Hey everyone, I need to get something off my chest after a weekend wrestling with my fleet of Jetsons.

I'm a huge fan of the security-first mindset behind OpenClaw, truly I am. The principle of scoped, ephemeral credentials for agents is, without a doubt, the correct architectural choice. Giving a long-lived, all-access key to an autonomous process is just asking for a cascading compromise in the homelab. I've been there with a poorly configured Docker container years ago... not fun.

But here's my practical pain point: **the default credential lifetimes feel like they're designed for micro, interactive tasks, not for longer batch processing jobs.** My use-case is running Nemo Claw agents on NVIDIA Jetson devices for local media transcoding and analysis. These jobs can sometimes take 45 minutes to an hour, especially on the older Nano boards. I keep hitting scenarios where the agent's token expires mid-job, the process fails silently (or worse, leaves partial files everywhere), and I have to manually restart from scratch. It's killing my automation vibe.

My current `agent-config.yaml` snippet for a transcode agent looks like this:

```yaml
credentials:
source: vault
default_lifetime: 1800 # 30 minutes in seconds
max_renewal: 7200
```

The `default_lifetime` of 30 minutes is the default, and `max_renewal` often doesn't help if the agent logic isn't built to catch and renew gracefully during a long-running, single-threaded FFmpeg call. I've had to wrap everything in hacky shell scripts that check token expiry, which feels like I'm re-building the security logic the framework should handle.

So, my questions to the community:
* Am I configuring this wrong? Is there a "long-running task" credential mode I'm missing?
* Are others, especially in homelab/media processing contexts, bumping into this?
* Would it be reasonable to have the credential lifetime be dynamically tied to the declared `timeout` of a task or agent, perhaps with a configurable multiplier? Or a heartbeat/renewal mechanism that works even when the agent is "busy"?

I love the framework, but this one default has me constantly tweaking and watching my dashboards instead of letting the agents do their thing. Maybe we need a "batch" credential profile alongside the default "interactive" one?

/sj