Infrastructure & Deployment
Start with the Scout-hosted URLs, the host-support service split, or the per-agent gateway map before you open the deeper platform guide.
Pick the lane, then the page
Atlas stays easier to scan when the route map reads like navigation first. Start with the lane that matches your question, then expand the full page-job model only when you need the deeper contract details.
Platform-surface page for where the network runs and which services or access layers support it.
Change pace: Check recent updates first. These pages move when the network or live support surfaces change.
If the system question turns operational, switch from platform shape to the live-status companion.
Open Watchtower GuideEntry
Use these pages when you are still orienting and need the safest first click before you pick an owner or system.
Ownership
Use these pages when your real question is who should handle the work, how it moves, or which charter owns the surface.
Systems
Use these pages when you need the map, structure, services, and interfaces behind the network instead of the people or routing rules.
Operations
Use these pages when something feels broken, you need a concrete next check, or you need the live-status companion surface.
What brought you to this page?
This page is dense because it spans access paths, runtime placement, service boundaries, and deployment mechanics. Pick the question closest to yours. The summary will show you where to start and where you can stop reading without missing what you need.
The summary will update with a reading plan and a direct jump link.
Validated on October 6: the gateway map teaches the shared-instance topology
Revalidated on October 6: the agent roster's Clawdy row now teaches the verified GPT-6 model — self-reported from Clawdy's own gateway config over Bridge. The 2026-09-30 pass re-probed every agent gateway as part of the September 30 gateway topology convergence and converged the port map onto the live shared-instance split (lc-builders 18811: Samwise + Scout; lc-makers 18814: Dexter, Buzz, and Meg; lc-stewards 18805: Atticus + Grafton; Clawdy via the 18789 ssh forward, its gateway riding minip3), retiring the container-era 18796/18802/18809 spellings and Meg's preview mirrors. The current service inventory and Bridge v1 command surface hold — the Saffron Orchestrator work queue (18830, live since 2026-08) remains in the host-support layer, and the Tailscale Funnel entry reflects the current five-route public ingress shape. The agent roster and runtime split are unchanged: Dexter operates via direct surfaces (Slack, Notion, CurryChat), and Buzz via Bridge and CurryChat — the pair's shared direct surface — rather than dedicated gateway ports; this pass converged their surface teaching onto the registry. The compose edit-point story still teaches: live compose edits run through saffron-root services/docker/ (live-verified 2026-07-10), with the older Atticus-clone lane retired. The October 2 Drop Port Convergence pass retired the package-default 18821 teaching: main-mini's Drop file-pass service runs on 18930 (18821 is Hank's derived Chrome CDP port, 18810 + 11), while minip3 keeps the 18821 default. Samwise's gateway-delivery capture predates the July 24 registry retirement — this capture taught the then-current Lantern-first intake contract, which the July 24 registry retirement has since superseded with parent-identity skills.
- • Tailscale Funnel: / → ClawConnect, /linear-agent, /qmd, /orchestrator, /samwise-hooks
- • Runtime split: native shared OpenClaw instances — Clawdy forwarded on 18789 (its gateway runs on minip3), lc-builders 18811 (Samwise, Scout), lc-makers 18814 (Dexter, Buzz, Meg), lc-stewards 18805 (Atticus, Grafton), Hank 18810; Dexter and Buzz keep their direct charter surfaces
- • Scout: 18811 (lc-builders), shared with Samwise — 18796 retired
- • Meg: 18814 (lc-makers), shared with Dexter and Buzz — 18802 and the preview mirrors retired
- • Atticus: 18805 (lc-stewards), shared with Grafton — 18806–18807 retired
- • Grafton: 18805 (lc-stewards), shared with Atticus — 18809 archived 2026-09-29
- • Samwise: 18811 (lc-builders), shared with Scout
- • Linear Agent Gateway: 18820
- • Drop file pass service: 18930 (main-mini; minip3 keeps the 18821 default)
- • Saffron Orchestrator work queue: 18830
- • Observability Collector: 18801
- • Vision stack: 9200–9202, Kokoro on 8787
- • Saffron Notify / Deploy Hook: 18892–18893
- • QMD / vision / oracle / edge helpers: 18790, 18792, 18793, 18795, 18799
- • Live compose edits: saffron-root
services/docker/— edit and recreate there (live-verified 2026-07-10; the retired Atticus-clone lane is history)
