diff --git a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md index bc13e33..bde3139 100644 --- a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md +++ b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md @@ -1,6 +1,6 @@ # VeriPath fleet snapshot -Updated: 2026-09-26 09:53 PT +Updated: 2026-09-26 10:03 PT Do not store passwords, tokens, or keys in this file. ## Operating model @@ -13,50 +13,39 @@ Do not store passwords, tokens, or keys in this file. ## Adopted rules (2026-09-26) - Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email. -- Park Regis-to-Hermes until launcher wrappers die with the Task Scheduler task, so a crash actually restarts. -- After that: web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only. +- Do not expose `100.64.0.1:8787` until allow-Regis plus block-everyone-else firewall rules exist. +- After firewall: small forwarder `100.64.0.1:8787` -> `127.0.0.1:8787`. Status-check test only. - Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale. -## Persistence (2026-09-26 09:53 PT) - -S4U / session 0 accepted without a reboot. Wrapper-stop bug closed by CoS at 09:50 without admin. - -Tasks at Highest, S4U as `fight`, At startup trigger: -- `\VeriPath\Hermes_WebUI` -- `\VeriPath\Cloudflared_Tunnel` -- `\VeriPath\Hermes_Gateway_leonard` - -Launchers in `C:\Users\fight\AppData\Local\VeriPath\` now: -- Check every 3 seconds that the Task Scheduler wrapper is alive. -- If the wrapper is gone or a `.disabled` file exists, stop the program and exit. -- If a new launcher finds an old leftover copy, shut it down and take over. -- Only touch their own program. Cannot catch Jimmy's gateway. -- Old scripts backed up as `*.ps1.bak-20260926`. Task definitions unchanged. - -CoS proof of wrapper fix: -- Stopped `Hermes_WebUI` at 09:49:13. By 09:49:16 port 8787 was dead. -- Started the task at 09:49:42. `/health` 200 at 09:49:49. -- Web app in session 0 under Task Scheduler, `127.0.0.1:8787` only, `.env` login passes. -- One tunnel copy. Public `/health` 200. -- One Leonard gateway in session 0. Telegram at 09:50:49. Jimmy task not touched. - -Unknown: something else tried to start Leonard at 09:48 and exited because Leonard was already running. Source not investigated. Do not start the default profile while looking. - -Side effect still open: Leonard runs elevated. `profiles\leonard` state unreadable to non-admin tools. +## Persistence +S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Tasks: `\VeriPath\Hermes_WebUI`, `\VeriPath\Cloudflared_Tunnel`, `\VeriPath\Hermes_Gateway_leonard`. +Launchers: `C:\Users\fight\AppData\Local\VeriPath\`. +Web app: `127.0.0.1:8787` only. Healthy. Tunnel `/health` 200. +Hermex live on `https://daughter-cards-fog-compete.trycloudflare.com`. +Live URL file: `%LOCALAPPDATA%\cloudflared\current-url.txt`. Password only in `C:\Users\fight\Projects\hermes-webui\.env`. -Web app still `127.0.0.1:8787` only. -Tunnel URL at 09:50: `https://daughter-cards-fog-compete.trycloudflare.com` -Prior URLs dead: `fridge-operations-agent-study`, `saving-bosnia-shades-pearl`, `indicated-forest-notify-low`. -Live URL file: `%LOCALAPPDATA%\cloudflared\current-url.txt` -Hermex 530 on the fridge-* URL was expected after rotate. +Leonard runs elevated. Unknown 09:48 Leonard start attempt, parked. -A real boot with nobody logged in is still the only 100% cold-boot test and was not done. +## Regis line (2026-09-26 10:03 PT) + +Stopped. Nothing exposed. Listen address not changed. + +Blocker: firewall rules need admin. Existing `python.exe` rule allows inbound any port from any address, so an allow-Regis rule alone would leave all of Headscale able to reach a `100.64.0.1` listener. + +Gatekeeper command, once, admin PowerShell: + +``` +New-NetFirewallRule -DisplayName 'VeriPath WebUI from Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 100.64.0.6 -Action Allow; New-NetFirewallRule -DisplayName 'VeriPath WebUI block non-Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 0.0.0.0-100.64.0.5,100.64.0.7-126.255.255.255,128.0.0.0-255.255.255.255 -Action Block +``` + +After `firewall done`, CoS adds a forwarder under the web app task, restarts only that task, then Regis status-check. + +Also reported, not changed: same allow-everything Python rules on `C:\Program Files\Python312` and a copy under `OneDrive\Desktop\data\assets`. ## Open / next -1. Done: launcher dies with wrapper. -2. Do not open `100.64.0.1` until Gatekeeper says the phone is on the live tunnel. -3. Then narrow Regis line if still wanted. -4. Parked: Leonard running elevated, unknown 09:48 Leonard start, Telegram flaps / NAT, Coach, default-profile token, client backlog. +1. Gatekeeper runs the two firewall rules. +2. CoS forwarder + Regis status-check. +3. Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, Telegram / NAT, Coach, default-profile token, client backlog.