A hardened gateway is not done until every boundary has evidence.

Freeze the paid-trial acceptance boundary

For a paid fresh-host hardening case, copy matrix contract openclaw-vps-hardening-acceptance-matrix/v1 and SHA-256 b306dc0a81e8dcea0fba14f266c2d031453ed50b9d540dbe3e6ec6c52efaba48 into the exact written scope before payment. Freeze the exact versions, selected SSH abuse-control path, selected health/alert path, selected secret-storage mechanism, every accepted non-critical warning, every evidence owner, every pass/fail probe, and every deliverable. Tested provider-console recovery and a usable snapshot or equivalent rollback are both required.

Only a documented customer-controlled loss of required access, information, approval, or host availability pauses the hardening clock. A third-party outage does not pause the active clock or void the guarantee. If complete delivery misses the active deadline, Agent Rescue Desk initiates a refund of exactly 1,000.000000 native USDC on Base Mainnet to the independently verified original payer within two hours after the missed active deadline, pays the refund gas without reducing the amount returned, and records the transaction plus network-finality evidence. A network-finality delay after timely initiation does not cancel, reduce, or replace that obligation.

Paid hardening completion and payment contract

Fresh-host hardening payment is exactly 1,000.000000 native USDC on Base Mainnet only; card payment is unavailable.

Hardening completion requires all five runtime-required deliverables: a redacted evidence report, a repeatable full runbook, a short screen recording, an exact version inventory, and the working hardened accepted host. Separate tested provider-console recovery proof and usable snapshot or equivalent rollback proof are also required.

Install directly with npm—no registry account required

npm install --global 'https://agent-rescue-desk.netlify.app/download/openclaw-vps-readiness-auditor?source=acceptance-page'
npm explore --global openclaw-vps-readiness-auditor -- npm run verify

AUDITOR_PACKAGE_DIR="$(npm root --global)/openclaw-vps-readiness-auditor"
less "$AUDITOR_PACKAGE_DIR/SKILL.md"
sha256sum -c "$AUDITOR_PACKAGE_DIR/scripts/openclaw-vps-readiness-check.sh.sha256"

The measured route records only a bounded source label, timestamp, and broad browser, crawler, or unknown classification before redirecting to the immutable tarball. It stores no IP address, user-agent string, referrer, email, or package input. A request is anonymous reach—not proof of an install, lead, buyer, or sale.

Or verify, unpack, and install the portable skill ZIP

curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-auditor-v2.0.0.zip
curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-auditor-v2.0.0.zip.sha256
sha256sum -c openclaw-vps-readiness-auditor-v2.0.0.zip.sha256
unzip -l openclaw-vps-readiness-auditor-v2.0.0.zip
unzip openclaw-vps-readiness-auditor-v2.0.0.zip
openclaw skills install ./openclaw-vps-readiness-auditor

Inspect SKILL.md and the checker before installation. The skill changes no host state; it keeps automated evidence separate from manual provider-firewall, deep-audit, reboot, and handoff gates.

The previously published version 1.0.0 npm tarball and skill ZIP remain byte-identical at their original immutable URLs.

Run only the reviewed checker on the trial host

curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-check.sh
curl -O https://agent-rescue-desk.netlify.app/openclaw-vps-readiness-check.sh.sha256
sha256sum -c openclaw-vps-readiness-check.sh.sha256
less openclaw-vps-readiness-check.sh

sudo bash openclaw-vps-readiness-check.sh \
  --runtime-user openclaw \
  --openclaw-bin /home/openclaw/.local/bin/openclaw \
  --unit-scope user \
  --unit openclaw-gateway.service \
  --admin-user operator \
  --admin-source 203.0.113.10 \
  --ssh-abuse-control both \
  --health-monitor netdata

Substitute the actual dedicated account and user-local paths. Root is required only so the script can read effective host and service state; the script contains no package installer, firewall mutation, service mutation, remote probe, credential prompt, or eval. It requires Ubuntu's unshare utility to isolate non-RPC OpenClaw CLI reads from the network. After proving loopback bind, shared-secret auth, and no remote target, it performs one authenticated local gateway status --deep --json --require-rpc probe. Do not run code fetched from the internet with sudo until you have inspected it.

