A floating assistant for the super admin and senior managers (captain.use:
super_admin, board_member, general_manager, membership_director,
sports_director). It answers in Egyptian Arabic: step-by-step guides with the
exact on-screen labels and a link to the page, numbers from the live data with
tables and mermaid charts, and explanations of the page the user has open. It
never talks about code, and it cannot change anything.

The model runs on the DevPilot box under a restricted client token — Haiku at
low effort, only Read/Grep/Glob, confined to its own checkout (clubphp-captain),
enforced by DevPilot from the token. It never touches the database: it asks for
SELECTs in a [[QUERY]] block and QueryGuard runs them on a separate read-only
connection (READ ONLY transaction, one statement, 5 s cap), refusing other
schemas, credential tables and columns, and HR/accounting/treasury data the
user has no permission for; contact data is masked and every query is logged.
Verified against the live database before shipping, including a write with the
text filter bypassed, which MySQL itself refused (1792).

KnowledgeSync keeps .captain/schema.txt (live schema with the values actually
stored) and .captain/menu.txt (every sidebar path) current in that checkout.
Config sits in captain_settings, not system_config, so the token never appears
on the Settings screen; the widget only shows once a token is configured.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>