Skip to content

NeXuS Compass — 2026-07-11

Session: Argus Accountability · DivaChain Package for Konrad · Security Incident

Living navigator — readable cold by any AI. Read this to resume.

🧭 SESSION FOCUS

Three big arcs braided together: 1. Argus Accountability — designed the cryptographic signing layer from scratch (git-as-ledger + master/child keys). 2. DivaChain package for Konrad — located the April docs he never saw, source-verified every claim, polished the Truth Manual, planned a sovereign-rails delivery. 3. Security incident — chased a reported "socket intrusion" → proved it was our own zombie watcher false-positiving; killed it for good; found a real open door (Privoxy :8118).

🔴 LIVE STATE (as of session end)

nexus-tmux-watch.sh    ✅ DEAD + ARCHIVED → ~/scripts/archive-disabled-2026-07-11/
                          (killed procs, moved executable, hook stripped — CANNOT relaunch)
tmux after-send-keys   ✅ hook removed
Caddy (*:80/*:443)     CLEAN — Matrix reverse proxy (matrix.nexusnet.network→127.0.0.1:6167), 0 connections
Privoxy (*:8118)       🚪 OPEN DOOR — bound 0.0.0.0 via pasta (rootless podman). PENDING DECISION (see §F)
DivaChain Truth Manual ✅ polished + source-verified → ~/claude/docs/DIVACHAIN_TRUTH_MANUAL.md
Package staging        ~/Documents/diva-chain/ (has divachain-readme-v1.md = Konrad's original)

A. ARGUS ACCOUNTABILITY — 🔵 DESIGNED (spec not yet written to a doc; captured in memory)

The mandate (Anon): "Accountability with a cryptographical fingerprint, and everything in NeXuS is a transaction so every transaction will have every fingerprint that touched it."

CIA triad, NeXuS meaning: C=Confidentiality · I=Integrity · A=Accountability (NOT Availability; Availability = "YMC-Availability").

Architecture (all Alpine-repo tools, nothing hand-rolled): - git = the ledger. Every doc/edit/backup = a signed commit. Parent-hash chain = the tamper-evident fingerprint chain. Do NOT build a bespoke PKI/JSONL ledger. - SSH Ed25519 keys = entity identities. git config gpg.format ssh + commit -S + allowed_signers. - Master/child model: ONE master key, password-protected, offline. Master ISSUES children (DERIVED, not certified — chosen because master = sovereign root). One child per entity (anon, claude, eye-sky, node-argus). Only master revokes. Delete = revoke (append, never erase). - KeePass KDBX v2 = vault; Rook (Alpine pkg, sr.ht/~ser/rook) = headless Secret Service serving keys (no GUI). - Keybase sigchain = the pattern we copy, NOT a dependency (Keybase = frozen since Zoom acquisition — the lock-in cautionary tale). - Separate from Ghost Gate key (Ghost Gate = external Nostr kind-24000 receipts). - Two-tier signing: (1) provenance = every op self-signs (frictionless); (2) multi-sig threshold = privileged only (merge to main, backup restore, archive, key changes). - Open integration detail: how Rook (Secret Service = passwords) feeds git's SSH signer (agent vs stored key). Small, testable.

Full detail: memory project_argus_accountability.md.

B. WATCHER TAKEDOWN + EMERGENCY STOP LAW — ✅ DONE

  • nexus-tmux-watch.sh was a false-positive machine: it flagged our OWN tmux status-bar scripts (continuum_save.sh, ram_info.sh, cpu_info.sh, uptime.sh) as "🔴 UNKNOWN PID ON SOCKET." Log: ~/logs/nexus-tmux-watch.log (25 "alerts" in an hour, all benign).
  • It kept "respawning" because it backgrounds its workers (monitor_loop &, inotifywait … &, line 55/113) → they orphan to PPID 1 and survive killing the launcher. Not resurrection — detached daemons.
  • Killed by exact PID (ps/awk), NOT pkill -f — pkill -f "nexus-tmux-watch" matches our own shell's command line and SIGKILLs it (that was the exit 1/144 bug).
  • Definitive fix: archived the executable → ~/scripts/archive-disabled-2026-07-11/nexus-tmux-watch.sh. Now test -x fails everywhere; no config/orphan can relaunch it. (Line still lives in the sacred backup ~/.config/tmux/org-2026-07-07-tmux.conf:140 but that config isn't sourced and the executable is gone.)
  • Why "why now?" The watcher was only ~5 min old — alerts track the WATCHER'S uptime, not an attacker's arrival. Status bar was always benign; the observer just woke up.

⚖️ EMERGENCY STOP LAW (established this session, in memory feedback_nexus_rules): No power-script (watcher/lockdown/hooks) ships or activates without a working, independent kill switch — preferably a tmux keybinding that nukes hooks + PIDs in one shot. No kill switch = feature doesn't ship.

C. DIVACHAIN PACKAGE FOR KONRAD — the main build

C1. The backstory

In April (post-Konrad-meeting), we/Gemini: fixed bootstrapping → joined his devnet → wrote a full upgrade of DivaChain's docs → discovered "Sovereign Attribution" in his source → pinned to IPFS + anchored on-chain. Konrad NEVER SAW ANY OF IT (published ≠ delivered — the core lesson).

C2. The documents — LOCATED at ~/claude/docs/

  • DIVACHAIN_TRUTH_MANUAL.md — the upgrade (polished + verified this session)
  • DIVA_SOVEREIGN_ATTRIBUTION.md — the source-audit discovery (identity-locked writes)
  • DIVACHAIN_ENGINEERING_LOG.md
  • Old variants archived → ~/claude/docs/archive/ (org-2026-07-11 + .bak + gemini-v2 + gotchas-backup)

C3. IPFS / on-chain references

  • April pin (OLD Truth Manual): IPFS QmVQL4LvHCYuwG2L2TsmxJx7vFjk434UqGL8YBkcA61H6Z — verified by hash to be the ORIGINAL (now archived) version.
  • On-chain anchor: diva:docs:4QyfWd7bqp1W6sqrjNv96ZLuQ3i69UhYLY918nLN05w
  • ⚠️ The polished canonical was NOT re-pinned — the pinned CID points at the pre-polish April doc. Re-pin the new version before delivery.
  • Dead-end trail: nexus-node CIDs (Qmamv/Qmdwn/QmcQn/QmbF) = February Hydra Command Center templates (empty stub nexus-bridge-monitor = 0 bytes). NOT related to Konrad. Made by ~/.nexus-security/hydra/hydra/scripts/nexus-darknet-host.py.

C4. Truth Manual polish (this session)

  • ELI5 "5th grader" section → replaced with professional §1 Overview (ELI5 migrates to the podcast/video).
  • Every questionable number source-verified against ~/claude/divachain/src/ → §7 Verification Log.
  • Backup made before edit: ~/claude/docs/archive/org-2026-07-11-DIVACHAIN_TRUTH_MANUAL.md.

C5. ✅ SOURCE-VERIFIED DIVACHAIN FACTS (from src/schema/tx/v1/ + src/chain/tx.ts, v0.60.0)

Claim Truth
d field size limit 8,024 CHARACTERS (maxLength: 8024; JSON Schema = chars not bytes). "8192 bytes" was WRONG. Per write-space, batchable up to 32/tx.
cs max commands 32 (maxItems:32, min 1, unique)
Namespace ns regex ^([A-Za-z0-9_-]{2,16}:){1,7}[A-Za-z0-9_-]{2,16}$ (2–16/seg, 2–8 segments)
tx fields (all 6 required) v, h, o, ha, p, cs — Truth Manual had only o/ha/cs
p field previous-tx hash (prevHash=prevTx.ha, h=prevTx.h+1) → per-origin hash chain = same tamper-evidence as git (ties to Argus!)
Identity locking writes auto-suffixed with pubkey → namespace:pubkey; only key-holder writes. Confirmed src/chain/chain.ts.
PoW ALREADY EXISTS — BLAKE3, P2P_POW_DIFFICULTY=2, 48-byte stamp, in src/net/network.ts. On P2P messages, NOT tx layer. (Konrad thought he needed to add it → really it's a "which layer?" convo. Ties to NeXuS hashcash thread.)
API token getTokenAPI() static wallet token; NO timed rotation in source ("3–10 min" claim = unsupported)
Block time "2-min blocks" = Konrad's word, NOT found in source (likely consensus-round, not a constant)
Version v0.60.0 confirmed (deno.json)
I2P transport SAM 127.0.0.1:7656, SOCKS5 127.0.0.1:4445; "exclusive" wording still to confirm w/ Konrad

C6. Seed mechanics (for fast-join / "0 to hero")

Two seeds (src/genesis.ts): - Genesis seed seed-genesis/tx.v1.json (274B): chain root (v1/h1/zeros/genesis:init). Wrong genesis = you fork onto an island. Immutable → perfect to pin to IPFS + anchor on-chain. - Peer seed peer-seed.json: array of known peers w/ I2P coords. Empty [] = the 10–30 min wait (tunnels to nobody). Populated (or BOOTSTRAP .i2p) = fast join. Mutable → needs a LIVE source, NOT a stale IPFS pin. - I2P router tunnels still take time — seed removes peer-discovery wait, not I2P handshake. "Fast join," not "instant."

