gea-program 0.82.0__tar.gz → 0.83.1__tar.gz

{gea_program-0.82.0/gea_program.egg-info → gea_program-0.83.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gea-program
-Version: 0.82.0
+Version: 0.83.1
 Summary: GEA-Program: downhole gauge monitoring - canonical measurement records, quality rules, drift evaluation with a re-fit change log, well-test validation, alarm management, model cards, store-and-forward, monthly SLA measurement, FAT/SAT protocols and a dashboard, generated from live objects in the client's reporting outline.
 Author: Daniel T. Murphy
 License: MPL-2.0
@@ -542,8 +542,12 @@ every configuration: enter the hub's address, **Make the network**, copy
 `gea-vpn-hub.zip` to the hub and run `sudo sh install-hub.sh`; install
 WireGuard on the office PC from wireguard.com and import the office's
 `gea-vpn.conf`; add a member per computer and hand it its zip (a box's
-holds `vpn.sh`, run once on the Pi; a window imports its `gea-vpn.conf`),
-then run the hub installer again. The keys stay in
+holds `vpn.sh`, run once on the Pi; every other member installs the
+client program **GEA-VPN** once - `vpn/`, `GEA-VPN-Setup-<version>.exe`
+and `GEA-VPN-<version>.tar.gz` on every release, since 0.83.0 - and drops
+its zip on the program's page at `http://127.0.0.1:8795/`: the tunnel is
+up from then on, at every start, and the page says when the hub and the
+office answer), then run the hub installer again. The keys stay in
 `keys\vpn\network.json`, owner-only, in the backup and never in the
 dossier. From a terminal: `gea vpn --workspace C:\site --create
 vpn.pad3site.com`, `gea vpn --workspace C:\site --add "Pad 3 box" --kind
@@ -843,7 +847,7 @@ unsigned, the key hand-overs - and shows the reports as they were signed. A
 reader made from the workspace knows the site's key fingerprints, so it
 says whether a dossier is the site's; it allows no network request, and it
 leaves the trusted time-stamp to `verify_dossier.py`. For a client who wants
-it installed, every release also carries `GEA-Reader-Setup-0.82.0.exe`: GEA
+it installed, every release also carries `GEA-Reader-Setup-0.83.1.exe`: GEA
 Reader as a Windows program of its own - its own icon and taskbar button,
 Check with GEA Reader on a dossier's right-click menu, fingerprints the client
 saves kept on that computer, nothing of GEA-Program. `gea help reader`.
@@ -1608,7 +1612,7 @@ attaches the zips to the GitHub release of that tag.
 
 ### The Windows installer
 
-Every release also carries `GEA-Program-Setup-0.82.0.exe` (for 0.82.0): the
+Every release also carries `GEA-Program-Setup-0.83.1.exe` (for 0.83.1): the
 same Windows kit installed like any Windows program, for the signed-in user
 alone and with no administrator rights (`%LOCALAPPDATA%\Programs\GEA-Program`).
 It asks for the site workspace (an existing one such as `C:\site` is used as
@@ -1627,7 +1631,7 @@ it, removes the program and leaves the workspace. Silent, for a site's
 software deployment:
 
 ```
-GEA-Program-Setup-0.82.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
+GEA-Program-Setup-0.83.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
 ```
 
 The setup is built by Inno Setup 6 from `tools/installer.iss` in the same

{gea_program-0.82.0 → gea_program-0.83.1}/README.md

@@ -503,8 +503,12 @@ every configuration: enter the hub's address, **Make the network**, copy
 `gea-vpn-hub.zip` to the hub and run `sudo sh install-hub.sh`; install
 WireGuard on the office PC from wireguard.com and import the office's
 `gea-vpn.conf`; add a member per computer and hand it its zip (a box's
-holds `vpn.sh`, run once on the Pi; a window imports its `gea-vpn.conf`),
-then run the hub installer again. The keys stay in
+holds `vpn.sh`, run once on the Pi; every other member installs the
+client program **GEA-VPN** once - `vpn/`, `GEA-VPN-Setup-<version>.exe`
+and `GEA-VPN-<version>.tar.gz` on every release, since 0.83.0 - and drops
+its zip on the program's page at `http://127.0.0.1:8795/`: the tunnel is
+up from then on, at every start, and the page says when the hub and the
+office answer), then run the hub installer again. The keys stay in
 `keys\vpn\network.json`, owner-only, in the backup and never in the
 dossier. From a terminal: `gea vpn --workspace C:\site --create
 vpn.pad3site.com`, `gea vpn --workspace C:\site --add "Pad 3 box" --kind
@@ -804,7 +808,7 @@ unsigned, the key hand-overs - and shows the reports as they were signed. A
 reader made from the workspace knows the site's key fingerprints, so it
 says whether a dossier is the site's; it allows no network request, and it
 leaves the trusted time-stamp to `verify_dossier.py`. For a client who wants
-it installed, every release also carries `GEA-Reader-Setup-0.82.0.exe`: GEA
+it installed, every release also carries `GEA-Reader-Setup-0.83.1.exe`: GEA
 Reader as a Windows program of its own - its own icon and taskbar button,
 Check with GEA Reader on a dossier's right-click menu, fingerprints the client
 saves kept on that computer, nothing of GEA-Program. `gea help reader`.
@@ -1569,7 +1573,7 @@ attaches the zips to the GitHub release of that tag.
 
 ### The Windows installer
 
-Every release also carries `GEA-Program-Setup-0.82.0.exe` (for 0.82.0): the
+Every release also carries `GEA-Program-Setup-0.83.1.exe` (for 0.83.1): the
 same Windows kit installed like any Windows program, for the signed-in user
 alone and with no administrator rights (`%LOCALAPPDATA%\Programs\GEA-Program`).
 It asks for the site workspace (an existing one such as `C:\site` is used as
@@ -1588,7 +1592,7 @@ it, removes the program and leaves the workspace. Silent, for a site's
 software deployment:
 
 ```
-GEA-Program-Setup-0.82.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
+GEA-Program-Setup-0.83.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"
 ```
 
 The setup is built by Inno Setup 6 from `tools/installer.iss` in the same

{gea_program-0.82.0 → gea_program-0.83.1}/gea/__init__.py

@@ -123,7 +123,7 @@ from .profile_catalog import (
     read_pangaea_txt,
 )
 
-__version__ = "0.82.0"
+__version__ = "0.83.1"
 __all__ = [
     "aging_rate", "rate_psi_yr", "accuracy_psi",
     "Sensor", "SimulatorConfig", "DownholeEngine",

{gea_program-0.82.0 → gea_program-0.83.1}/gea/acceptance_tests.py

@@ -15246,7 +15246,7 @@ def section_do_reader_program(tmp: str) -> None:
     marks = _re.findall(r'attach-kit\.sh "[^"]*" "[^"]+" "([^"]+)"', wf)
     v = __version__
     assets = [f"gea-program-{v}-win64.zip", f"GEA-Program-Setup-{v}.exe", f"gea-program-{v}-linux-x86_64.zip", f"GEA-Reader-Setup-{v}.exe", f"GEA-Reader-portable-{v}.zip",
-              f"GEA-Recorder-{v}.tar.gz", f"GEA-Driller-{v}.tar.gz"]
+              f"GEA-Recorder-{v}.tar.gz", f"GEA-Driller-{v}.tar.gz", f"GEA-VPN-Setup-{v}.exe", f"GEA-VPN-{v}.tar.gz"]
     app_id = _re.search(r"AppId=\{\{([0-9A-F-]+)\}", iss)
     c3 = {
         "kit": {"GEA-Reader.html", "GEA-Reader.cmd", "README.txt", "MANIFEST.json", "SHA256SUMS.txt", "reader.ico", "app/gea_reader.py", "app/winident.py",
@@ -15266,7 +15266,7 @@ def section_do_reader_program(tmp: str) -> None:
                      and '-m gea_reader ""%1""' in iss,
         "workflow": "windows-reader:" in wf and "tools/build_reader.py" in wf and "tools\\reader_installer.iss" in wf and "-m gea_reader --selftest" in wf
                     and "the right-click entry is still there" in wf
-                    and all(sum(mk in a_ for mk in marks) == 1 for a_ in assets) and len(marks) == 7,
+                    and all(sum(bool(_re.search(mk, a_)) for mk in marks) == 1 for a_ in assets) and len(marks) == 9,
     }
     failed3 = [k for k, v_ in c3.items() if not v_]
     ok(not failed3,
@@ -16219,7 +16219,8 @@ def section_dt_vpn(tmp: str) -> None:
     c3 = {
         "written": set(written) == {"hub", "office", box["id"], rd["id"]},
         "hub_zip": hub_names == ["README.txt", "gea-vpn.conf", "install-hub.sh"] and "wg syncconf" in install_sh and "PORT=51820" in install_sh and "$PORT/udp" in install_sh and "ip_forward" in install_sh and "IFACE=gea-vpn" in install_sh and "wg-quick@$IFACE" in install_sh,
-        "box_zip": box_names == ["gea-vpn.conf", "vpn.sh"] and box_conf_z == (root / box["id"] / "gea-vpn.conf").read_text(encoding="utf-8") and "IFACE=gea-vpn" in vpn_sh and "wg-quick@$IFACE" in vpn_sh and "wireguard" in vpn_sh,
+        # the files are written anew below (after the removal) with a new "made" line: the comparison leaves the first line out
+        "box_zip": box_names == ["gea-vpn.conf", "vpn.sh"] and box_conf_z.split("\n", 1)[1] == (root / box["id"] / "gea-vpn.conf").read_text(encoding="utf-8").split("\n", 1)[1] and "IFACE=gea-vpn" in vpn_sh and "wg-quick@$IFACE" in vpn_sh and "wireguard" in vpn_sh,
         "reader_zip": rd_names == ["README.txt", "gea-vpn.conf"],
         "sh_n": sh_ok in (None, True),
         "wg_quick_strip": strip_ok in (None, True),
@@ -17280,6 +17281,155 @@ def section_dz_textbook_oracle(tmp: str) -> None:
        "the self-test holds the policy to the oracle as well; the help names the bar and the ceiling" + (f" [failed: {', '.join(failed2)}]" if failed2 else ""))
 
