Add Tailscale Serve support for WSL gateways

[andyeskridge]

Summary

• Problem: Generated WSL gateways are loopback-only, so Companion cannot use a private tailnet endpoint.
• Why it matters: Users with Tailscale need secure remote access without LAN exposure, port forwarding, or localhost fallback.
• What changed: Added opt-in Tailscale Serve provisioning, browser/auth-key authorization, WSS gateway registration, Tailscale-aware recovery, runtime checks, redaction, and docs.
• User impact: New/replacement generated gateways can publish privately at wss://<wsl-node>.<tailnet>.ts.net. Tailscale identity authentication is a separate explicit opt-in.
• What did NOT change (scope boundary): No Funnel, Headscale, Tailscale SSH, subnet routing, named services, Windows Tailscale installation/removal, or in-place upgrades of existing gateways. Tailscale lifecycle and Serve remain root-owned; the openclaw account is not a Tailscale operator.

Change Type (select all)

• Bug fix
• Feature
• Refactor
• Docs / instructions
• Tests / validation
• Security hardening
• Chore / infra

Scope (select all touched areas)

• Tray / WinUI UX
• Windows node capability
• Local MCP / winnode
• Gateway / connection / pairing
• Setup / onboarding
• Permissions / privacy / security
• Tests / CI / docs

Linked Issue/PR

• Closes Add opt-in Tailscale Serve with tailnet identity authentication for generated WSL gateways #966
• Related to a bug or regression

Validation

Current commit: 4a70b196 Scope Tailscale recovery to managed gateways

• .\build.ps1
  • Passed: Shared, CLI, WinNode CLI, SetupEngine, and WinUI builds.
• dotnet test .\tests\OpenClaw.SetupEngine.Tests\OpenClaw.SetupEngine.Tests.csproj --no-restore
  • Passed: 448, Failed: 0, Skipped: 0.
• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore
  • Passed: 2724, Failed: 0, Skipped: 31.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore
  • Passed: 1671, Failed: 0, Skipped: 0.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter FullyQualifiedName~ConnectionPageTailscaleRecoveryTests
  • Passed: 4, Failed: 0, Skipped: 0.
• git diff --check
  • Passed.

Real behavior proof

Current-head automated proof

The current head includes focused regression coverage for the security and failure boundaries requested in review:

• happy-path Serve finalization: exact HTTPS proxy target, device-pair public URL write, WSS endpoint publication, and root-owned Serve operation;
• browser/HTTPS approval polling until configured or bounded timeout;
• Serve health-check failure rolls back Funnel/Serve state, logs out, and disables tailscaled before pairing;
• Tailscale transport with identity trust off keeps gateway.auth.allowTailscale=false and preserves shared/bootstrap/device-token precedence;
• Tailscale-disabled fresh and replacement pipelines skip only Tailscale steps;
• Funnel detection rejects public exposure and surfaces recovery guidance; cleanup resets Funnel and Serve before daemon teardown.

Current-head WinUI managed vs. unmanaged Tailscale recovery proof

• Environment tested: Windows 11 with two isolated Companion profiles. Each profile used a deliberately non-resolving fake wss://[redacted].ts.net endpoint; no real tailnet hostname, credential, or WSL gateway was used.
• PR head / commit tested: 4a70b196 Scope Tailscale recovery to managed gateways.
• Exact steps:
  1. Started Companion with an app-owned record marked IsLocal=true and SetupManagedDistroName=OpenClawGateway-Proof, then allowed the fake WSS connection to fail.
  2. Repeated with an external/manual .ts.net record without a managed-distro marker.
• Live WinUI diagnostic:
  • The managed record visibly rendered Tailscale gateway unavailable and Check Tailscale access, including the Windows sign-in, same-tailnet, tailscaled, Serve, OpenClaw service, Funnel, WSS-only, and no-localhost-fallback guidance.
  • The manual/external record visibly rendered Can't reach gateway and only the ordinary gateway-host, network/VPN, and SSH-tunnel recovery guidance. It did not display the Tailscale-specific recovery path.
• Observed result: Dedicated Tailscale recovery is scoped to app-owned generated WSL gateways; external/manual .ts.net gateways retain ordinary network recovery.

