@crvouga/dev-fleet 0.8.0 → 0.9.0

package/src/platform/t3-service.ts

@@ -1,20 +1,41 @@
 import policy from '../../ansible/ubuntu/policy.json';
 import type { Runner, Check } from '../types';
+import type { Session } from '../../bootstrap/worker-features';
 
 /** The user unit that runs the pinned desktop app (UI and embedded server). */
 export const T3_DESKTOP_UNIT = 't3code-desktop.service';
+/** The lingering user unit that runs the pinned native server on a headless
+ * worker (`t3-headless.yml`). */
+export const T3_HEADLESS_UNIT = 't3code-headless.service';
 
-/** Workers run one T3 process: the desktop app, started with the auto-login
- * graphical session. `t3-desktop.yml` installs it, retires the former headless
- * server and starts the app; this only refuses a foreign launcher beforehand
+/** The unit that runs T3 for a session type. */
+export function t3Unit(session: Session = 'desktop'): string {
+  return session === 'headless' ? T3_HEADLESS_UNIT : T3_DESKTOP_UNIT;
+}
+
+/** Workers run one T3 process: on a desktop worker the desktop app, started
+ * with the auto-login graphical session (`t3-desktop.yml`); on a headless
+ * worker the pinned native server as a lingering user service
+ * (`t3-headless.yml`). The play installs it, retires the other session
+ * type's unit and starts it; this only refuses a foreign launcher beforehand
  * and measures the result afterwards.
  */
 export async function convergeT3Service(
   artifact: { path: string; version: string },
   run: Runner,
-  prepare: () => Promise<Check[]> = async () => [],
-  install: () => Promise<boolean> = async () => true
+  steps: {
+    /** Stages the policy; any check it returns stops here. */
+    prepare?: () => Promise<Check[]>;
+    /** Applies the session type's playbook. */
+    install?: () => Promise<boolean>;
+    session?: Session;
+  } = {}
 ): Promise<Check[]> {
+  const {
+    prepare = async () => [],
+    install = async () => true,
+    session = 'desktop',
+  } = steps;
   const existing = await run(['t3', '--version']);
   if (conflictingVersion(existing, artifact.version))
     return pending(
@@ -23,27 +44,55 @@ export async function convergeT3Service(
     );
   const preparation = await prepare();
   if (preparation.length) return preparation;
-  if (!(await install()))
-    return pending(
+  const words = SESSION_WORDS[session];
+  if (!(await install())) return pending(...words.installFailed);
+  const unit = t3Unit(session);
+  const active = await userctl(run, 'is-active', unit);
+  const enabled = await userctl(run, 'is-enabled', unit);
+  if (!active.ok || !enabled.ok) return pending(...words.stopped(unit));
+  return [{ id: 't3:service', status: 'pass', summary: words.running }];
+}
+
+/** How a worker's T3 restarts for a new release or policy, as the manager's
+ * bootstrap passes it on to node convergence (`fleet-sync --restart-busy`).
+ * The words cross from one revision's script to another: an interface.
+ */
+export const T3_RESTART_MODES = ['keep-turns', 'restart-busy'] as const;
+
+/** What the check says of each session type: its codes and remedies. */
+const SESSION_WORDS: Record<
+  Session,
+  {
+    installFailed: [string, string];
+    stopped: (unit: string) => [string, string];
+    running: string;
+  }
+> = {
+  desktop: {
+    installFailed: [
       'T3_DESKTOP_INSTALL_FAILED',
-      'Inspect the t3-desktop.yml Ansible output (package download, apt, GDM auto-login, user unit). T3 data in ~/.t3 is untouched.'
-    );
-  const active = await userctl(run, 'is-active', T3_DESKTOP_UNIT);
-  const enabled = await userctl(run, 'is-enabled', T3_DESKTOP_UNIT);
-  if (!active.ok || !enabled.ok)
-    return pending(
+      'Inspect the t3-desktop.yml Ansible output (package download, apt, GDM auto-login, user unit). T3 data in ~/.t3 is untouched.',
+    ],
+    stopped: (unit) => [
       'T3_DESKTOP_STOPPED',
-      `The desktop app needs the auto-login graphical session. Reboot or log in on the machine, then inspect journalctl --user -u ${T3_DESKTOP_UNIT}; ~/.t3 is preserved.`
-    );
-  return [
-    {
-      id: 't3:service',
-      status: 'pass',
-      summary:
-        'Pinned T3 desktop app is enabled for the auto-login session and running. Private routing, policy and pairing remain separate checks.',
-    },
-  ];
-}
+      `The desktop app needs the auto-login graphical session. Reboot or log in on the machine, then inspect journalctl --user -u ${unit}; ~/.t3 is preserved.`,
+    ],
+    running:
+      'Pinned T3 desktop app is enabled for the auto-login session and running. Private routing, policy and pairing remain separate checks.',
+  },
+  headless: {
+    installFailed: [
+      'T3_SERVER_INSTALL_FAILED',
+      'Inspect the t3-headless.yml Ansible output (the pinned server in the toolchain, the user unit). T3 data in ~/.t3 is untouched.',
+    ],
+    stopped: (unit) => [
+      'T3_SERVER_STOPPED',
+      `The T3 server is a lingering user service and needs no login. Inspect journalctl --user -u ${unit} and loginctl show-user for Linger=yes; ~/.t3 is preserved.`,
+    ],
+    running:
+      'Pinned T3 server is enabled as a lingering user service and running, with no display. Private routing, policy and pairing remain separate checks.',
+  },
+};
 
