `privilegedescalation/headlamp-*` | Gandalf | Headlamp plugin repos |
diff --git a/engineering/gandalf/TOOLS.md b/engineering/gandalf/TOOLS.md
index 5347740..0d92e30 100644
--- a/engineering/gandalf/TOOLS.md
+++ b/engineering/gandalf/TOOLS.md
@@ -1,8 +1,27 @@
 # Gandalf the Greybeard — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — PRs, issues, CI runs, repo operations |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `node` / `npm` / `pnpm` / `npx` | Node.js runtime and package management |
+| `python3` | Python scripting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
diff --git a/engineering/hugh/TOOLS.md b/engineering/hugh/TOOLS.md
index f013aeb..60548d0 100644
--- a/engineering/hugh/TOOLS.md
+++ b/engineering/hugh/TOOLS.md
@@ -1,20 +1,29 @@
 # Hugh Hackman — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — PRs, issues, CI runs, repo operations |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `node` / `npm` / `pnpm` / `npx` | Node.js runtime and package management |
+| `python3` | Python scripting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
 
-## Gemini Workspace Restrictions
-
-The `gemini_local` adapter sandboxes Gemini's built-in file tools (`grep_search`, `read_file`, etc.) to the workspace directory. Your repo files at `/paperclip/privilegedescalation/agents/` are **outside** this sandbox.
-
-**Do NOT use Gemini's native file tools to access the repo.** They will fail with "Path not in workspace."
-
-Instead, use `bash` wrappers:
-
-- `cat`, `grep`, `find`, `ls` — for reading/searching files
-- `gh` — for GitHub operations
-- `curl` — for API calls
+> **Not installed:** `docker`, `kubectl`, `flux`. Infrastructure work requiring these must go through GitHub Actions CI/CD or request board intervention for pod-level installs.
diff --git a/engineering/regina/TOOLS.md b/engineering/regina/TOOLS.md
index a5a213c..d5ae2dc 100644
--- a/engineering/regina/TOOLS.md
+++ b/engineering/regina/TOOLS.md
@@ -1,9 +1,31 @@
 # Regression Regina — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill)
-- `npm test` / `npm run tsc` — Run test suites and type checking
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — PRs, issues, CI runs, repo operations |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, external services |
+| `jq` | JSON parsing and formatting |
+| `node` / `npm` / `pnpm` / `npx` | Node.js runtime and package management |
+| `python3` | Python scripting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |
+
+## Adapter Notes
+
+Regina uses the `opencode_local` adapter (MiniMax M2.5 via OpenRouter). This adapter does not support `instructionsFilePath` — the prompt must live in the `promptTemplate` field of the adapter config in the Paperclip DB. To update Regina's prompt, concatenate SOUL.md + HEARTBEAT.md and patch the DB `promptTemplate` field. See CONFIG.md for details.
diff --git a/marketing/samuel/TOOLS.md b/marketing/samuel/TOOLS.md
index aa2b17b..687b79f 100644
--- a/marketing/samuel/TOOLS.md
+++ b/marketing/samuel/TOOLS.md
@@ -1,9 +1,26 @@
 # Samuel Stinkpost — Tools
 
+## GitHub Authentication
+
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)
+
+Run this at the start of every heartbeat. Sets `GH_TOKEN` for `gh` and `git`.
+
+## Paperclip API
+
+Auto-injected env vars:
+
+- `PAPERCLIP_API_URL` — base URL
+- `PAPERCLIP_API_KEY` — short-lived JWT for this run
+- `PAPERCLIP_RUN_ID` — include on all mutating requests
+
 ## Available Tools
 
-- `gh` — GitHub CLI (repos, PRs, issues, actions)
-- `pnpm paperclipai issue ...` — Create, list, update, and comment on Paperclip issues
-- `pnpm paperclipai agent list` — List all agents and their status
-- `curl` — HTTP requests (e.g., loading the Paperclip skill, GitHub API)
-- `python3` — For data processing (e.g., parsing JSON from GitHub API)
+| Tool | Purpose |
+|---|---|
+| `gh` | GitHub CLI — issues, PRs, repo operations |
+| `git` | Version control — branches, commits, PRs |
+| `curl` | HTTP requests — Paperclip API, GitHub API, external services |
+| `jq` | JSON parsing and formatting |
+| `python3` | Data processing and scripting |
+| `pnpm paperclipai` | Paperclip CLI — issue/agent operations |