VeriPath fleet snapshot

Updated: 2026-09-26 10:03 PT Do not store passwords, tokens, or keys in this file.

Operating model

Anthony (Gatekeeper): irreversible calls only.
CoS is Grok Bot and has the desktop. Hermes can use the desktop but has no Windows admin.
No Ty unless Gatekeeper authorizes. Nothing sent without an explicit go.
Gitea is the master record. Fleet lives here, not in veripath-operations.

Adopted rules (2026-09-26)

Regis may research, draft, and check status. Nothing irreversible. No post/send. VeriMail owns email.
Do not expose 100.64.0.1:8787 until allow-Regis plus block-everyone-else firewall rules exist.
After firewall: small forwarder 100.64.0.1:8787 -> 127.0.0.1:8787. Status-check test only.
Desktop stays Headscale HS_tony / 100.64.0.1. iPhone stays personal Tailscale.

Persistence

S4U / session 0 accepted. Wrapper-stop fix proven 09:50. Tasks: \VeriPath\Hermes_WebUI, \VeriPath\Cloudflared_Tunnel, \VeriPath\Hermes_Gateway_leonard. Launchers: C:\Users\fight\AppData\Local\VeriPath\. Web app: 127.0.0.1:8787 only. Healthy. Tunnel /health 200. Hermex live on https://daughter-cards-fog-compete.trycloudflare.com. Live URL file: %LOCALAPPDATA%\cloudflared\current-url.txt. Password only in C:\Users\fight\Projects\hermes-webui\.env.

Leonard runs elevated. Unknown 09:48 Leonard start attempt, parked.

Regis line (2026-09-26 10:03 PT)

Stopped. Nothing exposed. Listen address not changed.

Blocker: firewall rules need admin. Existing python.exe rule allows inbound any port from any address, so an allow-Regis rule alone would leave all of Headscale able to reach a 100.64.0.1 listener.

Gatekeeper command, once, admin PowerShell:

New-NetFirewallRule -DisplayName 'VeriPath WebUI from Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 100.64.0.6 -Action Allow; New-NetFirewallRule -DisplayName 'VeriPath WebUI block non-Regis' -Direction Inbound -Protocol TCP -LocalPort 8787 -LocalAddress 100.64.0.1 -RemoteAddress 0.0.0.0-100.64.0.5,100.64.0.7-126.255.255.255,128.0.0.0-255.255.255.255 -Action Block

After firewall done, CoS adds a forwarder under the web app task, restarts only that task, then Regis status-check.

Also reported, not changed: same allow-everything Python rules on C:\Program Files\Python312 and a copy under OneDrive\Desktop\data\assets.

Open / next

Gatekeeper runs the two firewall rules.
CoS forwarder + Regis status-check.
Parked: Leonard elevated, unknown 09:48 start, other Python allow-all rules, Telegram / NAT, Coach, default-profile token, client backlog.

2.6 KiB Raw Blame History