Day 10: My SOC Console Watching an AI Agent Hack

Day 10 is a share day. The pitch is simple: a SOC console watching an AI agent hack.

The honest version is better.

The scene

Juice Shop on localhost:3001. Athena OPAR on the host. Nexus Console at :5174. Agent Feed open. Six HTTP probes land in under a second — home page, a SQLi search shape, Users API, whoami, login route, /ftp. The feed paints observe → act rows as ground-truth lines arrive. Session stops at limit-reached.

That is the demo. A browser, a target, an agent, and a live event stream.

What the demo is not

It is not Wazuh catching the traffic. Alerts and Suricata come later in Phase 2.

It is not a full gemma planner. On Day 9 the model registry was unreachable from this environment, so a canned planner drove Act. The Console does not care who planned — it cares that events arrive.

It is not production architecture. Host OPAR writes GT JSONL. The Gateway expects athena-agents HTTP on :8080. That surface does not exist yet (Day 13). A temporary bridge tails the JSONL and speaks SSE so Day 9 could still be a Use day instead of a blocked day.

Why that gap matters

Without the bridge, the agent can finish a scenario and the Console stays empty. Sessions return 502. SSE says UPSTREAM_DISCONNECTED. You would swear the stack is broken when the real bug is a missing event API between two components that each work alone.

Skill from that: code-console-host-opar-event-bridge.md. If GT is writing and the feed is silent, check the HTTP path before you debug the scenario.

What shipped around the share

• Day 9 bridge + start script so local Agent Feed can be brought up in one command
• CORS preflight no longer leaves a stale Content-Length on empty 204s (that wedged Gateway login)
• Dev auth retries for a real JWT instead of caching dev-bypass-token — EventSource was connecting with a placeholder the Gateway rejects

The template

Day 10/100 — #100DaysOfNexus

🎯 Today: Share the Console watching Athena vs Juice Shop
🔧 Built: GT→SSE bridge so Agent Feed has an upstream before Day 13
🔍 Learned: A healthy OPAR log is not evidence the Console can see the session
📊 Metric: 8 SSE frames, 7 GT lines, 2 agent sessions total

Skills generated: 15 | Agent sessions: 2

Next build days wire real Gateway alerts and approvals. Day 13 should retire the shim and put athena-agents on the event path for real.