openclaw-control-plane/evidence/verify-vps-baseline-20260515.md

VPS Baseline Verification - 2026-05-15

Owner: VPS_VERIFIER Task: T6-VPS-baseline-verify Mode: read-only independent review

Inputs Reviewed

• AGENT_BOARD.md
• .cursor/rules/agent-orchestration.mdc
• handoff/VPS_VERIFIER.md
• handoff/VPS_EXECUTOR.md
• tasks/T6-VPS-baseline-verify.md
• tasks/T4-VPS-baseline.md
• evidence/vps-baseline-20260515.md

Read-Only Checks Performed

• git pull returned Already up to date.
• Repository status remained clean on main...origin/main before verifier evidence was written.
• Docker container state was inspected for openclaw-gateway, nginx-proxy, gitea, confluence, and postgres_conf.
• Gateway health was checked inside openclaw-gateway with Node fetch against http://127.0.0.1:18789/healthz.
• Nginx mounted config directory and generated config output were inspected without reload.
• Public HTTPS endpoints were status-checked without content edits.
• OpenClaw CLI availability was checked with --version and command --help only.
• Evidence and handoff text were scanned for secret-indicator terms.

Findings

• Gateway is running and healthy on services_appnet; health endpoint returned 200 {"ok":true,"status":"live"}.
• Docker stack coexistence is intact at verification time:
  • openclaw-gateway is running and healthy with no host port published.
  • nginx-proxy is running with host ports 80 and 443 published.
  • gitea is running with container port 3000 and host SSH port 2222.
  • confluence is running with container ports 8090-8091.
  • postgres_conf is running and healthy with container port 5432.
• Endpoint checks matched executor evidence:
  • https://smartmotor.cloud/ returned 200.
  • https://git.smartmotor.cloud/ returned 200.
  • https://wiki.smartmotor.cloud/ returned 302 to login.
  • https://openclaw.smartmotor.cloud/ returned 200.
• OpenClaw CLI is not on the VPS host PATH, but is available inside openclaw-gateway via node openclaw.mjs.
• node openclaw.mjs devices approve --help, nodes pending --help, and nodes approve --help succeeded.
• No approval, pending-node listing, restart, reload, token rotation, or config mutation command was executed during verification.
• Secret scan found only policy/negative/planning references to password, token, private key, API key, or OPENCLAW_GATEWAY_TOKEN; no secret value was identified in the reviewed task, handoff, or evidence files.

Confirmed Baseline Observations

• The executor-reported path difference is real:
  • /opt/service does not exist.
  • /opt/services exists.
  • /opt/services/docker-composite.yml does not exist.
  • /opt/services/docker-compose.openclaw.yml exists.
• The executor-reported Nginx route anomaly is real:
  • /etc/nginx/conf.d inside nginx-proxy is empty.
  • nginx -T output contained no openclaw.smartmotor.cloud, proxy_pass, or server_name matches.
  • Public endpoints still returned expected HTTP status codes.

Frozen Website Rule

• No homepage content, linked page content, static asset, Nginx route file, bind mount, container image, service state, or Docker compose entry was changed by this verifier.
• The reviewed executor evidence also states no restart, reload, approval, token rotation, image change, bind mount change, Nginx route edit, or Docker compose edit was performed.
• Current evidence is sufficient to treat the smartmotor.cloud freeze as not touched during T4/T6 baseline review.

Verdict

VPS baseline evidence is accepted for G1/T6 with follow-up observations, not blockers:

• Track the /opt/service versus /opt/services and docker-composite.yml versus docker-compose.openclaw.yml naming drift before any future mutation task.
• Investigate the Nginx route/config anomaly in a later read-only correction pass before changing routing.

No VPS configuration changes are approved by this verifier evidence.