# T12 - G2 VPS Approval Verification

## Status

draft

## Owner

VPS_VERIFIER

## Dependencies

- T10 produces `evidence/vps-g2-approve-YYYYMMDD.md`
- User explicitly authorizes VPS-side approval before T10 runs
- CORRECTION confirms sync-health is not blocked

## Scope

Independently verify VPS-side G2 approval evidence and filing-freeze compliance after VPS_EXECUTOR performs the authorized pairing approval.

This task is evidence review by default. It does not authorize VPS mutation, service restart/reload, token rotation, Gateway config changes, Nginx edits, Docker compose edits, bind mount changes, image changes, or public website changes.

## Planning Status

- G2 pre-execution plan is documented in `docs/G2_RUNBOOK.md`.
- This task remains `draft` until T10 evidence exists.
- Planning confirmation does not authorize verifier-side VPS commands.

## Required Evidence

- Review `docs/G2_RUNBOOK.md`.
- Review VPS_EXECUTOR evidence from T10.
- Confirm the approved request or node ID matches PC evidence and display name.
- Confirm the token value is absent from evidence, handoffs, logs, commits, and chat.
- Confirm no restart, reload, token rotation, Gateway config mutation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
- Confirm existing VPS baseline anomalies are tracked as observations and were not changed during G2.
- Confirm VPS-side evidence is synchronized through Git and visible to the PC side.
- Write findings to `evidence/verify-vps-g2-YYYYMMDD.md`.
- Update `handoff/VPS_VERIFIER.md`.

## Command Drafts

Do not run VPS commands during planning. By default, verification is evidence review only:

```text
Review VPS evidence only. Do not execute VPS commands unless a later user instruction explicitly authorizes verifier-side read-only checks.
```

## Stop Conditions

- T10 evidence is missing, incomplete, or not synchronized.
- Evidence contains a secret.
- Approval cannot be tied to the intended PC node.
- Evidence shows restart, reload, token rotation, Gateway config mutation, Nginx edit, Docker edit, bind mount change, image change, service-state mutation, or frozen website output change.

## Acceptance

VPS_VERIFIER may mark T10 accepted only after non-secret evidence is sufficient. ORCHESTRATOR decides whether VPS-side G2 is ready to count toward G2 completion.