# tunnels

**Apps & urls.** Git worktrees separate files. Tunnels give those worktrees separate running apps, so the checkout agent cannot take over the catalog agent's port.

*Like separate paths through a nest: each worker reaches its own app.*

*each worker gets its own running app.*
*Two shop worktrees start separate API and web processes. Each passes its health check before its own browser address opens.*

## ready means you can use it

In the shop, each worker runs a Vite storefront and a Node API. antil picks their ports, starts the API first, and waits for its `/health` check. Then it starts the storefront. An app gets a live address only after antil verifies its process owns the port and its readiness check passes.

This catches an easy mistake: a server that ignores its assigned port must not borrow a successful health response from somebody else's server.

## an address belongs to a worker

Each app has a direct loopback address and a named local HTTP URL. Your browser or agent reads it from `status --json`. An ended or unready worker does not keep serving through its named URL. These addresses work on this machine; [HTTPS over your private network is coming](/docs/tunnels/https/).

Tunnels use [chambers](/docs/chambers/) for data and will give [seals](/docs/seals/) the running environment behind a test. The [foundation](/docs/foundation/) keeps the same state available to a replacement agent.

[Open the right app](/docs/tunnels/open-apps/) · [configure the shop](/docs/tunnels/configure-apps/) · [pause a worker](/docs/tunnels/pause/)