Defensive Perimeter — Packet Field

On the way — what you will learn

Defense begins when sockets become readable sentences in operator space. On the way you will read TX/RX contracts, gatekeeper verdicts, field memory in jsonl, and Queen alignment — local-first perimeter, not cloud omniscience.

• Connection Gatekeeper ten-axis scoring
• Watchlist before block; KILL with authorship
• Panel :9477 tour and archive habits
• Defense rhythm: daily, weekly, incident

Defensive perimeter — the packet field

The packet field is how you see what touches you before someone else narrates it for you. Offense and defense couple here: reading the field changes what you dare to run.

Implemented in NEXUS-Shield. Not inside AMOURANTHRTX Vulkan — different product boundary. Local sockets, local jsonl, local panel :9477 — not cloud omniscience.

Plain English — sockets to sentences

Every connection becomes a sentence in machine-readable log:

• ss shows sockets
• tcpdump shows frames
• Packet field adds meaning: who, which port, TX vs RX, process path, corroboration

TX / RX — operator perspective

Direction is field dimension — symmetric flows without TX/RX are unreadable defense.

Corroboration and 94/6 posture

Multiple independent signals before permanent action. 94/6 truth filter — watchlist before block; KILL is permanent and archived. One weird packet does not condemn a peer — love as engineering restraint.

Connection Gatekeeper — NEXUS

Ten-axis scoring → verdicts:

Gatekeeper is implemented — grep lib sources and panel JSON. Not AMOURANTHRTX binding.

Ten axes — literacy without memorizing every weight

Axes include process path trust, port habit deviation, direction balance, payload surprise hooks, honorability cross-checks — full source in NEXUS lib. Operator stance: verdict is summary; jsonl row is receipt; human is judge.

Field memory — what survives reboot

Memory is local-first discipline — your machine remembers so you can correlate across sessions without phone-home.

Port stories — habits not guilt

Ports are habits: 443 HTTPS, 53 DNS, 4444 shell-class risk. Registry learns your machine's habits, not textbook lists alone. A port is context for the sentence, not automatic guilt.

Panel :9477 — operator command center

https://127.0.0.1:9477/ — command, packets, threats, signals, DNS, library, system. RTX Zero ?rtx=1 — Aqua chrome. Correlate with AMOURANTHRTX stderr without merging products.

Queen alignment — 2026

Queen browser holds gates — WebRTC through gatekeeper, MP4 in-tree, EME held not omitted. Chapter 21 full doctrine. Packet field is perimeter Queen inherits — navigation → packet field → gatekeeper → honorability → thermo receipt.

Navigation → Packet Field → Gatekeeper → Honorability → Thermo receipt
                ↑ Truth DNS (no Google shortcut)
                ↑ Sovereign Time (SQUIDGIE witness)

Operator drill

./nexus.sh
# Open panel :9477 — archive one gatekeeper decision
grep -E 'USER_OK|SUSPICIOUS|HARM' field.jsonl | tail -5

Failure modes

Chapter summary

Packet field is local defensive perimeter — sentences in jsonl, gatekeeper verdicts, TX/RX contracts, corroboration before KILL. Queen inherits gates. Not AMOURANTHRTX Vulkan. Chapter 6 RF shell is separate visual layer.

Study questions

1. What three tools does packet field extend — ss, tcpdump, and what addition?
2. Define TX and RX contracts.
3. Name four gatekeeper verdicts.
4. What survives reboot vs not?
5. Why are ports habits not guilt?
6. How does Queen bind to packet field without replacing NEXUS?
7. Archive one panel row — what fields prove local-first?

Chapter 6 — Signal Shell →

Honorability cross-check

Gatekeeper integrates honorability signals — process reputation, path stability, prior verdict history — before HARM_CANDIDATE escalation. Not single-axis zealotry. Ten axes exist because peers are stories, not single packets.

