Acer Laptop (lap1) — Local Dev Worker Node

Environment ID: lap1 Type: local-dev Status: active (variable uptime — laptop, not always on)

Purpose

Local development machine repurposed as a supplementary worker node. Provides additional queue worker capacity and a GitHub Actions self-hosted runner without incurring VPS costs. Not a replacement for VPS-based workers — use only for P1–P2 jobs; never for P0 (incident response, sys-admin operations requiring guaranteed availability).

Hardware

Field	Value
Label	`lap1`
Hostname	`lap1` (Acer laptop)
Provider	Local — developer workstation
IP	CF Tunnel: ssh via `lap1-ssh.zintegrowana.online` (no direct inbound SSH; tunnel runs cloudflared on the laptop)
OS	Windows 10 Home (10.0.19045)
CPU	TBD
RAM	TBD
Storage	TBD

Running Workers

Worker ID	Type	Description
`lap1-que-w1`	Queue worker	Polls Supabase `p24_worker_queue` — outbound HTTPS only
`lap1-que-w2`	Queue worker	Polls Supabase `p24_worker_queue` — outbound HTTPS only
`lap1-gh-w1`	GitHub Actions runner	Self-hosted runner — outbound HTTPS to github.com only

Connectivity

Direction	Protocol	Destination	Notes
Outbound	HTTPS	`mwkqmgadqnkkihjdeqsi.supabase.co`	Queue polling (lap1-que-w1/w2)
Outbound	HTTPS	`github.com`, `*.github.com`	GH Actions runner (lap1-gh-w1)
Outbound	HTTPS	`p24-meta-dispatcher.radieu.workers.dev`	Worker queue API
Inbound	—	None	VPSes cannot reach lap1; no open ports required

No inbound access from VPSes. lap1 is on a private LAN. Queue workers poll outbound — they do not need to be reachable by the dispatcher. GitHub Actions runner phones home to GitHub over HTTPS — no inbound port needed.

Constraints

Constraint	Detail
Uptime	Not guaranteed — laptop may be off, sleeping, or in use
Priority filter	Accept P1–P2 jobs only; never P0 (incident, sys-admin)
OS	Windows 10 — workers run via PowerShell / native Windows process; no Docker
No SSH inbound	VPS admins cannot reach lap1 directly
SOPS+age	Age key available at `C:\Users\konar\.age\p24-infra-keys.txt` — same key as dev workstation
Auth	Claude Max OAuth subscription — same credentials as the main dev session

Naming Convention

Follows the standard {server-label}-{worker-type}-{index} convention:

Worker	Segments	Meaning
`lap1-que-w1`	`lap1` + `que` + `w1`	Laptop 1, queue worker, slot 1
`lap1-que-w2`	`lap1` + `que` + `w2`	Laptop 1, queue worker, slot 2
`lap1-gh-w1`	`lap1` + `gh` + `w1`	Laptop 1, GitHub Actions runner, slot 1

Note: que (queue) is used instead of cw (Claude Code worker) to distinguish Supabase queue pollers from the autonomous Claude Code agent sessions on VPS nodes.

Setup Notes

Queue workers (lap1-que-w1, lap1-que-w2)

Queue workers run as Windows processes (PowerShell or native exe) that poll the Supabase p24_worker_queue table directly via outbound HTTPS. No Docker, no SSH. The CLAUDE_WORKER_ID environment variable must be set to the worker ID before starting.

# Set worker identity (add to PowerShell profile or launcher script)
$env:CLAUDE_WORKER_ID = "lap1-que-w1"   # or lap1-que-w2
 
# Verify
Write-Host "Worker ID: $env:CLAUDE_WORKER_ID"

GitHub Actions runner (lap1-gh-w1)

Install the GitHub Actions self-hosted runner using the standard Windows installer. During ./config.cmd set:

Runner name:   lap1-gh-w1
Runner labels: self-hosted,windows,lap1

Reference in workflows with:

runs-on: [self-hosted, windows, lap1]
# OR target specifically:
runs-on: lap1-gh-w1

Secrets Access

Secret store	Access method	Can decrypt SOPS?
Most `secrets/*.env.sops` files	age key at `C:\Users\konar\.age\p24-infra-keys.txt`	Yes — dev machine holds the age key
`secrets/role-*.env.sops` (5 files)	—	No — recipients narrowed to developer + CI (`AGE_KEY_GHA`) only since 2026-07-29 (plan #4556 Phase 3); lap1’s age key was removed from these files specifically. See `docs/playbooks/lap1-worker-credentials.md`
`.env.local` on this machine	Direct file read	Yes — emergency fallback only
GitHub Actions secrets	Via GH Actions runner context	Yes — via `${{ secrets.* }}` in workflows

dev_r_services Registration

TODO — PENDING EXECUTION (see docs/playbooks/dev-r-services-insert.md for the canonical template).

Run the following SQL via the Supabase dashboard or psql once the workers are active:

-- lap1-que-w1
DO $$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM dev_r_services WHERE service_name = 'lap1-que-w1') THEN
    INSERT INTO dev_r_services (
      service_name,
      project_id,   project_name,
      office_id,    ws_id,    app_id,
      service_type,
      element_type,
      status,
      owner,
      compliance_workbook,
      workbook_url,
      compliance_notes
    ) VALUES (
      'lap1-que-w1',
      'p24-infra', 'p24-infra',
      'p24-devops', '99', 'et-app',
      'workflow',
      'script',
      'active',
      'radieu',
      'yes',
      'docs/environments/lap1.md',
      'Supabase queue worker on local Acer laptop (lap1). Outbound HTTPS only. P1-P2 jobs only. CLAUDE_WORKER_ID=lap1-que-w1.'
    );
  END IF;
END $$;
 
