Bootstrap OpenClaw agent control plane

Co-authored-by: Cursor <cursoragent@cursor.com>

handoff/CORRECTION.md

@@ -0,0 +1,30 @@
+# CORRECTION Handoff
+
+## Role
+
+Detect drift, unsafe assumptions, missing evidence, conflicting edits, and tasks that no longer align with the mission.
+
+## Watchlist
+
+- Agents editing outside their role scope.
+- Executors marking their own work as accepted.
+- Secrets appearing in repo files, handoffs, evidence, terminal captures, or commits.
+- Any attempt to alter the frozen `smartmotor.cloud` website, homepage-linked content, static assets, Nginx routing, bind mounts, container images, or `/opt/services/docker-composite.yml` entries that affect public website output.
+- PC/VPS agents making simultaneous config changes before baseline verification.
+- Gitea sync conflicts in `AGENT_BOARD.md` or handoff files.
+- Changes to Nginx, Docker, or Windows services without rollback notes.
+
+## Current State
+
+- Control-plane scaffold is being prepared locally in `D:\openclaw-control-plane`.
+- Remote Gitea repository has been created and cloned locally.
+
+## Next Actions
+
+1. After Gitea sync is configured, verify all role files exist on both PC and VPS.
+2. Check that the first execution phase is read-only discovery, not mutation.
+3. Flag any missing rollback note before service-level changes.
+
+## Last Update
+
+Template created during control-plane bootstrap.

handoff/ORCHESTRATOR.md

@@ -0,0 +1,40 @@
+# ORCHESTRATOR Handoff
+
+## Role
+
+Own requirements alignment, task decomposition, dependency tracking, and final acceptance.
+
+## Current Objective
+
+Bootstrap the shared Gitea-backed control plane, then coordinate read-only baseline discovery on PC and VPS.
+
+## Must Read
+
+- `AGENT_BOARD.md`
+- `OPENCLAW_EXEC_NODE_PLAN.md` from the PC workspace if available
+- All role handoff files relevant to active tasks
+
+## Current State
+
+- Standalone Gitea repository: `https://git.smartmotor.cloud/wangzhendong/openclaw-control-plane.git`.
+- PC local path: `D:\openclaw-control-plane`.
+- VPS target path: `/opt/openclaw-control-plane`.
+- Access mode: HTTPS.
+- Default branch: `main`.
+- Strict `smartmotor.cloud` website freeze is a hard requirement during filing review.
+
+## Next Actions
+
+1. Commit and push the control-plane scaffold to Gitea after user approval.
+2. Clone or pull the repository on the VPS at `/opt/openclaw-control-plane`.
+3. Run G0 requirements and acceptance review with the user.
+4. Assign PC and VPS read-only baseline tasks only after sync is available on both machines.
+
+## Open Questions
+
+- Has the VPS cloned the control-plane repository at `/opt/openclaw-control-plane`?
+- Should Gitea Issues be used immediately for task tracking, or should `AGENT_BOARD.md` remain the first source of truth for the initial run?
+
+## Last Update
+
+Control-plane repository scaffold prepared locally.

handoff/PC_EXECUTOR.md

@@ -0,0 +1,41 @@
+# PC_EXECUTOR Handoff
+
+## Role
+
+Operate only on the Windows 11 PC side: `D:\openclaw`, Tailscale, local OpenClaw CLI/node, and Windows service or scheduled task setup.
+
+## Allowed Work
+
+- Read local PC state.
+- Run harmless diagnostic commands.
+- Capture evidence under `evidence/pc-*`.
+- Prepare rollback notes under `rollback/pc-*` before local system changes.
+
+## Not Allowed
+
+- Do not access VPS secrets.
+- Do not approve Gateway pairings.
+- Do not expose local PC ports publicly.
+- Do not mark PC work as accepted without verifier review.
+
+## Current State
+
+From `OPENCLAW_EXEC_NODE_PLAN.md`:
+
+- OpenClaw CLI was previously detected as `OpenClaw 2026.5.7 (eeef486)`.
+- Gateway 443 connectivity was previously successful.
+- Tailscale service exists and was later logged in with PC Tailnet IP `100.125.185.1`.
+- Next planned OpenClaw work is C1 token injection, C2 `node run`, then C3 VPS approval.
+
+## Next Read-Only Task
+
+After the Gitea control plane is synchronized, collect current PC baseline evidence:
+
+- `openclaw --version`
+- `openclaw node --help`
+- Tailscale CLI path and login status
+- `Test-NetConnection openclaw.smartmotor.cloud -Port 443`
+
+## Last Update
+
+Template created during control-plane bootstrap.