DPI sample and intent layers

Deep inspection samples and connection-intent metadata enrich sentences beyond raw ss — still local-first, still operator-owned archives. Samples are corroboration fuel, not cloud upload by default in field posture.

threat-panel.json publish path

Panel consumes threat-panel.json — ephemeral HTML view over durable jsonl. Reboot kills panel window, not field memory. Know which artifacts are receipts vs chrome.

KILL dossier permanence

KILL is operator-authorized permanence — archived with context. Reversible until you say otherwise is policy; KILL is the line where reversibility ends. Philosophy with teeth.

Truth DNS lock — Chapter 20 pointer

Queen and FieldFox inherit Truth DNS — no Google shortcut. Navigation receipts tie to DNS integrity. Packet field without DNS truth is sentence without subject.

Sovereign time at perimeter — Chapter 19 pointer

Gatekeeper timestamps and correlation use operator-owned time when sovereign mode active. SQUIDGIE verdict fail-closes perimeter services. Time and packets couple at receive.

RTX Zero panel mode

?rtx=1 Aqua chrome, cache-first refresh — observability UX, not second engine. Thermo and packets still separate products.

Local jsonl hygiene

Rotate and backup field jsonl like any forensic archive. Disk is your memory; encryption at rest is operator choice outside this chapter's scope but inside your conscience.

WebRTC peer as packet sentence

Queen routes WebRTC peers through gatekeeper — each peer a sentence with direction, ports, verdict. Do not disable; receipt. Chapter 21 doctrine planted in Chapter 5 soil.

Extended treatment — Connection Gatekeeper axis philosophy

Ten axes exist because peers are stories, not packets. Process path anchors identity — same port, different binary, different story. Port habit deviation flags novelty without automatic evil. Direction balance catches asymmetric exfil shapes. Payload hints integrate oracle without conflation. Honorability cross-checks reputation time series. Verdict is summary; axes are explainability for operator review.

Extended treatment — corroboration before KILL

94/6 philosophy: generous truth allowance, narrow permanent punishment. Multiple independent signals before KILL dossier — ss snapshot, tcpdump corroboration, oracle storm, operator narrative. Reversible watchlist until KILL — love as engineering.

Extended treatment — field memory forensics

field jsonl survives reboot — treat as forensic archive. Rotate, backup, encrypt at rest per operator policy. KILL dossiers permanent — legal and moral weight. Panel HTML ephemeral — do not confuse window with memory.

Extended treatment — Queen and packet field 2026

Queen: WebRTC through gatekeeper, MP4 mandatory in-tree, EME held, Truth DNS, sovereign time witness. Navigation becomes packet sentences with thermo receipts. Wrong: disable WebRTC. Right: gate and archive.

Extended treatment — port habit registry

Registry learns your machine — 443 may be browser, 4444 may be shell-class risk context. Port is habit marker, not verdict. Combine with process path and direction for sentence grammar.

Extended panel tour — :9477

Command, packets, threats, signals, DNS, library, system — six faces one perimeter. RTX Zero ?rtx=1 is chrome mode, not second engine. Correlate panel JSON with stderr without product blur.

Packet field narrative — extended scenario writing

Scenario A: EPHEMERAL DNS blip — forgive, no KILL. Scenario B: SUSPICIOUS repeated RX to rare port with stable process path — watchlist, tcpdump corroboration. Scenario C: HARM_CANDIDATE with high H file drop same timeline — operator review, not auto block. Scenario D: USER_OK baseline — archive anyway for habit graph. Writing scenarios trains gatekeeper literacy beyond enum names.

Gatekeeper verdict state machine in prose

Flows enter as candidates. EPHEMERAL exits quickly from attention. USER_OK earns trust with monitoring. SUSPICIOUS enters watchlist — reversible attention debt. HARM_CANDIDATE demands human review — corroboration required. KILL is terminal archive — operator signature on conscience.

jsonl row anatomy lesson

Each row should be readable as: at time T, process P on path PATH, direction D, port habit H, verdict V, because axes A summary. If row lacks PATH or D, sentence incomplete — debug NEXUS intake.

