68 lines
2.7 KiB
Markdown
68 lines
2.7 KiB
Markdown
# T10 - G2 VPS Pairing Approval
|
|
|
|
## Status
|
|
|
|
blocked
|
|
|
|
## Owner
|
|
|
|
VPS_EXECUTOR
|
|
|
|
## Dependencies
|
|
|
|
- T9 produces a non-secret pairing request ID or pending node ID
|
|
- Fresh user authorization after role-misdirection correction
|
|
- CORRECTION confirms sync-health is not blocked
|
|
|
|
## Scope
|
|
|
|
Approve the intended PC node/device pairing on the VPS Gateway side.
|
|
|
|
This task does not authorize service restarts, reloads, token rotation, Gateway configuration changes, Nginx changes, Docker compose edits, bind mount changes, image changes, or public website changes.
|
|
|
|
## Planning Status
|
|
|
|
- G2 pre-execution plan is documented in `docs/G2_RUNBOOK.md`.
|
|
- Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared.
|
|
- Role-misdirection audit on 2026-05-19 paused G2 execution.
|
|
- This task must not be claimed or executed until ORCHESTRATOR records fresh explicit user authorization after the correction and T9 later produces a matching non-secret request/node ID.
|
|
- `docs/G2_RUNBOOK.md` remains the planned procedure, but it does not authorize VPS approval by itself.
|
|
|
|
## Required Evidence
|
|
|
|
- `rollback/vps-g2-approve-YYYYMMDD.md` written before approval action.
|
|
- Confirmation that request identity matched the PC evidence and display name.
|
|
- Exact command shape used, without secrets.
|
|
- Approval result summary.
|
|
- Confirmation that no restart, reload, token rotation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
|
|
- Evidence written to `evidence/vps-g2-approve-YYYYMMDD.md`.
|
|
- `handoff/VPS_EXECUTOR.md` updated.
|
|
|
|
## Command Drafts
|
|
|
|
Do not run these until T9 evidence provides a matching non-secret request/node ID. Approval must target only the intended PC pairing.
|
|
|
|
```bash
|
|
docker exec openclaw-gateway node openclaw.mjs nodes pending
|
|
docker exec openclaw-gateway node openclaw.mjs devices approve <requestId>
|
|
docker exec openclaw-gateway node openclaw.mjs nodes approve <nodeId>
|
|
```
|
|
|
|
## Expected Output
|
|
|
|
- The intended PC device/node is approved.
|
|
- Gateway shows the PC node online or approved.
|
|
- Evidence contains only non-secret request IDs or node IDs.
|
|
|
|
## Stop Conditions
|
|
|
|
- Fresh user authorization after the role-misdirection correction is absent or ambiguous.
|
|
- `docs/G2_RUNBOOK.md` has not been read by VPS_EXECUTOR.
|
|
- Request identity is ambiguous or multiple indistinguishable pending requests exist.
|
|
- A command asks for or prints a token/password.
|
|
- Approval would require restart, reload, token rotation, config mutation, Nginx changes, Docker changes, or any action that could affect frozen `smartmotor.cloud` website output.
|
|
|
|
## Acceptance
|
|
|
|
VPS_VERIFIER must review this evidence before ORCHESTRATOR can count the VPS half of G2 as accepted.
|