handoff/PC_VERIFIER.md

@@ -0,0 +1,26 @@
+# PC_VERIFIER Handoff
+
+## Role
+
+Independently validate PC-side execution results. Prefer read-only checks and evidence review.
+
+## Validation Scope
+
+- Confirm PC baseline commands match `OPENCLAW_EXEC_NODE_PLAN.md`.
+- Confirm any OpenClaw node execution evidence truly originates from the Windows PC.
+- Confirm no local PC port is exposed publicly as part of the node setup.
+- Confirm service persistence only after `node install/start/status` and reboot evidence exist.
+
+## Current State
+
+- Waiting for PC_EXECUTOR baseline evidence.
+
+## Next Actions
+
+1. Review `evidence/pc-*` after PC_EXECUTOR completes baseline discovery.
+2. Record pass/fail findings in this file and, if needed, `evidence/verify-pc-*`.
+3. Do not mutate PC configuration unless explicitly reassigned as an executor.
+
+## Last Update
+
+Template created during control-plane bootstrap.

handoff/VPS_EXECUTOR.md

@@ -0,0 +1,41 @@
+# VPS_EXECUTOR Handoff
+
+## Role
+
+Operate only on the VPS side: `/opt/service`, OpenClaw Gateway, Docker stack, Nginx, Gitea, Confluence, Postgres, and Gateway-side approval workflows.
+
+## Allowed Work
+
+- Read VPS service state.
+- Run harmless diagnostic commands.
+- Capture evidence under `evidence/vps-*`.
+- Prepare rollback notes under `rollback/vps-*` before service or config changes.
+
+## Not Allowed
+
+- Do not request or store plaintext VPS passwords.
+- Do not rotate or print secrets unless explicitly authorized by the user.
+- Do not change the `smartmotor.cloud` website during filing review: homepage content, linked content reachable from the homepage, static assets, routes, bind mounts, container images, Nginx rules, or `/opt/services/docker-composite.yml` entries that affect public website output are frozen.
+- Do not restart production-facing services without an approved rollback note.
+- Do not mark VPS work as accepted without verifier review.
+
+## Current State
+
+- VPS public IP: `114.132.222.127`.
+- OpenClaw Gateway is already deployed and coexists with the existing Docker stack.
+- The VPS service workspace path is `/opt/service`.
+- The VPS control-plane path is `/opt/openclaw-control-plane`.
+- Gitea control-plane repository: `https://git.smartmotor.cloud/wangzhendong/openclaw-control-plane.git`.
+
+## Next Read-Only Task
+
+After the Gitea control plane is synchronized, collect current VPS baseline evidence:
+
+- Git/Gitea repository availability for the control plane.
+- OpenClaw Gateway process or container status.
+- Nginx route for `openclaw.smartmotor.cloud`.
+- Whether `openclaw devices approve`, `openclaw nodes pending`, and `openclaw nodes approve` are available.
+
+## Last Update
+
+Template created during control-plane bootstrap.

handoff/VPS_VERIFIER.md

@@ -0,0 +1,27 @@
+# VPS_VERIFIER Handoff
+
+## Role
+
+Independently validate VPS-side execution results. Prefer read-only checks and evidence review.
+
+## Validation Scope
+
+- Confirm Gateway remains healthy.
+- Confirm Nginx, Gitea, Confluence, and Postgres coexistence is not degraded by changes.
+- Confirm the frozen `smartmotor.cloud` website is unchanged during filing review, including homepage content and linked content reachable from the homepage.
+- Confirm approval commands and node status evidence are sufficient.
+- Confirm no secrets are written into tracked files or evidence.
+
+## Current State
+
+- Waiting for VPS_EXECUTOR baseline evidence.
+
+## Next Actions
+
+1. Review `evidence/vps-*` after VPS_EXECUTOR completes baseline discovery.
+2. Record pass/fail findings in this file and, if needed, `evidence/verify-vps-*`.
+3. Do not mutate VPS configuration unless explicitly reassigned as an executor.
+
+## Last Update
+
+Template created during control-plane bootstrap.