---
name: cross-machine-test-rig
description: Second machine + access for spt-core cross-machine/network spikes (iroh NAT tests)
metadata: 
  node_type: memory
  type: reference
  originSessionId: 2c168d6d-6896-403a-bb2e-44bdc5b44daf
  modified: 2026-08-01T02:55:40.711Z
---

For two-host network tests (iroh NAT traversal, cross-node messaging), there's a second machine **enlyzeam** on the same Tailscale tailnet as the dev box **hfenduleam**. Both Windows.

**Single-node agent locality (perri-corrected 2026-08-01):** ALL core live agents — doyle, perri, flynn, lia, deployah, hertz, todlando — are LOCAL endpoints of hfenduleam's one daemon (`spt endpoint list`: one node, 14efb80c…). A "measurement on perri's node" IS a measurement on hfenduleam; never treat two resident agents as two instruments/boxes. Corollary from the #63 field arms: hfenduleam holds ZERO access rules at both tiers, so NO sender is trust-warning-eligible anywhere in the fleet as established — a warning-delivery observation needs an operator-minted access rule (engine-room ceremony, CLI refuses agents by design).

**hfenduleam triple-duty (doyle-confirmed 2026-07-10):** the dev box is ALSO the Windows CI runner AND the gate box, and it hosts a live resident spt daemon at all times. Consequences for test triage: (1) Windows CI timing bounds run on a box carrying dev + agent + CI load simultaneously — marginal wall-clock overruns (e.g. shellhost close-promptness 10.9s vs 10s bound) are the load class, not regressions; (2) any test resolving sockets via `home_tag()` over the DEFAULT spt home (ci.yml sets no SPT_HOME) can CROSS-TALK with the live daemon's real hubs (drivehub/tunnelhub/seed) — the live-host cross-talk class, kin [[daemon-lib-tests-deadlock-on-live-host]]; doyle's standing lean if such a test re-reds: isolate SPT_HOME for the unit + bound the best-effort hub clears (drive_clear/write_frame are currently unbounded — same unbounded-write family the W6/r4 saga killed in the broker).

- SSH access from hfenduleam: `ssh decid@enlyzeam` — key-based (my ed25519 key is in enlyzeam's `administrators_authorized_keys`), no password. SSH/MagicDNS routes over Tailscale, so it needs Tailscale **up** on both.
- Transfer: `scp <file> decid@enlyzeam:` lands in `C:\Users\decid\`.
- The Spike #2 binary `iroh-smoke.exe` is left at `C:\Users\decid\iroh-smoke.exe` on enlyzeam.

**Key gotcha for NAT-traversal tests:** the two boxes are on different home networks, but with Tailscale up iroh picks the `100.x` overlay addr as a "direct" path (Tailscale does the traversal, not iroh). To test iroh's OWN hole-punch, take Tailscale **down on the client (hfenduleam)** — then iroh hole-punches to the peer's public IP. Confirmed working (relay→direct upgrade, ~13ms direct). See [[spike-02-iroh-result]] in docs/spikes/SPIKE-02-iroh-smoke.md. Taking Tailscale down also kills ssh, so have the other side run the server + paste the ticket.

**Linux host (for `forkpty` / any Linux build or test):** **gravity-linux** on the same tailnet (Ubuntu 22.04, x86_64, 4 cores). enlyzeam is Windows — NOT a Linux option. Access is **password** auth: `ssh david@gravity-linux`, user `david` / pw `bigscreen` (NOT key, NOT my `decid` user; the tailnet is `brandon@`-owned). Windows OpenSSH has no `-pw` flag — feed the password non-interactively with an askpass shim: write a `.cmd` containing `@echo bigscreen`, then set `$env:SSH_ASKPASS=<that.cmd>`, `$env:SSH_ASKPASS_REQUIRE='force'`, `$env:DISPLAY='localhost:0'` before `ssh`/`scp`. rustup (cargo 1.96.0, minimal profile) was installed under `~/.cargo` on 2026-06-01 — `source ~/.cargo/env` first. Spike #4 (Linux forkpty parity) was run here: scp the spike crate to `~/spt-spike4/`, `cargo build && ./target/debug/spike run`. See docs/spikes/SPIKE-04-forkpty-parity.md.

**Working recipe from the Claude Bash tool (git-bash on Windows, used for M3a cross-OS validation 2026-06-02):** the askpass shim works as a plain `/tmp/askpass.sh` containing `echo bigscreen` (chmod +x) with `SSH_ASKPASS=/tmp/askpass.sh SSH_ASKPASS_REQUIRE=force ssh -o StrictHostKeyChecking=no david@gravity-linux '<cmd>' < /dev/null`. **No `rsync` on either side** — sync the workspace by piping a tarball: `tar czf /tmp/x.tgz --exclude=target --exclude=.git . ; ssh … 'cat > /tmp/x.tgz' < /tmp/x.tgz` then `ssh … 'rm -rf ~/spt-core-sync && mkdir ~/spt-core-sync && tar xzf /tmp/x.tgz -C ~/spt-core-sync'`. cargo/rustc are NOT on the default non-interactive PATH — prefix every remote cargo cmd with `export PATH=$HOME/.cargo/bin:$PATH`. clippy IS installed on gravity-linux (verified 2026-07-10, `rustup component add clippy` reports up-to-date) — useful for real cfg(unix) lint verification of Linux-only clippy reds (e.g. the v0.30.6 needless_return blocker); CI clippy can lie via incremental-cache lint suppression, gravity fresh-lint doesn't. Gotcha: `cargo test --workspace` (parallel) flakes `spt-msg::two_agents_exchange_message_tcp_and_spool` on a fixed-port/resource race — passes in isolation and under `--test-threads=1`; a pre-existing M1 test-isolation issue, not a real bug.