peters/horizon/horizon-cloud

Horizon cloud MCP

Use this skill for cloud offers, the cloud list of your workspace, a cloud that an agent rents or deletes without a person, companion workers, a worker's Local Network Bridge, and GitHub access on a cloud worker. Read the cloud reference for the server and operation you need. Use tools from the connected server and their current schemas. Do not substitute private Horizon state for MCP results. Cloud-list worker_image and image_publication are retained metadata from the matching cloud runtime, or null when unavailable or the image is unresolved. Registry publication includes an opaque nonsecret grant ID, never a credential value or path. These fields do not prove current registry access.

Hetzner offers include all current x86 types in permitted locations. The configured server types are fallback preferences; they do not restrict explicit worker choices.

cloud_create is the only cloud tool that spends money without a person. It rents a quick-start cloud in your workspace on the machine's own provider credentials, and only when cloud settings allow that in its agent_lifecycle section. Horizon chooses the provider from the offers of the providers that section lists, and the cheapest offer of the quick-start requirements wins. It answers at once: poll status with the same operation_id until done is true. The cloud appears on a card in your workspace and the card shows the same progress; stop it there, or read it with cloud_list. A cancel cannot recall a rented worker, so then read cloud_list and stop that cloud if it exists. You cannot choose a worker, plan token, siblings or publishing choice in this version. Read references/cloud.md before you submit.

cloud_delete deletes one cloud's provider resources without a person. It is irreversible: a provider request that Horizon sent cannot be recalled, so a delete may already be in progress as soon as submit answers. You can delete only a cloud that an agent panel of your own actor created. A cloud a person created, or one another agent created, is refused with cloud_delete_refused, and the person deletes it on its card. Poll status with the same operation_id: it reports the stage, the provider, and absent, which is true only when the record and the provider journal confirm that nothing the cloud created remains. The tool removes no card and deletes no credential. Read references/cloud.md before you submit.

Cloud cards show the last-read tailnet device name under Connections > Tailnet. Copy includes the MagicDNS domain when the worker reports it. A stable-name fallback accepts horizon-tailnet-contract=2 or horizon-tailnet-contract=4; it does not supply an unknown domain. Marker 2 qualifies this display fallback only; selected-tailnet operations require marker 4. Connect again to refresh names after an administrator rename.

The worker source recipes include pinned Unix PROXY1 and explicit flow cancellation. --horizon-flow-cancel / JSON HorizonFlowCancel defaults false; only Linux raw Unix PROXY1 without TLS supports it. The root controller must own the original private listener and exact daemon pair; agents must not substitute routes or infer identity from a header/config/descriptor. Payload write EOF keeps reverse flow open. Control DRAINED=0x01 then EOF confirms daemon copying, not remote application delivery. This transport does not activate M2; actual Kernel and userspace Worker consumer qualification remains separate. Same-PID TCP and generic-proxy output are insufficient. Published pins stay unchanged until actual publication. See references/cloud.md and docs/testing/procedures/tailscale-unix-proxy.md for current native-image gates.

A selected tailnet requires horizon-tailnet-contract=4 and an auth key with only tag:horizon-worker. The tailnet policy must define this tag in tagOwners. The worker checks Self.Tags after enrollment and once at each resume. An untagged node or a node with extra tags is refused and logged out. There is no continuous tag monitoring or separate tag for each workspace. The tailnet policy controls reachability. The quick-start pin contains marker 4; selected-tailnet startup still requires storage that enforces private root modes. The tested RunPod persistent storage does not and is unsupported. Never weaken these checks; None does not bypass isolation. CPU evidence is not GPU qualification.

Personal API token and OAuth client bindings stay in the desktop OS store, independently of enrollment auth keys. Stored presence reports kind only; it does not prove API validity, scope or network access. Saving does not remove nodes. Never pass an API secret to MCP or a worker. Settings > Tailnets displays nonsecret API credential status and supplies masked owner entry, replacement and removal. Saved values never fill a draft. Read cloud_companions.tailnet_api_credentials for cached ready, pending or unavailable status without Settings. The CLI is cloud_deploy tailnets STATE_ROOT [TAILNET_ID]. API status does not qualify an older worker image. Cached status is not an OS-store watcher; use Tailnets Refresh for an explicit fresh read. Never pass an API secret to MCP. For an authorized new cloud, the development CLI accepts cloud_deploy select-tailnet CATALOG_ROOT CLOUD_ID TAILNET_ID before allocation. Use the original saved catalog root and an existing saved ID. Deploy with STATE_ROOT equal to CATALOG_ROOT/CLOUD_ID. This writes only the selected network through the existing lifecycle lock; it reads no secret and starts no worker. A provisioned cloud keeps its network. Omission or an empty ID refuses instead of clearing it. See docs/testing/procedures/cloud-tailnet-selection.md.

