[jamesyong-42]

Sidecar protocol 11: sign-out, the client-log opt-out, Tailnet Lock's signing state, the embedded Tailscale version, and backend state changes within a second. These are the asks an embedding app needs to make Tailscale's own lifecycle honest to its users (VibeField's petitions T9, T10 and T11). They ship in one protocol bump, so a consumer moves once.

What an app gets

Ask	API	Sidecar (protocol 11)
Sign out	Node::logout() (and TailscaleProvider::logout()). The control server expires the node key, then the node stops as stop() does. An ephemeral node is removed. It is bounded by LOGOUT_TIMEOUT (12 s): past that the node is stopped anyway, and the error says the device stayed signed in. On an older sidecar it returns Unsupported and leaves the node running.	tsnet:logout → LocalClient.Logout, answered by tsnet:loggedOut or a tsnet:error carrying the requestId
Client-log opt-out	NodeBuilder::client_log_upload(false) (default true, Tailscale's own default) and TailscaleConfig.client_log_upload	tsnet:start's clientLogUpload:false
The tailnet refuses an opted-out node	NetworkStatusEvent::LoggingRequired. While build() waits it fails at once, naming why, instead of waiting out its timeout.	tsnet:loggingRequired
A running node's backend state	NetworkStatusEvent::BackendStateChanged { state: BackendState }, e.g. NeedsLogin after the key expired or an admin removed the device	tsnet:stateChange, now also kicked by an IPN bus watch: within a second, not at the next minute's poll
Tailnet Lock	NetworkStatusEvent::NeedsSignature / Signed, Node::needs_signature()	tsnet:lockStatus {enabled, signed} before the running events, and on every change
Embedded Tailscale	Node::tailscale_version() → TailscaleVersion { version: "1.104.1", long }	tailscaleVersion / tailscaleVersionLong on every status, plus tsnet:version

Everything is additive. NetworkStatusEvent and BackendState are #[non_exhaustive], and no existing command or event changes shape. TailscaleConfig gains one public field, as start_timeout did in #218. Code that builds it as a struct literal adds client_log_upload: true.

Facts the design rests on (read in tailscale.com v1.104.1)

• The opt-out needs two process-wide switches, not an environment variable. tsnet's startLogger (tsnet.go:1091) checks only testenv.InTest. It never consults logpolicy, the one reader of TS_NO_LOGS_NO_SUPPORT. So the sidecar throws the pair that tailscaled --no-logs-no-support and control's own DisableLogTail throw (controlclient/direct.go:1403), before srv.Start():
  • logtail.Disable() (the upload loop checks it at logtail.go:532/:768);
  • envknob.SetNoLogsNoSupport() (reported as Hostinfo.NoLogsNoSupport).
    Both last for the life of the process; the core spawns one sidecar per start.
• An older sidecar would ignore the opt-out and upload anyway. So when it is asked for, start() sends tsnet:version before tsnet:start. A sidecar older than 11 answers UNKNOWN_CMD and is refused before anything starts. Contrast login_allow, which is checked after the start; that is fine there, but not for a privacy promise.
• A tailnet with network flow logs refuses an opted-out node. ipnlocal/local.go:2048 turns WantRunning off with "tailnet requires logging to be enabled". The sidecar recognises this by the node's own data-plane-audit-logs capability on Self (which keeps the last netmap after the stop), not by the message text.
• A Tailnet-Lock-unsigned node reaches Running. Tailscale reports only a "locked out" health warning (tailnet-lock.go:245) and filters every peer. So start() returns, and NeedsSignature must arrive before it does, not as a reason start() waits.
• Bus notifications. State, Health and ErrMessage reach every IPN bus watcher whatever its mask (notifyForSessionLocked strips only peer fields). The new watch subscribes with NotifyNoNetMap and only kicks the existing monitor, which stays the single place statuses are read; its 60 s poll remains the safety net.
• Logout is permitted. tsnet's in-memory LocalAPI has PermitWrite (tsnet.go:1018), so /localapi/v0/logout is allowed. The tka/status route is compiled in unless ts_omit_tailnetlock.
• Version strings. tailscaleVersion is the module's own VERSION.txt. tailscaleVersionLong is version.Long(): for an embedder that is 1.104.1-dev<date>-g<this repo's commit>, which is what the admin console lists.

