ALL-SIGNAL // THE CLUB 1

OPERATIONS PROTOCOL // THE EPHEMERAL TOR CITADEL (1-TOR)

Properties2
tagsoperations, tor, security, opsec, protocol, all-signal
aliasesEphemeral Tor Citadel, 1-tor Protocol, Citadel Gate Specification, Tor Aperture Protocol

4 min read

🧅 OPERATIONS PROTOCOL // THE EPHEMERAL TOR CITADEL (1-TOR)

Sovereign Ephemeral Onion Service, Bubblewrap Sandbox & Synchronized Epoch Gate for ALL-SIGNAL // THE CLUB 1

“The Citadel does not linger in consensus cyberspace. It opens a temporal aperture, verifies sovereign proof of work, and vanishes. Zero footprint. Zero data leakage. Absolute mathematical isolation.”
— Council Directive // All-Signal Infrastructure

1. Executive Architecture

The Citadel Gate represents Layer 6 of Specification - The Omni-Vector Gauntlet. It serves as the intake and cryptographic verification portal for candidates navigating the Omni-Vector filtration pipeline.

To prevent permanent surveillance, crawler indexing, and brute-force bot attacks, the service is built upon a temporary 2-hour convergence window managed by the sovereign 1-tor CLI controller.

[ ADVERSARY / TOR VISITOR ]
            │ (6-Hop End-to-End Encrypted Circuit)
            ▼
[ TOR v3 ONION ADDRESS ] (ultronvxwkyn5j2naedmdba5it6eatbnyj7vvnv5yaw2pfl62xdynnqd.onion)
            │ (Forwarded internally to 127.0.0.1:7799 only)
            ▼
[ BUBBLEWRAP KERNEL SANDBOX (`bwrap`) ]
 ├── Read-Only /usr, /lib, /lib64, /www
 ├── /home/ MASKED (Completely invisible to the process)
 ├── Isolated PID, IPC, and UTS Namespaces
 └── Hardened Stripped Python Micro-Daemon (server.py)
      ├── Zero Server Signature (No Python/OS version leaks)
      ├── Strict Content Security Policy (connect-src 'self', frame-ancestors 'none')
      └── Synchronized Server Epoch Telemetry (/api/time)

2. The 5-Layer OpSec & Anti-Leakage Shield

LayerDefense MechanismRisk Mitigated
1. Tor v3 Rendezvous EncryptionSelf-authenticating 56-char Ed25519 public key. Standard http:// over Tor is end-to-end encrypted; no exit nodes involved.Clearweb traffic inspection, eavesdropping, ISP packet tracking.
2. Bubblewrap (bwrap) SandboxUnprivileged kernel namespace container. /home/ is unmounted; process can only see /www and system libraries.Arbitrary file disclosure, access to ~/.ssh, ~/Vault, dotfiles, tokens.
3. Strict Loopback FirewallDaemon binds exclusively to 127.0.0.1:7799.LAN / Wi-Fi correlation scanning; zero external interface exposure.
4. Zero-Header Daemon (server.py)Strips Server: and Date: headers. Disables directory listings. Rejects non-GET/HEAD HTTP methods.OS / Python version fingerprinting, clock-skew / timezone identification.
5. Static Zero-Asset FrontendSelf-contained HTML/CSS/JS with canvas Tetris engine. Zero Google Fonts, CDNs, or external requests.Outbound DNS leaks, Server-Side Request Forgery (SSRF).

3. Cryptographic Vanity Mining (ultron...)

Tor v3 onion addresses use RFC 4648 Base32 (a-z and digits 2-7). Digits 0, 1, 8, and 9 are omitted to prevent visual spoofing.

  • AVX2 Miner Engine: Compiled from mkp224o with native instruction optimizations.
  • Active Vanity Address: 
    http://ultronvxwkyn5j2naedmdba5it6eatbnyj7vvnv5yaw2pfl62xdynnqd.onion
  • Backup Key Mined via Google Colab (colab-miner): 
    http://ultronoxvtm2svt3mrkwds7k7ulbi3xr5ya4ci23tknjd3dxlfb7prqd.onion
  • Cloud Mining Automation: Managed via colab-miner (status, fetch, stop), bridging headless GPU instances on Google Cloud to offload cryptographic search from host laptop hardware.

4. Synchronized Server-Side Epoch Telemetry

Traditional client-side JavaScript timers reset whenever a user reloads the page. The Citadel Gate implements synchronized server-side epoch tracking:

  1. Epoch Injection: server.py reads /started_at and dynamically substitutes __SERVER_ELAPSED_SECS__ and __SERVER_REMAINING_SECS__ into index.html on every HTTP request.
  2. Refresh Immunity: Reloading the page in Tor Browser never resets the 2-hour counter; it immediately reflects the real elapsed time since 1-tor was launched.
  3. Dual Telemetry Cards:
    • APERTURE TIME ELAPSED (FROM START) (e.g., 00h:18m:42s in cyan)
    • TEMPORAL WINDOW REMAINING (e.g., 01h:41m:18s in green)
  4. Drift-Free API Polling: Client JavaScript periodically queries /api/time to eliminate browser sleep or background tab clock drift.
  5. Auto-Destruction: At 7,200 seconds (2 hours), the display updates to CONVERGENCE EXPIRED // APERTURE CLOSED and the systemd watchdog terminates all listeners.

5. Interactive Cybernetic Terminal Deck (CONSOLE // DECK-01)

The landing page features an embedded green-phosphor interactive terminal deck allowing visitors to explore the Sovereign Enclave:

guest@club-1:~$ help
AVAILABLE DIRECTIVES:
  manifesto   - Sovereign Enclave Manifesto & Philosophy
  vectors     - 22 Cross-Domain Verticals Matrix
  gauntlet    - The 7-Layer Omni-Vector Architecture
  status      - Live Citadel Telemetry & Node Uptime
  triumvirate - Council Node Clearance Hierarchy
  whoami      - Verify Active Session & Authorization
  clear       - Purge Console Buffer

6. CLI Command Reference (1-tor)

The controller is deployed at ~/.local/bin/1-tor (version-controlled in ~/dotfiles/bin/1-tor):

# Launch ephemeral 2-hour aperture
1-tor
 
# Check live uptime, remaining window, and .onion URL
1-tor status
 
# Immediately collapse aperture and purge listeners
1-tor down

🔗 Related Knowledge Nodes

Graph View

Backlinks