@meta
  v: 1
  route: /deck-gui
  generated: 2026-06-07T00:00:00Z
  ttl: 1h

@intent
  purpose:    The same screen-by-screen Warlock OS tour as /deck, captured from the web GUI instead of the terminal — a dark browser console reached over the tailnet.
  audience:   msp, security-pro, agent
  capability: read, evaluate, build

@state
  surfaces[3]: web-ui, terminal-ui, ai-operator
  access:      browser over tailscale tailnet; same single gated API as the terminal
  modules[10]{id,summary}:
    dashboard,"one HUD in the browser — throttle/temp/disk/links/peripherals/engagement; identical data to the terminal"
    wireless,"guided monitor-mode AP/client survey; handshake and PMKID capture, point-and-click"
    wireless-ids,"passive defensive watch — rogue-AP / deauth-flood detection surfaced as alerts"
    sdr,"RTL-SDR receive (ADS-B, rtl_433) in-browser; HackRF transmit replay hard-gated"
    sdr-offensive,"transmit/replay console — refused 403 in the UI until an engagement is armed + in scope"
    gps,"u-blox + 1-PPS map and fix; disciplines the system clock for accurate offline timestamps"
    net-recon,"ARP discovery + baseline-diff defense alerts; wide/non-local portscan gated"
    server-audit,"nmap-vuln/nikto/lynis/ssh-config; remote gated, local lynis always-on"
    mesh,"Meshtastic/LoRa off-grid deck-to-deck comms map; works air-gapped / infra-down"
    engagement-gate,"scoped engagement enforced at run time; scope violations refused + signed audit"

@actions
  - id: view_terminal
    method: GET
    href: /deck.html
  - id: view_human
    method: GET
    href: /deck-gui.html
  - id: the_build
    method: GET
    href: /warlock.html

@context
  > The GUI Deck page is the browser-rendered twin of /deck: the exact same Warlock OS capabilities, the exact same single gated API and audit trail, presented as a dark web console you reach over a Tailscale tailnet. Terminal and GUI are two faces of one deck — offensive operations stay inert (403 in the UI) until a human arms a scoped engagement, mesh provides off-grid deck-to-deck communication when infrastructure is down, and every refusal and job is audited and cryptographically signed.

@nav
  self:    /deck-gui.agent
  parents: [/.agent]
  peers:   [/deck.agent, /warlock.agent, /index.agent, /projects.agent]