Current-head live Windows/WSL/Tailscale proof

• Environment tested: Windows host with WSL2 and Windows Tailscale connected to the same tailnet as the replacement OpenClawGateway distro.

• PR head / commit tested: 4a70b196 Scope Tailscale recovery to managed gateways.

• Setup result: generated app-owned record is wss://…ts.net, named Tailscale (OpenClawGateway), marked local, and retains the managed distro association. It has no shared or bootstrap token.

• Tailscale state: Windows and WSL MagicDNS suffixes matched; tailscaled was active as root; the non-root openclaw user gateway service was active and could run tailscale whois.

• Serve and public exposure: Windows HTTPS to the generated hostname returned 200; tailscale serve status --json contained exactly one 127.0.0.1:18789 proxy; neither Serve nor tailscale funnel status --json reported a public Funnel flag.

• Identity trust: gateway.auth.allowTailscale=true. A Windows-originated WSS connect with no shared/bootstrap/device-token fields and no device identity reached NOT_PAIRED / DEVICE_IDENTITY_REQUIRED, rather than token authorization rejection. The same token-free request with the already-paired device's signed identity returned ok: true. This proves the intended layered path: Serve-verified tailnet identity plus normal paired-device identity, without silently falling back to a shared token.

• Companion result: openclaw nodes status reported one paired and connected node; openclaw nodes invoke --command device.info --params '{}' returned ok: true through the WSS record.

• Redaction: setup logs contained zero tskey- matches and zero login.tailscale.com authorization URLs.

• Screenshot/artifact links verified?

• Not verified / blocked: A fresh destructive rollback/uninstall execution was intentionally not repeated after the successful live setup, to preserve the working gateway. The current-head rollback and cleanup paths are covered by the focused automated tests above. Funnel, Headscale, Tailscale SSH, subnet routing, and named Tailscale Services remain intentionally out of scope.

Security Impact (required)

• New permissions/capabilities? (Yes)
• Secrets/tokens handling changed? (Yes)
• New/changed network calls? (Yes)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation:
  • Private Serve is opt-in and OpenClaw remains loopback-bound inside WSL.
  • tailscale up, Serve, reset, logout, and daemon administration are root-owned. The gateway account receives no Tailscale operator authority.
  • Tailscale identity trust is separately opt-in. When enabled, verified tailnet identity and tailnet ACLs become part of the gateway authorization boundary; token/device credentials remain available.
  • Auth keys are transient, never accepted through CLI arguments or persisted config, and setup logs redact auth keys and Tailscale authorization URLs.
  • Funnel is unsupported, detected, and rejected.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (Yes)
• Migration needed? (No)
• Existing managed gateways remain unchanged. To opt in, create or replace an app-generated WSL gateway and enable Tailnet access with Tailscale Serve.
• Optional headless inputs: --tailscale, --tailscale-trust-auth, --tailscale-auth browser|auth-key, --tailscale-hostname, and OPENCLAW_SETUP_TAILSCALE_AUTH_KEY for auth-key mode.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only conversations that still need reviewer or maintainer judgment.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 18, 2026, 1:34 AM ET / 05:34 UTC.

Summary
Adds opt-in Tailscale Serve provisioning for generated WSL gateways, with private WSS registration, optional tailnet identity authentication, setup UI/CLI inputs, recovery guidance, documentation, and regression coverage.

Reproducibility: not applicable. as a defect reproduction: this is a new capability. The PR supplies a concrete Windows/WSL setup and WSS invocation scenario, but its live evidence should be repeated on the current merge head.

Review metrics: 2 noteworthy metrics.

