Phase 3 — set up the 5 machines

Spread the ecosystem onto the 5 PCs over a private Tailscale network. ~1 evening of copy-paste. Tick each step — progress saves in this browser. Claude can't run these (physical machines); you run them, ping Claude if a step errors.

0 / 0 done

who runs what (the pin map)

laptop — L1 doctrine · Claude Code · Ollama light · TMAO live daemons
5080 — SBOS · Qdrant · Ollama 14B fleet · 24/7
2060 — l2-hub (PRIMARY) · LiteLLM · Hermes/OpenClaw/thClaws · Synapse
i3 — Postgres · kanban · backups · Portainer
i5 — on-demand · firmware flash

0 · prereqs (network)

Install Tailscale + log in on 5080 and 2060 (laptop / i3 / i5 already on the mesh)

Confirm direct (not relay) links — should be 1–5 ms:

tailscale ping 5080.tailnet
tailscale ping 2060.tailnet

1 · provision (Admin PowerShell on each PC)

On 5080:

Documents\scripts\provision-5080-desktop.ps1

On 2060:

Documents\scripts\provision-2060-pc.ps1

2 · pin each service to its host

5080 — SBOS up · Ollama 14B models · Qdrant

cd "Documents\Solopreneur Foundation"
docker compose up -d
ollama pull qwen3:14b   # + your 14B set

2060 — l2-hub + LiteLLM + Synapse + agent runtimes (Hermes / OpenClaw / thClaws)

i3 — Postgres + Hermes kanban + nightly backups

laptop — keep L1 doctrine + Claude Code + TMAO live daemons (no change)

3 · wire + verify

laptop .env: point OLLAMA_DESKTOP_URL + l2-hub→SBOS host at the 5080 Tailscale IP

Health-check the mesh:

curl http://2060.tailnet:8100/health      # l2-hub
curl http://5080.tailnet:8200/health      # SBOS
curl http://2060.tailnet:8500/health      # Synapse
curl http://5080.tailnet:11434/api/tags   # Ollama

Uptime Kuma — add cross-PC probes

4 · point the ops dashboard at the pinned hosts

Set the env + restart — the services that show "down" on localhost light up green:

set OPS_L2HUB=http://2060.tailnet:8100
set OPS_SBOS=http://5080.tailnet:8200
set OPS_SYNAPSE=http://2060.tailnet:8500
set OPS_AKASHA=http://2060.tailnet:8600
python Documents\scripts\ops_dashboard.py   # http://localhost:8090

5 · memory vault gate (G7) — before any memory sync

Clone the (already-created, private) vault to the 5080 canonical home:

gh repo clone wt-phatchara/operator-vault
cp operator-vault/hooks/pre-commit operator-vault/.git/hooks/pre-commit
chmod +x operator-vault/.git/hooks/pre-commit

Verify the gate blocks a fake secret (must FAIL the commit), then proceed:

cd operator-vault
echo "sk-test1234567890abcdefghij" > probe.md
git add probe.md && git commit -m test   # must be BLOCKED
rm probe.md

Gate first, content second, push third. Never let secret/ reach git.

done when

All 5 PCs reachable (1–5 ms) · all health checks 200 · ops dashboard shows 8–9 / 9 up · vault gate verified · backups running.

Full detail: specs/2026-06-13-v10-master-parts/19-roadmap-phases.md §15 Phase 3 + §11 verification.