Shadow313 NEXUS v4 — Architecture Dashboard

2648

Tests Passing

Active Detectors

Security Tools

CLI Modules

AI Models

16GB

RAM Available

Trust Boundary Architecture

☁️ Internet / Cloud

🤖

Claude (Anthropic)

api.anthropic.com:443

This chat. Cloud AI. No security data transmitted.

🦙

Ollama.com Registry

ollama.com:443

matarmohamad313/shadow313-nexus model hosted here.

🐙

GitHub

github.com:443

piyyy314/Shadow313-Nexus repo. CI/CD via Actions.

🌐

IPFS Network

ipfs.io:443

313-BIND receipt anchoring. Public data only.

🖥️

Hetzner VPS

UDP:51820 / 443

WireGuard VPN server. Bug bounty tools. €3.29/mo.

🪟 Windows 11 Pro Host — Dell Latitude 5490 (16GB RAM)

🦙

Ollama Engine

localhost:11434

4 models: llama3.2:3b, mistral:7b, codellama:7b, shadow313-nexus

🛡️

WireGuard Client

UDP:51820

Encrypted tunnel to Hetzner VPS. Kill-switch capable.

🐳

Docker Desktop

host.docker.internal

WSL2 backend. Manages all containers.

🔍

Burp Suite 2026

localhost:8080

HTTP proxy for web app security testing.

🔐

Quad9 DoH DNS

9.9.9.9:443

Encrypted DNS. Malware blocking. All queries encrypted.

🐧 WSL2 — Ubuntu 24.04 + Kali Linux 2026.2

⬡

Shadow313 CLI v4

/workspace/

30 modules. 2648 tests GREEN. 29 detectors active.

⚡

FastAPI Event Bus

localhost:8000

NEXUS detection pipeline REST API. Audit server.

🧠

NEXUS ML Engine

Internal

Isolation Forest + RF + Quantum scorer. 29 detectors.

🔗

313-BIND Protocol

Internal + IPFS

SLH-DSA + SHA3-512 + nanosecond ...313 timestamp.

🐉

Kali Linux 2026.2

wsl -d kali-linux

Metasploit, nmap 7.99, wordlists. shia313 user.

🔌

Ollama API Access

host.docker.internal:11434

WSL2 reaches Windows Ollama via gateway IP.

🐳 Docker Containers

💬

Open WebUI

localhost:3000

ChatGPT-like UI for local Ollama models. Install pending.

🔌

Shadow313 API

localhost:8000

FastAPI audit server. 6 routes. 313-BIND receipts.

🗄️

PostgreSQL

localhost:5432

Metasploit database backend. Initialized in Kali.

Component Details

313-BIND Temporal Binding Protocol — Receipt Chain

STEP 1

Payload Input

Security finding, audit event, or module output dict

→

STEP 2

Timestamp ...313

time.time_ns() nudged to end in ...313 (~1ms entropy)

→

STEP 3

SHA3-256 Hash

payload_hash = sha3_256(canonical_json)

→

STEP 4

SHA3-512 Chain

chain_hash = sha3_512(payload_hash + prev_hash + ts)

→

STEP 5

SLH-DSA Sign

FIPS 205 signature over chain_hash (pyspx or HMAC fallback)

→

STEP 6

BindReceipt

Immutable receipt: bind_id, ts_ns, hashes, signature

→

STEP 7

IPFS Anchor

Optional: CIDv1 anchor for external verification

→

VERIFY

Gap Detection

bind_index must be sequential — deletion detected instantly

Data Flow Map — All Connections

Inbound Flows

Browser→Claude API443HTTPS

Open WebUI→Ollama11434HTTP

Ubuntu WSL2→Ollama11434HTTP

Shadow313 AI→Ollama11434REST

Browser→Open WebUI3000HTTP

Browser→Burp Proxy8080HTTP

Kali Tools→PostgreSQL5432TCP

Outbound Flows

WireGuard→Hetzner VPS51820UDP/Enc

313-BIND→IPFS443HTTPS

Windows DNS→Quad9443DoH

Ollama→Ollama.com443HTTPS

Git Push→GitHub443HTTPS

Shadow313 Recon→TargetVariousTCP

Docker→Docker Hub443HTTPS

Port & Service Registry

Port	Service	Protocol	Direction	Trust Zone	Notes
11434	Ollama AI Engine	HTTP	Internal	LOCAL ONLY	Bound to 127.0.0.1 — never exposed externally
3000	Open WebUI	HTTP	Internal	LOCAL ONLY	Docker container — localhost access only
8000	Shadow313 FastAPI	HTTP	Internal	LOCAL ONLY	Audit server + event bus REST API
8080	Burp Suite Proxy	HTTP	Intercept	LOCAL ONLY	Configure browser proxy → 127.0.0.1:8080
5432	PostgreSQL (Metasploit)	TCP	Internal	LOCAL ONLY	Kali Linux Metasploit database
51820	WireGuard VPN	UDP	Outbound	ENCRYPTED	Tunnel to Hetzner VPS — or port 443 obfuscated
443	HTTPS (various)	TLS 1.3	Outbound	INTERNET	Claude, GitHub, Ollama.com, IPFS, Quad9 DoH
9.9.9.9	Quad9 DNS-over-HTTPS	DoH	Outbound	ENCRYPTED	All DNS queries encrypted — malware blocking

Shadow313 v4 Detector Stack — 29 Active Detectors

APT Hardening (FIX-12 → FIX-21)

FIX-12 ValidAccountsDetector → T1078

FIX-13 C2ProtocolAnalyzer → T1071/T1041

FIX-14 CredentialDumpingDetector → T1003

FIX-15 SessionHijackDetector → T1539/T1557

FIX-16 SpearphishingEnhancer → T1566.001

FIX-17 ImpossibleTravelDetector → T1078

FIX-18 AdaptiveBeaconDetector → T1071

FIX-19 HardenedCredDumpDetector → T1003

FIX-20 AdvancedSessionGuard → T1539/T1557

FIX-21 AttachmentDeepInspector → T1566.001

Identity Layer (IDENTITY-1 → IDENTITY-8)

ID-1 BehaviouralBiometricProfiler → Insider

ID-2 ZeroTrustNetworkAccessEngine → T1557

ID-3 OAuthTokenAnomalyDetector → T1528

ID-4 MFAChallengeOrchestrator → MFA

ID-5 HardwareTokenBindingVerifier → T1556

ID-6 MLAnomalyProfiler → Insider/Context

ID-7 LOTLAuthBypassDetector → T1550/T1558

ID-8 TLSInspectionEngine → T1071

PQC Stack (FIPS 203/204/205)

FIPS 203 ML-KEM-768 → Key Encapsulation

FIPS 204 ML-DSA-65 → Digital Signatures

FIPS 205 SLH-DSA-SHAKE-128f → Root of Trust

313-BIND ts...313 + SHA3-512 + IPFS

HNDL Harvest-Now-Decrypt-Later defense

CRQC Timeline: 2030-2035 (plan NOW)

pyspx SLH-DSA signing (installed)

DW-1 liboqs ML-DSA-65 → Q4 2026

  Shadow313 NEXUS v4.0.0 · Architecture Dashboard · Ottawa, ON, Canada · 2026 · 
  2648 tests GREEN · 
  313-BIND Active