Summary of coordinated actions (2026-02-14)

Purpose: Prepare OpenClaw environment so openclaw-expert (Mike) can reliably run repairs and `openclaw doctor --fix`.

What I accomplished:
- Created idempotent installer script: scripts/install-cli-tools.sh
  - Installs ripgrep (rg), jq, gh, Node (18 LTS) and pnpm via npm. Verifies presence.
- Created gateway service helper and entrypoint:
  - scripts/fix-gateway-service.sh: generates suggested systemd unit and prints sudo commands to apply it and ensure single instance.
  - scripts/gateway-entrypoint.sh: wrapper that sets PATH (includes /usr/local/bin and node_modules/.bin) and starts gateway using available entrypoint.
- Created docs indexing script: scripts/build-doc-index.sh
  - Uses rg to produce docs JSON index and sqlite3 to build an FTS table if sqlite3 present.
- Committed scripts to repo.

Findings / current state:
- Gateway runtime files in repo: gateway/ (contains tls/). No explicit systemd unit found inside repo. .openclaw contains openclaw.json and workspace files.
- Unable to inspect systemd units or running services from this environment; commands to manage services are provided but must be run with sudo by a human.

Risk assessment and order of operations (Dev-gandalf):
1) Permissions: ensure systemd unit runs as 'openclaw2' (or configured service user). Confirm ownership of /home/openclaw2/openclaw2 and adjust with sudo chown -R if needed. Risk: wrong owner can allow privilege escalation or fail to start. Mitigation: verify before chown.
2) Service unit fixes: provide a safe service file that sets PATH and a wrapper entrypoint. Risk: incorrect ExecStart may leave service down. Mitigation: service is disabled until enabled; test with systemctl start and check logs.
3) Tokens / pairing: verify credentials in credentials/ and .openclaw/identity. Do not overwrite tokens. Risk: accidental token rotation; Mitigation: backup current files before doctor step.
4) openclaw doctor --fix: run in report-only mode first (if available) to show changes. Only apply fixes after review and backups.

Ops-harry actionable edits & sudo commands:
- Suggested systemd unit (generated by scripts/fix-gateway-service.sh). To apply as sudo:
  sudo mv ./openclaw-gateway.service.suggested /etc/systemd/system/openclaw-gateway.service
  sudo systemctl daemon-reload
  sudo systemctl enable --now openclaw-gateway.service
  sudo systemctl status openclaw-gateway.service
- To ensure single instance (run if needed):
  sudo pgrep -a -f openclaw | xargs -r sudo kill
  sudo systemctl restart openclaw-gateway.service
- If PATH issues persist, check service Environment in unit and the scripts/gateway-entrypoint.sh wrapper.

Auto-alfred: verification steps and idempotent installs:
- Run (as sudo): scripts/install-cli-tools.sh
- Non-sudo verification (can be run by CI/user): which rg jq gh node pnpm
- If npm global install fails due to permission, recommend using npm config set prefix or install pnpm via corepack: corepack enable && corepack prepare pnpm@latest --activate

Doc-inquisitor + Doc-lexicanum actions:
- Build JSON index: scripts/build-doc-index.sh (requires rg and optionally sqlite3 + python3)
- Integrate with openclaw-docs skill: copy workspace/docs-index.json into skill's expected path (./skills/openclaw-docs/data/) and restart skill or service.
- Verify sample query: rg -n "doctor --fix" docs || sqlite3 workspace/docs-index.db "SELECT path FROM docs WHERE docs MATCH 'doctor';"

Safe run plan for openclaw doctor --fix:
1) Backup current .openclaw/openclaw.json and identity/ and credentials/:
   sudo cp -a .openclaw/openclaw.json .openclaw/openclaw.json.bak
   sudo tar -czf /tmp/openclaw-credentials-backup-2026-02-14.tgz credentials .openclaw/identity
2) Run openclaw doctor in dry/report mode (if available):
   /home/openclaw2/openclaw2/node_modules/.bin/openclaw doctor --report
   (or) openclaw doctor --dry-run
3) Review report, then run with --fix and capture logs:
   /home/openclaw2/openclaw2/node_modules/.bin/openclaw doctor --fix | tee /tmp/openclaw-doctor-fix-2026-02-14.log

Commands the human must run (sudo):
- Apply service unit and start gateway:
  sudo bash scripts/fix-gateway-service.sh
  # then follow the printed commands (mv, daemon-reload, enable --now)

- Install system packages (one-liner):
  sudo bash scripts/install-cli-tools.sh

- Build docs index (after installing rg):
  bash scripts/build-doc-index.sh

- Backup secrets before doctor:
  sudo cp -a .openclaw/openclaw.json .openclaw/openclaw.json.bak
  sudo tar -czf /tmp/openclaw-credentials-backup-2026-02-14.tgz credentials .openclaw/identity

- Run doctor in report mode (non-sudo expected):
  ./node_modules/.bin/openclaw doctor --report

Notes for the main agent (Mike):
- I could not interact with systemd or install packages from this environment; the scripts and suggested commands are prepared for the human to run with sudo.
- After the human runs the sudo commands, re-run the doc indexing and doctor report and collect outputs to finalize the fix.

Files added:
- scripts/install-cli-tools.sh
- scripts/fix-gateway-service.sh
- scripts/gateway-entrypoint.sh
- scripts/build-doc-index.sh
- memory/skills-setup-2026-02-14.md (this file)

End of report.