Use tailnet_api_credential to request set_personal_token, set_oauth or remove for an exact saved tailnet ID and caller-chosen UUID request ID. Set requests carry kind metadata only; the person enters values and selects Save in Settings. The person fulfills it in Settings > Tailnets; requests never open Settings or authorize a write. Read status with the same IDs after a lost answer. cancel cancels only a pending request; a running transaction remains uncertain until its result arrives. Credentials are desktop-global, so a workspace agent cannot approve its own request. Status qualification uses the production UI, actual CLI and normal AGENT public MCP responses; baseline id/name evidence alone does not qualify API status.

The Linux Worker protected-ingress feature is off by default and has no public command. Its live reader checks the original fixed read-only host receipt, file metadata and current kernel boundary, retaining the host allocation. Serialized facts do not recreate custody or prove source preservation. Rootless/remapped workers, Gate activation and full M2 qualification remain unsupported by this component. Read docs/architecture/protected-ingress-reader.md before its owned-VM test.

The internal one-service-gateway feature stays off by default. It supplies an exact LAN/tailnet endpoint engine and an internal pinned Unix SSH attachment. No UI, CLI or MCP operation enables it. Use the existing owner-enabled Local Network Bridge tools for current operations. Private attachment needs the trusted non-symlink /tmp policy; non-Unix attachment is unsupported. M1-1 still needs owner controls, saved membership, interface parity and actual native LAN/tailnet qualification. Read docs/architecture/pinned-unix-ssh-attachment.md.

The same internal feature now includes a trusted Core owner controller. It saves Armed before private listener/SSH dispatch and retains the original Store, worker and pinned route until physical cleanup finishes. Decoded owner scope or retained metadata grants no approval. No UI/CLI/MCP route invokes it yet; complete M1 still needs actual owner controls and parity. Read docs/architecture/one-device-owner-admission.md and its component procedure before using the controller.

The Linux Worker trusted-tcp-producer feature is off by default. It checks the original root daemon through a root-private Unix Serve backend before bounded header and WhoIs comparisons. Generic SOCKS/HTTP proxy dials cannot reach that backend. It requires the pinned Unix Serve PROXY-v1 runtime with explicit flow cancellation; qualification is pending. An opaque AcceptedStream retains the original payload and private control. Write EOF keeps control alive; whole cancel closes both immediately. Normal completion requires daemon DRAINED0x01 plus EOF, bounded by the caller's captured deadline and cancellation. It adds no Gate, keeper, Serve/Funnel mapping or public operation. Read docs/architecture/trusted-tcp-producer.md and its component procedure.

Producer acceptance is opaque and bound to its exact original backend instance; a successor at the same path cannot adopt it. Retain only the weak pending cancellation handle before identification. It keeps no queued descriptor alive and continues to cancel the original payload/control after acceptance. Serialized facts, path equality and a retained bare socket clone are not this authority.

The Linux worker exposure-gate feature is also off by default. It provides a bounded actual-peer CIDR/Public TCP component only; no public operation starts it. The direct constructor refuses DNS/tag and TailnetOnly before binding. The separate default-off trusted-exposure-gate adapter consumes an original Producer and opaque accepted Unix stream for Restricted DNS/tag/CIDR rules. Pending streams expose no raw FD; Gate keeps only a weak cancellation handle and compares the private original-accept cookie before named admission. The original root-private Unix backend has no TCP bridge; direct public sockets retain their actual-peer CIDR behavior. The shared relay preserves byte budgets, half-close and physical cancellation on both transports. It owns no Serve mapping, protected runtime, keeper or public operation; TailnetOnly still refuses. Actual named allow/deny in both daemon modes remains a required gate. Follow the worker Gate sections of the cloud reference and their procedures.

Retained exposure records store bounded comparison data and service intent. The cloud-exposure feature enables record transitions and SDK availability for an ignored qualification test. It stays off by default and adds no public exposure operation. Present exposure selects Deployment 7 and paired Allocation 5; absent exposure keeps the earlier formats. A decoded record supplies no live approval, transport or cleanup proof. Read the retained exposure metadata section of the cloud reference.

The default-off SDK exposure-firewall management controller retains its original client, sibling rules and foreign policies. It needs the actual owner's durable journal, pinned SSH management policy and physical Gate teardown; no public tool starts it. Read the exposure management section of the cloud reference.

The Protocol exposure-control feature is off by default. Its bounded request, reply, member and Worker observations are passive comparison facts. They grant no held stream, owner approval, live membership or runtime readiness. There is no public activation. See docs/architecture/exposure-control.md and its procedure.

Machine-local destination preference helpers retain a checkout/profile scope and nonsecret account or exact registry grant metadata. The launch engine retains that choice before image work. A saved preference is not proof of authentication or registry permission. Keep these settings outside repository files and use the shared transactional save helper to preserve other windows' choices.