@meta
  v: 1
  route: /warlock
  generated: 2026-06-07T00:00:00Z
  ttl: 1h

@intent
  purpose:    Warlock OS — a build-your-own field cyberdeck on a ClockworkPi uConsole (Raspberry Pi CM5): one API across web, terminal, and an on-device AI operator, behind a hard engagement-scope gate with signed audit attestation.
  audience:   msp, security-pro, agent
  capability: read, build, evaluate

@state
  status: active
  front_ends[3]: web, terminal, ai-operator
  capabilities[9]{domain,detail}:
    wireless-recon,"AP/client discovery, channel survey, handshake and PMKID capture (aircrack-ng, hcxdumptool) on MT7961 in monitor mode"
    wireless-offense,"gated — deauth, evil-twin and karma (airbase-ng), WPS (reaver/bully)"
    wireless-ids,"Kismet-driven rogue-AP, evil-twin and deauth-flood detection into a live alert pager"
    network,"ARP and port scanning, baseline plus diff change-detection (ARP-spoof / new-host alerts)"
    sdr,RTL-SDR receive; ADS-B aircraft map live over the bus; RF capture/replay/analyze — transmit hard-gated
    mesh-comms,Meshtastic / LoRa SX1262 off-grid messaging; u-blox GPS with PPS time discipline
    server-audit,"nmap-vuln, nikto, lynis, SSH-config review; remote targets gated; secrets env-passed, never logged"
    cracking,managed hashcat queue; auto-converts captures to .hc22000 (hcxpcapngtool)
    ai-operator,WaRL0c — on-device assistant that guides an engagement and can drive in-scope ops
  hardware[7]{component,detail}:
    chassis,"ClockworkPi uConsole handheld — keyboard, LCD, battery"
    compute,"Raspberry Pi Compute Module 5, 8 GB RAM"
    storage,4 TB NVMe (Samsung 990 EVO Plus); boots from NVMe
    expansion,"Hacker Gadgets AIO V2 — RTL-SDR, LoRa SX1262, GPS/PPS, RTC, USB 3.0, RJ45"
    wifi-attack,MediaTek MT7961 USB — monitor mode plus injection
    sdr,RTL2838 receive on the AIO; HackRF for TX/replay
    os,"Debian 13 (trixie), aarch64, kernel 6.12"
  safety[6]{control,detail}:
    safe-by-default,Offensive modules are inert until a scoped engagement is armed
    scope-enforced,Host/subnet/SSID/BSSID checked on every action — for humans and the AI
    kill-switch,One action cancels every in-flight job across all queues and restores safe state
    rf-strictest-gate,Transmitting requires an active engagement and a named in-scope target
    ai-cannot-self-authorize,The AI acts only inside an engagement a human armed; never arms one itself
    signed-and-verifiable,"Ed25519 / JCS / did:web attestation, verifiable offline against a reference verifier"

@actions
  - id: view_human
    method: GET
    href: /warlock.html
  - id: view_source
    method: GET
    href: https://github.com/techmages-org/warlock
  - id: read_charter
    method: GET
    href: /charter.html

@context
  > Warlock OS is not "a Pi with Kali on it." It is one FastAPI backend exposing 17 modules across red, blue, radio, and platform domains, fronted by a React web UI, an Ink terminal UI, and an on-device AI operator — all sharing one source of truth for state, scope, and audit. Offensive and transmit operations are inert until a human arms a scoped engagement; scope is enforced at execution time even when the AI makes the request; a kill switch reaches every queue; and every audit record is an Ed25519 / did:web attestation a third party can verify offline. It is build-your-own from a documented bill-of-materials.

@nav
  self:      /warlock.agent
  parents:   [/.agent]
  peers:     [/wisp.agent, /deck.agent, /deck-gui.agent, /projects.agent, /charter.agent, /index.agent, /contribute.agent]