# VeriPath fleet snapshot

Updated: 2026-09-26 09:34 PT
Source: Gatekeeper handover + CoS desktop report.
Do not store passwords, tokens, or keys in this file.

## Operating model

- Anthony (Gatekeeper) only makes irreversible calls: job go/no-go, starting evidence snapshot, publish, send, spend, and logins only he can do.
- Grok Bot Chief of Staff designs process, picks infrastructure, and runs the operation. CoS is Grok Bot and has the desktop.
- Hermes agents can also use the desktop. They do not have Windows admin rights.
- Keep Ty / Headscale admin out unless Gatekeeper authorizes it.
- Nothing is sent without an explicit go.
- Simplest fix first. No infra that snowballs.
- Gitea is the master record. Desktop Obsidian is a thin map plus lessons.
- Client work queue: `Tony_tech/veripath-operations`.
- Product / audits / evidence: `Tony_tech/veripath`.
- Fleet and agent-OS record: this repo. Do not put fleet state in `veripath-operations`.

## Adopted rules (2026-09-26)

- CoS runs everything it can without Gatekeeper.
- Regis may research, draft, and check status. Nothing irreversible.
- Regis produces artifacts only. VeriMail owns email. Regis does not post or send.
- Park the Regis-to-Hermes line until boot persistence is real (tasks start with nobody logged in).
- After persistence: smallest listen only. Web app on `100.64.0.1`, firewall allow `100.64.0.6` only, status-check test only.
- Desktop stays on Headscale as `HS_tony` / `100.64.0.1`.
- iPhone stays on personal Tailscale, not Headscale.

## Persistence (2026-09-26 09:32 PT)

Status: partial. Session-end is fixed. Cold boot is not.

Tasks (Task Scheduler, not services):
- `\VeriPath\Hermes_WebUI`
- `\VeriPath\Cloudflared_Tunnel`
- `\VeriPath\Hermes_Gateway_leonard`

Each starts at logon, restarts every minute if it fails, and uses a launcher that restarts the program if it exits. Launchers and logs: `C:\Users\fight\AppData\Local\VeriPath\`. Web app launcher reads the password from `.env` at start. Password is not in the task or the script.

Proved by CoS:
- Live processes were moved under Task Scheduler. Old session-tied web app was killed.
- From a fresh session: `127.0.0.1:8787/health` returned 200, public tunnel returned 200, new password login passed.
- Leonard connected to Telegram at 09:32 PT. Exactly one Leonard gateway running.
- Web app still bound to `127.0.0.1:8787` only. Default profile, Jimmy's existing task, Coach, NAT, Tailscale, and firewall were not touched.

Blocker: tasks run only while user `fight` is logged in. After reboot, nothing starts until someone logs in. Switching to "run whether user is logged on or not" plus an at-boot trigger needs administrator rights. CoS remote session is not elevated. Jimmy and Leonard cannot approve a UAC prompt.

Gatekeeper-only command, once, from an admin PowerShell on the desktop:
`powershell -ExecutionPolicy Bypass -File C:\Users\fight\AppData\Local\VeriPath\upgrade-to-s4u.ps1`

Tunnel URL changes on every restart. Current URL at last report: `https://fridge-operations-agent-study.trycloudflare.com`. Live URL is always in `%LOCALAPPDATA%\cloudflared\current-url.txt`.

## Machines

| Name | Role | Headscale |
|---|---|---|
| DESKTOP-81CBTV2 (Windows user `fight`) | Hosts Hermes agents + Hermes web app | `100.64.0.1` HS_tony |
| DESKTOP-AEI8KMV | Separate Hermes install, Steve profile | |
| muse-regis | Muse / overflow capture. Artifacts only. Outgoing only | `100.64.0.6` |
| deepblueubu | Model server | `100.64.0.2:8084` |
| ubudual5060 | VeriMail model | `100.64.0.9:8082` |
| omarmacmini | Expected | `.4` |
| grokbot-box-1 | Offline since 2026-09-20 | `.3` |
| grokbot-box-2 | HS_ty | `.7` |
| ubuntu | HS_shared | `.10` |

## Hermes agents (desktop)

- Jimmy and Leonard are the only Telegram-connected agents.
- Jimmy: Nous model provider.
- Leonard: deepseek-v4-flash via routeapi. Not deepblueubu. Task-managed as of 09:32 PT.
- Ashbot (xAI) and VeriMail (ubudual5060) running, no Telegram.
- Coach configured model is down. Parked.
- Default profile points at offline grokbot-box-1 and holds a duplicate of Jimmy's Telegram token. Do not start the default gateway.
- Jimmy already had an auto-start path. Do not duplicate it.

## Phone / web app

- Hermes web app: `127.0.0.1:8787`, password login. Bound local-only.
- Hermex uses the temporary Cloudflare tunnel. URL changes on tunnel restart.
- Password changed 2026-09-26. Lives only in `C:\Users\fight\Projects\hermes-webui\.env`.

## Open problems

1. Telegram flaps every 2-4 minutes. Likely double NAT. Parked. No Ty.
2. Coach model down. Parked.
3. Cold-boot persistence needs one admin elevation. Blocked on Gatekeeper.
4. Temporary Cloudflare URL rotates. Permanent hostname not set up.

## Next work (order)

1. Done: password change.
2. Partial: session-end persistence.
3. Now: Gatekeeper runs `upgrade-to-s4u.ps1` once as admin.
4. Then: narrow Regis line if still wanted.
5. Later: Telegram / NAT, Coach, default-profile token, backlog.

## Backlog (parked)

- Phoenix Salon close-out letter
- Birdeye re-scan by VeriMail (AgentMail key missing)
- Review unexpected Thornhill run Jimmy pushed to Gitea
- Add VeriMail Python environment lesson to Gitea
- Shared desktop drop folder for Regis artifacts
- Delete stale Phoenix reminder
- Decide whether to restart paused Hermes status watcher
- Coach other model machine bonsai-3060 is not on Headscale