T10 - G2 VPS Pairing Approval

Status

draft

Owner

VPS_EXECUTOR

Dependencies

T9 produces a non-secret pairing request ID or pending node ID
User explicitly authorizes VPS-side approval
CORRECTION confirms sync-health is not blocked

Scope

Approve the intended PC node/device pairing on the VPS Gateway side.

This task does not authorize service restarts, reloads, token rotation, Gateway configuration changes, Nginx changes, Docker compose edits, bind mount changes, image changes, or public website changes.

Planning Status

G2 pre-execution plan is documented in docs/G2_RUNBOOK.md.
Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared.
User authorized G2 on 2026-05-19 for foreground PC node run and corresponding VPS pairing approval only.
This task remains draft until T9 produces a non-secret pairing request ID or pending node ID that can be matched to the intended PC node.
Authorization covers only the corresponding pairing approval after T9 evidence exists; it does not authorize service restarts/reloads, token rotation, Gateway config mutation, Nginx changes, Docker changes, or frozen website changes.

Required Evidence

rollback/vps-g2-approve-YYYYMMDD.md written before approval action.
Confirmation that request identity matched the PC evidence and display name.
Exact command shape used, without secrets.
Approval result summary.
Confirmation that no restart, reload, token rotation, Nginx route edit, Docker compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
Evidence written to evidence/vps-g2-approve-YYYYMMDD.md.
handoff/VPS_EXECUTOR.md updated.

Command Drafts

Do not run these until T9 evidence provides a matching non-secret request/node ID. Approval must target only the intended PC pairing.

docker exec openclaw-gateway node openclaw.mjs nodes pending
docker exec openclaw-gateway node openclaw.mjs devices approve <requestId>
docker exec openclaw-gateway node openclaw.mjs nodes approve <nodeId>

Expected Output

The intended PC device/node is approved.
Gateway shows the PC node online or approved.
Evidence contains only non-secret request IDs or node IDs.

Stop Conditions

User authorization is absent or ambiguous.
docs/G2_RUNBOOK.md has not been read by VPS_EXECUTOR.
Request identity is ambiguous or multiple indistinguishable pending requests exist.
A command asks for or prints a token/password.
Approval would require restart, reload, token rotation, config mutation, Nginx changes, Docker changes, or any action that could affect frozen smartmotor.cloud website output.

Acceptance

VPS_VERIFIER must review this evidence before ORCHESTRATOR can count the VPS half of G2 as accepted.

2.8 KiB Raw Blame History