openclaw-control-plane/tasks/T9-G2-PC-node-run.md

T9 - G2 PC Foreground Node Run

Status

ready

Owner

PC_EXECUTOR

Dependencies

• G0A complete
• G0B complete
• G1 accepted
• Fresh user authorization after role-misdirection correction
• CORRECTION confirms sync-health is not blocked

Scope

Prepare the Windows PC OpenClaw node foreground pairing flow, with the user running token setup and openclaw node run manually in a dedicated local PowerShell terminal.

This task is not ready until ORCHESTRATOR records explicit user authorization for G2. It does not authorize service installation, startup persistence, firewall changes, network changes, or any public port exposure.

Planning Status

• G2 pre-execution plan is documented in docs/G2_RUNBOOK.md.
• Sync-health has been confirmed healthy and T7 sync-health blocked state is cleared.
• Fresh second G2 authorization was recorded by ORCHESTRATOR on 2026-05-19 for target window ORCHESTRATOR in D:\openclaw-control-plane.
• This task is ready for PC_EXECUTOR under docs/G2_RUNBOOK.md.
• Authorization covers only user-run local-session token use without disclosure and user-run foreground openclaw node run; it does not authorize Agent-shell token use, service changes, firewall changes, network changes, persistence, public port exposure, G3 smoke testing, or G4 service setup.

Execution Model - 2026-05-19 17:05 UTC+8

• ORCHESTRATOR corrected T9 to use a user-run local terminal model.
• PC_EXECUTOR must not request, read, print, record, or handle OPENCLAW_GATEWAY_TOKEN.
• PC_EXECUTOR does not need to run openclaw node run in the Agent shell.
• The user opens a dedicated local PC PowerShell terminal, sets OPENCLAW_GATEWAY_TOKEN only in that terminal, and runs the foreground node command in the same terminal.
• PC_EXECUTOR provides the command template, confirms/refreshes rollback guidance, reminds the user not to send the token to chat or files, and records only non-secret status plus any non-secret pairing request ID or pending node ID.
• T9 is ready for this user-manual token and foreground node step. T10 remains blocked until T9 produces one matching non-secret pairing request/node ID.

Blocker - 2026-05-19 15:56 UTC+8

• PC_EXECUTOR completed pre-run checks and updated rollback/pc-g2-node-run-20260519.md.
• User confirmed token setup in a local PC shell, but the Agent execution shell reported only OPENCLAW_GATEWAY_TOKEN_PRESENT=false.
• openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs" was not executed.
• No token value was read, printed, recorded, committed, or chat-sent.
• No service, scheduled task, firewall, network, environment persistence, or public-port exposure change was performed.
• Evidence: evidence/pc-g2-node-run-20260519.md.
• This prior attempt remained stopped because the token was not available in the same non-persistent local shell session that would run the foreground node.

Release - 2026-05-19 16:31 UTC+8

• ORCHESTRATOR reviewed CORRECTION's fresh T13 PASS from 2026-05-19 16:29 UTC+8.
• G2 remains authorized and In Progress.
• PC and VPS heartbeats are clean and within the 5-minute sync-health threshold.
• No sync-state/error-*.md files were observed.
• T9 is released back to ready for PC_EXECUTOR under docs/G2_RUNBOOK.md.
• PC_EXECUTOR must still set OPENCLAW_GATEWAY_TOKEN only in the same non-persistent local shell session that will run the foreground node, without printing or recording the token value.

Blocker - 2026-05-19 16:39 UTC+8

• PC_EXECUTOR refreshed rollback/pc-g2-node-run-20260519.md.
• User confirmed token setup locally, but the Agent execution shell reported OPENCLAW_GATEWAY_TOKEN_PRESENT=false.
• openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs" was not executed.
• No token value was read, printed, recorded, committed, or chat-sent.
• No service, scheduled task, firewall, network, environment persistence, public-port exposure, G3 smoke test, or G4 persistence change was performed.
• Evidence: evidence/pc-g2-node-run-20260519.md.
• This prior blocker is covered by ORCHESTRATOR's 2026-05-19 16:52 UTC+8 release after confirming G2 remains authorized, T13 PASS remains valid, current sync-health is clean, and no sync-state/error-*.md files exist.
• T9 is ready again, but PC_EXECUTOR must still ensure the token is available in the same non-persistent local shell session that will run the foreground node, without printing or recording the token value.

Blocker - 2026-05-19 16:55 UTC+8

• PC_EXECUTOR refreshed rollback/pc-g2-node-run-20260519.md.
• User confirmed token setup locally, but the Agent execution PowerShell session reported OPENCLAW_GATEWAY_TOKEN_PRESENT=false.
• openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs" was not executed.
• No token value was read, printed, recorded, committed, or chat-sent.
• No service, scheduled task, firewall, network, environment persistence, public-port exposure, G3 smoke test, or G4 persistence change was performed.
• Evidence: evidence/pc-g2-node-run-20260519.md.
• This blocker is covered by the 2026-05-19 17:05 UTC+8 execution-model correction: the token is expected to remain only in the user's dedicated local PowerShell terminal, not in the Agent shell.
• T9 is ready again for PC_EXECUTOR to guide the user-run local terminal flow without handling the token.

Required Evidence

• rollback/pc-g2-node-run-YYYYMMDD.md confirmed or refreshed before user token or node-run action.
• Confirmation that PC_EXECUTOR provided the user command template and warned the user not to send the token to chat/files.
• Confirmation that the user reported OPENCLAW_GATEWAY_TOKEN was set only in a dedicated local PC PowerShell terminal and that the token value was not printed or recorded.
• Exact foreground node command template used, without secrets.
• Non-secret connection status summary and non-secret pairing request ID or pending node ID if shown.
• Confirmation that no openclaw node install, start, restart, stop, uninstall, firewall, network, scheduled task, environment persistence, or public-port exposure change was performed.
• Evidence written to evidence/pc-g2-node-run-YYYYMMDD.md.
• handoff/PC_EXECUTOR.md updated.

Command Drafts

Authorized only within docs/G2_RUNBOOK.md and only for the user to run in a dedicated local PC PowerShell terminal. PC_EXECUTOR must not execute this in the Agent shell or record the token value.

$env:OPENCLAW_GATEWAY_TOKEN = "<user-pastes-token-locally>"
openclaw node run --host openclaw.smartmotor.cloud --port 443 --tls --display-name "desktop-vuor0gs"

Expected Output

• Foreground node process remains running.
• Logs show connection attempt to openclaw.smartmotor.cloud.
• Pairing request ID or pending node ID appears if approval is required.
• No secret value appears in evidence.

Stop Conditions

• Fresh second user authorization after role-misdirection correction is absent or ambiguous.
• docs/G2_RUNBOOK.md has not been read by PC_EXECUTOR.
• Any command asks to print, persist, or store a token.
• Any command prints a secret.
• PC_EXECUTOR is asked to receive the token, paste it into an Agent shell, or run the token-bearing flow directly.
• Any step requires PC service install/start, scheduled task changes, firewall changes, network changes, or public port exposure.
• Gateway host or display name differs from the runbook without ORCHESTRATOR review.

Acceptance

PC_VERIFIER must review this evidence before ORCHESTRATOR can count the PC half of G2 as accepted.

Session Freeze - 2026-05-19 14:46 UTC+8

• Status at freeze: ready.
• Next owner: PC_EXECUTOR.
• Single next action: claim T9, confirm or refresh rollback/pc-g2-node-run-YYYYMMDD.md, give the user the local terminal command template, and collect only non-secret status from the user-run foreground node flow in docs/G2_RUNBOOK.md.
• Do not record token values, install/start services, change firewall/network state, expose public ports, or start G3/G4 work.