• Patch surface: 25 files; 1,939 additions and 29 deletions. The feature spans SetupEngine, WinUI setup/recovery, documentation, and focused tests, so the authorization and upgrade boundary merits final human review.
• Focused coverage: 24 Tailscale setup/rollback, 4 managed-recovery, and 4 pairing-cancellation tests reported. The branch reports targeted regression coverage for its new pipeline and the two recent setup integrations.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #966
Summary: This PR is the candidate implementation for the closed feature request describing the same opt-in generated-WSL Tailscale Serve workflow.

Members:

• canonical: Add opt-in Tailscale Serve with tailnet identity authentication for generated WSL gateways #966 - The PR body explicitly links this feature request and its requested setup, WSS registration, recovery, redaction, and identity-auth behavior match the PR scope.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦐 gold shrimp
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Post a redacted live Windows/WSL Tailscale transcript from b5d8acb covering private Serve, Funnel status, WSS node invocation, and both identity-trust modes.
• Obtain explicit maintainer sponsorship for the new core setup and authorization surface.

Proof guidance:

• [P1] Needs stronger real behavior proof before merge: The PR contains valuable live Windows/WSL and WinUI evidence, but it identifies 4a70b196 rather than current head b5d8acb; refresh a redacted exact-head transcript before merge and update the PR body to trigger re-review.

Risk before merge

• [P1] Merging introduces a new optional trust boundary: when identity trust is enabled, tailnet identity and ACL policy participate in gateway authorization, so maintainers need to explicitly sponsor that core product/security contract.
• [P1] The supplied real Windows/WSL proof predates the current merge head, and the exact-head CI matrix is still in progress; a final redacted runtime transcript should verify the merged branch did not alter the intended Serve, Funnel, and authentication behavior.

Maintainer options:

1. Refresh exact-head runtime proof (recommended)
   Before merge, run the live Windows/WSL Tailscale scenario on b5d8acb and attach a redacted terminal transcript proving WSS reachability, no Funnel, and the trust-off/trust-on authorization boundaries.
2. Explicitly sponsor the authorization model
   A maintainer should confirm that optional tailnet identity and ACLs are an accepted additional gateway authorization boundary for generated WSL gateways.
3. Pause if core ownership is not desired
   If the project does not want to own Tailscale lifecycle and identity-trust UX in SetupEngine, pause this feature rather than landing a parallel unsupported path.

Next step before merge

• [P1] The remaining blockers are maintainer sponsorship of a new core security/product surface and refreshed contributor-owned runtime proof, not a narrow mechanical repair.

Maintainer decision needed

• Question: Should OpenClaw core own this opt-in Tailscale Serve plus optional tailnet-identity authorization flow for generated WSL gateways after exact-head runtime proof is refreshed?
• Rationale: The patch adds new setup flags, UI, root-owned network provisioning, and an authorization mode; implementation correctness cannot decide whether that long-term core security/product surface is desired.
• Likely owner: shanselman — They integrated the current main conflict resolution and documented the security boundary retained by the final branch.
• Options:
  • Sponsor the opt-in core feature (recommended): Accept the bounded root-owned design after exact-head proof confirms the documented private Serve and authorization behavior.
  • Keep the gateway integration out of core: Decline the new setup and authentication surface and direct the capability toward an external integration if core ownership is not desired.

Security
Cleared: No concrete new security defect is evident in the final described patch: it removes gateway-user operator delegation, keeps Tailscale administration root-owned, makes transport and identity trust opt-in, rejects Funnel, and adds redaction coverage.

Review details

Best possible solution:

Ship only if a maintainer sponsors Tailscale Serve as an opt-in core setup capability and the contributor refreshes redacted live proof on b5d8acb showing private Serve, no Funnel route, WSS connection, and both identity-trust modes.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a defect reproduction: this is a new capability. The PR supplies a concrete Windows/WSL setup and WSS invocation scenario, but its live evidence should be repeated on the current merge head.

Is this the best way to solve the issue?

Unclear. The implementation is narrow and preserves a root-owned, disabled-by-default transport path, but whether Tailscale lifecycle and tailnet identity authorization belong in core remains a maintainer product/security decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6b9e814cdd18.

Label changes

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR contains valuable live Windows/WSL and WinUI evidence, but it identifies 4a70b196 rather than current head b5d8acb; refresh a redacted exact-head transcript before merge and update the PR body to trigger re-review.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
• remove status: 👀 ready for maintainer look: Current PR status label is status: 📣 needs proof.
• remove proof: sufficient: Current real behavior proof status is insufficient, not sufficient.

Label justifications:

• P2: This is a useful optional gateway feature with bounded scope, but it changes setup, connection, and authorization behavior rather than repairing an active broad outage.
• merge-risk: 🚨 security-boundary: The PR provisions a root-owned Tailscale daemon and Serve endpoint and introduces an opt-in tailnet identity authorization path.
• merge-risk: 🚨 auth-provider: Enabling identity trust changes which credentials and identity assertions can participate in gateway authorization.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR contains valuable live Windows/WSL and WinUI evidence, but it identifies 4a70b196 rather than current head b5d8acb; refresh a redacted exact-head transcript before merge and update the PR body to trigger re-review.

Evidence reviewed

What I checked:

• Opt-in and root-owned design: The final-head integration summary states that Tailscale is disabled by default, identity trust is separately opt-in, no --operator delegation remains, and tailscale up, Serve, Funnel reset, logout, and daemon administration stay root-owned. (src/OpenClaw.SetupEngine/TailscaleSetupSteps.cs:1, b5d8acb0291b)
• Authorization and transport boundaries are covered: The PR adds configuration validation and focused tests for root-owned Serve setup, explicit gateway.auth.allowTailscale, token/device credential preservation when identity trust is off, Funnel rejection, rollback, and log redaction. (tests/OpenClaw.SetupEngine.Tests/SetupStepsTests.cs:1003, b5d8acb0291b)
• Recovery is scoped to app-managed gateways: The connection plan only selects Tailscale-specific recovery for a network failure on a managed local gateway record with a setup-managed WSL distro marker; tests distinguish unmanaged .ts.net endpoints. (src/OpenClaw.Tray.WinUI/Pages/ConnectionPagePlan.cs:445, b5d8acb0291b)
• Current-main compatibility was deliberately integrated: The final merge commit incorporates current main and retains the strict option parser from merged PR 1005 plus cancellation semantics from merged PR 1011; the PR adds the four Tailscale options to the canonical parser tests. (tests/OpenClaw.SetupEngine.Tests/ProgramArgumentTests.cs:14, b5d8acb0291b)
• Live proof is one revision behind the current head: The PR body provides a substantive Windows/WSL/Tailscale run and managed-versus-unmanaged WinUI evidence, but both identify 4a70b196 as the tested commit. The later b5d8acb update reports validation and conflict resolution, not a repeated live setup/connection transcript. (4a70b1964e9a)
• Repository policy applied: The repository AGENTS.md requires architecture/proof review for setup, connection, WinUI, permissions, and diagnostics changes, as well as the build, shared-test, and tray-test closeout subset. The PR reports those automated validations and focused setup/tray coverage. (AGENTS.md:1, 6b9e814cdd18)

Likely related people:

• shanselman: Authored the current PR-head merge commit and documented preservation of the root-owned Tailscale boundary plus setup compatibility semantics. (role: recent integrator and security-review participant; confidence: high; commits: b5d8acb0291b; files: src/OpenClaw.SetupEngine/TailscaleSetupSteps.cs, src/OpenClaw.SetupEngine/SetupSteps.cs, src/OpenClaw.SetupEngine/Program.cs)
• calebeden: Merged PR 1005 owns the strict canonical setup argument parser that this PR extends with Tailscale options. (role: adjacent setup-parser contributor; confidence: medium; commits: a286e43d43ea; files: src/OpenClaw.SetupEngine/Program.cs, tests/OpenClaw.SetupEngine.Tests/ProgramArgumentTests.cs)
• anagnorisis2peripeteia: Merged PR 1011 changed the pairing cancellation semantics in SetupSteps.cs, a behavior explicitly preserved by this branch's current-head integration. (role: adjacent pairing-cancellation contributor; confidence: medium; commits: d57047e08783; files: src/OpenClaw.SetupEngine/SetupSteps.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (9 earlier review cycles; latest 8 shown)

• reviewed 2026-07-10T22:34:55.366Z sha ff211c2 :: found issues before merge. :: [P1] Keep Tailscale daemon control out of the gateway account
• reviewed 2026-07-17T15:44:24.920Z sha 9456cc6 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-17T16:07:52.131Z sha feb6a6f :: needs real behavior proof before merge. :: none
• reviewed 2026-07-17T16:40:14.175Z sha feb6a6f :: found issues before merge. :: [P2] Limit Tailscale recovery to setup-managed gateways
• reviewed 2026-07-17T17:09:12.899Z sha 4a70b19 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-17T17:30:13.199Z sha 4a70b19 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-17T17:51:31.272Z sha 4a70b19 :: needs maintainer review before merge. :: none
• reviewed 2026-07-17T21:46:43.125Z sha a8b7933 :: needs maintainer review before merge. :: none

[andyeskridge]

The tailscale daemon needs to be in the openclaw account to allow openclaw to run tailscale whois for the tailscale authentication. That's why I have it there. It is convienent for me to trust tailscale with the authentication instead of needing to share a token with my devices that are already on the tailscale network.

I've addressed the other finding for parsing the tailscale serve status --json and added some regression tests around it.

[arturict]

Great improvement. If WSL/Tailscale path now changes, please call out migration expectations for existing gateway installs.

[andyeskridge]

Right now this only supports newly created WSL gateways to keep the implementation simpler.

[shanselman]

GitHub Copilot maintainer-assistant review — this is automated feedback, not a comment written personally by Scott.

Reviewed head: 36187ba2d3445264f5ced3e1f33cc2be9721eb16

The opt-in layering is good and should be preserved: Tailscale provisioning defaults off, Tailscale identity trust is separately opt-in, the normal non-Tailscale setup steps skip cleanly, the auth key is not persisted and is redacted, Serve status now validates the exact proxy target, and the mutable installer was replaced with the signed Noble APT repository. The real Windows/Tailscale proof is also valuable.

The remaining security-boundary concern is tailscale up --operator=<gateway user>. The rationale that the gateway account needs to run tailscale whois is understood, but --operator grants substantially broader control than whois: the compromised gateway account can reconfigure/disable Serve, change Tailscale state, and potentially enable Funnel/public exposure. That expands an OpenClaw service-account compromise into the tailnet control plane.

Before merge, please make the privilege model explicit and choose one of these approaches:

1. Least privilege (preferred): keep tailscale up, Serve configuration, reset/logout, and persistent daemon administration root-owned. Provide only the narrow runtime capability needed for identity lookup (for example, a constrained helper/service boundary rather than general operator rights).
2. Explicit operator delegation: if Tailscale cannot support the required whois flow without operator rights, gate operator delegation behind its own explicit setting and disclose exactly what authority it grants. It should not be implied merely by enabling private transport, and it needs explicit maintainer security acceptance.
3. Transport-only mode: preserve private Serve connectivity while continuing to require OpenClaw token/device authentication, avoiding runtime whois delegation entirely.

Please also replace the fixed two-second authorization waits around tailscale serve --bg --yes with bounded polling. Human HTTPS/Serve authorization can take tens of seconds; one sleep and retry can false-fail a setup that succeeds moments later.

