# VPS Baseline Verification - 2026-05-15

Owner: VPS_VERIFIER
Task: T6-VPS-baseline-verify
Mode: read-only independent review

## Inputs Reviewed

- `AGENT_BOARD.md`
- `.cursor/rules/agent-orchestration.mdc`
- `handoff/VPS_VERIFIER.md`
- `handoff/VPS_EXECUTOR.md`
- `tasks/T6-VPS-baseline-verify.md`
- `tasks/T4-VPS-baseline.md`
- `evidence/vps-baseline-20260515.md`

## Read-Only Checks Performed

- `git pull` returned `Already up to date`.
- Repository status remained clean on `main...origin/main` before verifier evidence was written.
- Docker container state was inspected for `openclaw-gateway`, `nginx-proxy`, `gitea`, `confluence`, and `postgres_conf`.
- Gateway health was checked inside `openclaw-gateway` with Node `fetch` against `http://127.0.0.1:18789/healthz`.
- Nginx mounted config directory and generated config output were inspected without reload.
- Public HTTPS endpoints were status-checked without content edits.
- OpenClaw CLI availability was checked with `--version` and command `--help` only.
- Evidence and handoff text were scanned for secret-indicator terms.

## Findings

- Gateway is running and healthy on `services_appnet`; health endpoint returned `200 {"ok":true,"status":"live"}`.
- Docker stack coexistence is intact at verification time:
  - `openclaw-gateway` is running and healthy with no host port published.
  - `nginx-proxy` is running with host ports `80` and `443` published.
  - `gitea` is running with container port `3000` and host SSH port `2222`.
  - `confluence` is running with container ports `8090-8091`.
  - `postgres_conf` is running and healthy with container port `5432`.
- Endpoint checks matched executor evidence:
  - `https://smartmotor.cloud/` returned `200`.
  - `https://git.smartmotor.cloud/` returned `200`.
  - `https://wiki.smartmotor.cloud/` returned `302` to login.
  - `https://openclaw.smartmotor.cloud/` returned `200`.
- OpenClaw CLI is not on the VPS host PATH, but is available inside `openclaw-gateway` via `node openclaw.mjs`.
- `node openclaw.mjs devices approve --help`, `nodes pending --help`, and `nodes approve --help` succeeded.
- No approval, pending-node listing, restart, reload, token rotation, or config mutation command was executed during verification.
- Secret scan found only policy/negative/planning references to password, token, private key, API key, or `OPENCLAW_GATEWAY_TOKEN`; no secret value was identified in the reviewed task, handoff, or evidence files.

## Confirmed Baseline Observations

- The executor-reported path difference is real:
  - `/opt/service` does not exist.
  - `/opt/services` exists.
  - `/opt/services/docker-composite.yml` does not exist.
  - `/opt/services/docker-compose.openclaw.yml` exists.
- The executor-reported Nginx route anomaly is real:
  - `/etc/nginx/conf.d` inside `nginx-proxy` is empty.
  - `nginx -T` output contained no `openclaw.smartmotor.cloud`, `proxy_pass`, or `server_name` matches.
  - Public endpoints still returned expected HTTP status codes.

## Frozen Website Rule

- No homepage content, linked page content, static asset, Nginx route file, bind mount, container image, service state, or Docker compose entry was changed by this verifier.
- The reviewed executor evidence also states no restart, reload, approval, token rotation, image change, bind mount change, Nginx route edit, or Docker compose edit was performed.
- Current evidence is sufficient to treat the `smartmotor.cloud` freeze as not touched during T4/T6 baseline review.

## Verdict

VPS baseline evidence is accepted for G1/T6 with follow-up observations, not blockers:

- Track the `/opt/service` versus `/opt/services` and `docker-composite.yml` versus `docker-compose.openclaw.yml` naming drift before any future mutation task.
- Investigate the Nginx route/config anomaly in a later read-only correction pass before changing routing.

No VPS configuration changes are approved by this verifier evidence.