Private networking
The gateway supports private access through Tailscale Serve and explicitly configured host connections.
Network paths
The gateway binds loopback. Tailscale Serve can expose it privately. Laptop observations and frames can reach the gateway through configured SSH forwarding; tailnet ACLs, SSH and producer availability all matter.
Localhost on an iPhone means the iPhone itself. Use the private HTTPS hostname for remote phone access and laptop localhost only in the laptop browser.
Credential boundary
Root credentials stay on trusted servers. Display tokens cannot authorize voice or consent actions. The owner approval path separately checks identity and origin.
A connected tunnel is not a source health check. Inspect producer timestamps, availability and browser delivery independently.
Implementation sources
Repository paths below describe the implementation. They do not certify a running deployment or a configured external account.
src/mushegh/brain/hud_gateway.pysrc/mushegh/edge/hud_tunnel.pysrc/mushegh/brain/hud_read_auth.py
Subsystem directory · HUD guide · Verification and known limits