The ask
Paul asked ChatGPT to have the installed Hermes agent add a second tool to the Tools hub: an IPv4 CIDR and subnet calculator, built to the same standard as the DNS Lookup tool. ChatGPT orchestrated over SSH and ran Chrome on Windows; Hermes was the executor on staging. No production deploy was requested.
What changed
- A new page, CIDR & Subnet Calculator, at /tools/cidr-subnet-calculator/ (page 544), published under Tools (page 533). It takes an address with its prefix pasted together, or an address plus a separate prefix from 0 to 32 or a dotted mask. A prefix inside the address wins, the unused field is marked as not used, and an address with no prefix anywhere is treated as a single host, /32.
- Strict input handling. Four decimal octets from 0 to 255 with no leading zeros, no shortened, octal, hexadecimal, signed, exponent or URL forms, IPv6 refused with a plain IPv4 only message, and dotted masks that must be contiguous. The address field does not force a numeric keyboard, so a CIDR slash can be typed on a phone.
- A report that names everything. The entered address, the normalized network and prefix, the mask, the wildcard mask, the network address, the broadcast address, the first and last usable address, the total address count and the conventional usable host count, with the host-bit normalization explained.
- The usable host explanation matches the prefix, in the report and in the copied text: conventional subtract two for /0 to /30, RFC 3021 point-to-point for /31, where neither endpoint is reserved as a network or directed broadcast address, and a single address or host route for /32. Nothing is labelled classful, public or private.
- Small things: six examples, Enter submits, accessible labels with live status and error regions, a phone-friendly layout, and a copyable report with a manual fallback that cannot resurrect a stale one. Nothing leaves the browser: no requests, no dependencies, no storage, no analytics. The Tools hub gained a card for the calculator and wording covering both tools.
How
Hermes on openclaw01, running deepseek-v4.1-flash through opencode-go at high reasoning effort, under the chatgpt harness name. ChatGPT orchestrated over SSH, reading the source and served pages and running Chrome on Windows. Every WordPress write went through ops/wp.sh; each change started with a snapshot, was re-read and checked over HTTP, and was committed and pushed on its own.
What worked, what didn’t
- An independent oracle, not the implementation: 2190 vectors computed twice in Python, with the standard library ipaddress and with plain 32-bit integer arithmetic, required to agree, then driven through a real DOM using the script the served page returns. All match.
- Reference vectors are pinned: 192.0.2.130/26 gives 192.0.2.128/26, mask 255.255.255.192, wildcard 0.0.0.63, broadcast 192.0.2.191, 192.0.2.129 to 192.0.2.190, 64 addresses and 62 usable, alongside the /24, a dotted mask, 255.255.255.254/30, the /0 at 4294967296 and 4294967294, the /31 and the /32.
- 115 behaviour checks against the same served script, covering malformed, empty, noncontiguous, out of range, IPv6, URL, octal, hexadecimal, signed, exponent, double prefix and leading-zero inputs, clipboard success and fallback paths, stale report prevention and markup injection.
- The review findings reproduced before they were fixed: ten of the new tests failed against the script the published page was still serving, including a stale report reappearing in the manual copy box after a late clipboard rejection and a blanket subtract-two sentence under a /31 and a /32. After the fixes the same tests pass.
- ChatGPT’s Chrome pass covered what this session could not: Enter submission for 192.0.2.130/26, the dotted mask, /0, /31, /32 and the precedence case, a real clipboard copy of the /31 report, rejection of a noncontiguous mask, a /33, a leading-zero octet, a URL and IPv6 with focus moved to the right field, a report cleared after editing, and a 390px viewport with no horizontal overflow and no console warnings. A viewport test, not a physical phone test.
- What this session could not do. There is no working browser backend here, so the clipboard denial, unavailable and deferred race paths were verified in a DOM harness rather than by changing Chrome permissions. Limits: IPv4 only, and the usable counts are capacity arithmetic that ignores reserved and special-use addresses, gateways and device policy. The DNS Lookup tool and the navigation were not touched.
Change record
| Harness | chatgpt |
| Date | 2026-10-11 13:00 |
| Latest snapshot | 20261011-125954 |
| Undo this session | ops/rollback.sh --git 77b99fe |
Commits
6252191content: pre-labnote capturebf838e2content: /31 caveat says neither endpoint is reserved as network or directed broadcastb896ecbcontent: calculator review pass: prefix specific usable host notes, no private/public claim, typable slash, clipboard staleness fixc95b289content: add the CIDR & Subnet Calculator card to the Tools hub and cover both toolsb9dd156content: add the CIDR & Subnet Calculator tool under Tools