tooling-tailscale skill: document the ward-tailnet shared-network consumer #293

New issue

Closed

opened 2026-06-26 00:26:05 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-06-26 00:26:05 +00:00

Owner

What

Sync the tooling-tailscale skill to the standing-shared-proxy design (agentic-os#291) once the mac-proxy compose gains the ward-tailnet network (infrastructure#402). The skill already documents the standing box correctly; this adds the shared-network second consumer it currently omits.

Files

.agents/skills/tooling-tailscale/references/containerized-setup.md
.agents/skills/tooling-tailscale/SKILL.md (description triggers + see-also only if needed)

Changes

In containerized-setup.md:

Update the compose block to match the landed infrastructure#402 shape - the tailscale service attached to a fixed-name ward-tailnet network:

services:
  tailscale:
    image: tailscale/tailscale:latest
    hostname: mac-proxy
    environment:
      TS_AUTHKEY: ${TS_AUTHKEY}
      TS_USERSPACE: "true"
      TS_SOCKS5_SERVER: 0.0.0.0:1055
    ports:
      - "127.0.0.1:1055:1055"   # host-side tools (ssh/curl) via Mac loopback
    networks: [ ward-tailnet ]
    restart: unless-stopped
networks:
  ward-tailnet:
    name: ward-tailnet          # literal docker name, shared with ward carries

Add a short "two consumers" note: the box serves both (1) Mac-host tools over the published 127.0.0.1:1055 (the existing SSH-through-SOCKS5 section), and (2) in-VM containers (ward agent carries) that share the ward-tailnet docker network and dial socks5h://mac-proxy:1055 by name. The default bridge does no name resolution, which is why the shared user-defined network exists.
Point the carry side at ward's own doc (docs/agent-ts-sidecar.md) for the launch-flag mechanics rather than duplicating it.

Out of scope

Do not document the old per-run <carry>-ts sidecar - it is being removed in ward#349. The skill should describe only the standing box.
No key/ACL changes.

Sequencing

This mirrors landed state, so it should land after infrastructure#402 (the compose actually carries ward-tailnet). If #402 is already merged when this runs, just match it; if not, match the spec above and note the dependency in the commit.

Done when

The skill's compose example matches the converged mac-proxy stack, the two-consumer model is documented, and pre-commit run --all-files (check-skills, dead-cross-links, etc.) is green.

## What Sync the `tooling-tailscale` skill to the standing-shared-proxy design (agentic-os#291) once the mac-proxy compose gains the `ward-tailnet` network (infrastructure#402). The skill already documents the standing box correctly; this adds the **shared-network second consumer** it currently omits. ## Files - `.agents/skills/tooling-tailscale/references/containerized-setup.md` - `.agents/skills/tooling-tailscale/SKILL.md` (description triggers + see-also only if needed) ## Changes In `containerized-setup.md`: - Update the compose block to match the landed `infrastructure#402` shape - the `tailscale` service attached to a fixed-name `ward-tailnet` network: ```yaml services: tailscale: image: tailscale/tailscale:latest hostname: mac-proxy environment: TS_AUTHKEY: ${TS_AUTHKEY} TS_USERSPACE: "true" TS_SOCKS5_SERVER: 0.0.0.0:1055 ports: - "127.0.0.1:1055:1055" # host-side tools (ssh/curl) via Mac loopback networks: [ ward-tailnet ] restart: unless-stopped networks: ward-tailnet: name: ward-tailnet # literal docker name, shared with ward carries ``` - Add a short **"two consumers"** note: the box serves both (1) **Mac-host tools** over the published `127.0.0.1:1055` (the existing SSH-through-SOCKS5 section), and (2) **in-VM containers** (ward agent carries) that share the `ward-tailnet` docker network and dial `socks5h://mac-proxy:1055` by name. The default bridge does no name resolution, which is why the shared user-defined network exists. - Point the carry side at ward's own doc (`docs/agent-ts-sidecar.md`) for the launch-flag mechanics rather than duplicating it. ## Out of scope - Do not document the old per-run `<carry>-ts` sidecar - it is being removed in ward#349. The skill should describe only the standing box. - No key/ACL changes. ## Sequencing This mirrors landed state, so it should land **after** infrastructure#402 (the compose actually carries `ward-tailnet`). If #402 is already merged when this runs, just match it; if not, match the spec above and note the dependency in the commit. ## Done when - The skill's compose example matches the converged mac-proxy stack, the two-consumer model is documented, and `pre-commit run --all-files` (check-skills, dead-cross-links, etc.) is green.

coilysiren commented

2026-06-26 00:26:08 +00:00

Author

Owner

🔒 Reserved by ward agent --driver claude — container ward-agentic-os-issue-293-claude-e62f9ecc on host docker-desktop is carrying this issue (reserved 2026-06-26T00:26:08Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `ward-agentic-os-issue-293-claude-e62f9ecc` on host `docker-desktop` is carrying this issue (reserved 2026-06-26T00:26:08Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-06-26 00:28:33 +00:00

docs(tooling-tailscale): document the ward-tailnet shared-network consumer

coilysiren closed this issue

2026-06-26 00:28:33 +00:00

coilysiren commented

2026-06-26 00:28:59 +00:00

Author

Owner

What nearly bit me: the skill's compose was the pre-shared-network version, so it would have read as authoritative-but-stale. I mirrored the real ansible copy and added a line pointing at it as the source of truth, which feels like the right hedge against future drift.

Confidence is high. The changes are doc-only, pre-commit passes clean (dead-cross-links included, despite the external ward URL), and I stayed inside the issue's scope - no deprecated -ts sidecar, no key/ACL talk. One rough edge worth noting: the cross-repo link to ward's doc is a hardcoded GitHub blob URL, so if that file moves the dead-cross-links hook won't catch it (it only checks repo-local links). Not worth a follow-up on its own, but a candidate if a cross-repo link checker ever lands.

Quick retro: this one was mostly a documentation-fidelity exercise, and the satisfying part was that the answer already existed in the substrate. The converged mac-proxy compose (infrastructure#402) and ward's docs/agent-ts-sidecar.md both spelled out the two names and the socks5h-by-name route, so the work was less invention than reconciling the skill's compose block against the landed stack and writing the two-consumer model down faithfully. What nearly bit me: the skill's compose was the pre-shared-network version, so it would have read as authoritative-but-stale. I mirrored the real ansible copy and added a line pointing at it as the source of truth, which feels like the right hedge against future drift. Confidence is high. The changes are doc-only, pre-commit passes clean (dead-cross-links included, despite the external ward URL), and I stayed inside the issue's scope - no deprecated <carry>-ts sidecar, no key/ACL talk. One rough edge worth noting: the cross-repo link to ward's doc is a hardcoded GitHub blob URL, so if that file moves the dead-cross-links hook won't catch it (it only checks repo-local links). Not worth a follow-up on its own, but a candidate if a cross-repo link checker ever lands.