VeriPath fleet snapshot

Updated: 2026-09-26 09:15 PT Source: Gatekeeper handover + password-change confirmation. Do not store passwords, tokens, or keys in this file.

Operating model

Anthony (Gatekeeper) only makes irreversible calls: job go/no-go, starting evidence snapshot, publish, send, spend, and logins only he can do.
Grok Bot Chief of Staff designs process, picks infrastructure, and runs the operation.
Keep Ty / Headscale admin out unless Gatekeeper authorizes it.
Nothing is sent without an explicit go.
Simplest fix first. No infra that snowballs.
Gitea is the master record. Desktop Obsidian is a thin map plus lessons.
Client work queue: Tony_tech/veripath-operations.
Product / audits / evidence: Tony_tech/veripath.
Fleet and agent-OS record: this repo. Do not put fleet state in veripath-operations.

Adopted rules (2026-09-26)

CoS runs everything it can without Gatekeeper.
Regis may research, draft, and check status. Nothing irreversible.
Regis produces artifacts only. VeriMail owns email. Regis does not post or send.
Park the Regis-to-Hermes line until boot persistence is real.
After persistence: smallest listen only. Web app on 100.64.0.1, firewall allow 100.64.0.6 only, status-check test only.
Desktop stays on Headscale as HS_tony / 100.64.0.1.
iPhone stays on personal Tailscale, not Headscale.

Machines

Name	Role	Headscale
DESKTOP-81CBTV2 (Windows user `fight`)	Hosts Hermes agents + Hermes web app	`100.64.0.1` HS_tony
DESKTOP-AEI8KMV	Separate Hermes install, Steve profile
muse-regis	Muse / overflow capture. Artifacts only. Outgoing only	`100.64.0.6`
deepblueubu	Model server	`100.64.0.2:8084`
ubudual5060	VeriMail model	`100.64.0.9:8082`
omarmacmini	Expected	`.4`
grokbot-box-1	Offline since 2026-09-20	`.3`
grokbot-box-2	HS_ty	`.7`
ubuntu	HS_shared	`.10`

Model servers were healthy at 08:55 PT on 2026-09-26.

Hermes agents (desktop)

Jimmy and Leonard are the only Telegram-connected agents. Restarted 08:08 PT 2026-09-26.
Jimmy: Nous model provider.
Leonard: deepseek-v4-flash via routeapi. Not deepblueubu.
Ashbot (xAI) and VeriMail (ubudual5060) running, no Telegram.
Coach configured model is down. A similar model was running at 127.0.0.1:8899 and is a candidate only with a later go.
Default profile points at offline grokbot-box-1 and holds a duplicate of Jimmy's Telegram token. Do not start the default gateway.
Only Jimmy auto-starts on desktop boot.

Phone / web app

Hermes web app: desktop 127.0.0.1:8787, password login.
Hermex iPhone reaches it through a temporary Cloudflare tunnel on the desktop. URL changes on tunnel restart or desktop reboot.
Permanent Cloudflare hostname is not set up.
Password changed 2026-09-26. Old password rejected. New password works. Phone address unchanged.
New password lives only in C:\Users\fight\Projects\hermes-webui\.env. Not recorded here.
All existing sessions were logged out. Hermex needs the new password once.
Web app was running under Gatekeeper's remote session at confirmation time. It may stop if that session ends. Boot persistence must not depend on an interactive / RDP session.

Open problems

Jimmy and Leonard Telegram connections drop every 2-4 minutes and recover in seconds. Continues after restart. Likely double NAT (router outside 10.0.0.121, public 76.149.57.201) plus Tailscale relays. Possible fix is ISP modem bridge mode. Parked. Do not involve Ty.
Coach model down. Parked.
Only Jimmy survives reboot. Leonard, web app, and tunnel do not. Next work.
Web app process is tied to the current remote session. Same persistence work.

Next work (order)

Done: change web app password, log out old sessions.
Now: boot persistence for Leonard, web app, and cloudflared. Must survive reboot and RDP / remote-session end.
Then: narrow Regis line if Gatekeeper still wants it.
Later: Telegram / NAT, Coach retarget, default-profile token cleanup, backlog.

Persistence constraint

Do not use a Startup-folder or interactive-session process as the only start method. The web app already dies when the remote session ends. Use a Windows scheduled task or service that runs whether the user is logged on or not.

Backlog (parked)

Phoenix Salon close-out letter
Birdeye re-scan by VeriMail (AgentMail key missing)
Review unexpected Thornhill run Jimmy pushed to Gitea
Add VeriMail Python environment lesson to Gitea
Shared desktop drop folder for Regis artifacts
Delete stale Phoenix reminder
Decide whether to restart paused Hermes status watcher
Coach other model machine bonsai-3060 is not on Headscale

Regis networking (2026-09-26 09:00 PT)

Sees every Headscale machine and can reach both model servers.
Outgoing only through runtime proxy. No SSH, no incoming, no Tailscale ping. Cannot change that from inside the VM.
Cannot reach Hermes today because the web app is local-only.

4.9 KiB Raw Blame History