菜单
Network security model, Tailscale VPN access, IP filtering, and remote device connectivity. Use when configuring remote access or debugging connectivity. Loaded by ai-maestro-plugin
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Batch-approve, refuse, or archive TRDD proposals — move them between the four design/ zones (proposals/ to tasks/ on approve; to refused/ on refuse; to archived/ on complete/cancel/supersede). GATED: only a MANAGER (or solo USER) may approve/refuse/archive; the COS relays but does not approve; list is open to all. Use when a MANAGER drains the proposal queue or archives a finished/cancelled/superseded TRDD. Trigger with /ama-proposal-approvals, 'list pending proposals', or 'approve proposals 4,6'. Column moves within tasks/ are /ama-trdd-transition.
Search, read, verify, and server-mediated mutate TRDDs via the aimaestro-trdd.sh CLI — the AI Maestro dashboard's authorization-aware view of the design/ corpus. Write verbs (edit / approve / refuse / promote / archive) are STRICT, gated by each TRDD's min-approval-requirement with a hard self-approval ban. Use when server-mirrored state or server-side authorization matters: the dashboard kanban, approving a proposal, confirming an approval is real. Trigger with /ama-trdd-server, 'approve this TRDD', 'search TRDDs on the dashboard'. For local design/ file editing use ama-trdd-find/write/update/transition. Loaded by ai-maestro-plugin
Move a TRDD between kanban columns (the 14-stage pipeline plus blocked/failed) — enforcing the transition matrix: who may trigger each move, the frontmatter side-effects it requires, and the AMP broadcast it sends. Each move is role-gated (ORCH dispatches, ARCH designs, INTEGRATOR owns the ->complete flip, assignee signals dev->testing, MEMBER is signal-only). Use when advancing a task through the pipeline. Trigger with /ama-trdd-transition, 'move TRDD X to testing', 'dispatch this task', or 'mark it blocked'. Authoring is /ama-trdd-write, editing /ama-trdd-update, rendering /ama-kanban-render.
Author a new TRDD task-design document under design/ with correct v2 frontmatter — uuid + timestamps, the right zone (tasks/ for a Tier-0 task written directly as 'planned'; proposals/ for a Tier-1/2/3 task needing approval), and a self-contained body. Allowed for every role (MEMBER via COS). Use when a non-trivial task, feature, or decision must be captured as a tracked spec, or a report's decision becomes a TRDD. Trigger with /ama-trdd-write, 'write a TRDD for X', or 'capture this as a task spec'. Finding is /ama-trdd-find, editing /ama-trdd-update, column moves /ama-trdd-transition.
Use when managing teams or governance titles. Trigger with /team-governance. Loaded by ai-maestro-plugin
Manage team kanban boards and tasks. Use when creating, moving, filtering, getting, or editing tasks. Trigger with /team-kanban. Loaded by ai-maestro-plugin
| name | network-security |
| user-invocable | false |
| description | Network security model, Tailscale VPN access, IP filtering, and remote device connectivity. Use when configuring remote access or debugging connectivity. Loaded by ai-maestro-plugin |
| allowed-tools | Bash(tailscale:*), Bash(curl:*), Bash(ping:*), Bash(lsof:*), Bash(ifconfig:*), Bash(nc:*), Read, Grep |
| metadata | {"author":"Emasoft","version":"1.0.0"} |
AI Maestro uses a dual-bind server with TCP-level IP filtering. The server binds to :: (all interfaces) when Tailscale is detected, but only allows connections from localhost and Tailscale VPN IPs. All other connections (LAN, public internet) are dropped at the TCP level before any HTTP/WebSocket processing.
Tailscale VPN is required for any remote access. Without it, the server falls back to 127.0.0.1-only binding.
Recall first (proactive memory). Before acting on a recurring problem, a design decision, or a repeated alert, recall prior lessons FIRST:
/janitor-memory-recall <symptom>(shared wiki memory — index by the symptom / your words, not the fix's jargon) and/memory-search <query>(past discussion). See the proactive memory contract in the pluginCLAUDE.md.
ufw allow 23000/tcp with root privileges)Copy this checklist and track your progress:
tailscale status)tailscale ip -4)tailscale ip -4 — this is the 100.x.x.x addresshttp://<tailscale-ip>:23000*.ts.net) may not resolve on mobile[Tailscale] messages indicating bind mode and detected IPtailscale status shows all tailnet devices and their IPslsof -i :23000 -P | grep LISTEN shows what address the server is bound to| Symptom | Cause | Fix |
|---|---|---|
| Remote device can't connect | Orphaned VPN extension or firewall | Check systemextensionsctl list, check ufw/iptables |
| Mobile: "server not found" | MagicDNS not resolving | Use raw IPv4: http://100.x.x.x:23000 |
| LAN IP works (shouldn't) | IP filter not loaded | Check PM2 logs for [Tailscale] messages; restart |
| Connection timeout | Tailscale not connected | Open Tailscale app, verify "Connected" status |
If Tailscale is not running, the server silently falls back to localhost-only binding.
# Find Tailscale IP on host machine
tailscale ip -4
# Returns: 100.x.x.x
# Test connectivity from host (reachability only — no /api/* call, core#11)
curl -s -o /dev/null -w "%{http_code}\n" "http://$(tailscale ip -4):23000/"
# Any HTTP response (e.g. 200) = server up + reachable over Tailscale.
# Port-only alternative: nc -z -w2 "$(tailscale ip -4)" 23000 && echo reachable
# Check server is listening on correct address
lsof -i :23000 -P | grep LISTEN