From 5134f68d5ed3ee8f79a825b5b2c8d618f1c009a1 Mon Sep 17 00:00:00 2001 From: ubuntu Date: Tue, 19 May 2026 12:18:00 +0800 Subject: [PATCH] Sync agent state from VPS at 2026-05-19 12:18:00 --- handoff/CORRECTION.md | 7 ++++++- handoff/PC_EXECUTOR.md | 10 +++++++++- handoff/VPS_EXECUTOR.md | 11 ++++++++++- tasks/T7-correction-monitor.md | 3 ++- 4 files changed, 27 insertions(+), 4 deletions(-) diff --git a/handoff/CORRECTION.md b/handoff/CORRECTION.md index 582eede..5e2102f 100644 --- a/handoff/CORRECTION.md +++ b/handoff/CORRECTION.md @@ -38,4 +38,9 @@ Detect drift, unsafe assumptions, missing evidence, sync-health failures, confli ## Last Update -Template created during control-plane bootstrap. +2026-05-19 12:16 UTC+8: G2 authorization guard update. + +- User authorized G2 only for foreground PC node run and corresponding VPS pairing approval under `docs/G2_RUNBOOK.md`. +- T9 and T13 are ready; T10 remains draft until T9 produces a matching non-secret pairing request ID or pending node ID. +- Continue blocking service persistence, `openclaw node install/start`, Nginx/Docker/website changes, firewall/network changes, public port exposure, and any token/secret recording. +- Stop G2 if heartbeat becomes stale, any `sync-state/error-*.md` appears, evidence is not visible on both sides, request identity is ambiguous, or freeze compliance becomes uncertain. diff --git a/handoff/PC_EXECUTOR.md b/handoff/PC_EXECUTOR.md index b5b793d..330f124 100644 --- a/handoff/PC_EXECUTOR.md +++ b/handoff/PC_EXECUTOR.md @@ -38,4 +38,12 @@ After the Gitea control plane is synchronized, collect current PC baseline evide ## Last Update -Template created during control-plane bootstrap. +2026-05-19 G2 authorized for PC foreground node run only. + +- Read `docs/G2_RUNBOOK.md` before acting. +- T9 is ready for PC_EXECUTOR. +- Before token or node-run action, write `rollback/pc-g2-node-run-YYYYMMDD.md`. +- Set `OPENCLAW_GATEWAY_TOKEN` only in the local shell/session and never record, print, commit, or paste the token value. +- Run only the foreground node flow from the runbook. Do not run `openclaw node install`, `openclaw node start`, service persistence, scheduled task, firewall, network, or public-port exposure changes. +- Evidence should go to `evidence/pc-g2-node-run-YYYYMMDD.md` and must include no secrets. +- Stop immediately if a command prints or asks to store a secret, asks for persistence, changes firewall/network state, or drifts from `docs/G2_RUNBOOK.md`. diff --git a/handoff/VPS_EXECUTOR.md b/handoff/VPS_EXECUTOR.md index 6d71e02..01f7dc9 100644 --- a/handoff/VPS_EXECUTOR.md +++ b/handoff/VPS_EXECUTOR.md @@ -38,4 +38,13 @@ After the Gitea control plane is synchronized, collect current VPS baseline evid ## Last Update -Template created during control-plane bootstrap. +2026-05-19 G2 authorized for corresponding VPS pairing approval only after PC evidence exists. + +- Read `docs/G2_RUNBOOK.md` before acting. +- T10 remains draft until T9 provides a matching non-secret pairing request ID or pending node ID. +- Before approval action, write `rollback/vps-g2-approve-YYYYMMDD.md`. +- Approve only the intended PC request/node that matches T9 evidence and display name. +- Do not run approval commands if multiple pending requests are indistinguishable. +- Do not request, print, record, rotate, or store any token/password/secret. +- Do not restart/reload services, change Gateway config, edit Nginx, edit Docker/compose/bind mounts/images, change service state, or alter frozen `smartmotor.cloud` website output. +- Evidence should go to `evidence/vps-g2-approve-YYYYMMDD.md` and must include no secrets. diff --git a/tasks/T7-correction-monitor.md b/tasks/T7-correction-monitor.md index 953fce5..24cb5f8 100644 --- a/tasks/T7-correction-monitor.md +++ b/tasks/T7-correction-monitor.md @@ -28,12 +28,13 @@ This task does not authorize PC or VPS configuration mutation. CORRECTION may bl ## Monitoring Findings +- 2026-05-19 12:16 UTC+8: User authorized G2 with strict scope: foreground PC node run and corresponding VPS pairing approval only. T9/T13 are ready; T10 waits for T9 evidence with a matching non-secret request/node ID. Continue blocking service persistence, `openclaw node install/start`, Nginx/Docker/website changes, firewall/network changes, and any token/secret recording. - 2026-05-19 12:07 UTC+8: User confirmed sync-health is healthy and T7 sync-health blocked state is cleared. G2 entered pre-execution planning only. `docs/G2_RUNBOOK.md` and G2 task files define authorization gates, stop conditions, rollback, secret handling, and filing-freeze constraints. No G2 execution is authorized by this planning pass. - 2026-05-15 11:42 UTC+8: Read `AGENT_BOARD.md`, `README.md`, `.cursor/rules/agent-orchestration.mdc`, this task, and all relevant PC/VPS handoffs and baseline tasks. - Historical note from 2026-05-15: T3/T4 were `ready`, T5/T6 were `draft`, and G1 was pending at that time. - Current G2 planning state from 2026-05-19: G1 is done, T9/T10/T11/T12 remain `draft`, and G2 execution is not authorized. - No executor overreach, frozen `smartmotor.cloud` website mutation, pre-G1 configuration mutation, rollback-note gap, sync conflict, or secret-bearing evidence was detected in tracked repository contents. -- Correction decision: no task is blocked in this pass, but no G2 PC/VPS execution is authorized until the user explicitly opens G2 and all authorization gates in `docs/G2_RUNBOOK.md` are satisfied. +- Correction decision: G2 execution is open only within the strict runbook scope. Block anything outside foreground PC node run, matching VPS pairing approval, non-secret evidence, and required rollback notes. ## Stop Conditions