 /** The recovery script, installed outside every revision (`tasks/recovery.yml`). */
 export const T3_HEALTH_SCRIPT = '/usr/local/lib/personal-fleet/t3-health.sh';
@@ -85,7 +134,8 @@ export async function restartDeferral(
 export async function runningVersionCheck(
   run: Runner,
   uid: number,
-  now: number = Date.now()
+  now: number = Date.now(),
+  session: Session = 'desktop'
 ): Promise<Check> {
   const server = await run(
     [
@@ -98,11 +148,8 @@ export async function runningVersionCheck(
     ],
     { timeoutMs: 15_000 }
   );
-  const installed = await run(['cat', T3_DESKTOP_RELEASE]);
   const running = serverVersion(server.ok ? server.stdout : '');
-  const release = /^T3-Code-(.+)-[a-z0-9]+\.deb$/.exec(
-    installed.ok ? installed.stdout.trim() : ''
-  )?.[1];
+  const release = await installedRelease(run, session);
   const id = 't3:running-version';
   if (!running || !release)
     return {
@@ -111,7 +158,7 @@ export async function runningVersionCheck(
       summary: 'T3_RUNNING_VERSION_UNKNOWN',
       remedy: {
         action:
-          'The running server or the installed release could not be read. Check worker:t3-health, then rerun fleet-sync to reinstall the pinned desktop app.',
+          'The running server or the installed release could not be read. Check worker:t3-health, then rerun fleet-sync to reinstall the pinned T3.',
       },
     };
   if (running === release)
@@ -127,12 +174,37 @@ export async function runningVersionCheck(
     summary: 'T3_RESTART_PENDING',
     remedy: {
       action: deferral.overdue
-        ? `T3 still runs ${running} after ${policy.t3RestartMaxDeferralHours} hours because agent turns kept running. Finish or stop them, or restart ${T3_DESKTOP_UNIT} on the worker (this ends its running turns).`
+        ? `T3 still runs ${running} after ${policy.t3RestartMaxDeferralHours} hours because agent turns kept running. Finish or stop them, or restart ${t3Unit(session)} on the worker (this ends its running turns).`
         : `T3 runs ${running}; ${release} is installed. personal-worker-recovery restarts it at the first check with no agent turn running.`,
     },
   };
 }
 
+/** The release installed for the session: the desktop package the app was
+ * unpacked from, or the versioned directory the server unit runs. */
+async function installedRelease(
+  run: Runner,
+  session: Session
+): Promise<string | undefined> {
+  if (session === 'headless') {
+    const shown = await run([
+      'systemctl',
+      '--user',
+      'show',
+      '--property=ExecStart',
+      '--value',
+      T3_HEADLESS_UNIT,
+    ]);
+    return shown.ok
+      ? /\/t3-([\w.+-]+?)-linux-[a-z0-9]+\/t3\b/.exec(shown.stdout)?.[1]
+      : undefined;
+  }
+  const installed = await run(['cat', T3_DESKTOP_RELEASE]);
+  return /^T3-Code-(.+)-[a-z0-9]+\.deb$/.exec(
+    installed.ok ? installed.stdout.trim() : ''
+  )?.[1];
+}
+
 function serverVersion(body: string): string | undefined {
   try {
     const value: unknown = JSON.parse(body);
@@ -148,15 +220,18 @@ function serverVersion(body: string): string | undefined {
   }
 }
 
