Sync agent state from PC at 2026-05-19 12:06:32

tasks/T10-G2-VPS-pairing-approve.md

@@ -0,0 +1,58 @@
+# T10 - G2 VPS Pairing Approval
+
+## Status
+
+draft
+
+## Owner
+
+VPS_EXECUTOR
+
+## Dependencies
+
+- T9 produces a non-secret pairing request ID or pending node ID
+- User explicitly authorizes VPS-side approval
+- CORRECTION confirms sync-health is not blocked
+
+## Scope
+
+Approve the intended PC node/device pairing on the VPS Gateway side.
+
+This task does not authorize service restarts, reloads, token rotation, Gateway configuration changes, Nginx changes, Docker compose edits, bind mount changes, image changes, or public website changes.
+
+## Required Evidence
+
+- `rollback/vps-g2-approve-YYYYMMDD.md` written before approval action.
+- Confirmation that request identity matched the PC evidence and display name.
+- Exact command shape used, without secrets.
+- Approval result summary.
+- Confirmation that no restart, reload, token rotation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
+- Evidence written to `evidence/vps-g2-approve-YYYYMMDD.md`.
+- `handoff/VPS_EXECUTOR.md` updated.
+
+## Command Drafts
+
+Do not run these until G2 approval is explicitly authorized.
+
+```bash
+docker exec -it openclaw-gateway node openclaw.mjs devices approve <requestId>
+docker exec -it openclaw-gateway node openclaw.mjs nodes pending
+docker exec -it openclaw-gateway node openclaw.mjs nodes approve <nodeId>
+```
+
+## Expected Output
+
+- The intended PC device/node is approved.
+- Gateway shows the PC node online or approved.
+- Evidence contains only non-secret request IDs or node IDs.
+
+## Stop Conditions
+
+- User authorization is absent or ambiguous.
+- Request identity is ambiguous or multiple indistinguishable pending requests exist.
+- A command asks for or prints a token/password.
+- Approval would require restart, reload, token rotation, config mutation, Nginx changes, Docker changes, or any action that could affect frozen `smartmotor.cloud` website output.
+
+## Acceptance
+
+VPS_VERIFIER must review this evidence before ORCHESTRATOR can count the VPS half of G2 as accepted.