C7. Distribution principle (decided)

  • Tiny + immutable (genesis) → direct fetch / IPFS pin
  • Large + immutable (chain snapshot, releases, doc bundle) → I2P torrent (I2P is first-class torrent; stays in-network, no clearnet leak)
  • Mutable (live peers) → live service (eepsite / gossip / BOOTSTRAP)
  • Proposed enhancement: chain-snapshot-as-I2P-torrent = the real fast-sync (grab bulk state from swarm, tail-sync the gap). NOT in his code — a NeXuS proposal for the meeting.

C8. Delivery plan — "NeXuS delivers the goods" (dogfood the stack)

  • Bundle (manual + attribution + eng-log + graphics + 5-min video + 30–45 min podcast) → I2P torrent
  • Genesis → IPFS pin + anchor CID on DivaChain
  • Manifest (index + hashes) → pin + anchor on DivaChain
  • Pointer → Telegram ← THE lesson: April published but never pointed → unseen. Rails carry the goods; the Telegram ping makes them SEEN. Both, or it's April on repeat.
  • Frame as a gift, not a takeover (solo dev whose project got audited/rewritten — land it as respect).

C9. "0 to hero" one-liner — 🔵 DESIGNED (nexus-diva-up.sh, NOT built/tested)

Chains: prereq check (deno/docker) → clone → musl sodium-native link fix → deno.json allowScripts → I2P containers up → create-devnet → drop in peer-seed (kills the wait) → verify :17468/about. Must be TESTED end-to-end on a clean box before we stamp "0 to hero" (honest-engineering: don't claim TESTED before tested).

C10. Konrad meeting logistics

  • Monthly sync; missed June (both busy). Comms channel = Telegram (his project's own contact is Telegram too).
  • His repo github.com/diva-exchange/divachain: no commits since 2026-04-29 (branch develop-deno). Bootstrapping/joining/syncing fixed together in April.
  • Draft message built around "the doc upgrade you never saw + let's meet today + I'll PR it into your repo." Fact-sheet w/ CIDs prepared.

D. RIN + ARC PRIZE 2026

  • RIN = Real-Intelligence-Network — proof-of-personhood layer. 1 human = 1 node = 1 vote. Defense-in-depth ("measurement in depth"): composite attestation from many weak signals (puzzle/Sudoku-proof, 7+day uptime, history, peer verification). Anti-plutocracy (2011 laptop = data center in vote weight). Janus Key (USB+TPM) = the hardware home for the Argus master key — one identity spine: Argus (which key) + RIN (one human) + Ghost Gate (external receipt).
  • ARC Prize 2026 — Konrad gave the link out of the personhood convo (ARC puzzles = "trivial for humans, brutal for machines" = a personhood signal). Nov 2026 deadline (~4 mo), $2M pool, ARC-AGI-2 + ARC-AGI-3 tracks on Kaggle, open-source, offline/compute-capped. Honest tension: ARC weakens as a personhood test as AI improves → use as a rotating signal. Memory: project_arc_prize_2026.md.

E. MULTI-FORGE PUBLISHING — 🔴 PLANNED

  • No sovereign FOSS tool exists for "create repo across GitHub+Codeberg+SourceHut + multi-push." (roostorg/mirror = cloud CI/GitHub-hub = fails Sovereign.)
  • Plan: git-native multi-pushurl (backbone, never reinvent) + thin nexus-forge.sh wrapper over per-forge CLIs. gh installed ✅; tea (Codeberg) + hut (SourceHut) NOT installed.
  • Immediate driver: ~/scripts/scripts/nexus-portal/README.md clones from codeberg.org/hackenstacks/portable-nxs-https-server — repo doesn't exist yet. Plan: create on Codeberg + SourceHut (make reality match the README). Not a git repo yet; needs .gitignore → init → dev branch (protocol).
  • Anon HAS Codeberg; SourceHut unconfirmed. Auth (SSH keys preferred — dovetails with Argus Ed25519) TBD.