-/** When the desktop app last started; changes exactly when it restarts. */
-export async function t3StartedAt(run: Runner): Promise<string> {
+/** When T3 last started; changes exactly when it restarts. */
+export async function t3StartedAt(
+  run: Runner,
+  session: Session = 'desktop'
+): Promise<string> {
   const shown = await run([
     'systemctl',
     '--user',
     'show',
     '--property=ActiveEnterTimestampMonotonic',
     '--value',
-    T3_DESKTOP_UNIT,
+    t3Unit(session),
   ]);
   return shown.ok ? shown.stdout.trim() : '';
 }

package/src/platform/ubuntu-release.ts

@@ -9,6 +9,11 @@ export interface UbuntuRelease {
   architectures: string[];
   /** Pins of this release that differ from the policy's `packages`. */
   packages?: Record<string, string>;
+  /** Pins of this release that differ from the policy's `browser.packages`. */
+  browserPackages?: Record<string, string>;
+  /** The digest of the key Tailscale signs this release's suite with, when
+   * it is not the policy's `tailscale.keySha256`. */
+  tailscaleKeySha256?: string;
 }
 
 export const UBUNTU_RELEASES: readonly UbuntuRelease[] = policy.releases;
@@ -21,6 +26,25 @@ export function packagePins(
   return { ...policy.packages, ...release?.packages };
 }
 
+/** The browser library pins of one release, combined the same way. */
+export function browserPackagePins(
+  release: UbuntuRelease | undefined
+): Record<string, string> {
+  return { ...policy.browser.packages, ...release?.browserPackages };
+}
+
+/** The Tailscale version and the digest of the key that signs one release's
+ * suite (as tasks/release.yml selects it for Ansible). */
+export function tailscalePins(release: UbuntuRelease | undefined): {
+  version: string;
+  keySha256: string;
+} {
+  return {
+    version: policy.tailscale.version,
+    keySha256: release?.tailscaleKeySha256 ?? policy.tailscale.keySha256,
+  };
+}
+
 /** `uname -m` for each Debian architecture name. */
 const KERNEL_ARCHITECTURES: Record<string, string> = {
   amd64: 'x86_64',

package/src/platform/ubuntu-verify.ts

@@ -1,9 +1,13 @@
 import type { Check, Runner } from '../types';
+import type { MachineClass } from '../machine/machine-class';
 
-const LOGIND = {
+/** What a lid does: a virtual machine has none, so these do not apply. */
+const LID = {
   HandleLidSwitch: 's "ignore"',
   HandleLidSwitchDocked: 's "ignore"',
   HandleLidSwitchExternalPower: 's "ignore"',
+};
+const LOGIND = {
   IdleAction: 's "ignore"',
   KillUserProcesses: 'b false',
   StopIdleSessionUSec: 't 18446744073709551615',
@@ -17,9 +21,33 @@ const POWER_FILES = [
  */
 export async function verifyUbuntuBoot(
   user: string,
-  run: Runner
+  run: Runner,
+  machine: MachineClass = 'physical'
+): Promise<Check[]> {
+  const virtual = machine === 'virtual';
+  // On a virtual machine the lid policy is not applicable; the sleep masks
+  // stay, since a guest can still be suspended by its own idle policy.
+  const lid: Check[] = virtual
+    ? [
+        {
+          id: 'ubuntu:lid-policy',
+          status: 'not-applicable',
+          summary: 'Not applicable: a virtual machine has no lid.',
+        },
+      ]
+    : [];
+  return [
+    ...lid,
+    ...(await bootPolicy(user, run, virtual ? LOGIND : { ...LID, ...LOGIND })),
+  ];
+}
+
+async function bootPolicy(
+  user: string,
+  run: Runner,
+  properties: Record<string, string>
 ): Promise<Check[]> {
-  for (const [property, expected] of Object.entries(LOGIND)) {
+  for (const [property, expected] of Object.entries(properties)) {
     const observed = await run([
       'busctl',
       'get-property',

