feat(greenfield): replace generic exec with service actions

greenfield/docs/architecture/greenfield-rewrite/application-architecture.md

@@ -213,7 +213,7 @@ Every application operation controlled by this repository becomes a tRPC procedu
 - settings, authentication, MFA, WebAuthn, and session administration;
 - Docker inventory, updater policy, and actions;
 - database, cache, quota, backup, and log-rotation operations;
-- Moltbook, files, logs, terminal helpers, and exec jobs; and
+- Moltbook, files, logs, terminal sessions, and purpose-built Service Actions; and
 - TypeScript automation calls from OpenClaw scripts.
 
 The browser uses `@trpc/tanstack-react-query`, a singleton `QueryClient`, and a singleton
@@ -464,6 +464,42 @@ is exclusive, caller-idempotent, single-attempt, non-retry-safe, and non-cancell
 worker owns its fixed no-shell lifecycle command. Ambiguous enqueue or terminal settlement is
 reconciled by durable run identity and never blindly dispatches a second restart.
 
+### Purpose-built Service Actions partially replace generic exec consumers
+
+The Overview exposes exactly four fixed Service Actions through
+`serviceActions.getStatus` and `serviceActions.request`: OpenClaw session cleanup, OpenClaw
+installation update, host restart, and host update. The browser submits only a fixed action ID and
+a caller-owned idempotency key. The web process commits a sanitized attempt audit, checks a fresh
+exact-release worker advertisement, and revalidates the browser session plus recent MFA at the
+durable enqueue handoff. It returns a job-run ID rather than waiting for a privileged effect and
+links all progress and terminal state to the existing Jobs surface.
+
+OpenClaw cleanup and update are implemented worker-only through the hash-pinned
+`sessions.cleanup` and `update.run` Gateway methods. Their providers accept no browser parameters,
+persist only bounded schema-validated summaries, never return raw Gateway results, and never
+blindly replay a post-dispatch unknown outcome. Cleanup deliberately uses OpenClaw's source-owned
+session/artifact maintenance instead of reproducing legacy recursive deletion. These safe
+replacements do not yet close `POST /api/exec/start`: the legacy broad `system_cleanup` behavior
+crosses separate ownership domains and remains planned as three explicit capabilities. Docker
+prune belongs to the Docker slice, apt cleanup belongs to host/package maintenance, and journald
+vacuum belongs to log maintenance. The row stays open until all three are delivered or separately
+reviewed without removing their operator-visible behavior.
+
+The contract and Overview retain fixed rows for host restart and host update, but production marks
+both unavailable. The current web and worker processes share one Unix identity, so a group- or
+shared-user polkit rule would also give a compromised web process the worker's root authority. No
+such broker, polkit rule, root helper, or host-operation unit ships in this slice. Enabling either
+host action later requires a distinct worker OS identity, a root-owned immutable worker boundary,
+and separately reviewed provisioning and rollback before the worker may advertise the action key.
+
+The interactive PTY remains the sole terminal boundary. Shell `cd` and completion are owned by the
+connected shell/readline protocol, termination uses the bounded terminal session control, and no
+new generic command, cwd, or completion API is introduced. The unused synchronous `POST /api/exec`
+endpoint is a reviewed removal because no current browser or scoped automation consumer depends on
+it. Implemented long-running exec consumers map to either the PTY or the fixed durable Service
+Actions queue, while the inventory keeps `POST /api/exec/start` planned for the outstanding
+cleanup decomposition.
+
 ### Current-protocol Control UI projections
 
 The 2026-08-06 OpenClaw audit separates protocol authority from Control UI projection through 23

greenfield/docs/architecture/greenfield-rewrite/data-and-security.md

@@ -281,6 +281,29 @@ deploys, builds, Git mutations, Docker mutations, backups, restores, systemd cha
 restarts, or unbounded shell commands. Those operations become durable `job_runs` consumed by
 the worker.
 
