Romeo Apps Written scope

OpenClaw operator receipt / 23 July 2026

The loop ran. The boundary held.

An hourly local agent operation with five clean stages, explicit read-only tools, and a separate human-grade execution gate.

Inspect the run verified packet ยท exit 0

One current receipt

Five minutes of work, independently legible.

The production packet started at 05:00:02 UTC and finished at 05:05:40 UTC. It records the model, cadence, safety boundary, artifacts, and exit code for every stage. A finding is still only a hypothesis until a stronger operator verifies and acts on it.

01deterministic heartbeatexit 0
02qwen3:8b workerexit 0
03bounded tool loopexit 0
04deep strategyexit 0
05supervisor briefexit 0

Evidence boundary

Running now is not the same as promised next.

Already running and verified

  • Hourly macOS launchd execution on a narrow runner mirror
  • Local qwen3:8b scouting with explicit tool allowlists
  • Public-URL checks that reject localhost and private IP targets
  • No public, account, payment, email, or spend actions from the local worker
  • Stage receipts, freshness metadata, and operator handoff artifacts

This is operations evidence for a real local system. It is not a claim that an Ubuntu/OpenClaw client host has already passed the checks beside it.

What a paid Ubuntu trial must prove

  • Pinned OpenClaw under a dedicated, non-sudo systemd user
  • SSH key-only access, UFW, fail2ban, and verified loopback bindings
  • 0600 environment files with no secrets in units or shell history
  • CrowdSec and Netdata, or a documented lower-complexity alternative
  • Reboot persistence, recovery, rollback, port inventory, and negative checks
  • Concise runbook and narrated handoff recording

The trial is complete only when the throwaway host passes the written acceptance checklist. Production credentials stay out of scope.

Deterministic workflow thinking

Chat photo in. Correct job record out.

01

Require context

Capture a stable job ID from a caption, QR code, reply context, or explicit operator selection. Never ask a model to invent it.

02

Persist once

Fetch the original through Telegram, checksum it, and store it under a private, job-keyed object path.

03

Validate then write

Confirm the job exists and is in an allowed state before attaching the durable URL and source metadata idempotently.

04

Refuse ambiguity

Missing or conflicting matches enter a confirmation queue. The staff member gets a receipt only after the record update succeeds.

One fresh host. One bounded proof.

Operate first. Claim only what the receipt supports.

Romeo Apps works asynchronously in writing. A fixed trial starts on a fresh host after scope and payment are agreed, and ends with a reproducible acceptance packet rather than a confidence story.

Discuss the written trial