100 Days Changelog
Progress notes for the Underground Nexus challenge — not blog essays. Newest day first.
-
Day 16: Factory Reviews in the Approvals Queue
Gateway ingests factory-agents high/critical review webhooks, merges them with Athena OPAR approvals for Console, and documents ADR 0009 F2. Partial progress on the deferred typed-approvals Build — not Property 8, not persistence.
-
Day 15: Changelog on acaldwell.dev
Document day: Days 12–14 changelog entries ship to production on Cloudflare Workers. The Day 15 Use brief (Console alerts ↔ nexus-tui) waits on a real SOC session.
-
Day 14: Triage That Persists — Build Prep for the Use Day
ai-inference gets SQLite persistence, Suricata/Wazuh/Athena scoring, and a Gateway camelCase contract. Thin lab k8s overlay pins the image. The Day 14 Use brief — Athena traffic → real alerts → triage in Console — is still open.
-
Day 13: Audit — Challenge vs core-nexus
Catch-up Document day: honest map of Days 1–100 against the repo. Phase 1 stops at Day 11 (+32 early). Approvals and athena SSE Builds deferred. Architecture overclaims called out.
-
Day 12: Where core-nexus Actually Is
Catch-up Document day: the platform spine moved under us — R2 overlay, Vault in nexus-hashistack, SOC k8s Gateway/Console/Wazuh, gated Day 9 bridge. Approvals and real agent SSE are still deferred Builds.
-
Day 11: Alerts That Speak Console
Gateway GET /api/v1/alerts now maps Wazuh documents to SOCAlert camelCase, filters by severity/source/time, and hardens triage 404/504. Properties 5–7 covered.
-
Day 10: My SOC Console Watching an AI Agent Hack
Share day: the Nexus Console Agent Feed finally shows Athena probing Juice Shop live — after a Use-day bridge admitted that host OPAR and the Gateway were not talking.
-
Day 9: Watching the Agent From the Console
Use day: Console Agent Feed could not see host OPAR until a GT→SSE bridge filled the missing athena-agents HTTP surface. Juice Shop run streamed eight events through the Gateway.
-
Day 8: A Settings Page That Does Not Leak the Token
Console Settings now shows runtime config, JWT claims without the raw token, and Gateway-probed service status. Property 17 keeps the bearer string off the page.
-
Day 7: CORS and the Path to MinIO
Preflight now returns 204. Console points at gateway :3100. Presigned MinIO URLs use a browser-reachable host. Five tests cover CORS and the artifact download path.
-
Day 6: Live Badges
Sidebar badges now poll the Gateway. Alerts shows unacknowledged critical+high. Approvals shows pending. The wiring is real. The alert count will stay at zero until Wazuh payloads look like SOCAlert.
-
Day 5: First Skill from the Run
Documenting the Juice Shop OPAR run and encoding the allowlist identity bug as a reusable skill. Plan works. Act is still a stub. Ground-truth is not traffic.
-
Day 4: Juice Shop
Catching up three calendar days. First OPAR run against the target the challenge actually named. The agent plans a sensible web chain. The Act phase is still a stub.
-
Day 4: The Agent Thinks
First live OPAR run with LLM planning. The agent selects tools, assigns MITRE technique IDs, and explains its reasoning. Three actions against a real target.
-
Day 3: Ahead of Schedule
Days 1-3 collapsed into one session. The entrypoint, orchestrator CLI, and Dockerfile stages were all built on Day 1. Day 3 is a retrospective on velocity and what it means for the rest of the challenge.
-
Day 2: Setting the Stage
Adding a target, verifying the LLM backend, and getting everything aligned so the OPAR agent can run live tomorrow. Infrastructure day.
-
Day 1: Wiring the Agent
Making ./scripts/run-athena-profile.sh agent juice-shop actually work. Multi-stage Docker builds, an entrypoint that validates before it executes, and a Python CLI that bootstraps the OPAR loop.