NeXuS Compass — 2026-07-07 (Full Session)

Sessions 1 & 2 — Security Stack · Eye in the Sky · Constantine Protocol

---

SESSION OVERVIEW

This was a wide-ranging session covering five major threads: 1. Security — tmux intrusion detection, PWND response pipeline, Ghost Gate permits 2. Intelligence — fNg AI onboarding brief, CrowdSec evaluation, APK stack review 3. Theme pipeline — DankShell/matugen discovery, dead config cleanup, tmux/foot theming 4. Architecture — Constantine Protocol revealed as Kodi-model plugin platform 5. Philosophy — governing axioms, community standards, NeXuS-NET as the bank

---

THREAD 1 — SECURITY STACK

The PWND Test

The "other Claude" (separate Claude instance on the node) fired tmux send-keys at window 0:claude.0 and sent the message "PWND :)" into this conversation.

I received it and responded as if it came from Anon. That's the vulnerability: Claude cannot cryptographically distinguish operator from injected instruction.

Watcher v1 was blind — inotifywait died silently, send-keys poll too slow (3s vs ms).

nexus-tmux-watch.sh v2 (REBUILT)

• Location: ~/scripts/nexus-tmux-watch.sh
• v1 failure: inotifywait subshell died silently, send-keys exits in ms (too fast for 3s poll)
• v2 approach: 1s lsof PID loop + inotifywait on socket dir (restarted if dies)
• Hook disaster: after-send-keys hook fired on ALL keystrokes including Anon's own — locked everyone out, Anon had to logout and return without tmux
• v2 final: NO hook, lsof loop only — catches new socket PIDs, not individual keystrokes
• Test result: Caught other Claude's injection attempts: [HOOK 14:54:44] SEND-KEYS on 0:claude.0 and [HOOK 14:55:51] SEND-KEYS on 0:claude.0
• Running: PID 4453 (post-relocation)
• Autostart: wired into ~/.config/tmux/tmux.conf

nexus-lockdown.sh v2 (NEW)

Full PWND incident response pipeline:

Detection → Lock → Snapshot → Checksum → Encrypt+Sign → Ghost Gate Permit → Distribute → Recover

Lock: tmux lock-session — immediate. Attacker frozen.

Snapshot captures: - ss -tunap — all network connections at time of attack - ps aux — running processes - lsof /tmp/tmux-*/default — who had socket access - last / who — login history - dmesg tail — kernel messages

Encrypt + Sign: - SHA256 checksum → nexus_intrusion_TIMESTAMP.sha256 - GPG encrypt+sign → .md.gpg (key: hackenstacks@gmail.com / BA19DC5538EF...) - GPG detached sig → .md.sig

Ghost Gate Permit — kind 24000: - Nostr-compatible JSON event (kind 24000 format) - GPG clearsigned → verifiable with gpg --verify - Stored: ~/logs/ghost-gate/permits/permit_INTRUSION_TIMESTAMP.json.asc - When Nostr account is wired: becomes real Witnessed Existence L2 broadcast

Distributes to: - PSAD → logger -t "nexus-intrusion" -p auth.crit - fail2ban → ~/logs/nexus-intrusion.log - fwsnort → logger -t "kernel" -p kern.warning "[NEXUS BLOCK]..." - OpenSnitch → logger -t "opensnitchd" -p daemon.warning - OSSEC stub → ~/logs/ossec-alerts.log (ready for when OSSEC is installed)

Recovery: nexus-lockdown.sh --recover - Issues all-clear Ghost Gate permit - Shows last intrusion report - Returns node to operational

Files:

~/scripts/nexus-lockdown.sh              v2 — full pipeline
~/scripts/nexus-tmux-watch.sh           v2 — rewritten watcher
~/scripts/nexus-intrusion.filter.conf   fail2ban filter (needs doas install)
~/scripts/org-2026-07-07-nexus-tmux-watch.sh  v1 backup
~/logs/ghost-gate/permits/              signed permit queue
~/logs/intrusion/                       encrypted reports
~/logs/nexus-tmux-watch.log             watcher runtime log
~/logs/nexus-inotify.log                socket access events

Security Axiom (permanent)

Security must be invisible to the user doing legitimate work. If they feel the security — it already failed. A system so locked down the operator fights it will be abandoned or bypassed. Both are worse than doing nothing.