Defense without cloud — threat model paragraph

Adversary on LAN, adversary in browser, adversary in supply chain — packet field sees local manifestation. You still need updates, still need operator judgment, still need Queen gates. You do not need cloud to narrate your sockets.

Packet field capstone — defensive sentences

Template: Flow F from process P direction D port H received verdict V; I will action A because corroboration C. Write five for real rows. Literacy is syntax.

Queen WebRTC peer sentence: Peer P via WebRTC, gated, verdict V, thermo receipt T — Chapter 21 binds browser to same grammar.

KILL dossier sentence: After review date D, operator O KILL peer P because reasons R1 R2 independent signals — permanent archive ethics.

Local-first restated: jsonl on your disk, panel on your loopback, gatekeeper on your processes — not internet panopticon.

Chapter 6 RF follows — separate RF words from packet words before signals panel correlation.

NEXUS install and state directories

NEXUS_INSTALL_ROOT locates lib modules — gatekeeper, sovereign-time, panel assets. NEXUS_STATE_DIR (default /var/lib/nexus-shield) holds jsonl, keys, dossiers. Know paths before incident — literacy includes filesystem map.

Honorability — reputation over time

Honorability tracks process and path reputation — sudden binary swap on trusted path raises eyebrows without auto-KILL. Combine with oracle and direction for story.

WebRTC gate path — Queen 2026 step list

Navigation requests peer. Packet field records intent. Gatekeeper scores. Honorability cross-checks. Operator panel displays. Thermo per context accrues in Queen build. Verdict archived. No step skipped when built correctly.

MP4 mandatory — packet bytes perspective

Media is packets — demux parses locally in-tree — no missing codec excuse to fetch remote blob blindly. Sovereign parsing is defensive surface — Chapter 21; Chapter 5 names packet bytes include media.

Threat panel JSON — field guide

Read threat-panel.json as ephemeral view of durable jsonl — like HTML view of database. Refresh does not replace archive discipline.

Defense exercise — red team local

Simulate suspicious RX with netcat locally — verify gatekeeper picks it up, verify you can archive without KILL, verify corroboration checklist. Local red team beats cloud card guessing.

Chapter 5 extended — defensive perimeter day in the life

Morning: grep jsonl since yesterday, review SUSPICIOUS watchlist, verify sovereign time USER_OK. Afternoon: run AMOURANTHRTX session, correlate THERMO with any flagged flows from morning. Evening: Queen browsing if deployed — verify WebRTC peer through gatekeeper, archive verdict. Night: no cloud dashboard — local perimeter sleeps with jsonl memory intact.

Day-in-the-life shows defense is rhythm not product install once. Packet field value accumulates with habit graph length — registry learns you.

Gatekeeper appeals process — operator humanity

Peer falsely SUSPICIOUS? Review axes, check tcpdump corroboration, forgive with note. Peer falsely USER_OK? Escalate watchlist before KILL — 94/6. Appeals are human process — daemon provides evidence not verdict finality.

Packet field and compliance framing

Local jsonl may support compliance narratives — you own data, you own retention, you own legal questions. Field stack does not phone home — compliance posture starts with local control. Consult counsel; chapter teaches technical honesty not legal advice.

Introduction — defensive perimeter as readable sentences

Chapters 2 through 4 taught continuous state on silicon: fabric texels, die bytes, thermo receipts. Chapter 5 turns outward — not to the whole internet, but to your machine’s sockets rendered as operator-readable sentences. The packet field is the defensive core of NEXUS-Shield: local-first, MIT-licensed, grep-able, archived in field jsonl that survives reboot. It is Implemented in NEXUS. It is not inside AMOURANTHRTX Vulkan — conflating products is week-one failure.

ss shows sockets. tcpdump shows frames. The packet field adds meaning: process path, port habit, TX versus RX, corroboration across axes, gatekeeper verdict summary. Defense, in Field Technology, is reading continuous state faster than confusion propagates — then choosing watchlist, block, or KILL with conscience. Chapter 7 takes the spear; this chapter holds the shield.

