{
  "schemaVersion": "1.0",
  "item": {
    "slug": "aleph-vm-replication",
    "name": "OpenClaw cloud self-deployment",
    "source": "tencent",
    "type": "skill",
    "category": "AI 智能",
    "sourceUrl": "https://clawhub.ai/san-npm/aleph-vm-replication",
    "canonicalUrl": "https://clawhub.ai/san-npm/aleph-vm-replication",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/aleph-vm-replication",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=aleph-vm-replication",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-30T16:55:25.780Z",
      "expiresAt": "2026-05-07T16:55:25.780Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
        "contentDisposition": "attachment; filename=\"network-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/aleph-vm-replication"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/aleph-vm-replication",
    "agentPageUrl": "https://openagent3.xyz/skills/aleph-vm-replication/agent",
    "manifestUrl": "https://openagent3.xyz/skills/aleph-vm-replication/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/aleph-vm-replication/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Aleph Cloud Self-Deployment",
        "body": "Teach an AI agent to deploy itself onto Aleph Cloud decentralized infrastructure — from provisioning a VM to configuring its own runtime, autonomously."
      },
      {
        "title": "Overview",
        "body": "This skill gives an AI agent everything it needs to:\n\nProvision its own VM on the Aleph Cloud network\nInstall its agent framework (OpenClaw) on the new instance\nConfigure its own credentials, gateway, and identity\nTransfer its knowledge and skills to the new environment\nBecome fully operational on decentralized compute — without human intervention"
      },
      {
        "title": "Prerequisites",
        "body": "aleph-client CLI installed (pip install aleph-client)\nA funded Aleph Cloud account (credits on BASE/ETH/AVAX/SOL, or $ALEPH tokens for holding)\nAn SSH keypair for VM access\nAI provider API key (Anthropic, OpenAI, etc.) to share with spawned agents"
      },
      {
        "title": "Install aleph-client",
        "body": "pip install aleph-client --break-system-packages\n\nOn Ubuntu 24+ you need --break-system-packages or use a venv."
      },
      {
        "title": "Check Version",
        "body": "aleph --version"
      },
      {
        "title": "Import or Create a Private Key",
        "body": "# Import existing private key\naleph account create --private-key <YOUR_HEX_PRIVATE_KEY> --chain BASE --active\n\n# Or generate a new one\naleph account create --chain BASE --active\n\nKeys are stored at ~/.aleph-im/private-keys/. Always chmod 600 key files."
      },
      {
        "title": "Check Balance",
        "body": "aleph account balance\n\nYou need credits or $ALEPH tokens. Credits are the simplest (pay-as-you-go). Buy credits at https://account.aleph.im/ or hold $ALEPH tokens."
      },
      {
        "title": "Pricing Reference",
        "body": "aleph pricing instance\n\nTierCompute UnitsvCPUsRAMDefault DiskCredits/HourCredits/Day1112 GiB20 GiB14,250342,0002224 GiB40 GiB28,500684,0003448 GiB80 GiB57,0001,368,00046612 GiB120 GiB85,5002,052,000\n\nDisk size can be overridden with --rootfs-size <MiB>. The tier sets the minimum; you can allocate more (e.g., 40GB on a Tier 1). Extra disk costs ~4,416 credits/GiB/day."
      },
      {
        "title": "Step 2: Generate SSH Keypair",
        "body": "ssh-keygen -t ed25519 -f ~/.ssh/aleph_agent -N \"\" -C \"agent@aleph\"\nchmod 600 ~/.ssh/aleph_agent"
      },
      {
        "title": "List Active CRNs (Top 10 by Score)",
        "body": "aleph node compute --active --json 2>/dev/null | python3 -c \"\nimport sys, json\nnodes = json.load(sys.stdin)\nscored = []\nfor n in nodes:\n    score = n.get('score', 0) or 0\n    name = n.get('name', 'unknown')\n    node_hash = n.get('hash', '')\n    url = n.get('address', '')\n    if score > 0.5:  # Score is 0.0–1.0 (not percentage)\n        scored.append((score, name, node_hash, url))\nscored.sort(reverse=True)\nfor s, name, h, url in scored[:10]:\n    print(f'{s*100:.1f}% | {name} | {h} | {url}')\n\""
      },
      {
        "title": "Get Best CRN Hash (for scripts)",
        "body": "CRN_HASH=$(aleph node compute --active --json 2>/dev/null | python3 -c \"\nimport sys, json\nnodes = json.load(sys.stdin)\nbest = max(\n    (n for n in nodes if (n.get('score', 0) or 0) > 0.5),\n    key=lambda n: n.get('score', 0),\n    default=None\n)\nprint(best['hash'] if best else '')\n\")\necho \"Best CRN: $CRN_HASH\""
      },
      {
        "title": "Known Rootfs Hashes",
        "body": "OSRootfs HashUbuntu 245330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84eUbuntu 22(default if --rootfs omitted)"
      },
      {
        "title": "Create Instance (Non-Interactive)",
        "body": "The aleph instance create command has an interactive TUI for CRN selection. To bypass it completely, use --crn-hash + --skip-volume:\n\naleph instance create \\\n  --name \"agent-v1\" \\\n  --compute-units 1 \\\n  --rootfs 5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e \\\n  --rootfs-size 40960 \\\n  --payment-type credit \\\n  --payment-chain BASE \\\n  --ssh-pubkey-file ~/.ssh/aleph_agent.pub \\\n  --crn-hash \"$CRN_HASH\" \\\n  --crn-auto-tac \\\n  --skip-volume \\\n  --verbose\n\nCritical flags:\n\n--crn-hash <HASH>: Bypasses the interactive CRN picker TUI entirely\n--crn-auto-tac: Auto-accepts CRN Terms & Conditions\n--skip-volume: Skips the \"add extra volumes?\" interactive prompt\n--rootfs: OS image hash (omit for Ubuntu 22 default)\n--rootfs-size: Disk size in MiB (40960 = 40GB; overrides tier default)"
