Pin the software boundary.
Install the exact agreed OpenClaw and Node versions under a dedicated non-sudo runtime account, with owned private state and explicit paths.
Fresh-host OpenClaw hardening · Ubuntu 24.04
One hardened OpenClaw VPS in 12 active hours—or the full fee back.
A fixed trial for one buyer-owned, fresh, pre-production Ubuntu 24.04 VPS. Hardening completion requires all five runtime-required deliverables: a redacted evidence report, a repeatable full runbook, a short screen recording, an exact version inventory, and the working hardened accepted host. Separate tested provider-console recovery proof and usable snapshot or equivalent rollback proof are also required. After fit and written-scope acceptance, payment is exactly 1,000.000000 native USDC on Base Mainnet only; card payment is unavailable.
No payment or account is required to submit. Do not put credentials, private hostnames, IP addresses, or customer data in the public intake.
Exact versions pinnedOpenClaw and Node recorded
Runtime isolateddedicated non-sudo identity
Gateway kept privateloopback RPC with authentication
Recovery + rollback provedprovider console, snapshot, reboot, external validation
The fixed implementation
Harden the host, the service boundary, and the handoff.
The written scope freezes exact versions, selected controls, accepted
warnings, and acceptance matrix
v1
before payment. Matrix v1 is fixed at SHA-256
b306dc0a81e8dcea0fba14f266c2d031453ed50b9d540dbe3e6ec6c52efaba48.
Work begins on a fresh host with no production data, credentials, or
traffic.
Keep RPC local and authenticated.
Bind the OpenClaw gateway to loopback, require authentication, and run it through a hardened systemd unit that recovers after boot without exposing the RPC listener publicly.
Restrict administrative access.
Configure key-only SSH, the agreed host and provider firewalls, and agreed abuse controls and monitoring without opening an unnecessary public service.
Reboot, probe, and hand off.
Use controlled reboot and external validation to prove startup recovery and listener boundaries, then return every runtime-required deliverable and the separate recovery and rollback proof.
Included in the written scope
One production-shaped host without production exposure.
- One buyer-owned fresh Ubuntu 24.04 VPS
- Exact OpenClaw and Node version pins
- Dedicated non-sudo runtime identity and private state
- Loopback-only authenticated OpenClaw RPC gateway
- Hardened systemd service and boot recovery
- Tested provider-console recovery proof and a usable snapshot or equivalent rollback proof
- Key-only SSH and root-login restriction
- Agreed host and VPS-provider firewall rules
- Agreed abuse controls and loopback-safe monitoring
- Safe secret-file or secret-store pattern without putting values in shell history, service definitions, recordings, or reports
- Controlled reboot, external checks, and redacted evidence
Explicitly excluded
No production cutover, workflow build, or fleet commitment.
- Production data, credentials, traffic, or live cutover
- Telegram, n8n, monday.com, or other workflow construction
- Domains, TLS termination, or a public reverse proxy
- OpenClaw plugins, channels, agents, models, or prompts
- Multiple hosts, templates, fleet rollout, or tenant migration
- Ongoing operations, monitoring response, or 24×7 support
- Bypassing provider controls, authorization, or platform policy
Clock start gates
The 12 active hours do not start on intake or payment alone.
Every gate below must be recorded before the delivery clock starts. Only a documented customer-controlled loss of access, approval, information, or host availability pauses the hardening clock.
Exact work is accepted and the fee is cleared.
Fit is confirmed, the written scope and exclusions are accepted, and exactly 1,000.000000 native USDC on Base Mainnet has cleared for the case; card payment is unavailable.
The agreed Ubuntu 24.04 VPS is ready.
The buyer-owned host is fresh and pre-production, with no production credentials, customer data, or live traffic.
Authorization, recovery, and rollback are ready.
Separate tested provider-console recovery proof and usable snapshot or equivalent rollback proof are both confirmed, and agreed temporary access, authorization, public keys, and required non-secret materials are available.
The agreed result can be tested.
Versions, selected alternatives, accepted warnings, listeners, firewall boundaries, reboot recovery, and every matrix-v1 pass criterion are frozen, observable, and testable.
Full-fee outcome guarantee
Working hardened host and evidence pack—or a full refund.
Hardening completion requires all five runtime-required deliverables:
a redacted evidence report, a repeatable full runbook, a short screen
recording, an exact version inventory, and the working hardened
accepted host. Separate tested provider-console recovery proof and
usable snapshot or equivalent rollback proof are also required. If
that complete outcome is not delivered within the applicable 12
active hours, the full service fee is refunded. A generic
remediation report is not a substitute for this trial outcome.
The clock starts only after cleared payment, exact written scope,
fresh-host readiness, tested provider-console recovery and usable
snapshot or equivalent rollback, agreed temporary access and
authorization, required materials, and the frozen matrix-v1
acceptance criteria are all in place. Only a documented
customer-controlled loss of required access, information, approval,
or host availability pauses the hardening clock.
A third-party outage does not pause the active hardening clock or
void the guarantee. If it prevents complete delivery by the active
deadline, Agent Rescue Desk initiates a refund of exactly
1,000.000000 native USDC on Base Mainnet to the independently
verified original payer within two hours after that missed
deadline. Agent Rescue Desk pays the refund gas; it is not deducted
from the 1,000.000000 native USDC. Base congestion,
reorganization, or another network-finality delay after timely
initiation may delay confirmation, but does not cancel, reduce, or
replace the refund obligation. The private case receives the
transaction hash and finality evidence.
Free read-only screening
The auditor helps define the gates; it does not certify the host.
The free OpenClaw VPS Readiness Auditor is a read-only local screening tool. Its automated classifications do not prove provider-firewall state, authorization, a successful reboot, or a complete handoff. It is not a security certification and its synthetic validation artifacts are not claims of prior client work.
Payment is case-bound
Fit and written scope come before payment instructions.
Submit a secret-free fit review first. If the fresh-host trial is accepted, its private case records the only payment instruction: exactly 1,000.000000 native USDC on Base Mainnet only; card payment is unavailable. No payment request means no accepted engagement.
Secret-free fit review available
Bring one fresh host, one exact boundary, and one testable finish line.
Describe the host provider, intended OpenClaw role, agreed versions, allowed SSH source range, and acceptance target without submitting credentials or private infrastructure details. Access is arranged privately only after scope acceptance.