Work / Nexus / Changelog / Day 14
Day 14: Triage That Persists — Build Prep for the Use Day
ai-inference gets SQLite persistence, Suricata/Wazuh/Athena scoring, and a Gateway camelCase contract. Thin lab k8s overlay pins the image. The Day 14 Use brief — Athena traffic → real alerts → triage in Console — is still open.
Calendar Day 14 is a Use brief: start the SOC baseline, generate Athena traffic, triage the first real alerts in Console. That run did not happen. What did land is the triage spine it depends on — Build prep, not a checked Use day.
ai-inference v0.2.x
Persistence. store.py adds SQLite under NEXUS_AI_DB_PATH (or ./data/triage.db). POST /v1/triage scores and saves; GET /v1/triage/{event_id} returns a prior result. The Gateway deep-link path finally has something to hit.
Scoring. triage.py expands feature packs for Suricata categories, Wazuh groups + MITRE tags, and Athena-labeled traffic. Athena events prefer needs_human_review over auto-contain language — containment still requires human approval.
Console shape. Responses carry both snake_case and camelCase aliases (confidenceScore, recommendedAction, reasoningExcerpt). This is a NumPy baseline scorer, not a production LLM runtime; hardware scan endpoints are advisory only.
Gateway contract
platform/api-gateway/src/clients/ai_inference.py maps service payloads via to_console_triage and validates TriageResponse. On GET miss, the alerts route can POST the matching Wazuh document for on-demand scoring instead of returning an empty 404 forever.
Eleven Gateway tests still green; triage route cases cover the new fallback path.
Kubernetes
ai-inference moved out of the flat SOC base blob into deploy/kubernetes/soc/ai-inference/ with a SQLite /data mount, Flux image watch, and pins in the thin gitops-lab and R2 overlays (nexus-ai-inference:v0.2.3). Vector already POSTs to /v1/triage when wired — the service can now persist what arrives.
Parallel (not day-completing)
ADR 0009 locks factory AI coding/review agents in nebucloud/factory-agents. That is supply-chain adjacent work, not Phase 1 Day 14.
What I am not claiming
- Wazuh Manager + Suricata baseline is not up end-to-end in this environment yet
- No recorded Athena session whose alerts were triaged live in Console
- Day 15’s nexus-tui correlation Use brief is untouched
- Deferred Builds (typed approvals, real athena-agents SSE) are still deferred
Next
Run the Day 14 Use brief for real: baseline stack, Juice Shop or range Athena traffic, alerts in Console, triage deep-link returns scored JSON. Until then, Phase 1 stays at Days 1–13 (+32 early) with this Build prep noted in the log.