Claude 92fa2a9860 bootstrap: infer the tailnet tag from the pre-auth key, verify the granted tag ... rig used to pass --ts-tag to `tailscale up --advertise-tags`, stating the tailnet tag a second time with no way to know whether its request and the key's own tags agreed. It asserted the tag it REQUESTED, never the tag control GRANTED — the sshd first-wins bug in a different hat, and the same scar (both M900s joined tag:server, retagged by hand, unnoticed). Collapse the two sources of truth onto one: the key. - `tailscale up` drops --advertise-tags; the key's tags apply. - After join, poll `tailscale status --json` for `.Self.Tags` (netmap ground truth, not `debug prefs`) until tags appear or BackendState=Running, on BOTH the fresh-join and already-joined paths. - UNTAGGED -> hard refusal: `tailscale logout` to back the user-owned node out, then die naming the fix (mint a tagged key). - Role policy moves onto the effective tag: a runner must not have tag:server among the tags the key actually granted. Strictly stronger than before. - --ts-tag is removed, and dies exit 2 with a message pointing at the key (consuming its value), not an "unknown flag". - New array-aware reader json_string_array in lib/runner-config.sh (jq-free, never fails under set -e), with its own unit tests; bootstrap sources the lib. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-17 15:27:09 +00:00
..
cli.sh	bootstrap: infer the tailnet tag from the pre-auth key, verify the granted tag	2026-07-17 15:27:09 +00:00