{
  "type": "excalidraw",
  "version": 2,
  "source": "infra-field-guide local editable architecture",
  "elements": [
    {
      "id": "worker-zone",
      "type": "rectangle",
      "x": 40,
      "y": 220,
      "width": 285,
      "height": 365,
      "angle": 0,
      "strokeColor": "#a9d4e6",
      "backgroundColor": "#ffffff",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 3,
      "version": 1,
      "versionNonce": 3,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "region",
        "name": "VPS",
        "responsibility": "命令实际由谁执行",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "overlay-zone",
      "type": "rectangle",
      "x": 345,
      "y": 220,
      "width": 285,
      "height": 365,
      "angle": 0,
      "strokeColor": "#a9d4e6",
      "backgroundColor": "#ffffff",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 6,
      "version": 1,
      "versionNonce": 6,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "region",
        "name": "Tailnet",
        "responsibility": "只处理网络访问许可",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "mac-zone",
      "type": "rectangle",
      "x": 650,
      "y": 220,
      "width": 910,
      "height": 365,
      "angle": 0,
      "strokeColor": "#a9d4e6",
      "backgroundColor": "#ffffff",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 9,
      "version": 1,
      "versionNonce": 9,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "region",
        "name": "Mac · Remote Login / OpenSSH",
        "responsibility": "登录身份、文件权限与项目能力继续分别判断",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "identity",
      "type": "rectangle",
      "x": 40,
      "y": 815,
      "width": 1520,
      "height": 155,
      "angle": 0,
      "strokeColor": "#a9d4e6",
      "backgroundColor": "#ffffff",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 32,
      "version": 1,
      "versionNonce": 32,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "region",
        "name": "最小访问示例的边界",
        "responsibility": "100.64.0.10 / .20 是合成 shared-address 示例，不是真实节点；不要原样应用到账号。",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "enter-overlay",
      "type": "arrow",
      "x": 305,
      "y": 415,
      "width": 60,
      "height": 0,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 2.5,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 22,
      "version": 1,
      "versionNonce": 22,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "points": [
        [
          0,
          0
        ],
        [
          60,
          0
        ]
      ],
      "startBinding": {
        "elementId": "worker-user",
        "focus": 0,
        "gap": 1
      },
      "endBinding": {
        "elementId": "grant",
        "focus": 0,
        "gap": 1
      },
      "startArrowhead": null,
      "endArrowhead": "arrow",
      "elbowed": false,
      "customData": {
        "kind": "edge",
        "source": "worker-user",
        "destination": "grant",
        "payload": "经 tailnet 加密链路访问 TCP22",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "tcp22",
      "type": "arrow",
      "x": 610,
      "y": 415,
      "width": 60,
      "height": 0,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 2.5,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 23,
      "version": 1,
      "versionNonce": 23,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "points": [
        [
          0,
          0
        ],
        [
          60,
          0
        ]
      ],
      "startBinding": {
        "elementId": "grant",
        "focus": 0,
        "gap": 1
      },
      "endBinding": {
        "elementId": "openssh",
        "focus": 0,
        "gap": 1
      },
      "startArrowhead": null,
      "endArrowhead": "arrow",
      "elbowed": false,
      "customData": {
        "kind": "edge",
        "source": "grant",
        "destination": "openssh",
        "payload": "网络 grant 允许指定源目的端口 TCP22",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "ssh-login",
      "type": "arrow",
      "x": 925,
      "y": 415,
      "width": 40,
      "height": 0,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 2.5,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 24,
      "version": 1,
      "versionNonce": 24,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "points": [
        [
          0,
          0
        ],
        [
          40,
          0
        ]
      ],
      "startBinding": {
        "elementId": "openssh",
        "focus": 0,
        "gap": 1
      },
      "endBinding": {
        "elementId": "mac-user",
        "focus": 0,
        "gap": 1
      },
      "startArrowhead": null,
      "endArrowhead": "arrow",