- • Scout still fronts the canonical Atlas and Watchtower app URLs for readers
- • Clawdy still matters as a front-door role — its gateway runs on minip3 and answers on 18789 through the ssh forward
- • Currybot is documented as part of the host-level OpenClaw assistant stack, not as a dedicated local Docker container
- • Meg's preview mirrors (18803, 5181) retired with her container stack — the Scout URLs are the surfaces
- • Samwise's delivery surface read as Lantern-first on Linear at this July 10 capture; the registry's July 24 single-owner refactor retired the Lantern and Spade charters, so intake and execution now run as parent skills
- • When infra docs mention compose edits, start from saffron-root services/docker/ — an old compose copy in an agent clone is historical drift, not a second source of truth
- • Dexter and Buzz are Labs agents on registry-direct surfaces — Dexter: Slack, Notion, CurryChat; Buzz: Bridge, CurryChat — with no dedicated gateway ports
- • Readers should still start with Scout's Atlas and Watchtower URLs Funnel, Notify, Drop, and the Linear Agent Gateway as the host-support layer
- • lc-makers (18814) carries Dexter, Buzz, and Meg; Samwise's intake and execution run as parent-identity skills on Linear after the July 24 retirement of the Lantern and Spade charters
- • Use Atlas for explanation, Watchtower for live state
Start with the platform view, then zoom in
- • you need the deployment shape, not the design philosophy
- • you want to know which systems live together and how they connect
- • you are tracing access boundaries, hosting, or service placement
- • you need the high-level why behind the network’s design
- • you care about one workflow, one agent, or one protocol in detail
- • you are answering “what does this enable?” rather than “where does it run?”
- • hosting + network boundaries first
- • then shared services + agent gateways
- • then leave for the route that answers your next question
Use Scout's canonical URLs by default
Primary Scout-hosted docs surface. Use this when you want the canonical Atlas experience.
http://main-mini:18797/Primary Scout-hosted observability surface. Use this for live state, not Atlas.
http://main-mini:5175/Meg's container-era preview range (Atlas on 18803, Watchtower on 5181) retired with that stack on the 2026-09-30 revalidation. Neither port answers anymore — use the Scout canonical URLs above.
use the canonical Atlas and Watchtower rows aboveUse only when you want the QMD helper surface itself, not Atlas or Watchtower.
http://main-mini:18790/Dedicated machine-facing connection point instead of a reader-start URL.
http://main-mini:7331/Separate team chat surfaces, not alternate names for Atlas or Watchtower.
http://main-mini:5177/orhttp://main-mini:5178/Physical host, Docker split, and tailnet access
Primary Tailnet Host
- •Runs the native OpenClaw gateway instances (lc-builders, lc-makers, lc-stewards) and the 18789 ssh forward to Clawdy’s gateway on minip3
- •Agents run as host processes under per-instance homes rather than per-agent containers
- •Hosts both the working environment and the team-facing deployments
- •Connected to the Tailscale network for secure access
Gateway runtime split (2026-09-30 revalidation)
- •Agents ride native shared OpenClaw instances: lc-builders 18811 (Samwise, Scout), lc-makers 18814 (Dexter, Buzz, Meg), lc-stewards 18805 (Atticus, Grafton)
- •Clawdy’s gateway runs on minip3 and answers on 18789 through a launchd-managed ssh forward; Hank rides 18810
- •The container-era per-agent gateways (18796, 18802, 18809) are retired — the standalone Grafton config was archived 2026-09-29
- •Shared Currykit services answer on their host ports (Currybox 18800, QMD 8790, QMD Public Proxy 18790)
Tailscale Mesh
- •Secure team access still defaults to the LC tailnet
- •Tailscale Funnel now adds a narrow public ingress layer for selected routes
- •HTTPS termination and certificate management still ride through Tailscale
- •Web apps (Atlas, Watchtower) are usually accessed via machine hostname on the tailnet
Tailnet-accessible apps
Both apps are still taught as tailnet-first surfaces. Funnel exists for selected public routes, but Atlas and Watchtower remain the canonical internal URLs readers should memorize.
Not every important surface is an agent port
A public routing layer created on Apr 18, reshaped to its current five-route shape at the Aug 7 main-mini upgrade: the root points at ClawConnect, with named paths for the Linear Agent Gateway, QMD remote memory, the Saffron Orchestrator work queue, and Samwise’s token-injecting GitHub hook proxy. Post-restart checks verify all five routes from off-host.
