v2026.3.x compatibility audit: deploy guide, Actions workflow, config update

[jdanjohnson]

v2026.3.x compat: deploy guide, Actions workflow, config update

Summary

Audits the starter project for OpenClaw v2026.3.x compatibility and replaces the generic VPS deployment docs with a step-by-step guide matching the HGDW workshop curriculum.

What changed:

• README deployment section — rewrote from a generic "any Linux VPS" guide to a structured 4-step walkthrough: provision DO droplet → back up config to GitHub → set up GitHub Actions auto-deploy → deploy dashboard via Caddy + Vercel. Includes an ASCII architecture diagram.
• .github/workflows/deploy.yml (new) — GitHub Actions workflow that rsyncs agent/ contents to a droplet and restarts OpenClaw on push to main. Excludes memory/, knowledge/, sessions/ from workspace sync to protect server-generated state.
• agent/openclaw.json — bumped meta.lastTouchedVersion to 2026.3.2; added a safe placeholder origin https://replace-me.invalid to gateway.controlUi.allowedOrigins (users replace this with their real Vercel domain).
• dashboard/.env.example (new) — documents VITE_GATEWAY_URL for local vs production.
• Version references updated from v2026.2.19 to v2026.3.x throughout README. Compatibility section expanded with config validation, Telegram streaming, and security audit features.
• Removed tracked .DS_Store files.

Updates since last revision (bot-followups):

• Security: replaced the claimable Vercel placeholder domain with https://replace-me.invalid.
• Deploy correctness: hooks/ is no longer excluded from rsync; hooks committed to the repo will deploy. (Note: because workspace sync uses --delete, the repo becomes the source of truth for hooks too.)
• Docs rendering: fixed corrupted control characters in README (Step headings + GitHub secrets navigation line).

Review & Testing Checklist for Human

• GitHub Actions deploy.yml assumptions — confirm the DO 1-click image uses /home/openclaw/.openclaw/ and that sudo systemctl restart openclaw works for the deploy SSH user.
• Rsync --delete expectations — workspace sync uses --delete; confirm you want the repo to be the source of truth for all workspace content besides excluded server-state directories (memory/, knowledge/, sessions/). This will delete server-only workspace files (including hooks) that aren’t in the repo.
• Caddy install + reverse proxy — validate on a fresh Ubuntu 22.04+ droplet; confirm reverse proxy target should be 127.0.0.1:18789 for your setup.
• CORS allowlist — ensure workshop instructions strongly emphasize replacing https://replace-me.invalid with the attendee’s real Vercel domain before using the dashboard.

Test Plan (requires live infrastructure)

1. Provision a fresh DO droplet from the OpenClaw 1-click image
2. Fork this repo and follow the Step 2–3 instructions (scp config to repo, push, configure GitHub Actions secrets)
3. Make a trivial change in agent/workspace/SOUL.md, commit, push
4. Verify GitHub Actions deploys successfully and OpenClaw restarts without errors
5. Set up Caddy with a real domain, deploy dashboard to Vercel, verify the dashboard connects via WebSocket (wss://...)

Notes

• Link to Devin Session: https://app.devin.ai/sessions/f16314078e74471cb6ff8f1ce0aeebdc
• Requested by: @jdanjohnson
• This PR focuses on documentation + deploy pipeline setup; no changes to plugin/agent behavior.
• Dashboard TypeScript typecheck passed locally (npm run typecheck in dashboard/).

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Devin Review found 3 new potential issues.

View 9 additional findings in Devin Review.

[devin-ai-integration]

🟡 Corrupted arrow characters render as control character + '7' in README navigation instructions

The GitHub secrets navigation path on this line reads Repo 7 Settings 7 Secrets and variables 7 Actions instead of the intended Repo → Settings → Secrets and variables → Actions.

Root Cause

The → (U+2192, RIGHTWARDS ARROW) characters have been corrupted into the two-byte sequence \x18 0x37 (ASCII CAN control character followed by the digit '7'). This can be verified with xxd:

00000020: 3720 5365 7474 696e 6773 2018 3720 5365  7 Settings .7 Se

This makes the navigation instructions unreadable when rendered on GitHub. Users won't know where to find the Actions secrets settings.

Impact: Anyone following the deployment guide will see garbled instructions for the critical step of configuring GitHub Actions secrets.

Suggested change

	Add these GitHub secrets (Repo 7 Settings 7 Secrets and variables 7 Actions):
	Add these GitHub secrets (Repo → Settings → Secrets and variables → Actions):

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Fixed: replaced the corrupted arrow/control characters in the GitHub secrets navigation line and normalized the Step headings to use an em dash (e.g. Step 3 — ...).