Day 13: Audit — Challenge vs core-nexus

Natural day 13 of the challenge. The checklist and git had drifted — platform work landed without day numbers, and a few changelogs overstated readiness. This entry is the audit.

Phase 1 — Foundation

Days	Status
1–11	Done (Day 9 via GT→SSE bridge, not prod athena HTTP)
12–13	Done as Document catch-up (this pair) — original Builds deferred
14–20	Open (Use/Build/retrospective)
Deferred	Typed approvals contract; athena-agents SSE (retire Day 9 bridge)

Day 4’s stub-Act story is historical. Act executes registered tools in athena-agents now. Day 6’s “SOCAlert = Day 32” claim is stale — Day 11 shipped the map (also checked as Day 32).

Phase 2 — Detection

Days	Status
21–31	Not started (SQLi→Suricata, OpenPLC, Modbus Use/share)
32	Done early (= Day 11 SOCAlert map)
33	Not started (alert ack API)
34	Partial — badge rules from Day 6; meaningful “unacked” needs Day 33
35–40	Not started

k8s Wazuh/Suricata manifests exist. That is not the same as Days 14/21/35 Use evidence.

Phases 3–5 — precursors only

No day checkboxes complete. Roughly two dozen days have scaffolding or adjacent work (skill MinIO sync, Console approvals UI, range Athena limits, syft/cosign for platform images, Kyverno signed-image policy, AI-inference keyword “memory” mock, ICS specs). None finish a Phase 3–5 brief inside core-nexus alone.

Prerequisites shifted under several future days:

• Skill/RAG days that say “MinIO only” must mean object store (MinIO lab / R2 prod)
• “Agent overlay on k3d” lives primarily in nexus-athena; core-nexus has the range shell + Console
• Vault-in-this-repo assumptions → nexus-hashistack
• Webtop-era SOC → Console Deployments

Architecture honesty

Highest drift is docs, not the challenge tracker:

• docs/architecture/13 (and related) present Plan skill load, multi-backend agent LLM, and Chroma/Milvus RAG as current while code still shows Future / mock / external repos
• Supply-chain scripts sign platform images; that is not Day 66–70 “Athena agent SBOM/cosign loop” complete
• TUI approvals are display-oriented; write-back is not the Day 58/59 story yet

The challenge file’s empty Phase 3–5 progress logs were the accurate part. The narrative docs need a pass (not this day’s rewrite).

Deferred Builds (do next)

1. Approvals — ApprovalAction models, pending-default + Property 8, decision 404/409/502
2. SSE from athena-agents — real /sessions + /events; gate stays on the Day 9 bridge until then

Then

Day 14 (U): use the SOC spine — Athena traffic, real alerts, triage in Console. Until Approvals/SSE land, Agent Feed and the Approvals badge stay limited by upstream honesty.

Tracker metrics (unchanged)

Skills 15 · sessions 2 · GT 14 · detection coverage still —.