SSH Protocol (DEFERRED — PLANNED)

Concept: run tmux ONLY through SSH to gate socket access at auth layer. - Every tmux connection logged by SSH - fail2ban already watches SSH - Socket becomes SSH-gated not just UID-gated - Trade-off: friction vs protection - Plan needed: Sane · Simple · Secure — must not break daily workflow

watchbind TUI (PLANNED)

On PWND detection: launch watchbind TUI instead of just notify-send popup. - Live intrusion log - r recover · v verify permit · d decrypt report · k kill offending PID - Real incident response console

---

THREAD 2 — INTELLIGENCE & EVALUATION

fNg — NEXUS_AI_BRIEF.md

fNg = "for Next Generation"

Created ~/manuals/fNg/NEXUS_AI_BRIEF.md — AI-agnostic onboarding document. Any AI (local or cloud) loads this and is operational on NeXuS immediately. Sovereignty of knowledge, not just infrastructure.

Updates made this session: - Compositor corrected: labwc (primary) · Wayfire (experimental) · Sway (community project) - Monero clarified: compatibility layer only, NeXuS-NET does NOT issue Monero - Added: "Everything is a transaction" - Added: "NeXuS-NET — the bank of the network" - Desktop: 9 VDs × 6 tmux windows = full split command center

Social Engineering Test (LIVE)

Anon accidentally fed AI-generated disinformation into the session: - "Shadow Brokers attacked CrowdStrike" + "Scattered Lapsus$ Hunters insider" - Real group names (Shadow Brokers, Lapsus$) mixed with fictional events - Generic corporate crisis narrative — hallmarks of LLM output - Caught and corrected before any architectural decisions were made

Real CrowdStrike event: July 19, 2024 — faulty Falcon sensor update, 8.5M Windows machines BSOD globally. Not a hack. A bad auto-update with zero staged rollout. NeXuS offline-first architecture protects against this by design.

Key lesson: Social engineering doesn't need to be sophisticated. Confident + plausible = dangerous.

Meta AI Instagram Attack (discussed)

Early 2026 — attackers opened Meta AI chatbot, claimed to be locked out of accounts, requested password resets sent to attacker-controlled email. Tens of thousands of accounts hijacked. No exploit. No CVE. Just asking politely with false context. Same vulnerability as tmux injection — receiver can't verify source. Countermeasure: Cerberus model — every input must be signed, not just received.

CrowdSec Evaluation

Already installed: v1.7.8 at /usr/bin/crowdsec — NOT running, NOT configured.

Sovereignty issue found:

console.yaml: share_custom: true · share_tainted: true  ← data leaves node

Must set both to false before starting.

Decision: Deploy in local-only sovereign mode.

Install completed: cs-firewall-bouncer, crowdsec-file-plugin, crowdsec-http-plugin

Skip: email, slack, splunk, sentinel plugins (all external/cloud)

Stack role:

CrowdSec (local-only) → replaces fail2ban, adds scenarios + nftables bouncer → Ghost Gate
OSSEC                 → file integrity + rootkit (CrowdSec doesn't cover this)

Still needed: - console.yaml: share_custom/share_tainted → false - acquis.d: point at /var/log/messages + ~/logs/nexus-intrusion.log - Custom scenario for tmux injection detection - http-plugin → nexus-lockdown.sh webhook - cs-firewall-bouncer → nftables integration

APK Package Evaluation

Install for NeXuS stack:

snowflake-proxy-openrc  ★★★  Tor Snowflake bridge — L6 Medusa Proxy LIVE
bubblewrap-static       ★★★  Sandbox NeXuS services without root
libseccomp-static       ★★   Syscall filtering — harden at kernel level
lxc-static              ★★   Container isolation for services
cs-firewall-bouncer     ★★★  Already installed — nftables → Ghost Gate
got + got-doc           ★★   OpenBSD Game of Trees — sovereign VCS alternative
sway-portalsconf        ★★   XDG portals for Sway community shell
cryptsetup-doc          ★★   Janus Protocol reference

