Split Regis line: firewall admin then CoS forwarder

projects/hermes-persistent-os/tasks.md

@@ -3,11 +3,13 @@
 ## Now (2026-09-26)
 
 - [x] Session-end persist Leonard, web app, cloudflared
-- [x] S4U / session 0 proof without reboot (At startup, parent = Task Scheduler)
+- [x] S4U / session 0 proof without reboot
 - [x] Gatekeeper ran `upgrade-to-s4u.ps1`
-- [x] CoS: launcher dies if wrapper dies, so a task stop or crash actually restarts the program
+- [x] Launcher dies if wrapper dies
 - [x] Phone on live tunnel `https://daughter-cards-fog-compete.trycloudflare.com`
-- [ ] Narrow Regis line: web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only
+- [ ] Gatekeeper: two firewall rules from admin PowerShell (allow Regis `100.64.0.6` to `100.64.0.1:8787`, block everyone else on that bind)
+- [ ] After `firewall done`: CoS adds forwarder under web app task, Regis status-check only
 - [ ] Later: drop Leonard off admin / Highest if it can be done without another Gatekeeper prompt
+- [ ] Later: existing `python.exe` allow-everything firewall rules (web app plus Python312 and OneDrive copy)
 
 See `memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md`.