diff --git a/docs/G2_RUNBOOK.md b/docs/G2_RUNBOOK.md index c5ca813..ad19672 100644 --- a/docs/G2_RUNBOOK.md +++ b/docs/G2_RUNBOOK.md @@ -39,12 +39,22 @@ Forbidden in this planning pass: G2 prepares the OpenClaw execution path immediately before smoke testing: -- Start the Windows PC node in foreground mode and connect it to the VPS Gateway. +- Have the user start the Windows PC node in a dedicated local PowerShell terminal in foreground mode and connect it to the VPS Gateway. - Approve the pairing on the VPS/Gateway side. - Confirm the execution plane is ready for G3 smoke testing, without running the G3 smoke test yet unless separately authorized. G2 does not install a persistent service. G4 covers persistence later. +## T9 Token Execution Model + +`OPENCLAW_GATEWAY_TOKEN` must not be sent to chat, files, evidence, commits, or an Agent-managed shell. Because a token set in a separate user PowerShell session does not automatically enter the Agent shell, T9 uses this model: + +- The user opens a dedicated local PC PowerShell terminal. +- The user sets `OPENCLAW_GATEWAY_TOKEN` only in that local terminal session. +- The user runs the foreground `openclaw node run` command in that same terminal. +- PC_EXECUTOR does not run `openclaw node run` in the Agent shell and does not request, read, print, or record the token value. +- PC_EXECUTOR provides the command template, reminds the user not to disclose the token, then records only non-secret status and any non-secret pairing request ID or pending node ID reported by the user. + ## Current Baseline - G0A, G0B, and G1 are complete in `AGENT_BOARD.md`. @@ -107,10 +117,11 @@ Scope: Windows PC only. Planned G2 task: -- Confirm no stale OpenClaw node process is running only after G2 execution is authorized. -- After explicit user authorization, set the Gateway token only in the local shell/session. -- Run the node in foreground mode. -- Capture non-secret evidence of connection and pairing request ID if shown. +- Confirm or refresh the PC rollback note before the user-run foreground node flow. +- Give the user the local PowerShell command template and require that the token is never sent to chat or files. +- Ask the user to set the Gateway token and run the foreground node in the same dedicated local PowerShell terminal. +- Do not run `openclaw node run` from the Agent shell. +- Capture only non-secret evidence reported by the user, including connection status and pairing request ID or pending node ID if shown. - Stop immediately on any secret exposure, fatal connection error, or request for unapproved mutation. May write: @@ -119,7 +130,7 @@ May write: - `handoff/PC_EXECUTOR.md` - `rollback/pc-g2-node-run-YYYYMMDD.md` -Command drafts, not for this planning pass: +Command template for the user to run in a dedicated local PC PowerShell terminal; PC_EXECUTOR must not execute this in the Agent shell: ```powershell $env:OPENCLAW_GATEWAY_TOKEN = "" @@ -129,13 +140,13 @@ openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-na PC_EXECUTOR authorization points: - A0 before any G2 work. -- A1 before token use. -- A2 before `openclaw node run`. +- A1 before instructing the user to set the token in the local terminal. +- A2 before instructing the user to run foreground `openclaw node run`. PC_EXECUTOR stop conditions: - User authorization is absent or ambiguous. -- Token would be printed, stored, logged, committed, or pasted into chat. +- Token would be printed, stored, logged, committed, pasted into chat, or entered into an Agent-managed shell. - Command asks to install, start, restart, stop, or persist a service. - Command attempts firewall, network, scheduled task, environment persistence, or public port changes. - Gateway host, display name, or command shape differs from the runbook without ORCHESTRATOR review. @@ -321,11 +332,12 @@ Stop conditions: Prerequisites: -- User explicitly authorizes token use. -- Token is provided out-of-band or typed locally by the user, not pasted into repo/chat. -- PC shell is local and not being logged into evidence. +- User explicitly authorizes local token use. +- The user is at a dedicated local PC PowerShell terminal, not an Agent shell. +- Token is typed or pasted locally by the user, not pasted into repo/chat/files. +- The local terminal is not being copied into evidence. -Command draft: +User-run command template; do not execute in Agent shell and do not record the token value: ```powershell $env:OPENCLAW_GATEWAY_TOKEN = "" @@ -334,7 +346,7 @@ $env:OPENCLAW_GATEWAY_TOKEN = "" Expected output: - No command output containing the token. -- Evidence records only: "Gateway token was set in local shell session; value not displayed or recorded." +- Evidence records only: "User set Gateway token in a dedicated local PC PowerShell terminal; value not displayed or recorded." Stop conditions: @@ -350,7 +362,7 @@ Prerequisites: - No stale foreground node process conflicts are reported. - No service install/start command is planned. -Command draft: +User-run command template in the same dedicated local PC PowerShell terminal; do not execute in Agent shell: ```powershell openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs" @@ -370,6 +382,7 @@ Stop conditions: - Command asks to install or persist a service. - Command attempts to bind a public PC port. - Gateway host differs from `openclaw.smartmotor.cloud` without ORCHESTRATOR review. +- User cannot report non-secret status without exposing terminal content that includes a token. ### Step 4 - VPS Rollback Note Before Approval @@ -468,9 +481,10 @@ PC_EXECUTOR evidence should include: - Authorization was received. - Rollback note path. -- Token was set locally without value disclosure. -- Exact node command used. -- Connection/pairing status summary. +- User was given the local PowerShell command template and warned not to send the token to chat/files. +- User reported token was set in a dedicated local PC PowerShell terminal without value disclosure. +- Exact node command template used, without secrets. +- Non-secret connection/pairing status summary reported by the user. - Pairing request ID if non-secret. - Confirmation no install/start/service/firewall/network/public-port change occurred.