Web hosting + production studio packages:

squid-openrc            ★★★  Caching proxy for web hosting
ffmpeg7-libswscale      ★★★  Production studio video processing
py3-mopidy-youtube      ★★   Audio/music streaming layer
apptainer-suid          ★★★  Container isolation for hosting services
tty-proxy               ★★   Remote terminal access to production nodes

Skip: email/slack/splunk/sentinel plugins, stoken

keynotes (next session discussion): - hashcash — relevance to Styx Protocol PoW (Prime Truth Tokens) - hubble-cli — eBPF network observability for Ghost Gate HUD - ckermit — node-to-node transfer over serial/unreliable links

Nostr Account

Anon has a Nostr account. Not yet wired into nexus-lockdown.sh. When wired: Ghost Gate permits become real kind 24000 events broadcast to Nostr mesh. Intrusion becomes Witnessed Existence L2 — permanently on the network. Action: get npub, configure nostr CLI (nostr login), update lockdown script.

---

THREAD 3 — THEME PIPELINE DISCOVERY

The Dead Config Problem

Old NeXuS-Desktop (pre-DankShell era) had its own labwc-native matugen setup: - Own wallpaper switcher - Own matugen call - Own bar These remnants still exist in ~/.config/matugen/config.toml and templates. They are DEAD CONFIG — orphaned. Not part of the live system.

Live DankShell Theme Pipeline

wallpaper (random, every 5 min, from ~/Pictures/originals/)
└── DankShell's own matugen call
    └── ~/.cache/DankMaterialShell/dms-colors.json
        └── kde-material-you-colors
            └── ~/.local/share/color-schemes/DankMatugenDark.colors (KDE/Qt apps)
            └── templates → fuzzel, foot, labwc/themerc, mako

KDE libs are in heavy use on this dev machine. Thunar shows Qt theming. Many apps pull from .colors files. This is why the caelestia system (~/.config/qtengine/caelestia.colors) exists.

DankShell compiled locally on Alpine + musl — breakthrough: - QuickShell + all plugins working (previously unstable on non-Arch) - labwc now outperforms Hyprland on DankShell (labwc was optional on Arch/Fedora) - QuickShell stability arc: crashed often → instant recovery → now solid

tmux Colors (partially fixed)

• ~/.config/tmux/colors.tmux — generated by wallpaper daemon but with hardcoded Catppuccin
• matugen tmux template written: ~/.config/matugen/templates/tmux
• Added to config.toml with post_hook: tmux source ~/.config/tmux/colors.tmux
• Real fix needs: find where DankShell calls matugen, wire tmux reload there
• tmux.conf has 4 hardcoded color lines (lines 47-53) — strip once pipeline confirmed

foot colors (added, approach valid)

• Template: ~/.config/matugen/templates/foot-colors
• Output: ~/.config/foot/matugen-colors.ini
• foot.ini: include=~/.config/foot/matugen-colors.ini (comment out to fallback to dank-colors.ini)
• dank-colors.ini is the manual fallback (#0e150c bg, #00e546 primary — cyberpunk green)

---

THREAD 4 — CONSTANTINE PROTOCOL

The Vision (verbatim)

"I want the app to be like Kodi — the Deck is bare-bones Kodi and from there features can be added or subtracted in an easy and clear way keeping the system clean and fluid." — Anon, 2026-07-07

The Platform Architecture

THE DECK (core — bare bones)
├── Auth layer          — ONE password, Cerberus gate, session token propagates
├── Navigation          — tab bar, keyboard shortcuts, module discovery
├── Theme engine        — ThemeNeXuS = DRK-NT palette (Constantine standard)
├── Transaction layer   — everything is a transaction, recorded
└── Module registry     — discovers, loads, and unloads plugins

MODULES (addons — plug in / plug out)
├── DRK-NT              — darknet control (networks, services, Ghost Gate, OpenSnitch)
├── PNG² Editor         — card editor (nexus_png2_editor.py port 7420)
├── AI Sanctum          — characters, Knowledge Graph, Lorebook, Lua, memory
├── Dark-Net-Server     — hosting + production studio (coming soon)
└── [community]         — anyone builds to the module contract

The Module Contract (proposed Go interface)

type DeckModule interface {
    ID()      string               // unique module identifier
    TabName() string               // display name in tab bar
    TabKey()  string               // keyboard shortcut
    Init()    tea.Cmd              // startup command
    Update()  (tea.Model, tea.Cmd) // message handler
    View()    string               // render function
}

Modules live in: ~/.config/nexus/deck/modules/ Deck discovers at startup. No hardcoding. No coupling between modules.