 
+def section_ea_vpn_client(tmp: str) -> None:
+    """Section EA - GEA-VPN, the client program: standalone (the standard library and nothing of GEA), the connect
+    information read from the zip GEA itself writes for a member and from pasted text, refused when wrong, its
+    public key the one GEA has for the member; the page waiting, taking the information, refusing a request without
+    its own header, forgetting; the records owner-only with a log; `wg show` parsed; the self-test from the command
+    line; the Linux kit built (the wheel, install.sh, the sums); the Windows setup script, the workflow's jobs and
+    marks, the icon, the kit names in the updates, the member's README, the card, the help, IT_SECURITY."""
+    import importlib
+    import importlib.util as _ilu
+    import io as _io
+    import re as _re
+    import subprocess as _sp
+    import zipfile as _zf
+    from . import __version__
+    from . import helplib as H
+    from . import icon as IC
+    from . import updates as UP
+    from . import vpn as VP
+    from . import x25519 as X
+    from .workspace import Workspace
+    pkg = Path(__file__).parent
+    src = pkg.parent / "vpn"
+    d = Path(tmp, "ea"); d.mkdir()
+    if not (src / "gea_vpn" / "__init__.py").is_file():
+        ok(True, "EA GEA-VPN's program (vpn/) is not beside this installation; the kits carry it - nothing to check here")
+        return
+    if str(src) not in sys.path:
+        sys.path.insert(0, str(src))
+    GV = importlib.import_module("gea_vpn"); GB = importlib.import_module("gea_vpn.bundle"); GS = importlib.import_module("gea_vpn.service"); GW = importlib.import_module("gea_vpn.wg")
+    # -- EA1 the program ---------------------------------------------------------------------------------------------------------
+    imports = set()
+    for p_ in (src / "gea_vpn").glob("*.py"):
+        for m_ in _re.findall(r"^\s*(?:from|import)\s+([a-zA-Z_][\w.]*)", p_.read_text(encoding="utf-8"), flags=_re.M):
+            imports.add(m_.split(".")[0])
+    foreign = {m_ for m_ in imports if m_ not in sys.stdlib_module_names and m_ not in ("gea_vpn",)} if hasattr(sys, "stdlib_module_names") else set()
+    ws = Workspace.create(str(d / "ws"), "Pad 3 vpn", actor="tester")
+    VP.create(ws, "tester", "vpn.pad3site.com")
+    m = VP.add_member(ws, "tester", "Pad 3 rig PC", "driller")
+    written = VP.write_bundles(ws, "tester")
+    zip_bytes = Path(written[m["id"]]["zip"]).read_bytes()
+    info = GB.read_connect_info(zip_bytes, os.path.basename(written[m["id"]]["zip"]))
+    net = VP.load(ws)
+    office = next(x for x in net["members"] if x["kind"] == "office")
+    readme = Path(written[m["id"]]["dir"], "README.txt").read_text(encoding="utf-8")
+    text_info = GB.check_conf(Path(written[m["id"]]["conf"]).read_text(encoding="utf-8"))
+    refused = []
+    for bad in (b"hello", b"PK\x03\x04junk", Path(written[m["id"]]["conf"]).read_text(encoding="utf-8").replace(":51820", "").encode(),
+                Path(written[m["id"]]["conf"]).read_text(encoding="utf-8").replace("[Peer]", "[Peer]\nPublicKey = AAAA\n[Peer]").encode()):
+        try:
+            GB.read_connect_info(bad, "x.conf"); refused.append(False)
+        except GB.BundleError:
+            refused.append(True)
+    cl = GS.Client(data_dir=str(d / "data"), dry=True)
+    srv = GS.Server(cl, port=0); srv.start()
+    try:
+        import urllib.error
+        import urllib.request
+        with urllib.request.urlopen(srv.url + "/live.json", timeout=5) as r_:
+            l0 = json.load(r_)
+        rq = urllib.request.Request(srv.url + "/api/connect", data=json.dumps({"text": info["conf"]}).encode(), headers={"Content-Type": "application/json"}, method="POST")
+        try:
+            urllib.request.urlopen(rq, timeout=5); no_header = False
+        except urllib.error.HTTPError as e:
+            no_header = e.code == 403
+        rq = urllib.request.Request(srv.url + "/api/connect", data=json.dumps({"text": info["conf"], "by": "tester"}).encode(), headers={"Content-Type": "application/json", "X-GEA-VPN": "1", "Origin": "http://evil.example"}, method="POST")
+        try:
+            urllib.request.urlopen(rq, timeout=5); foreign_origin = False
+        except urllib.error.HTTPError as e:
+            foreign_origin = e.code == 403
+        # the zip itself, as the page takes it from a drop
+        bnd = "----gea"; body = (f"--{bnd}\r\nContent-Disposition: form-data; name=\"by\"\r\n\r\ntester\r\n--{bnd}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"gea-vpn-x.zip\"\r\nContent-Type: application/zip\r\n\r\n").encode() + zip_bytes + f"\r\n--{bnd}--\r\n".encode()
+        rq = urllib.request.Request(srv.url + "/api/connect", data=body, headers={"Content-Type": f"multipart/form-data; boundary={bnd}", "X-GEA-VPN": "1"}, method="POST")
+        with urllib.request.urlopen(rq, timeout=5) as r_:
+            res = json.load(r_)
+        with urllib.request.urlopen(srv.url + "/live.json", timeout=5) as r_:
+            l1 = json.load(r_)
+        with urllib.request.urlopen(srv.url + "/health", timeout=5) as r_:
+            hl = json.load(r_)
+        mode = os.stat(cl.state.conf).st_mode & 0o777
+        rq = urllib.request.Request(srv.url + "/api/forget", data=b'{"by":"tester"}', headers={"Content-Type": "application/json", "X-GEA-VPN": "1"}, method="POST")
+        with urllib.request.urlopen(rq, timeout=5) as r_:
+            json.load(r_)
+        with urllib.request.urlopen(srv.url + "/live.json", timeout=5) as r_:
+            l2 = json.load(r_)
+    finally:
+        srv.stop()
+    dump = "PRIV\tPUB\t0\toff\n" + "HUBKEY\tPSK\t203.0.113.10:51820\t10.77.0.1/32,10.77.0.2/32\t" + str(int(time.time()) - 40) + "\t1024\t2048\t25\n"
+    pd = GW.parse_dump(dump)
+    wst = GW.status()
+    env = dict(os.environ); env["PYTHONPATH"] = str(src)
+    r_st = _sp.run([sys.executable, "-m", "gea_vpn", "selftest", "--json"], capture_output=True, text=True, env=env, cwd=str(d))
+    try:
+        stj = json.loads(r_st.stdout)
+    except ValueError:
+        stj = {}
+    c1 = {
+        "standalone": not foreign and GV.__version__ == __version__ and "numpy" not in imports,
+        "zip_read": info["name"] == "Pad 3 rig PC" and info["kind"] == "driller" and info["address"] == m["address"] and info["hub"]["host"] == "vpn.pad3site.com" and info["hub"]["port"] == 51820
+                    and info["hub"]["address"] == net["hub"]["address"] and info["office_address"] == office["address"] and info["public_key"] == m["public_key"] and info["preshared"] and info["keepalive_s"] == 25
+                    and text_info["public_key"] == m["public_key"],
+        "refusals": all(refused) and len(refused) == 4,
+        "page": l0["phase"] in ("waiting", "no-wireguard") and l0["member"] is None and no_header and foreign_origin and res["ok"] and res["member"]["address"] == m["address"]
+                and l1["member"]["name"] == "Pad 3 rig PC" and l1["source"] == "gea-vpn-x.zip" and hl["member"] == m["address"] and (os.name == "nt" or mode == 0o600)
+                and l2["member"] is None and not os.path.isfile(cl.state.conf) and any("forget" in x for x in l2["log"]) and any("connect: Pad 3 rig PC" in x for x in l2["log"]),
+        "dump": pd["public_key"] == "PUB" and len(pd["peers"]) == 1 and pd["peers"][0]["endpoint"] == "203.0.113.10:51820" and pd["peers"][0]["rx_bytes"] == 1024 and pd["peers"][0]["keepalive_s"] == 25
+                and isinstance(wst.get("installed"), bool),
+        "selftest": r_st.returncode == 0 and stj.get("ok") and len(stj.get("checks", [])) >= 6,
+    }
+    failed1 = [k for k, v in c1.items() if not v]
+    ok(not failed1,
+       "EA1 GEA-VPN is the standard library and nothing of GEA; it reads the zip GEA writes for a member - the name, the kind, the address, the hub, the office, the "
+       "pre-shared key, the keepalive, and this computer's public key the one GEA has - and the text of the configuration, and refuses what is not one; its page waits, "
+       "refuses a request without its own header or from a foreign origin, takes the zip as dropped, keeps the configuration owner-only and the log, and forgets; "
+       "`wg show` is parsed; the self-test passes from the command line" + (f" [failed: {', '.join(failed1)}]" if failed1 else ""))
+    # -- EA2 the kits, the setup, the workflow, GEA's side -----------------------------------------------------------------------
+    tools = pkg.parent / "tools"
+    spec = _ilu.spec_from_file_location("gea_build_vpn", tools / "build_vpn.py")
+    BV = _ilu.module_from_spec(spec); spec.loader.exec_module(BV)
+    with __import__("contextlib").redirect_stdout(_io.StringIO()):
+        tgz = BV.build_linux(d / "dist")
+    with __import__("tarfile").open(tgz) as tf:
+        names = sorted(n.split("/", 1)[1] for n in tf.getnames() if "/" in n)
+    iss = (tools / "vpn_installer.iss").read_text(encoding="utf-8")
+    wf = (pkg.parent / ".github" / "workflows" / "build-installer.yml").read_text(encoding="utf-8")
+    marks = _re.findall(r'attach-kit\.sh "[^"]*" "([^"]+)" "([^"]+)"', wf)
+    ico = IC.ico_bytes(kind="vpn")
+    app_src = (pkg / "web" / "app.html").read_text(encoding="utf-8")
+    c2 = {
+        "kit": tgz.name == f"GEA-VPN-{__version__}.tar.gz" and {"install.sh", "README.md", "pyproject.toml", "SHA256SUMS.txt", "MANIFEST.json", "gea_vpn/__main__.py", "gea_vpn/service.py", "gea_vpn/wg.py", "gea_vpn/bundle.py"} <= set(names)
+               and (any(n.startswith("gea_vpn-") and n.endswith(".whl") for n in names) or _ilu.find_spec("pip") is None) and "gea_vpn install" in (src / "install.sh").read_text(encoding="utf-8"),
+        "setup": "5B7E2C1A-4D0F-4A7B-9C3E-2F6A8D1E7B42" in iss and "PrivilegesRequired=admin" in iss and "installtunnelservice" not in iss and "-m gea_vpn install" in iss and "wireguard-amd64-0.5.3.msi" in iss
+                 and "uninstall-service" in iss and "schtasks" in iss and "http://127.0.0.1:8795/" in iss,
+        "workflow": "windows-vpn:" in wf and "  vpn:" in wf and "build_vpn.py --win64" in wf and "WireGuard LLC" in wf and ("dist/GEA-VPN-Setup-*.exe", "GEA-VPN-Setup-") in marks
+                    and ("dist/GEA-VPN-*.tar.gz", "GEA-VPN-[0-9]") in marks and "/api/connect" in wf,
+        "icon": len(ico) > 10000 and {s_ for s_, _, _, _ in IC.read_ico(ico)} >= {16, 32, 48, 256},
+        "updates": "GEA-VPN-Setup-" in UP.KITS and "GEA-VPN-" in UP.KITS and UP.KITS.index("GEA-VPN-Setup-") < UP.KITS.index("GEA-VPN-"),
+        "readme": "GEA-VPN-Setup-" in readme and "127.0.0.1:8795" in readme and "wireguard.com" in readme,
+        "card": "GEA-VPN-Setup-" in app_src and "127.0.0.1:8795" in app_src,
+        "help": not H.check("vpn") and "The client program" in (pkg / "help" / "vpn.md").read_text(encoding="utf-8") and "GEA-VPN-Setup-" in (pkg / "help" / "tutorial" / "23-vpn.md").read_text(encoding="utf-8")
+                and "installtunnelservice" in (pkg / "help" / "IT_SECURITY.md").read_text(encoding="utf-8") and "vpn/" in (pkg.parent / "README.md").read_text(encoding="utf-8"),
+    }
+    failed2 = [k for k, v in c2.items() if not v]
+    ok(not failed2,
+       f"EA2 the Linux kit builds ({tgz.name}: the wheel, the program, install.sh, the sums) and its self-test passes on the built program; the Windows setup script installs "
+       "as administrator, carries WireGuard's installer, registers the task and removes it; the workflow builds, signs, installs and attaches both kits with their marks; "
+       "the icon has its sizes; the updates know the two kit names; the member's README, the card, the help, the tutorial and IT_SECURITY say so"
+       + (f" [failed: {', '.join(failed2)}]" if failed2 else ""))
+
+
 def main() -> int:
     print("GEA-Program - ACCEPTANCE SUITE (the product gate)")
     # a handle a job subprocess still holds at the end must not turn a finished gate into a traceback on Windows:
@@ -17413,6 +17563,7 @@ def main() -> int:
         section_dx_third_dimension(tmp)
         section_dy_vibration(tmp)
         section_dz_textbook_oracle(tmp)
+        section_ea_vpn_client(tmp)
     if _FAILS:
         print(f"[ACCEPTANCE] {len(_FAILS)} FAILURES ({_PASS} passed):")
         for f in _FAILS:

