# VeriPath fleet snapshot

Updated: 2026-09-26 10:03 PT
Do not store passwords, tokens, or keys in this file.

## Operating model

- Anthony (Gatekeeper): irreversible calls only.
- CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin.
- No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go.
- Gitea is the master record. Fleet lives here, not in `veripath-operations`.

## Adopted rules (2026-09-26)

- Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
- Do not expose `100.64.0.1:8787` until allow-Regis plus block-everyone-else firewall rules exist.
- After firewall: small forwarder `100.64.0.1:8787` -> `127.0.0.1:8787`. Status-check test only.
- Desktop stays Headscale `HS_tony` / `100.64.0.1`. iPhone stays personal Tailscale.

## Persistence

S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Tasks: `\VeriPath\Hermes_WebUI`, `\VeriPath\Cloudflared_Tunnel`, `\VeriPath\Hermes_Gateway_leonard`.
Launchers: `C:\Users\fight\AppData\Local\VeriPath\`.
Web app: `127.0.0.1:8787` only. Healthy. Tunnel `/health` 200.
Hermex live on `https://daughter-cards-fog-compete.trycloudflare.com`.
Live URL file: `%LOCALAPPDATA%\cloudflared\current-url.txt`.
Password only in `C:\Users\fight\Projects\hermes-webui\.env`.

Leonard runs elevated. Unknown 09:48 Leonard start attempt, parked.

## Regis line (2026-09-26 10:03 PT)

Stopped. Nothing exposed. Listen address not changed.

Blocker: firewall rules need admin. Existing `python.exe` rule allows inbound any port from any address, so an allow-Regis rule alone would leave all of Headscale able to reach a `100.64.0.1` listener.

Gatekeeper command, once, admin PowerShell:

```
New-NetFirewallRule -DisplayName 'VeriPath WebUI from Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 100.64.0.6 -Action Allow; New-NetFirewallRule -DisplayName 'VeriPath WebUI block non-Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 0.0.0.0-100.64.0.5,100.64.0.7-126.255.255.255,128.0.0.0-255.255.255.255 -Action Block
```

After `firewall done`, CoS adds a forwarder under the web app task, restarts only that task, then Regis status-check.

Also reported, not changed: same allow-everything Python rules on `C:\Program Files\Python312` and a copy under `OneDrive\Desktop\data\assets`.

## Open / next

1. Gatekeeper runs the two firewall rules.
2. CoS forwarder + Regis status-check.
3. Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, Telegram / NAT, Coach, default-profile token, client backlog.