/remote-mac

name: remote-mac
description: "Remote Macs: MacBooks, Mac Studios, hosted claw Macs, Tailscale, SSH, and OpenClaw."

Remote Mac

Use when the user says `MacBook`, `Mac Studio`, `clawmac`, `foundationclaw`, `foundationmac`, `megaclaw`, `miniclaw`, `Molty`, Tailscale, or asks to run/check something on one of Peter's Macs.

Peter's Topology

• Primary workstation for interactive approvals and day-to-day work: Peter's SF Mac Studio, local/Tailscale name `steipete-studio-sf`. Peter's MacBook Pro (`steipete-mbp`) is the portable/fallback workstation; do not route prompts there merely because it is online.
• London workhorse: Mac Studio, Tailscale `peters-mac-studio-1`, usually best reached as `steipete@steipete-macstudio.local` when on its LAN.
• SF primary workstation: `steipete-studio-sf`. Its current Tailscale target and retired-node state live in private manager `computers.yaml`; do not choose a peer merely because it appears online.
• `clawstudio` is the separate SF data server and personal OpenClaw Gateway host, formerly `mac-studio-sf2`. Its exact current peer IDs, addresses, hardware identity, and reconciliation state live only in private manager inventory and `docs/tailnet-portal.md`. If multiple peers appear, pin each backend command, verify the physical host locally, preserve a rollback path, and follow the private reconciliation gate. Do not publish or copy the private topology into public runbooks.
• SF Mini: local/Tailscale name `steipete-mini-sf`. Its current kernel and retired GUI targets live in private manager inventory. The Mini uses classic key-only OpenSSH over the tailnet TCP 22 grant because GUI Tailscale builds cannot host Tailscale SSH. Its own key is installed on both SF Studios, MegaClaw, and MiniClaw; see private manager `docs/fleet-setup.md` for live proof and offline/provider-blocked directions. Do not confuse it with FoundationClaw.
• Personal cloud OpenClaw: `clawmac` (Peter may typo/say `crabmac`), MacStadium service `100121942`, Tailscale/SSH `steipete@clawmac`, gateway via LaunchAgent `ai.openclaw.gateway`, loopback `127.0.0.1:18789`, Telegram connected. The current 2026-08-01 provider network outage is tracked by Atlanta remote hands on tickets #11481/#11484; one hard reboot restored SSH only briefly, so do not repeat power cycles.
• Network split:
• `corporate`: Peter's work-managed environment. Treat Mac Studio as the main remote Mac to configure and inspect there.
• `personal`: Peter's personal LAN / personal cloud environment, including `clawmac`.
• Network boundary: `clawmac` and the personal LAN are unreachable from Peter's corporate Mac. Never use `clawmac` as a relay or LAN vantage from there.
• Molty's former Mac Studio gateway is retired and must remain disabled; real Molty runs separately on Hetzner. Do not use the old Mac Studio runtime as a healthy-state expectation.
• `megaclaw`: Virtualized.gg product 22 (Mac Studio M4 Max, Phoenix), the active alternate Mac worker. Tailscale/SSH `steipete@megaclaw`. No OpenClaw gateway by design; the personal Gateway runs on `clawstudio`. Do not configure or start one on `megaclaw`.
• `miniclaw`: Virtualized.gg product 24 (Mac mini M4 Pro, Phoenix), public SSH `steipete@131.143.4.3`. Live 2026-08-01 state regressed: the privileged Homebrew daemon owns stale duplicate `miniclaw-1` and cannot reach coordination, while canonical `miniclaw` is unusable. Use public SSH until the stored personal admin credential is explicitly authorized for a privileged repair; do not claim the canonical tailnet path is healthy from provider SSH alone.
• `foundationclaw`: MacStadium service 100124960, M2.L in Atlanta, public address recorded in `computers.yaml`. Provider SSH verified a Mac14,12 M2 Pro Mac mini, hardware UUID, and the `administrator` admin account; its canonical local hostname is `foundationclaw`. Signed Tailscale and Jump Desktop Connect v10 are installed, but the previously working provider credential stopped authenticating and a data-preserving reset is pending on ticket #11386 before Tailscale enrollment and first-run GUI permissions can continue. Do not merge it with the separate SF Mini.

Non-Mac fleet nodes (full detail in `computers.yaml`):

• `gorillaclaw`: personal Ubuntu Linux node at GorillaServers (Los Angeles), Tailscale `100.93.99.79`; SSH user `steipete`.
• `steipetesurface`: Peter's personal Windows Surface, Tailscale `100.118.219.64`, SSH user `steip`. Corporate Windows laptop `CPC-steip-11ENO` is separate and work-managed.

Not Peter's Macs (do not configure/brand as his):

• `crabhammer`: Scaleway M4-XL given to vince; on Peter's tailnet + billing but provisioned for vince (no SSH access). Listed under `handed_off:` in `computers.yaml`.

Manager repo source of truth (canonical inventory of all nodes, Mac and non-Mac):

• `/Users/steipete/Projects/manager/computers.yaml`
• `/Users/steipete/Projects/manager/agents.yaml`

Discovery

1. Start with live `tailscale status --json`; match hostname/DNS name and use the node's current IP. Manager-cached Tailscale IPs may be stale. 2. If one physical Mac exposes multiple Tailscale peers, do not choose by `Active`, PATH order, process name, or IP age. Verify ComputerName, LocalHostName, hardware UUID, stable node ID, and backend-pinned status. On clawstudio, macsys is `/Applications/Tailscale.app/Contents/MacOS/Tailscale`; Homebrew kernel requires `/opt/homebrew/bin/tailscale --socket=/var/run/tailscaled.socket`. Preserve a proven fallback or timed automatic reconnect before stopping either backend. 3. For rented Macs, reconcile the live identity with the provider service/product record in `computers.yaml`. Provider-active does not mean fleet-configured, and a public IP alone is not enough to merge identities. 4. For `clawmac`, if MacStadium reports Active while the public IP, SSH/VNC, and Tailscale all fail, treat it as a provider network/hardware incident. Check the current incident note in `computers.yaml`, update the existing ticket,