Tests

• Go (go test ./..., plus -race on the new set). status_v11_test.go drives the real handlers and loops against a fake LocalAPI:
  • every status carries the version pair; tsnet:version answers with no node;
  • clientLogUpload parsing; the opt-out throws its switches exactly once (the real ones swapped out, since they cannot be undone in a test process);
  • loggingRequired needs both the opt-out and the capability; the start loop reports it once;
  • the lock state precedes tsnet:status/tsnet:started; the monitor re-sends it only on change;
  • a NeedsLogin on the bus becomes tsnet:stateChange with the minute's poll set to an hour;
  • logout answers with its requestId (204, and 500 → LOGOUT_ERROR), and without a node → NOT_RUNNING.
• Rust (cargo test, fmt, clippy -D warnings, doc -D warnings):
  • wire mapping of every new line;
  • the event processor: lock reports announce entering and leaving the locked-out state, never a repeat; backend states arrive typed (Other for an unknown one), and health keeps Tailscale's name;
  • scripted sidecars as real child processes:
    • an opted-out node asks the version first and sends clientLogUpload:false with the start;
    • it learns the Tailscale client and hears NeedsSignature before start() returns;
    • logout signs out and then stops;
    • an older sidecar is refused before tsnet:start is ever sent;
    • LoggingRequired fails the start at once;
    • a refused logout still stops the node;
    • on a v10 sidecar logout is Unsupported, and the node keeps running.
• Real tailnet: test_logout_signs_the_node_out_of_the_tailnet in integration_network. Alpha logs out, and beta must drop it from its peers within a minute. An ephemeral node is removed at its logout, while a plain stop only takes it offline. On the way it asserts the real sidecar names its Tailscale client and reports no Tailnet Lock.

Witnessed on this PR's CI (2026-10-27, job 122281446930, real tailnet, key set): test_logout_signs_the_node_out_of_the_tailnet passed.

• The pair started at 15:27:43.06Z and rendezvoused at 15:27:45.07Z, each listing the other.
• Alpha's logout() returned, and alpha was stopped by 15:27:45.72Z.
• Beta's peers had dropped alpha by 15:27:46.22Z: about 0.5 s from logout to the peer losing the ephemeral node.
• The real sidecar named a three-part tailscale_version(), and needs_signature() was Some(false) (no Tailnet Lock on the test tailnet).

Not covered by CI, because each needs a tailnet configured for it:

• flow logs on (LoggingRequired live);
• Tailnet Lock on (NeedsSignature live);
• an admin expiring a key (NeedsLogin live);
• an outbound-connection check that an opted-out sidecar never dials log.tailscale.com.

Found along the way

GoSidecar::shutdown queues tsnet:stop and then notifies the stdin writer to shut down. The writer select!s between the two, so the stop line is sometimes never written. It is harmless today, because the writer then drops stdin and the sidecar's EOF runs handleStop. But a test must assert that the node stopped, not that the line arrived. This PR does not change it.

Audits at the push (2026-10-27 09:52Z)

• cargo audit: exit 0 (14 allowed warnings).
• govulncheck v1.9.0 on the sidecar: exit 0. One vulnerability in a required module, not called.
• pnpm audit --audit-level=high: exit 1, already present on main, not from this PR.
  • 107 advisories: 2 critical (proxy-addr, tar), 64 high (among them electron, vite, app-builder-lib, tar, @xmldom/xmldom).
  • This PR changes no lockfile: pnpm-lock.yaml, Cargo.lock and go.sum are byte-identical to origin/main, whose lockfile gives the same 107 findings and exit 1.
  • The findings come through examples/playground (48), benchmark/app (8), the root (5), crates/truffle-napi (3) and examples/express-over-mesh (2).
  • truffle's CI runs no npm audit (security-audit.yml is govulncheck, cargo-deny and cargo-audit), which is how main carried it unseen. A follow-up PR adds a pnpm audit job and the bumps or overrides.

Not in this PR

• The Swift plane (apple/) is untouched.
• NAPI, the Tauri plugin and the CLI do not expose the new calls yet.
• T8, an app-chosen hostname prefix with membership read from a Hostinfo tag, waits on a live probe of whether control relays a peer's Hostinfo.App.

🤖 Generated with Claude Code