<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-08-31T00:00:00.000Z" agent="Codex" version="24.7.17"><diagram id="mac-ops-boundary-map" name="mac-ops-boundary-map"><mxGraphModel dx="1480" dy="860" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1280" pageHeight="850" math="0" shadow="0"><root>
<mxCell id="0"/><mxCell id="1" parent="0"/>
<mxCell id="header" value="&lt;b&gt;What can reach what — the Mac operations-centre boundary&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;align=left;spacingLeft=20;fillColor=#0f172a;strokeColor=#0f172a;fontColor=#ffffff;fontSize=19;" vertex="1" parent="1"><mxGeometry x="40" y="30" width="1200" height="56" as="geometry"/></mxCell>
<mxCell id="band_loop" value="&lt;b&gt;THE MAC · 127.0.0.1 — nothing here is reachable from outside&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;align=left;verticalAlign=top;spacingTop=10;spacingLeft=16;fillColor=#dbeafe;strokeColor=#2563eb;strokeWidth=2;fontSize=13;opacity=60;" vertex="1" parent="1"><mxGeometry x="40" y="120" width="640" height="400" as="geometry"/></mxCell>
<mxCell id="band_cont" value="&lt;b&gt;CONTAINERS · OrbStack — isolated, state in volumes&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;align=left;verticalAlign=top;spacingTop=10;spacingLeft=16;fillColor=#ede9fe;strokeColor=#7c3aed;strokeWidth=2;fontSize=13;opacity=60;" vertex="1" parent="1"><mxGeometry x="40" y="570" width="640" height="200" as="geometry"/></mxCell>
<mxCell id="band_mesh" value="&lt;b&gt;TAILSCALE MESH · private · credential-gated&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;align=left;verticalAlign=top;spacingTop=10;spacingLeft=16;fillColor=#dcfce7;strokeColor=#16a34a;strokeWidth=2;fontSize=13;opacity=60;" vertex="1" parent="1"><mxGeometry x="720" y="120" width="250" height="650" as="geometry"/></mxCell>
<mxCell id="band_pub" value="&lt;b&gt;PUBLIC · the only
internet-facing surface&lt;/b&gt;" style="rounded=1;whiteSpace=wrap;html=1;align=left;verticalAlign=top;spacingTop=10;spacingLeft=16;fillColor=#fef3c7;strokeColor=#d97706;strokeWidth=2;fontSize=13;opacity=60;" vertex="1" parent="1"><mxGeometry x="1010" y="120" width="240" height="650" as="geometry"/></mxCell>
<mxCell id="e_boot" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_boot_a" target="n_boot_b"><mxGeometry relative="1" as="geometry"><Array as="points"></Array></mxGeometry></mxCell>
<mxCell id="e_call" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_call_a" target="n_call_b"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="430" y="390"/></Array></mxGeometry></mxCell>
<mxCell id="e_dash" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_dash_a" target="n_dash_b"><mxGeometry relative="1" as="geometry"><Array as="points"></Array></mxGeometry></mxCell>
<mxCell id="e_pub" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_pub_a" target="n_pub_b"><mxGeometry relative="1" as="geometry"><Array as="points"></Array></mxGeometry></mxCell>
<mxCell id="e_ssh" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_ssh_a" target="n_ssh_b"><mxGeometry relative="1" as="geometry"><Array as="points"></Array></mxGeometry></mxCell>
<mxCell id="e_boards" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_boards_a" target="n_boards_b"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="895" y="405"/><mxPoint x="840" y="405"/></Array></mxGeometry></mxCell>
<mxCell id="e_tg" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;strokeColor=#334155;strokeWidth=2;endArrow=classic;endFill=1;exitX=0.5;exitY=0.5;entryX=0.5;entryY=0.5;" edge="1" parent="1" source="n_tg_a" target="n_tg_b"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="700" y="280"/><mxPoint x="700" y="690"/><mxPoint x="1130" y="690"/></Array></mxGeometry></mxCell>
<mxCell id="n_keeper" value="&lt;b&gt;launchd keepers&lt;/b&gt;&lt;br&gt;start at boot · restart what dies&lt;br&gt;the layer every other service trusts" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#2563eb;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="60" y="160" width="250" height="110" as="geometry"/></mxCell>
<mxCell id="n_agents" value="&lt;b&gt;Agent sessions&lt;/b&gt;&lt;br&gt;Codex · OpenClaw · Hermes · OMP&lt;br&gt;A2A endpoints 127.0.0.1:8391–8394&lt;br&gt;bounded tools · worktree writes" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#2563eb;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="380" y="160" width="270" height="140" as="geometry"/></mxCell>
