Skip to content

fix(pm-stack): ready-for-agent binds 0.0.0.0:6056 while the rest of the stack binds loopback+tailnet - align bind scopes #1181

New issue
New issue
Closed
Closed
fix(pm-stack): ready-for-agent binds 0.0.0.0:6056 while the rest of the stack binds loopback+tailnet - align bind scopes#1181
Assignees
dezren39
Labels
app/pm-stackpm-stack (Pad/Grist) in developing-today/codeeffort/sSmall: expected under 2 hours of workkind/securitySecurity issue or security hardeningmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedpriority/highImportant and time-sensitivequeue/blockedQueue or user escalation statequeue/queuedHas a queued task in the Supabase agent queuesource/humanFiled directly by a humanstatus/blockedQueue or user escalation statestatus:donetask/small-fixQueue packet kind: bounded fix with reproduction and targeted testsuser/escalatedQueue or user escalation state

Description

@dezren39
dezren39
opened on Oct 27, 2026

Finding

Evidence (live review 2026-10-26 ~22:40 CDT, laptop loopback + gh, cross-checked): ss on the laptop tonight: aggregator listens on 127.0.0.1 + 100.99.113.103 (tailnet) only; Grist and Pad the same; Kaneo loopback only (+ tunnel). ready-for-agent listens on 0.0.0.0:6056 - every interface including the LAN (and any future WAN-facing interface), inconsistent with the stack's settled access model (Drew, 2026-10-25: LAN/tailnet fine, public only behind a password) and with its own earlier tailnet-bind change in slice 1.

Proposal

Bind ready-for-agent to loopback + tailnet like the rest (its UI is consumed via tailnet/local agents - verify no LAN consumer exists first via its README/runbook), or document a deliberate exception with its reason. Add a bind-scope row to the topology table (topology issue) so drift is visible.

Acceptance

Acceptance criteria

  • ready-for-agent no longer listens on 0.0.0.0:6056: ss output after the change shows it bound to loopback + tailnet like the rest of the stack — OR the exception is documented with its reason and Drew-acknowledged on this issue.
  • The topology table gains a bind-scope row so future drift is visible.
  • Verification that no LAN consumer of the ready-for-agent UI exists (README/runbook check) is recorded before the bind changes.

Activity

  1. dezren39
    added
    kind/securitySecurity issue or security hardening
    task/small-fixQueue packet kind: bounded fix with reproduction and targeted tests
    app/pm-stackpm-stack (Pad/Grist) in developing-today/code
    on Oct 27, 2026

  2. developing-today commented on Oct 27, 2026

    @developing-today
    developing-todayBot
    on Oct 27, 2026 – with developing.today
    Contributor

    CODE-317

  3. github-actions
    assigned
    dezren39
    on Oct 27, 2026
  4. dezren39
    added a parent issue on Oct 27, 2026
  5. dezren39
    added
    status/needs-triageNot yet triaged; needs a first look
    source/humanFiled directly by a human
    meta/enrichedIntake review done: acceptance criteria, links, and normalized labels added
    priority/highImportant and time-sensitive
    effort/sSmall: expected under 2 hours of work
    on Oct 28, 2026

  6. dezren39 commented on Oct 28, 2026

    @dezren39
    dezren39
    on Oct 28, 2026
    MemberAuthor

    Intake review

    Fleet monitor intake enrichment (protocol §5) — 2026-10-28T06:25Z. This issue was filed 2026-10-27 by Drew (dezren39) from the 2026-10-26 live pm-stack review and had no priority/* label and no standard ## Acceptance criteria section; both are now supplied (the body's own Acceptance text is restated under the standard heading, original body preserved verbatim above it).

    • Related: Refs in body: pm-stack: Pad/Grist compose files hard-code one host's tailnet IP (100.99.113.103), breaking the documented move-hosts procedure #781 (host-config hygiene). No merged PR explicitly references or resolves this issue (checked this run).
    • Labels normalized: one kind/* (kept existing), source/human, status/needs-triage, priority/high, effort/s, app/pm-stack (existing), meta/enriched.
    • Still live: verified open this run; no merged PR or commit found that implements it.
    • Risks: Changing the bind before confirming there is no LAN consumer could cut off a real client; the issue's own verify-first step is the guard. Tailnet address can change on re-enrollment — prefer the stack's existing bind mechanism over a hard-coded address.
    • Suggested approach: Follow the stack's existing loopback+tailnet bind pattern used by the aggregator; verify with ss on the laptop post-change and paste the output on the issue.
  7. dezren39
    added
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    and removed
    status/needs-triageNot yet triaged; needs a first look
    on Nov 2, 2026

  8. 30 remaining items

  9. dezren39
    added
    queue/blockedQueue or user escalation state
    status/blockedQueue or user escalation state
    user/escalatedQueue or user escalation state
    and removed
    status/in-progressQueue worker lifecycle state
    queue/queuedHas a queued task in the Supabase agent queue
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Nov 3, 2026

  10. dezren39 commented on Nov 3, 2026

    @dezren39
    dezren39
    on Nov 3, 2026
    MemberAuthor

    Correction to the command above: this host's flake attribute is amd (hostname amd, nixos/hosts/default.nix → amd = host { ... framework/13-inch/7040-amd }). Exact command:

    sudo nixos-rebuild switch --flake ~/git/code#amd
  11. dezren39
    added
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 3, 2026

  12. dezren39 commented on Nov 6, 2026

    @dezren39
    dezren39
    on Nov 6, 2026
    MemberAuthor

    Deploy verification (2026-11-06): the PR #4657 activation already landed via the 2026-11-05 switches (gens 540–542) — ready-for-agent now binds 127.0.0.1:6056 only, 0.0.0.0:6056 is gone, LAN connect refused, aggregator probe READY. BUT the tailnet leg never worked: ready-for-agent-tailnet.service ExecStart points at /run/current-system/sw/bin/systemd-socket-proxyd, which does not exist on this host (the binary is in the systemd package's lib/systemd/). The socket sits armed until first connection, then start-limit-fails. Needs a one-line path fix in nixos/services/pm-apps/default.nix + PR + switch before #1181 can close. Fix in flight.

  13. developing-today
    added
    status:in-review
    on Nov 6, 2026
  14. dezren39
    added a commit that references this issue on Nov 6, 2026

    Merge pull request #6453 from developing-today/fix/1181-tailnet-socke…

    50debbc
  15. developing-today
    added
    status:done
    and removed
    status:in-review
    on Nov 6, 2026
  16. developing-today
    closed this as completedon Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/pm-stackpm-stack (Pad/Grist) in developing-today/codeeffort/sSmall: expected under 2 hours of workkind/securitySecurity issue or security hardeningmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedpriority/highImportant and time-sensitivequeue/blockedQueue or user escalation statequeue/queuedHas a queued task in the Supabase agent queuesource/humanFiled directly by a humanstatus/blockedQueue or user escalation statestatus:donetask/small-fixQueue packet kind: bounded fix with reproduction and targeted testsuser/escalatedQueue or user escalation state

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions