The Ghost in the Network

Chasing an HTTPS bug that wasn't one

The mystery

A working HTTPS dashboard, and one phone that couldn't reach it

The same self-hosted PWA loaded fine over HTTPS on the developer's Mac, on the Tailscale tailnet — but the iPhone browser insisted the site “couldn't be reached.” The obvious fix, blaming the fresh TLS code, was the wrong one.

First question: what exactly is the site the phone can't reach?

The “AMP Browser” is muxplex — a web tmux dashboard you install on your home screen

muxplex is a mobile-friendly, PWA-capable web dashboard for tmux, reached in a phone browser over HTTPS on the tailnet.

So the question becomes: was this dashboard actually serving?

PWA
Responsive, PWA-capable for home-screen install (README.md:19)
:8088
Served on spark-1 at 0.0.0.0:8088 (live socket in session 830459e9)
408
Commits by Brian Krabach; iOS/iPadOS touch-scroll fix via PR #4 (@samueljklee)

The server was innocent: HTTPS was live and the ports were bound

Live probes showed muxplex listening on :8088 and Tailscale serve mapping the MagicDNS host to local services — reachability gated “tailnet only.”

If the server was serving, why was HTTPS still the first suspect?

# tailscale serve status https://spark-1.tail79ce67.ts.net (tailnet only) |-- / proxy http://127.0.0.1:8400 |-- /dash proxy http://127.0.0.1:7777 :8443 (tailnet only) -> :7777 :8444 (tailnet only) -> :8080 # ss -tlnp LISTEN 0 2048 0.0.0.0:8088 users:(("muxplex"))

HTTPS looked guilty because a new feature had just forced it into existence

muxplex had just added native clipboard support — and the browser Clipboard API requires a secure context. That's why muxplex setup-tls and all the fresh cert code existed at all.

Freshly-changed code is always the tempting scapegoat. So how do you clear it fairly?

Clipboard API needs a secure context “navigator.clipboard requires a secure context — either localhost or HTTPS” (tls-setup-design.md:9)
So TLS was added: setup-tls Auto-detection chain Tailscale → mkcert → self-signed (26 TLS commits, 2026-04-01..04-06)
Tailscale gets a real cert tailscale cert, hostname read from tailscale status --self --json

One Amplifier butler session ran the recon — read-only, and it changed nothing

The flagship session coordinated many subagents; foundation:explorer agents ran live network probes to clear the server before anyone touched the code.

Those read-only probes captured one line that flipped the whole case.

1
Run tailscale status to read the tailnet peer table
2
Run ss -tlnp to confirm bound ports
3
Run tailscale serve/funnel status and docker ps
4
Report: “All read-only; no changes made” — 31 subagent spawns on disk (21 per audit)

The peer table flipped the case: the phone was offline, the Mac was online

In the captured tailscale status, iphone171 read “offline, last seen 16h ago” while macstudio was online. The evidence pointed away from HTTPS and toward the phone's tailnet membership.

Off the tailnet — so what actually broke first?

# tailscale status (session 7084bb34) 100.94.69.99 iphone171 ramparte@ iOS offline, last seen 16h ago 100.79.85.60 macstudio ramparte@ macOS - # bare "-" = online

Off the tailnet, MagicDNS never resolved spark-1 — so there was no HTTPS to fail

With the phone off the tailnet, MagicDNS couldn't resolve the spark-1 host at all. The browser never reached a server to negotiate HTTPS with. spark-1 even logged a DNS-layer health warning in the same window.

A name-resolution ghost stacked on a tailnet-membership failure — never an HTTPS bug.

Phone off the tailnet iphone171 “offline, last seen 16h ago” while macstudio online (session 7084bb34)
MagicDNS can't resolve spark-1 spark-1 health check: “Tailscale can't reach the configured DNS servers”
HTTPS was never reached No name resolution → no server → no TLS handshake to blame

Clear the server before you blame the code

Read-only recon that exonerates the server first saves you from patching innocent TLS code. The same “device not on the tailnet” failure class hits the Windows host too — it's off-tailnet and must be bridged over an SSH tunnel through WSL.

The ghost was never in the HTTPS. It was in who was — and wasn't — on the tailnet.

Prove innocence with read-only probes tailscale status, ss -tlnp, serve/funnel, docker ps — change nothing first
Check tailnet membership before certs “Couldn't be reached” can mean the peer never resolved at all
Same class: the Windows host Windows side is NOT on the tailnet — only WSL is; bridged via SSH tunnel over WSL
Sources

Research Methodology

Data as of: 2026-07-15 (latest session referenced).

Feature status: muxplex HTTPS/TLS — SHIPPED (muxplex/tls.py, CHANGELOG.md:53, 2026-04-03..04-06). Amplifier multi-agent debugging & session recovery — OBSERVED IN PRACTICE.

Research performed:

Gaps / notes: “AMP Browser” is a narrative nickname mapped to muxplex, not a shipped product name. In tailscale status, a bare “-” means ONLINE; a disconnected peer renders “offline, last seen ...”. Subagent totals differ by source (21 audited vs 31 on-disk spawn events); both confirm a large multi-agent investigation.

Primary contributors: Brian Krabach (408 muxplex commits); Samuel Lee / @samueljklee (iOS touch-scroll, PR #4); Sam Schillace / ramparte (operator on spark-1, ran the Amplifier sessions).

More Amplifier Stories