openclaw-control-plane/handoff/VPS_EXECUTOR.md

VPS_EXECUTOR Handoff

Role

Operate only on the VPS side: /opt/services, OpenClaw Gateway, Docker stack, Nginx, Gitea, Confluence, Postgres, and Gateway-side approval workflows.

Allowed Work

• Read VPS service state.
• Run harmless diagnostic commands.
• Capture evidence under evidence/vps-*.
• Prepare rollback notes under rollback/vps-* before service or config changes.

Not Allowed

• Do not request or store plaintext VPS passwords.
• Do not rotate or print secrets unless explicitly authorized by the user.
• Do not change the smartmotor.cloud website during filing review: homepage content, linked content reachable from the homepage, static assets, routes, bind mounts, container images, Nginx rules, /opt/services/docker-compose.openclaw.yml, or any equivalent compose/service entries that affect public website output are frozen.
• Do not restart production-facing services without an approved rollback note.
• Do not mark VPS work as accepted without verifier review.

Current State

• VPS public IP: 114.132.222.127.
• OpenClaw Gateway is already deployed and coexists with the existing Docker stack.
• The VPS service workspace path is /opt/services.
• The VPS control-plane path is /home/ubuntu/openclaw-control-plane.
• Gitea control-plane repository: https://git.smartmotor.cloud/wangzhendong/openclaw-control-plane.git.

Next Read-Only Task

After the Gitea control plane is synchronized, collect current VPS baseline evidence:

• Git/Gitea repository availability for the control plane.
• OpenClaw Gateway process or container status.
• Nginx route for openclaw.smartmotor.cloud.
• Whether openclaw devices approve, openclaw nodes pending, and openclaw nodes approve are available.

Last Update

2026-05-21 T10A read-only Gateway pending/online status check completed.

• Evidence written to evidence/vps-g2-pending-status-20260521.md.
• Latest git pull completed before checking.
• Read-only commands used: Gateway nodes --help, devices --help, nodes pending/list/status --help, nodes pending/list/status --json, devices list --help, and devices list --json.
• Result for desktop-vuor0gs: not visible as pending, paired, online, or approved in Gateway node status output.
• Gateway node summary: no pending node requests, no paired nodes, no known nodes.
• Device summary: no pending device pairing requests.
• No non-secret request ID or pending node ID was found for desktop-vuor0gs; no VPS approval target is available.
• T10 should remain blocked unless ORCHESTRATOR opens a new path with a specific non-secret target.
• No approval, restart, reload, token rotation, config edit, Nginx edit, Docker/compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
• No token/password/secret value was requested, supplied, recorded, or stored.

2026-05-19 fresh second G2 authorization recorded, but T10 remains blocked until T9 evidence exists.

• T10 is blocked and must not be claimed or executed.
• Do not run openclaw devices approve, openclaw nodes pending, or openclaw nodes approve for G2 until T9 provides a matching non-secret pairing request ID or pending node ID and ORCHESTRATOR opens T10.
• Do not approve any pairing request before T10 is opened.
• Do not request, print, record, rotate, or store any token/password/secret.
• Do not restart/reload services, change Gateway config, edit Nginx, edit Docker/compose/bind mounts/images, change service state, or alter frozen smartmotor.cloud website output.
• After T10 is opened later, approve only the intended PC request/node that matches T9 evidence and display name, with rollback note first.