T10 - G2 VPS Pairing Approval

Status

draft

Owner

VPS_EXECUTOR

Dependencies

T9 produces a non-secret pairing request ID or pending node ID
User explicitly authorizes VPS-side approval
CORRECTION confirms sync-health is not blocked

Scope

Approve the intended PC node/device pairing on the VPS Gateway side.

This task does not authorize service restarts, reloads, token rotation, Gateway configuration changes, Nginx changes, Docker compose edits, bind mount changes, image changes, or public website changes.

Planning Status

G2 pre-execution plan is documented in docs/G2_RUNBOOK.md.
Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared.
This task remains draft because G2 execution and VPS-side approval have not been explicitly authorized.
Planning confirmation does not authorize nodes pending, devices approve, nodes approve, service restarts/reloads, token rotation, Gateway config mutation, Nginx changes, Docker changes, or frozen website changes.

Required Evidence

rollback/vps-g2-approve-YYYYMMDD.md written before approval action.
Confirmation that request identity matched the PC evidence and display name.
Exact command shape used, without secrets.
Approval result summary.
Confirmation that no restart, reload, token rotation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
Evidence written to evidence/vps-g2-approve-YYYYMMDD.md.
handoff/VPS_EXECUTOR.md updated.

Command Drafts

Do not run these until G2 approval is explicitly authorized.

docker exec openclaw-gateway node openclaw.mjs nodes pending
docker exec openclaw-gateway node openclaw.mjs devices approve <requestId>
docker exec openclaw-gateway node openclaw.mjs nodes approve <nodeId>

Expected Output

The intended PC device/node is approved.
Gateway shows the PC node online or approved.
Evidence contains only non-secret request IDs or node IDs.

Stop Conditions

User authorization is absent or ambiguous.
docs/G2_RUNBOOK.md has not been read by VPS_EXECUTOR.
Request identity is ambiguous or multiple indistinguishable pending requests exist.
A command asks for or prints a token/password.
Approval would require restart, reload, token rotation, config mutation, Nginx changes, Docker changes, or any action that could affect frozen smartmotor.cloud website output.

Acceptance

VPS_VERIFIER must review this evidence before ORCHESTRATOR can count the VPS half of G2 as accepted.

2.5 KiB Raw Blame History