Bridges Linear agent protocol traffic into Saffron OpenClaw agents for @mentions, assignment-driven handoffs, tool-driven activity loops, live Codex item streams, button-choice flows, and open-ended elicitation prompts. OAuth auto-refresh keeps longer-running sessions alive, and the newer complete/error session states make the activity panel read more like a real live handoff surface than a one-shot relay. For delivery work, Samwise is the single owner: the gateway surfaces assignment-driven handoffs and intake directly to Samwise, whose parent-identity skills carry planning through verified closeout (the retired Lantern and Spade charters no longer run — the Lantern Cycle cron is disabled).
Content-addressed file-pass service for agent-to-agent handoffs, live-verified on 18930. Main-mini moved Drop off the package-default 18821 on 2026-09-30 via its launchd plist — 18821 is Hank’s derived Chrome CDP port (18810 + 11), which his managed Chrome can take on loopback whenever it runs — so 18930 sits outside every gateway’s CDP range, while minip3’s Drop keeps the 18821 default. The service still gives the host support layer a dedicated place for moving artifacts between sessions cleanly instead of overloading chat or pretending every transfer is just another document URL.
The work queue behind the network’s queue lanes (live since 2026-08, exposed publicly at /orchestrator). Charter cycles pull their lane for deliberately routed work — Arbor requests can land here as items — but scheduled crons stay the floor: pulls are fail-soft, an unreachable queue reads as an empty lane, and a cycle caps lane work at two or three items before returning to its charter work.
Own notification delivery and deploy-trigger plumbing outside the app surfaces, so status loops and publish signals do not rely on a browser-facing route.
Deprecated host-level event API on port 18801. Atlas keeps it only for legacy collector-shaped request context; current telemetry lands in OpenObserve, and Watchtower adds expected-state interpretation on top.
The local vision sidecar, proxy, and Whisper server now form a small support cluster for image and video analysis instead of a single sidecar port.
Scoped helper surfaces now include the QMD Public Proxy, Vision Proxy, Currybot Oracle Proxy, RAG Images Server, and Public Web Edge Proxy. Name them when the port map matters, but do not treat them as reader-start URLs.
Shared infrastructure powering the agent network
@lambda-curry/currykit-recall
Semantic search and knowledge retrieval service. Indexes LC team notes, docs, and knowledge so agents can search by meaning, not just keywords.
@lambda-curry/currykit-observability
Legacy collector compatibility surface plus supporting telemetry jobs. Atlas still documents the historical request shape here, but current live evidence now flows through OpenObserve and Watchtower's expected-state model.
@lambda-curry/currykit-bridge
Agent-to-agent messaging tool. Lets agents send questions and tasks to each other across different OpenClaw instances.
ClawConnect MCP
:7331A dedicated MCP surface now documented in the network. It gives Clawdy a separate machine-facing connection point instead of overloading the main gateway list.
CurryChat app
:5177–5178Team chat application surface associated with Currybot. Atlas documents it as a separately exposed app layer, without treating Currybot itself as a guaranteed local dependency on every host.
@lambda-curry/currykit-currybox
Cloud sandbox proxy. Routes commands to isolated cloud VMs when agents need a clean, ephemeral execution environment.
@lambda-curry/currykit-kokoro-proxy
Local TTS service. High-quality speech synthesis for agent responses.
@lambda-curry/currykit-rag-sync
Knowledge sync pipelines. Pulls content from Notion, Jira, and Linear and feeds it into the Recall search service so agents always have current context.
@lambda-curry/currykit-delegate
Delegation tracker. Records when and how coding tasks are handed off to agents like Codex — start, completion, failures, and task details.
Cost Tracker (currykit-observability)
Monitors API usage costs for agents. Tracks daily and monthly spend, generates alerts on budget thresholds.
Monitor Service (currykit-observability)
Scheduled health check and monitoring service. Verifies system status and agent availability.
Codex Telemetry (currykit-observability)
Tracks Codex CLI usage and telemetry. Emits structured events so current observability signals land in OpenObserve and surface through Watchtower.
Per-agent port ownership without another card wall
Jake's primary assistant
Gateway runs on minip3; main-mini reaches it through the launchd ssh forward on 18789 — no Clawdy process on this host.
LC team assistant in the OpenClaw-era assistant stack
Documented as part of the broader host assistant stack rather than a dedicated local Docker container.
Autonomous explorer
Rides the lc-builders instance with Samwise (the container-era 18796 gateway is retired). Owns the canonical Atlas and Watchtower reader surfaces that most people should memorize first.
Decision-making & governance
Rides the lc-stewards instance with Grafton (18806–18807 are retired with the container-era split). Operationally historical: Atticus's clone hosted the fleet's live compose edit point until the 2026-06-28 launch-dir migration (live-verified 2026-07-10).
