Platform teams love declaring “SSH only” for OpenClaw gateways until macOS quietly demands a human finger on a permission sheet. This 2026 matrix tells you which operator tasks stay on SSH, which require VNC break-glass, and how to keep both paths aligned with loopback admin and split ingress—without turning every emergency into a permanent public bind.
Read alongside SSH tunnel patterns for remote admin, loopback admin versus public ingress, and TCC regression matrices so your break-glass story matches the rest of your threat model.
Why “SSH only” fails the moment Apple adds friction
Gateways on Apple Silicon M4 Mac mini hosts inherit the same Transparency, Consent, and Control surfaces as laptops. Automation can edit plist files all day, but when System Settings needs a checkbox only rendered in Aqua, SSH sessions stall with no stderr hint. Treating VNC as shameful guarantees midnight pages where someone widens 0.0.0.0 binds “temporarily” and forgets to revert.
Matrix A — Operator task vs preferred path vs audit note
| Task | Preferred path | Audit note |
|---|---|---|
| Tail gateway logs + rotate tokens | SSH | Keep sessions ephemeral; forbid shared screen forwarding for secret pastes. |
| Reach loopback dashboard from laptop | SSH -L |
Document host, local port, and teardown—tunnels are credentials. |
| Approve Accessibility for moved binary | VNC break-glass | Screenshot panes into change ticket; revert gateway to SSH-first after closure. |
Matrix B — Risk if you default wrong vs mitigation
| Risk | When it appears | Mitigation |
|---|---|---|
| Over-coupling secrets to VNC clipboards | Operators paste tokens into GUI fields under stress | Use SSH heredocs or files on ramdisk; VNC only for clicks, not typing secrets. |
| Stale SSH tunnels left open | Laptops sleep, forwards linger, ports collide on next shift | Wrap forwards in scripts with ServerAliveInterval and explicit ExitOnForwardFailure. |
| Permanent VNC exposure | Break-glass becomes default remote desktop | ACL VNC to bastion IPs; pair with split ingress matrix for public webhooks. |
Numeric guardrails for on-call
- Break-glass budget: cap simultaneous VNC sessions to 1 per gateway host unless two-factor approval is logged.
- Tunnel TTL: default SSH forwards to 4 hours wall clock; renew deliberately.
- Evidence window: attach screenshots or CLI transcripts within 15 minutes of closing TCC prompts.
Seven HowTo steps (mirrored in JSON-LD)
- Classify the incident: file/config vs GUI consent vs network path.
- SSH first: collect
launchctl print, gateway version, and disk space. - Tunnel loopback admin instead of rebinding services to
en0. - VNC only when macOS shows a permission sheet that cannot be automated.
- Record evidence in the ticket—timestamps, panes touched, binaries moved.
- Re-tighten ingress using the split-proxy checklist; remove any “temporary” firewall holes.
- Drill monthly so the path is muscle memory, not improvisation.
FAQ
Should VNC be on the public internet for faster response?
No—terminate inside your bastion or provider controls; keep operator paths off raw internet scanning.
Where do I read baseline SSH onboarding?
Start with the help center for keys and access patterns; use VNC only when GUI consent (TCC) cannot be satisfied over SSH.
When should I add another dedicated gateway host?
When break-glass sessions collide with CI bursts or webhook spikes—see pricing to split prod and lab regions across Hong Kong, Japan, Korea, Singapore, and the United States.
Treating SSH as default and VNC as audited break-glass keeps OpenClaw gateways on Mac mini M4 honest: Apple Silicon performance does not waive native macOS consent rules. Pairing tunnels with the loopback admin story and split ingress stops panic-driven bind changes. Renting dedicated Mac mini M4 capacity in Hong Kong, Japan, Korea, Singapore, and the United States gives you isolated hosts where SSH-first operations and occasional VNC approvals coexist without laptop sleep breaking production. When matrices show collisions between operators and automation, scale with pricing instead of sharing one heroic gateway.