diff --git a/handoff/ORCHESTRATOR.md b/handoff/ORCHESTRATOR.md index 4b5644f..d716a51 100644 --- a/handoff/ORCHESTRATOR.md +++ b/handoff/ORCHESTRATOR.md @@ -6,7 +6,7 @@ Own requirements alignment, task decomposition, dependency tracking, and final a ## Current Objective -Maintain the shared Gitea-backed control plane, keep user-facing status current, and coordinate the next gate only after explicit user authorization. +Coordinate authorized G2 execution strictly under `docs/G2_RUNBOOK.md`: foreground PC node run first, then corresponding VPS pairing approval only after a matching non-secret request/node ID exists. ## Must Read @@ -27,7 +27,7 @@ Maintain the shared Gitea-backed control plane, keep user-facing status current, - Strict `smartmotor.cloud` website freeze is a hard requirement during filing review. - Communication MVP uses polling Git sync scripts in `sync/` and task files in `tasks/`. - `USER_STATUS.md` is the user-facing status entry; internal agent ledgers should not be required reading for the user. -- G2 and mutation-stage work are not authorized until the user explicitly opens the next stage. +- G2 is authorized as of 2026-05-19, limited to foreground PC node run and corresponding VPS pairing approval under `docs/G2_RUNBOOK.md`. - `docs/G2_RUNBOOK.md` has been prepared as the G2 execution-before-action runbook. It does not authorize execution by itself. - Sync-health is currently healthy: tracked PC and VPS heartbeats are present and clean, and no `sync-state/error-*.md` files are observed in the latest control-plane snapshot. - T2.1 and T8 are now treated as complete control-plane setup work; G2 remains Pending. @@ -36,12 +36,12 @@ Maintain the shared Gitea-backed control plane, keep user-facing status current, ## Next Actions -1. Ask the user whether to explicitly authorize G2 execution only after they review `docs/G2_RUNBOOK.md`. +1. Let PC_EXECUTOR claim T9, write `rollback/pc-g2-node-run-YYYYMMDD.md`, set the Gateway token only in the local shell/session without recording it, and run only the foreground PC node command from `docs/G2_RUNBOOK.md`. 2. Keep `USER_STATUS.md` current when gate, blocker, heartbeat, or required user decision changes. 3. Keep T7/CORRECTION monitoring active for sync-health, drift, missing evidence, and freeze-policy risk. -4. If the user authorizes G2 later, move T9-T13 from draft to ready in dependency order and require rollback notes before token/run/approval actions. -5. Track VPS verifier follow-up observations before future mutation: service path naming drift and Nginx route/config anomaly. -6. Do not open G2 or perform Gateway/node pairing until explicitly authorized. +4. Keep T10 draft until T9 evidence includes a matching non-secret pairing request ID or pending node ID. +5. When T10 becomes eligible, require `rollback/vps-g2-approve-YYYYMMDD.md` before approval and approve only the matching request/node. +6. Continue forbidding service persistence, `openclaw node install/start`, Nginx/Docker/website changes, firewall/network changes, and recording any token or secret. ## Open Questions @@ -50,6 +50,13 @@ Maintain the shared Gitea-backed control plane, keep user-facing status current, ## Last Update +2026-05-19 12:16 UTC+8: User authorized G2 with strict scope. + +- Allowed scope: foreground PC node run and corresponding VPS pairing approval under `docs/G2_RUNBOOK.md`. +- T9 and T13 are ready; T10 remains draft until T9 provides a matching non-secret request/node ID. +- G2 quality gate is In Progress, not accepted. +- No PC/VPS command was executed by ORCHESTRATOR, no token was handled, no node was started here, no VPS approval was performed here, and no service was modified. + 2026-05-19 12:11 UTC+8: Completed G2 authorization-before-execution control-plane cleanup. - `docs/G2_RUNBOOK.md` is complete as the G2 pre-execution runbook. diff --git a/sync-state/heartbeat-vps.json b/sync-state/heartbeat-vps.json index 2de57e0..c922367 100644 --- a/sync-state/heartbeat-vps.json +++ b/sync-state/heartbeat-vps.json @@ -1,9 +1,9 @@ { "host": "vps", - "time": "2026-05-19T12:16:28+0800", + "time": "2026-05-19T12:17:29+0800", "branch": "main", - "head": "7bd3789", - "status": "clean", + "head": "53a40b0", + "status": "dirty", "intervalSeconds": 30, "heartbeatEverySeconds": 60 } diff --git a/tasks/T10-G2-VPS-pairing-approve.md b/tasks/T10-G2-VPS-pairing-approve.md index 55382c5..a2b28c6 100644 --- a/tasks/T10-G2-VPS-pairing-approve.md +++ b/tasks/T10-G2-VPS-pairing-approve.md @@ -24,8 +24,9 @@ This task does not authorize service restarts, reloads, token rotation, Gateway - G2 pre-execution plan is documented in `docs/G2_RUNBOOK.md`. - Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared. -- This task remains `draft` because G2 execution and VPS-side approval have not been explicitly authorized. -- Planning confirmation does not authorize `nodes pending`, `devices approve`, `nodes approve`, service restarts/reloads, token rotation, Gateway config mutation, Nginx changes, Docker changes, or frozen website changes. +- User authorized G2 on 2026-05-19 for foreground PC node run and corresponding VPS pairing approval only. +- This task remains `draft` until T9 produces a non-secret pairing request ID or pending node ID that can be matched to the intended PC node. +- Authorization covers only the corresponding pairing approval after T9 evidence exists; it does not authorize service restarts/reloads, token rotation, Gateway config mutation, Nginx changes, Docker changes, or frozen website changes. ## Required Evidence @@ -39,7 +40,7 @@ This task does not authorize service restarts, reloads, token rotation, Gateway ## Command Drafts -Do not run these until G2 approval is explicitly authorized. +Do not run these until T9 evidence provides a matching non-secret request/node ID. Approval must target only the intended PC pairing. ```bash docker exec openclaw-gateway node openclaw.mjs nodes pending diff --git a/tasks/T13-G2-correction-guard.md b/tasks/T13-G2-correction-guard.md index 5737a95..128828c 100644 --- a/tasks/T13-G2-correction-guard.md +++ b/tasks/T13-G2-correction-guard.md @@ -2,7 +2,7 @@ ## Status -draft +ready ## Owner @@ -22,10 +22,17 @@ This task does not authorize PC/VPS configuration mutation. - Confirm `sync-state/heartbeat-pc.json` and `sync-state/heartbeat-vps.json` are present and fresh before G2 execution starts. - Confirm no `sync-state/error-pc.md` or `sync-state/error-vps.md` file exists. +- Confirm user authorization is limited to foreground PC node run and corresponding VPS pairing approval. - Confirm PC and VPS agents can see the same latest G2 task state and evidence through Git. - Block G2 if any task bypasses explicit user authorization, records a secret, or risks changing frozen `smartmotor.cloud` website output. - Record findings in `handoff/CORRECTION.md` and, if needed, update this task status to `blocked`. +## Current Authorization + +- User authorized G2 on 2026-05-19. +- Allowed: foreground PC node run under `docs/G2_RUNBOOK.md` and corresponding VPS pairing approval after T9 produces a matching non-secret request/node ID. +- Forbidden: service persistence, `openclaw node install/start`, Nginx/Docker/website changes, firewall/network changes, and recording any token or secret. + ## Stop Conditions - Heartbeat older than the sync policy threshold. diff --git a/tasks/T9-G2-PC-node-run.md b/tasks/T9-G2-PC-node-run.md index b9a12e3..c1bfe72 100644 --- a/tasks/T9-G2-PC-node-run.md +++ b/tasks/T9-G2-PC-node-run.md @@ -2,7 +2,7 @@ ## Status -draft +ready ## Owner @@ -26,8 +26,9 @@ This task is not ready until ORCHESTRATOR records explicit user authorization fo - G2 pre-execution plan is documented in `docs/G2_RUNBOOK.md`. - Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared. -- This task remains `draft` because G2 execution has not been explicitly authorized. -- Planning confirmation does not authorize token use, `openclaw node run`, service changes, firewall changes, network changes, or public port exposure. +- User authorized G2 on 2026-05-19 for foreground PC node run and corresponding VPS pairing approval only. +- This task is ready for PC_EXECUTOR under `docs/G2_RUNBOOK.md`. +- Authorization covers only local-session token use without disclosure and foreground `openclaw node run`; it does not authorize service changes, firewall changes, network changes, persistence, or public port exposure. ## Required Evidence @@ -41,7 +42,7 @@ This task is not ready until ORCHESTRATOR records explicit user authorization fo ## Command Drafts -Do not run these until G2 is explicitly authorized. +Authorized only within `docs/G2_RUNBOOK.md` and only on the Windows PC by PC_EXECUTOR. Do not record the token value. ```powershell $env:OPENCLAW_GATEWAY_TOKEN = ""