      "elbowed": false,
      "customData": {
        "kind": "edge",
        "source": "openssh",
        "destination": "mac-user",
        "payload": "SSH key 对应本机用户",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "file-access",
      "type": "arrow",
      "x": 1220,
      "y": 415,
      "width": 40,
      "height": 0,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 2.5,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 25,
      "version": 1,
      "versionNonce": 25,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "points": [
        [
          0,
          0
        ],
        [
          40,
          0
        ]
      ],
      "startBinding": {
        "elementId": "mac-user",
        "focus": 0,
        "gap": 1
      },
      "endBinding": {
        "elementId": "project",
        "focus": 0,
        "gap": 1
      },
      "startArrowhead": null,
      "endArrowhead": "arrow",
      "elbowed": false,
      "customData": {
        "kind": "edge",
        "source": "mac-user",
        "destination": "project",
        "payload": "受 OS 权限、TCC 与目录状态约束",
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "title",
      "type": "text",
      "x": 40,
      "y": 28,
      "width": 1520,
      "height": 45.900000000000006,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 1,
      "version": 1,
      "versionNonce": 1,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 34,
      "fontFamily": 2,
      "text": "私有控制 · 能到达网络，还要能以正确身份工作",
      "originalText": "私有控制 · 能到达网络，还要能以正确身份工作",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 700,
        "boldFirstLine": false,
        "guide": {
          "title": "私有控制 · 能到达网络，还要能以正确身份工作",
          "description": "参考：VPS worker 经 Tailscale 访问自己的 Mac 普通 OpenSSH；不是 macOS GUI 客户端的 Tailscale SSH server。",
          "width": 1600,
          "height": 1060,
          "evidence": [
            "../09-private-access.md",
            "../02-first-server.md",
            "../../examples/tailnet-ssh-grant.example.json",
            "../../examples/ssh-config.example"
          ],
          "state": {
            "canonical": "Mac 用户与文件权限",
            "writers": "已获准且以指定 Mac 用户登录的 SSH 会话",
            "receipts": "真实 worker 的项目命令；未授权 peer 拒绝；既有 HTTPS 仍通"
          },
          "question": "一次远程执行需要经过哪些独立边界？",
          "status": "reference-model"
        }
      }
    },
    {
      "id": "subtitle",
      "type": "text",
      "x": 40,
      "y": 82,
      "width": 1520,
      "height": 25.650000000000002,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 2,
      "version": 1,
      "versionNonce": 2,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 19,
      "fontFamily": 2,
      "text": "参考：VPS worker 经 Tailscale 访问自己的 Mac 普通 OpenSSH；不是 macOS GUI 客户端的 Tailscale SSH server。",
      "originalText": "参考：VPS worker 经 Tailscale 访问自己的 Mac 普通 OpenSSH；不是 macOS GUI 客户端的 Tailscale SSH server。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    },
    {
      "id": "worker-zone-heading",
      "type": "text",
      "x": 60,
      "y": 235,
      "width": 245,
      "height": 29.700000000000003,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 4,
      "version": 1,
      "versionNonce": 4,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 22,
      "fontFamily": 2,
      "text": "VPS",
      "originalText": "VPS",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 700,
        "boldFirstLine": false
      }
    },
    {
      "id": "worker-zone-sub",
      "type": "text",
      "x": 60,
      "y": 269,
      "width": 245,
      "height": 21.6,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 5,
      "version": 1,
      "versionNonce": 5,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 16,
      "fontFamily": 2,
      "text": "命令实际由谁执行",
      "originalText": "命令实际由谁执行",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    },
    {
      "id": "overlay-zone-heading",
      "type": "text",
      "x": 365,
      "y": 235,
      "width": 245,
      "height": 29.700000000000003,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 7,
      "version": 1,
      "versionNonce": 7,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 22,
      "fontFamily": 2,
      "text": "Tailnet",
      "originalText": "Tailnet",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 700,
        "boldFirstLine": false
      }
    },
    {
      "id": "overlay-zone-sub",
      "type": "text",
      "x": 365,
      "y": 269,
      "width": 245,
      "height": 21.6,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 8,
      "version": 1,
      "versionNonce": 8,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 16,
      "fontFamily": 2,
      "text": "只处理网络访问许可",
      "originalText": "只处理网络访问许可",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    },
    {
      "id": "mac-zone-heading",
      "type": "text",
      "x": 670,
      "y": 235,
      "width": 870,
      "height": 29.700000000000003,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 10,
      "version": 1,
      "versionNonce": 10,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 22,
      "fontFamily": 2,
      "text": "Mac · Remote Login / OpenSSH",
      "originalText": "Mac · Remote Login / OpenSSH",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 700,
        "boldFirstLine": false
      }
    },
    {
      "id": "mac-zone-sub",
      "type": "text",
      "x": 670,
      "y": 269,
      "width": 870,
      "height": 21.6,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 11,
      "version": 1,
      "versionNonce": 11,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 16,
      "fontFamily": 2,
      "text": "登录身份、文件权限与项目能力继续分别判断",
      "originalText": "登录身份、文件权限与项目能力继续分别判断",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    },
    {
      "id": "worker-user",
      "type": "rectangle",
      "x": 60,
      "y": 330,
      "width": 245,
      "height": 170,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#e9f7fc",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 12,
      "version": 1,
      "versionNonce": 12,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "worker-user-text",
          "type": "text"
        },
        {
          "id": "enter-overlay",
          "type": "arrow"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "真实 worker 用户",
        "responsibility": "专用 SSH 私钥 / 不要只用管理员测试",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "worker-user-text",
      "type": "text",
      "x": 78,
      "y": 372.5,
      "width": 209,
      "height": 81.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 13,
      "version": 1,
      "versionNonce": 13,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "真实 worker 用户\n专用 SSH 私钥\n不要只用管理员测试",
      "originalText": "真实 worker 用户\n专用 SSH 私钥\n不要只用管理员测试",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "worker-user",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "grant",
      "type": "rectangle",
      "x": 365,
      "y": 330,
      "width": 245,
      "height": 170,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#e9f7fc",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 14,
      "version": 1,
      "versionNonce": 14,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "grant-text",
          "type": "text"
        },
        {
          "id": "enter-overlay",
          "type": "arrow"
        },
        {
          "id": "tcp22",
          "type": "arrow"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "指定节点 grant",
        "responsibility": "合成源 100.64.0.10 / → 100.64.0.20:22 / 既有 allow 规则会叠加",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "grant-text",
      "type": "text",
      "x": 383,
      "y": 359.0,
      "width": 209,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 15,
      "version": 1,
      "versionNonce": 15,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "指定节点 grant\n合成源 100.64.0.10\n→ 100.64.0.20:22\n既有 allow 规则会叠加",
      "originalText": "指定节点 grant\n合成源 100.64.0.10\n→ 100.64.0.20:22\n既有 allow 规则会叠加",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "grant",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "openssh",
      "type": "rectangle",
      "x": 670,
      "y": 330,
      "width": 255,
      "height": 170,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#e9f7fc",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 16,
      "version": 1,
      "versionNonce": 16,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "openssh-text",
          "type": "text"
        },
        {
          "id": "tcp22",
          "type": "arrow"
        },
        {
          "id": "ssh-login",
          "type": "arrow"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "OpenSSH 认证",
        "responsibility": "独立核验 host key / StrictHostKeyChecking yes / 专用 key + from=限制",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "openssh-text",
      "type": "text",
      "x": 688,
      "y": 359.0,
      "width": 219,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 17,
      "version": 1,
      "versionNonce": 17,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "OpenSSH 认证\n独立核验 host key\n只用专用 SSH key\nfrom= 指定源 IP",
      "originalText": "OpenSSH 认证\n独立核验 host key\n只用专用 SSH key\nfrom= 指定源 IP",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "openssh",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "mac-user",
      "type": "rectangle",
      "x": 965,
      "y": 330,
      "width": 255,
      "height": 170,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#e9f7fc",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 18,
      "version": 1,
      "versionNonce": 18,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "mac-user-text",
          "type": "text"
        },
        {
          "id": "ssh-login",
          "type": "arrow"
        },
        {
          "id": "file-access",
          "type": "arrow"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "Mac 登录用户",
        "responsibility": "按 OS 用户授予权限 / owner 用户拥有广泛权限 / 不自动成为 repo 沙箱",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "mac-user-text",
      "type": "text",
      "x": 983,
      "y": 359.0,
      "width": 219,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 19,
      "version": 1,
      "versionNonce": 19,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "Mac 登录用户\n按 OS 用户授予权限\nowner 用户拥有广泛权限\n不自动成为 repo 沙箱",
      "originalText": "Mac 登录用户\n按 OS 用户授予权限\nowner 用户拥有广泛权限\n不自动成为 repo 沙箱",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "mac-user",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "project",
      "type": "rectangle",
      "x": 1260,
      "y": 330,
      "width": 275,
      "height": 170,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#e9f7fc",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 20,
      "version": 1,
      "versionNonce": 20,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "project-text",
          "type": "text"
        },
        {
          "id": "file-access",
          "type": "arrow"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "项目与 runtime",
        "responsibility": "cwd / git / 可写目录 / 非交互 PATH / node / TCC 与 GUI 能力另验",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "project-text",
      "type": "text",
      "x": 1278,
      "y": 359.0,
      "width": 239,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 21,
      "version": 1,
      "versionNonce": 21,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "项目与 runtime\ncwd / git / 可写目录\n非交互 PATH / node\nTCC 与 GUI 能力另验",
      "originalText": "项目与 runtime\ncwd / git / 可写目录\n非交互 PATH / node\nTCC 与 GUI 能力另验",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "project",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "network-receipt",
      "type": "rectangle",
      "x": 40,
      "y": 625,
      "width": 490,
      "height": 140,
      "angle": 0,
      "strokeColor": "#e7c979",
      "backgroundColor": "#fff5d9",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 26,
      "version": 1,
      "versionNonce": 26,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "network-receipt-text",
          "type": "text"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "网络探测的证据范围",
        "responsibility": "tailscale ping 成功不证明 TCP22 获准。 / direct / DERP 改变传输路径， / 不替代 OpenSSH key 与用户认证。",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "network-receipt-text",
      "type": "text",
      "x": 58,
      "y": 639.0,
      "width": 454,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 27,
      "version": 1,
      "versionNonce": 27,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "网络探测的证据范围\ntailscale ping 成功不证明 TCP22 获准。\ndirect / DERP 改变传输路径，\n不替代 OpenSSH key 与用户认证。",
      "originalText": "网络探测的证据范围\ntailscale ping 成功不证明 TCP22 获准。\ndirect / DERP 改变传输路径，\n不替代 OpenSSH key 与用户认证。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "network-receipt",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "permission-receipt",
      "type": "rectangle",
      "x": 555,
      "y": 625,
      "width": 490,
      "height": 140,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#e9f7fc",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 28,
      "version": 1,
      "versionNonce": 28,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "permission-receipt-text",
          "type": "text"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "权限要正向与反向验收",
        "responsibility": "真实 worker 用户：SSH、cwd、git。 / 临时文件 write/read、真实项目命令。 / 未授权 peer 仍拒绝；原 HTTPS 仍通。",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "permission-receipt-text",
      "type": "text",
      "x": 573,
      "y": 639.0,
      "width": 454,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 29,
      "version": 1,
      "versionNonce": 29,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "权限要正向与反向验收\n真实 worker 用户：SSH、cwd、git。\n临时文件 write/read、真实项目命令。\n未授权 peer 仍拒绝；原 HTTPS 仍通。",
