deploy-rwlisted

# Deploy remote-workstreams You are deploying remote-workstreams: a persistent launchd service on this Mac, reached from the user's iPhone over their tailnet. The end state is a running service, secrets in the Keychain, HTTPS on the Mac's MagicDNS name, and a phone paired via QR code. This skill runs the same from Claude Code or Codex — one deploy serves both engines. Three helper scripts live in `scripts/` next to this file. They print `key=value` lines and are all idempotent — re-running any of them is safe. ## Rules - **Confirm before changing the system.** Before every command that touches system state — `git clone`, Keychain writes, `launchctl`, `tailscale serve`, installing Tailscale — tell the user exactly what you will run and why, and get a yes. Read-only commands (`check.sh`, `tailscale status`, `--help`, `curl` of healthz) need no confirmation. - **Secrets:** never echo stored secrets back, never write the plaintext PIN anywhere. - **Re-runs are normal.** This flow doubles as repair: `check.sh` shows what is already done; skip completed steps unless the user wants to redo one (e.g. rotate a key). ## Step 0 — Assess Run `scripts/check.sh [REPO_DIR]` (default checks `~/remote-workstreams`). Read the output and tell the user what is already in place and which steps remain. On a healthy install (everything `ok`/`present`/`configured`), say so and ask what they want to change. ## Step 1 — Preflight: macOS, uv, tmux, service repo - `os=unsupported` → stop