docs: update OpenVINO NPU service maps

docs/diagram-maintenance.md

@@ -15,6 +15,7 @@ Update the relevant diagram in the same change set when you change any of these:
 - n8n workflow architecture
 - Hermes/Atlas routing or gateway responsibilities
 - local AI/search/voice endpoints
+- OpenVINO NPU live/prototype status, ports, or safety gates (`:18810`, `:18816`, `:18817`, `:18818`, `:18819`, `:18820`, optional `:18829`)
 - Obsidian/RAG data flow
 - OpenClaw/VM operational mode
 - ownership/source-of-truth paths for a component
@@ -27,6 +28,7 @@ Create a new focused diagram when the existing overview would become too dense.
 - agentmon internals: collectors → NATS → processor → Postgres → query/UI
 - Obsidian/RAG automation pipeline
 - local AI routing: Hermes/LiteLLM/llama.cpp/Ollama/provider boundaries
+- OpenVINO NPU assistant sidecars, with live baseline and approved/not-live prototype lanes separated
 - messaging/channel routing: Telegram/Discord/email → Hermes/n8n/alerts
 - disaster recovery / backup topology
 
@@ -37,6 +39,7 @@ Create a new focused diagram when the existing overview would become too dense.
 - Link diagrams from the nearest README or operational doc.
 - Keep labels operational: service name, port, responsibility, and data direction.
 - Avoid secrets, credential names that imply secret values, private tokens, raw webhook URLs, or sensitive sample payloads.
+- Do not imply live Atlas/Hermes/RAG routing to an OpenVINO NPU prototype unless a reviewed implementation actually enabled it; label approved prototypes as `not live` or `approval required`.
 - If a raw export or live config was used to build the diagram, commit only the sanitized diagram/docs, not the raw sensitive source.
 
 ## Verification before committing