      "originalText": "权限要正向与反向验收\n真实 worker 用户：SSH、cwd、git。\n临时文件 write/read、真实项目命令。\n未授权 peer 仍拒绝；原 HTTPS 仍通。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "permission-receipt",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "availability-receipt",
      "type": "rectangle",
      "x": 1070,
      "y": 625,
      "width": 490,
      "height": 140,
      "angle": 0,
      "strokeColor": "#6ab9db",
      "backgroundColor": "#ffffff",
      "fillStyle": "solid",
      "strokeWidth": 2,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": {
        "type": 3
      },
      "seed": 30,
      "version": 1,
      "versionNonce": 30,
      "isDeleted": false,
      "boundElements": [
        {
          "id": "availability-receipt-text",
          "type": "text"
        }
      ],
      "updated": 0,
      "link": null,
      "locked": false,
      "customData": {
        "kind": "node",
        "name": "可达性不等于持续可用",
        "responsibility": "Mac 休眠、重启、FileVault 状态， / 挂载盘、GUI 会话与 TCC 均可阻断。 / 按自己的设备启动路径实际验收。",
        "evidence": [
          "../09-private-access.md",
          "../02-first-server.md",
          "../../examples/tailnet-ssh-grant.example.json",
          "../../examples/ssh-config.example"
        ],
        "evidenceStatus": "reference-model"
      }
    },
    {
      "id": "availability-receipt-text",
      "type": "text",
      "x": 1088,
      "y": 639.0,
      "width": 454,
      "height": 108.0,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 31,
      "version": 1,
      "versionNonce": 31,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 20,
      "fontFamily": 2,
      "text": "可达性不等于持续可用\nMac 休眠、重启、FileVault 状态，\n挂载盘、GUI 会话与 TCC 均可阻断。\n按自己的设备启动路径实际验收。",
      "originalText": "可达性不等于持续可用\nMac 休眠、重启、FileVault 状态，\n挂载盘、GUI 会话与 TCC 均可阻断。\n按自己的设备启动路径实际验收。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": "availability-receipt",
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": true
      }
    },
    {
      "id": "identity-heading",
      "type": "text",
      "x": 60,
      "y": 830,
      "width": 1480,
      "height": 29.700000000000003,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 33,
      "version": 1,
      "versionNonce": 33,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 22,
      "fontFamily": 2,
      "text": "最小访问示例的边界",
      "originalText": "最小访问示例的边界",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 700,
        "boldFirstLine": false
      }
    },
    {
      "id": "identity-sub",
      "type": "text",
      "x": 60,
      "y": 864,
      "width": 1480,
      "height": 21.6,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 34,
      "version": 1,
      "versionNonce": 34,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 16,
      "fontFamily": 2,
      "text": "100.64.0.10 / .20 是合成 shared-address 示例，不是真实节点；不要原样应用到账号。",
      "originalText": "100.64.0.10 / .20 是合成 shared-address 示例，不是真实节点；不要原样应用到账号。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    },
    {
      "id": "identity-body",
      "type": "text",
      "x": 65,
      "y": 900,
      "width": 1470,
      "height": 25.650000000000002,
      "angle": 0,
      "strokeColor": "#163a5f",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 35,
      "version": 1,
      "versionNonce": 35,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 19,
      "fontFamily": 2,
      "text": "将 grant fragment 合并到既有策略并检查所有 allow；SSH 配置使用 IdentitiesOnly yes，专用 key 不代替 OS 用户隔离。",
      "originalText": "将 grant fragment 合并到既有策略并检查所有 allow；SSH 配置使用 IdentitiesOnly yes，专用 key 不代替 OS 用户隔离。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    },
    {
      "id": "footer",
      "type": "text",
      "x": 40,
      "y": 1018,
      "width": 1520,
      "height": 21.6,
      "angle": 0,
      "strokeColor": "#365775",
      "backgroundColor": "transparent",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 0,
      "opacity": 100,
      "groupIds": [],
      "frameId": null,
      "index": null,
      "roundness": null,
      "seed": 36,
      "version": 1,
      "versionNonce": 36,
      "isDeleted": false,
      "boundElements": null,
      "updated": 0,
      "link": null,
      "locked": false,
      "fontSize": 16,
      "fontFamily": 2,
      "text": "实线：一次远程执行逐层跨越的权限边界。Tailscale 私有访问无需家庭公网入站地址；域名、Tunnel 和公网出口不是此路径的前提。",
      "originalText": "实线：一次远程执行逐层跨越的权限边界。Tailscale 私有访问无需家庭公网入站地址；域名、Tunnel 和公网出口不是此路径的前提。",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "autoResize": false,
      "lineHeight": 1.35,
      "customData": {
        "weight": 400,
        "boldFirstLine": false
      }
    }
  ],
  "appState": {
    "viewBackgroundColor": "#ffffff",
    "gridSize": null
  },
  "files": {}
}