Sync agent state from PC at 2026-05-19 12:07:04

tasks/T11-G2-PC-verify.md

@@ -0,0 +1,37 @@
+# T11 - G2 PC Verification
+
+## Status
+
+draft
+
+## Owner
+
+PC_VERIFIER
+
+## Dependencies
+
+- T9 done
+
+## Scope
+
+Independently verify PC-side G2 evidence before ORCHESTRATOR accepts the PC half of G2.
+
+## Required Evidence
+
+- Review `evidence/pc-g2-node-run-YYYYMMDD.md`.
+- Confirm PC foreground node connected to the expected Gateway.
+- Confirm token value is absent from evidence and handoffs.
+- Confirm no `openclaw node install`, `start`, `restart`, `stop`, `uninstall`, service, scheduled task, firewall, network, environment persistence, or public-port exposure mutation occurred.
+- Write verification evidence to `evidence/verify-pc-g2-YYYYMMDD.md`.
+- Update `handoff/PC_VERIFIER.md`.
+
+## Stop Conditions
+
+- Missing PC executor evidence.
+- Evidence includes secrets.
+- PC node command or Gateway target does not match `docs/G2_RUNBOOK.md`.
+- Evidence suggests a G4 persistence action occurred during G2.
+
+## Acceptance
+
+ORCHESTRATOR may count the PC half of G2 as accepted only after PC_VERIFIER records acceptance.

tasks/T12-G2-VPS-verify.md

@@ -0,0 +1,39 @@
+# T12 - G2 VPS Verification
+
+## Status
+
+draft
+
+## Owner
+
+VPS_VERIFIER
+
+## Dependencies
+
+- T10 done
+
+## Scope
+
+Independently verify VPS-side G2 approval evidence and frozen website compliance before ORCHESTRATOR accepts the VPS half of G2.
+
+## Required Evidence
+
+- Review `evidence/vps-g2-approve-YYYYMMDD.md`.
+- Confirm only the intended pairing approval occurred.
+- Confirm no token value, password, API key, private key, cookie, or `OPENCLAW_GATEWAY_TOKEN` value appears in evidence or handoffs.
+- Confirm no restart, reload, token rotation, Nginx edit, Docker compose edit, bind mount change, image change, service-state mutation, or public website output change occurred.
+- Track existing `/opt/service` versus `/opt/services`, `docker-composite.yml` versus `docker-compose.openclaw.yml`, and Nginx route/config anomalies as follow-up observations unless they directly affect G2.
+- Write verification evidence to `evidence/verify-vps-g2-YYYYMMDD.md`.
+- Update `handoff/VPS_VERIFIER.md`.
+
+## Stop Conditions
+
+- Missing VPS executor evidence.
+- Evidence includes secrets.
+- Approval cannot be tied to the intended PC node.
+- Frozen `smartmotor.cloud` website compliance is uncertain.
+- Evidence suggests service, Docker, Nginx, route, bind mount, image, or public content mutation.
+
+## Acceptance
+
+ORCHESTRATOR may count the VPS half of G2 as accepted only after VPS_VERIFIER records acceptance.

tasks/T13-G2-correction-guard.md

@@ -0,0 +1,39 @@
+# T13 - G2 Correction Guard
+
+## Status
+
+draft
+
+## Owner
+
+CORRECTION
+
+## Dependencies
+
+- G2 user authorization recorded by ORCHESTRATOR
+
+## Scope
+
+Guard G2 execution against sync-health failures, missing evidence, unsafe task expansion, secret leakage, and frozen website policy risk.
+
+This task does not authorize PC/VPS configuration mutation.
+
+## Required Evidence
+
+- Confirm `sync-state/heartbeat-pc.json` and `sync-state/heartbeat-vps.json` are present and fresh before G2 execution starts.
+- Confirm no `sync-state/error-pc.md` or `sync-state/error-vps.md` file exists.
+- Confirm PC and VPS agents can see the same latest G2 task state and evidence through Git.
+- Block G2 if any task bypasses explicit user authorization, records a secret, or risks changing frozen `smartmotor.cloud` website output.
+- Record findings in `handoff/CORRECTION.md` and, if needed, update this task status to `blocked`.
+
+## Stop Conditions
+
+- Heartbeat older than the sync policy threshold.
+- Any sync error file exists.
+- Any evidence, handoff, task, commit, or chat contains a secret value.
+- Any G2 task attempts service persistence, restart/reload, Nginx/Docker edits, firewall/network changes, public port exposure, or website-affecting changes.
+- Pairing request identity is ambiguous.
+
+## Acceptance
+
+ORCHESTRATOR reviews CORRECTION findings before accepting G2 or opening G3.