Tony_tech/personal-agent-os
6
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Record Regis forwarder live; local-trust not accepted

Browse Source
This commit is contained in:
Ty
2026-09-26 17:20:30 +00:00
parent 2e3f2b5db7
commit b2144691bf
1 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md
+22 -9
View File
@@ -1,6 +1,6 @@
# VeriPath fleet snapshot # VeriPath fleet snapshot
Updated: 2026-09-26 10:04 PT Updated: 2026-09-26 10:20 PT
Do not store passwords, tokens, or keys in this file. Do not store passwords, tokens, or keys in this file.
## Operating model ## Operating model
@@ -13,7 +13,7 @@ Do not store passwords, tokens, or keys in this file.
## Adopted rules (2026-09-26) ## Adopted rules (2026-09-26)
- Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email. - Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
- After firewall: small forwarder `100.64.0.1:8787` -> `127.0.0.1:8787`. Status-check test only. - Regis may hit `/health` and `/login` as HTTP status only. No login. No terminal. No password.
- Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale. - Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale.
## Persistence ## Persistence
@@ -23,18 +23,31 @@ Web app: `127.0.0.1:8787` only. Healthy. Tunnel `/health` 200.
Hermex live on `https://daughter-cards-fog-compete.trycloudflare.com`. Hermex live on `https://daughter-cards-fog-compete.trycloudflare.com`.
Password only in `C:\Users\fight\Projects\hermes-webui\.env`. Password only in `C:\Users\fight\Projects\hermes-webui\.env`.
## Regis line (2026-09-26 10:04 PT) ## Regis line (2026-09-26 10:16 PT)
Firewall done. Both rules Enabled, PrimaryStatus OK: Firewall enabled:
- `VeriPath WebUI from Regis` — Inbound Allow - `VeriPath WebUI from Regis` — Inbound Allow (`100.64.0.6` -> `100.64.0.1:8787`)
- `VeriPath WebUI block non-Regis` — Inbound Block - `VeriPath WebUI block non-Regis` — Inbound Block
Listen address not changed yet. Next is CoS forwarder under `\VeriPath\Hermes_WebUI` only, then Regis status-check. Forwarder live under `\VeriPath\Hermes_WebUI` only.
- `regis-forward.py` listens on `100.64.0.1:8787` and passes to `127.0.0.1:8787`.
- Second child of the same web app task. Stops/starts with the task. Retries bind every 5s if Headscale is late at boot.
- Old launcher backup: `webui.ps1.bak-regis-20260926`.
CoS proof at 10:16:
- Two listeners on 8787: `127.0.0.1` (app) and `100.64.0.1` (forwarder), same Task Scheduler launcher.
- `/health` 200 on both. Tunnel `/health` 200. Cloudflared not restarted. Hermex URL unchanged.
- `.env` login test passed. Stop/start killed both in ~3s and brought both back.
- Jimmy, Leonard, default profile, Tailscale, and other Python allow-all rules not touched.
Not accepted: forwarder connections look local, so Hermes would give Regis first-password setup and the embedded terminal without a password. Status-check only until that is tightened.
Open: boot-time bind retry untested with a real reboot. Login test left one extra Hermes session.
Also reported, not changed: `python.exe` allow-everything rules on the web app Python, `C:\Program Files\Python312`, and a copy under `OneDrive\Desktop\data\assets`. Also reported, not changed: `python.exe` allow-everything rules on the web app Python, `C:\Program Files\Python312`, and a copy under `OneDrive\Desktop\data\assets`.
## Open / next ## Open / next
1. Done: firewall rules. 1. Regis `/health` (and optional `/login` status code only).
2. CoS forwarder + Regis status-check. 2. Tighten so forwarder clients are not localhost-privileged.
3. Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, Telegram / NAT, Coach, default-profile token, client backlog. 3. Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, extra Hermes session, Telegram / NAT, Coach, default-profile token, client backlog.