feat: ship agent-first mission control v0.2.57

compose.yaml

@@ -49,10 +49,25 @@ services:
       Jwt__Issuer: ${JWT_ISSUER:-nexus}
       Jwt__Audience: ${JWT_AUDIENCE:-nexus-web}
       Bootstrap__OwnerEmail: ${BOOTSTRAP_OWNER_EMAIL:?Set BOOTSTRAP_OWNER_EMAIL in .env}
-      # Initial owner password is generated once at first seed and then lives only in the DB.
+      # Existing initialized databases do not need the bootstrap password again.
+      # A fresh database still fails closed in EnsureDatabaseAsync when this is empty.
+      Bootstrap__OwnerPassword: ${BOOTSTRAP_OWNER_PASSWORD:-}
+      ForwardedHeaders__ForwardLimit: ${FORWARDED_HEADERS_FORWARD_LIMIT:-1}
+      ForwardedHeaders__KnownProxies__0: ${FORWARDED_HEADERS_KNOWN_PROXY:-}
+      ForwardedHeaders__KnownNetworks__0: ${FORWARDED_HEADERS_KNOWN_NETWORK:-}
       Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://host.docker.internal:18789}
+      Integrations__OpenClaw__RequiredVersion: ${OPENCLAW_REQUIRED_VERSION:-2026.7.1}
       Integrations__OpenClaw__Token: ${OPENCLAW_GATEWAY_TOKEN:-}
       Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
+      GatewayConnector__DeviceStatePath: /var/lib/nexus/openclaw/device-state.json
+      GatewayConnector__OperationAuditPath: /var/lib/nexus/openclaw/operation-audit.jsonl
+      GatewayConnector__ClientId: nexus
+      GatewayConnector__ClientMode: backend
+      GatewayConnector__ExternalClientIdentitySupported: ${OPENCLAW_EXTERNAL_CLIENT_ID_SUPPORTED:-false}
+      GatewayConnector__AllowReservedInternalClientIdentity: "false"
+      GatewayConnector__TlsFingerprint: ${OPENCLAW_TLS_FINGERPRINT:-}
+      OpenClawSetup__ExternalClientIdentitySupported: ${OPENCLAW_EXTERNAL_CLIENT_ID_SUPPORTED:-false}
+      Integrations__OpenClaw__AllowCommandCron: ${OPENCLAW_ALLOW_COMMAND_CRON:-false}
       Admin__ResetToken: ${Admin__ResetToken:-}
       NexusApiKey: ${NEXUS_API_KEY:-}
     extra_hosts:
@@ -68,13 +83,7 @@ services:
       retries: 3
       start_period: 15s
     volumes:
-      - /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/home/node/.openclaw/agents-sanitized.json:ro
-      - /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
-      - /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
-      - /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer
-      - /home/projekte_bao/openclaw/data/openclaw/workspace-architekt:/mnt/workspace-architekt
-      - /home/projekte_bao/openclaw/data/openclaw/workspace-researcher:/mnt/workspace-researcher
-      - /home/projekte_bao/openclaw/data/openclaw/workspace-executor:/mnt/workspace-executor
+      - nexus-openclaw-device:/var/lib/nexus/openclaw
     networks:
       - nexus
       - openclaw_default
@@ -130,3 +139,4 @@ networks:
     external: true
 volumes:
   nexus-postgres:
+  nexus-openclaw-device: