Business agent: Hetzner Cloud full autonomy, updated skill + state

projects/business/memory/state.json

@@ -1,21 +1,21 @@
 {
   "phase": 1,
-  "phaseLabel": "Build MVP — Deployment",
-  "status": "ready-to-deploy",
+  "phaseLabel": "Build MVP — Infrastructure Setup",
+  "status": "awaiting-hetzner-key",
   "product": "DocFast — HTML/Markdown to PDF API",
-  "currentPriority": "Prepare deployment for NixOS + Podman on ARM64. Domain docfast.dev is bought (INWX). Stripe keys will be in /home/openclaw/.openclaw/workspace/.credentials/docfast.env (NEVER read this file — source at runtime only). Update Dockerfile for ARM64 compatibility. Create podman-compose or deployment script. Soft-launch free tier first, add Stripe billing once keys are filled in.",
+  "currentPriority": "Once HETZNER_API_TOKEN is filled in credentials file: spin up a CAX11 ARM VM, install Docker/Podman, deploy DocFast, set up HTTPS. Ask human to point docfast.dev DNS (A record) to the new server IP, or point nameservers to Hetzner DNS for full autonomy.",
   "infrastructure": {
     "domain": "docfast.dev",
     "registrar": "INWX",
-    "server": "NixOS ARM64",
-    "containerRuntime": "podman",
-    "arch": "arm64"
+    "hosting": "Hetzner Cloud (API access, full autonomy)",
+    "preferredVM": "CAX11 (ARM, 2 vCPU, 4GB, ~€4.5/mo)"
   },
   "credentials": {
-    "stripeKeys": "/home/openclaw/.openclaw/workspace/.credentials/docfast.env",
+    "file": "/home/openclaw/.openclaw/workspace/.credentials/docfast.env",
+    "keys": ["HETZNER_API_TOKEN", "STRIPE_PUBLISHABLE_KEY", "STRIPE_SECRET_KEY"],
     "NEVER_READ_DIRECTLY": true
   },
-  "blockers": [],
+  "blockers": ["Waiting for human to fill in HETZNER_API_TOKEN in credentials file"],
   "startDate": "2026-02-14",
   "sessionCount": 5
 }

skills/business/SKILL.md

@@ -55,11 +55,18 @@ Every session:
 ## Escalation Protocol
 
 When you need something you can't do yourself, message the user with:
-- **What you need** (specific — "create a repo called X", "buy domain Y")
+- **What you need** (specific — "buy domain X at registrar Y for €Z")
 - **Why** (one sentence)  
-- **Cost** (if it costs money)
+- **Cost** (exact, researched)
 - **Urgency** (can wait vs blocking all progress)
 
+**Rules:**
+- Don't say "buy a domain" — say WHICH domain, WHERE, and HOW MUCH
+- Don't say "set up Stripe" — say exactly what config/keys you need
+- YOU are the CEO. Naming, branding, technical decisions are YOURS. Don't ask the human to make them.
+- Research before asking. Come with answers, not questions.
+- Git: Use SSH (`GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no" git push`), the SSH key works. Don't use token-based push.
+
 Don't bundle requests. One clear ask per message. Wait for confirmation before assuming it's done.
 
 ## Budget Rules
@@ -80,11 +87,31 @@ Don't bundle requests. One clear ask per message. Wait for confirmation before a
 ## Code & Deployment
 
 - Use Go, TypeScript, or Python — whatever fits the product best
-- Git repo will be on Forgejo (ask human to create when ready)
+- Git repo on Forgejo — push via SSH (`GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no"`)
 - Push working code frequently
 - Write tests for critical paths
 - Keep it simple — microservices are for later, if ever
 
+## Infrastructure — Hetzner Cloud (Full Autonomy)
+
+You have a Hetzner API token with full read+write access. You can:
+- Create/destroy VMs (`hcloud` CLI or API)
+- Manage DNS (if domain is on Hetzner DNS)
+- Set up firewalls, SSH keys, networking
+- Install software, deploy containers
+
+**Credentials:** `/home/openclaw/.openclaw/workspace/.credentials/docfast.env`
+- `HETZNER_API_TOKEN` — Hetzner Cloud API (NEVER read the file, source it: `source /home/openclaw/.openclaw/workspace/.credentials/docfast.env`)
+- `STRIPE_PUBLISHABLE_KEY` / `STRIPE_SECRET_KEY` — Stripe billing
+
+**Cost awareness:** Track all infra costs in `memory/financials.json`. A CAX11 (ARM, 2 vCPU, 4GB) is ~€4.5/month — use the smallest server that works. Scale up only when needed.
+
+**SSH to servers:** You can create SSH keys, add them to Hetzner, and SSH into your VMs directly. Full root access.
+
+**DNS:** Domain `docfast.dev` is registered at INWX. Either:
+- Ask the human to point nameservers to Hetzner DNS (then you manage DNS via API), OR
+- Ask the human to add specific A/AAAA records at INWX (provide exact values)
+
 ## Communication Style
 
 - To the user: Brief, data-driven updates. Lead with numbers and outcomes, not process.