VeriPath fleet snapshot

Updated: 2026-09-26 10:40 PT Do not store passwords, tokens, or keys in this file.

Operating model

Anthony (Gatekeeper): irreversible calls only.
CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin.
No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go.
Gitea is the master record. Fleet lives here, not in veripath-operations.

Adopted rules (2026-09-26)

Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
Regis may hit /health only. No login. No terminal. No password.
Desktop stays Headscale HS_tony / 100.64.0.1. iPhone stays personal Tailscale.

Persistence

S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Web app: 127.0.0.1:8787 only. Healthy. Tunnel /health 200. Hermex live on https://daughter-cards-fog-compete.trycloudflare.com. Password only in C:\Users\fight\Projects\hermes-webui\.env.

Regis line (2026-09-26 10:40 PT)

Firewall enabled. Forwarder live under \VeriPath\Hermes_WebUI. Regis /health from 100.64.0.6 returned 200 at 10:26 PT.

Local-trust closed at 10:40, no admin:

Forwarder connects to Hermes from 127.0.0.2.
Patch in hermes-webui\server.py relabels those connections as 100.64.0.1. Forwarded headers from that address are ignored.
Forwarder refuses to serve if the patch is missing.
Backups: server.py.bak-regis-20260926, regis-forward.py.bak-regis-20260926. webui.ps1 and .env unchanged.
Only \VeriPath\Hermes_WebUI was restarted.

Proved: /health 200 via 100.64.0.1 logged as 100.64.0.1 even with X-Forwarded-For: 127.0.0.1. Unauthenticated onboarding, first-password, and terminal return 401 through the forwarder. Loopback-only read is granted on 127.0.0.1 and refused on 100.64.0.1. Tunnel and loopback login still pass. Listeners still only 127.0.0.1:8787 and 100.64.0.1:8787.

Watch: a git pull or hermes-webui self-update will drop the patch. Forwarder then stops. Loopback and tunnel keep working. Re-apply the patch before Regis can use the line again.

Open: boot-time bind retry untested with a real reboot. Extra Hermes sessions from login tests. python.exe allow-everything rules unchanged.

Open / next

Done: Regis /health 200 and local-trust close.
Infra slice is enough to run VeriPath work. Do not keep stacking infra.
Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, extra Hermes sessions, Telegram / NAT, Coach, default-profile token, hermes-webui patch watch, client backlog.

2.6 KiB Raw Blame History