Problem
A brokered self-host engine behind NAT/Tailscale has no public inbound URL, but the central Orb only supported push relay delivery (POST to the engine's registered relay URL). Diagnosed live: the engine's relay URL was a tailnet hostname with no Tailscale serve/funnel config, so the Orb's pushes were unreachable — 257 events failed to deliver for the active install, and the engine received zero fresh PR events (reviews ran only via the periodic re-gate sweep, never within minutes of a PR opening).
Fix
Wire the engine side of pull mode (the server side — /v1/orb/relay/pull + enqueueRelayPending + forwardOrbEvent's pull path — already exists): ORB_RELAY_MODE=pull registers with no relay URL and a 15s drain loop pulls events outbound + enqueues them into the WEBHOOKS lane. No inbound endpoint is exposed (more secure than push). Set ORB_RELAY_MODE=pull in the self-host .env.
Problem
A brokered self-host engine behind NAT/Tailscale has no public inbound URL, but the central Orb only supported push relay delivery (POST to the engine's registered relay URL). Diagnosed live: the engine's relay URL was a tailnet hostname with no Tailscale serve/funnel config, so the Orb's pushes were unreachable — 257 events failed to deliver for the active install, and the engine received zero fresh PR events (reviews ran only via the periodic re-gate sweep, never within minutes of a PR opening).
Fix
Wire the engine side of pull mode (the server side — /v1/orb/relay/pull + enqueueRelayPending + forwardOrbEvent's pull path — already exists):
ORB_RELAY_MODE=pullregisters with no relay URL and a 15s drain loop pulls events outbound + enqueues them into the WEBHOOKS lane. No inbound endpoint is exposed (more secure than push). SetORB_RELAY_MODE=pullin the self-host .env.