tailscale_diagnosticslisted

# tailscale_diagnostics — look, do not touch The host's Tailscale identity stays on the host. The ts-broker runs there and serves two verbs over a unix socket; `./sc ts` is the client. The fork's `ts` block names `allowed_hosts` (unrestricted exec as the configured `ssh_user`) and `readonly_hosts` (diagnostic verbs only). A host in `readonly_hosts` is implicitly allowed; a host in neither list is refused. ```bash ./sc ts status # tailnet backend, self, peers ./sc ts exec <host> -- <command> # one policy-checked command ./sc ts init --ssh-user <user> [--allowed-host H]... [--readonly-host H]... [--tailscale-bin <path>] ``` `init` writes only the `ts` block and prints whether the broker is ready and the command that starts it (`./sc ts-broker-up`). Every result is one JSON object: `{ok, exit, stdout, stderr}` for `exec`. ## Read-only doctrine A shell never reaches a read-only host with `tailscale` or `ssh` directly, on bare metal or otherwise, even when the operator's own tailnet identity or a login would let it; the only path to a `readonly_hosts` entry is `./sc ts exec`, and observation means observation — read state and logs, report what you saw, and change nothing on that host by any route. The broker allowlist plus this paragraph is the accepted boundary (decision #354); device-side enforcement is deferred, not a gap you are free to use. ## What a read-only host accepts The broker accepts a command on a `readonly_hosts` entry only when it