<mxCell id="n_listeners" value="&lt;b&gt;Local listeners&lt;/b&gt;&lt;br&gt;ops board · session index ·&lt;br&gt;local APIs — every one bound&lt;br&gt;to 127.0.0.1 only" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#2563eb;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="60" y="320" width="250" height="160" as="geometry"/></mxCell>
<mxCell id="n_coolify" value="&lt;b&gt;Coolify stack&lt;/b&gt;&lt;br&gt;VictoriaMetrics · Grafana · small apps&lt;br&gt;ports published to loopback only · volumes persist state" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#7c3aed;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="70" y="620" width="580" height="120" as="geometry"/></mxCell>
<mxCell id="n_devices" value="&lt;b&gt;Your devices&lt;/b&gt;&lt;br&gt;phone · laptop&lt;br&gt;tailnet members" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#16a34a;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="740" y="160" width="210" height="110" as="geometry"/></mxCell>
<mxCell id="n_ssh" value="&lt;b&gt;SSH&lt;/b&gt;&lt;br&gt;terminal into the Mac,&lt;br&gt;key-based" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#16a34a;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="740" y="310" width="200" height="90" as="geometry"/></mxCell>
<mxCell id="n_boards" value="&lt;b&gt;Ops boards&lt;/b&gt;&lt;br&gt;Grafana · agent mail&lt;br&gt;reachable over the tailnet,&lt;br&gt;nowhere else" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#16a34a;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="740" y="440" width="200" height="120" as="geometry"/></mxCell>
<mxCell id="n_vercel" value="&lt;b&gt;Vercel&lt;/b&gt;&lt;br&gt;rajeevg.com · static + serverless&lt;br&gt;nothing here can open a connection&lt;br&gt;to the Mac" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#d97706;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="1030" y="160" width="200" height="110" as="geometry"/></mxCell>
<mxCell id="n_telegram" value="&lt;b&gt;Telegram&lt;/b&gt;&lt;br&gt;operator chat surface,&lt;br&gt;reached by outbound connection&lt;br&gt;only" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#d97706;strokeWidth=2;fontSize=13;labelBackgroundColor=#ffffff;align=center;" vertex="1" parent="1"><mxGeometry x="1030" y="310" width="200" height="130" as="geometry"/></mxCell>
<mxCell id="lbl_e_boot" value="boot +&lt;br&gt;restart" style="text;html=1;align=middle;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="265" y="182" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="lbl_e_call" value="call local APIs" style="text;html=1;align=start;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="362" y="338" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="lbl_e_dash" value="query dashboards" style="text;html=1;align=start;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="492" y="460" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="lbl_e_pub" value="publish to 127.0.0.1" style="text;html=1;align=start;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="132" y="544" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="lbl_e_ssh" value="credentials" style="text;html=1;align=start;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="718" y="284" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="lbl_e_boards" value="credentials" style="text;html=1;align=start;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="827" y="400" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="lbl_e_tg" value="outbound long-poll — Telegram never dials in" style="text;html=1;align=middle;fontSize=11;fontColor=#475569;labelBackgroundColor=#ffffff;" vertex="1" parent="1"><mxGeometry x="825" y="664" width="160" height="30" as="geometry"/></mxCell>
<mxCell id="legend" value="Bands show reachability zones · solid arrows are real network paths · absence of an arrow means no path exists · Evidence date: 31 Aug 2026" style="rounded=1;whiteSpace=wrap;html=1;align=center;fillColor=#f8fafc;strokeColor=#cbd5e1;fontSize=13;fontStyle=2;labelBackgroundColor=#f8fafc;" vertex="1" parent="1"><mxGeometry x="40" y="800" width="1200" height="44" as="geometry"/></mxCell>
</root></mxGraphModel></diagram></mxfile>