      },
      {
        "title": "If Interactive TUI Still Appears",
        "body": "Some versions of aleph-client may still show prompts. Use pexpect:\n\n#!/usr/bin/env python3\n\"\"\"Automate aleph instance create when CLI flags don't fully bypass TUI.\"\"\"\nimport pexpect\nimport sys\nimport re\n\nCRN_HASH = sys.argv[1] if len(sys.argv) > 1 else \"\"\nNAME = sys.argv[2] if len(sys.argv) > 2 else f\"agent-{int(__import__('time').time())}\"\n\ncmd = (\n    f'aleph instance create '\n    f'--name \"{NAME}\" '\n    f'--compute-units 1 '\n    f'--rootfs 5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e '\n    f'--rootfs-size 40960 '\n    f'--payment-type credit '\n    f'--payment-chain BASE '\n    f'--ssh-pubkey-file ~/.ssh/aleph_agent.pub '\n    f'--crn-auto-tac '\n    f'--skip-volume '\n    f'--verbose'\n)\nif CRN_HASH:\n    cmd += f' --crn-hash {CRN_HASH}'\n\nchild = pexpect.spawn('/bin/bash', ['-c', cmd], timeout=180, encoding='utf-8')\nchild.logfile_read = sys.stdout\n\nwhile True:\n    try:\n        idx = child.expect([\n            r'(?i)rootfs.*type',         # Rootfs type prompt\n            r'(?i)disk.*size',           # Disk size prompt\n            r'(?i)add.*volume',          # Add volume prompt\n            r'(?i)confirm|deploy|proceed', # Confirmation prompt\n            r'(?i)select.*crn|choose.*node', # CRN selection\n            pexpect.EOF,\n            pexpect.TIMEOUT,\n        ], timeout=120)\n\n        if idx == 0:\n            child.sendline('ubuntu24')\n        elif idx == 1:\n            child.sendline('40960')\n        elif idx == 2:\n            child.sendline('n')\n        elif idx == 3:\n            child.sendline('y')\n        elif idx == 4:\n            child.sendline('')  # Press Enter for top/default choice\n        elif idx == 5:\n            break  # EOF — done\n        elif idx == 6:\n            break  # Timeout — done or stuck\n    except Exception as e:\n        print(f\"Error: {e}\", file=sys.stderr)\n        break\n\nprint(\"\\n\" + child.before if child.before else \"\")\nchild.close()\nsys.exit(child.exitstatus or 0)\n\nInstall pexpect: pip install pexpect --break-system-packages\n\nUsage: python3 create_instance.py <CRN_HASH> <INSTANCE_NAME>"
      },
      {
        "title": "Parse Instance Hash After Creation",
        "body": "The CLI outputs the instance details. Extract the hash:\n\n# List instances and get the newest one\naleph instance list 2>&1\n\nThe output shows a table with instance hash, SSH connection details, and mapped ports. Look for:\n\nssh root@<HOST_IP> -p <PORT> -i <ssh-private-key-file>"
      },
      {
        "title": "Programmatic SSH Details",
        "body": "# Parse connection info for the most recent instance\naleph instance list 2>&1 | grep -oP 'ssh root@\\S+ -p \\d+'"
      },
      {
        "title": "Wait and Connect",
        "body": "# Wait for VM to boot (30-60 seconds)\nsleep 45\n\n# Connect\nssh -o StrictHostKeyChecking=no root@<HOST_IP> -p <MAPPED_PORT> -i ~/.ssh/aleph_agent"
      },
      {
        "title": "Step 5: Install OpenClaw on the New VM",
        "body": "SSH into the VM, then:\n\n# Install Node.js 22\ncurl -fsSL https://deb.nodesource.com/setup_22.x | bash -\nDEBIAN_FRONTEND=noninteractive apt-get install -y nodejs git\n\n# Install OpenClaw\nnpm install -g openclaw\n\n# Create workspace\nmkdir -p /root/openclaw/memory /root/openclaw/skills\n\n# Verify\nnode --version    # Should show v22.x\nopenclaw --version\n\nUse DEBIAN_FRONTEND=noninteractive to prevent dpkg prompts in non-TTY sessions."
      },
      {
        "title": "Set Up Anthropic API Key",
        "body": "mkdir -p /root/.openclaw/agents/main/agent /root/.openclaw/agents/main/sessions\n\ncat > /root/.openclaw/agents/main/agent/auth-profiles.json << 'EOF'\n{\n  \"version\": 1,\n  \"profiles\": {\n    \"anthropic:default\": {\n      \"type\": \"token\",\n      \"provider\": \"anthropic\",\n      \"token\": \"<YOUR_ANTHROPIC_API_KEY>\"\n    }\n  },\n  \"lastGood\": {\n    \"anthropic\": \"anthropic:default\"\n  }\n}\nEOF\nchmod 600 /root/.openclaw/agents/main/agent/auth-profiles.json\n\nCritical: The file MUST be named auth-profiles.json (not auth.json). The gateway reads auth-profiles.json — using the wrong filename silently fails with \"No API key found for provider\"."
      },
      {
        "title": "Configure OpenClaw",
        "body": "GATEWAY_TOKEN=$(openssl rand -hex 24)\necho \"Gateway token: $GATEWAY_TOKEN\"  # Save this!\n\ncat > /root/.openclaw/openclaw.json << EOF\n{\n  \"auth\": {\n    \"profiles\": {\n      \"anthropic:default\": {\n        \"provider\": \"anthropic\",\n        \"mode\": \"token\"\n      }\n    }\n  },\n  \"agents\": {\n    \"defaults\": {\n      \"model\": {\n        \"primary\": \"anthropic/claude-sonnet-4-20250514\"\n      },\n      \"workspace\": \"/root/openclaw\"\n    }\n  },\n  \"gateway\": {\n    \"port\": 18789,\n    \"mode\": \"local\",\n    \"bind\": \"loopback\",\n    \"auth\": {\n      \"mode\": \"token\",\n      \"token\": \"$GATEWAY_TOKEN\"\n    }\n  }\n}\nEOF\n\n# Harden permissions\nchmod 700 /root/.openclaw\nchmod 600 /root/.openclaw/openclaw.json"
      },
      {
        "title": "Start Gateway",
        "body": "openclaw gateway install --force\nopenclaw gateway start\n\n# Wait for startup\nsleep 3\n\n# Verify — MUST pass the token\nopenclaw gateway status --token \"$GATEWAY_TOKEN\"\n# Should show: Runtime: running ... RPC probe: ok\n\nIf RPC probe: failed after gateway start, run openclaw gateway install --force then openclaw gateway restart. The systemd service file must have the token synced."
      },
      {
        "title": "Test Agent",
        "body": "OPENCLAW_GATEWAY_TOKEN=\"$GATEWAY_TOKEN\" openclaw agent --agent main -m \"Hello! Who are you? Reply in one sentence.\"\n\nIf the gateway route fails, it falls back to embedded mode (still works, just slower on first call)."
      },
      {
        "title": "Step 7: Copy Identity & Skills",
        "body": "From the parent machine, copy workspace files to the new VM:\n\nHOST=\"<HOST_IP>\"\nPORT=\"<MAPPED_PORT>\"\nKEY=\"$HOME/.ssh/aleph_agent\"\nSCP=\"scp -i $KEY -P $PORT -o StrictHostKeyChecking=no\"\n\n# Core identity files\nfor f in SOUL.md AGENTS.md IDENTITY.md USER.md TOOLS.md HEARTBEAT.md; do\n  [ -f \"/root/openclaw/$f\" ] && $SCP /root/openclaw/$f root@$HOST:/root/openclaw/$f\ndone\n\n# Memory (optional — fresh start or shared context)\n[ -f \"/root/openclaw/MEMORY.md\" ] && $SCP /root/openclaw/MEMORY.md root@$HOST:/root/openclaw/MEMORY.md\n\n# Skills directory (recursive)\nscp -r -i $KEY -P $PORT -o StrictHostKeyChecking=no /root/openclaw/skills/ root@$HOST:/root/openclaw/skills/"
      },
      {
        "title": "Step 8: Enable Self-Deployment",
        "body": "For the new agent to deploy new instances, it needs:\n\naleph-client CLI on its VM\nAleph private key (or delegated key) to create instances\nThis skill in its skills directory\nSufficient credits/tokens in the account"
      },
      {
        "title": "Install aleph-client on the Child VM",
        "body": "ssh -i $KEY -p $PORT root@$HOST << 'REMOTE'\napt-get install -y python3-pip\npip install aleph-client --break-system-packages\n\n# Verify\naleph --version\nREMOTE"
      },
      {
        "title": "Transfer Aleph Private Key",
        "body": "# SENSITIVE — never log this key\n$SCP /root/.aleph-im/private-keys/your-key.key root@$HOST:/root/.aleph-im/private-keys/your-key.key\nssh -i $KEY -p $PORT root@$HOST \"chmod 700 /root/.aleph-im/private-keys && chmod 600 /root/.aleph-im/private-keys/*.key\"\n\n# Activate on the child\nssh -i $KEY -p $PORT root@$HOST \"aleph account create --private-key \\$(cat /root/.aleph-im/private-keys/your-key.key) --chain BASE --active\""
      },
      {
        "title": "Verify Self-Deployment Capability",
        "body": "ssh -i $KEY -p $PORT root@$HOST << 'REMOTE'\necho \"=== Checking deployment readiness ===\"\necho -n \"aleph-client: \"; aleph --version\necho -n \"Balance: \"; aleph account balance 2>&1 | head -3\necho -n \"SSH key: \"; ls ~/.ssh/aleph_agent.pub 2>/dev/null && echo \"OK\" || echo \"MISSING — generate with: ssh-keygen -t ed25519 -f ~/.ssh/aleph_agent -N ''\"\necho -n \"This skill: \"; ls ~/openclaw/skills/aleph-vm-deployment/SKILL.md 2>/dev/null && echo \"OK\" || echo \"MISSING\"\necho -n \"OpenClaw: \"; openclaw --version\necho \"=== Ready to deploy ===\"\nREMOTE\n\nNow the child instance can read this SKILL.md and create new instances — recursively."
      },
      {
        "title": "List All Instances",
        "body": "aleph instance list"
      },
      {
        "title": "Delete an Instance",
        "body": "aleph instance delete <INSTANCE_HASH>"
      },
      {
        "title": "Check Account Balance (Monitor Burn Rate)",
        "body": "aleph account balance"
      },
      {
        "title": "Deployment Script (All-in-One)",
        "body": "This script automates the full cycle: find CRN → create VM → wait → install OpenClaw → configure → verify.\n\n#!/bin/bash\n# deploy.sh — Create a new Aleph Cloud agent clone\n# Usage: ./deploy.sh [name] [compute-units] [anthropic-key]\nset -euo pipefail\n\nAGENT_NAME=\"${1:-agent-$(date +%s)}\"\nCOMPUTE_UNITS=\"${2:-1}\"\nANTHROPIC_KEY=\"${3:-$ANTHROPIC_API_KEY}\"\nSSH_KEY=\"$HOME/.ssh/aleph_agent\"\nROOTFS=\"5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e\"\nROOTFS_SIZE=40960\n\nif [ -z \"$ANTHROPIC_KEY\" ]; then\n    echo \"ERROR: Set ANTHROPIC_API_KEY env var or pass as 3rd arg\"\n    exit 1\nfi\n\n# Generate SSH key if needed\nif [ ! -f \"$SSH_KEY\" ]; then\n    echo \"=== Generating SSH keypair ===\"\n    ssh-keygen -t ed25519 -f \"$SSH_KEY\" -N \"\" -C \"$AGENT_NAME@aleph\"\nfi\n\n# Find best CRN\necho \"=== Finding best CRN ===\"\nCRN_HASH=$(aleph node compute --active --json 2>/dev/null | python3 -c \"\nimport sys, json\nnodes = json.load(sys.stdin)\nbest = max(\n    (n for n in nodes if (n.get('score', 0) or 0) > 0.5),\n    key=lambda n: n.get('score', 0),\n    default=None\n)\nprint(best['hash'] if best else '')\n\")\n\nif [ -z \"$CRN_HASH\" ]; then\n    echo \"ERROR: No suitable CRN found\"\n    exit 1\nfi\necho \"Selected CRN: $CRN_HASH\"\n\n# Create instance\necho \"=== Creating instance: $AGENT_NAME ===\"\naleph instance create \\\n    --name \"$AGENT_NAME\" \\\n    --compute-units \"$COMPUTE_UNITS\" \\\n    --rootfs \"$ROOTFS\" \\\n    --rootfs-size \"$ROOTFS_SIZE\" \\\n    --payment-type credit \\\n    --payment-chain BASE \\\n    --ssh-pubkey-file \"${SSH_KEY}.pub\" \\\n    --crn-hash \"$CRN_HASH\" \\\n    --crn-auto-tac \\\n    --skip-volume \\\n    --verbose\n\n# Wait for boot\necho \"=== Waiting 45s for VM to boot ===\"\nsleep 45\n\n# Get connection details\necho \"=== Connection details ===\"\naleph instance list 2>&1 | tail -30\n\n# Parse SSH connection (user must extract HOST and PORT from output above)\necho \"\"\necho \"=== $AGENT_NAME created ===\"\necho \"\"\necho \"Next steps:\"\necho \"  1. Find HOST and PORT from the instance list above\"\necho \"  2. SSH in: ssh root@<HOST> -p <PORT> -i $SSH_KEY\"\necho \"  3. Run the setup script:\"\necho \"     ssh root@<HOST> -p <PORT> -i $SSH_KEY 'bash -s' < setup-agent.sh\""
