VeriPath fleet snapshot

Updated: 2026-09-26 10:20 PT Do not store passwords, tokens, or keys in this file.

Operating model

Anthony (Gatekeeper): irreversible calls only.
CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin.
No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go.
Gitea is the master record. Fleet lives here, not in veripath-operations.

Adopted rules (2026-09-26)

Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
Regis may hit /health and /login as HTTP status only. No login. No terminal. No password.
Desktop stays Headscale HS_tony / 100.64.0.1. iPhone stays personal Tailscale.

Persistence

S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Web app: 127.0.0.1:8787 only. Healthy. Tunnel /health 200. Hermex live on https://daughter-cards-fog-compete.trycloudflare.com. Password only in C:\Users\fight\Projects\hermes-webui\.env.

Regis line (2026-09-26 10:16 PT)

Firewall enabled:

VeriPath WebUI from Regis — Inbound Allow (100.64.0.6 -> 100.64.0.1:8787)
VeriPath WebUI block non-Regis — Inbound Block

Forwarder live under \VeriPath\Hermes_WebUI only.

regis-forward.py listens on 100.64.0.1:8787 and passes to 127.0.0.1:8787.
Second child of the same web app task. Stops/starts with the task. Retries bind every 5s if Headscale is late at boot.
Old launcher backup: webui.ps1.bak-regis-20260926.

CoS proof at 10:16:

Two listeners on 8787: 127.0.0.1 (app) and 100.64.0.1 (forwarder), same Task Scheduler launcher.
/health 200 on both. Tunnel /health 200. Cloudflared not restarted. Hermex URL unchanged.
.env login test passed. Stop/start killed both in ~3s and brought both back.
Jimmy, Leonard, default profile, Tailscale, and other Python allow-all rules not touched.

Not accepted: forwarder connections look local, so Hermes would give Regis first-password setup and the embedded terminal without a password. Status-check only until that is tightened.

Open: boot-time bind retry untested with a real reboot. Login test left one extra Hermes session.

Also reported, not changed: python.exe allow-everything rules on the web app Python, C:\Program Files\Python312, and a copy under OneDrive\Desktop\data\assets.

Open / next

Regis /health (and optional /login status code only).
Tighten so forwarder clients are not localhost-privileged.
Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, extra Hermes session, Telegram / NAT, Coach, default-profile token, client backlog.

2.6 KiB Raw Blame History