whatsapp-qr-gateway

Run read-only checks against the gateway: use curl http://localhost:8555/health for the health endpoint and ps aux | grep 8555 to confirm a process is listening. Treat prior runtime claims as volatile and re-verify each session.

After scanning the QR code and authenticating with a bearer token, send text commands like health, restart <service>, task <spec>, or status <job-id>. The gateway webhook on port 8555 validates the token and routes the command to PT, orama, or Portal.

Restart, task submission, scheduled commands, QR refresh that invalidates sessions, and external notification delivery all require explicit HITL approval. Read-only actions like health checks, status lookups, and log inspection can proceed after verification.

Check the health endpoint with curl http://localhost:8555/health and inspect the gateway log at ~/.openclaw/logs/whatsapp-gateway.log. Do not run local pkill or restart commands without operator approval; restarts are HITL-gated.

The MVP assumes a single-user bearer-token flow, text-primary commands with voice and OCR fallback, and a 90-second latency budget before async queue fallback. Multi-user RBAC, scheduled commands, and voice-native mode are roadmap items not yet implemented.