NEXUS COMPASS — 2026-08-07 — Systems Architecture Deep Dive¶

Session Overview¶

Wide-ranging architecture and philosophy session covering services audit, language stack decisions, CE design, and the two-track CLI/Web conclusion.

Services Audit¶

Running but doing nothing useful¶

darkman — no config, no hooks, zombie from labwc-desktop meta-package
fprintd — VFS5011 hardware detected but flaky driver, nothing enrolled. Not stable enough for PAM auth.
ossec-hids — BROKEN partial install. Only ossec-execd + ossec-monitord running. Missing analysisd/logcollector/syscheckd. Effectively dead.
fwknopd — CRASHED in OpenRC. On pending list.
goa-daemon — 69MB, GNOME Online Accounts. Pulled by gvfs-full → gvfs-goa → gnome-online-accounts
goa-identity-service — GNOME Kerberos. Same chain.
gvfs-afc/gphoto2/mtp monitors — Apple/camera/Android GNOME VFS. All from gvfs-full.
at-spi2-core — GNOME accessibility framework
accounts-daemon — AccountsService (GNOME)
xdg-desktop-portal-gnome/hyprland/kde — wrong portals for labwc (keep wlr only)

Root cause of GNOME bloat¶

gvfs-full in /etc/apk/world pulls entire GNOME VFS ecosystem. Fix: replace gvfs-full with gvfs + gvfs-fuse only.

Intentional Dark Stack services (keep)¶

conduit — Matrix homeserver, Rust, port 6167, healthy, local-only (matrix.nexusnet.network not publicly reachable — domain/NAT issue)
caddy — TLS reverse proxy for conduit
Both are OpenRC system services, boot on startup

Server Status Dashboard — BUILT¶

/api/servers endpoint added to nexus_web_server.py
~/nexus-web/servers/index.html — live service health, log tails, file links, auto-refresh 30s
"⬡ Servers" button added to hub nav

Language Stack — Two Track Conclusion¶

Evolution¶

Phase 1: Python + Rich      — prototype, works, icons/emojis, no true images
Phase 2: Go rewrite         — CLI native, notcurses fixes images, Ghost Gate/Dark Stack
Phase 3: TypeScript/Web     — full images, browser native, more features
Phase 4: Now                — proxy + web suite unifies Python + TS/JS, fluid

The Two Tracks (BOTH NEEDED)¶

Track 1 — Go CLI (nexus-cli) - Ghost Gate, Observer, Dark Stack protocol daemons - Character reader with notcurses true pixel rendering - Long-running services, systems code - cage-foot native, runs anywhere, no browser

Track 2 — Python + TS/JS Web (nexus-web) - Web server + API proxy (already built) - Full image rendering, rich UI - Browser interface, served by nexus_web_server.py

Same character cards, same API backend, same provider stack. Different rendering surface. Web suite is the bridge making both feel like one system.

Notcurses — Image Rendering Fixed¶

Problem: chafa subprocess → blocky/pixelated thumbnails (block chars)
Fix: notcurses ncvisual with NCBLIT_PIXEL/NCBLIT_SIXEL → true pixel rendering
Used in: ~/git/nexus-charcard/render.go, ~/Projects/adv-go-char-gen/card_browser.go
Still unexplored: ncvisual video, sprite planes, fade/pulse effects, layered planes

Desktop Architecture — CE Design¶

The Two Modes¶

Mode 1 — CLI Pure (Ghost/Headless)
  kmscon → tuios/tmux → micro + yazi + w3m + foot-server
  No compositor, boots in seconds, lowest attack surface

Mode 2 — Minimal Wayland (Operator)
  cage → foot-client (connects to foot-server)
  Terminal IS the desktop, cage is ~500 lines C, invisible infrastructure

Community Editions¶

CE-0   CLI-Pure       kmscon + tmux(v1)/tuios(v2) + TUI stack
CE-1   Cage           CE-0 + cage + foot server/client
CE-2   labwc          CE-1 + labwc + thunar + standard apps
CE-3   labwc-qs       CE-2 + quickshell + full NeXuS HUD

Each is strict superset of previous. Drop down any tier.

Multiplexer Decision¶

v1 first adopters  →  tmux default (power users, muscle memory)
v2 broader base    →  tuios default (friendlier, "Terminal UI OS" framing)
tmux always available as swap

Tuios = "Terminal UI Operating System" — mouse, workspaces, tiling, Nerd Font icons, 11MB. First adopters ARE power users (sysadmins, Arch reddit crowd). Friendliness is a v2 problem.

The Wayland Decision — Settled¶

NO X11: hard line, always was
Wayland: correct engineering conclusion after living the alternatives
kmscon framebuffer path: looks minimal, actually insecure (broad /dev/fb0 permissions, less audited)
cage + foot: proper Wayland isolation, better security MODEL than raw KMS

"CLI purists complaining about Wayland are running Hyprland with 47 widgets. Their 'CLI only' is a terminal inside a GUI. NeXuS CLI is actually CLI only."

foot sings in cage¶

Direct path: foot → cage → KMS → display
foot server/client: instant spawn, shared memory, no per-window overhead
No compositor overhead stealing cycles
Better rendering than kmscon: faster, more color, sixel native

Official NeXuS App Layer¶

Quickshell    — shell/HUD/panels (not a file manager/editor/archiver)
Thunar        — file manager (keeps winning, accept it, plugins work)
micro         — editor
foot          — terminal
mpv           — media
xarchiver     — archives
grim/slurp    — screen capture

Quickshell is first-class suite for shell layer. App layer is best-in-class per tool. csuite evaluated — redundant given existing stack + quickshell.

Sovereign Toolchain Stack (Knowledge)¶

Hare language    — systems lang, spec frozen, no UB, small binaries
harec            — compiler → QBE backend
QBE              — 15K line compiler backend (LLVM alternative)
simple-cc        — portable C toolchain using QBE
musl             — C stdlib (NOT redundant — different layer from QBE)
Helios           — Drew DeVault's microkernel written in Hare (experimental)

Full sovereign stack: Hare → QBE → musl → Alpine Every line auditable by one person. Cage in Hare = future project worth considering.

Drew DeVault Ecosystem¶

wlroots → sway → labwc lineage. His code runs the NeXuS desktop. Also: sourcehut, aerc, scdoc, foot, Hare, Helios, QBE (contributor). Philosophy: small, auditable, no unnecessary deps — same as NeXuS.

Other Tech Notes¶

rqlite — Worth Watching¶

Distributed SQLite via Raft consensus. HTTP API (curl-queryable). Use case: NeXuS node registry — distributed, survives node failure, SQLite simplicity. File in "Next Session Keynotes."

Haiku OS¶

Small because: coherent single-codebase design, no legacy accretion, BFS metadata, built-in media kit
Security: NOT suitable for NeXuS — no ASLR, no sandboxing, single-user design
Interesting architecturally, wrong threat model

suckless¶

Still on X11. dwm requires Xorg. Patch culture = outsourced config.
The suckless SPIRIT lives more in: Hare, musl, foot, cage, micro
"They have the philosophy right. The execution got stuck in 1999."

NEXT SESSION Priorities (carry forward)¶

Remove bloat services: gvfs-full → gvfs, kill GOA cluster, remove xdg-portal-gnome/hyprland/kde
Fix or remove ossec-hids (broken partial install)
Investigate fwknopd crash (on pending list)
CE design document — write formally
Image path IDs for warm operator series + anime series (nexus-web visual library)
Copy remaining nexus-03/04/05/078/08 to nexus-web with canonical names
File action report for servers dashboard work