F. SECURITY: THE PRIVOXY DOOR — ⏳ PENDING DECISION

  • *:8118 = Privoxy bound to 0.0.0.0 via pasta (rootless podman) = open filtering proxy (anyone on LAN/WAN could route through your IP).
  • Defined at TWO layers, both wide:
  • ~/.nexus-security/containers/privoxy/config:2 → listen-address 0.0.0.0:8118
  • ~/.nexus-security/containers/privoxy-run.sh:5 → -p 8118:8118 (host publish, all interfaces)
  • Fix (no doas, rootless): -p 8118:8118 → -p 127.0.0.1:8118:8118, backup privoxy-run.sh first, restart container.
  • ⚠️ TWO honest caveats:
  • Firewall unknown — can't read nft without root. Open socket ≠ proven reachable; nft may already block inbound 8118.
  • Might be load-bearing — nexus-hotspot.sh + nexus-transparent-proxy.sh reference :8118; internal IPs (10.152.152.10, 192.168.88.1) point at it. So the exposure MAY be intentional for hotspot/transparent-proxy.
  • DECISION NEEDED: mistake (→ rebind to localhost) vs. serving hotspot (→ scope to hotspot iface only + confirm firewall). Root peek needed to verify firewall.

🌟 DECISIONS / PRINCIPLES ESTABLISHED

  • 5th Star = SUSTAINABLE. Order: Sane · Simple · Secure · Stealthy · SUSTAINABLE. (Beautiful's slot status TBD — do not assume dropped.) The Stars are navigational, not slogans — "the Starz in the NeXuS night that keep NeXuS on course." Constellation is OPEN (more Stars will rise).
  • "NeXuS — where the code is public but not your identity" (prior-session Claude). The one-line statement of Accountability: accountable to your KEY, not your NAME.
  • Emergency Stop Law (see §B).
  • Published ≠ delivered (see §C8).
  • Honest engineering — don't claim TESTED before tested; verify against source, not AI memory (caught the 8192→8024 error this way).

⏭️ NEXT-SESSION QUEUE (priority)

  1. Privoxy door decision (§F) — mistake vs hotspot; needs a root peek at nft.
  2. Send Konrad the Telegram message (built; pointer = the whole point).
  3. Re-pin the polished Truth Manual to IPFS (old CID = pre-polish April version) + re-anchor.
  4. Build the diva-chain package in ~/Documents/diva-chain/ (docs/ media/ + manifest).
  5. Write I2P-torrent chain-snapshot fast-sync design note for the meeting.
  6. Build + TEST nexus-diva-up.sh (0-to-node on clean checkout) before claiming "0 to hero."
  7. Write the Argus Accountability spec doc (from memory project_argus_accountability.md).
  8. Multi-forge: install tea+hut, git-init nexus-portal, build nexus-forge.sh, create Codeberg+SourceHut repos.
  9. Confirm w/ Konrad: block time, "I2P exclusive," token rotation, which PoW layer he meant.
  10. Revamp the intruder alert — TOOL-POWERED, not hand-rolled. The dead watcher failed because it was a bespoke socket loop (false positives + self-lockout). Rebuild on proven tools already installed: OpenSnitch (running), CrowdSec (installed/unconfigured), fail2ban (running), PSAD, OSSEC → feed into Ghost Gate/accountability pipeline. Kill switch FIRST (Emergency Stop Law) or it doesn't ship. Same lesson as git-as-ledger: don't reinvent, lean on battle-tested tools (Sane·Simple·Sustainable).
  11. Port knocking (knockd) — SSH/port protection via knock sequence (was on pending list).

🔑 KEY PATHS

Path What
~/claude/docs/DIVACHAIN_TRUTH_MANUAL.md polished + verified upgrade
~/claude/docs/DIVA_SOVEREIGN_ATTRIBUTION.md the source-audit discovery
~/claude/docs/archive/ old Truth Manual variants (archived)
~/claude/divachain/ Konrad's DivaChain source (v0.60.0, develop-deno)
~/claude/divachain/src/schema/tx/v1/ tx.json + data.json (the verified schemas)
~/claude/divachain/seed-genesis/tx.v1.json genesis seed (chain root)
~/Documents/diva-chain/ package staging (has divachain-readme-v1.md = original)
~/scripts/archive-disabled-2026-07-11/ the dead watcher executable
~/.nexus-security/containers/privoxy-run.sh the -p 8118:8118 open-door line
~/scripts/scripts/nexus-portal/ portable-https-server (README points at nonexistent Codeberg repo)

🧠 MEMORY FILES WRITTEN THIS SESSION

  • project_argus_accountability.md (git-as-ledger, master/child, 5th Star, "code public not identity", Emergency Stop)
  • project_arc_prize_2026.md (ARC + RIN personhood context)
  • feedback_nexus_rules.md (Emergency Stop Law added)

NeXuS: Sane • Simple • Secure • Stealthy • Sustainable Compass by Claude · 2026-07-11 · Author: hackenstacks