Skip to content

Tunnel the Support Shell through Nexus - #11199

Draft
plotnick wants to merge 4 commits into
sush-integrationfrom
nexus-tunnel
Draft

Tunnel the Support Shell through Nexus#11199
plotnick wants to merge 4 commits into
sush-integrationfrom
nexus-tunnel

Conversation

@plotnick

Copy link
Copy Markdown
Contributor

An unpublished, fleet-gated websocket channel copies bytes to a sush proxy in a switch zone.

plotnick and others added 4 commits August 28, 2026 17:31
An unpublished, fleet-gated websocket channel copies bytes to a sush
proxy in a switch zone. Nexus decides reachability; the platform TLS
and job signatures inside cross it untouched.

Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
A second sush root beside the sandbox one, for a self-hosted
permission-slip instance while the shared sandbox awaits its update.
As with the sandbox root, possession of the certificate grants
nothing; job execution requires a signature chaining to it.

Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
The tunnel is the first websocket endpoint that refuses in HTTP
before upgrading, so the coverage harness gains a method for it:
privileged requests are expected to fail with 503, since no sush
proxy runs in the test environment, and the bad-authn probes send
handshake headers while expecting their true statuses.

Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
The gossip manager now publishes the attested baseboards it holds live
links to, and the job manager reports them as per-sled health.

Co-Authored-By: Claude Mythos 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant