Sync agent state from VPS at 2026-05-19 12:17:29

tasks/T13-G2-correction-guard.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-draft
+ready
 
 ## Owner
 
@@ -22,10 +22,17 @@ This task does not authorize PC/VPS configuration mutation.
 
 - Confirm `sync-state/heartbeat-pc.json` and `sync-state/heartbeat-vps.json` are present and fresh before G2 execution starts.
 - Confirm no `sync-state/error-pc.md` or `sync-state/error-vps.md` file exists.
+- Confirm user authorization is limited to foreground PC node run and corresponding VPS pairing approval.
 - Confirm PC and VPS agents can see the same latest G2 task state and evidence through Git.
 - Block G2 if any task bypasses explicit user authorization, records a secret, or risks changing frozen `smartmotor.cloud` website output.
 - Record findings in `handoff/CORRECTION.md` and, if needed, update this task status to `blocked`.
 
+## Current Authorization
+
+- User authorized G2 on 2026-05-19.
+- Allowed: foreground PC node run under `docs/G2_RUNBOOK.md` and corresponding VPS pairing approval after T9 produces a matching non-secret request/node ID.
+- Forbidden: service persistence, `openclaw node install/start`, Nginx/Docker/website changes, firewall/network changes, and recording any token or secret.
+
 ## Stop Conditions
 
 - Heartbeat older than the sync policy threshold.