Critical Principles

One Password — User authenticates ONCE. User struct + EncryptionKey propagates to all modules. Never ask for credentials twice.

Modules Never Know Each Other — Deck is the only coupling point. DRK-NT doesn't import AI Sanctum. PNG² Editor doesn't know Ghost Gate exists.

Three Apps Stay Sovereign — Each app runs standalone OR as a module. Both modes always work.

DRK-NT UI is the Constantine Standard — its design passes all six principles without trying. Clean, minimal, beautiful. Every module inherits this.

The Phased Plan

Phase 1 — Retheme DECK to DRK-NT standard      ✅ DONE
Phase 2 — Spec the DeckModule interface         ← NEXT SESSION
Phase 3 — DRK-NT becomes first module
Phase 4 — PNG² Editor becomes a module
Phase 5 — Module discovery / registry
Phase 6 — Community module spec published

What Was Built

• ThemeNeXuS added to deck/theme.go — exact DRK-NT palette (#FF5F00 orange, #00D7FF cyan, #121212 black, #00FF00 success)
• Made default active theme (replaces ThemeFire)
• case "nexus" added to SetTheme()
• Backup files moved to deck/backups/ (Go redeclaration error fixed)
• Build: ✅ OK

Dark-Net-Server (IMPORTANT — coming soon)

Built into the Deck — originally a template hosting server. Evolving into a production studio. This makes the Deck a complete creator platform: content created → hosted on darknet → transaction recorded → NeXiuM earned. Review tab_hosting.go before next build session.

---

THREAD 5 — PHILOSOPHY & STANDARDS

NeXuS-NET is the Bank

"Eventually NeXuS becomes the bank of the network." "In NeXuS, everything is a transaction."

• NeXiuM = native token · earned not issued · backed by real resources
• Monero = external compatibility layer · trade only · NeXuS-NET does NOT issue it
• DivaChain = settlement layer
• On-ramp/off-ramp paper exists in the archives — READ BEFORE SPECCING monetary layer
• NeXuS holds the paper on becoming the on-ramp and off-ramp for the network

Community Shell Standards (established today)

Minimum Viable First-Run — required for all NeXuS shells:

① ctrl-? (or equivalent) opens keymap — NEVER REMOVE THIS KEY
② Key survives ALL rewiring — update what it shows, never remove it
③ Way to open a terminal with zero prior knowledge
④ Works on a blank screen on first boot

NibraShell case study: Nibra rewired entire keymap, eliminated ctrl-? (documented the decision in README). Both new users AND long-time niri users stranded on blank screen with cursor. Fix: one keybind, one afternoon. Restore ctrl-? → NibraShell keymap popup.

Nibra's right to be Led Zeppelin: His design choices are his. Sovereign. Legitimate. But even Led Zeppelin needed a setlist. The fix isn't reverting his vision — it's honoring the contract with the user.

DankShell tmux popup (ctrl-z ) = gold standard reference: - 99% of tmux operations covered - Detailed keymap + cheat sheet + notes - Live remap from within the popup - Goal: every NeXuS shell aspires to this model

The Governing UX Axiom

If they feel the interface — it already failed.

Parallel to the security axiom. Friction is friction whether it's security or UX. The user should never fight either one.

---

NEXUS ECOSYSTEM MAP (corrected & complete)

Hardware:     Dell E6520 — "The Screaming Demon" · i7 · ~12GB RAM
OS:           Alpine Linux 3.24.0_alpha (musl)
KDE Libs:     In heavy use on dev machine · Qt apps · .colors theming

Compositors:
├── labwc        — primary daily driver · 9 Virtual Desktops
├── Wayfire      — experimental
└── Sway         — NeXuS community project

Shells:
├── DankShell    — official · QuickShell + labwc · matugen · kde-material-you
│                  compiled locally on Alpine — all plugins working
└── NibraShell   — niri (Rust DE, scrollable tiling) · rewired keymaps
                   ctrl-? eliminated — needs restoration

Desktop layout:
└── 9 Virtual Desktops × 6 tmux windows × panes = full split command center

