# v8.8 Network Sync (Tailscale + WebDAV) Implementation Plan

> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

**Goal:** Add optional network sync/serve capabilities for Engram memory directories over private networking and WebDAV-compatible clients.

**Architecture:** Provide a strict opt-in networking layer with clear security boundaries: private-network sync helpers and local WebDAV serving for selected directories. Keep this isolated from default plugin runtime.

**Tech Stack:** TypeScript, `src/network/*`, `src/cli.ts`, Node HTTP modules, node:test.

---

## Requirements

1. All networking features disabled by default.
2. Explicit allowlist of directories exposed via WebDAV.
3. Optional basic auth support for WebDAV endpoints.
4. Tailscale helper commands only operate when binary/service is available.
5. No automatic public exposure/funnel behavior by default.

## Task 1: WebDAV service module

**Files:**
- Create: `src/network/webdav.ts`
- Test: `tests/network-webdav.test.ts`

## Task 2: Tailscale helper module

**Files:**
- Create: `src/network/tailscale.ts`
- Test: `tests/network-tailscale.test.ts`

## Task 3: CLI command surfaces

**Files:**
- Modify: `src/cli.ts`
- Test: `tests/cli-network-commands.test.ts`

Commands:
- `openclaw engram tailscale-status`
- `openclaw engram tailscale-sync`
- `openclaw engram webdav-serve`
- `openclaw engram webdav-stop`

## Task 4: Security + docs

**Files:**
- Modify: `docs/operations.md`
- Modify: `SECURITY.md`
- Modify: `CHANGELOG.md`

