From eae9401de70e2d71a09b79f5060fe5928ffd7a40 Mon Sep 17 00:00:00 2001 From: Ty Date: Sat, 26 Sep 2026 16:38:53 +0000 Subject: [PATCH] Record S4U Running on VeriPath persistence tasks --- .../04_projects/veripath/fleet-2026-09-26.md | 119 ++++++------------ 1 file changed, 35 insertions(+), 84 deletions(-) diff --git a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md index b3d053e..dbdb01c 100644 --- a/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md +++ b/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md @@ -1,108 +1,59 @@ # VeriPath fleet snapshot -Updated: 2026-09-26 09:34 PT -Source: Gatekeeper handover + CoS desktop report. +Updated: 2026-09-26 09:38 PT Do not store passwords, tokens, or keys in this file. ## Operating model -- Anthony (Gatekeeper) only makes irreversible calls: job go/no-go, starting evidence snapshot, publish, send, spend, and logins only he can do. -- Grok Bot Chief of Staff designs process, picks infrastructure, and runs the operation. CoS is Grok Bot and has the desktop. -- Hermes agents can also use the desktop. They do not have Windows admin rights. -- Keep Ty / Headscale admin out unless Gatekeeper authorizes it. -- Nothing is sent without an explicit go. -- Simplest fix first. No infra that snowballs. -- Gitea is the master record. Desktop Obsidian is a thin map plus lessons. -- Client work queue: `Tony_tech/veripath-operations`. -- Product / audits / evidence: `Tony_tech/veripath`. -- Fleet and agent-OS record: this repo. Do not put fleet state in `veripath-operations`. +- Anthony (Gatekeeper): irreversible calls only. +- CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin. +- No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go. +- Gitea is the master record. Fleet lives here, not in `veripath-operations`. +- Product: `Tony_tech/veripath`. Client queue: `Tony_tech/veripath-operations`. ## Adopted rules (2026-09-26) -- CoS runs everything it can without Gatekeeper. -- Regis may research, draft, and check status. Nothing irreversible. -- Regis produces artifacts only. VeriMail owns email. Regis does not post or send. -- Park the Regis-to-Hermes line until boot persistence is real (tasks start with nobody logged in). -- After persistence: smallest listen only. Web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only. -- Desktop stays on Headscale as `HS_tony` / `100.64.0.1`. -- iPhone stays on personal Tailscale, not Headscale. +- Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email. +- Park Regis-to-Hermes until CoS proves the three tasks start with nobody logged in. +- After that: web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only. +- Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale. -## Persistence (2026-09-26 09:32 PT) +## Persistence (2026-09-26 09:38 PT) -Status: partial. Session-end is fixed. Cold boot is not. +Status: S4U on. Cold-boot proof still owed by CoS. -Tasks (Task Scheduler, not services): -- `\VeriPath\Hermes_WebUI` -- `\VeriPath\Cloudflared_Tunnel` -- `\VeriPath\Hermes_Gateway_leonard` +Tasks: +- `\VeriPath\Hermes_WebUI` Running S4U +- `\VeriPath\Cloudflared_Tunnel` Running S4U +- `\VeriPath\Hermes_Gateway_leonard` Running S4U -Each starts at logon, restarts every minute if it fails, and uses a launcher that restarts the program if it exits. Launchers and logs: `C:\Users\fight\AppData\Local\VeriPath\`. Web app launcher reads the password from `.env` at start. Password is not in the task or the script. +Launchers and logs: `C:\Users\fight\AppData\Local\VeriPath\`. Password still only in `C:\Users\fight\Projects\hermes-webui\.env`. +Web app still bound to `127.0.0.1:8787` only. +Gatekeeper ran `upgrade-to-s4u.ps1` from admin PowerShell at 09:38 PT. -Proved by CoS: -- Live processes were moved under Task Scheduler. Old session-tied web app was killed. -- From a fresh session: `127.0.0.1:8787/health` returned 200, public tunnel returned 200, new password login passed. -- Leonard connected to Telegram at 09:32 PT. Exactly one Leonard gateway running. -- Web