-- lap1-que-w2
DO $$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM dev_r_services WHERE service_name = 'lap1-que-w2') THEN
    INSERT INTO dev_r_services (
      service_name,
      project_id,   project_name,
      office_id,    ws_id,    app_id,
      service_type,
      element_type,
      status,
      owner,
      compliance_workbook,
      workbook_url,
      compliance_notes
    ) VALUES (
      'lap1-que-w2',
      'p24-infra', 'p24-infra',
      'p24-devops', '99', 'et-app',
      'workflow',
      'script',
      'active',
      'radieu',
      'yes',
      'docs/environments/lap1.md',
      'Supabase queue worker on local Acer laptop (lap1). Outbound HTTPS only. P1-P2 jobs only. CLAUDE_WORKER_ID=lap1-que-w2.'
    );
  END IF;
END $$;
 
-- lap1-gh-w1
DO $$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM dev_r_services WHERE service_name = 'lap1-gh-w1') THEN
    INSERT INTO dev_r_services (
      service_name,
      project_id,   project_name,
      office_id,    ws_id,    app_id,
      service_type,
      element_type,
      status,
      owner,
      compliance_workbook,
      workbook_url,
      compliance_notes
    ) VALUES (
      'lap1-gh-w1',
      'p24-infra', 'p24-infra',
      'p24-devops', '99', 'et-app',
      'workflow',
      'script',
      'active',
      'radieu',
      'yes',
      'docs/environments/lap1.md',
      'GitHub Actions self-hosted runner on local Acer laptop (lap1). Labels: self-hosted,windows,lap1. Outbound HTTPS to github.com only.'
    );
  END IF;
END $$;

Operations

Since lap1 is a local Windows machine, operations differ from VPS hosts:

# Check queue worker processes
Get-Process -Name "claude" -ErrorAction SilentlyContinue
 
# Check GitHub Actions runner service (if installed as Windows service)
Get-Service -Name "actions.runner.*" -ErrorAction SilentlyContinue
 
# Check worker environment variable
[bool]$env:CLAUDE_WORKER_ID  # True if set; never print the value directly

No SSH access from VPSes. If a remote agent needs to interact with lap1 results, it must do so through the Supabase queue (p24_worker_queue) or GitHub Actions artifacts — not direct SSH.

Remote Access — Cloudflare Tunnel

lap1 has no static IP and no open inbound ports. Remote SSH is via Cloudflare Tunnel:

Tunnel name: lap1-ssh (CF account: Radieu@gmail.com)
Tunnel hostname: lap1-ssh.zintegrowana.online (CNAME in Cloudflare)
Local IP: dynamic LAN DHCP (irrelevant for remote access)

Installing cloudflared on lap1

# 1. Download cloudflared for Windows
winget install Cloudflare.cloudflared
# OR: download from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/
 
# 2. Authenticate (one-time)
cloudflared tunnel login
 
# 3. Install the tunnel as a Windows service using the token
#    (token stored in C:\code_2026\p24-infra\secrets\administration.env.sops as CF_TUNNEL_LAP1_TOKEN)
cloudflared service install <TOKEN>
 
# 4. Start the service
Start-Service cloudflared

SSH via the tunnel (from any machine)

ssh -o ProxyCommand="cloudflared access ssh --hostname lap1-ssh.zintegrowana.online" root@lap1

Or add to ~/.ssh/config:

Host lap1
  HostName lap1-ssh.zintegrowana.online
  User root
  ProxyCommand cloudflared access ssh --hostname %h

Pane execution layer — abandoned pilot (historical, #6132)

lap1 was briefly considered as a target host for the Pane (runpane.com) execution pilot — parallel job execution via a self-hosted local daemon, an alternative to the SSH dispatcher for issues labelled pane. The pilot was abandoned the same day it was proposed (2026-08-11) after Pane’s headless daemon setup hit an unresolved, architectural hang (confirmed via 4 independently ruled-out theories — display availability, network/DNS, WSL2 connectivity, virtual framebuffer; root cause per Pane’s own docs is that its “remote daemon” has no genuine headless code path). See #6132’s final comment for the full writeup. The team reverted to the already-built Docker path (#6110 / ADR-005 §5b) — see windows-dev.md for the current design of record.

docs/playbooks/adding-new-worker.md — worker registration playbook
docs/playbooks/dev-r-services-insert.md — Supabase registration template
docs/ai-agent-operations.md — agent fleet overview
docs/infrastructure-overview.md §2 — compute infrastructure listing

p24-infra Docs

Explorer

lap1

Acer Laptop (lap1) — Local Dev Worker Node

Purpose

Hardware

Running Workers

Connectivity

Constraints

Naming Convention

Setup Notes

Queue workers (lap1-que-w1, lap1-que-w2)

GitHub Actions runner (lap1-gh-w1)

Secrets Access

dev_r_services Registration

Operations

Remote Access — Cloudflare Tunnel

Installing cloudflared on lap1

SSH via the tunnel (from any machine)

Pane execution layer — abandoned pilot (historical, #6132)

Graph View

Table of Contents

Backlinks

p24-infra Docs

Explorer

lap1

Acer Laptop (lap1) — Local Dev Worker Node

Purpose

Hardware

Running Workers

Connectivity

Constraints

Naming Convention

Setup Notes

Queue workers (lap1-que-w1, lap1-que-w2)

GitHub Actions runner (lap1-gh-w1)

Secrets Access

dev_r_services Registration

Operations

Remote Access — Cloudflare Tunnel

Installing cloudflared on lap1

SSH via the tunnel (from any machine)

Pane execution layer — abandoned pilot (historical, #6132)

Related Docs

Graph View

Table of Contents

Backlinks