catalyst-app-tunnels
App tunnels: letting Catalyst call into this machine
Goal: end this skill with Catalyst able to reach a process on the user's machine, on a port of their choosing, under a Catalyst identity, and with a request proven to have arrived through it.
catalyst_get_connection (the catalyst-develop skill) gives a local process
outbound access only: it can call its sidecar, start workflows, publish. Nothing in
Catalyst can call back into it. That needs an app tunnel, and no catalyst_* tool
opens one. This is the one place these skills use the Diagrid CLI, and only for the
commands below. Everything else (creating resources, granting access, reading status)
still goes through the catalyst_* tools.
Never reach for a public tunnel (cloudflared, ngrok, a port-forward to a public address) to give Catalyst a URL. An app tunnel keeps the traffic under the identity and access policy of the App ID it serves. A public URL bypasses both, and anyone who learns it can call the process.