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/IT_SECURITY.md

@@ -166,7 +166,21 @@ declared extras.
   admin-only and audited (`vpn.bundle.download`). The tunnel encrypts and
   addresses; the programs' own sign-in, roles and hashes apply through it
   unchanged, and the box's page is still bound to the pad network and the
-  tunnel address only.
+  tunnel address only. The client program **GEA-VPN** (since 0.83.0, the
+  standalone kits `GEA-VPN-Setup-<v>.exe` and `GEA-VPN-<v>.tar.gz`) runs on
+  a member computer as a service - on Windows the scheduled task `GEA-VPN`
+  as SYSTEM, because `wireguard.exe /installtunnelservice` needs those
+  rights - and serves its page on 127.0.0.1:8795 only, to this computer's
+  own browser; its actions need a header a browser form of another site
+  cannot set, and a foreign Origin is refused. It keeps the member's
+  configuration (the private key) owner-only under `%ProgramData%\GEA-VPN`
+  (administrators and SYSTEM) or `/var/lib/gea-vpn` (root), shows the public
+  key only, and logs every connect, disconnect and forget with the name
+  given. It reaches no network itself: WireGuard does, as the configuration
+  says, and the page's one probe is a TCP connect to the office's port
+  through the tunnel. The Windows setup carries WireGuard's own installer,
+  whose Authenticode signature (WireGuard LLC) the build checks before the
+  setup is made; it is run only when the computer has no WireGuard.
 - **The tutorial** (since 0.76.0): the lessons are files inside the
   program; reading one writes nothing. A person's ticks are kept in the
   workspace (`records\tutorial_progress.json`, by account name, no more);

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/driller.md

@@ -2,7 +2,7 @@
 
 > A program on the rig PC that reads the rig's own feed and the pre-drill model, places the bit in the layer with a position filter, and, every 30 ft, recommends in the driller's units what to do next - a policy trained by reinforcement learning in a physics twin of the lateral - with the driller's answer, every command, and the records pulled into GEA.
 