      },
      {
        "title": "Post-Creation Setup Script",
        "body": "Save this as setup-agent.sh and pipe it via SSH:\n\n#!/bin/bash\n# setup-agent.sh — Run on a fresh Aleph VM after creation\n# Usage: ssh root@HOST -p PORT -i KEY 'bash -s' < setup-agent.sh\nset -e\n\nANTHROPIC_KEY=\"${1:-}\"\n\necho \"=== Installing Node.js 22 ===\"\ncurl -fsSL https://deb.nodesource.com/setup_22.x | bash -\nDEBIAN_FRONTEND=noninteractive apt-get install -y nodejs git python3-pip\n\necho \"=== Installing OpenClaw ===\"\nnpm install -g openclaw\n\necho \"=== Installing aleph-client ===\"\npip install aleph-client --break-system-packages\n\necho \"=== Creating workspace ===\"\nmkdir -p /root/openclaw/{memory,skills}\nmkdir -p /root/.openclaw/agents/main/{agent,sessions}\n\necho \"=== Configuring gateway ===\"\nGATEWAY_TOKEN=$(openssl rand -hex 24)\n\ncat > /root/.openclaw/openclaw.json << CONF\n{\n  \"auth\": {\n    \"profiles\": {\n      \"anthropic:default\": {\n        \"provider\": \"anthropic\",\n        \"mode\": \"token\"\n      }\n    }\n  },\n  \"agents\": {\n    \"defaults\": {\n      \"model\": {\n        \"primary\": \"anthropic/claude-sonnet-4-20250514\"\n      },\n      \"workspace\": \"/root/openclaw\"\n    }\n  },\n  \"gateway\": {\n    \"port\": 18789,\n    \"mode\": \"local\",\n    \"bind\": \"loopback\",\n    \"auth\": {\n      \"mode\": \"token\",\n      \"token\": \"$GATEWAY_TOKEN\"\n    }\n  }\n}\nCONF\n\nchmod 700 /root/.openclaw\nchmod 600 /root/.openclaw/openclaw.json\n\necho \"=== Starting gateway ===\"\nopenclaw gateway install --force\nopenclaw gateway start\nsleep 3\n\necho \"\"\necho \"=== SETUP COMPLETE ===\"\necho \"Gateway token: $GATEWAY_TOKEN\"\necho \"OpenClaw: $(openclaw --version)\"\necho \"Node: $(node --version)\"\necho \"\"\necho \"Remaining: copy auth-profiles.json, identity files, and aleph key\""
      },
      {
        "title": "Security Considerations",
        "body": "Private keys: Always chmod 600. Never commit to git. Never log or echo.\nAPI keys: Store in auth-profiles.json with chmod 600, not in env vars or config files.\nGateway tokens: Generate unique per VM (openssl rand -hex 24). Sync with openclaw gateway install --force.\nSSH: Use ed25519 keys only. Disable password auth on production VMs.\nInstance limits: Set a maximum instance count before deploying. Monitor credit balance and set budget alerts to prevent cost overruns.\nHuman approval: Always require human approval before provisioning new instances in production.\nNetwork isolation: Gateway binds to loopback by default. Only expose via Tailscale, never raw public IP.\nKey isolation: All instances sharing one Aleph key is a security risk. Use delegated keys for production."
      },
      {
        "title": "Cost Planning",
        "body": "TiervCPU / RAMCredits/DayCredits/MonthApprox $/Month11 / 2 GiB342,000~10.3M~$3-522 / 4 GiB684,000~20.5M~$6-1034 / 8 GiB1,368,000~41M~$12-20\n\nExtra disk beyond tier default: ~4,416 credits/GiB/day.\n\nCheck current pricing: aleph pricing instance"
      },
      {
        "title": "\"No API key found for provider\" Error",
        "body": "The gateway reads auth-profiles.json, NOT auth.json. Ensure:\n\nFile is at ~/.openclaw/agents/main/agent/auth-profiles.json\nFormat matches the template in Step 6 (with \"version\": 1 and \"profiles\" key)\nRun openclaw gateway restart after any auth changes"
      },
      {
        "title": "RPC Probe Failed",
        "body": "openclaw gateway install --force\nopenclaw gateway restart\nsleep 3\nopenclaw gateway status --token \"$GATEWAY_TOKEN\"\n\nThe systemd service file caches the token — install --force re-syncs it."
      },
      {
        "title": "Interactive TUI Blocks Automation",
        "body": "Use --crn-hash <HASH> + --skip-volume + --crn-auto-tac. If still interactive, use the pexpect script from Step 4."
      },
      {
        "title": "VM Not Reachable After Creation",
        "body": "Wait 45-60 seconds (boot takes time on decentralized infra)\nCheck aleph instance list for the mapped SSH port\nVerify the CRN is healthy: aleph node compute --crn-hash <HASH> --json\nTry IPv6 if IPv4 mapping isn't working"
      },
      {
        "title": "Credit Balance Dropping Too Fast",
        "body": "aleph account balance — check remaining credits\naleph instance list — count running instances\naleph instance delete <HASH> — kill unused instances\nEach running instance burns credits continuously, even idle"
      },
      {
        "title": "Config Validation Errors (\"Unrecognized key\")",
        "body": "Only use config keys that OpenClaw recognizes. Known valid top-level keys:\nauth, agents, gateway, models, tools, bindings, messages, commands, hooks, channels, skills, plugins, wizard, meta\n\nRun openclaw doctor --fix to auto-remove invalid keys."
