Tailscale is not connected
If the Tailscale app does not show Connected or your workspace VM is missing from tailscale status, your device is not in the workspace network. Sign in to the platform’s server, not to an ordinary Tailscale account (Set up Tailscale).
RDP or the desktop does not respond
Compare hostname, port, and username with the Connect dialog on the workspace card, restart your RDP client, and connect again; shortly after the VM starts, the services need a moment. workspace-<slug>.workspaces.vpn.application-platform.com is only resolved through Tailscale; a foreign host name under workspaces-dev.application-platform.com is the public gateway DNS.
Windows App on macOS: password prompt, then nothing
If the Windows App shows neither connection nor error message after the local password dialog, check in the terminal:
tailscale statusshows the workspace VM as online.dscacheutil -q host -a name workspace-<slug>.workspaces.vpn.application-platform.comreturns an IP from100.64.x.x.nc -vz workspace-<slug>.workspaces.vpn.application-platform.com 3389reports the port as reachable.
If steps 2 and 3 work, test with the Tailscale IP instead of the MagicDNS name, or use FreeRDP (sdl-freerdp) with /cert:ignore for a clear error message. The logs under ~/Library/Containers/com.microsoft.rdc.macos/Data/Library/Logs/Windows App/ indicate a DNS or routing problem with Name resolution failed or Connection refused, and a sign-in problem with a successful RDP handshake.
Error 0x207 (“expired password”)
“expired password” with Error code: 0x207 is misleading; usually the password does not match gnome-remote-desktop on the VM, or the CredSSP/NLA handshake fails. Copy the password from the Connect dialog; if FreeRDP with /cert:ignore reports AUTHENTICATION_FAILED, reset the credentials on the VM (grdctl --system rdp set-credentials …).
If only the Windows App shows 0x207 or SSL_ERR_HANDSHAKE_FAILED, the .rdp file needs this line (the platform’s file already sets it):
use redirection server name:i:1
Delete old PC entries in the Windows App and open the file again, or use sdl-freerdp … /cert:ignore /gfx.
A tool is missing
In a new terminal, check the versions with asdf current, change into the project folder with the .tool-versions, and run ap run-local again; ap doctor shows which tool is missing.
A port is in use
Stop the old process or Docker container that occupies the port and start ap run-local again; ap ports shows which port belongs to which repository. Backends use docker compose, frontends and homepages fixed ports.
A project folder is missing
Check whether the repository is cloned in the shared project folder; if it is missing, clone it from the GitLab group (Working with projects).