Skip to main content

Security

jhf-openclaw-env owns environment and runtime guardrails for the Helpifyr OpenClaw stack. It documents how host, ingress, DNS, TLS, runtime-health, and verification paths are operated without becoming the owner of product policy, identity truth, business roles, or secret values.

Security Ownership​

This repository owns:

  • host/runtime guardrails for the OpenClaw environment
  • bounded diagnostics and recovery runbooks
  • environment-level SSO/TLS/DNS/ingress materialization contracts
  • live verification paths for the running stack
  • evidence classification for environment-owned runtime checks

This repository does not own:

  • OpenClaw application internals
  • business identity or role truth
  • secret-store product behavior
  • Fabric policy/admission truth
  • downstream module authorization decisions

Secret And Credential Handling​

Secrets, tokens, private keys, passwords, and raw .env values must never be committed or copied into documentation. Repo-owned docs may name the owner system or redacted variable name when that is required for an operator runbook, but they must not include secret values.

Use operator-owned secret stores and host-owned runtime environment files for live materialization. Evidence should cite readback commands and status, not credential payloads.

Public Documentation Safety​

Public-safe docs may describe stable roles, boundaries, and verification commands. They must not publish:

  • raw local workstation paths
  • unredacted host-only filesystem paths unless required for operator runbooks
  • private customer or business data
  • incident evidence with sensitive payloads
  • internal scratchpad notes
  • unfinished plans as implemented product truth

Operator-only material must stay redacted before it is admitted into public manufacturer docs.

Runtime Guardrails​

Runtime diagnostics must stay bounded and low-pressure:

  • use bounded log reads with --since, --tail, and timeouts
  • do not run unbounded docker logs -f
  • verify idempotent reruns for critical reconcile paths
  • secret-admission diagnostics may report only declared allowlisted key-presence booleans; they must not inventory environment keys or render secret values
  • avoid tight restart loops
  • use the runtime-owner host readback before claiming runtime state

The live host and operator identity remain owner-only runtime truth. Public release-facing documents must not depend on private host coordinates to explain the security posture. Do not infer runtime state from repository files alone.

Verification​

Recommended repo-local checks:

python scripts/validate_docs_platform_v1_6.py

Recommended runtime checks depend on the issue scope and must use the repo-owned verifier named by the relevant runbook or feature entry.

License: AGPLv3 Project: https://helpifyr.com