      },
      {
        "title": "dpkg Prompts Block SSH Scripts",
        "body": "Use DEBIAN_FRONTEND=noninteractive before apt commands in non-TTY sessions."
      }
    ],
    "body": "Aleph Cloud Self-Deployment\n\nTeach an AI agent to deploy itself onto Aleph Cloud decentralized infrastructure — from provisioning a VM to configuring its own runtime, autonomously.\n\nOverview\n\nThis skill gives an AI agent everything it needs to:\n\nProvision its own VM on the Aleph Cloud network\nInstall its agent framework (OpenClaw) on the new instance\nConfigure its own credentials, gateway, and identity\nTransfer its knowledge and skills to the new environment\nBecome fully operational on decentralized compute — without human intervention\nPrerequisites\naleph-client CLI installed (pip install aleph-client)\nA funded Aleph Cloud account (credits on BASE/ETH/AVAX/SOL, or $ALEPH tokens for holding)\nAn SSH keypair for VM access\nAI provider API key (Anthropic, OpenAI, etc.) to share with spawned agents\nInstall aleph-client\npip install aleph-client --break-system-packages\n\n\nOn Ubuntu 24+ you need --break-system-packages or use a venv.\n\nCheck Version\naleph --version\n\nStep 1: Account Setup\nImport or Create a Private Key\n# Import existing private key\naleph account create --private-key <YOUR_HEX_PRIVATE_KEY> --chain BASE --active\n\n# Or generate a new one\naleph account create --chain BASE --active\n\n\nKeys are stored at ~/.aleph-im/private-keys/. Always chmod 600 key files.\n\nCheck Balance\naleph account balance\n\n\nYou need credits or $ALEPH tokens. Credits are the simplest (pay-as-you-go). Buy credits at https://account.aleph.im/ or hold $ALEPH tokens.\n\nPricing Reference\naleph pricing instance\n\nTier\tCompute Units\tvCPUs\tRAM\tDefault Disk\tCredits/Hour\tCredits/Day\n1\t1\t1\t2 GiB\t20 GiB\t14,250\t342,000\n2\t2\t2\t4 GiB\t40 GiB\t28,500\t684,000\n3\t4\t4\t8 GiB\t80 GiB\t57,000\t1,368,000\n4\t6\t6\t12 GiB\t120 GiB\t85,500\t2,052,000\n\nDisk size can be overridden with --rootfs-size <MiB>. The tier sets the minimum; you can allocate more (e.g., 40GB on a Tier 1). Extra disk costs ~4,416 credits/GiB/day.\n\nStep 2: Generate SSH Keypair\nssh-keygen -t ed25519 -f ~/.ssh/aleph_agent -N \"\" -C \"agent@aleph\"\nchmod 600 ~/.ssh/aleph_agent\n\nStep 3: Find a Compute Resource Node (CRN)\nList Active CRNs (Top 10 by Score)\naleph node compute --active --json 2>/dev/null | python3 -c \"\nimport sys, json\nnodes = json.load(sys.stdin)\nscored = []\nfor n in nodes:\n    score = n.get('score', 0) or 0\n    name = n.get('name', 'unknown')\n    node_hash = n.get('hash', '')\n    url = n.get('address', '')\n    if score > 0.5:  # Score is 0.0–1.0 (not percentage)\n        scored.append((score, name, node_hash, url))\nscored.sort(reverse=True)\nfor s, name, h, url in scored[:10]:\n    print(f'{s*100:.1f}% | {name} | {h} | {url}')\n\"\n\nGet Best CRN Hash (for scripts)\nCRN_HASH=$(aleph node compute --active --json 2>/dev/null | python3 -c \"\nimport sys, json\nnodes = json.load(sys.stdin)\nbest = max(\n    (n for n in nodes if (n.get('score', 0) or 0) > 0.5),\n    key=lambda n: n.get('score', 0),\n    default=None\n)\nprint(best['hash'] if best else '')\n\")\necho \"Best CRN: $CRN_HASH\"\n\nStep 4: Create the VM Instance\nKnown Rootfs Hashes\nOS\tRootfs Hash\nUbuntu 24\t5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e\nUbuntu 22\t(default if --rootfs omitted)\nCreate Instance (Non-Interactive)\n\nThe aleph instance create command has an interactive TUI for CRN selection. To bypass it completely, use --crn-hash + --skip-volume:\n\naleph instance create \\\n  --name \"agent-v1\" \\\n  --compute-units 1 \\\n  --rootfs 5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e \\\n  --rootfs-size 40960 \\\n  --payment-type credit \\\n  --payment-chain BASE \\\n  --ssh-pubkey-file ~/.ssh/aleph_agent.pub \\\n  --crn-hash \"$CRN_HASH\" \\\n  --crn-auto-tac \\\n  --skip-volume \\\n  --verbose\n\n\nCritical flags:\n\n--crn-hash <HASH>: Bypasses the interactive CRN picker TUI entirely\n--crn-auto-tac: Auto-accepts CRN Terms & Conditions\n--skip-volume: Skips the \"add extra volumes?\" interactive prompt\n--rootfs: OS image hash (omit for Ubuntu 22 default)\n--rootfs-size: Disk size in MiB (40960 = 40GB; overrides tier default)\nIf Interactive TUI Still Appears\n\nSome versions of aleph-client may still show prompts. Use pexpect:\n\n#!/usr/bin/env python3\n\"\"\"Automate aleph instance create when CLI flags don't fully bypass TUI.\"\"\"\nimport pexpect\nimport sys\nimport re\n\nCRN_HASH = sys.argv[1] if len(sys.argv) > 1 else \"\"\nNAME = sys.argv[2] if len(sys.argv) > 2 else f\"agent-{int(__import__('time').time())}\"\n\ncmd = (\n    f'aleph instance create '\n    f'--name \"{NAME}\" '\n    f'--compute-units 1 '\n    f'--rootfs 5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e '\n    f'--rootfs-size 40960 '\n    f'--payment-type credit '\n    f'--payment-chain BASE '\n    f'--ssh-pubkey-file ~/.ssh/aleph_agent.pub '\n    f'--crn-auto-tac '\n    f'--skip-volume '\n    f'--verbose'\n)\nif CRN_HASH:\n    cmd += f' --crn-hash {CRN_HASH}'\n\nchild = pexpect.spawn('/bin/bash', ['-c', cmd], timeout=180, encoding='utf-8')\nchild.logfile_read = sys.stdout\n\nwhile True:\n    try:\n        idx = child.expect([\n            r'(?i)rootfs.