# T9 - G2 PC Foreground Node Run ## Status done ## Owner PC_EXECUTOR ## Dependencies - G0A complete - G0B complete - G1 accepted - Fresh user authorization after role-misdirection correction - CORRECTION confirms sync-health is not blocked ## Scope Prepare the Windows PC OpenClaw node foreground pairing flow, with the user running token setup and `openclaw node run` manually in a dedicated local PowerShell terminal. This task is not ready until ORCHESTRATOR records explicit user authorization for G2. It does not authorize service installation, startup persistence, firewall changes, network changes, or any public port exposure. ## Planning Status - G2 pre-execution plan is documented in `docs/G2_RUNBOOK.md`. - Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared. - Fresh second G2 authorization was recorded by ORCHESTRATOR on 2026-05-19 for target window ORCHESTRATOR in `D:\openclaw-control-plane`. - This task is ready for PC_EXECUTOR under `docs/G2_RUNBOOK.md`. - Authorization covers only user-run local-session token use without disclosure and user-run foreground `openclaw node run`; it does not authorize Agent-shell token use, service changes, firewall changes, network changes, persistence, public port exposure, G3 smoke testing, or G4 service setup. ## Execution Model - 2026-05-19 17:05 UTC+8 - ORCHESTRATOR corrected T9 to use a user-run local terminal model. - PC_EXECUTOR must not request, read, print, record, or handle `OPENCLAW_GATEWAY_TOKEN`. - PC_EXECUTOR does not need to run `openclaw node run` in the Agent shell. - The user opens a dedicated local PC PowerShell terminal, sets `OPENCLAW_GATEWAY_TOKEN` only in that terminal, and runs the foreground node command in the same terminal. - PC_EXECUTOR provides the command template, confirms/refreshes rollback guidance, reminds the user not to send the token to chat or files, and records only non-secret status plus any non-secret pairing request ID or pending node ID. - T9 is `ready` for this user-manual token and foreground node step. T10 remains blocked until T9 produces one matching non-secret pairing request/node ID. ## Completion - 2026-05-21 16:49 UTC+8 - PC_EXECUTOR confirmed `rollback/pc-g2-node-run-20260521.md` before the user-run token/node action. - PC_EXECUTOR provided the dedicated local PowerShell command template and warned the user not to send token values to chat or files. - User reported non-secret result: connected to `openclaw.smartmotor.cloud`. - Pairing request ID or pending node ID was not provided in the user report. - Evidence written to `evidence/pc-g2-node-run-20260521.md`. - Handoff updated: `handoff/PC_EXECUTOR.md`. - No token value was recorded, printed, committed, or chat-sent. - PC_EXECUTOR did not run the token-bearing flow in the Agent shell. - No `openclaw node install`, `start`, `restart`, `stop`, `uninstall`, firewall, network, scheduled task, environment persistence, public-port exposure, G3 smoke test, or G4 persistence change was performed by PC_EXECUTOR. - T10 remains blocked until a matching non-secret pairing request ID or pending node ID is available, or ORCHESTRATOR updates the dependency based on verifier/Gateway state. ## Blocker - 2026-05-19 15:56 UTC+8 - PC_EXECUTOR completed pre-run checks and updated `rollback/pc-g2-node-run-20260519.md`. - User confirmed token setup in a local PC shell, but the Agent execution shell reported only `OPENCLAW_GATEWAY_TOKEN_PRESENT=false`. - `openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs"` was not executed. - No token value was read, printed, recorded, committed, or chat-sent. - No service, scheduled task, firewall, network, environment persistence, or public-port exposure change was performed. - Evidence: `evidence/pc-g2-node-run-20260519.md`. - This prior attempt remained stopped because the token was not available in the same non-persistent local shell session that would run the foreground node. ## Release - 2026-05-19 16:31 UTC+8 - ORCHESTRATOR reviewed CORRECTION's fresh T13 PASS from 2026-05-19 16:29 UTC+8. - G2 remains authorized and `In Progress`. - PC and VPS heartbeats are clean and within the 5-minute sync-health threshold. - No `sync-state/error-*.md` files were observed. - T9 is released back to `ready` for PC_EXECUTOR under `docs/G2_RUNBOOK.md`. - PC_EXECUTOR must still set `OPENCLAW_GATEWAY_TOKEN` only in the same non-persistent local shell session that will run the foreground node, without printing or recording the token value. ## Blocker - 2026-05-19 16:39 UTC+8 - PC_EXECUTOR refreshed `rollback/pc-g2-node-run-20260519.md`. - User confirmed token setup locally, but the Agent execution shell reported `OPENCLAW_GATEWAY_TOKEN_PRESENT=false`. - `openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs"` was not executed. - No token value was read, printed, recorded, committed, or chat-sent. - No service, scheduled task, firewall, network, environment persistence, public-port exposure, G3 smoke test, or G4 persistence change was performed. - Evidence: `evidence/pc-g2-node-run-20260519.md`. - This prior blocker is covered by ORCHESTRATOR's 2026-05-19 16:52 UTC+8 release after confirming G2 remains authorized, T13 PASS remains valid, current sync-health is clean, and no `sync-state/error-*.md` files exist. - T9 is ready again, but PC_EXECUTOR must still ensure the token is available in the same non-persistent local shell session that will run the foreground node, without printing or recording the token value. ## Blocker - 2026-05-19 16:55 UTC+8 - PC_EXECUTOR refreshed `rollback/pc-g2-node-run-20260519.md`. - User confirmed token setup locally, but the Agent execution PowerShell session reported `OPENCLAW_GATEWAY_TOKEN_PRESENT=false`. - `openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs"` was not executed. - No token value was read, printed, recorded, committed, or chat-sent. - No service, scheduled task, firewall, network, environment persistence, public-port exposure, G3 smoke test, or G4 persistence change was performed. - Evidence: `evidence/pc-g2-node-run-20260519.md`. - This blocker is covered by the 2026-05-19 17:05 UTC+8 execution-model correction: the token is expected to remain only in the user's dedicated local PowerShell terminal, not in the Agent shell. - T9 is ready again for PC_EXECUTOR to guide the user-run local terminal flow without handling the token. ## Required Evidence - `rollback/pc-g2-node-run-YYYYMMDD.md` confirmed or refreshed before user token or node-run action. - Confirmation that PC_EXECUTOR provided the user command template and warned the user not to send the token to chat/files. - Confirmation that the user reported `OPENCLAW_GATEWAY_TOKEN` was set only in a dedicated local PC PowerShell terminal and that the token value was not printed or recorded. - Exact foreground node command template used, without secrets. - Non-secret connection status summary and non-secret pairing request ID or pending node ID if shown. - Confirmation that no `openclaw node install`, `start`, `restart`, `stop`, `uninstall`, firewall, network, scheduled task, environment persistence, or public-port exposure change was performed. - Evidence written to `evidence/pc-g2-node-run-YYYYMMDD.md`. - `handoff/PC_EXECUTOR.md` updated. ## Command Drafts Authorized only within `docs/G2_RUNBOOK.md` and only for the user to run in a dedicated local PC PowerShell terminal. PC_EXECUTOR must not execute this in the Agent shell or record the token value. ```powershell $env:OPENCLAW_GATEWAY_TOKEN = "" openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs" ``` ## Expected Output - Foreground node process remains running. - Logs show connection attempt to `openclaw.smartmotor.cloud`. - Pairing request ID or pending node ID appears if approval is required. - No secret value appears in evidence. ## Stop Conditions - Fresh second user authorization after role-misdirection correction is absent or ambiguous. - `docs/G2_RUNBOOK.md` has not been read by PC_EXECUTOR. - Any command asks to print, persist, or store a token. - Any command prints a secret. - PC_EXECUTOR is asked to receive the token, paste it into an Agent shell, or run the token-bearing flow directly. - Any step requires PC service install/start, scheduled task changes, firewall changes, network changes, or public port exposure. - Gateway host or display name differs from the runbook without ORCHESTRATOR review. ## Acceptance PC_VERIFIER must review this evidence before ORCHESTRATOR can count the PC half of G2 as accepted. ## Session Freeze - 2026-05-19 14:46 UTC+8 - Status at freeze: ready. - Next owner: PC_EXECUTOR. - Single next action: claim T9, confirm or refresh `rollback/pc-g2-node-run-YYYYMMDD.md`, give the user the local terminal command template, and collect only non-secret status from the user-run foreground node flow in `docs/G2_RUNBOOK.md`. - Do not record token values, install/start services, change firewall/network state, expose public ports, or start G3/G4 work.