From 98f056bd3a674828eb6664f1f4b5f9a04ccbda9c Mon Sep 17 00:00:00 2001 From: Ty Date: Sat, 26 Sep 2026 17:26:53 +0000 Subject: [PATCH] Record Regis /health 200; next is local-trust tighten --- .../04_projects/veripath/fleet-2026-09-26.md | 30 ++++++------------- 1 file changed, 9 insertions(+), 21 deletions(-) diff --git a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md index 36aa628..1cc68ce 100644 --- a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md +++ b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md @@ -1,6 +1,6 @@ # VeriPath fleet snapshot -Updated: 2026-09-26 10:20 PT +Updated: 2026-09-26 10:26 PT Do not store passwords, tokens, or keys in this file. ## Operating model @@ -13,7 +13,7 @@ Do not store passwords, tokens, or keys in this file. ## Adopted rules (2026-09-26) - Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email. -- Regis may hit `/health` and `/login` as HTTP status only. No login. No terminal. No password. +- Regis may hit `/health` only. No `/login`. No terminal. No password. - Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale. ## Persistence @@ -23,31 +23,19 @@ Web app: `127.0.0.1:8787` only. Healthy. Tunnel `/health` 200. Hermex live on `https://daughter-cards-fog-compete.trycloudflare.com`. Password only in `C:\Users\fight\Projects\hermes-webui\.env`. -## Regis line (2026-09-26 10:16 PT) +## Regis line (2026-09-26 10:26 PT) -Firewall enabled: -- `VeriPath WebUI from Regis` — Inbound Allow (`100.64.0.6` -> `100.64.0.1:8787`) -- `VeriPath WebUI block non-Regis` — Inbound Block +Firewall enabled. Forwarder live under `\VeriPath\Hermes_WebUI` (`regis-forward.py` on `100.64.0.1:8787` -> `127.0.0.1:8787`). -Forwarder live under `\VeriPath\Hermes_WebUI` only. -- `regis-forward.py` listens on `100.64.0.1:8787` and passes to `127.0.0.1:8787`. -- Second child of the same web app task. Stops/starts with the task. Retries bind every 5s if Headscale is late at boot. -- Old launcher backup: `webui.ps1.bak-regis-20260926`. +Regis `/health` from `100.64.0.6` returned **200** at 10:26 PT. Line works. -CoS proof at 10:16: -- Two listeners on 8787: `127.0.0.1` (app) and `100.64.0.1` (forwarder), same Task Scheduler launcher. -- `/health` 200 on both. Tunnel `/health` 200. Cloudflared not restarted. Hermex URL unchanged. -- `.env` login test passed. Stop/start killed both in ~3s and brought both back. -- Jimmy, Leonard, default profile, Tailscale, and other Python allow-all rules not touched. - -Not accepted: forwarder connections look local, so Hermes would give Regis first-password setup and the embedded terminal without a password. Status-check only until that is tightened. +Not accepted: forwarder connections look local, so Hermes would give Regis first-password setup and the embedded terminal without a password. CoS to close that gap now. Open: boot-time bind retry untested with a real reboot. Login test left one extra Hermes session. - -Also reported, not changed: `python.exe` allow-everything rules on the web app Python, `C:\Program Files\Python312`, and a copy under `OneDrive\Desktop\data\assets`. +Also reported, not changed: `python.exe` allow-everything rules. ## Open / next -1. Regis `/health` (and optional `/login` status code only). -2. Tighten so forwarder clients are not localhost-privileged. +1. Done: Regis `/health` 200. +2. CoS tightens so forwarder clients are not localhost-privileged. 3. Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, extra Hermes session, Telegram / NAT, Coach, default-profile token, client backlog.