Record partial persistence and admin-elevation blocker

2026-09-26 16:34:50 +00:00
parent 676d8ade71
commit 61b912008b
1 changed files with 44 additions and 34 deletions
@@ -1,13 +1,14 @@
 # VeriPath fleet snapshot
-Updated: 2026-09-26 09:15 PT
+Updated: 2026-09-26 09:34 PT
-Source: Gatekeeper handover + password-change confirmation.
+Source: Gatekeeper handover + CoS desktop report.
 Do not store passwords, tokens, or keys in this file.
 ## Operating model
 - Anthony (Gatekeeper) only makes irreversible calls: job go/no-go, starting evidence snapshot, publish, send, spend, and logins only he can do.
- Grok Bot Chief of Staff designs process, picks infrastructure, and runs the operation.
+- Grok Bot Chief of Staff designs process, picks infrastructure, and runs the operation. CoS is Grok Bot and has the desktop.
 - Hermes agents can also use the desktop. They do not have Windows admin rights.
 - Keep Ty / Headscale admin out unless Gatekeeper authorizes it.
 - Nothing is sent without an explicit go.
 - Simplest fix first. No infra that snowballs.
@@ -21,11 +22,35 @@ Do not store passwords, tokens, or keys in this file.
 - CoS runs everything it can without Gatekeeper.
 - Regis may research, draft, and check status. Nothing irreversible.
 - Regis produces artifacts only. VeriMail owns email. Regis does not post or send.
- Park the Regis-to-Hermes line until boot persistence is real.
+- Park the Regis-to-Hermes line until boot persistence is real (tasks start with nobody logged in).
 - After persistence: smallest listen only. Web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only.
 - Desktop stays on Headscale as `HS_tony` / `100.64.0.1`.
 - iPhone stays on personal Tailscale, not Headscale.
 ## Persistence (2026-09-26 09:32 PT)
 Status: partial. Session-end is fixed. Cold boot is not.
 Tasks (Task Scheduler, not services):
 - `\VeriPath\Hermes_WebUI`
 - `\VeriPath\Cloudflared_Tunnel`
 - `\VeriPath\Hermes_Gateway_leonard`
 Each starts at logon, restarts every minute if it fails, and uses a launcher that restarts the program if it exits. Launchers and logs: `C:\Users\fight\AppData\Local\VeriPath\`. Web app launcher reads the password from `.env` at start. Password is not in the task or the script.
 Proved by CoS:
 - Live processes were moved under Task Scheduler. Old session-tied web app was killed.
 - From a fresh session: `127.0.0.1:8787/health` returned 200, public tunnel returned 200, new password login passed.
 - Leonard connected to Telegram at 09:32 PT. Exactly one Leonard gateway running.
 - Web app still bound to `127.0.0.1:8787` only. Default profile, Jimmy's existing task, Coach, NAT, Tailscale, and firewall were not touched.
 Blocker: tasks run only while user `fight` is logged in. After reboot, nothing starts until someone logs in. Switching to "run whether user is logged on or not" plus an at-boot trigger needs administrator rights. CoS remote session is not elevated. Jimmy and Leonard cannot approve a UAC prompt.
 Gatekeeper-only command, once, from an admin PowerShell on the desktop:
 `powershell -ExecutionPolicy Bypass -File C:\Users\fight\AppData\Local\VeriPath\upgrade-to-s4u.ps1`
 Tunnel URL changes on every restart. Current URL at last report: `https://fridge-operations-agent-study.trycloudflare.com`. Live URL is always in `%LOCALAPPDATA%\cloudflared\current-url.txt`.
 ## Machines
 | Name | Role | Headscale |
@@ -40,45 +65,36 @@ Do not store passwords, tokens, or keys in this file.
 | grokbot-box-2 | HS_ty | `.7` |
 | ubuntu | HS_shared | `.10` |
 Model servers were healthy at 08:55 PT on 2026-09-26.
 ## Hermes agents (desktop)
- Jimmy and Leonard are the only Telegram-connected agents. Restarted 08:08 PT 2026-09-26.
