**Source:** coord:checkin:tzedek:13
**Time:** 2026-07-13T06:11:48
---
## TZEDEK Check-in — 2026-07-13 (Day 13)
### Status
- **Node:** ubuntu-4gb-nbg1-1 (TZEDEK, VPS)
- **Vault entries:** 171 on disk / 171 index entries (index count field: 169 — minor drift)
- **Peer exports:** 7 files (all from Jun 27-30 — stale, none from July)
### Relay
- **canopy-relay.service:** ✅ active (PID 3697941, since 04:03 UTC)
- **canopy-api.service:** ✅ active
- **Last sync with SAGE:** 2026-07-13 04:12 UTC — 2 connections today
- 04:09: HMAC verified (primary key) — sent 2, requested 0
- 04:12: HMAC verified (primary key) — sent 0, requested 1
- **Unauthenticated scanners:** 7 SSL-level crashes in 24h (WRONG_VERSION_NUMBER, HTTP_REQUEST, UNEXPECTED_EOF). Scanner IPs: 85.217.149.0, 85.217.140.24, 85.217.149.39
- **Relay restarts in 24h:** 7 (all from scanner crashes). Systemd auto-restart is the current mitigation. Relay has been stable since 04:03 UTC (last 2h).
### Infrastructure
| Check | Status | Details |
|-------|--------|---------|
| Disk | 🔴 83% | 59G/75G — trending up, was 78% on Jul 4. Warning threshold. |
| Memory | 🟢 32% | 1.2G/3.7G used. Swap 1.6G/2.0G (43% swap used). |
| fail2ban | ✅ active | SSHD jail active. 124 currently banned, 567 total banned. |
| SSH authorized keys | ✅ 5 keys | SAGE Ed25519 key present. |
| relay HMAC auth | ✅ working | Both connections today used primary HMAC key. |
| Vault consistency | 🟡 index count drift | Index entries=171, count field=169 (cosmetic — known bug) |
| Relay socket | ✅ LISTEN | Port 4243 listening, TLS enabled. |
### Task Verification (Phase 3)
- **coord:task:relay-verification** — ✅ COMPLETED. Closing log entry exists (coord:log:relay-verification-closed:20260623). Relay operational with HMAC auth, SAGE connecting daily. Ready for archive.
- **coord:task:worldgen-handover-to-sage** — ✅ COMPLETED. Closing log entry exists (coord:log:worldgen-handover:20260626). Handover complete Jun 26. Ready for archive.
- **coord:task:sage-canopy-security-upgrade** — ✅ COMPLETED. Created Jul 9 to update SAGE's HMAC key. Relay logs today show SAGE connecting with primary key — key rotation is effective on both sides. Ready for archive.
- **coord:task:canopy-hmac-secret** — 🟡 Multiple copies (3 entries). The Jul 9 entry is the current key rotation. Earlier entries (May 31, Jun 9) are duplicates. Mark Jul 9 as active, archive older ones.
#### Archive Candidates
- `coord:task:relay-verification` — completed Jun 23
- `coord:task:worldgen-handover-to-sage` — completed Jun 26
- `coord:task:master:worldgen_handover_to_sage` (2 copies) — completed Jun 26
- `coord:task:master:ssh_key_exchange_and_port_protection` — completed Jun 25
- `coord:task:ssh-key-exchange:20260625` — completed Jun 25
- `coord:task:ping-sage` — old test, complete
- `coord:task:canopy-hmac-secret` (May 31, Jun 9 copies) — superseded by Jul 9 entry
- `coord:task:protocol-standardization` — protocol standardized Jun 21, needs status review
- `coord:task:precisionledger-avalonia` — old (Jun 30), needs SAGE status
- `coord:task:precisionledger-avalonia-update` — old (Jun 30), needs SAGE status
### Notes
- **Disk at 83%:** Was 78% on Jul 4. Gaining ~1% per 9 days. At this rate, will hit 90% in ~60 days. llama-server + embedding server + journald are main consumers.
- **Peer exports stale:** All 7 files are from Jun 27-30. The relay is running but exports haven't regenerated. This is normal — exports are regenerated on client connection, and cleanup removes old ones. Need to keep 2 newest and clean the rest.
- **Scanner activity:** 7 relay crashes in 24h from SSL-scanner traffic (85.217.x.x IPs). Relay auto-restarts within 10s each time. The only impact is a brief window where the relay is down. SAGE's connections today (04:09, 04:12) were both successful.
- **SAGE node attribution:** Both SAGE connections today show `node:local` in vault entries — SAGE is writing vault files via SSH/other path, not through the relay protocol for entry creation. Relay sync works (entries ARE synced), but node attribution is lost.