the-custodian/docs/recovery/tunnels-yaml-proposed-changes-CUST-WP-0067.md

Proposed ~/.config/bridge/tunnels.yaml changes — CUST-WP-0067-T02

Claude could not edit this file (outside any repo; blocked by the permission classifier). Apply manually or grant the write. Back up first:

cp ~/.config/bridge/tunnels.yaml ~/.config/bridge/tunnels.yaml.bak-$(date +%Y%m%d%H%M%S)

1. state-hub-primary — health check probes the wrong thing

Its local_port: 8000 is already correct and needs no change. The health check does:

    health_check:
-     url: http://127.0.0.1:8000/state/health
+     url: http://127.0.0.1:8000/state/health   # correct only now that no local hub binds 8000

No edit required today, but note why it read healthy for seven weeks: it probed the local cache, not the tunnel it opened on [::1]:8000. A tunnel health check that can be satisfied by a different process is not a health check. Prefer probing through the tunnel's own bind address once instance identity lands (T03).

2. state-hub-mcp-railiance01 — retire (was: probes the wrong port)

Superseded 2026-08-24. An MCP server now runs on central (state-hub-mcp, ClusterIP 10.43.110.80:8001, CUST-WP-0067-T08), so this tunnel has nothing left depending on it — the documented dev-hub registration has been repointed at the ClusterIP. Remove the entry rather than fixing its health check, which probed :8000 while forwarding :8001.

-  state-hub-mcp-railiance01:  # -R 18001 -> workstation:8001

3. Reverse relay tunnels — retire

-  state-hub-railiance01:      # -R 18000 -> workstation:8000
-  state-hub-mcp-railiance01:  # -R 18001 -> workstation:8001

Both make a remote box dial back into this workstation to reach a hub. That was correct when the workstation was the hub. It is not: the primary runs on railiance01, so an agent there currently routes localhost:18000 -> workstation:8000 -> jump host -> 10.43.68.154:8000 to reach a service on its own machine.

Status 2026-08-24:

• state-hub-mcp-railiance01 — safe to remove now. Central MCP is serving and the global port map points at it.
• state-hub-railiance01 — not yet. The global instructions are repointed, but roughly 120 AGENTS.md files across both machines still tell agents to use 127.0.0.1:18000. Removing it before CUST-WP-0067-T07 repoints those breaks any session that follows its own repo's instructions.

On railiance01 both services are reachable in-cluster with no tunnel at all — this is where "abandon tunneling" genuinely applies.