#3920 swamp-club.com/cve/tailworm: cover grade, probeScript, gradeFleet and the reachability matrix (extension 2026.10.25.5)

Summary

Update the swamp-club.com/cve/tailworm page (#3895) for what @swamp/cve/tailworm has shipped since the page was built. The page should drive the extension as it is now, and its commands and sample output must match the current release.

What changed in the extension

• 2026.10.25.2 (#3908): probeScript stores the probe, compressed and as one sh command line. grade grades probe output the caller collected through another exec channel (KubeVirt / Harvester guest agent, kubectl exec), into the same status and report as scan. Statuses carry externalProbe: true.
• 2026.10.25.3 (#3910): serve targets the probe could not follow are reported as unverified in the localapi column, with a recommendation to check them by hand. CRLF output (kubectl exec -t) is read as is.
• 2026.10.25.4 (#3912): gradeFleet grades many hosts' output in one call (outputs: a list of {target, output, encoding?}) and gives one fleet report. In a workflow, outputs can be built from an earlier exec step's data with a CEL map. A host named fleet is refused by gradeFleet and scanFleet.
• 2026.10.25.5 (#3919, PR #568): opt-in includeReachability on scan and scanFleet. It reads each node's compiled packet filter (the PacketFilter of tailscale debug netmap, nothing else) and the report adds a Reachability section: a source-by-destination matrix between scanned hosts (allowed ports or denied) and a per-host inbound list. Port 22 is marked when Tailscale SSH is on, and serve ports that reach the localapi are marked too. A rule admitting the whole tailnet (the default allow-all policy) reads as any tailnet device. Needs root or the operator user; without it, or without the node's own addresses, a host reads as unknown, never as unreachable. It is the compiled policy, not a live test. grade and gradeFleet do not collect it.

Scope

• Add a section for hosts the model cannot reach: run probeScript, run its command on each host as root through your own channel, then grade one host or gradeFleet the fleet. Show the input-file example and the workflow step from the extension README (cve/tailworm/README.md, "Scan hosts the model cannot reach" and "Grade a fleet"). Note that the CEL expression must be quoted in YAML.
• Show sample results for graded hosts: mitigate cannot reach them, so the report suggests applying the fixes through the same exec channel, then probing and grading again.
• Mention the unverified localapi cell and what to do about it.
• Add a "Check your policy" section after the SSH-policy advice: the page tells readers to rewrite Tailscale SSH rules as per-pair grants, and scanFleet --input includeReachability=true is how they check the rewrite worked. Show the before/after matrices: the allow-all policy, then a tagged policy. Sample output and a recording come from the demo in the extension README ("Who can reach what"). Say what it does not show: subnet-route and exit-node traffic, app capability grants, and live reachability.
• Check every command and sample output on the page against 2026.10.25.5 once PR #568 is released.

Related

Extension: @swamp/cve/tailworm (cve/tailworm/ in swamp-club/swamp-extensions). Page: #3895. Extension issues: #3908, #3910, #3912, #3919 (follow-ups #3923).