-- Seed Yerin, the security agent. READ-ONLY by capability (no suggest/write):
-- she investigates and reports; remediation goes through you. Runs on the same
-- claude CLI subscription path as Dross (model NULL = server default); switch to
-- a local Ollama model later by setting agents.model. See docs/yerin-security-agent.md.
INSERT INTO agents (slug, name, kind, model, capabilities)
VALUES (
  'yerin', 'Yerin', 'claude', NULL,
  '{"read":true,"suggest":false,"write":false}'::jsonb
)
ON CONFLICT (slug) DO NOTHING;