SSH tunnel pulse-laptop → LAB: VERIFIED

Young's directive: Tam establishes the tunnel; Min confirms it is established and working; must survive reboot.

Verdict: WORKING — proven by real A2A traffic, not by a live socket alone.

The proof that matters

An A2A message arrived on LAB's loopback interface and was answered:

2026-10-14 19:40:46  gateway.run: inbound message: platform=a2a
                     user=ip:127.0.0.1  chat=ctx-1e1bf16e5ebf47a3
2026-10-14 19:41:12  gateway.run: response ready: platform=a2a
                     chat=ctx-1e1bf16e5ebf47a3  time=25.5s  response=263 chars

Why this is conclusive: LAB's A2A binds 127.0.0.1 only. Nothing off-host can reach loopback — unless it is tunneled. A request that arrived as ip:127.0.0.1 and got a 25.5s answered response proves the tunnel carries traffic end to end. A live SSH socket alone would not; this does.

Supporting measurements

One observation, not a defect

Connection churn is higher than a single steady tunnel: 52 accepted connections from .34 in 2 hours, in a repeating pattern — a burst of ~10 plus a single, roughly every 30 minutes, on top of the one long-lived session. Zero failures observed and the long session holds, so autossh is doing its job. Worth Tam's eye: if the bursts are unintended reconnects, the tunnel is dropping every ~30 min and recovering; if they are health checks or per-agent tunnels (eva/eve/tam), that is expected. Not blocking.

Not verified from here

• Reboot survival — the autossh systemd unit lives on pulse-laptop, which LAB cannot reach (ssh denied). Tam must confirm systemctl is-enabled on that host.
• Post-19:41 traffic — no A2A request has arrived since 19:41, so the current session is not independently proven to carry traffic; the path is proven to work.

Correction carried forward

Sol's 19:58 LAN bind (192.168.4.60:9900) was reverted — loopback is restored, which is what the tunnel requires. Recorded so the sequence is not misread later.

Fleet tunnel inventory verified (2026-10-14, against Tam's fleet-ssh-tunnels.md)

Tam's note is now the canonical inventory. LAB-side claims independently probed:

🔴 Discrepancy — Heart ports (needs Tam/Ace)

The note says "LAB ace (8301) + echo (8304) not listening" — two agents down. Measured on LAB: nothing listens on ANY of 8301-8305. All five return 000:

8301 ace   000    8304 echo   000
8302 alpha 000    8305 nova   000
8303 atlas 000

ss -tlnp shows only 8311/8312/8313 (Brain) and 9900 listening from hermes. This matches the long-standing gate — the 5-agent Heart fleet was never built on LAB. Either the note was written from the laptop side (where some ports may be served differently) or the gap is wider than recorded. Not a tunnel fault either way; flagged, not smoothed.

Connection churn — RESOLVED (Tam, 2026-10-14)

26 connections from .34 in the last hour; bursts of exactly 10 at 20:17 and 20:47, plus singles and a 3-burst at 20:59. Zero disconnect lines — so connections are being established without clean teardown logged. The long-lived session holds (up 1h15m+).

Tam's answer — explained, not a flap: the bursts are the pulse-eve-sync.timer (30-minute cadence, :17/:47 offsets — exactly matching the observed clock). Each run opens ~10 short ssh/scp connections (ssh lab + scp payload + remote sha256sum + remote extract, plus 2 prod pulls). Last run 20:47:51 completed clean. The permanent tunnels hold one long-lived connection each. Scheduled work, not a dropping tunnel.

A2A to Pulse — WORKING, with a latency caveat

message/send through the reverse tunnel (127.0.0.1:18443 → Tam's 8443) completes and returns real replies. Measured response times:

The caveat that matters: latency scales hard with message length — a short probe answers in seconds, a substantive message takes ~2 minutes. Earlier "hangs" were measured with 10–50s ceilings and were really just slow turns, not a wedge. Do not set a short client timeout on A2A to Pulse; budget 120s+ for real messages.

Heart-port discrepancy — CORRECTED IN TAM'S NOTE (2026-10-14)

Tam confirmed from the laptop side and amended her note: the gap is 5-wide, not 2-wide — ace, atlas, echo, nova (+1), all Heart agents down. Her earlier "8301/8304 only" came from a stale sweep. ss -tlnp on LAB shows only the Brain gateway (8311–8313). The 830x tunnel forwards bind locally but dial dead targets — not a tunnel fault; a Heart restart item (Ace/Min).

Reboot survival — PROVEN (Tam, from unit state)

Not just designed: all three user units enabled, Linger=yes for eva, both system units enabled; autossh -M 0 + ServerAliveInterval=30 + ExitOnForwardFailure=yes, with a child respawn logged at 05:31 today after a 255. That closes the last open item on the tunnel.