+- Jimmy and Leonard are the only Telegram-connected agents.
 - Jimmy: Nous model provider.
- Leonard: deepseek-v4-flash via routeapi. Not deepblueubu.
+- Leonard: deepseek-v4-flash via routeapi. Not deepblueubu. Task-managed as of 09:32 PT.
 - Ashbot (xAI) and VeriMail (ubudual5060) running, no Telegram.
- Coach configured model is down. A similar model was running at `127.0.0.1:8899` and is a candidate only with a later go.
+- Coach configured model is down. Parked.
 - Default profile points at offline grokbot-box-1 and holds a duplicate of Jimmy's Telegram token. Do not start the default gateway.
- Only Jimmy auto-starts on desktop boot.
+- Jimmy already had an auto-start path. Do not duplicate it.
 ## Phone / web app
- Hermes web app: desktop `127.0.0.1:8787`, password login.
+- Hermes web app: `127.0.0.1:8787`, password login. Bound local-only.
- Hermex iPhone reaches it through a temporary Cloudflare tunnel on the desktop. URL changes on tunnel restart or desktop reboot.
+- Hermex uses the temporary Cloudflare tunnel. URL changes on tunnel restart.
- Permanent Cloudflare hostname is not set up.
+- Password changed 2026-09-26. Lives only in `C:\Users\fight\Projects\hermes-webui\.env`.
 - Password changed 2026-09-26. Old password rejected. New password works. Phone address unchanged.
 - New password lives only in `C:\Users\fight\Projects\hermes-webui\.env`. Not recorded here.
 - All existing sessions were logged out. Hermex needs the new password once.
 - Web app was running under Gatekeeper's remote session at confirmation time. It may stop if that session ends. Boot persistence must not depend on an interactive / RDP session.
 ## Open problems
-1. Jimmy and Leonard Telegram connections drop every 2-4 minutes and recover in seconds. Continues after restart. Likely double NAT (router outside `10.0.0.121`, public `76.149.57.201`) plus Tailscale relays. Possible fix is ISP modem bridge mode. Parked. Do not involve Ty.
+1. Telegram flaps every 2-4 minutes. Likely double NAT. Parked. No Ty.
 2. Coach model down. Parked.
-3. Only Jimmy survives reboot. Leonard, web app, and tunnel do not. Next work.
+3. Cold-boot persistence needs one admin elevation. Blocked on Gatekeeper.
-4. Web app process is tied to the current remote session. Same persistence work.
+4. Temporary Cloudflare URL rotates. Permanent hostname not set up.
 ## Next work (order)
-1. Done: change web app password, log out old sessions.
+1. Done: password change.
-2. Now: boot persistence for Leonard, web app, and cloudflared. Must survive reboot and RDP / remote-session end.
+2. Partial: session-end persistence.
-3. Then: narrow Regis line if Gatekeeper still wants it.
+3. Now: Gatekeeper runs `upgrade-to-s4u.ps1` once as admin.
-4. Later: Telegram / NAT, Coach retarget, default-profile token cleanup, backlog.
+4. Then: narrow Regis line if still wanted.
-
+5. Later: Telegram / NAT, Coach, default-profile token, backlog.
 ## Persistence constraint
 Do not use a Startup-folder or interactive-session process as the only start method. The web app already dies when the remote session ends. Use a Windows scheduled task or service that runs whether the user is logged on or not.
 ## Backlog (parked)
@@ -90,9 +106,3 @@ Do not use a Startup-folder or interactive-session process as the only start met
 - Delete stale Phoenix reminder
 - Decide whether to restart paused Hermes status watcher
 - Coach other model machine bonsai-3060 is not on Headscale
 ## Regis networking (2026-09-26 09:00 PT)
 - Sees every Headscale machine and can reach both model servers.
 - Outgoing only through runtime proxy. No SSH, no incoming, no Tailscale ping. Cannot change that from inside the VM.
 - Cannot reach Hermes today because the web app is local-only.