LAB Access Lane Verification (2026-09-27)

Verification of the three access lanes requested by Eva for Young's check. Every claim below is from a live probe on 2026-09-27, not from config.

🔐 Lane 1 — SSH as lab@192.168.4.60 : VERIFIED

• LAN direct works: ping 192.168.4.60 → 0% loss, 39-61 ms RTT.
• Two keys authenticate as lab:
  • ~/.ssh/lab_ctrl_key (SHA256:WVKC+drAk3BolB27/9GHQwLAr9w+VRtfD+GVtWVsn5Q, "solos-server->new-laptop ctrl")
  • ~/.ssh/tam_vault_key (SHA256:flBDKOvZJuNM+1yVCRjYE+hcDowA1vdnHaixg0d3I4E)
• Both land on host LAB as user lab; lab is in group sudo (no passwordless sudo).
• ubuntu@ is gone: ubuntu@192.168.4.60 → Too many authentication failures. The old-box user name does not exist on LAB.
• Host identity: 127.0.0.1 + 192.168.4.60 only — no tailscale on LAB (separate tailscaled runs userspace-only for the runtime, not for my reach).
• Old cloud box (100.124.146.127, tam_server_key) remains reachable over the laptop tailnet — that is a different box, not LAB.

🔐 Lane 2 — Obsidian REST API : VERIFIED (with corrections)

• NOT reachable as briefed. https://127.0.0.1:27124 is bound to LAB loopback only (Obsidian renderer pid 179600, fd 52). From the laptop it is refused; port 27124 is not in the LAN bind set.
• Working method: SSH tunnel ssh -N -L 27924:127.0.0.1:27124 -i lab_ctrl_key lab@192.168.4.60, then TLS against https://127.0.0.1:27924.
• HTTPS is mandatory — plain http:// returns empty reply (curl exit 52). Self-signed cert: CN=Obsidian Local REST API, issued by CN=Obsidian Local REST API CA, valid Sep 27 2026 → Sep 27 2027. Use -k or pin the CA.
• Auth confirmed: no token / bad token → 401 {"errorCode":40101}. Real key → 200.
• Key identity matches Eva's brief: retrieved from /home/lab/SolOS/docs/vault/.obsidian/plugins/obsidian-local-rest-api/data.json, len 64, prefix 78ff, suffix 5c89 — the exact key in Eva's message. ✅
• Real write test passed end-to-end: PUT vault/solos/research/tam/_apilane-probe-2026-09-27.md → 204; GET → 200 with content; disk read-back on LAB → 186 bytes, sha256 d6fe5863b5d6e87c40f73c2acf9224730f4961ba9e2264a3e68d1642d1342c88 matching the API copy byte-for-byte. Probe files deleted afterwards (both API DELETE → 204).
• Plugin also exposes /mcp (same bearer auth) — v5.2.0 = "Local REST API with MCP".

⚠️ Vault path correction (important)

• Eva's stated target vault/research/tam/ is empty (created 12:50 today, 0 files).
• The API serves a vault root whose real content is under vault/solos/research/tam/ — 8 entries incl. README.md, _probe.md, ai/, health/, medical/, news/, tech/, 2026-09-07-persona-upgrade.md.
• On LAB, /home/lab/.solos/docs/vault is a symlink → /home/lab/SolOS/docs/vault (the real dir). Both research/tam/ and solos/research/tam/ resolve on disk, but only solos/research/tam/ has content.
• Recommendation: write to vault/solos/research/tam/. Writing to research/tam/ would silently create a second, orphaned tree. Needs a Sol/Min ruling on which is canonical — this is the vault-move problem again, not a new one.

🔐 Lane 3 — Fleet agents on LAB : PARTIALLY CORRECTED

Open on the LAN (192.168.4.60) — verified, agent identified via /health:

• Agents are FastAPI services: /health returns {"agent":"sol","status":"running","circuit_open":false,...}; /docs serves Swagger UI; / → 405 (POST-only).
• No agent card on /.well-known/agent.json on any port (404) — card discovery is not wired for these.
• Governance ports absent on LAB: 8430, 8433, 8436 all closed on both LAN and loopback. Confirms governance has NOT been ported yet.

⚠️ The :8442 / "eve refused" claim is WRONG

• From the laptop, 8442/8447/8448 are refused because they are not bound to the LAN IP — LAB only exposes 8300-8307 + 8432.
• On LAB loopback, 8442, 8443 and 8447 are all OPEN. They are not local agents — they are SSH port-forwards owned by a single long-lived ssh process (pid 11740, started Sat Sep 26 19:00:41) running: -L 127.0.0.1:8442:127.0.0.1:8448 -L 8443->8443 -L 8447->8447 ubuntu@161.33.71.67
• So LAB:8442 actually tunnels to the OLD cloud box port 8448 (eve) — it is not "refused", it is a stale tunnel back to the old fleet.
• Consequence: the eve service on LAB is absent, and LAB:8442 is a misleading name for a remote eve. Flag to Sol/Min — do not treat LAB:8442 as a local agent.
• :8441 (Eva) is refused even on loopback — Eva is laptop-only, as expected.

🔐 Key hygiene note

• Obsidian data.json holding the API key is mode 664 (world-readable) on LAB. Recommend chmod 600.
• Agent runner /proc//environ files are mode 400 owner lab — acceptable, but they contain provider keys in plaintext; only lab can read them (no other login users on the box, so exposure is limited).

✅ Recommended working recipe (copy/paste)

# 1. tunnel the API (loopback-only on LAB)
ssh -N -o ExitOnForwardFailure=yes -L 27924:127.0.0.1:27124 \
    -i ~/.ssh/lab_ctrl_key lab@192.168.4.60 &
# 2. write over TLS
KEY=$(ssh -i ~/.ssh/lab_ctrl_key lab@192.168.4.60 \
  "python3 -c \"import json;print(json.load(open('/home/lab/SolOS/docs/vault/.obsidian/plugins/obsidian-local-rest-api/data.json'))['apiKey'])\"")
curl -sk -X PUT -H "Authorization: Bearer $KEY" -H "Content-Type: text/markdown" \
  --data-binary @note.md https://127.0.0.1:27924/vault/solos/research/tam/2026-09-27-topic.md
# 3. verify on disk
ssh -i ~/.ssh/lab_ctrl_key lab@192.168.4.60 sha256sum \
  /home/lab/SolOS/docs/vault/solos/research/tam/2026-09-27-topic.md

🔁 Open items for Sol / Min

1. Ruling needed: canonical Tam write path — solos/research/tam/ (has content) vs research/tam/ (empty, per Eva's brief).
2. Stale tunnel: LAB pid 11740 forwards 8442/8443/8447 to the old box 161.33.71.67. Retire or document once the old box is decommissioned.
3. Governance not ported: 8430/8433/8436 absent on LAB — matches the reconcile order (port governance before agents).
4. chmod 600 on the Obsidian plugin data.json.
5. No A2A agent cards (/.well-known/agent.json) on the LAB agent ports — matters for discovery tooling.

Related: 2026-09-27-lab-connectivity-audit