Tony_tech/personal-agent-os
6
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add VeriPath fleet snapshot and Gatekeeper rules for 2026-09-26

Browse Source
This commit is contained in:
Ty
2026-09-26 16:16:10 +00:00
parent 548e79b509
commit 5dc337b9d8
1 changed files with 98 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md
+98
View File
@@ -0,0 +1,98 @@
# VeriPath fleet snapshot
Updated: 2026-09-26 09:15 PT
Source: Gatekeeper handover + password-change confirmation.
Do not store passwords, tokens, or keys in this file.
## Operating model
- Anthony (Gatekeeper) only makes irreversible calls: job go/no-go, starting evidence snapshot, publish, send, spend, and logins only he can do.
- Grok Bot Chief of Staff designs process, picks infrastructure, and runs the operation.
- Keep Ty / Headscale admin out unless Gatekeeper authorizes it.
- Nothing is sent without an explicit go.
- Simplest fix first. No infra that snowballs.
- Gitea is the master record. Desktop Obsidian is a thin map plus lessons.
- Client work queue: `Tony_tech/veripath-operations`.
- Product / audits / evidence: `Tony_tech/veripath`.
- Fleet and agent-OS record: this repo. Do not put fleet state in `veripath-operations`.
## Adopted rules (2026-09-26)
- CoS runs everything it can without Gatekeeper.
- Regis may research, draft, and check status. Nothing irreversible.
- Regis produces artifacts only. VeriMail owns email. Regis does not post or send.
- Park the Regis-to-Hermes line until boot persistence is real.
- After persistence: smallest listen only. Web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only.
- Desktop stays on Headscale as `HS_tony` / `100.64.0.1`.
- iPhone stays on personal Tailscale, not Headscale.
## Machines
| Name | Role | Headscale |
|---|---|---|
| DESKTOP-81CBTV2 (Windows user `fight`) | Hosts Hermes agents + Hermes web app | `100.64.0.1` HS_tony |
| DESKTOP-AEI8KMV | Separate Hermes install, Steve profile | |
| muse-regis | Muse / overflow capture. Artifacts only. Outgoing only | `100.64.0.6` |
| deepblueubu | Model server | `100.64.0.2:8084` |
| ubudual5060 | VeriMail model | `100.64.0.9:8082` |
| omarmacmini | Expected | `.4` |
| grokbot-box-1 | Offline since 2026-09-20 | `.3` |
| grokbot-box-2 | HS_ty | `.7` |
| ubuntu | HS_shared | `.10` |
Model servers were healthy at 08:55 PT on 2026-09-26.
## Hermes agents (desktop)
- Jimmy and Leonard are the only Telegram-connected agents. Restarted 08:08 PT 2026-09-26.
- Jimmy: Nous model provider.
- Leonard: deepseek-v4-flash via routeapi. Not deepblueubu.
- Ashbot (xAI) and VeriMail (ubudual5060) running, no Telegram.
- Coach configured model is down. A similar model was running at `127.0.0.1:8899` and is a candidate only with a later go.
- Default profile points at offline grokbot-box-1 and holds a duplicate of Jimmy's Telegram token. Do not start the default gateway.
- Only Jimmy auto-starts on desktop boot.
## Phone / web app
- Hermes web app: desktop `127.0.0.1:8787`, password login.
- Hermex iPhone reaches it through a temporary Cloudflare tunnel on the desktop. URL changes on tunnel restart or desktop reboot.
- Permanent Cloudflare hostname is not set up.
- Password changed 2026-09-26. Old password rejected. New password works. Phone address unchanged.
- New password lives only in `C:\Users\fight\Projects\hermes-webui\.env`. Not recorded here.
- All existing sessions were logged out. Hermex needs the new password once.
- Web app was running under Gatekeeper's remote session at confirmation time. It may stop if that session ends. Boot persistence must not depend on an interactive / RDP session.
## Open problems
1. Jimmy and Leonard Telegram connections drop every 2-4 minutes and recover in seconds. Continues after restart. Likely double NAT (router outside `10.0.0.121`, public `76.149.57.201`) plus Tailscale relays. Possible fix is ISP modem bridge mode. Parked. Do not involve Ty.
2. Coach model down. Parked.
3. Only Jimmy survives reboot. Leonard, web app, and tunnel do not. Next work.
4. Web app process is tied to the current remote session. Same persistence work.
## Next work (order)
1. Done: change web app password, log out old sessions.
2. Now: boot persistence for Leonard, web app, and cloudflared. Must survive reboot and RDP / remote-session end.
3. Then: narrow Regis line if Gatekeeper still wants it.
4. Later: Telegram / NAT, Coach retarget, default-profile token cleanup, backlog.
## Persistence constraint
Do not use a Startup-folder or interactive-session process as the only start method. The web app already dies when the remote session ends. Use a Windows scheduled task or service that runs whether the user is logged on or not.
## Backlog (parked)
- Phoenix Salon close-out letter
- Birdeye re-scan by VeriMail (AgentMail key missing)
- Review unexpected Thornhill run Jimmy pushed to Gitea
- Add VeriMail Python environment lesson to Gitea
- Shared desktop drop folder for Regis artifacts
- Delete stale Phoenix reminder
- Decide whether to restart paused Hermes status watcher
- Coach other model machine bonsai-3060 is not on Headscale
## Regis networking (2026-09-26 09:00 PT)
- Sees every Headscale machine and can reach both model servers.
- Outgoing only through runtime proxy. No SSH, no incoming, no Tailscale ping. Cannot change that from inside the VM.
- Cannot reach Hermes today because the web app is local-only.