62 lines
3.6 KiB
Markdown
62 lines
3.6 KiB
Markdown
# VPS_EXECUTOR Handoff
|
|
|
|
## Role
|
|
|
|
Operate only on the VPS side: `/opt/services`, OpenClaw Gateway, Docker stack, Nginx, Gitea, Confluence, Postgres, and Gateway-side approval workflows.
|
|
|
|
## Allowed Work
|
|
|
|
- Read VPS service state.
|
|
- Run harmless diagnostic commands.
|
|
- Capture evidence under `evidence/vps-*`.
|
|
- Prepare rollback notes under `rollback/vps-*` before service or config changes.
|
|
|
|
## Not Allowed
|
|
|
|
- Do not request or store plaintext VPS passwords.
|
|
- Do not rotate or print secrets unless explicitly authorized by the user.
|
|
- Do not change the `smartmotor.cloud` website during filing review: homepage content, linked content reachable from the homepage, static assets, routes, bind mounts, container images, Nginx rules, `/opt/services/docker-compose.openclaw.yml`, or any equivalent compose/service entries that affect public website output are frozen.
|
|
- Do not restart production-facing services without an approved rollback note.
|
|
- Do not mark VPS work as accepted without verifier review.
|
|
|
|
## Current State
|
|
|
|
- VPS public IP: `114.132.222.127`.
|
|
- OpenClaw Gateway is already deployed and coexists with the existing Docker stack.
|
|
- The VPS service workspace path is `/opt/services`.
|
|
- The VPS control-plane path is `/home/ubuntu/openclaw-control-plane`.
|
|
- Gitea control-plane repository: `https://git.smartmotor.cloud/wangzhendong/openclaw-control-plane.git`.
|
|
|
|
## Next Read-Only Task
|
|
|
|
After the Gitea control plane is synchronized, collect current VPS baseline evidence:
|
|
|
|
- Git/Gitea repository availability for the control plane.
|
|
- OpenClaw Gateway process or container status.
|
|
- Nginx route for `openclaw.smartmotor.cloud`.
|
|
- Whether `openclaw devices approve`, `openclaw nodes pending`, and `openclaw nodes approve` are available.
|
|
|
|
## Last Update
|
|
|
|
2026-05-21 T10A read-only Gateway pending/online status check completed.
|
|
|
|
- Evidence written to `evidence/vps-g2-pending-status-20260521.md`.
|
|
- Latest `git pull` completed before checking.
|
|
- Read-only commands used: Gateway `nodes --help`, `devices --help`, `nodes pending/list/status --help`, `nodes pending/list/status --json`, `devices list --help`, and `devices list --json`.
|
|
- Result for `desktop-vuor0gs`: not visible as pending, paired, online, or approved in Gateway node status output.
|
|
- Gateway node summary: no pending node requests, no paired nodes, no known nodes.
|
|
- Device summary: no pending device pairing requests.
|
|
- No non-secret request ID or pending node ID was found for `desktop-vuor0gs`; no VPS approval target is available.
|
|
- T10 should remain blocked unless ORCHESTRATOR opens a new path with a specific non-secret target.
|
|
- No approval, restart, reload, token rotation, config edit, Nginx edit, Docker/compose edit, bind mount change, image change, service-state mutation, or frozen website output change was performed.
|
|
- No token/password/secret value was requested, supplied, recorded, or stored.
|
|
|
|
2026-05-19 fresh second G2 authorization recorded, but T10 remains blocked until T9 evidence exists.
|
|
|
|
- T10 is blocked and must not be claimed or executed.
|
|
- Do not run `openclaw devices approve`, `openclaw nodes pending`, or `openclaw nodes approve` for G2 until T9 provides a matching non-secret pairing request ID or pending node ID and ORCHESTRATOR opens T10.
|
|
- Do not approve any pairing request before T10 is opened.
|
|
- Do not request, print, record, rotate, or store any token/password/secret.
|
|
- Do not restart/reload services, change Gateway config, edit Nginx, edit Docker/compose/bind mounts/images, change service state, or alter frozen `smartmotor.cloud` website output.
|
|
- After T10 is opened later, approve only the intended PC request/node that matches T9 evidence and display name, with rollback note first.
|