Queen browser (Chapter 21) routes WebRTC through the same gatekeeper instead of disabling WebRTC. Sovereign time (Chapter 19) and Truth DNS (Chapter 20) supply sealed clocks and trace-from-root resolution — packet field sentences sit beside those receipts, not above them. Chapter 12 lists rocks; this chapter teaches rhythm.

Plain English — every connection becomes a sentence

Local-first means loopback truth: panel at :9477 on your host, jsonl under operator-owned paths, no phone-home conscience. The packet field does not see the whole internet. It sees endpoints your OS exposes to the daemon — Implemented scope. Claiming NEXUS “monitors the planet” is vendor fantasy; label it Philosophy until jsonl proves otherwise.

Direction is a field dimension. TX is egress you own — bytes you sent. RX is ingress you must explain — bytes you received. Asymmetry matters for corroboration: a peer that only RX-es strange payloads without TX context tells a different story than symmetric chatter.

Connection Gatekeeper — ten-axis table

Verdicts are summaries; axes are explanations. One weird packet does not condemn a peer — restraint is engineering, not sentiment. The gatekeeper scores up to ten axes and emits a verdict enum.

Implemented. Grep NEXUS-Shield sources for gatekeeper scoring — not Vulkan bindings. Chapter 4’s Shannon oracle may corroborate payload surprise; it does not replace axis review.

field jsonl — schema habits and archive discipline

Jsonl is append-only memory — each line a JSON object, one flow event or verdict witness per row. Habits that keep archives forensically usable:

• One row, one claim. Do not stuff multiple peers into one line because JSON allows it — grep wants linear time.
• Sealed time column. Correlate with Chapter 19 sovereign receipts — wall clock lies; sealed session clock does not rewrite.
• Stable keys. Process path, port, direction, verdict — column names consistent across weeks so week-twelve diff works.
• Rotation with conscience. Large jsonl is truth; rotate with backup, encrypt at rest per operator policy, never “delete to feel better” without review.
• No retroactive edit. Time is linear — append correction rows, do not silently rewrite history.

{"ts_sealed":9123456,"dir":"RX","port":443,"path":"/usr/bin/queen-browser",
 "peer":"127.0.0.1:9477","verdict":"USER_OK","axis_note":"loopback panel"}
{"ts_sealed":9123489,"dir":"TX","port":4444,"path":"/tmp/.cache/a.out",
 "peer":"203.0.113.7:4444","verdict":"SUSPICIOUS","axis_note":"shell-class habit"}

Example rows are pedagogical — your daemon may pack additional axes. The habit is: grep-friendly sentences that survive reboot and court your future self as witness.

KILL dossier ethics — permanent does not mean casual

KILL is not a button mood. It creates a permanent dossier — archived, surviving reboot, readable years later when you forgot the afternoon’s frustration. Ethics:

1. Watchlist before block. SUSPICIOUS earns observation; KILL earns authorship.
2. Corroboration before permanence. Multiple axes, optionally oracle alert, optionally DNS trace — not one weird packet.
3. Human authorship. Daemons recommend; operators sign. No automated KILL because entropy stormed.
4. Forgiveness path. Local memory enables review — downgrade watchlist, annotate dossier, admit mistake without phone-home.
5. No cloud absolution. Vendor “global ban lists” outsource conscience; NEXUS keeps yours local.

Panel HTML at :9477 is ephemeral window chrome — pretty, convenient, not the archive. field jsonl and KILL dossiers are the memory. Screenshot the panel for teaching; trust jsonl for testimony.