package/src/platform/ubuntu-worker.ts

@@ -0,0 +1,58 @@
+import type { Runner } from '../types';
+import type { WorkerFeatures } from '../worker-features';
+import {
+  browserPackagePins,
+  kernelArchitectures,
+  packagePins,
+  tailscalePins,
+  UBUNTU_RELEASES,
+  ubuntuRelease,
+} from './ubuntu-release';
+import type { WorkerPlatform, WorkerRelease } from './worker-platform';
+
+/** Ubuntu: every release ansible/ubuntu/policy.json accepts, converged by
+ * the playbooks under ansible/ubuntu. A release's differences are data of
+ * its policy entry (tasks/release.yml selects it from the facts). */
+export const UBUNTU_WORKER: WorkerPlatform = {
+  family: 'ubuntu',
+  label: 'Ubuntu',
+  policy: 'ansible/ubuntu/policy.json',
+  playbooks: 'ansible/ubuntu',
+  releases: UBUNTU_RELEASES,
+  mismatch: 'UBUNTU_BASELINE_MISMATCH',
+  packageManager: 'apt',
+  packagePins: (release) => packagePins(ubuntuRelease(release?.release)),
+  browserPackagePins: (release) =>
+    browserPackagePins(ubuntuRelease(release?.release)),
+  tailscalePins: (release) => tailscalePins(ubuntuRelease(release?.release)),
+  serviceManager: 'systemd',
+  sessionModel: 'systemd-user-linger',
+  release: (version) => ubuntuRelease(version),
+  kernelArchitectures: (release: WorkerRelease) =>
+    kernelArchitectures(ubuntuRelease(release.release) ?? release),
+  // Loaded when used: the platform probe reads this module on the manager,
+  // and the host checks pull in what only a worker runs.
+  hostChecks: async (
+    user: string,
+    run: Runner,
+    features?: WorkerFeatures,
+    powerRecoveryNote?: string
+  ) =>
+    (await import('../worker-host-checks')).workerHostChecks(
+      user,
+      run,
+      features,
+      powerRecoveryNote
+    ),
+};
+
+/** Every platform a worker may run. A machine of any other family is
+ * refused by the first check that can tell (docs/support-matrix.md). */
+export const WORKER_PLATFORMS: readonly WorkerPlatform[] = [UBUNTU_WORKER];
+
+/** The platform of an `ID` from /etc/os-release, when workers may run it. */
+export function workerPlatform(
+  family: string | null | undefined
+): WorkerPlatform | undefined {
+  return WORKER_PLATFORMS.find((platform) => platform.family === family);
+}

package/src/platform/worker-platform.ts

@@ -0,0 +1,72 @@
+import type { Check, Runner } from '../types';
+import type { WorkerFeatures } from '../worker-features';
+
+/** One release of a worker platform, as its policy names it. */
+export interface WorkerRelease {
+  /** `VERSION_ID` of /etc/os-release. */
+  release: string;
+  codename: string;
+  /** Debian architecture names, as `dpkg --print-architecture` reports them. */
+  architectures: string[];
+}
+
+/** What differs between the operating systems a worker may run. Everything
+ * the manager and the worker's own checks need to know about one platform is
+ * here; what a playbook needs is data of the platform's policy, selected on
+ * the machine from its facts. Ubuntu is the one implementation
+ * (`src/platform/ubuntu-worker.ts`); docs/support-matrix.md lists the
+ * platforms that are not, and what each would need.
+ */
+export interface WorkerPlatform {
+  /** `ID` of /etc/os-release, as the platform probe prints it. */
+  readonly family: string;
+  /** The name the support matrix gives it. */
+  readonly label: string;
+  /** The policy that names its releases and pins, from the package root. */
+  readonly policy: string;
+  /** The playbooks that converge it, from the package root. */
+  readonly playbooks: string;
+  /** The releases a worker may run, newest first. */
+  readonly releases: readonly WorkerRelease[];
+  /** The reason a machine of this family is refused before anything is
+   * installed: another release or another CPU. */
+  readonly mismatch: string;
+
+  /** Packages: the system package manager the pins are written for, and the
+   * exact pins of one release (common pins with the release's own over them). */
+  readonly packageManager: 'apt';
+  packagePins(release: WorkerRelease | undefined): Record<string, string>;
+  /** The libraries headless Chromium loads, pinned the same way. */
+  browserPackagePins(
+    release: WorkerRelease | undefined
+  ): Record<string, string>;
+  /** The Tailscale version and the digest of the key that signs this
+   * release's package suite. */
+  tailscalePins(release: WorkerRelease | undefined): {
+    version: string;
+    keySha256: string;
+  };
+
+  /** Service manager: what keeps the always-on system services and the
+   * developer's own units running and restarts them. */
+  readonly serviceManager: 'systemd';
+  /** Session model: how the developer's processes (T3, agents) outlive a
+   * login. `systemd-user-linger`: a lingering systemd user manager, started
+   * at boot without anyone logged in, never stopped by logind. */
+  readonly sessionModel: 'systemd-user-linger';
+
+  /** The release a probe reported, when the platform accepts it. */
+  release(version: string | null | undefined): WorkerRelease | undefined;
+  /** The `uname -m` names one release runs on. */
+  kernelArchitectures(release: WorkerRelease): string[];
+  /** Checks: the measured host evidence of a worker of this platform,
+   * read-only, run on the worker itself. What its declared features leave
+   * out is not applicable; so is a physical machine's power recovery on a
+   * virtual one, which `powerRecoveryNote` may say who provides. */
+  hostChecks(
+    user: string,
+    run: Runner,
+    features?: WorkerFeatures,
+    powerRecoveryNote?: string
+  ): Promise<Check[]>;
+}

