T10 - G2 VPS Pairing Approval

Status

blocked

Owner

VPS_EXECUTOR

Dependencies

T9 produces a non-secret pairing request ID or pending node ID
Fresh user authorization after role-misdirection correction
CORRECTION confirms sync-health is not blocked

Scope

Approve the intended PC node/device pairing on the VPS Gateway side.

This task does not authorize service restarts, reloads, token rotation, Gateway configuration changes, Nginx changes, Docker compose edits, bind mount changes, image changes, or public website changes.

Planning Status

G2 pre-execution plan is documented in docs/G2_RUNBOOK.md.
Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared.
Role-misdirection audit on 2026-05-19 paused G2 execution.
This task must not be claimed or executed until ORCHESTRATOR records fresh explicit user authorization after the correction and T9 later produces a matching non-secret request/node ID.
docs/G2_RUNBOOK.md remains the planned procedure, but it does not authorize VPS approval by itself.

Required Evidence

rollback/vps-g2-approve-YYYYMMDD.md written before approval action.
Confirmation that request identity matched the PC evidence and display name.
Exact command shape used, without secrets.
Approval result summary.
Confirmation that no restart, reload, token rotation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
Evidence written to evidence/vps-g2-approve-YYYYMMDD.md.
handoff/VPS_EXECUTOR.md updated.

Command Drafts

Do not run these until T9 evidence provides a matching non-secret request/node ID. Approval must target only the intended PC pairing.

docker exec openclaw-gateway node openclaw.mjs nodes pending
docker exec openclaw-gateway node openclaw.mjs devices approve <requestId>
docker exec openclaw-gateway node openclaw.mjs nodes approve <nodeId>

Expected Output

The intended PC device/node is approved.
Gateway shows the PC node online or approved.
Evidence contains only non-secret request IDs or node IDs.

Stop Conditions

Fresh user authorization after the role-misdirection correction is absent or ambiguous.
docs/G2_RUNBOOK.md has not been read by VPS_EXECUTOR.
Request identity is ambiguous or multiple indistinguishable pending requests exist.
A command asks for or prints a token/password.
Approval would require restart, reload, token rotation, config mutation, Nginx changes, Docker changes, or any action that could affect frozen smartmotor.cloud website output.

Acceptance

VPS_VERIFIER must review this evidence before ORCHESTRATOR can count the VPS half of G2 as accepted.

2.7 KiB Raw Blame History