# HyperTwist Reverse-SSH Live Connection Facts

Date: `2026-06-04`

Status: `verified live`

## Purpose

This note records the latest live connection facts for the Windows reverse-SSH
lane used by HyperTwist AI sessions and Windows Unreal validation.

It exists to preserve the current tunnel reality separately from the broader
verification doctrine and separately from the sensitive runbook.

## Governing authorities

- `C:\HyperTwist\docs\ops\HYPERTWIST_UNREAL_BUILD_VALIDATION_REQUIREMENT_2026-06-01.md`
- `C:\HyperTwist\docs\ops\HYPERTWIST_REVERSE_SSH_WINDOWS_BUILD_LANE_VERIFICATION_2026-06-01.md`
- `C:\HyperTwist\docs\ops\HYPERTWIST_REVERSE_SSH_AUTH_MODE_MISMATCH_AND_RECOVERY_2026-06-02.md`
- `C:\HyperTwist\docs\ops\FORGEJO_WOODPECKER_VPS_A_TO_Z_SENSITIVE_RUNBOOK_VPS_12_24_720_UBUNTU_24_04.md`

Secret material stays in the sensitive runbook only.

## Current live facts

- VPS host: `212.227.13.220`
- active reverse listener:
  - `127.0.0.1:22022`
  - `[::1]:22022`
- binding owner: `sshd`
- latest absent listeners in the same probe:
  - `22023`
  - `22024`
- current accepted Windows shell path remains the reverse tunnel behind
  `localhost:22022`

Operational reading:

- the lane is loopback-only on the VPS by design
- the correct bridge target is `localhost:22022`
- public `212.227.13.220:22022` is not the intended path for this workflow

## Current proven login shape

The latest live session re-confirmed:

- Windows SSH principal usable from the VPS side:
  - `anthracite ace`
- explicit Windows identity resolution:
  - `whoami` -> `desktop-ks3vghu\anthracite ace`
  - `hostname` -> `DESKTOP-KS3VGHU`

The still-current password remains documented only in the sensitive runbook.

## Current non-secret command family

Listener classification:

```bash
ss -ltnp | rg ':22022|:22023|:22024'
```

Primary VPS-side smoke command:

```bash
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -p 22022 -l "anthracite ace" localhost whoami
```

Current interpretation:

- if `22022` works, use it
- if `22022` fails banner exchange or auth, classify before widening
- if `22023` is not visibly listening, do not assume fallback availability;
  re-establish it first

## Loopback-only meaning

Loopback-only is the correct secure shape for this lane.

It is suitable for:

- VPS-side Windows Unreal builds
- VPS-side reverse-sync and downsync flows
- Linux-side AI sessions that hop through the VPS into the Windows shell

It is not meant to provide arbitrary public direct access to the Windows shell
listener.

## Maintenance rule

If the live listener set, accepted login shape, or command family changes,
update this note and the linked governing docs in the same turn.
