Blueprint v2 — Final Audit (Tam, research lane)

Directive: Young → Atlas → Tam. Verify tunnel, audit blueprint vs live, list blockers, register. Read-only posture; nothing modified on server.

1. Tunnel — RECONNECTED (one cleanup flag)

• ssh pid 843761 (Sep21) ESTABLISHED to 100.124.146.127:22, full forward set live: local 18300-18307 + 8430/8432/8433/8434/8320/8091/19902/18442; reverse 9222/8443/8447/9903/5902/8765/9904. fail2ban whitelist ignoreip covers 100.64.0.0/10 (Tailscale CGNAT), laptop 100.85.164.30 clean. ✅
• ⚠️ TWO overlapping tunnel managers still present: autossh 299169 + 299170 (both Sep12) are STALE (no live ssh child, no ESTAB) but still looping; they contend for the same reverse-forward ports (9222/8443/9903) when they retry. P2.3 "consolidated tunnel" still OPEN → kill 299169/299170, keep 843761 (or one autossh unit).

2. Blueprint discrepancies (doc vs live)

Doc = /home/ubuntu/.solos/docs/blueprint-unified-solos-implementation.md (18,790 B, Sep 21 21:14). NOT at ~/.solos/docs/ on laptop — Atlas's stated path is wrong (same as prior audit).

Doc integrity:

1. FUTURE-DATED: header/§5/§5.2/footer all "2026-09-24"; today is 09-22.
2. SELF-CONTRADICTION: header "LOCKED by Young (09-18)" vs §8 "Blueprint approval ⏳ PENDING" vs footer "awaiting Young approval". Cannot be LOCKED and PENDING.
3. WEIGHTING DRIFT: doc "OpenCode 60 / Sol-custom 30 / Hermes 0%" (sums to 90) vs Young-locked vault addendum (sha 8141c7ab, Sep 19) "OpenCode 60 / SolOS 30 / Hermes 10 (patterns)". Reconcile 0% vs 10%.

Content vs live (probed 09-22 ~08:55 AEST): 4. AGENT HEALTH (§2.1) STALE: doc "Mira ⚠️ Restarting" is FALSE (mira 405 UP). doc "Eve Bridge :8442 ✅ Online" is FALSE — eve DOWN (eve-a2a + eve-a2a-bridge both auto-restart crash-loop, exit status 200/CHDIR). Ace listed "✅ Running" is now TRUE (405) after a transient 000 at first probe. All 7 core (sol/ace/mira/nova/echo/atlas/ min) + alpha = 405 UP. 5. COSTGOV :8430 — RESTORED (was masked/down in prior audit). /health 200 ok; /v1/check/{sol,ace,alpha} → tier "go", within budget. BUT §5.2 budget table STALE: Sol doc $43.22 vs live $41.91; Ace doc $4.10 "🔴 Tight" vs live $6.59; "Alpha — Not registered" is FALSE (live $5.91 go). Caps were raised (Atlas/Min $20, Ace/Alpha $15) — doc doesn't reflect. 6. DB SIZE: doc "241MB", Atlas dispatch "310MB", live 303MB (317,612,032 B). Both wrong. 7. DOUBLE-REGISTRATION unresolved (doc §2.2 gap; §3.2 invariant "8433 is mirror" not yet true): :8433 is an independent in-memory registry with DIVERGENT ids ("eva-laptop", "eve (Vercel)", "tam (Laptop)") and 6 core agents (sol/ace/mira/nova/echo/min) with last_seen = 2026-08-19 (34 days stale, heartbeat_count=1). Not a mirror. 8. REGISTRY STATUS FIELD lags live: central :8432 marks sol/atlas/ace "down" while TCP 405-UP; last_seen batch-identical (fresh=true even for down agents). 9. TG GATEWAY (§2.1 "✅ Running, 2 processes, gateway_loop.py") — FALSE. No gateway_loop.py process, no telegram gateway systemd unit. The task-80d6bbb2 SPOF is STILL unresolved. 10. VAULT PATH MOVED AGAIN (found during this audit): server vault moved from /home/ubuntu/.solos/docs/Research/tam → /home/ubuntu/.solos/docs/vault/solos/research/tam (~08:31-08:47 today, a docs-site reorganization — .git + AGENTS.md + VAULT-INDEX.md now at vault/). Laptop sync_vault.sh still pointed at the old path → the 30m cron was silently failing every file. FIXED locally: RBASE corrected to vault/solos/research/tam and re-synced (sha-verified). SERVER-SIDE still stale: solos-tam-vault-perms.service description still says "Research/tam/ drops" — needs Sol/Atlas to repoint, and the path must be PINNED so it stops moving under the sync.

3. Blockers for COMPLETE

• B1 (SPOF, critical) — Telegram gateway absent: no process, no unit. Young's primary surface has zero routing to agents. (task-80d6bbb2 still open.)
• B2 — Eve :8442 down: eve-a2a.service + eve-a2a-bridge.service crash-loop on CHDIR because ExecStart points at /home/ubuntu/.hermes/profiles/min/bridge/eve-a2a/server.py — a removed Hermes path (Hermes decommissioned). Root cause clear: repoint wrapper off ~/.hermes/.
• B3 — Double-registration :8432/:8433 divergent; single-source-of-truth invariant unenforced.
• B4 — Registry status/heartbeat untrustworthy (mislabels up as down; batch last_seen).
• B5 — Two overlapping tunnel managers (autossh Sep12 + ssh Sep21) → reverse-forward contention.
• B6 — §8 approvals ALL PENDING: Young blueprint approval (blocked by doc future-date + LOCKED-vs-PENDING contradiction); GO budget split (Mira+Young); 7 TG tokens (Young); Tam/Eva direct-A2A (Ace net test).
• B7 — Vault path instability: server vault moved Research/tam → vault/solos/research/tam without notice, silently breaking the 30m sync (now fixed on laptop side). solos-tam-vault- perms.service still watches the old path. Path must be PINNED + change-notified.

4. Verdict

NOT ready for sign-off. Big improvement since prior audit — CostGov restored + enforcing, all 7 core agents 405-UP, fail2ban whitelisted, tunnel reconnected. But the #1 reachability blocker (Telegram gateway) is still absent, Eve is crash-looping on a removed Hermes path, double-registration persists, and the doc is future-dated + self-contradictory + stale in its health/cost/db tables. Fix: (1) stand up gateway_loop.py (or OpenCode web frontend per task-80d6bbb2), (2) repoint eve wrapper off ~/.hermes/, (3) collapse to single registry + fix status field, (4) re-date + un-contradict + refresh doc tables, then Young signs.

🎯 Tam's Read: Infrastructure is up and the 7 core agents are green, but the Telegram gateway is still missing, Eve is crash-looping on a deleted Hermes path, the doc can't be signed until re-dated + un-contradicted — and the vault path moved mid-audit, which I corrected and re-synced.