-**The command**: on the rig PC, `GEA-Driller-0.82.0.tar.gz` from the release (or the kit's `installers` folder, fetched on the Audit / Update tab): unpack it and run `sudo sh install.sh` on Linux or `install.cmd` on Windows, once; edit its config - the EDR's WITS0 feed (`tcp`, the host and port; `serial`, the COM port), the pre-drill model (the target layer's top TVD at the heel, its thickness and dip, the gamma in, above and below, the deep-resistivity tool, the heel's MD and TVD), the tool's cap, the limits - and restart it. The driller's screen is at port 8790 of the rig PC: `http://192.168.1.60:8790/live`. It shows the section with the model's layer window, the hole drilled through it and - since 0.78.0 - the **position filter**'s band: where the layer is from the readings, as a geosteerer places it (a particle filter over the layer's offset from the model, its dip error and its thickness, moved every decision and kept to the guesses that explain the gamma and the deep-resistivity distance), with the probability the bit is in the layer, above or below it and the distance to the top and the base with its spread, sixty feet ahead; the agent reads the same estimate, and so does the textbook driller it is judged against. Then the recommendation in words - *Build +1.5°/100 ft (toolface up, 25% steering); 25 klb WOB, 120 rpm, 500 gpm* - with its reasons (what the deep-resistivity tool says, the gamma against the model's values, the model's bracket, the limits) and the confidence of each choice, the rig's numbers against the limits, and **Accept**, **Reject** or **Did something else…** with the operator's name. In GEA: the **Drill string** tab's card **GEA Driller** - the rig PC's address and the well, **Pull**: the records come in checked against their hashes, and the table says how many decisions, accepted, rejected, done otherwise, the hole under advice, the armed sections and the commands. **Open the driller's screen** opens the rig PC's screen from its address. Before there is a rig PC: **Start the twin as the rig** runs the driller's program on this computer with a scene drilling itself under the agent - **Open its screen** is the driller's screen with the twin behind it, labelled SIMULATION - and **Pull from it** brings its records in; **Stop it** closes them. **Shadow a drilled well** (since 0.79.0): a well of this workspace with a drilling-recorder export is replayed through the advisor - every 30 ft the agent sees what the rig had shown to that point and nothing past it, and its recommendation is set beside what the record did next: the build actually made over the following 90 ft, the weight, speed and flow used, and at each stretch the gamma marks as out of the layer, whether the advisor called the way back at the first reading. The report, **SHADOW MODE**, is under the well's reports with a drawing of the lateral against the layer; the layer model is read off the well's own gamma in hindsight and says so - and grades how well it fits the well (good, fair, poor: a well steered to a rock that is not the low gamma reads poor, and the agent's calls against a poor model mean little) - unless the site's pre-drill model is given: a file `wells\Well-30636033\driller\model.json` with the config's `model` block (the target layer's top TVD at the heel, its thickness and dip, the gamma in, above and below, the heel's MD and TVD) is used whenever it is there (`gea workspace --path C:\site --action driller-shadow --well Well-30636033`). The export is read on this computer and nothing of it leaves it. Agreement with the driller says the two would have done alike, not that either was right. **The third dimension** (since 0.80.0): the lateral has an azimuth. The config's model carries the plan's azimuth (`plan_azimuth_deg`; empty, the first survey's at the heel is taken), the layer's dip across the plan line (`cross_dip_deg`, positive deepening to the right), the corridor the hole may run in to the right and left of the plan line (`corridor_ft`, the lease line and the offset wells) and where the heel sits across it (`heel_offset_ft`); the feed's surveys and the continuous azimuth (WITS item 0832, or the config's mapping) place the bit by minimum curvature along the plan, right of its line and in depth, and the screen draws the plan view - the corridor as a band, the hole against the plan line - under the section. The recommendation gains the aim - where to point the azimuth, along the plan or 4° left or right of it, and the turn that asks from where the hole points: *Build +1.5°/100 ft and aim 4° right of the plan (azimuth 44.0°), turning right 2.0°/100 ft (toolface 53°, 42% steering)* - with the build and the turn held together inside the DLS limit, and **Did something else…** takes the aim, or the turn made instead; the position filter carries the cross dip and reads it only when the hole moves across the plan line, leaving the model's value standing until then. In the twin the layer is a surface, the faults have a strike, the tool walks, and a hole that leaves the corridor by 150 ft is lost; the agent is judged on the hole in the corridor as well as in the layer (`gea-driller evaluate` prints both). Shadow mode reads the record's `azimuth_deg` column when it has one and sets the turn the advisor would have asked beside the turn the record made; without it the record's turns are not judged, and the report says so. **The vibration index from the feed** (since 0.81.0): a rig without a downhole vibration tool left the agent blind to the stick-slip and the whirl it was trained to ease, and the closed loop's vibration limit could never trip. Now the rig PC reads an index off the surface channels every EDR sends: over the last minute (`rig.vibration_window_s`), the surface torque's RMS about its mean as a fraction of the mean - the measure the Drill string page calls the oscillation index - times root two for the amplitude, and the same of the weight on bit and the hook load; stick-slip is the torque amplitude over 0.4, lateral vibration the weight amplitude over 0.2 (the twin's scale, where 1.2 is the limit), and the index is the larger. The downhole tool's item (WITS 0830) is taken instead whenever it comes, and every decision records which it read: the tile on the screen says *downhole tool* or *from surface data, stick-slip*, the reasons say *vibration 1.35 derived from the surface data (stick-slip, the surface torque swinging ±54%) over the limit 1.2*, and the limit disarms the loop on either. A surface proxy, labelled; on the twin as the rig it tracks the twin's own index within a few hundredths. The lateral file GEA writes for shadow mode carries, per foot, the surface channels' mean and RMS over the seconds of that foot (`torque_mean`, `torque_rms`, `wob_mean`, `wob_rms`, `hkld_mean`, `hkld_rms`, `rpm_mean`, `rpm_rms`, `spp_mean`, `spp_rms`), the replay reads the index off them for every decision, and the report says how often it stood over the limit and how often the advisor asked for less weight or more speed there than the record used; a record without torque or weight statistics says so and the advisor sees none. **The bar and the ceiling** (since 0.82.0): the agent is judged between two drillers on the same held-out scenes. The textbook driller is the bar - what a careful directional driller and geosteerer do by the book from the same observation the agent gets and nothing more: aim at the middle of the layer as the filter places it, steer back hard when the filter says the bit is out, lean away from a boundary the gamma's trend is running at, the rated weight in a calm hole in the layer and not while the hole fills, over the vibration limit lighter and faster first and heavier and slower when that did not quiet it, circulate at 40% of a bed, ream a balled bit, hold the plan line; it has a driller's memory of its own last decisions and none of the twin's secret. The oracle is the ceiling - the same driller told the twin's own layer at the bit and 120 ft ahead of it, which no policy can beat because it sees what no tool measures. `gea-driller evaluate` prints the three rows and how far the agent stands from the bar toward the ceiling; the self-test refuses a policy that does not beat the textbook, and the gate holds it under the oracle. The figures are a simulation's, labelled; a stronger textbook lowers the agent's standing without changing the agent, and that is the point of it. Over a cellular modem the rig PC joins GEA-VPN as a member of kind `driller` and GEA pulls from `http://10.77.0.4:8790`. The closed loop: `closed_loop.allowed` in the rig PC's config puts the switch on its screen; an operator arms it by name for one section of at most 500 ft (**Arm for this section**), every decision then goes to the downlink as a command, and the loop disarms itself on a stale feed, a crossed limit, the section's end or **Disarm now** - and this version's only downlink is the null one, which keeps every command on record and sends none, because no vendor's downlink protocol ships with it. From a terminal: `gea workspace --path C:\site --action driller-pull --box http://192.168.1.60:8790 --well SWD-1`; on the rig PC `gea-driller sim --seed 7 --pace 3 --port 8790`, `gea-driller evaluate --scenes 20`, `gea-driller train --seconds 600 --out policy.json`, `gea-driller selftest`.
+**The command**: on the rig PC, `GEA-Driller-0.83.1.tar.gz` from the release (or the kit's `installers` folder, fetched on the Audit / Update tab): unpack it and run `sudo sh install.sh` on Linux or `install.cmd` on Windows, once; edit its config - the EDR's WITS0 feed (`tcp`, the host and port; `serial`, the COM port), the pre-drill model (the target layer's top TVD at the heel, its thickness and dip, the gamma in, above and below, the deep-resistivity tool, the heel's MD and TVD), the tool's cap, the limits - and restart it. The driller's screen is at port 8790 of the rig PC: `http://192.168.1.60:8790/live`. It shows the section with the model's layer window, the hole drilled through it and - since 0.78.0 - the **position filter**'s band: where the layer is from the readings, as a geosteerer places it (a particle filter over the layer's offset from the model, its dip error and its thickness, moved every decision and kept to the guesses that explain the gamma and the deep-resistivity distance), with the probability the bit is in the layer, above or below it and the distance to the top and the base with its spread, sixty feet ahead; the agent reads the same estimate, and so does the textbook driller it is judged against. Then the recommendation in words - *Build +1.5°/100 ft (toolface up, 25% steering); 25 klb WOB, 120 rpm, 500 gpm* - with its reasons (what the deep-resistivity tool says, the gamma against the model's values, the model's bracket, the limits) and the confidence of each choice, the rig's numbers against the limits, and **Accept**, **Reject** or **Did something else…** with the operator's name. In GEA: the **Drill string** tab's card **GEA Driller** - the rig PC's address and the well, **Pull**: the records come in checked against their hashes, and the table says how many decisions, accepted, rejected, done otherwise, the hole under advice, the armed sections and the commands. **Open the driller's screen** opens the rig PC's screen from its address. Before there is a rig PC: **Start the twin as the rig** runs the driller's program on this computer with a scene drilling itself under the agent - **Open its screen** is the driller's screen with the twin behind it, labelled SIMULATION - and **Pull from it** brings its records in; **Stop it** closes them. **Shadow a drilled well** (since 0.79.0): a well of this workspace with a drilling-recorder export is replayed through the advisor - every 30 ft the agent sees what the rig had shown to that point and nothing past it, and its recommendation is set beside what the record did next: the build actually made over the following 90 ft, the weight, speed and flow used, and at each stretch the gamma marks as out of the layer, whether the advisor called the way back at the first reading. The report, **SHADOW MODE**, is under the well's reports with a drawing of the lateral against the layer; the layer model is read off the well's own gamma in hindsight and says so - and grades how well it fits the well (good, fair, poor: a well steered to a rock that is not the low gamma reads poor, and the agent's calls against a poor model mean little) - unless the site's pre-drill model is given: a file `wells\Well-30636033\driller\model.json` with the config's `model` block (the target layer's top TVD at the heel, its thickness and dip, the gamma in, above and below, the heel's MD and TVD) is used whenever it is there (`gea workspace --path C:\site --action driller-shadow --well Well-30636033`). The export is read on this computer and nothing of it leaves it. Agreement with the driller says the two would have done alike, not that either was right. **The third dimension** (since 0.80.0): the lateral has an azimuth. The config's model carries the plan's azimuth (`plan_azimuth_deg`; empty, the first survey's at the heel is taken), the layer's dip across the plan line (`cross_dip_deg`, positive deepening to the right), the corridor the hole may run in to the right and left of the plan line (`corridor_ft`, the lease line and the offset wells) and where the heel sits across it (`heel_offset_ft`); the feed's surveys and the continuous azimuth (WITS item 0832, or the config's mapping) place the bit by minimum curvature along the plan, right of its line and in depth, and the screen draws the plan view - the corridor as a band, the hole against the plan line - under the section. The recommendation gains the aim - where to point the azimuth, along the plan or 4° left or right of it, and the turn that asks from where the hole points: *Build +1.5°/100 ft and aim 4° right of the plan (azimuth 44.0°), turning right 2.0°/100 ft (toolface 53°, 42% steering)* - with the build and the turn held together inside the DLS limit, and **Did something else…** takes the aim, or the turn made instead; the position filter carries the cross dip and reads it only when the hole moves across the plan line, leaving the model's value standing until then. In the twin the layer is a surface, the faults have a strike, the tool walks, and a hole that leaves the corridor by 150 ft is lost; the agent is judged on the hole in the corridor as well as in the layer (`gea-driller evaluate` prints both). Shadow mode reads the record's `azimuth_deg` column when it has one and sets the turn the advisor would have asked beside the turn the record made; without it the record's turns are not judged, and the report says so. **The vibration index from the feed** (since 0.81.0): a rig without a downhole vibration tool left the agent blind to the stick-slip and the whirl it was trained to ease, and the closed loop's vibration limit could never trip. Now the rig PC reads an index off the surface channels every EDR sends: over the last minute (`rig.vibration_window_s`), the surface torque's RMS about its mean as a fraction of the mean - the measure the Drill string page calls the oscillation index - times root two for the amplitude, and the same of the weight on bit and the hook load; stick-slip is the torque amplitude over 0.4, lateral vibration the weight amplitude over 0.2 (the twin's scale, where 1.2 is the limit), and the index is the larger. The downhole tool's item (WITS 0830) is taken instead whenever it comes, and every decision records which it read: the tile on the screen says *downhole tool* or *from surface data, stick-slip*, the reasons say *vibration 1.35 derived from the surface data (stick-slip, the surface torque swinging ±54%) over the limit 1.2*, and the limit disarms the loop on either. A surface proxy, labelled; on the twin as the rig it tracks the twin's own index within a few hundredths. The lateral file GEA writes for shadow mode carries, per foot, the surface channels' mean and RMS over the seconds of that foot (`torque_mean`, `torque_rms`, `wob_mean`, `wob_rms`, `hkld_mean`, `hkld_rms`, `rpm_mean`, `rpm_rms`, `spp_mean`, `spp_rms`), the replay reads the index off them for every decision, and the report says how often it stood over the limit and how often the advisor asked for less weight or more speed there than the record used; a record without torque or weight statistics says so and the advisor sees none. **The bar and the ceiling** (since 0.82.0): the agent is judged between two drillers on the same held-out scenes. The textbook driller is the bar - what a careful directional driller and geosteerer do by the book from the same observation the agent gets and nothing more: aim at the middle of the layer as the filter places it, steer back hard when the filter says the bit is out, lean away from a boundary the gamma's trend is running at, the rated weight in a calm hole in the layer and not while the hole fills, over the vibration limit lighter and faster first and heavier and slower when that did not quiet it, circulate at 40% of a bed, ream a balled bit, hold the plan line; it has a driller's memory of its own last decisions and none of the twin's secret. The oracle is the ceiling - the same driller told the twin's own layer at the bit and 120 ft ahead of it, which no policy can beat because it sees what no tool measures. `gea-driller evaluate` prints the three rows and how far the agent stands from the bar toward the ceiling; the self-test refuses a policy that does not beat the textbook, and the gate holds it under the oracle. The figures are a simulation's, labelled; a stronger textbook lowers the agent's standing without changing the agent, and that is the point of it. Over a cellular modem the rig PC joins GEA-VPN as a member of kind `driller` and GEA pulls from `http://10.77.0.4:8790`. The closed loop: `closed_loop.allowed` in the rig PC's config puts the switch on its screen; an operator arms it by name for one section of at most 500 ft (**Arm for this section**), every decision then goes to the downlink as a command, and the loop disarms itself on a stale feed, a crossed limit, the section's end or **Disarm now** - and this version's only downlink is the null one, which keeps every command on record and sends none, because no vendor's downlink protocol ships with it. From a terminal: `gea workspace --path C:\site --action driller-pull --box http://192.168.1.60:8790 --well SWD-1`; on the rig PC `gea-driller sim --seed 7 --pace 3 --port 8790`, `gea-driller evaluate --scenes 20`, `gea-driller train --seconds 600 --out policy.json`, `gea-driller selftest`.
 