Port registry learning — habits, not textbook alone

Ports are habits learned on your machine: 443 HTTPS, 53 DNS, 123 NTP, 9123 sovereign pulse, 9477 panel. Shell-class ports (4444, 1337 folklore) raise different axis weight than loopback 9477 health checks. The registry compares today’s flow against your history — not a generic list shipped from a vendor who never saw your lab.

First week on a fresh install: many flows read EPHEMERAL or lightly SUSPICIOUS because habit axis lacks memory — normal, not failure. Week six: repeated Queen WebRTC peers should stabilize toward USER_OK if honorability and paths stay clean. Sudden habit breakage — trusted port, alien path — is corroboration gold.

Chapter 20 Truth DNS at 127.0.0.1 with trace-from-root supplies naming honesty for corroboration. Packet field sentences plus DNS receipts beat either alone.

Panel :9477 tour — command, packets, threats, signals

Open https://127.0.0.1:9477/ after ./nexus.sh (or your package equivalent). Treat tabs as views on the same archive, not separate products.

Tour drill: pick one USER_OK row in Packets, one SUSPICIOUS row, grep jsonl for matching keys, note sealed time delta. If UI and jsonl disagree, UI is wrong until reconciled — same rule as HUD hex versus THERMO in Chapter 4.

Queen WebRTC chain — gates held, not disabled

Queen posture: nothing optional, hold all gates, MP4 mandatory in-tree, EME held not omitted. Wrong security story: disable WebRTC to feel safe. Right story: WebRTC through Connection Gatekeeper with honorability axis and packet field sentences per peer.

Navigation → DNS (Ch.20) → socket open → gatekeeper axes → verdict
          → field jsonl append → thermo receipt (Ch.7/21) → operator review

WebRTC media paths do not bypass NEXUS because Queen is sovereign browser, not a chrome fork with holes poked for convenience. Each peer earns TX/RX diary entries. Thermo context per WebGL surface inherits AMOURANTHRTX proxy discipline when built with QUEEN_BROWSER_BUILD — offense and defense share timestamps without merging scores.

Chapter 21 is full doctrine. This chapter plants the chain: packet field is not “network chapter only” — it is the perimeter Queen wears.

TX and RX — contracts the gatekeeper expects you to honor

Every packet field sentence carries direction because accountability is asymmetric. TX flows are confessions: you originated bytes, chose destination, accepted egress policy. RX flows are interrogations: someone reached your machine — which process listened, which port opened, which habit broke? Operators who journal only RX panic miss half the story; operators who journal only TX forget that defense begins at ingress.

Corroboration pairs directions. A peer with heavy RX and no TX history may be benign software update noise — or may be exfiltration listening post. A symmetric chat pattern on loopback 9477 differs from symmetric chatter to global RFC1918. The gatekeeper encodes direction on its own axis; your job is to narrate why the direction makes sense in plain language before you escalate verdicts.

Chapter 2 named packet field as the third scale of state. Direction is not metadata garnish — it is a coordinate. Queen navigation that claims HTTPS honorability while jsonl shows raw shell-class TX is a lie the axes exist to catch.

Defense rhythm — daily, weekly, incident

Field Technology is practice, not one-time read. Rhythm beats heroics.

./nexus.sh
curl -k https://127.0.0.1:9477/ | head -5   # panel alive
ss -tunap | head -20
tail -5 /var/lib/nexus-shield/field.jsonl    # path may vary per install

# After SUSPICIOUS row appears:
grep -F 'SUSPICIOUS' /var/lib/nexus-shield/field.jsonl | tail -3
# Record process path + port + DNS answer for same peer in operator journal

Failure catalog — packet field edition

Ephemeral versus permanent — what defense remembers

Panel HTML refreshes; browser tabs close; screenshots fade from chat logs. field jsonl and KILL dossiers remain — that asymmetry is design. Operators who understand permanence wield KILL sparingly and watchlists generously. Operators who mistake panel cache for archive delete history by reinstalling and wonder why habits reset.