package/src/protocol.ts

@@ -2,7 +2,7 @@ import { record } from './config';
 import { FINGERPRINT_FILES } from './input-hashes';
 import type { Check, Snapshot } from './types';
 
-const STATUSES = ['pass', 'warn', 'fail', 'skip'];
+const STATUSES = ['pass', 'warn', 'fail', 'skip', 'not-applicable'];
 
 export function validCheck(value: unknown): value is Check {
   if (

package/src/public-reachability.ts

@@ -0,0 +1,186 @@
+import { createConnection, isIP } from 'node:net';
+import { record } from './config';
+import { fleet } from './fleet-config';
+import { workerExposure, type WorkerExposure } from './exposure';
+import { MONITORING_AGENT_PORT } from './worker-exposure';
+import type { Check, NodeReport, Runner } from './types';
+
+/** Opens one TCP connection and closes it at once: whether it was accepted. */
+export type Connect = (
+  host: string,
+  port: number,
+  timeoutMs: number
+) => Promise<boolean>;
+
+export const tcpConnect: Connect = (host, port, timeoutMs) =>
+  new Promise((resolve) => {
+    const socket = createConnection({ host, port });
+    const done = (accepted: boolean) => {
+      socket.destroy();
+      resolve(accepted);
+    };
+    socket.setTimeout(timeoutMs, () => done(false));
+    socket.once('connect', () => done(true));
+    socket.once('error', () => done(false));
+  });
+
+const UNRESTRICTED = 'WORKER_PUBLIC_PORT_UNRESTRICTED';
+
+const PRIVATE_V4: [number, number][] = [
+  [0x00000000, 8], // this network
+  [0x0a000000, 8],
+  [0x64400000, 10], // carrier-grade NAT and the tailnet
+  [0x7f000000, 8],
+  [0xa9fe0000, 16], // link-local
+  [0xac100000, 12],
+  [0xc0a80000, 16],
+  [0xe0000000, 3], // multicast and reserved
+];
+
+/** An address the internet routes to: not private, loopback, link-local,
+ * shared (which includes the tailnet), unique-local or multicast. */
+export function isPublicAddress(address: string): boolean {
+  if (isIP(address) === 4) {
+    const value =
+      address
+        .split('.')
+        .reduce((total, part) => total * 256 + Number(part), 0) >>> 0;
+    return !PRIVATE_V4.some(
+      ([network, bits]) =>
+        value >>> (32 - bits) === (network >>> (32 - bits)) >>> 0
+    );
+  }
+  if (isIP(address) === 6) {
+    const lower = address.toLowerCase();
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+    if (mapped) return isPublicAddress(mapped[1]!);
+    return !(
+      lower === '::' ||
+      lower === '::1' ||
+      /^fe[89ab]/.test(lower) ||
+      /^f[cd]/.test(lower) ||
+      /^ff/.test(lower)
+    );
+  }
+  return false;
+}
+
+/** The public addresses Tailscale reaches a worker at (`Addrs` of its peer in
+ * `tailscale status --json`), each once. */
+export function publicEndpoints(
+  status: unknown,
+  tailscaleName: string
+): string[] {
+  if (!record(status) || !record(status['Peer'])) return [];
+  const name = tailscaleName.toLowerCase();
+  const peer = Object.values(status['Peer']).find(
+    (entry) =>
+      record(entry) &&
+      typeof entry['DNSName'] === 'string' &&
+      entry['DNSName'].replace(/\.$/, '').toLowerCase() === name
+  );
+  if (!record(peer) || !Array.isArray(peer['Addrs'])) return [];
+  const found = new Set<string>();
+  for (const entry of peer['Addrs'].slice(0, 32)) {
+    if (typeof entry !== 'string') continue;
+    const host = entry.replace(/:\d+$/, '').replace(/^\[|\]$/g, '');
+    if (isPublicAddress(host)) found.add(host);
+  }
