Pèsè

Apply least privilege to temporary private access: serve only the eligible resource and return its exact usable target. Setup or transport advice alone is not completion.

The local resource remains authoritative.

Direct invocation authorizes task-scoped staging, an ephemeral local listener if needed, and one narrow temporary private route using ready tooling. Installation, persistent startup/configuration, saved credentials/keys, DNS publication, public exposure, broad served roots and unrelated mutation require separate authority.

Resolve tooling from current official evidence

Resolve volatile syntax from the installed transport and current official documentation: Tailscale Serve or Tailcat. For installed Tailcat, prefer its embedded documentation. If installation or configuration must change, use the installed transport's supported interface; this skill does not own setup guidance.

Bound the resource

Pin: