Pinned OpenClaw version, local runtime/package setup, dedicated non-sudo user, and a tested systemd service.
What ships
SSH key-only, UFW, fail2ban, loopback-bound non-SSH services, and mode-0600 environment files.
Monitoring, exposed-port check, restart/log verification, rollback notes, runbook, and screen recording without secrets.
Telegram and runtime: the short answer
The paid trial installs and runs OpenClaw on the new Ubuntu VPS. Your local machine remains an operator client; it is not required to stay online for the VPS service.
Telegram bot connection can be included when it fits the agreed scope. The bot token is provided only after scope acceptance, stored in a mode-0600 environment file, and never placed in chat, a unit file, or the recording.
The handoff records service status, listening addresses, firewall state, restart behavior, logs, and a redacted Telegram connectivity check when included.
Hard boundary
The trial covers one new VPS and the listed controls. Production migration, custom agent or n8n workflow development, DNS/provider fees, third-party subscriptions, 24/7 on-call coverage, and ongoing maintenance are separate scopes. Work begins only after the complete intake and temporary throwaway-host access arrive.
Not ready to buy? Send an anonymous scope check.
Do not include passwords, private keys, personal data, customer data, or production credentials. A public messenger handle and a short infrastructure description are enough.