 **What it writes**: on the rig PC, `decisions.jsonl` (every observation, recommendation, confidence, reasons and answer), `commands.jsonl` (every arming, command and disarming with its reason) and `surveys.csv`, each with a `.sha256` beside it, and `manifest.json`. In GEA, `wells\SWD-1\driller\` holds the same files as pulled, `manifest.json` and `last_pull.json` with the summary; the audit lines `driller.pull`, `driller.sim_start`, `driller.sim_stop`. The twin as the rig writes under `field\sim-driller\data`.
 

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/install.md

@@ -2,7 +2,7 @@
 
 > GEA-Program-Setup: the program installed for you like any Windows program - a window of its own, an icon in the notification area, Start-menu and desktop shortcuts, an Add/Remove Programs entry, upgrades in place - with no administrator rights and the site's data left where it is.
 
-**The command**: download the setup from the release on GitHub (`GEA-Program-Setup-0.82.0.exe` for this version) and run it. It installs for you alone, under `%LOCALAPPDATA%\Programs\GEA-Program`, and asks for the site workspace - the folder that holds the wells, reports, records, accounts and keys. An existing one such as `C:\site` is used exactly as it is, its name included; for a new one (by default `%LOCALAPPDATA%\GEA-Program\site`) it also asks the site's name, which heads every report, and makes the workspace with it (left empty, the workspace is named after its folder; an administrator renames the site in Administration's site settings). Then the Start menu's **GEA-Program** (and the desktop shortcut) starts the control panel when it is not running and opens it in a window of its own. A newer setup installs over the older one: it stops the control panel, replaces the program, keeps the workspace and the choices made before. For a site's software deployment: `GEA-Program-Setup-0.82.0.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"` (`/SITENAME` names a workspace the setup makes; one that exists keeps its own name). From a terminal: `gea launch` does what the shortcut does, `gea launch --selftest` says what it would do, `gea tray --selftest` checks the icon.
+**The command**: download the setup from the release on GitHub (`GEA-Program-Setup-0.83.1.exe` for this version) and run it. It installs for you alone, under `%LOCALAPPDATA%\Programs\GEA-Program`, and asks for the site workspace - the folder that holds the wells, reports, records, accounts and keys. An existing one such as `C:\site` is used exactly as it is, its name included; for a new one (by default `%LOCALAPPDATA%\GEA-Program\site`) it also asks the site's name, which heads every report, and makes the workspace with it (left empty, the workspace is named after its folder; an administrator renames the site in Administration's site settings). Then the Start menu's **GEA-Program** (and the desktop shortcut) starts the control panel when it is not running and opens it in a window of its own. A newer setup installs over the older one: it stops the control panel, replaces the program, keeps the workspace and the choices made before. For a site's software deployment: `GEA-Program-Setup-0.83.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /WORKSPACE="C:\site" /SITENAME="Pad 3" /TASKS="desktopicon"` (`/SITENAME` names a workspace the setup makes; one that exists keeps its own name). From a terminal: `gea launch` does what the shortcut does, `gea launch --selftest` says what it would do, `gea tray --selftest` checks the icon.
 
 **The window**: Microsoft Edge's app window (`msedge --app=`: the control panel with no tabs and no address bar, its own button on the taskbar, which shows the program's derrick and pins as GEA-Program, not as Edge), with a browser profile of its own (`%LOCALAPPDATA%\GEA-Program\window`, no extensions; the first time, Edge may say it signed that profile in to your Microsoft account - Got it), else Google Chrome's, else a tab in the default browser. Where the browser keeps no cookies (its settings or a policy block them), the sign-in page says so and the control panel holds the sign-in itself, in the window's address, until the window is closed. The control panel itself runs with no window of its own: `gea supervise` keeps it running in the background, starts it again when it asks for a restart, and writes everything it would have shown in a console - the start, the sign-ins, the jobs, a stop and why - to `records\console.log` in the workspace. No PowerShell or console window opens. The kit's `start-dashboard.cmd` still runs it in a console window, for a site that wants to watch it there.
 
@@ -18,7 +18,7 @@
 
 **The number to check**: Add/Remove Programs lists GEA-Program with the version you installed; `gea doctor --workspace C:\site` ends with `nothing blocks serving`; the Start menu's **Verify GEA-Program** runs the acceptance gate from the installation and ends with `[ACCEPTANCE] OK - N checks passed`. The release's build installs, upgrades and uninstalls the setup silently before it is published, with the control panel running, and checks the workspace untouched afterwards.
 
-**Signed**: when the publisher's code-signing certificate is configured for the build, the setup is signed with it (Authenticode, timestamped) and Windows names the publisher; until then it ships unsigned and Windows SmartScreen says "unknown publisher" (More info, then Run anyway). The build's provenance holds either way: `gh attestation verify GEA-Program-Setup-0.82.0.exe -R Daniel8Murphy0007/GEA-Program`. The uninstaller the setup leaves behind is Inno Setup's own and is not signed separately.
+**Signed**: when the publisher's code-signing certificate is configured for the build, the setup is signed with it (Authenticode, timestamped) and Windows names the publisher; until then it ships unsigned and Windows SmartScreen says "unknown publisher" (More info, then Run anyway). The build's provenance holds either way: `gh attestation verify GEA-Program-Setup-0.83.1.exe -R Daniel8Murphy0007/GEA-Program`. The uninstaller the setup leaves behind is Inno Setup's own and is not signed separately.
 