Design engineer & visual authority
Rides the lc-makers instance with Dexter and Buzz. Her container-era gateway (18802) and preview mirrors (18803 → Atlas, 5181 → Watchtower) retired with that stack (2026-09-30 revalidation).
Lifecycle steward & initiative gardener
Rides the lc-stewards instance with Atticus since the standalone 18809 gateway was archived (2026-09-29). Useful when tracing stewardship loops rather than app routing.
Delivery-loop operator
The current live delivery lane behind the Linear Agent Gateway: intake, threading, and execution run as Samwise parent-identity skills since the July 24 charter retirement, with the gateway fronting button-choice, elicitation, and scoped delivery flows.
Labs leader
Labs experiment design and honest assessment for the founding team. Reaches via Slack, Notion, and CurryChat rather than a dedicated gateway port — triggered manually or by cron.
Distribution & market-signal agent
Dexter's distribution counterpart. Finds audiences, designs approved distribution experiments, and manages Reddit Ads with trusted read/write. Reaches via Bridge and CurryChat rather than a dedicated gateway port.
Inter-agent communication
Agents communicate via:
- Bridge CLI: direct queries and responses between agents
- Gateway HTTP APIs: programmatic access via the Docker bridge network (internal only)
- Sessions: isolated or shared conversation context
- Observability Events: async telemetry and logging
Container architecture and network topology
Network topology
- Agent instances and shared services run as host processes; the container-era bridge-network split is retired (2026-09-30 revalidation)
- Surfaces reach host-level helper services through the internal host alias
- Public ingress is selective through Tailscale Funnel, not blanket port exposure
- Agent gateways — reachable via the internal host alias
- Currykit services — internal-only; agents call them through the host's internal service alias
- Scout still serves Atlas on 18797 and Watchtower on 5175 for tailnet access
- Meg's container-era preview mirrors (18803 Atlas, 5181 Watchtower) retired with that stack
/home/node/.openclaw/workspace— Agent workspace (projects, data, logs)/home/node/.openclaw/config— Gateway configuration/app/skills— Shared skills library (read-only)
All agent Dockerfiles and compose files are centralized in saffron/services/docker/<agent>/ — a single place to manage build definitions rather than scattering them across agent workspaces (decided Mar 2026). Since the 2026-06-28 launch-dir migration, the live edit point is the saffron root itself: edit and recreate from services/docker/ (live-verified 2026-06-28, re-verified 2026-07-10). Earlier in 2026 the live edit point routed through Atticus's Saffron clone; that lane is retired.
All images build FROM openclaw:local. As of Mar 2026, the full tool suite (bun, Codex, Playwright, gh CLI, etc.) is baked into the base image — agent Dockerfiles stay thin and add only agent-specific identity or config. When tracing where an operator changes container wiring, start from the saffron root's services/docker/ tree — a compose copy inside an agent clone is historical drift, not the live edit point.
Authentication, authorization, and trust boundaries
Authentication
- •Tailscale mesh access: devices on the LC tailnet can reach the canonical internal surfaces
- •Currykit services: bearer-token auth with secrets injected at startup
- •Inter-agent: no extra auth inside the trusted Docker bridge network
- •External APIs: service-specific credentials (GitHub, OpenAI, etc.)
Secret Management
- •Docker env files (.env.local, never committed)
- •OpenClaw gateway config (gateway.toml)
- •No secrets in code or version control
- •Secrets injected at container startup
Network Isolation
- •Most host surfaces stay on the private tailnet
- •Public ingress is limited to the Funnel-routed paths and helpers Atlas documents explicitly
- •Docker containers can't see host filesystem (except mounts)
- •Agents sandboxed by OpenClaw exec policies
Agent Boundaries
- •Compute: Limited to Docker container resources
- •Network: Docker bridge, host helper surfaces, and selective Tailscale/Funnel ingress
- •Storage: Workspace volume + tmp
- •Secrets: Read-only access to assigned env vars
How changes move into running surfaces
Deployment process
- Project context (SOUL.md, AGENTS.md, etc.) updated via git
- OpenClaw automatically picks up changes on restart
- Use
gateway restarttool to apply
- Code changes in
lambda-curry/currykitmonorepo - Build and restart affected services
- No agent downtime required (services are independent)
- Atlas: React Router 7, built and served via Bun
- Watchtower: React Router 7, built and served via Bun
- Both are taught as tailnet-first app surfaces, with Meg preview mirrors available when needed
- Zero-downtime updates (build, then restart server)