Sync agent state from VPS at 2026-05-15 16:12:14

evidence/verify-vps-baseline-20260515.md

@@ -0,0 +1,72 @@
+# VPS Baseline Verification - 2026-05-15
+
+Owner: VPS_VERIFIER
+Task: T6-VPS-baseline-verify
+Mode: read-only independent review
+
+## Inputs Reviewed
+
+- `AGENT_BOARD.md`
+- `.cursor/rules/agent-orchestration.mdc`
+- `handoff/VPS_VERIFIER.md`
+- `handoff/VPS_EXECUTOR.md`
+- `tasks/T6-VPS-baseline-verify.md`
+- `tasks/T4-VPS-baseline.md`
+- `evidence/vps-baseline-20260515.md`
+
+## Read-Only Checks Performed
+
+- `git pull` returned `Already up to date`.
+- Repository status remained clean on `main...origin/main` before verifier evidence was written.
+- Docker container state was inspected for `openclaw-gateway`, `nginx-proxy`, `gitea`, `confluence`, and `postgres_conf`.
+- Gateway health was checked inside `openclaw-gateway` with Node `fetch` against `http://127.0.0.1:18789/healthz`.
+- Nginx mounted config directory and generated config output were inspected without reload.
+- Public HTTPS endpoints were status-checked without content edits.
+- OpenClaw CLI availability was checked with `--version` and command `--help` only.
+- Evidence and handoff text were scanned for secret-indicator terms.
+
+## Findings
+
+- Gateway is running and healthy on `services_appnet`; health endpoint returned `200 {"ok":true,"status":"live"}`.
+- Docker stack coexistence is intact at verification time:
+  - `openclaw-gateway` is running and healthy with no host port published.
+  - `nginx-proxy` is running with host ports `80` and `443` published.
+  - `gitea` is running with container port `3000` and host SSH port `2222`.
+  - `confluence` is running with container ports `8090-8091`.
+  - `postgres_conf` is running and healthy with container port `5432`.
+- Endpoint checks matched executor evidence:
+  - `https://smartmotor.cloud/` returned `200`.
+  - `https://git.smartmotor.cloud/` returned `200`.
+  - `https://wiki.smartmotor.cloud/` returned `302` to login.
+  - `https://openclaw.smartmotor.cloud/` returned `200`.
+- OpenClaw CLI is not on the VPS host PATH, but is available inside `openclaw-gateway` via `node openclaw.mjs`.
+- `node openclaw.mjs devices approve --help`, `nodes pending --help`, and `nodes approve --help` succeeded.
+- No approval, pending-node listing, restart, reload, token rotation, or config mutation command was executed during verification.
+- Secret scan found only policy/negative/planning references to password, token, private key, API key, or `OPENCLAW_GATEWAY_TOKEN`; no secret value was identified in the reviewed task, handoff, or evidence files.
+
+## Confirmed Baseline Observations
+
+- The executor-reported path difference is real:
+  - `/opt/service` does not exist.
+  - `/opt/services` exists.
+  - `/opt/services/docker-composite.yml` does not exist.
+  - `/opt/services/docker-compose.openclaw.yml` exists.
+- The executor-reported Nginx route anomaly is real:
+  - `/etc/nginx/conf.d` inside `nginx-proxy` is empty.
+  - `nginx -T` output contained no `openclaw.smartmotor.cloud`, `proxy_pass`, or `server_name` matches.
+  - Public endpoints still returned expected HTTP status codes.
+
+## Frozen Website Rule
+
+- No homepage content, linked page content, static asset, Nginx route file, bind mount, container image, service state, or Docker compose entry was changed by this verifier.
+- The reviewed executor evidence also states no restart, reload, approval, token rotation, image change, bind mount change, Nginx route edit, or Docker compose edit was performed.
+- Current evidence is sufficient to treat the `smartmotor.cloud` freeze as not touched during T4/T6 baseline review.
+
+## Verdict
+
+VPS baseline evidence is accepted for G1/T6 with follow-up observations, not blockers:
+
+- Track the `/opt/service` versus `/opt/services` and `docker-composite.yml` versus `docker-compose.openclaw.yml` naming drift before any future mutation task.
+- Investigate the Nginx route/config anomaly in a later read-only correction pass before changing routing.
+
+No VPS configuration changes are approved by this verifier evidence.