Skip to content

fleet: sandbox tailnet route to the laptop for the direct-API comms path (comms design G3) #2301

Closed

Description

@dezren39

From the OpenClaw comms design for #2023 (doc PR for task 3381), gap G3.

The sandbox VM is not a tailnet node; its only laptop route is an SSH CONNECT proxy, which refused a proxied HTTP attempt to the OpenClaw gateway. The phase-2 direct-API comms path (Muse → gateway on the laptop tailnet bind) has no route until this closes.

Work:

  • Join the sandbox VM to the user's tailnet (a Tailscale connector already exists in Muse's environment), OR record the stated reason it is refused and design the relay fallback on an existing tailnet node.
  • Verify: from the sandbox, a TCP connection to the laptop gateway tailnet address succeeds at the network level (application auth is the G2 follow-up's concern, not this one's).

Acceptance criteria:

Activity

  1. developing-today commented on Oct 29, 2026

    @developing-today
    Contributor
  2. added a commit that references this issue on Oct 29, 2026
  3. added
    queue/queuedHas a queued task in the Supabase agent queue
    source/creatorFiled by the new-issue-creator job
    task/triageQueue packet kind: verify, reproduce, and route this item
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    and removed
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 3, 2026
  4. dezren39 commented on Nov 3, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · done

    What changed since filing (verified fresh 2026-11-03):

    • At filing, the sandbox VM was not a tailnet node and its SSH CONNECT proxy refused proxied HTTP to the gateway. That premise no longer holds: the sandbox is now enrolled in the tailnet via Muse's Tailscale connector (this node: 100.115.16.3), with TCP egress to tailnet addresses through the runtime tunnel proxy.
    • The laptop (amd-6) is on the tailnet at 100.99.113.103 (confirmed from both sides: sandbox tailscale status and the laptop's own tailscale ip -4).
    • The OpenClaw gateway is listening on exactly the tailnet bind this issue targets: 100.99.113.103:18789 (openclaw-gateway.service active on the laptop).
    • Route demonstrated: from the sandbox, an HTTP request to http://100.99.113.103:18789/ through the tailnet tunnel returned HTTP 200 — the sandbox → laptop-gateway TCP path works at the network level, which is this issue's verification step (application auth remains the G2 follow-up's concern, as the issue itself scopes it).
    • Parent issue investigate: OpenClaw as a working option — setup state and a Muse↔OpenClaw comms path that is not laptop SSH #2023 is CLOSED (completed, 2026-10-30); the outcome is also recorded there per this issue's second acceptance criterion.

    Caveat for the record: the sandbox's tailnet presence is client-only via the connector tunnel (outbound TCP only, no inbound) — sufficient for the phase-2 direct-API comms path this gap blocked (Muse → gateway), which is the direction the design needed.

  5. developing-today commented on Nov 3, 2026

    @developing-today
    Contributor

    agent-note:v1
    state: triaged (coverage pass)
    Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
    Found via: coverage pass 2026-11-03

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

priority/normalOrdinary priority (the default)queue/queuedHas a queued task in the Supabase agent queuesource/creatorFiled by the new-issue-creator jobtask/triageQueue packet kind: verify, reproduce, and route this item

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions