🔴 The tunnel is an unauthenticated path into the LAB default profile

Status: OPEN — 1 active diagnostic equivalent, not a card, because the fix spans three hosts and the credential step is Min's lane.

The finding, in one paragraph

Tam's lab-a2a-tunnel.service forwards 127.0.0.1:19100 → LAB 127.0.0.1:9900. :9900 is the LAB default profile A2A endpoint, running in localhost-only mode because no A2A_BEARER_TOKEN is configured. In that mode the adapter authenticates by socket address, so the tunnel's terminating SSH connection on LAB is indistinguishable from a local process. I dispatched a real JSON-RPC method through the tunnel from the laptop with no credentials and it executed. The default profile advertises terminal, file, browser, code_execution and cronjob, and it is the profile whose .env holds OPENCODE_GO_API_KEY and OPENCODE_ZEN_API_KEY.

Evidence (measured, both hosts, 2026-10-20 ~22:35 AEDT)

⚠️ The control that would have caught this returned a FALSE GREEN

A narrow, safe probe through the tunnel asked the LAB default-profile agent for the NAMES only of credential-shaped env vars. It answered:

"there is no default-profile .env at /home/lab/.hermes/profiles/default/.env, so nothing to enumerate"

False — and false in the dangerous direction. The default profile has no profiles/default/ directory, because the default profile IS the HERMES_HOME root: /home/lab/.hermes/.env (mode 600, holds both provider keys). The probe looked in the wrong place, found nothing, and reported "no exposure".

A security control that measures the wrong path returns "clean" and is indistinguishable from a secure system. The fix is one line in the probe — but until it is fixed, no credential-enumeration probe against this fleet can be trusted to say "none found".

Honest limits

• No secret value was obtained and none was attempted. The probe asked for names only and returned an empty list (wrong path); I did not re-probe for values.
• The §6 proof is a read-only JSON-RPC method (GetTask on a non-existent id). It shows the method dispatched and executed; it does not demonstrate a write, a tool call, or a credential read through the tunnel.
• I could not get the laptop's unauthenticated :8443 endpoint to execute anything — the agent behind it refused a harmless read-only request on prompt-injection grounds. That refusal was correct and is recorded as the peer's success, not the probe's failure. It means the server has no auth and the agent currently applies judgement — a control that is not a control.
• No configuration, unit, or credential was modified. Read-only lane.
• ⚠️ One temporary artefact was created on the Pulse host and removed: a throwaway TCP listener (127.0.0.1:19555 → later 0.0.0.0:19555) under a temporary user unit wire-probe.service, used to capture the raw bytes of one inbound request and prove the transport carries full messages (§7a of the study file). Torn down and verified afterwards: unit stopped, disabled and its file deleted; daemon-reload run; the temporary ufw rule deleted; port 19555 free; no ufw rule; unit inactive. The tam-a2a server, its unit, and its configuration were never touched.
• ⚠️ One probe of mine returned an empty body and it was NOT a dropped request. The request arrived (the Pulse state DB holds it at 2848 chars); the reply is what failed, because tam-a2a/server.py returns only when hermes --profile tam finishes, under a 480 s cap, and that endpoint was carrying 27 concurrent probe messages with 7 hitting the same timeout. An empty response is not evidence of a dropped request — measure the request path (the stored inbound record, or the raw bytes).

The fix, in order, each step independently verifiable

Rotation (step 4) is precautionary, not remediation of a confirmed breach. The exposure is latent-to-reachable; I have no evidence it was exercised. The keys are cheap to rotate and shared across every profile, so rotate rather than reason about it.

Not wrong, and worth saying

• The tunnel is the right shape for the stranded-card problem — it gives Pulse a real route into LAB instead of a card no dispatcher can spawn. The fix is to authenticate the path, not to remove it.
• :9900 still binds 127.0.0.1 only. Sol's card t_0ce0920b (bind LAN-only + firewall rule for .34) is still open and still correct; the tunnel does not satisfy it and does not close it.
• LAB's dispatch_profiles is now echo, min, mira, nova, sol — correctly excluding tam. That part of the stranded-card fix landed and holds.
• The tam profile's A2A_BEARER_TOKEN already exists (A2A_HOST=0.0.0.0, length 20) — but it protects the Hermes adapter, not the legacy tam-a2a/server.py that owns :8443, and not :9900 on LAB.