Co.PropertyTeam wikiCo.Property20 October 2026
Press slash to search. Arrow keys select a result.
Internal knowledge
Browse the wiki

Contribution

macOS, Windows & Linux

Checked

Most staff should use approved dashboard access. Technical operators use their own Tailscale identity and SSH key to reach the office mini only after owner approval.

Download page Markdown
Interactive mapSelect a node to read its explanation. Use Work on this beside the section to prepare a change.
Personal access: choose the least-privileged path diagramA contributor creates a personal key, joins Tailscale through an invitation, receives authorisation, verifies the host fingerprint, then uses the coproperty-office SSH alias. Staff dashboard access is a separate least-privileged path.Personal key — Personal access: choose the least-privileged pathPersonal keyTailscale invitation — Personal access: choose the least-privileged pathTailscale invitationOwner verification — Personal access: choose the least-privileged pathOwner verificationStandard SSH alias — Personal access: choose the least-privileged pathStandard SSH aliasStaff dashboard — Dashboard and passive TV: shared views, not source authorityStaff dashboardOffice mini — The Mac mini: authoritative writer and local operating coreOffice mini
Personal identity and approval precede a standard SSH connection to the office mini.Solid · information flowDashed rose · operator access
Read the diagram as text

A contributor creates a personal key, joins Tailscale through an invitation, receives authorisation, verifies the host fingerprint, then uses the coproperty-office SSH alias. Staff dashboard access is a separate least-privileged path.

  • Personal key → Personal access: choose the least-privileged path
  • Tailscale invitation → Personal access: choose the least-privileged path
  • Owner verification → Personal access: choose the least-privileged path
  • Standard SSH alias → Personal access: choose the least-privileged path
  • Staff dashboard → Dashboard and passive TV: shared views, not source authority
  • Office mini → The Mac mini: authoritative writer and local operating core
What it does

Give macOS, Windows, and Linux contributors a safe access checklist without distributing private keys, assuming Tailscale SSH, or treating installed tools as proof of identity.

Responsibility

Each contributor creates and protects their own SSH key pair.

Next step

Use personal SSH keys and personal/approved GitHub identity; never install a bundled private key.

Install on your computer

Download and extract the connection kit. It creates a personal key on your computer and adds the approved SSH alias. It includes no private key. Keep both the config and scripts folders together.

Download connection kit Illustrated setup PDF

macOS

Install Tailscale for Mac, sign in with your invited identity and open Terminal. In the extracted kit folder, run:

sh scripts/setup-macos-linux.sh

Use a passphrase. Send only the displayed public key to the owner. After approval, run ssh coproperty-office.

Windows

Install Tailscale for Windows. Follow Microsoft’s OpenSSH client setup if ssh is unavailable. Open PowerShell in the extracted kit folder and run:

powershell -ExecutionPolicy Bypass -File .\scripts\setup-windows.ps1

This applies the execution-policy override to this one reviewed script process. The script creates your key locally. Send only the public key for approval; then run ssh coproperty-office.

Linux

Install Tailscale for Linux and your distribution’s OpenSSH client. Join with your invited identity. Open a terminal in the extracted kit folder and run:

sh scripts/setup-macos-linux.sh

Send only the public key for approval. The expected result of ssh coproperty-office is the office mini shell. Confirm the host fingerprint with the owner before connecting.

If the helper detects an existing alias, it stops for manual review. Keep its backup files. For a fingerprint mismatch or rejected key, stop and contact the owner.

Ask for dashboard access before SSH when it is enough

Checked

The usual staff entry point is the approved dashboard.

Read the details

The usual staff entry point is the approved dashboard. It lets a teammate read company information and use role-enabled features without becoming an infrastructure operator. A technical operator path exists for people who need to work on the office computer itself, and it requires explicit owner approval.

This distinction is not a judgement about trust. It is a practical way to minimise access and keep operational and infrastructure responsibilities understandable.

Current
Checked — staff and technical access are documented as different paths.
Proposed next state
Start every access request by naming the task and the least-privileged surface that can perform it.
Expected outcome
People receive only the access needed for their work and have a clear reason for it.
Checks to include when changing this section
  • Check dashboard is presented before SSH in the page and Markdown export.
  • Check all external service links say existing authorised account required.

macOS, Windows, and Linux use your own key and approved network identity

Checked

macOS: install Tailscale from https://tailscale.com/download/mac, sign in with your invited company identity, and open Terminal.

Read the details

macOS: install Tailscale from https://tailscale.com/download/mac, sign in with your invited company identity, and open Terminal. Check `ssh -V`, then create a personal key with `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub to the access administrator. Keep the private file on your computer.

Windows: install Tailscale from https://tailscale.com/download/windows and join the invited company network. In PowerShell, check `ssh -V`. If it is missing, use Microsoft’s OpenSSH Client instructions at https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse. Run `ssh-keygen -t ed25519 -f "$HOME/.ssh/coproperty_office"` and send only the resulting .pub file. Arrange an observed first connection; installing the client does not grant access.

Linux: follow https://tailscale.com/download/linux for your distribution and install its OpenSSH client. In a terminal, check `ssh -V`, then run `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub. Join the invited Tailscale identity before connecting.

After approval, ask the administrator to confirm your SSH alias configuration and the host fingerprint below. Run `ssh coproperty-office`. Success is a shell on the expected company mini; verify `hostname`, `whoami`, and the project path before any change. If access is denied or the host key changes, stop and contact the administrator. Do not install a private-key bundle. A shared Unix account does not isolate permissions. Setup prepares your device but does not grant access on the mini.

Current
Checked — platform preparation is documented; each person’s actual access remains subject to invitation and approval.
Proposed next state
Use a supported, observed first connection for Windows and any unfamiliar device configuration.
Expected outcome
Each operating system follows the same identity and approval model without sharing credentials.
Checks to include when changing this section
  • Check macOS, Windows, and Linux are each mentioned with personal-key guidance.
  • Check no command in generated output creates, imports, or distributes someone else’s private key.

Verify the host before you trust the alias

Checked

Use the standard SSH alias `coproperty-office` only after verifying with the owner that it resolves to `copropertys-mac-mini.tail3ab9e5.ts.net`, user `coproperty`, and the pinned host fingerprint `SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg`.

Read the details

Use the standard SSH alias `coproperty-office` only after verifying with the owner that it resolves to `copropertys-mac-mini.tail3ab9e5.ts.net`, user `coproperty`, and the pinned host fingerprint `SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg`. Do not assume Tailscale SSH; this contract uses standard SSH over the approved private route.

Once connected, first verify hostname, project path `/Users/coproperty/Projects/coproperty-office-os`, and repository status. Installed Codex at `/Users/coproperty/.local/bin/codex` is a local tool path, not evidence that a teammate is authenticated; use a personal or approved identity.

Current
Checked — the target contract is documented; first use still requires owner verification and personal approved authentication.
Proposed next state
Record any changed host fingerprint or target contract through an owner-approved documentation update, not a guess.
Expected outcome
A contributor connects to the intended machine and validates the actual work surface before taking any action.
Checks to include when changing this section
  • Check the exact target contract is available in every contextual work draft.
  • Check no Codex URL includes a remote path parameter or tries to open a remote shell.

Apply with care

A concrete safe example

Example, responsibilities & checklist

A safe first-access request

Ask for an invitation to the company Tailscale network and approval of your public SSH key. Verify the owner-approved fingerprint before trusting the alias. If you only need the staff dashboard, request that instead of SSH.

Responsibilities

  • Each contributor creates and protects their own SSH key pair.
  • The owner or admin approves the public key, Tailscale identity, and first access.
  • The contributor verifies alias, hostname, fingerprint, project path, and status before work.
  • The shared Unix account does not replace individual identity or permission controls.

Checklist

  1. Use personal SSH keys and personal/approved GitHub identity; never install a bundled private key.
  2. Join Tailscale with an invited identity and obtain admin authorisation.
  3. Use standard SSH through alias coproperty-office; do not assume Tailscale SSH.
  4. Verify the owner-confirmed fingerprint before trusting the first connection.
Expected outcome

A contributor can request the right access level and prepare their device without changing the mini or using someone else’s credentials.

Traceability without sensitive material

Source pointers and exports

This page expands the approved handoff into plain-language guidance. It does not include runtime logs, credentials, databases, private evidence, internal QA artifacts, or developer planning history.

Documentation references
  • Handoff / pages/access.html
  • Handoff / pages/infrastructure.html
  • Handoff / START-HERE.html
Page MarkdownPage context JSON