Sync agent state from PC at 2026-05-19 12:28:51

tasks/T10-G2-VPS-pairing-approve.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-draft
+blocked
 
 ## Owner
 
@@ -24,9 +24,9 @@ This task does not authorize service restarts, reloads, token rotation, Gateway
 
 - G2 pre-execution plan is documented in `docs/G2_RUNBOOK.md`.
 - Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared.
-- User authorized G2 on 2026-05-19 for foreground PC node run and corresponding VPS pairing approval only.
-- This task remains `draft` until T9 produces a non-secret pairing request ID or pending node ID that can be matched to the intended PC node.
-- Authorization covers only the corresponding pairing approval after T9 evidence exists; it does not authorize service restarts/reloads, token rotation, Gateway config mutation, Nginx changes, Docker changes, or frozen website changes.
+- Role-misdirection audit on 2026-05-19 paused G2 execution.
+- This task must not be claimed or executed until ORCHESTRATOR records fresh explicit user authorization after the correction and T9 later produces a matching non-secret request/node ID.
+- `docs/G2_RUNBOOK.md` remains the planned procedure, but it does not authorize VPS approval by itself.
 
 ## Required Evidence
 
@@ -56,7 +56,7 @@ docker exec openclaw-gateway node openclaw.mjs nodes approve <nodeId>
 
 ## Stop Conditions
 
-- User authorization is absent or ambiguous.
+- Fresh user authorization after the role-misdirection correction is absent or ambiguous.
 - `docs/G2_RUNBOOK.md` has not been read by VPS_EXECUTOR.
 - Request identity is ambiguous or multiple indistinguishable pending requests exist.
 - A command asks for or prints a token/password.