The immune system that watches back.
Ghost Continuum is a local-first Living Digital Immune System: polymorphic deception that evolves, morphs, contains, and seals. Version 3.6.4 Air-Gap Map vendors Three.js r160 so the Command Nexus holographic map runs without a CDN. Crystal Seal silent Windows spawn is unchanged. Defensive scope and zero-core-deps discipline stay.
listen · breed · morph · remember · seal · evolve · contain
git clone https://github.com/Pitchfork-and-Torch/ghost-continuum.git
cd ghost-continuum
npm run setup
npm start
# -> http://127.0.0.1:30000 Command NexusRequirements: Node.js 18+. Core engine: zero npm dependencies. Command Nexus ships Three.js r160 under /vendor/three.module.js (canvas 2D fallback if WebGL is blocked).
Public site: https://ghost.jonbailey.xyz/ · Preview: https://ghost.jonbailey.xyz/hub/
| Pillar | Capability |
|---|---|
| Vendored Three.js | Fabric map loads /vendor/three.module.js (r160). No CDN required for WebGL. |
| Canvas fallback | If WebGL is blocked, the map still draws in 2D. |
| Pillar | Capability |
|---|---|
| No-console spawn | Ghost LAN is a hidden child of the hub. No cmd.exe, no detached console on Windows. |
| Browser open | Hub URL opens via explorer.exe, not cmd /c start. |
| Pillar | Capability |
|---|---|
| Silent start | Ghost LAN no longer uses cmd /c start /MIN. The honeypot starts hidden. |
| Pillar | Capability |
|---|---|
| Evasion invert | Encoded UUID/MAC/IPv4 lists, sideload paths, and VM/Sysmon recon become encoded-blob / sideload / anti-emu classes (minimal response + trap) |
| Portable exe | GhostContinuum.exe zip on the GitHub Release (bundled Node, no install) |
| NL / response | "evasion" / "packer" / "sideload" queries; threat-response TTP evasion-probe |
| Pillar | Capability |
|---|---|
| Sealed replay | Each SEAL writes replay.html - open offline, print to PDF, step with j/k |
| Integrity | Evidence hashed after write; portable MANIFEST.json; tamper fails verify |
| CLI | ghost-continuum seal [label] · ghost-continuum verify [dir|.tgz] |
| Pillar | Capability |
|---|---|
| Command palette | Ctrl/Cmd+K jump to views, LIVE/DEMO, RESPOND, evolve, seal |
| Time-window queries | last hour / 24h / 7d actually filter events; typed IPv4 AND-filter |
| Keyboard cockpit | 1-5 views, / focuses query, Esc closes palette then dossier |
| Public site | Landing copy + tweet card ?v=3.5.0 match the engine |
Public site craft: brand island + X follow, visitor counter, 44px targets, tweet card, FAQ/HowTo schema.
| Pillar | Capability |
|---|---|
| Tabbed Nexus | Overview · Ghost LAN · Genome · Forensics · Home Shield |
| Hover-expand map | Banner map grows to full center bento for clean node work |
| Deck under map | Protection · OPS · Devices · Hygiene (expand upward) |
| Simple help | Glass tips in plain language; TIPS ON/OFF |
| Operator chip | Follow @suddenlyjon on X |
| Pillar | Capability |
|---|---|
| Crystal Bento layout | Asymmetric membrane tiles: hero fabric map, efficacy, planes, morph, genome, timeline, Merkle strip |
| Command Nexus polish | Crystalline edges, membrane hover, gauge breath, refined tokens, progressive bento restack |
| Static /hub/ preview | Full bento showcase, FAQ JSON-LD, run-locally CTAs, SEO/AEO suite |
| Architecture art | Infographic + share cards aligned to Crystal Bento |
| Docs | Design system + visual changelog 3.2 |
| Pillar | Capability |
|---|---|
| Art direction | Soft teal / pearl / warm charcoal; no pure void, neon HUD, or CRT scanlines |
| Typography | Self-hosted Fontshare Clash Display + Satoshi |
| Public site | Full design-token rewrite, membrane microinteractions, progressive disclosure |
| Command Nexus | Same premium language as the public site; quieter scientific instrument chrome |
| Share cards | 1200x630 OG / tweet cards regenerated for the new brand |
| Architecture art | Infographic and hub preview aligned to Luminous Membrane |
| Docs | Design system + visual changelog under docs/ |
Deep dive: docs/DESIGN-SYSTEM-LUMINOUS-MEMBRANE.md · docs/VISUAL-CHANGELOG-3.1-LUMINOUS-MEMBRANE.md · CHANGELOG.md
| Pillar | Capability |
|---|---|
| Command Nexus | Living fabric map, gauges, morphs, Forensic Time Machine, Ghost Voice |
| Threat lifecycle | Detect -> Morph -> Contain -> Seal (client demos + live hub) |
| NSGA-II Genome | Multi-objective evolution, leaderboard, phylogeny |
| Sensor planes | Ghost LAN, Edge, Audit, Narrative, Phantom, Deep Veil, Mirage, Trench Coat |
| Home Shield | Wizard, kid mode, quiet hours, device trust, weekly report, alerts, PWA |
| Merkle forensics | Sealed incidents, integrity chain |
| Local-first | Hub binds to 127.0.0.1 by default; no forced cloud |
Architecture diagram: landing/infographic.svg
npm start→ open http://127.0.0.1:30000- Click DEMO - inject a sealed synthetic campaign
- Explore the fabric map · switch Sentinel Morphs
- Scrub the Forensic Time Machine
- Open Home Shield if this is a home or lab network
- SEAL INCIDENT (or
ghost-continuum seal lab) - openreplay.html, thenghost-continuum verifyon the folder
- Defensive only - authorized networks you own or may defend
- Local-first - brain and data under
~/.ghost-continuumby default; hub Host/Origin lock keeps the Command Nexus on loopback (see SECURITY.md) - Zero core npm dependencies for the engine (Node 18+ only)
- Open source MIT - auditable; no
eval - No offensive capabilities
See LEGAL.md and SECURITY.md.
ghost-continuum/
landing/ Public product site (source of truth for ghost.jonbailey.xyz)
packages/hub-ui/ Command Nexus UI (local :30000)
packages/hub-api/ Local hub API
packages/core/ Zero-dep engine primitives
packages/genome/ NSGA-II evolution
packages/planes/ Defensive sensor planes
deploy/jonbailey/ Cloudflare Pages deploy scripts
docs/ Architecture, design system, changelogs
npm run deploy:site
# optional SEO ping:
npm run deploy:seo
MIT - see LICENSE.
Pitchfork-and-Torch · https://ghost.jonbailey.xyz/