+  return [...found];
+}
+
+/** worker:public-reachability, from the manager: none of the fleet's ports
+ * accepts a connection on the worker's public address. Optional: the manager
+ * may share the worker's network, so a failure here never blocks readiness;
+ * worker:exposure is measured on the worker itself. Names the service and
+ * port, never the address.
+ */
+export async function publicReachabilityCheck(
+  rules: WorkerExposure,
+  addresses: string[],
+  connect: Connect = tcpConnect
+): Promise<Check> {
+  if (addresses.length === 0)
+    return {
+      id: 'worker:public-reachability',
+      status: 'not-applicable',
+      required: false,
+      summary:
+        'Tailscale knows no public address for this worker: there is nothing outside the tailnet to try.',
+    };
+  const ports = [
+    ...(rules.policy.publicSsh ? [] : [{ name: 'SSH', port: rules.sshPort }]),
+    { name: 'T3', port: rules.t3Port },
+    { name: 'the monitoring agent', port: MONITORING_AGENT_PORT },
+  ].filter(
+    (entry) =>
+      !rules.policy.publicPorts.some(
+        (open) => open.protocol === 'tcp' && open.port === entry.port
+      )
+  );
+  const accepted: string[] = [];
+  for (const entry of ports)
+    for (const address of addresses)
+      if (await connect(address, entry.port, 3_000)) {
+        accepted.push(`${entry.name} (tcp ${entry.port})`);
+        break;
+      }
+  const tried = ports.map((entry) => `${entry.name} (tcp ${entry.port})`);
+  if (accepted.length)
+    return {
+      id: 'worker:public-reachability',
+      status: 'fail',
+      required: false,
+      summary: `${UNRESTRICTED} ${accepted.join(', ')} accepted a connection on the worker's public address.`,
+      remedy: {
+        action:
+          'Run devfleet fleet-sync, which loads the fleet firewall on the worker, then read worker:exposure for the unit that listens. When the manager shares the worker’s network, confirm from a machine outside it before changing anything.',
+      },
+    };
+  return {
+    id: 'worker:public-reachability',
+    status: 'pass',
+    required: false,
+    summary: `No connection was accepted on the worker's public address: ${tried.join(', ')}.`,
+  };
+}
+
+/** Adds worker:public-reachability to the report of every declared worker
+ * the tailnet knows. */
+export async function appendPublicReachability(
+  reports: NodeReport[],
+  run: Runner,
+  connect: Connect = tcpConnect
+): Promise<void> {
+  const status = await run(['tailscale', 'status', '--json'], {
+    timeoutMs: 15_000,
+  });
+  let parsed: unknown = null;
+  try {
+    parsed = status.ok ? JSON.parse(status.stdout) : null;
+  } catch {
+    /* Raw status is never reported. */
+  }
+  for (const machine of fleet.workers) {
+    const name = machine.network?.tailscaleName;
+    const report = reports.find(
+      (entry) => entry.node === name || entry.node === machine.id
+    );
+    if (!report || !name) continue;
+    report.checks.push(
+      parsed === null
+        ? {
+            id: 'worker:public-reachability',
+            status: 'skip',
+            required: false,
+            summary:
+              'Tailscale status is unavailable on the manager, so the public address of this worker is unknown.',
+          }
+        : await publicReachabilityCheck(
+            workerExposure(fleet, machine.id),
+            publicEndpoints(parsed, name),
+            connect
+          )
+    );
+  }
+}