Backup jsonl before OS upgrades. Encrypt archives at rest if your threat model includes shared disks. Rotate logs with append-only discipline — never rewrite a row to feel better about Tuesday. Chapter 19 sealed time columns make rotated archives comparable across months.

Cross-links — defense meets offense

Chapter 2: three scales — packet field is scale three. Chapter 4: Shannon oracle corroborates, does not replace axes. Chapter 6: Field Antenna JSON panels appear under Signals — correlate, no super-score. Chapter 7: dispatch thermo runs parallel; merge timestamps only. Chapter 11: observability grep rhythm. Chapter 19–20: sovereign time and Truth DNS. Chapter 21: Queen all gates. Chapter 12: honesty rocks on local scope.

Chapter summary

The packet field turns local sockets into sentences in field jsonl — TX/RX, process path, port habits, gatekeeper verdicts from ten axes. Watchlist before block; KILL dossiers permanent with human authorship. Port registry learns your machine. Panel :9477 tours live views; jsonl is memory. Queen WebRTC flows through gatekeeper, not around it. Defense rhythm is daily glance, weekly archive, incident corroboration.

Prior: Chapter 4 — Entropy. Next: Chapter 6 — RF & Signals — three meanings before offense takes the spear in Chapter 7.

Deep dive — NEXUS daemon rhythm and sampling ethics

NEXUS daemons sample sockets on a duty cycle tuned by calm/alert/storm posture from the entropy oracle — nurse watching vitals, not judge passing sentence. High storm duty increases CPU wakeups locally; it does not phone home. Operators on laptops notice battery tradeoffs — honesty includes admitting local defense costs local watts, still not the same as entropyThisFrame proxy.

Sampling sees process paths when OS APIs allow; containers and sandboxes may obscure paths — gatekeeper axes downgrade confidence, not invent guilt. When path is unknown, verdicts trend EPHEMERAL or SUSPICIOUS rather than USER_OK — restraint again.

Corroboration means independent witnesses: socket table, payload hints, DNS resolution trace (Chapter 20), sovereign time column (Chapter 19), optional tcpdump slice you attach to incident notes. One witness is never a trial.

Deep dive — threat-panel.json and live panel anatomy

threat-panel.json feeds the :9477 dashboard — ephemeral snapshot refreshed by daemon, not a substitute for jsonl archive. Read it for “what is happening now”; grep jsonl for “what happened across reboots.”

Tour the panel once per month even if quiet — familiarity prevents panic formatting during real incidents.

Deep dive — incident narrative template (half page)

When a flow surprises you, write before you click KILL:

1. Sentence — one jsonl row quoted: direction, ports, path, verdict.
2. Context — what you were doing (Queen tab, build, game, ssh).
3. Corroboration — second witness (oracle H, DNS trace, tcpdump one-liner).
4. Decision — watch, block, forgive, KILL — with date and operator name.
5. Follow-up — grep THERMO if AMOURANTHRTX ran parallel; note timestamp only.

This template is how field literacy meets love as restraint — memory without phone-home, permanent actions only with authorship.

Deep dive — ten gatekeeper axes in plain English

Axes are not secret sauce — they are explicit questions the daemon asks before summarizing a verdict. Operators who learn axes forgive peers intelligently and escalate with evidence.

Verdict enums compress axis stories — always read axes before arguing with the enum. Chapter 12 rocks table lists conflation failures; this table lists human judgment inputs.

Deep dive — building a port habit registry over month one

Week one registry is naive — textbook ports only. Week four registry is yours: dev servers, game anticheat channels, local mesh sync, Queen WebRTC UDP patterns. The packet field learns without cloud upload because jsonl stays on disk.

Operators exporting habits between machines should export jsonl archives, not screenshots. Import on new machine seeds registry — forgiveness and suspicion travel with evidence, not with vendor account login.

