VeriPath fleet snapshot

Updated: 2026-09-26 10:26 PT Do not store passwords, tokens, or keys in this file.

Operating model

Anthony (Gatekeeper): irreversible calls only.
CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin.
No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go.
Gitea is the master record. Fleet lives here, not in veripath-operations.

Adopted rules (2026-09-26)

Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
Regis may hit /health only. No /login. No terminal. No password.
Desktop stays Headscale HS_tony / 100.64.0.1. iPhone stays personal Tailscale.

Persistence

S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Web app: 127.0.0.1:8787 only. Healthy. Tunnel /health 200. Hermex live on https://daughter-cards-fog-compete.trycloudflare.com. Password only in C:\Users\fight\Projects\hermes-webui\.env.

Regis line (2026-09-26 10:26 PT)

Firewall enabled. Forwarder live under \VeriPath\Hermes_WebUI (regis-forward.py on 100.64.0.1:8787 -> 127.0.0.1:8787).

Regis /health from 100.64.0.6 returned 200 at 10:26 PT. Line works.

Not accepted: forwarder connections look local, so Hermes would give Regis first-password setup and the embedded terminal without a password. CoS to close that gap now.

Open: boot-time bind retry untested with a real reboot. Login test left one extra Hermes session. Also reported, not changed: python.exe allow-everything rules.

Open / next

Done: Regis /health 200.
CoS tightens so forwarder clients are not localhost-privileged.
Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, extra Hermes session, Telegram / NAT, Coach, default-profile token, client backlog.

1.8 KiB Raw Blame History