openclaw-control-plane/tasks/T12-G2-VPS-verify.md

T12 - G2 VPS Approval Verification

Status

draft

Owner

VPS_VERIFIER

Dependencies

• T10 produces evidence/vps-g2-approve-YYYYMMDD.md
• User explicitly authorizes VPS-side approval before T10 runs
• CORRECTION confirms sync-health is not blocked

Scope

Independently verify VPS-side G2 approval evidence and filing-freeze compliance after VPS_EXECUTOR performs the authorized pairing approval.

This task is evidence review by default. It does not authorize VPS mutation, service restart/reload, token rotation, Gateway config changes, Nginx edits, Docker compose edits, bind mount changes, image changes, or public website changes.

Planning Status

• G2 pre-execution plan is documented in docs/G2_RUNBOOK.md.
• This task remains draft until T10 evidence exists.
• Planning confirmation does not authorize verifier-side VPS commands.

Required Evidence

• Review docs/G2_RUNBOOK.md.
• Review VPS_EXECUTOR evidence from T10.
• Confirm the approved request or node ID matches PC evidence and display name.
• Confirm the token value is absent from evidence, handoffs, logs, commits, and chat.
• Confirm no restart, reload, token rotation, Gateway config mutation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
• Confirm existing VPS baseline anomalies are tracked as observations and were not changed during G2.
• Confirm VPS-side evidence is synchronized through Git and visible to the PC side.
• Write findings to evidence/verify-vps-g2-YYYYMMDD.md.
• Update handoff/VPS_VERIFIER.md.

Command Drafts

Do not run VPS commands during planning. By default, verification is evidence review only:

Review VPS evidence only. Do not execute VPS commands unless a later user instruction explicitly authorizes verifier-side read-only checks.

Stop Conditions

• T10 evidence is missing, incomplete, or not synchronized.
• Evidence contains a secret.
• Approval cannot be tied to the intended PC node.
• Evidence shows restart, reload, token rotation, Gateway config mutation, Nginx edit, Docker edit, bind mount change, image change, service-state mutation, or frozen website output change.

Acceptance

VPS_VERIFIER may mark T10 accepted only after non-secret evidence is sufficient. ORCHESTRATOR decides whether VPS-side G2 is ready to count toward G2 completion.