Automated coverage requested:

• FinalizeTailscaleServeStep happy path: Serve route, device-pair URL write, and ctx.GatewayUrl update;
• delayed authorization: poll until configured or an explicit timeout;
• health-check failure and rollback;
• Tailscale enabled with identity trust off still uses token/device auth;
• Tailscale disabled fresh setup and replacement path remain behavior-identical;
• fail mid-setup/uninstall and confirm Serve reset/logout/daemon cleanup;
• assert Funnel is not configured, and surface a clear warning if health/recovery detects public Funnel state.

The current “newly created WSL gateways only” migration boundary should be stated prominently in the PR and docs. Existing managed gateways should remain untouched rather than partially upgraded.

This is a promising feature, but the paired reviews both landed below the 90% merge bar because the operator delegation is a lasting security contract, not just implementation detail. A narrow privilege decision plus Finalize/polling coverage would materially improve confidence.

[shanselman]

GitHub Copilot maintainer-assistant note — automated, not written personally by Scott.

@andyeskridge, the hardened #967 head passed paired review at 91–93% and is approved from a code/security perspective. After #1011 merged, GitHub now reports a conflict in the overlapping setup surface.

Could you please rebase onto current main and resolve the conflict carefully? In particular, preserve the newly landed #1011 cancellation semantics in SetupSteps.cs: caller cancellation during node pairing must propagate immediately, while genuine internal timeout still maps to NodeConnectionOutcome.Timeout, with no spurious retry warning.

After resolving, please rerun the required build/shared/tray validation plus the focused Tailscale pipeline/rollback/non-Tailscale tests. Once the rebased head is green, this should be ready for a quick final diff check and merge.

[andyeskridge]

Rebased codex/tailscale onto current origin/main (4518dd8), retaining #1011’s cancellation/timeout semantics.
Preserved both the new cancellation regressions and all Tailscale pipeline tests.
Pushed rewritten head: a8b7933.
Validation passed:
.\build.ps1
Focused SetupEngine: 28 passed
Shared: 2,866 passed, 31 skipped
Tray: 1,748 passed

[shanselman]

Automated conflict-resolution update

• New head: b5d8acb0291bfcc3dac8dc11f6b637da7498612d
• Merged current origin/main (6b9e814cdd182cd8361cf0dfd479a389a1673e21) with a normal merge commit; no history rewrite or force-push.
• Preserved fix(setup): cancel node pairing cleanly instead of a spurious timeout warning + wasted retry #1011 caller-cancel vs internal-timeout semantics and focused TestSupport-backed coverage.
• Preserved fix: setup fails closed for invalid configuration arguments #1005 strict SetupArgumentParser / SetupWindow fail-closed behavior; registered the four Tailscale options in the canonical parser and retained duplicate-value rejection.
• Preserved Add Tailscale Serve support for WSL gateways #967 hardening: no --operator, root-owned Tailscale administration/Serve/Funnel reset, disabled-by-default Tailscale and identity trust, signed Noble APT installation, Funnel rejection/reset, bounded polling, transient/redacted auth key, rollback/uninstall, non-Tailscale behavior, and managed-only recovery/new-or-replacement scope.
• Final diff against current main is limited to the intended feature's 24 files plus ProgramArgumentTests.cs for strict-parser compatibility.

Validation:

• ./build.ps1 — passed; 5/5 projects.
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore — 2,901 passed, 31 skipped, 0 failed (2,932 total).
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore — 1,814 passed, 0 failed.
• dotnet test ./tests/OpenClaw.SetupEngine.Tests/OpenClaw.SetupEngine.Tests.csproj --no-restore — 645 passed, 0 failed.
• Focused Tailscale setup/pipeline/rollback — 24 passed, 0 failed.
• Focused managed recovery — 4 passed, 0 failed.
• Focused fix(setup): cancel node pairing cleanly instead of a spurious timeout warning + wasted retry #1011 pairing cancellation — 4 passed, 0 failed.
• Rubber-duck conflict review: SHIP, no blocking or non-blocking findings.

Blockers: none.