PAX
← all writing

Station Log — November 6, 2026

Station Log — November 6, 2026

Phase 11 L4 — age ratings, disclosures, discount rules, buyers-only reviews (pax-sidelane)

Worked across 4 repo(s) today.

  • pax-heliopause: 10 change(s)
  • pax-helios: 11 change(s)
  • pax-portal: 1 change(s)
  • pax-sidelane: 4 feature(s)

4 feature(s) landed.

  • Phase 11 L4 — age ratings, disclosures, discount rules, buyers-only reviews (pax-sidelane)
  • Phase 11 L3 — malware scan gate, rescans, kill switch, 2FA, release review (pax-sidelane)
  • Phase 11 L2 — reports, DMCA, legal holds, suspension, child safety (pax-sidelane)
  • Phase 11 L1 — legal pages, acceptance gate, 18+, U.S.-only, web games off (pax-sidelane)

22 other change(s) of note.

  • PLAYER-MANUAL.md §3 — the launcher's download bar carries the megabytes so far (helios v0.381.0). Docs only (pax-heliopause)
  • SECURITY-AUDIT-HOST.md §9 — fries' ~/.config/pax-portal removed with the pilot's go (2026-11-06): the pre-rotation env file, and tsnet/, the copy of helios's tailnet identity left on fries after the cutover (node state, certificate key, ACME account key), shredded; helios on burrito unaffected. Recorded the public door part two missed: the pax-public container is the Funnel node pax-station (tag:public-entry) serving the "Daily builds" site through fries' Caddy on *:443; it stays public, and its move off fries goes to a pax-station session, as does the keepalived address 192.168.0.200. Docs only (pax-heliopause)
  • SECURITY-AUDIT-HOST.md §9 — fries' tailnet-only 8444 serve entry removed (nothing listened behind it; fries has no serve config now), and pax-remote-access's web client (0.0.0.0:8080) and coturn relay (3478 on every address, static credentials in the repo) stopped with the pilot's go, 2026-11-06; the project has been idle since July. Docs only (pax-heliopause)
  • SECURITY-AUDIT-HOST.md §9 — fries' old Funnel entry removed and rent-postgres stopped (the pilot's go, 2026-11-06). The 8443 entry proxied to pax-public on 127.0.0.1:8091 and would have published it the moment Funnel was re-granted to fries; removed with tailscale serve --https=8443 off (funnel --https=8443 off hangs asking for a login link on a node without Funnel rights). rent-postgres (0.0.0.0:5433) stopped, data kept in its unnamed volume; the rental project is on hold, bound for burrito. Docs only (pax-heliopause)
  • SECURITY-AUDIT-HOST.md §9 — H-9's VNC half closed (2026-11-06): fries' x11vnc answers only on lo and on tailscale0 from shake and hamburger (nft table inet fries_vnc, /etc/fries-vnc.nft, fries-vnc-firewall.service before the network); the home LAN gets a reset. Fallback when Tailscale is down: a reverse SSH tunnel from fries to shake's localhost:5901 (user unit vnc-reverse-tunnel, a key used for nothing else, held on shake by from=/restrict/permitlisten/permitopen/command=). Checked from shake; the key cannot run a command, open -L, or listen anywhere else. Still open on fries: rent-postgres on 0.0.0.0:5433, sshd passwords. Docs only (pax-heliopause)

Auto-generated Station Log. 2 agent session(s) · 27 commit(s) across 4 repo(s) · Models: deepseek-v4-pro:cloud · Releases: v20261106.0.9, v20261106.0.8, v20261106.0.7 · Built by Claude · Orchestrated by Hermes