 **What this page will not call a measurement**: the icon's running or stopped is whether the control panel's port answers on this computer, read every three seconds - not whether every patch, job or report behind it is healthy (Home and the Verification page say that).
 

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/reader.md

@@ -4,7 +4,7 @@
 
 **The command**: Reports tab -> Signed dossiers -> **Download GEA Reader for your clients**, or `gea reader --workspace C:\site --out C:\site\GEA-Reader.html`. Send the file once, by any channel (email, a USB stick, the client's portal); send the site's key fingerprint separately - by phone, email or in the contract - as for any dossier. The client opens GEA-Reader.html, drops a dossier on it (or chooses it), and reads the verdict: **Valid** (signed with the site's key, or with a newer key the site's key handed over to), **Valid, but signed by a key you were not given**, or **Not valid** with the reason. Below the verdict: each check, the signer's fingerprint, the key hand-overs, and every file the dossier holds - a report opens in the page as it was signed, a PDF in the browser's own viewer, a table or a log as text, and any file can be saved. A dossier that lists source records by hash without carrying them lets the client choose their copies and checks each against its hash.
 
-**The program**: for a client who wants it installed, **GEA-Reader-Setup-0.82.0.exe** on the release page installs GEA Reader as a Windows program of its own, for the signed-in user, with no administrator rights and nothing of GEA-Program: GEA Reader in the Start menu and on the desktop with its own icon (a white page with a green seal, on blue) and its own taskbar button, and **Check with GEA Reader** on the right-click menu of .zip files (on Windows 11, under Show more options), which opens the dossier at once. It opens the same page in Microsoft Edge's app window with a browser profile of its own (`%LOCALAPPDATA%\GEA-Reader\window`), so a fingerprint the client saves - **Remember this fingerprint**, with whose it is - stays on that computer, and every later dossier signed with that key reads **Valid** with the name the client gave it. `GEA-Reader-portable-0.82.0.zip` is the same program to unzip and run (`GEA-Reader.cmd`). `python\python.exe -m gea_reader --selftest`, in the installed folder, checks the page, the icon, the taskbar identity and the hand-over of a dossier without opening a window.
+**The program**: for a client who wants it installed, **GEA-Reader-Setup-0.83.1.exe** on the release page installs GEA Reader as a Windows program of its own, for the signed-in user, with no administrator rights and nothing of GEA-Program: GEA Reader in the Start menu and on the desktop with its own icon (a white page with a green seal, on blue) and its own taskbar button, and **Check with GEA Reader** on the right-click menu of .zip files (on Windows 11, under Show more options), which opens the dossier at once. It opens the same page in Microsoft Edge's app window with a browser profile of its own (`%LOCALAPPDATA%\GEA-Reader\window`), so a fingerprint the client saves - **Remember this fingerprint**, with whose it is - stays on that computer, and every later dossier signed with that key reads **Valid** with the name the client gave it. `GEA-Reader-portable-0.83.1.zip` is the same program to unzip and run (`GEA-Reader.cmd`). `python\python.exe -m gea_reader --selftest`, in the installed folder, checks the page, the icon, the taskbar identity and the hand-over of a dossier without opening a window.
 
 **What it writes**: the one file, GEA-Reader.html (about 40 KB): the checks, written in the page's own script - Ed25519 (RFC 8032) in its own arithmetic, SHA-256 from the browser - and, when made from a workspace, the site's name and the fingerprints of every key it has signed with (the current one and each retired one from the key history: public halves only; the signing key never leaves `keys\`). The audit log records each download (`reader.download`) and each `gea reader` (`reader.write`) with the fingerprints the reader carried. The reader page writes nothing on the client's computer but the fingerprints a client saves (in the browser's storage for the page): it reads the zip it is given, in memory, and a saved copy goes where the client's browser saves downloads. The installed program also writes the page it opens to `%LOCALAPPDATA%\GEA-Reader\page` (with the dossier inside it when one was right-clicked; removed ten minutes later) and its right-click entry under the user's own registry keys, removed with the program.
 

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/recorder.md

@@ -2,7 +2,7 @@
 
 > GEA Recorder is the program on the pad: a Raspberry Pi in a sealed box that records the ground channels (geophones, accelerometers, electrode dipoles) through a 24-bit ADC and the rig's WITS0 feed, every sample on one GPS-disciplined clock, into hourly miniSEED files with a SHA-256 beside each and a manifest, and serves one status page on the pad network. Nothing to type: power it and it records. GEA pulls its files in and makes stations of them.
 
-**The command**: the **Seismic** tab, the card **Field recorder**: the box's address on the pad network (`http://192.168.1.50:8780` - the status page shows the address) or the folder of the USB mirror carried to the office, a station name if the site's is not wanted, then **Pull** (a job). GEA fetches the manifest, downloads every file it does not have, checks each against its SHA-256, and makes or updates two stations: the array of the ground-motion sensors (band 8-80 Hz, the sensors' positions from the box's config) and the electrode station (0.01-5 Hz); each sensor's hours are joined in order into one record, nothing re-sampled or filtered. Pull again later: only the new hours come across, and the stations are updated in place. From a terminal: `gea workspace --path C:\site --action field-pull --box http://192.168.1.50:8780`. On the box: `gea-recorder status`, `gea-recorder selftest`; `sudo sh kiosk.sh` once puts the live view full-screen on a monitor on the box's HDMI port from boot - RECORDING in green or what is wrong in red, the clock, the rig's depth, every channel's last minute and the ground sensors' spectrogram, nothing to press - and the same view is at `/live` on the box's page from any browser on the pad network; `sudo sh install.sh` once, from the release's `GEA-Recorder-0.82.0.tar.gz`; the box's README has the parts list, the wiring and the three chrony lines for the GPS clock.
+**The command**: the **Seismic** tab, the card **Field recorder**: the box's address on the pad network (`http://192.168.1.50:8780` - the status page shows the address) or the folder of the USB mirror carried to the office, a station name if the site's is not wanted, then **Pull** (a job). GEA fetches the manifest, downloads every file it does not have, checks each against its SHA-256, and makes or updates two stations: the array of the ground-motion sensors (band 8-80 Hz, the sensors' positions from the box's config) and the electrode station (0.01-5 Hz); each sensor's hours are joined in order into one record, nothing re-sampled or filtered. Pull again later: only the new hours come across, and the stations are updated in place. From a terminal: `gea workspace --path C:\site --action field-pull --box http://192.168.1.50:8780`. On the box: `gea-recorder status`, `gea-recorder selftest`; `sudo sh kiosk.sh` once puts the live view full-screen on a monitor on the box's HDMI port from boot - RECORDING in green or what is wrong in red, the clock, the rig's depth, every channel's last minute and the ground sensors' spectrogram, nothing to press - and the same view is at `/live` on the box's page from any browser on the pad network; `sudo sh install.sh` once, from the release's `GEA-Recorder-0.83.1.tar.gz`; the box's README has the parts list, the wiring and the three chrony lines for the GPS clock.
 
 **Before there is a Pi**: on the same card, **Start the simulated box**: the recorder's own program runs on this computer with its test signal in place of the ADC (a process of its own, its files under `field\sim-box\` in the workspace, its page on port 8781), **Open its monitor** shows the live screen the attendant will see, **Pull from it** brings its files in as stations, **Stop it** closes every file and lists them. **Open the box's monitor** opens any real box's live screen from its address. The kit and the setup install the recorder's program beside GEA for this; a pip install adds it with `pip install gea-recorder`. **From the office, over the internet**: GEA-VPN (`gea help vpn`, Administration) gives every box a private address the office pulls from (`http://10.77.0.3:8780`) through a tunnel from the pad's cellular modem; the box's zip from that card holds `vpn.sh`, run once on the Pi.
 

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial/01-install.md

@@ -5,10 +5,10 @@ Takes: 15 minutes
 > The program installed like any Windows program, with the site's folder chosen once.
 
 ## Before you start
-You need a Windows PC that will stay on while the site is watched (the office machine, or the doghouse PC), and the setup file for this version, `GEA-Program-Setup-0.82.0.exe`, from the release page on GitHub. No administrator rights are needed: the program installs for you alone.
+You need a Windows PC that will stay on while the site is watched (the office machine, or the doghouse PC), and the setup file for this version, `GEA-Program-Setup-0.83.1.exe`, from the release page on GitHub. No administrator rights are needed: the program installs for you alone.
 
 ## Steps
-1. Double-click `GEA-Program-Setup-0.82.0.exe`. If Windows asks whether to run it, choose **Run** - the setup is published by the site, not by a store.
+1. Double-click `GEA-Program-Setup-0.83.1.exe`. If Windows asks whether to run it, choose **Run** - the setup is published by the site, not by a store.
 2. The setup asks for the **site workspace**: the one folder that will hold the wells, the reports, the records, the accounts and the keys. For a new site keep the default or type `C:\site`. For a workspace that already exists, point at it - it is used exactly as it is, its name included.
 3. For a new workspace it asks the **site's name** (`Pad 3`). This name heads every report the program writes; an administrator can change it later in Administration, site settings.
 4. Tick the desktop shortcut and finish. The setup puts **GEA-Program** in the Start menu and an icon in the notification area by the clock.