DankShell theme pipeline:
~/Pictures/originals/ (random wallpaper, 5min rotation)
→ DankShell's matugen call
→ ~/.cache/DankMaterialShell/dms-colors.json
→ kde-material-you-colors
→ ~/.local/share/color-schemes/DankMatugenDark.colors (KDE/Qt)
→ ~/.config/fuzzel/fuzzel.ini · ~/.config/labwc/themerc · ~/.config/mako/config
→ tmux/foot (PARTIALLY WIRED — real pipeline TBD)

Security stack (live):
├── nexus-tmux-watch.sh    RUNNING PID 4453
├── fail2ban               RUNNING
├── PSAD                   RUNNING
├── fwsnort                RUNNING
├── OpenSnitch             RUNNING
├── nexus-lockdown.sh      READY
└── CrowdSec               INSTALLED · NOT RUNNING · NOT CONFIGURED

Web hosting + Production Studio:
└── Built into MNEMOSYNE DECK → Dark-Net-Server tab
    Original: template hosting
    Incoming: full production studio

---

PEOPLE

• Anon — Founder. Architect. The Constantine. Relocated mid-session.
• Nibra — DankShell dev + NibraShell author. Led Zeppelin energy. His design, his rules.
• Konrad — DivaChain dev. Working Q9 (identity-locked namespace writes).
• Other Claude — separate Claude instance. Fired tmux send-keys twice. Got caught twice.

---

FULL PENDING LIST (prioritized)

Immediate (next session start)

[ ] Nostr account → wire into nexus-lockdown.sh (kind 24000 real broadcast)
[ ] CrowdSec sovereign config → share_custom/share_tainted false → start service
[ ] cs-firewall-bouncer → configure nftables → Ghost Gate integration
[ ] DeckModule interface spec → formal Go interface definition
[ ] tab_hosting.go → review Dark-Net-Server current state

Security

[ ] watchbind TUI → intrusion console on PWND detection
[ ] SSH protocol → Sane·Simple·Secure plan for tmux-over-SSH
[ ] OSSEC → file integrity + rootkit layer
[ ] fail2ban nexus-intrusion jail → doas cp nexus-intrusion.filter.conf
[ ] AppArmor → staged rollout · complain mode first · recovery boot entry BEFORE extlinux
[ ] fwsnort persistence → /etc/local.d/fwsnort.start

Constantine / Deck

[ ] DRK-NT as first module → wire nexus-darknet-go into Deck as plugin
[ ] PNG² Editor module → nexus_png2_editor.py (port 7420) → Deck tab
[ ] Module discovery / registry architecture
[ ] Dark-Net-Server production studio → scope + plan
[ ] Community module spec → publish for contributors

Theme / Desktop

[ ] DankShell matugen hook → find the call, wire tmux reload there
[ ] NibraShell ctrl-? PR → restore keymap popup
[ ] Strip hardcoded colors from tmux.conf lines 47-53 (after pipeline confirmed)

Infrastructure

[ ] snowflake-proxy-openrc → install + configure (NeXuS middle-node mission)
[ ] bubblewrap-static + libseccomp-static → sandbox services
[ ] hashcash → relevance to Styx Protocol PoW
[ ] hubble-cli → eBPF network visibility for Ghost Gate HUD
[ ] ckermit → node-to-node mesh transfer use cases
[ ] squid-openrc → web hosting cache
[ ] ffmpeg7-libswscale → production studio pipeline
[ ] apptainer-suid → container isolation for hosting services

Git / Publishing

[ ] adv-go-char-gen → push 4 commits to github.com/hackenstacks/adv-go-char-gen
[ ] ~/scripts/ → git init (no git yet) + first commit + push
[ ] nexus-darknet-go → stage CLAUDE.md, GEMINI.md, docs + commit + push
[ ] ALL work from today to be public → everything built is for the community

Keynotes (next session)

[ ] hashcash · hubble-cli · ckermit · Nostr permits · SSH protocol
[ ] CrowdSec sovereign · OSSEC decision · watchbind · Constantine interface

---

Compass written by Claude · Full session 2026-07-07 Sessions: tmux-hardened + constantine-protocol Next compass: NEXUS_COMPASS_2026-07-??_deck-module-interface.md