+Service Actions are a separate fixed-intent boundary, not a generic exec facade. The contract
+contains exactly `openclaw-cleanup`, `openclaw-update`, `system-restart`, and `system-update`; a
+caller can supply only one of those IDs plus an actor-bound idempotency key. Reads and requests are
+session-only under dedicated capabilities, requests require recent MFA, and audit attempt must
+commit before the durable enqueue handoff. That handoff rechecks exact-release worker
+availability, the current browser session, and recent MFA. Enqueue uncertainty is reconciled by
+the same principal/idempotency intent, and post-dispatch uncertainty never authorizes a replay.
+
+The production worker advertises only actions for which its composition owns an exact executor.
+OpenClaw cleanup and update are worker-only, fixed-parameter Gateway operations with bounded,
+sanitized results. Host restart and host update remain canonical contract/UI rows but are
+unavailable in production because the web and worker currently share one Unix identity. A shared
+group or polkit grant would therefore collapse the web/worker trust boundary. This rewrite ships
+no shared-user host broker, polkit rule, root helper, or host-operation systemd unit. Future host
+enablement requires a distinct worker OS identity, root-owned immutable worker execution, exact
+subject and operation policy, and reviewed install/rollback evidence before either action key can
+be advertised.
+
+This boundary is a partial secure replacement for `POST /api/exec/start`, not a feature-removal
+claim. The legacy `system_cleanup` intent remains planned as three separately authorized effects:
+Docker prune in the Docker slice, apt cleanup in host/package maintenance, and journald vacuum in
+log maintenance. None may be smuggled back through a generic shell or shared-user privilege grant.
+
 The `cache:read` automation heartbeat is a separate sanitized projection, not a shortcut around
 session, task, job, or cron detail authorization. It reads process-local validated Gateway
 summaries plus bounded payload-free cache status and purpose-built SQLite task/Dashboard-job
@@ -367,7 +390,7 @@ Retain the current security behavior while simplifying its structure:
 - durable browser sessions use random opaque validators, store only their hashes, and enforce
   idle and absolute expiry;
 - recent high-assurance verification is required for secrets, credentials, deploy, rollback,
-  restore, exec, Docker mutation, and security administration;
+  restore, Service Actions, Docker mutation, and security administration;
 - the process Effect runtime bounds Gateway, password/Argon2, TOTP AES/HMAC, and WebAuthn
   parsing/signature work with separate concurrency and queue limits; rolling in-memory budgets
   stop parallel requests before expensive work can outrun durable cooldowns, and a failed authentication attempt retains its active-work
@@ -589,8 +612,8 @@ proxy mode names exact proxies and requires them to overwrite forwarded identity
   units.
 - Markdown and HTML are sanitized at the rendering boundary. A raw HTML feature is not an
   authorization boundary.
-- Exec, terminal, Git, Docker, systemd, backup, restore, and OpenClaw adapters each have a
-  command/operation allowlist and a structured audit record.
+- Terminal, Service Actions, Git, Docker, systemd, backup, restore, and OpenClaw adapters each have
+  a command/operation allowlist and a structured audit record. No generic exec adapter is retained.
 - Logs and audit details pass a central redactor before persistence and again before browser
   output.
 - CSP, frame denial, MIME-sniff prevention, referrer policy, permissions policy, and request ID

greenfield/docs/architecture/greenfield-rewrite/implementation-plan.md

@@ -101,6 +101,16 @@ including restart during streaming.
 - treat the configured Terminal workspace root as an initial working-directory catalog only. A
   real interactive shell can change directory and access anything permitted by its OS identity;
   filesystem isolation requires a separate mount, namespace, or container sandbox.
+- keep shell `cd`, completion, and termination inside the implemented bounded PTY. Replace consumed
+  legacy exec behavior only with purpose-built durable Service Actions; do not restore a generic
+  command, shell, or cwd API for the unused synchronous exec route. Keep `POST /api/exec/start`
+  planned until `system_cleanup` is decomposed without feature loss: Docker prune in the Docker
+  slice, apt cleanup in host/package maintenance, and journald vacuum in log maintenance.
+- expose the four fixed Service Action intents in contract/UI, but advertise only exact executors
+  owned by a fresh worker on the current release. OpenClaw cleanup/update use reviewed worker-only
+  Gateway methods. Host restart/update remain unavailable until web and worker have distinct OS
+  identities and a root-owned immutable worker boundary with reviewed provisioning and rollback;
+  a shared-user/group polkit grant is forbidden.
 
 **Exit gate:** capability, step-up, audit, cancellation, resource-limit, and failure-recovery
 tests pass for every privileged operation.