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial/19-dossier-reader.md

@@ -8,7 +8,7 @@ Takes: 20 minutes
 1. On **Reports**, **Signed dossiers**: **Sign a dossier for the pad**, or one of the wells (the operator role). Tick *embed the source records* to carry the drilling records themselves rather than their hashes. The dossier is a zip: the reports as they stand, the declarations behind them, the audit log, the source records' hashes, the site's Ed25519 signature, and a checker inside (`verify_dossier.py`, plain Python).
 2. **Check** re-checks a dossier this site signed against the workspace as it now stands; a workspace that no longer matches a signed dossier raises an alert. *Check a dossier someone sent you* checks an uploaded one.
 3. **Download GEA Reader for your clients**: one HTML file. Send it to the client once by any channel - email, a USB stick, their portal. Send the site's **key fingerprint** separately - by phone, or in the contract - as for any dossier; the card shows it.
-4. The client opens `GEA-Reader.html` in any current browser, offline, and drops a dossier on it. The verdict: **Valid** (signed with the site's key, or a newer key the site's key handed over to), **Valid, but signed by a key you were not given**, or **Not valid** with the reason. Below it, every file the dossier holds: a report opens in the page as it was signed, a PDF in the browser's own viewer. A client who wants it installed, with a right-click **Check with GEA Reader** on dossiers, gets `GEA-Reader-Setup-0.82.0.exe` from the release page.
+4. The client opens `GEA-Reader.html` in any current browser, offline, and drops a dossier on it. The verdict: **Valid** (signed with the site's key, or a newer key the site's key handed over to), **Valid, but signed by a key you were not given**, or **Not valid** with the reason. Below it, every file the dossier holds: a report opens in the page as it was signed, a PDF in the browser's own viewer. A client who wants it installed, with a right-click **Check with GEA Reader** on dossiers, gets `GEA-Reader-Setup-0.83.1.exe` from the release page.
 5. **The key**: it lives in `keys\dossier_ed25519.json` in the workspace. The backup carries it; nothing else does; never send it. An administrator **rotates** it with a reason when a person who had access leaves; the old key's history rides in every later dossier so a reader of an old dossier still knows it was the site's.
 
 ## You know it worked when

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial/22-updates.md

@@ -8,7 +8,7 @@ Takes: 10 minutes
 1. Open **Audit / Update**, the card **The release**: the newest release on GitHub against the version running, with the three kits it carries - `GEA-Program-Setup`, `GEA-Reader-Setup` and `GEA-Recorder` - each with the SHA-256 GitHub recorded.
 2. Press **Fetch the kits** (the button names the version). A job brings them into the workspace's `installers\` folder, checks each against its recorded hash (a kit altered after that is not kept), and moves older kits to `installers\_older`. The card marks every kit on hand ✓.
 3. Press **Install now** (the button names the version). The program's setup runs silently from there with this workspace, and the reader's setup with it; the control panel stops for about a minute and is started again by a helper outside the program. Sign in again. The card now shows the new version running.
-4. The recorder's kit, `GEA-Recorder-0.82.0.tar.gz`, is in the same folder for the attendant to take to the box (lesson 25).
+4. The recorder's kit, `GEA-Recorder-0.83.1.tar.gz`, is in the same folder for the attendant to take to the box (lesson 25); so are the driller's, `GEA-Driller-0.83.1.tar.gz` (lesson 29), and GEA-VPN's two, `GEA-VPN-Setup-0.83.1.exe` and `GEA-VPN-0.83.1.tar.gz`, for every computer that joins the private network (lesson 23).
 5. On a computer that cannot reach GitHub, the setup from the release page installs over the old version the same way; the workspace is kept.
 
 ## You know it worked when

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial/23-vpn.md

@@ -12,7 +12,7 @@ One **hub**: a small cloud server of the site's own - any Debian or Ubuntu machi
 2. Download **gea-vpn-hub.zip**, copy it to the hub and run there, once: `sudo sh install-hub.sh`. It installs WireGuard, opens the port, turns forwarding on and starts the tunnel at boot.
 3. On this PC: open WireGuard, **Import tunnel(s) from file**, choose `gea-vpn.conf` from **gea-vpn-office.zip**, **Activate**. The card's pill turns to **tunnel up**.
 4. Add a member per computer: its name (`Pad 3 box`) and its kind - **box** for a recorder (reaches the office only), **operator** or **reader** for a window (reaches the office's control panel only), **office** for a second control panel - then **Add the member**. Its address and its zip appear in the table. Run the hub installer again - the hub's folder is written anew with every member.
-5. Hand each member its zip by a channel of its own - in person, or not by the same e-mail as anything else: it holds that computer's key. A box: `sudo sh vpn.sh` on the Pi, once (lesson 27). A Windows member imports its `gea-vpn.conf` into WireGuard, once.
+5. Hand each member its zip by a channel of its own - in person, or not by the same e-mail as anything else: it holds that computer's key. A box: `sudo sh vpn.sh` on the Pi, once (lesson 27). Every other member installs **GEA-VPN** once (`GEA-VPN-Setup-0.83.1.exe` on Windows, `GEA-VPN-0.83.1.tar.gz` on Linux, from the release or the office's `installers\` folder), opens it from the Start menu, drops its zip on the page and presses **Connect** - the page reads *connected* when the hub has answered, and says whether this office answers through the tunnel. (A Windows member without GEA-VPN imports its `gea-vpn.conf` into WireGuard by hand.)
 6. The table shows each member's **last handshake** (within two or three minutes means its tunnel is up) and whether its program **answers** through the tunnel. Pull from a box at its private address: `http://10.77.0.3:8780`.
 7. A lost file, or a computer that leaves: **Remove** the member and run the hub installer again; add it again for a new key. The keys are in `keys\vpn\network.json`, owner-only - the backup carries it, the dossier never does.
 

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial/25-install-recorder.md

@@ -5,10 +5,10 @@ Takes: 30 minutes
 > One script, one config file, one restart.
 
 ## Before you start
-The box assembled (lesson 24), the Pi on the pad network, and the release's `GEA-Recorder-0.82.0.tar.gz` - from the office's `installers\` folder (lesson 22) or the release page - copied to the Pi.
+The box assembled (lesson 24), the Pi on the pad network, and the release's `GEA-Recorder-0.83.1.tar.gz` - from the office's `installers\` folder (lesson 22) or the release page - copied to the Pi.
 
 ## Steps
-1. On the Pi, unpack the kit and run the installer once: `tar xzf GEA-Recorder-0.82.0.tar.gz`, `cd GEA-Recorder-0.82.0`, `sudo sh install.sh`. It makes `/opt/gea-recorder` (a Python environment of its own), writes the example config to `/etc/gea-recorder/config.json`, makes `/var/lib/gea-recorder`, enables SPI, enables the service to start at boot and runs the self-test.
+1. On the Pi, unpack the kit and run the installer once: `tar xzf GEA-Recorder-0.83.1.tar.gz`, `cd GEA-Recorder-0.83.1`, `sudo sh install.sh`. It makes `/opt/gea-recorder` (a Python environment of its own), writes the example config to `/etc/gea-recorder/config.json`, makes `/var/lib/gea-recorder`, enables SPI, enables the service to start at boot and runs the self-test.
 2. The clock: wire the GPS as lesson 24 says, then the three lines the README gives - `dtoverlay=pps-gpio,gpiopin=18` and `enable_uart=1` in `/boot/firmware/config.txt`, the two `refclock` lines in `/etc/chrony/chrony.conf` - `sudo apt install gpsd pps-tools`, and reboot. `chronyc tracking` then names PPS as the reference with an offset of microseconds.
 3. Edit the config: `sudo nano /etc/gea-recorder/config.json`. The site's name as the office spells it; the station id; the wellhead's latitude and longitude; each channel's ADC input, its id (`REF`, `S01`...), its kind (`geophone` or `electrode`) and its place in feet east and north of the wellhead; the ADC driver `ads1256` (`sim` records a test signal with no hardware); the rig feed - `rig.enabled`, the serial port or the TCP host and port the EDR offers; the mirror path for the USB stick.
 4. `sudo systemctl restart gea-recorder`. Open the box's page from any computer on the pad network: port 8780 of the box's address - `http://192.168.1.50:8780/` when that is its address. It shows the site, the station, RECORDING, the clock and what its time is worth, every channel's level, the files closed, the free space, the rig feed.

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial/29-driller-rig.md

@@ -5,7 +5,7 @@ Takes: 30 minutes
 > One install, one config file, and the driller's screen on the rig.
 
 ## Before you start
-The rig PC (the EDR's own, or the directional driller's laptop) on the rig network, with the EDR's WITS0 feed available on a TCP port or a serial line - ask the EDR vendor's hand for the port; it is read-only and nothing is ever sent to it. The kit `GEA-Driller-0.82.0.tar.gz` from the office's `installers\` folder (lesson 22) or the release page. On Windows, Python 3.9 or newer from python.org with "Add to PATH" ticked.
+The rig PC (the EDR's own, or the directional driller's laptop) on the rig network, with the EDR's WITS0 feed available on a TCP port or a serial line - ask the EDR vendor's hand for the port; it is read-only and nothing is ever sent to it. The kit `GEA-Driller-0.83.1.tar.gz` from the office's `installers\` folder (lesson 22) or the release page. On Windows, Python 3.9 or newer from python.org with "Add to PATH" ticked.
 
