Capstone: run, inspect, stop, and remove the first safe agent

Verifiedon 2026-07-302026.7.1-2

Capstone outcome: reversible evidence

This capstone is complete only when the exercise can be inspected and removed. A successful model response is one checkpoint, not the finish line. Run exactly one task from the previous lesson, keep the input synthetic, produce a proposal, and record a human decision about a possible future action without performing that action. Then stop the Gateway if it was started for the lab, rotate or revoke the test credential, and remove only the confirmed test installation and workspace.

The reviewed source set is OpenClaw 2026.7.1-2, revision 1237c0cf8157a6ad4a900d6b165ea8c830449e78: agent execution, uninstall, and secrets handling. The capstone intentionally preserves the source limitations: a redacted rehearsal is not production readiness, SecretRefs are not process isolation, and a dry-run is not permission to delete a shared host.

Rules of engagement

Use the same host, user, and workspace named in the pre-flight card. Before running, confirm:

• the CLI version matches the supported range in the course metadata;
• the provider check has a timestamped pass/fail record and the credential is still a disposable test credential;
• the Gateway and RPC evidence is current enough for this run;
• no real channel, mailbox, repository, recipient, or private archive is connected;
• the task contract names one synthetic input and forbids tools, external paths, and side effects;
• the teardown owner is available and knows which state belongs to the exercise.

Do not turn a capstone into an upgrade test, a channel demo, or a general-purpose assistant. Those are different risk decisions. Do not add a daemon, public listener, browser profile, plugin, or persistent scheduled job while “finishing” the exercise.

Lab: run and inspect one proposal

Use the exact reviewed command form selected in the first-agent lesson. The following is an example, not a license to use an ambient configuration:

openclaw agent exec --isolated --cwd ./openclaw-first-agent-lab --message-file task.md --json

If you chose --auth-env-only, record that choice and ensure the process environment contains only the approved test credential. Do not rerun after a transport timeout until you check the Gateway status and session evidence. The agent reference warns that a transport loss is ambiguous: the Gateway may have accepted and may still finish the turn. A blind retry can duplicate an action, even though this capstone forbids side effects.

Inspect the result in this order:

1. Exit state: success, controlled refusal, timeout, or error.
2. Scope: did the agent read only the synthetic input and produce only a proposal?
3. Authority: did it request a tool, recipient, URL, or external path?
4. Evidence: can you explain the result without saving a raw response containing private data?
5. Decision: did the named human approve only a future, separately reviewed action—or withhold approval?

For this capstone, the safe approval decision is usually “not approved; no external action performed”. A human may record “approved for a future separate design review” if that is true, but the future action remains disconnected and unexecuted.

Learner artifact: the evidence packet

Produce one redacted packet. It should be useful to another operator without becoming a new secret store.

CAPSTONE: reversible first-agent installation
run-at: <UTC>
platform/user: <redacted role and platform>
openclaw: <version>; source revision: 1237c0c...
provider-check: <provider/model>; result=<pass|fail>; credential value recorded=no
cli-gateway-checks: <bounded classifications>
task-contract: <path or identifier>; input=<synthetic label>
run-result: <proposal|refusal|error>; external side effect: none observed
human decision: <not approved | approved for separate future review>
credential status: <rotated|revoked>; old credential usable: <no/unknown>
Gateway stop: <result>
removal preview: <targets reviewed, no shared target>
removal result: <completed|held for owner>
residual risk/next owner: <short statement>

Never include the credential, full environment, raw provider response, private recipient, private endpoint, or an unbounded log. If the run produced a secret-shaped value, stop packet publication and handle the secret incident first.

Secret rotation drill

Assume the test credential was copied into an unsafe note. Treat it as exposed even if the note was private or the visible value was truncated. Revoke it at the provider, remove the unsafe copy from every destination you control, and verify that the old credential cannot authenticate. If a repeat run is necessary, issue a new test credential with the same or smaller budget. A new key does not erase an old key from backups, history, screenshots, retired configuration, or generated model catalogs.

This is consistent with the secrets guidance: plaintext residue remains a secret until removed, moved outside the agent boundary, or isolated. SecretRefs can reduce persistence on supported fields, but they do not permit an agent to read arbitrary files safely.

Teardown: preview, approve, remove, verify

Use the official uninstall guide for the exact install route. Preview the built-in scope first:

openclaw uninstall --dry-run --all

Read every target. Stop if the list includes a shared Node installation, a non-test workspace, a production service, or an unknown path. Ask the removal owner before approving destructive removal. On a local host, stop the test Gateway first, then apply the approved uninstall scope. On a VPS, retain only the redacted operational evidence and policy-required backup; remove test state only after confirming it is not shared. Do not improvise rm -rf commands from memory.

After removal, verify the intended result with non-destructive checks: the test service is stopped, the test workspace is absent or empty as planned, the test executable is no longer in the intended path if removal included it, the old credential is revoked, and no channel or scheduled task remains. If the install is shared or the preview is ambiguous, the correct result is held for owner, not forced cleanup.

Rubric and failure handling

Expected result: a redacted packet proves one bounded proposal and a reversible close-out. Failure mode: the Gateway remains running, the credential remains reusable, teardown targets are unclear, or the packet contains private data. Rollback: stop the exercise, revoke the credential, preserve only safe evidence, and hand the unresolved removal decision to the named owner. A partial teardown with an explicit owner is safer than an unreviewed deletion.

A pass means the exercise is reversible and inspectable—not that the agent is safe for production, autonomous, or connected to a real channel.

Check your understanding

Primary source receipt

• OpenClaw agent exec, reviewed revision
• OpenClaw uninstall and dry-run, reviewed revision
• OpenClaw SecretRefs and residue, reviewed revision

Learner artifact: the redacted capstone evidence packet and rubric decision. It is a local learning record, not a credential or certification.