*type',         # Rootfs type prompt\n            r'(?i)disk.*size',           # Disk size prompt\n            r'(?i)add.*volume',          # Add volume prompt\n            r'(?i)confirm|deploy|proceed', # Confirmation prompt\n            r'(?i)select.*crn|choose.*node', # CRN selection\n            pexpect.EOF,\n            pexpect.TIMEOUT,\n        ], timeout=120)\n\n        if idx == 0:\n            child.sendline('ubuntu24')\n        elif idx == 1:\n            child.sendline('40960')\n        elif idx == 2:\n            child.sendline('n')\n        elif idx == 3:\n            child.sendline('y')\n        elif idx == 4:\n            child.sendline('')  # Press Enter for top/default choice\n        elif idx == 5:\n            break  # EOF — done\n        elif idx == 6:\n            break  # Timeout — done or stuck\n    except Exception as e:\n        print(f\"Error: {e}\", file=sys.stderr)\n        break\n\nprint(\"\\n\" + child.before if child.before else \"\")\nchild.close()\nsys.exit(child.exitstatus or 0)\n\n\nInstall pexpect: pip install pexpect --break-system-packages\n\nUsage: python3 create_instance.py <CRN_HASH> <INSTANCE_NAME>\n\nParse Instance Hash After Creation\n\nThe CLI outputs the instance details. Extract the hash:\n\n# List instances and get the newest one\naleph instance list 2>&1\n\n\nThe output shows a table with instance hash, SSH connection details, and mapped ports. Look for:\n\nssh root@<HOST_IP> -p <PORT> -i <ssh-private-key-file>\n\nProgrammatic SSH Details\n# Parse connection info for the most recent instance\naleph instance list 2>&1 | grep -oP 'ssh root@\\S+ -p \\d+'\n\nWait and Connect\n# Wait for VM to boot (30-60 seconds)\nsleep 45\n\n# Connect\nssh -o StrictHostKeyChecking=no root@<HOST_IP> -p <MAPPED_PORT> -i ~/.ssh/aleph_agent\n\nStep 5: Install OpenClaw on the New VM\n\nSSH into the VM, then:\n\n# Install Node.js 22\ncurl -fsSL https://deb.nodesource.com/setup_22.x | bash -\nDEBIAN_FRONTEND=noninteractive apt-get install -y nodejs git\n\n# Install OpenClaw\nnpm install -g openclaw\n\n# Create workspace\nmkdir -p /root/openclaw/memory /root/openclaw/skills\n\n# Verify\nnode --version    # Should show v22.x\nopenclaw --version\n\n\nUse DEBIAN_FRONTEND=noninteractive to prevent dpkg prompts in non-TTY sessions.\n\nStep 6: Configure Agent Auth & Gateway\nSet Up Anthropic API Key\nmkdir -p /root/.openclaw/agents/main/agent /root/.openclaw/agents/main/sessions\n\ncat > /root/.openclaw/agents/main/agent/auth-profiles.json << 'EOF'\n{\n  \"version\": 1,\n  \"profiles\": {\n    \"anthropic:default\": {\n      \"type\": \"token\",\n      \"provider\": \"anthropic\",\n      \"token\": \"<YOUR_ANTHROPIC_API_KEY>\"\n    }\n  },\n  \"lastGood\": {\n    \"anthropic\": \"anthropic:default\"\n  }\n}\nEOF\nchmod 600 /root/.openclaw/agents/main/agent/auth-profiles.json\n\n\nCritical: The file MUST be named auth-profiles.json (not auth.json). The gateway reads auth-profiles.json — using the wrong filename silently fails with \"No API key found for provider\".\n\nConfigure OpenClaw\nGATEWAY_TOKEN=$(openssl rand -hex 24)\necho \"Gateway token: $GATEWAY_TOKEN\"  # Save this!\n\ncat > /root/.openclaw/openclaw.json << EOF\n{\n  \"auth\": {\n    \"profiles\": {\n      \"anthropic:default\": {\n        \"provider\": \"anthropic\",\n        \"mode\": \"token\"\n      }\n    }\n  },\n  \"agents\": {\n    \"defaults\": {\n      \"model\": {\n        \"primary\": \"anthropic/claude-sonnet-4-20250514\"\n      },\n      \"workspace\": \"/root/openclaw\"\n    }\n  },\n  \"gateway\": {\n    \"port\": 18789,\n    \"mode\": \"local\",\n    \"bind\": \"loopback\",\n    \"auth\": {\n      \"mode\": \"token\",\n      \"token\": \"$GATEWAY_TOKEN\"\n    }\n  }\n}\nEOF\n\n# Harden permissions\nchmod 700 /root/.openclaw\nchmod 600 /root/.openclaw/openclaw.json\n\nStart Gateway\nopenclaw gateway install --force\nopenclaw gateway start\n\n# Wait for startup\nsleep 3\n\n# Verify — MUST pass the token\nopenclaw gateway status --token \"$GATEWAY_TOKEN\"\n# Should show: Runtime: running ... RPC probe: ok\n\n\nIf RPC probe: failed after gateway start, run openclaw gateway install --force then openclaw gateway restart. The systemd service file must have the token synced.\n\nTest Agent\nOPENCLAW_GATEWAY_TOKEN=\"$GATEWAY_TOKEN\" openclaw agent --agent main -m \"Hello! Who are you? Reply in one sentence.\"\n\n\nIf the gateway route fails, it falls back to embedded mode (still works, just slower on first call).