feat: ship agent-first mission control v0.2.57

.env.template

@@ -17,9 +17,31 @@ JWT_AUDIENCE=nexus-web
 
 # ── Bootstrap Owner (first seed only) ───────────────────
 BOOTSTRAP_OWNER_EMAIL=***
+BOOTSTRAP_OWNER_PASSWORD=*** # at least 10 characters; never written to logs
+
+# ── Trusted reverse proxies ──────────────────────────────
+# Keep empty unless the API is behind a known proxy. Use one exact proxy IP
+# and/or a narrow CIDR for the private container network.
+FORWARDED_HEADERS_KNOWN_PROXY=
+FORWARDED_HEADERS_KNOWN_NETWORK=
+FORWARDED_HEADERS_FORWARD_LIMIT=1
 
 # ── OpenClaw Integration ────────────────────────────────
-# Base URL of the OpenClaw gateway (host.docker.internal from inside container)
+# Base URL of the OpenClaw gateway.
+# Direct loopback can use a trusted backend shared secret. A remote or
+# host.docker.internal topology also needs a paired backend device identity.
 OPENCLAW_BASE_URL=http://host.docker.internal:18789
+# Version pin is fail-fast and must match the deployed Gateway.
+OPENCLAW_REQUIRED_VERSION=2026.7.1
 OPENCLAW_GATEWAY_TOKEN=***
 OPENCLAW_GATEWAY_PASSWORD=***
+# Nexus will not impersonate OpenClaw's reserved gateway-client/backend identity.
+# Keep false until the pinned OpenClaw build explicitly registers the external
+# `nexus` client id. A patched or future supported build may set this to true.
+OPENCLAW_EXTERNAL_CLIENT_ID_SUPPORTED=false
+# Remote wss:// endpoints require a confirmed SHA-256 certificate fingerprint.
+OPENCLAW_TLS_FINGERPRINT=
+# The persisted primary profile is the only management gate. Enable it through
+# the owner-only Attach & Adopt flow after read-only adoption and scope upgrade.
+# High-risk unattended command/on-exit cron payloads remain disabled by default.
+OPENCLAW_ALLOW_COMMAND_CRON=false