openclaw-control-plane/handoff/VPS_EXECUTOR.md

VPS_EXECUTOR Handoff

Role

Operate only on the VPS side: /opt/service, OpenClaw Gateway, Docker stack, Nginx, Gitea, Confluence, Postgres, and Gateway-side approval workflows.

Allowed Work

• Read VPS service state.
• Run harmless diagnostic commands.
• Capture evidence under evidence/vps-*.
• Prepare rollback notes under rollback/vps-* before service or config changes.

Not Allowed

• Do not request or store plaintext VPS passwords.
• Do not rotate or print secrets unless explicitly authorized by the user.
• Do not change the smartmotor.cloud website during filing review: homepage content, linked content reachable from the homepage, static assets, routes, bind mounts, container images, Nginx rules, or /opt/services/docker-composite.yml entries that affect public website output are frozen.
• Do not restart production-facing services without an approved rollback note.
• Do not mark VPS work as accepted without verifier review.

Current State

• VPS public IP: 114.132.222.127.
• OpenClaw Gateway is already deployed and coexists with the existing Docker stack.
• The VPS service workspace path is /opt/service.
• The VPS control-plane path is /home/ubuntu/openclaw-control-plane.
• Gitea control-plane repository: https://git.smartmotor.cloud/wangzhendong/openclaw-control-plane.git.

Next Read-Only Task

After the Gitea control plane is synchronized, collect current VPS baseline evidence:

• Git/Gitea repository availability for the control plane.
• OpenClaw Gateway process or container status.
• Nginx route for openclaw.smartmotor.cloud.
• Whether openclaw devices approve, openclaw nodes pending, and openclaw nodes approve are available.

Last Update

2026-05-15 VPS baseline discovery completed for T4.

• Evidence written to evidence/vps-baseline-20260515.md.
• Discovery was read-only: no restart, reload, approval, token rotation, config edit, route edit, image change, bind mount change, or website content change was performed.
• /opt/service was not present; /opt/services is the active service workspace.
• /opt/services/docker-composite.yml was not present; /opt/services/docker-compose.openclaw.yml exists for OpenClaw Gateway.
• openclaw-gateway container is running and healthy; local /healthz returned 200 with live status.
• Docker stack high-level status: nginx-proxy, gitea, confluence, postgres_conf, and openclaw-gateway are running; postgres_conf and openclaw-gateway report healthy.
• Host PATH does not include openclaw; the Gateway container CLI is available via node openclaw.mjs.
• devices approve, nodes pending, and nodes approve help commands are available in the Gateway container. No approval command was executed beyond --help.
• Baseline note for VPS_VERIFIER: HTTPS endpoints respond, but /opt/services/nginx/conf.d is empty and nginx -T did not show server_name or proxy_pass route lines. Please verify whether this reflects expected Nginx state or route/config drift.

Waiting for VPS_VERIFIER review. VPS_EXECUTOR did not self-accept the work.