Document lab ports in operator runbook: “Port 8765 is my test echo — expect USER_OK when binary path matches.” Future-you will thank present-you when a colleague’s script triggers SUSPICIOUS on that port.

Deep dive — jsonl grep patterns for week-two defense

grep '"verdict":"SUSPICIOUS"' field.jsonl | tail -20
grep '"direction":"RX"' field.jsonl | grep -v 'USER_OK' | tail -10
grep '"port":' field.jsonl | sort | uniq -c | sort -rn | head -20

First pattern surfaces watchlist candidates. Second finds ingress that did not earn USER_OK — hospitality with scrutiny. Third builds empirical port histogram for your machine — registry ground truth beats textbook port lists alone.

Pair grep with panel tour weekly. jsonl is memory; panel is pulse. Defense literacy is rhythm — daily pulse glance, weekly grep archive, monthly port histogram update in runbook.

Study questions

1. Why is packet field local-first, and what myth does that refuse?
2. Name four gatekeeper axes and two verdict enums.
3. What jsonl habits keep archives grep-friendly?
4. When is KILL ethical versus premature?
5. Tour :9477 — which tab maps to Field Antenna signals?
6. Trace Queen WebRTC chain in five steps.
7. Distinguish panel HTML from KILL dossier persistence.
8. Run Drill 5.A; record one normal and one notable flow.
9. Why is one weird packet insufficient for condemnation?
10. How does Chapter 7 thermo relate without merging scores?

ss versus jsonl — when to use which

ss is instantaneous snapshot; jsonl is memory arc. Packet field adds meaning to snapshots and archives arcs.

tcpdump corroboration

tcpdump frames corroborate payload stories gatekeeper summarizes — independent signal before KILL.

EPHEMERAL verdict lifecycle

Short flows may never need archive depth — EPHEMERAL is kindness to DNS blips, not negligence to tunnels.

HARM_CANDIDATE review queue

Operator review queue discipline — dashboard shows candidates; human decides block or forgive.

Panel library tab

Library surfaces reference docs locally — perimeter includes knowledge, not cloud PDF phone-home.

NEXUS_INSTALL_ROOT layout

Know install root for lib paths — sovereign-time.py, gatekeeper modules, field jsonl location. Literacy includes filesystem.

MIT license boundary exercises

Can you link NEXUS and AMOURANTHRTX in Queen build? Yes with license eyes open. Can you pretend one repo? No.

Loopback TLS panel

127.0.0.1 TLS is local trust — not public CA theater. Operator owns cert story.

Block versus watch operational SLO

Watch SLO: hours to review. Block SLO: documented reason in archive. KILL SLO: permanent dossier with context.

Defense in depth — local edition

Depth means jsonl memory plus gatekeeper plus operator review plus Queen gates plus Truth DNS — not cloud layers you cannot grep.

TX egress ownership narrative

TX bytes are your speech — own them. Unexpected TX to rare port is confession you must explain or block.

RX ingress hospitality narrative

RX is guest at your door — hospitality with verification. RX without process path is anonymous guest — higher scrutiny.

Watchlist hygiene

Review SUSPICIOUS weekly — forgive or escalate deliberately. Watchlist rot is security debt.

Panel command tab

Command tab issues local operator actions — receipts should land in jsonl when actions permanent.

DNS panel integration

DNS view supports Truth Resolver posture — 127.0.0.1 trace discipline Chapter 20. DNS lies poison packet sentences.

Queen MP4 mandatory — why mention in packet chapter

Media bytes are packets — MP4 in-tree means media parsing in sovereign boundary, not codec absent security. Chapter 21; Chapter 5 plants packet-media coupling.

Exercise 5.C — narrate one flow

Pick one jsonl row; write five sentences plain English: who, direction, port habit, verdict, your decision. Literacy is narration.

verdict = score(axis₁…axis₁₀) → tier

./nexus.sh  # panel :9477  |  tail field jsonl