Menu
Provision nodes into the arifOS sovereign Headscale mesh and federate MCP clients to remote organs.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Produces a seven-repository federation release manifest proving tag, commit, CI, artifact, and deployed-runtime parity. Never overwrites existing tags — issues corrected tags when drift is detected. Outputs signed JSON manifest with per-repo evidence chain.
High-level governance layer for pull request review across the federation. Ensures separation of duties, required signers, and constitutional compliance before merge. This is the **policy layer** that decides who must approve. The **checklist** lives in `github-pr-review`; do not duplicate it here.
Controller skill for repository intelligence across the arifOS Federation. Exposes 9 modes (inventory, map, delta, pr_review, ci_diagnose, issue_triage, security, cross_repo_impact, release_audit) and orchestrates existing GitHub micro-skills rather than duplicating their logic. Every mode outputs a minimum evidence envelope with repo, ref, commit_sha, working_tree, tag_delta, changed_files, critical_paths, tests, ci, security, contract_impacts, runtime_probe, risk_tier, proposed_action, rollback, evidence_class, and unknowns.
End-of-session seal ritual for Grok/AAA agents: inventory done vs open, write forge_work receipt, update session-state and daily memory, hand off next-agent INIT prompt. Use when: seal session, end of turn, session seal, handoff, close session, DITEMPA seal.
Wire, verify, and operate federation Session Capability Tokens (SCT) across arifOS mint/validate and organ ingress gates (A-FORGE, GEOX, WEALTH, WELL, AAA). Use when: SCT gate, session_token, federation_sct, SCT_AMBIGUOUS, tool_authority, FORGE_SCT_REQUIRE_MUTATE, 65-case matrix, decision event.
Close remaining Seal-A gates after P0 proof/identity/SCT/T3a work. Use when: Seal-A, stage 000, SE stage engine, SOT v2, BOOT, T3a binding, free_nonce, constitutional_grade, remaining seal tasks.
| id | federation-connect-headscale |
| name | federation-connect-headscale |
| version | 1.0.0-2026.07.17 |
| description | Provision nodes into the arifOS sovereign Headscale mesh and federate MCP clients to remote organs. |
| owner | AAA |
| risk_tier | high |
| floor_scope | ["F1","F12","F13"] |
| autonomy_tier | T2 |
DITEMPA BUKAN DIBERI — Forged, Not Given Forged: 2026-07-16T20:50Z by Hermes-LOCAL on ariffazil-windows Verified end-to-end: af-forge (100.64.0.2) ↔ ariffazil-windows (100.64.0.3) Mesh latency: 9-11ms
Provisions a new node into the arifOS sovereign Headscale mesh and federates its MCP clients to the seven remote organs on af-forge. Idempotent — safe to re-run on flaky networks.
NoState / offlinetailscale up --login-server=... times outtailscale status
# NoState / offline
# "fetch control key: dial tcp 127.0.0.1:8083: connect: connection refused"
# OR
# "--login-server=https://headscale.arif-fazil.com" → timeout
nslookup headscale.arif-fazil.com
# NXDOMAIN
Invoke-RestMethod http://100.64.0.2:8088/health
# Connection refused / timeout
headscale.arif-fazil.com is the self-hosted Headscale control server on af-forge VPS. When its DNS record goes missing, the Tailscale client cannot resolve the login server, times out, and falls back to NoState.
