# Herdr Remote Smoke Checklist

Repeatable end-to-end smoke for `herdr --remote` over Tailscale.

## Preflight

```bash
# 1. Verify Tailscale connectivity
tailscale status | grep <host>

# 2. Test SSH over Tailscale IP
ssh <host>-ts-herdr 'hostname; uname -a'

# 3. Check remote state (should be clean before first deploy)
ssh <host>-ts-herdr 'command -v herdr || echo NOT_FOUND'
ssh <host>-ts-herdr 'ls -la ~/.config/herdr 2>/dev/null || echo NOT_FOUND'
```

## First deploy

From the client machine (has herdr binary on PATH):

```bash
herdr --remote <host>-ts-herdr
```

Approve the install prompt (`[Y/n] y`). TUI opens — verify panes appear
remote-side. Quit with `prefix+q` or `q`.

## Post-deploy verification (run immediately after detach)

```bash
# Herdr binary installed
ssh <host>-ts-herdr 'ls -la ~/.local/bin/herdr && ~/.local/bin/herdr --version'

# Server still running (persists after client detach)
ssh <host>-ts-herdr 'ps aux | grep "herdr server" | grep -v grep'

# Unix sockets created
ssh <host>-ts-herdr 'ls -la ~/.config/herdr/*.sock'

# Config auto-generated
ssh <host>-ts-herdr 'cat ~/.config/herdr/config.toml'

# Server log — check client connect/disconnect events
ssh <host>-ts-herdr 'tail -20 ~/.config/herdr/herdr-server.log'
```

## Expected results

| Artifact       | Expected                                                        |
| -------------- | --------------------------------------------------------------- |
| Binary         | `~/.local/bin/herdr` (13 MB, `chmod 755`)                       |
| Version        | `herdr 0.6.2`                                                   |
| Server process | `/home/<user>/.local/bin/herdr server` (PID, running)           |
| Sockets        | `herdr.sock` (API) + `herdr-client.sock` (client), `srw-------` |
| Config         | auto-generated, `onboarding = false`                            |
| Log            | `client connected` → `client disconnected` events               |

## Reverse direction

Same checklist, swapped hosts. Ensure:

1. SSH config entry exists on the new client host
2. Destination host has the client's public key in `authorized_keys`
3. Destination host's sshd is running (check `ListenAddress 0.0.0.0` pitfall)

## Troubleshooting

| Symptom                               | Likely cause                            | Fix                                           |
| ------------------------------------- | --------------------------------------- | --------------------------------------------- |
| `Cannot bind any address` in sshd log | `ListenAddress <tailscale-ip>` at boot  | Set `ListenAddress 0.0.0.0`                   |
| `Permission denied (publickey)`       | Key not in remote `authorized_keys`     | Add pubkey to destination                     |
| `Connection refused` on Tailscale IP  | sshd not running or wrong ListenAddress | `systemctl status ssh`                        |
| "run from an interactive terminal"    | First install requires prompt           | Run from user terminal, or pre-install binary |
| RemotePlatform rejects FreeBSD        | `from_uname` only accepts Linux/Darwin  | Do not use `--remote` with osa                |