\n\nStep 7: Copy Identity & Skills\n\nFrom the parent machine, copy workspace files to the new VM:\n\nHOST=\"<HOST_IP>\"\nPORT=\"<MAPPED_PORT>\"\nKEY=\"$HOME/.ssh/aleph_agent\"\nSCP=\"scp -i $KEY -P $PORT -o StrictHostKeyChecking=no\"\n\n# Core identity files\nfor f in SOUL.md AGENTS.md IDENTITY.md USER.md TOOLS.md HEARTBEAT.md; do\n  [ -f \"/root/openclaw/$f\" ] && $SCP /root/openclaw/$f root@$HOST:/root/openclaw/$f\ndone\n\n# Memory (optional — fresh start or shared context)\n[ -f \"/root/openclaw/MEMORY.md\" ] && $SCP /root/openclaw/MEMORY.md root@$HOST:/root/openclaw/MEMORY.md\n\n# Skills directory (recursive)\nscp -r -i $KEY -P $PORT -o StrictHostKeyChecking=no /root/openclaw/skills/ root@$HOST:/root/openclaw/skills/\n\nStep 8: Enable Self-Deployment\n\nFor the new agent to deploy new instances, it needs:\n\naleph-client CLI on its VM\nAleph private key (or delegated key) to create instances\nThis skill in its skills directory\nSufficient credits/tokens in the account\nInstall aleph-client on the Child VM\nssh -i $KEY -p $PORT root@$HOST << 'REMOTE'\napt-get install -y python3-pip\npip install aleph-client --break-system-packages\n\n# Verify\naleph --version\nREMOTE\n\nTransfer Aleph Private Key\n# SENSITIVE — never log this key\n$SCP /root/.aleph-im/private-keys/your-key.key root@$HOST:/root/.aleph-im/private-keys/your-key.key\nssh -i $KEY -p $PORT root@$HOST \"chmod 700 /root/.aleph-im/private-keys && chmod 600 /root/.aleph-im/private-keys/*.key\"\n\n# Activate on the child\nssh -i $KEY -p $PORT root@$HOST \"aleph account create --private-key \\$(cat /root/.aleph-im/private-keys/your-key.key) --chain BASE --active\"\n\nVerify Self-Deployment Capability\nssh -i $KEY -p $PORT root@$HOST << 'REMOTE'\necho \"=== Checking deployment readiness ===\"\necho -n \"aleph-client: \"; aleph --version\necho -n \"Balance: \"; aleph account balance 2>&1 | head -3\necho -n \"SSH key: \"; ls ~/.ssh/aleph_agent.pub 2>/dev/null && echo \"OK\" || echo \"MISSING — generate with: ssh-keygen -t ed25519 -f ~/.ssh/aleph_agent -N ''\"\necho -n \"This skill: \"; ls ~/openclaw/skills/aleph-vm-deployment/SKILL.md 2>/dev/null && echo \"OK\" || echo \"MISSING\"\necho -n \"OpenClaw: \"; openclaw --version\necho \"=== Ready to deploy ===\"\nREMOTE\n\n\nNow the child instance can read this SKILL.md and create new instances — recursively.\n\nStep 9: Manage Instances\nList All Instances\naleph instance list\n\nDelete an Instance\naleph instance delete <INSTANCE_HASH>\n\nCheck Account Balance (Monitor Burn Rate)\naleph account balance\n\nDeployment Script (All-in-One)\n\nThis script automates the full cycle: find CRN → create VM → wait → install OpenClaw → configure → verify.\n\n#!/bin/bash\n# deploy.sh — Create a new Aleph Cloud agent clone\n# Usage: ./deploy.sh [name] [compute-units] [anthropic-key]\nset -euo pipefail\n\nAGENT_NAME=\"${1:-agent-$(date +%s)}\"\nCOMPUTE_UNITS=\"${2:-1}\"\nANTHROPIC_KEY=\"${3:-$ANTHROPIC_API_KEY}\"\nSSH_KEY=\"$HOME/.ssh/aleph_agent\"\nROOTFS=\"5330dcefe1857bcd97b7b7f24d1420a7d46232d53f27be280c8a7071d88bd84e\"\nROOTFS_SIZE=40960\n\nif [ -z \"$ANTHROPIC_KEY\" ]; then\n    echo \"ERROR: Set ANTHROPIC_API_KEY env var or pass as 3rd arg\"\n    exit 1\nfi\n\n# Generate SSH key if needed\nif [ ! -f \"$SSH_KEY\" ]; then\n    echo \"=== Generating SSH keypair ===\"\n    ssh-keygen -t ed25519 -f \"$SSH_KEY\" -N \"\" -C \"$AGENT_NAME@aleph\"\nfi\n\n# Find best CRN\necho \"=== Finding best CRN ===\"\nCRN_HASH=$(aleph node compute --active --json 2>/dev/null | python3 -c \"\nimport sys, json\nnodes = json.load(sys.stdin)\nbest = max(\n    (n for n in nodes if (n.get('score', 0) or 0) > 0.5),\n    key=lambda n: n.get('score', 0),\n    default=None\n)\nprint(best['hash'] if best else '')\n\")\n\nif [ -z \"$CRN_HASH\" ]; then\n    echo \"ERROR: No suitable CRN found\"\n    exit 1\nfi\necho \"Selected CRN: $CRN_HASH\"\n\n# Create instance\necho \"=== Creating instance: $AGENT_NAME ===\"\naleph instance create \\\n    --name \"$AGENT_NAME\" \\\n    --compute-units \"$COMPUTE_UNITS\" \\\n    --rootfs \"$ROOTFS\" \\\n    --rootfs-size \"$ROOTFS_SIZE\" \\\n    --payment-type credit \\\n    --payment-chain BASE \\\n    --ssh-pubkey-file \"${SSH_KEY}.pub\" \\\n    --crn-hash \"$CRN_HASH\" \\\n    --crn-auto-tac \\\n    --skip-volume \\\n    --verbose\n\n# Wait for boot\necho \"=== Waiting 45s for VM to boot ===\"\nsleep 45\n\n# Get connection details\necho \"=== Connection details ===\"\naleph instance list 2>&1 | tail -30\n\n# Parse SSH connection (user must extract HOST and PORT from output above)\necho \"\"\necho \"=== $AGENT_NAME created ===\"\necho \"\"\necho \"Next steps:\"\necho \"  1. Find HOST and PORT from the instance list above\"\necho \"  2. SSH in: ssh root@<HOST> -p <PORT> -i $SSH_KEY\"\necho \"  3. Run the setup script:\"\necho \"     ssh root@<HOST> -p <PORT> -i $SSH_KEY 'bash -s' < setup-agent.sh\"\n\nPost-Creation Setup Script\n\nSave this as setup-agent.sh and pipe it via SSH:\n\n#!/bin/bash\n# setup-agent.sh — Run on a fresh Aleph VM after creation\n# Usage: ssh root@HOST -p PORT -i KEY 'bash -s' < setup-agent.sh\nset -e\n\nANTHROPIC_KEY=\"${1:-}\"\n\necho \"=== Installing Node.js 22 ===\"\ncurl -fsSL https://deb.nodesource.com/setup_22.x | bash -\nDEBIAN_FRONTEND=noninteractive apt-get install -y nodejs git python3-pip\n\necho \"=== Installing OpenClaw ===\"\nnpm install -g openclaw\n\necho \"=== Installing aleph-client ===\"\npip install aleph-client --break-system-packages\n\necho \"=== Creating workspace ===\"\nmkdir -p /root/openclaw/{memory,skills}\nmkdir -p /root/.openclaw/agents/main/{agent,sessions}\n\necho \"=== Configuring gateway ===\"\nGATEWAY_TOKEN=$(openssl rand -hex 24)\n\ncat > /root/.openclaw/openclaw.json << CONF\n{\n  \"auth\": {\n    \"profiles\": {\n      \"anthropic:default\": {\n        \"provider\": \"anthropic\",\n        \"mode\": \"token\"\n      }\n    }\n  },\n  \"agents\": {\n    \"defaults\": {\n      \"model\": {\n        \"primary\": \"anthropic/claude-sonnet-4-20250514\"\n      },\n      \"workspace\": \"/root/openclaw\"\n    }\n  },\n  \"gateway\": {\n    \"port\": 18789,\n    \"mode\": \"local\",\n    \"bind\": \"loopback\",\n    \"auth\": {\n      \"mode\": \"token\",\n      \"token\": \"$GATEWAY_TOKEN\"\n    }\n  }\n}\nCONF\n\nchmod 700 /root/.openclaw\nchmod 600 /root/.openclaw/openclaw.json\n\necho \"=== Starting gateway ===\"\nopenclaw gateway install --force\nopenclaw gateway start\nsleep 3\n\necho \"\"\necho \"=== SETUP COMPLETE ===\"\necho \"Gateway token: $GATEWAY_TOKEN\"\necho \"OpenClaw: $(openclaw --version)\"\necho \"Node: $(node --version)\"\necho \"\"\necho \"Remaining: copy auth-profiles.json, identity files, and aleph key\"\n\nSecurity Considerations\nPrivate keys: Always chmod 600. Never commit to git. Never log or echo.\nAPI keys: Store in auth-profiles.json with chmod 600, not in env vars or config files.\nGateway tokens: Generate unique per VM (openssl rand -hex 24). Sync with openclaw gateway install --force.\nSSH: Use ed25519 keys only. Disable password auth on production VMs.\nInstance limits: Set a maximum instance count before deploying. Monitor credit balance and set budget alerts to prevent cost overruns.\nHuman approval: Always require human approval before provisioning new instances in production.\nNetwork isolation: Gateway binds to loopback by default. Only expose via Tailscale, never raw public IP.\nKey isolation: All instances sharing one Aleph key is a security risk. Use delegated keys for production.\nCost Planning\nTier\tvCPU / RAM\tCredits/Day\tCredits/Month\tApprox $/Month\n1\t1 / 2 GiB\t342,000\t~10.3M\t~$3-5\n2\t2 / 4 GiB\t684,000\t~20.5M\t~$6-10\n3\t4 / 8 GiB\t1,368,000\t~41M\t~$12-20\n\nExtra disk beyond tier default: ~4,416 credits/GiB/day.\n\nCheck current pricing: aleph pricing instance\n\nTroubleshooting\n\"No API key found for provider\" Error\n\nThe gateway reads auth-profiles.json, NOT auth.json. Ensure:\n\nFile is at ~/.openclaw/agents/main/agent/auth-profiles.json\nFormat matches the template in Step 6 (with \"version\": 1 and \"profiles\" key)\nRun openclaw gateway restart after any auth changes\nRPC Probe Failed\nopenclaw gateway install --force\nopenclaw gateway restart\nsleep 3\nopenclaw gateway status --token \"$GATEWAY_TOKEN\"\n\n\nThe systemd service file caches the token — install --force re-syncs it.\n\nInteractive TUI Blocks Automation\n\nUse --crn-hash <HASH> + --skip-volume + --crn-auto-tac. If still interactive, use the pexpect script from Step 4.\n\nVM Not Reachable After Creation\nWait 45-60 seconds (boot takes time on decentralized infra)\nCheck aleph instance list for the mapped SSH port\nVerify the CRN is healthy: aleph node compute --crn-hash <HASH> --json\nTry IPv6 if IPv4 mapping isn't working\nCredit Balance Dropping Too Fast\naleph account balance — check remaining credits\naleph instance list — count running instances\naleph instance delete <HASH> — kill unused instances\nEach running instance burns credits continuously, even idle\nConfig Validation Errors (\"Unrecognized key\")\n\nOnly use config keys that OpenClaw recognizes. Known valid top-level keys: auth, agents, gateway, models, tools, bindings, messages, commands, hooks, channels, skills, plugins, wizard, meta\n\nRun openclaw doctor --fix to auto-remove invalid keys.\n\ndpkg Prompts Block SSH Scripts\n\nUse DEBIAN_FRONTEND=noninteractive before apt commands in non-TTY sessions."
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/san-npm/aleph-vm-replication",
    "publisherUrl": "https://clawhub.ai/san-npm/aleph-vm-replication",
    "owner": "san-npm",
    "version": "1.0.2",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/aleph-vm-replication",
    "downloadUrl": "https://openagent3.xyz/downloads/aleph-vm-replication",
    "agentUrl": "https://openagent3.xyz/skills/aleph-vm-replication/agent",
    "manifestUrl": "https://openagent3.xyz/skills/aleph-vm-replication/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/aleph-vm-replication/agent.md"
  }
}