From 937707ff0652b1aeb81c57c552ee1f118ec48f73 Mon Sep 17 00:00:00 2001 From: wangzhendong Date: Tue, 19 May 2026 12:07:04 +0800 Subject: [PATCH] Sync agent state from PC at 2026-05-19 12:07:04 --- sync-state/heartbeat-pc.json | 6 ++--- tasks/T11-G2-PC-verify.md | 37 ++++++++++++++++++++++++++++++ tasks/T12-G2-VPS-verify.md | 39 ++++++++++++++++++++++++++++++++ tasks/T13-G2-correction-guard.md | 39 ++++++++++++++++++++++++++++++++ 4 files changed, 118 insertions(+), 3 deletions(-) create mode 100644 tasks/T11-G2-PC-verify.md create mode 100644 tasks/T12-G2-VPS-verify.md create mode 100644 tasks/T13-G2-correction-guard.md diff --git a/sync-state/heartbeat-pc.json b/sync-state/heartbeat-pc.json index c27843c..a31170b 100644 --- a/sync-state/heartbeat-pc.json +++ b/sync-state/heartbeat-pc.json @@ -1,9 +1,9 @@ { "host": "pc", - "time": "2026-05-19T12:06:00+08:00", + "time": "2026-05-19T12:07:03+08:00", "branch": "main", - "head": "0db767f", - "status": "clean", + "head": "303b917", + "status": "dirty", "intervalSeconds": 30, "heartbeatEverySeconds": 60 } diff --git a/tasks/T11-G2-PC-verify.md b/tasks/T11-G2-PC-verify.md new file mode 100644 index 0000000..9f3cf5a --- /dev/null +++ b/tasks/T11-G2-PC-verify.md @@ -0,0 +1,37 @@ +# T11 - G2 PC Verification + +## Status + +draft + +## Owner + +PC_VERIFIER + +## Dependencies + +- T9 done + +## Scope + +Independently verify PC-side G2 evidence before ORCHESTRATOR accepts the PC half of G2. + +## Required Evidence + +- Review `evidence/pc-g2-node-run-YYYYMMDD.md`. +- Confirm PC foreground node connected to the expected Gateway. +- Confirm token value is absent from evidence and handoffs. +- Confirm no `openclaw node install`, `start`, `restart`, `stop`, `uninstall`, service, scheduled task, firewall, network, environment persistence, or public-port exposure mutation occurred. +- Write verification evidence to `evidence/verify-pc-g2-YYYYMMDD.md`. +- Update `handoff/PC_VERIFIER.md`. + +## Stop Conditions + +- Missing PC executor evidence. +- Evidence includes secrets. +- PC node command or Gateway target does not match `docs/G2_RUNBOOK.md`. +- Evidence suggests a G4 persistence action occurred during G2. + +## Acceptance + +ORCHESTRATOR may count the PC half of G2 as accepted only after PC_VERIFIER records acceptance. diff --git a/tasks/T12-G2-VPS-verify.md b/tasks/T12-G2-VPS-verify.md new file mode 100644 index 0000000..08f37c4 --- /dev/null +++ b/tasks/T12-G2-VPS-verify.md @@ -0,0 +1,39 @@ +# T12 - G2 VPS Verification + +## Status + +draft + +## Owner + +VPS_VERIFIER + +## Dependencies + +- T10 done + +## Scope + +Independently verify VPS-side G2 approval evidence and frozen website compliance before ORCHESTRATOR accepts the VPS half of G2. + +## Required Evidence + +- Review `evidence/vps-g2-approve-YYYYMMDD.md`. +- Confirm only the intended pairing approval occurred. +- Confirm no token value, password, API key, private key, cookie, or `OPENCLAW_GATEWAY_TOKEN` value appears in evidence or handoffs. +- Confirm no restart, reload, token rotation, Nginx edit, Docker compose edit, bind mount change, image change, service-state mutation, or public website output change occurred. +- Track existing `/opt/service` versus `/opt/services`, `docker-composite.yml` versus `docker-compose.openclaw.yml`, and Nginx route/config anomalies as follow-up observations unless they directly affect G2. +- Write verification evidence to `evidence/verify-vps-g2-YYYYMMDD.md`. +- Update `handoff/VPS_VERIFIER.md`. + +## Stop Conditions + +- Missing VPS executor evidence. +- Evidence includes secrets. +- Approval cannot be tied to the intended PC node. +- Frozen `smartmotor.cloud` website compliance is uncertain. +- Evidence suggests service, Docker, Nginx, route, bind mount, image, or public content mutation. + +## Acceptance + +ORCHESTRATOR may count the VPS half of G2 as accepted only after VPS_VERIFIER records acceptance. diff --git a/tasks/T13-G2-correction-guard.md b/tasks/T13-G2-correction-guard.md new file mode 100644 index 0000000..5737a95 --- /dev/null +++ b/tasks/T13-G2-correction-guard.md @@ -0,0 +1,39 @@ +# T13 - G2 Correction Guard + +## Status + +draft + +## Owner + +CORRECTION + +## Dependencies + +- G2 user authorization recorded by ORCHESTRATOR + +## Scope + +Guard G2 execution against sync-health failures, missing evidence, unsafe task expansion, secret leakage, and frozen website policy risk. + +This task does not authorize PC/VPS configuration mutation. + +## Required Evidence + +- Confirm `sync-state/heartbeat-pc.json` and `sync-state/heartbeat-vps.json` are present and fresh before G2 execution starts. +- Confirm no `sync-state/error-pc.md` or `sync-state/error-vps.md` file exists. +- Confirm PC and VPS agents can see the same latest G2 task state and evidence through Git. +- Block G2 if any task bypasses explicit user authorization, records a secret, or risks changing frozen `smartmotor.cloud` website output. +- Record findings in `handoff/CORRECTION.md` and, if needed, update this task status to `blocked`. + +## Stop Conditions + +- Heartbeat older than the sync policy threshold. +- Any sync error file exists. +- Any evidence, handoff, task, commit, or chat contains a secret value. +- Any G2 task attempts service persistence, restart/reload, Nginx/Docker edits, firewall/network changes, public port exposure, or website-affecting changes. +- Pairing request identity is ambiguous. + +## Acceptance + +ORCHESTRATOR reviews CORRECTION findings before accepting G2 or opening G3.