personal-agent-os/memory-systems/agent-os/04_projects/veripath/fleet-2026-09-26.md

VeriPath fleet snapshot

Updated: 2026-09-26 09:53 PT Do not store passwords, tokens, or keys in this file.

Operating model

• Anthony (Gatekeeper): irreversible calls only.
• CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin.
• No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go.
• Gitea is the master record. Fleet lives here, not in veripath-operations.

Adopted rules (2026-09-26)

• Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
• Park Regis-to-Hermes until launcher wrappers die with the Task Scheduler task, so a crash actually restarts.
• After that: web app on 100.64.0.1, firewall allow 100.64.0.6 only, status-check test only.
• Desktop stays Headscale HS_tony / 100.64.0.1. iPhone stays personal Tailscale.

Persistence (2026-09-26 09:53 PT)

S4U / session 0 accepted without a reboot. Wrapper-stop bug closed by CoS at 09:50 without admin.

Tasks at Highest, S4U as fight, At startup trigger:

• \VeriPath\Hermes_WebUI
• \VeriPath\Cloudflared_Tunnel
• \VeriPath\Hermes_Gateway_leonard

Launchers in C:\Users\fight\AppData\Local\VeriPath\ now:

• Check every 3 seconds that the Task Scheduler wrapper is alive.
• If the wrapper is gone or a .disabled file exists, stop the program and exit.
• If a new launcher finds an old leftover copy, shut it down and take over.
• Only touch their own program. Cannot catch Jimmy's gateway.
• Old scripts backed up as *.ps1.bak-20260926. Task definitions unchanged.

CoS proof of wrapper fix:

• Stopped Hermes_WebUI at 09:49:13. By 09:49:16 port 8787 was dead.
• Started the task at 09:49:42. /health 200 at 09:49:49.
• Web app in session 0 under Task Scheduler, 127.0.0.1:8787 only, .env login passes.
• One tunnel copy. Public /health 200.
• One Leonard gateway in session 0. Telegram at 09:50:49. Jimmy task not touched.

Unknown: something else tried to start Leonard at 09:48 and exited because Leonard was already running. Source not investigated. Do not start the default profile while looking.

Side effect still open: Leonard runs elevated. profiles\leonard state unreadable to non-admin tools.

Password only in C:\Users\fight\Projects\hermes-webui\.env. Web app still 127.0.0.1:8787 only.

Tunnel URL at 09:50: https://daughter-cards-fog-compete.trycloudflare.com Prior URLs dead: fridge-operations-agent-study, saving-bosnia-shades-pearl, indicated-forest-notify-low. Live URL file: %LOCALAPPDATA%\cloudflared\current-url.txt Hermex 530 on the fridge-* URL was expected after rotate.

A real boot with nobody logged in is still the only 100% cold-boot test and was not done.

Open / next

1. Done: launcher dies with wrapper.
2. Do not open 100.64.0.1 until Gatekeeper says the phone is on the live tunnel.
3. Then narrow Regis line if still wanted.
4. Parked: Leonard running elevated, unknown 09:48 Leonard start, Telegram flaps / NAT, Coach, default-profile token, client backlog.