Work / Nexus
One stack: the parent kernel, the Core Nexus deploy, Athena agents (the agent-athenas loop), the Kali image that hosts them, and the webtops that operate the SOC. Public repos only.
acald-creator/underground-nexus Sovereign kernel layer. Curated artifacts and an agentic kernel that assemble, harden, and prove infrastructure.
The parent Cloud Underground platform. Policy-guided automation that builds and governs infrastructure on any hardware or cloud — Git-BIOS, robotics hooks, and the Cerberus install path. The rest of the family deploys against this layer.
acald-creator/core-nexus AI-native security operations deploy. Console, API gateway, and the closed loop around Athena.
Deployment and operator platform for Underground Nexus. SOC detection (Wazuh + Suricata), autonomous red-team agents, and a unified console plus TUI. The agent generates labeled attack traffic, sensors detect it, and the platform measures coverage gaps. Image: phoenixvlabs/core-nexus.
acald-creator/athena-agents OPAR offensive loop. Observe, plan, act, reflect — with allowlists, capability gates, and ground-truth telemetry.
The agent-athenas piece: an AI offensive framework for autonomous security testing. Python orchestrator, Rust protocol tools (Modbus, CAN), pluggable LLM backends. Production path is the nexus-athena container, not a standalone product.
acald-creator/nexus-athena Athena0 Kali image. Controlled adversary emulation and the runtime that hosts the OPAR agents.
Red-team and adversary-emulation container for Underground Nexus. Profiles for manual red-team, packet lab, exploit lab, LLM agent, and ICS agent. Generates labeled traffic against approved targets for SOC validation and detection engineering.
acald-creator/nexus-webtop-workbench Browser analyst desktop. SOC dashboards, infra admin, MCP workflows. Replaces the legacy XFCE webtop.
Ubuntu MATE webtop for operators: Wazuh and Grafana, Terraform and kubectl, MCP-driven agentic workflows, and review of Athena results. Not the place that runs sensors or red-team tooling.
acald-creator/nexus-webtop-soc SOC baseline stack. Wazuh + Suricata receive labeled Athena traffic and feed the triage loop.
Detection pipeline for Underground Nexus. Suricata and Wazuh ingest labeled traffic from nexus-athena. The analyst XFCE image here is legacy — the workbench webtop is the current desktop. This repo’s value is the compose stack.