# Operator Surface Map - Leo / Teleo - 2026-07-09

## Repo Workspace

- Teleo infra checkout: this repository.
- Repo-local evidence pack: `docs/reports/leo-working-state-20260709/`
- Telegram export supplied by user during July 9 analysis: `/Users/user/PycharmProjects/ChatExport_2026-07-08/messages.html`

## VPS

- Host: `77.42.65.182`
- SSH user: `root`
- SSH key path exists locally; never print key contents.
- Live service: `leoclean-gateway.service`
- Service user/cwd from latest readback: `teleo`, `/home/teleo`
- Main DB container: `teleo-pg`
- Main DB name: `teleo`
- Live profile report dir: `/home/teleo/.hermes/profiles/leoclean/kb_stage/reports/`
- Live deploy/source area used in current work: `/opt/teleo-eval/workspaces/deploy-infra`

## Current VPS Stability Readback

Latest retained readback showed:

- `leoclean-gateway.service` active/running
- `MainPID=3252143`
- `NRestarts=0`
- service start timestamp `Thu 2026-07-09 06:59:44 UTC`

Always refresh before claiming current state.

## GCP

- Project: `teleo-501523`
- Compute: `teleo-prod-1` in `europe-west6-a`.
- Private Cloud SQL: `teleo-pgvector-standby`, database `teleo_canonical`.
- Direct passwordless alias `ssh teleo-gcp-staging` and `sudo -n` were retained as
  working on 2026-07-14; always re-run the batch-mode preflight before relying on
  them.
- A disposable private-TLS clone matched the current VPS snapshot at `39` tables
  and `52,167` rows, then was deleted. Persistent `teleo_canonical` remains the
  older staging copy and is not promoted or cut over.
- Current artifacts:
  `docs/reports/leo-working-state-20260709/gcp-db-first-working-leo-20260714.md`
  and `docs/reports/leo-working-state-20260709/gcp-db-first-parity-current.json`.
- PR #148 is open candidate evidence for scoped runtime access; its branch and
  proposed live outcome are not canonical `main`.

## Telegram

- Live group label: `Leo`
- Group chat id used in retained proof: `-5146042086`
- Authenticated Chrome/Telegram Web is the expected UI route for live Telegram canaries.
- Use Computer Use / node_repl sky tooling. Do not use AppleScript, OSA, System Events, focus hijacking, or foreground hacks.

## Production Mutation Boundary

- Live Telegram bot test messages to Leo are authorized when the goal is testing Leo.
- Production DB canonical apply is not authorized by this pack.
- Clone/staging DB creation, rollback rehearsals, preflight SQL, and postflight SQL are allowed when safe and cleaned up.