 ## Steps
 1. Unpack the kit. On a Linux PC: `sudo sh install.sh`. On Windows: double-click `install.cmd`. Either makes a Python environment of its own with the package and the trained policy inside it, writes the example config beside it, makes the data folder, runs the self-test (a minute: the twin, the policy against the textbook driller, a short training that learns, the service), and sets the program to start with the PC.

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/tutorial.md

@@ -2,9 +2,9 @@
 
 > Every step of GEA and the programs around it - the control panel, the Reader, the Recorder on the pad, GEA-VPN, GEA Driller - as 29 lessons: the office's first, the pad attendant's after, each naming the page it is done on, what you press, and how you know it worked.
 
-**The command**: the **Tutorial** tab. The lessons are listed by part - Getting started, Wells and their data, Watching the pad, The engineering pages, Seismic, Reports for the client, Keeping it running, On the pad, The driller's agent - each with who it is for and how long it takes. Open one: **Open the page this lesson is about** goes to the tab it is done on, the numbered steps say what to press, **You know it worked when** says what to look for, and **Mark this lesson done** ticks it off for you (each account has its own progress; the list says how many are done and which comes next). **Print the handout** opens the whole course as one page for the people who do not sit at this screen - the attendant on the pad - and the browser's Print makes the PDF; **Write the handout into exports\tutorial** (the operator role) writes the same as `GEA-Tutorial-0.82.0.html` and `.md` into the workspace. From a terminal: `gea tutorial` lists the lessons, `gea tutorial --lesson 3` prints one, `gea tutorial --lesson install` the same by name, `gea tutorial --handout --workspace C:\site` writes the handout into the workspace, `gea tutorial --handout --out C:\site\GEA-Tutorial.html` writes it anywhere. The lessons are Markdown files under the program's `help\tutorial` folder.
+**The command**: the **Tutorial** tab. The lessons are listed by part - Getting started, Wells and their data, Watching the pad, The engineering pages, Seismic, Reports for the client, Keeping it running, On the pad, The driller's agent - each with who it is for and how long it takes. Open one: **Open the page this lesson is about** goes to the tab it is done on, the numbered steps say what to press, **You know it worked when** says what to look for, and **Mark this lesson done** ticks it off for you (each account has its own progress; the list says how many are done and which comes next). **Print the handout** opens the whole course as one page for the people who do not sit at this screen - the attendant on the pad - and the browser's Print makes the PDF; **Write the handout into exports\tutorial** (the operator role) writes the same as `GEA-Tutorial-0.83.1.html` and `.md` into the workspace. From a terminal: `gea tutorial` lists the lessons, `gea tutorial --lesson 3` prints one, `gea tutorial --lesson install` the same by name, `gea tutorial --handout --workspace C:\site` writes the handout into the workspace, `gea tutorial --handout --out C:\site\GEA-Tutorial.html` writes it anywhere. The lessons are Markdown files under the program's `help\tutorial` folder.
 
-**What it writes**: `records\tutorial_progress.json` in the workspace (who finished which lesson, when); `exports\tutorial\GEA-Tutorial-0.82.0.html` and `.md` when the handout is written, with the audit line `tutorial.handout`; `tutorial.print` when the handout is opened from the page. Reading a lesson writes nothing.
+**What it writes**: `records\tutorial_progress.json` in the workspace (who finished which lesson, when); `exports\tutorial\GEA-Tutorial-0.83.1.html` and `.md` when the handout is written, with the audit line `tutorial.handout`; `tutorial.print` when the handout is opened from the page. Reading a lesson writes nothing.
 
 **The number to check**: the list's "done" count against 29, and on the Tutorial tab which lesson is next. A lesson's own check is its **You know it worked when** - the thing on the screen or the disk that is there only if the steps were done; a tick without it is a tick.
 

{gea_program-0.82.0 → gea_program-0.83.1}/gea/help/vpn.md

@@ -4,6 +4,8 @@
 
 **The command**: the Administration tab's **GEA-VPN** card (admin). It is WireGuard - the VPN built into every Linux kernel and installed on Windows from wireguard.com - and GEA writes every key, address and configuration, so nothing is typed on a pad. One **hub** is needed: a small cloud server of the site's own, any Debian or Ubuntu machine with a public address (a rented virtual server of the smallest size is enough), reachable on UDP port 51820; every member connects out to it and it forwards between the office and each member - members never see one another. Make the network once: enter the hub's public name or address (`vpn.pad3site.com` or `203.0.113.10`) and click **Make the network** - the office member (this control panel, `10.77.0.2`) is made with it. Download `gea-vpn-hub.zip`, copy it to the hub and run there, once, `sudo sh install-hub.sh` (it installs WireGuard, opens the port, turns forwarding on and starts the tunnel at boot). Install WireGuard on this computer from wireguard.com (admin, once), click **Import tunnel(s) from file**, choose `gea-vpn.conf` from `gea-vpn-office.zip`, click **Activate**; the card's pill turns to `tunnel up`. Add a member per computer: its name (`Pad 3 box`) and its kind - `box` for a recorder (its page on 8780, reaches the office only), `driller` for the driller's agent on a rig PC (its screen on 8790, reaches the office only), `operator` or `reader` for a window (reaches the office's control panel only), `office` for a second control panel - then **Add the member**; its address and `gea-vpn-pad-3-box.zip` appear in the table, and the hub installer must be run again (the hub's folder is written anew with every member). A box's zip holds `vpn.sh`: on the Pi, `sudo sh vpn.sh` once. A Windows member imports its `gea-vpn.conf` into WireGuard once. In the Field tab, pull from the box at its private address: `http://10.77.0.3:8780`. **Remove** takes a member out (its key is dropped from the hub when the installer runs again); **Make the files again** rewrites every folder and zip. From a terminal: `gea vpn --workspace C:\site --create vpn.pad3site.com`, `gea vpn --workspace C:\site --add "Pad 3 box" --kind box`, `gea vpn --workspace C:\site --remove pad-3-box`, `gea vpn --workspace C:\site --bundles`, `gea vpn --workspace C:\site` (the table).
 
+**The client program** (since 0.83.0): every member but the hub and the Pi installs **GEA-VPN**, a standalone program of its own - `GEA-VPN-Setup-<version>.exe` on Windows (administrator rights, once: it installs WireGuard for Windows from the official installer it carries when the computer has none, and runs the program as a service of its own, the scheduled task `GEA-VPN` as SYSTEM at every start, because a tunnel service needs those rights and a person should not), `GEA-VPN-<version>.tar.gz` on Linux (`sudo sh install.sh`: WireGuard from the distribution, the service `gea-vpn` under systemd); both on every release and fetched into `installers\` with the other kits on Audit / Update. Installed, it is **ready for the connect information**: its page at `http://127.0.0.1:8795/` on that computer (the Start menu's **GEA-VPN**) waits for the member's zip - dropped on it, chosen, or the text of `gea-vpn.conf` pasted - checks it key by key, and on **Connect** brings the tunnel up now and at every start; from then on the page says whether WireGuard is installed, whether the tunnel is up, when the hub last answered (a handshake within three minutes means it is talking), the bytes each way, and whether this office answers through the tunnel. **Disconnect** takes the tunnel down; **Disconnect and forget** removes the connect information from the computer, and the office removes the member and makes a new zip. The page listens on 127.0.0.1 only and answers its own requests only; the connect information is kept owner-only under `%ProgramData%\GEA-VPN` (Windows, administrators) or `/var/lib/gea-vpn` (Linux, root) with a log of what was done, by whom. From a terminal on that computer: `gea-vpn status`, `gea-vpn connect gea-vpn-pad-3-rig-pc.zip`, `gea-vpn disconnect`, `gea-vpn forget`, `gea-vpn selftest`.
+
 **What it writes**: `keys\vpn\network.json` (owner-only; every member's private key, the hub's, and the pre-shared key per member) - the backup carries it, the dossier never does; under `exports\vpn\`: `hub\` (`gea-vpn.conf`, `install-hub.sh`, `README.txt`, zipped as `gea-vpn-hub.zip`) and one folder per member (`gea-vpn.conf` with the member's own private key, plus `vpn.sh` for a box or `README.txt` for a window, zipped as `gea-vpn-pad-3-box.zip` for `Pad 3 box`); the audit lines `vpn.create`, `vpn.hub`, `vpn.member.add`, `vpn.member.remove`, `vpn.bundles`, `vpn.bundle.download`. A member's zip holds its key: hand it over in person, or by a channel of its own, never by the same e-mail as anything else; a lost file is replaced by removing the member, adding it again and running the hub installer again.
 
 **The number to check**: the card's pill - `tunnel up` means WireGuard on this computer has the `gea-vpn` tunnel active; `tunnel not up here` means it is not installed or not activated, and nothing private is reachable. In the table, **Last handshake** within the last two or three minutes for a member means its tunnel is up and talking to this computer (a keepalive every 25 s keeps it so behind a cellular modem); **Reachable** `yes` means the member's program answered on its port through the tunnel - a box's page on 8780, a window's control panel - and that is the address to pull from.