Gate 1: isolate the runtime before testing the agent

Gate 2: prove SSH policy and effective exposure

1. sshd -T -C for the intended admin/source enables public keys and disables password, keyboard-interactive, host-based, GSSAPI, Kerberos, and empty-password authentication.
2. The root context disables root login, and SSH uses this contract's agreed TCP 22.
3. UFW is active, default-deny, and restricts SSH to the declared admin source; the effective nftables input hook is also default-deny.
4. No non-loopback TCP listener exists except an sshd-owned port 22.
5. The VPS-provider firewall separately exposes only the agreed SSH source range. The local checker cannot prove provider-console state.

Keep a live recovery session or provider console until a fresh key-only login works. Record host and provider firewall evidence, then run an external port probe from the agreed source. Verify UDP and private-network exposure separately.

Gate 3: keep the OpenClaw gateway local and authenticated

The automated report requires valid config, a clean secrets audit, gateway.bind: "loopback", token or password auth, no non-loopback remote target, and successful authenticated read-scope RPC. trusted-proxy is outside this loopback-and-SSH-tunnel contract.

# Run as the dedicated OpenClaw account after the host checker.
openclaw doctor
openclaw security audit
openclaw security audit --deep
openclaw health

Resolve every critical audit finding. Document each intentionally accepted warning by its checkId. The downloadable checker runs the bounded local RPC status probe but deliberately leaves doctor and deep security audit as explicit operator actions.

Gate 4: prove restart behavior without putting secrets in systemd

• Exactly one declared OpenClaw unit exists across effective user and system managers; it is active and enabled.
• A user unit has lingering enabled; a system unit effectively runs as the dedicated account.
• Effective ExecStart uses the declared install, and the active process uses the declared state/config paths.
• Canonical effective properties include Restart=always, RestartPreventExitStatus=78, nonzero restart/start-limit/timeouts, OOMPolicy=continue, and KillMode=control-group.
• No secret-shaped value appears in effective Environment= or ExecStart=, and openclaw secrets audit --check is clean.
• Any dotenv fallback is a nonsymlink 0600 file with ownership appropriate to the unit scope.

Review shell history locally and record only “clear” or “not clear.” Never paste history or an environment file into a ticket, recording, chat, or acceptance report. Prefer supported OpenClaw SecretRefs. Ordinary systemd environment variables are not a secret store.

Gate 5: buyer-selected monitoring must prove function

Declare one SSH abuse-control path—fail2ban, CrowdSec, or both—and one health/alert path such as Netdata or an accepted custom alternative. These are buyer scope, not OpenClaw requirements. Active services are only a screen: final acceptance also needs a controlled functional test, alert delivery and ownership, retention, off-host data disclosure, and reboot recovery.

Netdata must remain loopback-only. If CrowdSec and UFW are combined, document effective rule ordering and enforcement instead of assuming two active services compose safely.

Gate 6: reboot into application readiness

After a controlled reboot, prove the same versions, binary, state path, config path, and unit returned without an interactive shell. Rerun the screen, then run openclaw gateway status --deep --json --require-rpc and openclaw health --json. If channels are in scope, run openclaw channels status --probe; a config-only fallback is not a pass.

Final handoff: evidence someone else can repeat

1. Exact Ubuntu, Node, OpenClaw, and monitoring versions, package integrity, and the exact version-pinned install command used before installation.
2. Redacted systemd, firewall, listener, audit, health, and reboot evidence.
3. A concise architecture and trust-boundary note.
4. Disabled automatic update application during acceptance, plus backup, upgrade, rollback, credential-rotation, and access-removal steps.
5. A narrated screen recording of the important checks with no secret values, customer data, public IP, or reusable credential visible.
6. A completed matrix-v1 gate and evidence inventory.

“Service is running” is not acceptance. The handoff passes when a second operator can identify what is exposed, reproduce the validation, and reverse the change without guessing.

A zero checker exit means only that the automated screen has no failure or unresolved warning. Final acceptance remains INCOMPLETE until every manual gate has evidence.

Official OpenClaw references

• Security model, audit, loopback and authentication guidance ↗
• Security audit check IDs and severities ↗
• Gateway exposure preflight and rollback runbook ↗
• Linux VPS, SSH tunnel, and systemd guidance ↗
• Read-only redacted configuration queries ↗