Design-intent reference and simulation. Not a shipped product, not a medical device, no clinical claims.

Attach guide: real traffic through TAL

This guide puts a real machine (an evaluator workstation, a programmer, or a bedside monitor on a bench) behind a TAL gateway so every flow it makes is decided by the signed allowlist, shaped, and recorded as a signed, hash chained receipt. Lab tenant grp-lab-bench, overlay 10.66.0.0/16, gateway at 10.66.0.1.

Form factor: this is the network proxy form factor (gateway plus tunnel). It is separate from the SDK embedded form factor and the two are not mixed.

1. Build the tools (private clone, no published binaries)

git clone git@github.com:hb512/secgenix.git && cd secgenix/gateway
go build -o bin/ ./cmd/tal ./cmd/tal-gateway

2. Mint one time tokens (operator)

From the admin console (Lab tunnels, Mint) after passkey sign in, or from a shell with the admin key:

npx tsx scripts/admin.ts https://api.secgenix.com .secrets/prod.json mint gateway lab-a 60
npx tsx scripts/admin.ts https://api.secgenix.com .secrets/prod.json mint device ws-hb evaluator-workstation 60

Tokens are single use, stored only as SHA-256 hashes, and expire (default 60 min). Roles: evaluator-workstation, programmer, bedside-monitor.

3. Run a gateway

Any host the device can reach on UDP 51820 (a laptop on the same LAN works):

./bin/tal-gateway --state ./gw-state --api https://api.secgenix.com --token tal_g_... --name lab-a \
  --endpoint <ip-the-device-can-reach>:51820 --deny-private

Or TAL_TOKEN=tal_g_... TAL_ENDPOINT=<ip>:51820 docker compose up -d in gateway/. The gateway registers its Ed25519 and WireGuard keys, pulls the signed bundle (refresh about every 5 min, SSE pushes earlier, max validity 24 h, fail closed), and installs only peers named in the bundle. Status JSON: curl 127.0.0.1:9090/status.

4. Attach a device

export TAL_HOME=~/.tal           # optional
tal attach --api https://api.secgenix.com --token tal_d_... --name ws-hb --role evaluator-workstation

Then choose one:

* Userspace, no root, any OS: tal connect exposes SOCKS5 and HTTP CONNECT on 127.0.0.1:1080 inside the tunnel. curl --proxy socks5h://127.0.0.1:1080 https://example.com, or export HTTPS_PROXY=http://127.0.0.1:1080.

* Kernel WireGuard, full tunnel (default, every packet of the machine through TAL): sudo wg-quick up ~/.tal/tal0.conf.

* Split tunnel: tal attach ... --split 203.0.113.0/24,198.51.100.7/32 routes only those CIDRs (plus the gateway) through TAL.

Per OS: macOS uses the WireGuard app or brew install wireguard-tools; Linux uses wireguard-tools; Windows uses the WireGuard client and imports tal0.conf; a Raspberry Pi can act as an inline bridge for a bench device that cannot run a client (run tal-gateway --transparent-listen with iptables REDIRECT and --source-map <lan-ip>=<deviceId>).

Leases last 24 h: tal renew extends with a device signed request; revocation from the console removes the peer on the next bundle.

5. Alternate on ramp

Cloudflare Tunnel or WARP can carry the proxy port (TCP only) when UDP 51820 is not reachable. This is design intent and is not configured in this build.

6. What you will see

Admin, Lab tunnels: gateways, devices, and every flow (source, destination class, op, effect, reason, bytes, via) updating over SSE. Public demo, Live gateway card: the same flows redacted to roles and destination classes, read only. Every row is labelled source: gateway; simulator rows never mix in.

Note: --deny-private refuses RFC1918, CGNAT and ULA destinations (the gateway's own DNS relay excepted). Use it on hosted gateways; omit it on a bench gateway whose allowlist must reach LAN devices such as a monitor's central station.