app still bound to `127.0.0.1:8787` only. Default profile, Jimmy's existing task, Coach, NAT, Tailscale, and firewall were not touched. - -Blocker: tasks run only while user `fight` is logged in. After reboot, nothing starts until someone logs in. Switching to "run whether user is logged on or not" plus an at-boot trigger needs administrator rights. CoS remote session is not elevated. Jimmy and Leonard cannot approve a UAC prompt. - -Gatekeeper-only command, once, from an admin PowerShell on the desktop: -`powershell -ExecutionPolicy Bypass -File C:\Users\fight\AppData\Local\VeriPath\upgrade-to-s4u.ps1` - -Tunnel URL changes on every restart. Current URL at last report: `https://fridge-operations-agent-study.trycloudflare.com`. Live URL is always in `%LOCALAPPDATA%\cloudflared\current-url.txt`. +Tunnel URL rotates. Last reported: `https://fridge-operations-agent-study.trycloudflare.com`. Live URL: `%LOCALAPPDATA%\cloudflared\current-url.txt`. ## Machines | Name | Role | Headscale | |---|---|---| -| DESKTOP-81CBTV2 (Windows user `fight`) | Hosts Hermes agents + Hermes web app | `100.64.0.1` HS_tony | -| DESKTOP-AEI8KMV | Separate Hermes install, Steve profile | | -| muse-regis | Muse / overflow capture. Artifacts only. Outgoing only | `100.64.0.6` | -| deepblueubu | Model server | `100.64.0.2:8084` | +| DESKTOP-81CBTV2 (`fight`) | Hermes + web app | `100.64.0.1` HS_tony | +| DESKTOP-AEI8KMV | Steve Hermes | | +| muse-regis | overflow capture, artifacts only | `100.64.0.6` | +| deepblueubu | model | `100.64.0.2:8084` | | ubudual5060 | VeriMail model | `100.64.0.9:8082` | -| omarmacmini | Expected | `.4` | -| grokbot-box-1 | Offline since 2026-09-20 | `.3` | -| grokbot-box-2 | HS_ty | `.7` | -| ubuntu | HS_shared | `.10` | +| grokbot-box-1 | offline since 2026-09-20 | `.3` | -## Hermes agents (desktop) +## Agents -- Jimmy and Leonard are the only Telegram-connected agents. -- Jimmy: Nous model provider. -- Leonard: deepseek-v4-flash via routeapi. Not deepblueubu. Task-managed as of 09:32 PT. -- Ashbot (xAI) and VeriMail (ubudual5060) running, no Telegram. -- Coach configured model is down. Parked. -- Default profile points at offline grokbot-box-1 and holds a duplicate of Jimmy's Telegram token. Do not start the default gateway. -- Jimmy already had an auto-start path. Do not duplicate it. +- Jimmy: Nous, Telegram. Existing auto-start. Do not duplicate. +- Leonard: deepseek-v4-flash via routeapi, Telegram, now task-managed. +- Ashbot and VeriMail running, no Telegram. +- Coach down. Parked. +- Default profile: offline grokbot-box-1 + duplicate Jimmy token. Do not start. -## Phone / web app +## Open / next -- Hermes web app: `127.0.0.1:8787`, password login. Bound local-only. -- Hermex uses the temporary Cloudflare tunnel. URL changes on tunnel restart. -- Password changed 2026-09-26. Lives only in `C:\Users\fight\Projects\hermes-webui\.env`. - -## Open problems - -1. Telegram flaps every 2-4 minutes. Likely double NAT. Parked. No Ty. -2. Coach model down. Parked. -3. Cold-boot persistence needs one admin elevation. Blocked on Gatekeeper. -4. Temporary Cloudflare URL rotates. Permanent hostname not set up. - -## Next work (order) - -1. Done: password change. -2. Partial: session-end persistence. -3. Now: Gatekeeper runs `upgrade-to-s4u.ps1` once as admin. -4. Then: narrow Regis line if still wanted. -5. Later: Telegram / NAT, Coach, default-profile token, backlog. - -## Backlog (parked) - -- Phoenix Salon close-out letter -- Birdeye re-scan by VeriMail (AgentMail key missing) -- Review unexpected Thornhill run Jimmy pushed to Gitea -- Add VeriMail Python environment lesson to Gitea -- Shared desktop drop folder for Regis artifacts -- Delete stale Phoenix reminder -- Decide whether to restart paused Hermes status watcher -- Coach other model machine bonsai-3060 is not on Headscale +1. CoS proves S4U tasks start with nobody logged in. +2. Then narrow Regis line if still wanted. +3. Parked: Telegram flaps / NAT, Coach, default-profile token, client backlog.