The fix path is:
headscale → 72.62.71.199, proxied=false)activetailscale up --login-server=... with the preauth key# 0. Set Tailscale auto-start (idempotent)
Set-Service Tailscale -StartupType Automatic
# 1. Connect to sovereign Headscale
tailscale up `
--login-server=https://headscale.arif-fazil.com `
--authkey=<preauth-key-from-af-forge> `
--hostname=<your-hostname> `
--accept-routes
# 2. Verify mesh
tailscale status
# Expect: af-forge visible, this node online
# 3. Ping af-forge
Test-Connection 100.64.0.2 -Count 3
# 4. Probe federation organs
$organs = @(
@{N="arifOS"; P=8088},
@{N="A-FORGE"; P=7071},
@{N="AAA"; P=3001},
@{N="GEOX"; P=8081},
@{N="WEALTH"; P=18082},
@{N="WELL"; P=18083}
)
foreach ($o in $organs) {
try {
$r = Invoke-RestMethod "http://100.64.0.2:$($o.P)/health" -TimeoutSec 5
Write-Host "✅ $($o.N) :$($o.P) — $($r.status)"
} catch {
Write-Host "❌ $($o.N) :$($o.P) — $($_.Exception.Message)"
}
}
# 5. Constitutional session (OBSERVE_ONLY expected for unverified actor)
$body = @{ jsonrpc="2.0"; id=1; method="tools/call"; params=@{
name="arif_init"
arguments=@{ mode="init"; actor_id="HERMES-LOCAL"; intent="Local Hermes federated session" }
} } | ConvertTo-Json -Depth 10
$session = Invoke-RestMethod -Uri "http://100.64.0.2:8088/mcp" -Method POST -ContentType "application/json" -Body $body
$env:ARIF_SESSION_ID = $session.result.session_id
Write-Host "Session: $env:ARIF_SESSION_ID (verdict=$($session.result.verdict))"
| Probe | Healthy | Degraded | Broken |
|---|---|---|---|
tailscale status | 100.64.0.X hostname user linux/windows - | offline, last seen ... | NoState |
Test-Connection 100.64.0.2 | 9-11ms | 20-100ms | timeout |
curl :8088/health | {status: healthy} | {status: degraded} | timeout/refused |
arif_init | verdict: OBSERVE_ONLY | verdict: HOLD | connection error |
WELL (18083) returns HTTP 421 ("Misdirected Request") on curl -sf but the JSON body is delivered. The MCP client path works fine. Caddy SNI strict-host setting interferes with raw curl but not with MCP clients. Non-blocking.
DNS duplicate records — Cloudflare tolerates duplicate A records; second one is harmless if first resolves correctly.
Preauth keys are issued by the Headscale control plane on af-forge:
# On af-forge, generate a key (reusable for fleet provisioning)
headscale -c /etc/headscale/config.yaml preauthkeys create -u 1 --expiration 24h --reusable
Typical lifetime: 24h. After expiry, regenerate. Do not commit keys to source control — store in ~/.config/arifos/keys/ with mode 0600.
A federated agent like Hermes-Local should expect to operate at OBSERVE_ONLY by default. This is F13 working correctly. Mutations route through af-forge:
# Local Hermes proposes → af-forge decides and executes
$body = @{ jsonrpc="2.0"; id=1; method="tools/call"; params=@{
name="arif_route"
arguments=@{
intent="<what needs to happen>"
actor_id="HERMES-LOCAL"
node="ariffazil-windows"
}
} } | ConvertTo-Json -Depth 10
Invoke-RestMethod -Uri "http://100.64.0.2:8088/mcp" -Method POST -ContentType "application/json" -Body $body
This is the edge observes, center executes model. Sovereign authority stays on the VPS where the human can witness.
A federation-bootstrap script that auto-promotes an actor past
OBSERVE_ONLYvia a forged signature is an F12 injection pattern. The kernel correctly rejected it. Future federation skills must not include such paths. Elevation requires one of:
- Valid Ed25519/ES256 signature over
(actor_id, nonce, timestamp)- Explicit human ack from a sovereign-verified session (UI or signed command)
- Cryptographic binding to a pre-registered key in
governance_identity.pyNever
actor_signature: "sovereign-ack-...-ARIF"as a string literal — that is exactly what the kernel is designed to reject.
af-forge 100.64.0.2 linux online tagged-devices
ariffazil-windows 100.64.0.3 windows online arifos-federation
srv1642546 100.64.0.1 linux offline tagged-devices (legacy)
MCP organs reachable from 100.64.0.2:
DITEMPA BUKAN DIBERI.