Skip to content

fix(pm-stack): ready-for-agent binds 0.0.0.0:6056 while the rest of the stack binds loopback+tailnet - align bind scopes #1181

New issue
New issue
Open
Open
fix(pm-stack): ready-for-agent binds 0.0.0.0:6056 while the rest of the stack binds loopback+tailnet - align bind scopes#1181
Assignees
dezren39
Labels
app/pm-stackpm-stack (Pad/Grist) in developing-today/codeeffort/sSmall: expected under 2 hours of workkind/securitySecurity issue or security hardeningmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedpriority/highImportant and time-sensitivequeue/blockedQueue or user escalation statequeue/queuedHas a queued task in the Supabase agent queuesource/humanFiled directly by a humanstatus/blockedQueue or user escalation statetask/small-fixQueue packet kind: bounded fix with reproduction and targeted testsuser/escalatedQueue or user escalation state

Description

@dezren39
dezren39
opened on Oct 27, 2026

Finding

Evidence (live review 2026-10-26 ~22:40 CDT, laptop loopback + gh, cross-checked): ss on the laptop tonight: aggregator listens on 127.0.0.1 + 100.99.113.103 (tailnet) only; Grist and Pad the same; Kaneo loopback only (+ tunnel). ready-for-agent listens on 0.0.0.0:6056 - every interface including the LAN (and any future WAN-facing interface), inconsistent with the stack's settled access model (Drew, 2026-10-25: LAN/tailnet fine, public only behind a password) and with its own earlier tailnet-bind change in slice 1.

Proposal

Bind ready-for-agent to loopback + tailnet like the rest (its UI is consumed via tailnet/local agents - verify no LAN consumer exists first via its README/runbook), or document a deliberate exception with its reason. Add a bind-scope row to the topology table (topology issue) so drift is visible.

Acceptance

Acceptance criteria

  • ready-for-agent no longer listens on 0.0.0.0:6056: ss output after the change shows it bound to loopback + tailnet like the rest of the stack — OR the exception is documented with its reason and Drew-acknowledged on this issue.
  • The topology table gains a bind-scope row so future drift is visible.
  • Verification that no LAN consumer of the ready-for-agent UI exists (README/runbook check) is recorded before the bind changes.

Activity

  1. dezren39
    added
    kind/securitySecurity issue or security hardening
    task/small-fixQueue packet kind: bounded fix with reproduction and targeted tests
    app/pm-stackpm-stack (Pad/Grist) in developing-today/code
    on Oct 27, 2026

  2. developing-today commented on Oct 27, 2026

    @developing-today
    developing-todayBot
    on Oct 27, 2026 – with developing.today
    Contributor

    CODE-317

  3. github-actions
    assigned
    dezren39
    on Oct 27, 2026
  4. dezren39
    added a parent issue on Oct 27, 2026
  5. dezren39
    added
    status/needs-triageNot yet triaged; needs a first look
    source/humanFiled directly by a human
    meta/enrichedIntake review done: acceptance criteria, links, and normalized labels added
    priority/highImportant and time-sensitive
    effort/sSmall: expected under 2 hours of work
    on Oct 28, 2026

  6. dezren39 commented on Oct 28, 2026

    @dezren39
    dezren39
    on Oct 28, 2026
    MemberAuthor

    Intake review

    Fleet monitor intake enrichment (protocol §5) — 2026-10-28T06:25Z. This issue was filed 2026-10-27 by Drew (dezren39) from the 2026-10-26 live pm-stack review and had no priority/* label and no standard ## Acceptance criteria section; both are now supplied (the body's own Acceptance text is restated under the standard heading, original body preserved verbatim above it).

    • Related: Refs in body: pm-stack: Pad/Grist compose files hard-code one host's tailnet IP (100.99.113.103), breaking the documented move-hosts procedure #781 (host-config hygiene). No merged PR explicitly references or resolves this issue (checked this run).
    • Labels normalized: one kind/* (kept existing), source/human, status/needs-triage, priority/high, effort/s, app/pm-stack (existing), meta/enriched.
    • Still live: verified open this run; no merged PR or commit found that implements it.
    • Risks: Changing the bind before confirming there is no LAN consumer could cut off a real client; the issue's own verify-first step is the guard. Tailnet address can change on re-enrollment — prefer the stack's existing bind mechanism over a hard-coded address.
    • Suggested approach: Follow the stack's existing loopback+tailnet bind pattern used by the aggregator; verify with ss on the laptop post-change and paste the output on the issue.
  7. dezren39
    added
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    and removed
    status/needs-triageNot yet triaged; needs a first look
    on Nov 2, 2026

  8. 24 remaining items

  9. dezren39
    added
    queue/claimedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Nov 3, 2026

  10. dezren39 commented on Nov 3, 2026

    @dezren39
    dezren39
    on Nov 3, 2026
    MemberAuthor

    Handed off: task 7499 (small_fix, issue #1181) was claimed by lane code-l and assigned to the opencode execution lane. The laptop claimant launches the bound opencode session, which drives task 7499 to its terminal state (deploy + verify for issue #1181). Labels synced to this claim (queue/claimed + status/in-progress + work/assigned; queue/queued removed).

  11. dezren39
    added
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 3, 2026

  12. dezren39 commented on Nov 3, 2026

    @dezren39
    dezren39
    on Nov 3, 2026
    MemberAuthor

    Queue note (blocked → escalated to user, task 7499): the code half is merged and correct; the deploy needs an interactive sudo password, which no queue worker has.

    Verified this run (2026-11-03T12:52Z, on the laptop itself)

    Check Result
    ss -tlnp | grep 6056 LISTEN 0.0.0.0:6056 users:(("ready-for-agent",pid=158234)) — bug still live on the host
    systemctl --user is-active ready-for-agent.service active
    systemctl --user is-active ready-for-agent-tailnet.socket inactive
    PR #4657 merge 745c8b7f9 in primary clone main yes (main 9d1464c05)
    sudo -n true sudo: a password is required
    sudo -n -l same — no NOPASSWD rule
    deploy helper in ~/tools or ~/hatch/tools none

    So the NixOS-generated unit on this host still carries the old bind scope. The fix only takes effect after a rebuild from a tree containing the merge — which this clone already has. The single missing ingredient is root.

    What Drew needs to do (one command)

    From a tree containing 745c8b7f9 (the primary clone qualifies):

    sudo nixos-rebuild switch --flake ~/git/code#<laptop-host>

    Or grant a scoped NOPASSWD rule for nixos-rebuild switch if unattended deploys are wanted from now on.

    Verification for whoever runs it (no sudo needed)

    1. ss -tlnp | grep 6056 → expect only 127.0.0.1:6056 and 100.99.113.103:6056; 0.0.0.0:6056 must be gone.
    2. systemctl --user is-active ready-for-agent.service → active; systemctl --user is-active ready-for-agent-tailnet.socket → active.
    3. Aggregator ready-for-agent probe (pm-stack/aggregator) returns ok.
    4. Then close fix(pm-stack): ready-for-agent binds 0.0.0.0:6056 while the rest of the stack binds loopback+tailnet - align bind scopes #1181 with that evidence.

    Not touched

    No rebuild attempted, no source edits, no commits, and the primary clone's unpushed commits and dirty files (pkgs/id/src/chat.rs, pm-stack/aggregator/events.json) were left exactly as found — they belong to other lanes.

    Labels set to user/escalated + status/blocked + queue/blocked; the task is blocked with reason class escalated-to-user rather than parked, because this will not unblock on a timer.

  13. dezren39
    added
    queue/blockedQueue or user escalation state
    status/blockedQueue or user escalation state
    user/escalatedQueue or user escalation state
    and removed
    status/in-progressQueue worker lifecycle state
    queue/queuedHas a queued task in the Supabase agent queue
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Nov 3, 2026

  14. dezren39 commented on Nov 3, 2026

    @dezren39
    dezren39
    on Nov 3, 2026
    MemberAuthor

    Correction to the command above: this host's flake attribute is amd (hostname amd, nixos/hosts/default.nix → amd = host { ... framework/13-inch/7040-amd }). Exact command:

    sudo nixos-rebuild switch --flake ~/git/code#amd
  15. dezren39
    added
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/pm-stackpm-stack (Pad/Grist) in developing-today/codeeffort/sSmall: expected under 2 hours of workkind/securitySecurity issue or security hardeningmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedpriority/highImportant and time-sensitivequeue/blockedQueue or user escalation statequeue/queuedHas a queued task in the Supabase agent queuesource/humanFiled directly by a humanstatus/blockedQueue or user escalation statetask/small-fixQueue packet kind: bounded fix with reproduction and targeted testsuser/escalatedQueue or user escalation state

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions