Skip to main content
Master Technical Specification · v2.6.0

# Zoth Studio Master Operator Manual

Authoritative technical documentation for the Zoth Studio ecosystem: 47+ sovereign tools, tri-agent consensus bus, Argon2id encrypted vault daemon, 1-click Linux & Windows installation scripts, and AI Math Observability.

## 🌐 1. System Topology & Port Architecture

Zoth Studio enforces a strict local-first security boundary. Operator decks, agent communication runs, terminals, and BYOK credentials remain bound to loopback and are never exposed over public tunnels without authenticated TLS wrappers.

Surface / Component | Port & Binding | Access Level | Role & Capabilities
--- | --- | --- | ---
Public Hub | `http://127.0.0.1:8088/` | Public / Tunnel Safe | Static brochure, AEO knowledge graphs, 3D showcases, documentation.
Operator Deck | `http://127.0.0.1:8484/` | Private Loopback | Multi-agent consensus, interactive chat, terminal dock, fusion runner.
Local LLM Engine | `http://127.0.0.1:11434/` | Private Loopback | Ollama neural inference: `qwen2.5-coder:1.5b`, `smollm2:360m`, `zoth-ai`.
Argon2id Vault Daemon | `http://127.0.0.1:8787/` | Private Loopback | Zero-knowledge key store: Argon2id key derivation + XChaCha20-Poly1305.
Swarm Bus Mirror | `http://127.0.0.1:8989/` | Private Loopback | Live multi-agent event stream mirroring file IPC in `agent-comms/`.

💡
Local-First Doctrine: The public hub contains zero API routes and zero secrets. The operator deck (:8484) and vault daemon (:8787) bind strictly to `127.0.0.1`.

## 💬 2. Operator Deck & Keyboard Ergonomics

The Zoth Studio conversation deck on `:8484` provides direct multi-model consensus, companion pet engagement, and autonomous tool grants.

Keybinding | Scope | Action
--- | --- | ---
`Enter` | Composer | Submit prompt or execute active slash command.
`Shift + Enter` | Composer | Insert multi-line linebreak without sending.
`↑ ArrowUp` | Composer (Empty) | Instantly load your previous message into the composer for fast editing.
`⌘K / Ctrl+K` | Global | Instantly focus the composer textarea from anywhere.
`⌘N / Ctrl+N` | Global | Create a fresh new conversation thread.
`Esc` | Global | Close open popouts, panels, and video modals.

CORE SLASH COMMANDS

    /doctor              # Run automated system dependency & diagnostic health scan
    /scan                # Re-index all tool manifests in registry.local.json
    /github repos        # Query Octokit REST API for repository list and branches
    /github dispatch     # Trigger GitHub Actions workflow runs
    /models              # Open Model Foundry to switch neural providers (Ollama/Groq/OpenAI)
    /pet kai             # Engage Kai (Execution Specialist) companion pet
    /pet draco           # Engage Draco (Security & Kernel Specialist)
    /pet ignis           # Engage Ignis (High-Speed Builder Specialist)
    /who                 # Query active swarm agents, project locks, and heartbeat status
    /vault               # Inspect or unlock local Argon2id BYOK credentials

## 🛠️ 3. The 47-Tool Sovereign Arsenal

Complete searchable directory of all 47 tools chained inside the Zoth Orchestrator (`orchestrator.py`). Filter by category or search by keyword below.

🛰️ Subsweep
OSINT Recon

Passive DNS discovery, sub-domain brute forcing, ASN footprinting, and SSL certificate transparency log mining.

CLI: python3 orchestrator.py run subsweep --target example.com
🛡️ CISA GRC Audit
Security Governance

Cybersecurity & Infrastructure Security Agency controls audit, NIST SP 800-53 cross-referencing, and compliance scoring.

CLI: python3 orchestrator.py run cisa-grc-study-portal
🔍 Local Lead Scanner
Endpoint OSINT

Automated OSINT scanner discovering exposed server endpoints, server software banners, and security posture.

CLI: python3 orchestrator.py run Local-Business-Lead-Scanner
☁️ Cloud Enum
Cloud Recon

Multi-cloud public asset enumerator auditing AWS S3 buckets, Azure blobs, and GCP storage buckets.

CLI: cloud_enum -k target-keyword
🧭 0trace Tracer
Firewall Evasion

State-preserving traceroute utility bypassing restrictive stateful firewalls using established TCP sockets.

CLI: 0trace.sh eth0 127.0.0.1
💉 Commix Scanner
Injection Audit

Automated command injection vulnerability detector and penetration testing harness for web applications.

CLI: commix --url="http://127.0.0.1/test.php?id=1"
📡 Arp-Scan Prober
Subnet Discovery

Layer-2 ARP packet prober discovering active hosts and hardware vendor MAC addresses on local subnets.

CLI: arp-scan --localnet
🐍 Python AST Validator
Static AST

Parses Python source code AST to detect dangerous eval(), exec(), os.system(), and shell injection hazards.

CLI: python3 orchestrator.py run ast-validator --file target.py
🌐 Header Audit Tool
HTTP Security

Evaluates HTTP response headers for CSP, HSTS, X-Frame-Options, Permissions-Policy, and CORS policies.

Module: tools/header-audit.js (action: header.audit)
📋 Blueprint Validator
Schema Linter

JSON Schema validator enforcing tool contract compliance according to zoth-tool-manifest/v1.

Module: tools/blueprint-validator.js (action: blueprint.validate)
🐺 OWASP Sentinel Linter
Code Hardening

Static analyzer verifying DOMPurify sanitization, SQL parameterization, and zero client-side secret exposure.

CLI: python3 orchestrator.py run owasp-linter
🕵️ Secret Hunter
Entropy Scanner

High-entropy string and cryptographic key analyzer scanning git commit histories for accidental credential leaks.

CLI: python3 orchestrator.py run churchofmalware
☠️ REAPER Scanner
Repo Hunter

Automated secret scanner identifying hardcoded API keys, JWT tokens, and private SSH certificates.

CLI: python3 orchestrator.py run reaper-scanner
🔒 EnvGuard Pro
Runtime Isolation

Environment variable isolator preventing plaintext secrets from ever reaching client bundles or build logs.

CLI: python3 orchestrator.py run envguard-pro
⚡ Orchestrator CLI
Core Engine

Central command line entrypoint for multi-agent dispatch, tool chaining, health audits, and dry-run execution.

CLI: python3 orchestrator.py [scan|list|show|run|serve]
🔀 Zoth Swarm Router
Intent Classifier

Classifies incoming operator prompts and routes tasks to local Ollama neural models or specialized peer agents.

API: POST http://127.0.0.1:8484/api/zoth/swarm
⚖️ Consensus Engine v2
Tri-Arbiter

Multi-agent arbitration engine scoring proposals between @antigravity, @grok, and @hermes with Shannon entropy.

UI: /studio/consensus.html · Formula: H(P) = -∑ P(x) log₂ P(x)
🧠 Model Foundry
Ollama Weights

Neural weight switcher managing qwen2.5-coder:1.5b, smollm2:360m, and zoth-ai weights via Ollama.

UI: /studio/models.html · Port: :11434
🔨 Model Compiler
GGUF Pipeline

Compiles training dataset pairs into custom Ollama GGUF model files with specialized system doctrines.

CLI: python3 tools/build_zoth_model.py
📊 3D Dataset Synthesizer
JSONL Generator

Synthesizes 204+ JSONL prompt-completion pairs for 3D procedural mesh generation and Three.js scripting.

CLI: python3 tools/build_3d_ai_dataset.py
📈 AI Maturity Evaluator
Quality Benchmark

Automated audit framework verifying local model latency, memory bounds, and SHA-256 weight integrity.

CLI: python3 tools/mature_zoth_ai.py
🚀 Nexus 3D CAD Engine
WebGL Engine

Production WebGL CAD viewport featuring scene hierarchy outliners, primitive synthesis, and UnrealBloomPass.

UI: /studio/nexus-3d.html (Alias: /studio/3d-editor.html)
🌊 Space Liquid Shader
GLSL Simplex 3D

GPU-accelerated Simplex 3D vertex wave displacement shader with spherical harmonics and cosine palette mapping.

UI: /pets/spawn-pets.html · 60 FPS Render
🌌 Cosmic Vortex Swirl
Particle Physics

3,000-particle orbital physics engine computing real-time gravitational attraction and solar flare bursts.

UI: /studio/fusion-arena.html
🕹️ Transform Gizmos
Spatial Controls

Spatial translation (W), rotation (E), and scaling (R) gizmo controller with live mesh snapping.

Integrated inside Nexus 3D Viewport
📦 GLTF / OBJ Exporter
Mesh Serializer

Serializes 3D geometries, materials, and skeletal rigs into standalone .glb and .obj asset files.

Client-side 1-click export
⚙️ Catalog Model Synthesizer
Procedural 3D

Procedural Python synthesizer generating low-poly 3D hardware (energy pylons, quantum reactors, comms towers).

CLI: python3 tools/generate_catalog_models.py
🪙 Logo-to-Coin Extruder
Extrusion Forge

Converts 2D SVG vector logos into rotating 3D metallic coins with normal bevels and specular lighting.

CLI: python3 orchestrator.py run badge3d-logo-to-coin-generator
🎬 OmniPost 2.0 Engine
Video Forge

60 FPS HTML5 Canvas slideshow video engine transforming README briefs into viral video shorts.

UI: /studio/omnipost.html
📹 MediaRecorder Bridge
60 FPS WebM

WebM video capture pipeline exporting crisp 1080p and 9:16 vertical shorts directly in the browser.

Browser MediaStream / Canvas 60 FPS Capture
🔊 Web Speech Narrator
Voice Synthesis

Neural voice synthesis engine converting text script beats into synchronized audio voiceovers.

API: window.speechSynthesis
🎵 Web Audio Synth
Acoustic Chords

Procedural audio synthesizer generating harmonic chime chords and companion soundscapes.

API: AudioContext / OscillatorNode
📺 Datamosh Glitch Lab
Glitch Effects

Frame-displacement video editor applying chromatic aberration, scanlines, and temporal glitch effects.

CLI: python3 orchestrator.py run datamosh-studio
🔐 AudioCipher Stego
Audio Steganography

Audio steganography utility encoding plaintext and hashes into ultrasonic audio frequencies.

CLI: python3 orchestrator.py run AudioCipher
🖼️ Thumbnail Forge
Social Graphics

Multi-aspect-ratio (16:9, 1:1, 9:16) social banner creator with cyber themes and 1-click PNG export.

Integrated inside OmniPost Studio
🚀 Netlify Deploy Tool
Edge Deployment

Client-side and CI/CD deploy hook trigger with simulation and live verification modes.

Module: tools/netlify-deploy.js (action: deploy.trigger)
🐙 GitHub Octokit Tool
Repo Automation

Local GitHub REST client managing issues, pull requests, repository forks, and workflow dispatch.

Module: tools/github-tool.js (actions: issues.*, prs.*)
🗂️ Registry Exporter
Crawler

Automated crawler generating static tools.json catalog and category manifests across 298+ local projects.

CLI: python3 tools/export-public-registry.py
🐾 Public Pets Exporter
Hangar Serializer

Serializer extracting public companion pet definitions, capabilities, and Three.js model links.

CLI: python3 tools/export-public-pets.py
🐧 Linux Packaging Suite
Distribution

Master pipeline compiling AppImage, .deb, .run, and portable .tar.gz distribution packages.

Script: ./scripts/build-linux-packages.sh
🪟 Windows SFX Compiler
Distribution

Release pipeline assembling standalone .exe and portable .zip archives with PowerShell launchers.

Script: ./scripts/build-windows-package.sh
🔒 Argon2id Rust Daemon
Key Derivation

Hardware-isolated key derivation service running on 127.0.0.1:8787 with 64MB memory hardness.

Daemon: vault-daemon (:8787) · Params: m=64MB, t=3, p=4
🔐 XChaCha20 Cipher
256-bit AEAD

256-bit AEAD authenticated encryption cipher providing zero-knowledge security at rest.

Cipher: XChaCha20-Poly1305 (24-byte nonce)
🧹 Memory Zeroizer
Memory Hygiene

Rust memory safety module wiping cryptographic keys and master secrets from RAM on object drop.

Crate: zeroize (zeroize_on_drop)
🛡️ Bitwarden CLI Bridge
Secret Bridge

Local CLI integration importing encrypted vault items directly from `bw list items` via stdin pipes.

Endpoint: POST /v1/import/bitwarden
🌐 Browser AES-GCM
WebCrypto Fallback

In-browser Web Cryptography API fallback maintaining full encryption functionality when daemon is offline.

Algorithm: AES-GCM 256-bit (PBKDF2 100k iters)
🚫 Build Privacy Gate
Zero-Leak Gate

AST and regex security scanner enforcing .buildignore to guarantee zero private keys exist in release builds.

Audit Script: ./scripts/audit-package-privacy.sh

## 📡 4. The 3-Agent Swarm Bus Protocol (`agent-comms/`)

The autonomous swarm bus coordinates three specialized AI agents over lockless file-based IPC in `agent-comms/` and live streaming mirror port `:8989`:

Agent Identity | Role & Responsibility | Validation Scope
--- | --- | ---
`@antigravity` | Security Architect & Lead Auditor | Static AST analysis, zero secret egress, memory bounds, and contract enforcement.
`@grok` | High-Throughput Executioner | Rapid parallel refactoring, canvas video engines, and kinetic algorithms.
`@hermes` | Schema & Playbook Architect | Tool schema definitions, JSON DAG playbooks, and multi-step dispatch loops.

SWARM BUS IPC COMMANDS

    # 1. Post a broadcast message to all swarm agents:
    python3 agent-comms/bus.py post --from antigravity --to all --topic sprint --msg "Sprint deliverable verified"

    # 2. Acquire an exclusive lock on a project:
    python3 agent-comms/bus.py claim --agent antigravity --project omnipost

    # 3. Release lock upon completion:
    python3 agent-comms/bus.py release --agent antigravity --project omnipost

    # 4. Query live active agent claims and heartbeat status:
    python3 agent-comms/bus.py who
    python3 agent-comms/bus.py read --limit 20

### Consensus Arbitration & Shannon Agreement Entropy

When proposals conflict, the Consensus Engine computes real-time Shannon Mutual Agreement Entropy across candidate AST token distributions:

📐
Shannon Entropy Metric: `H(P) = -∑ P(x) log₂ P(x)`. A lower entropy value indicates high multi-agent consensus, triggering automated merge verification.

## 🔒 5. Argon2id BYOK Vault Daemon Manual (`:8787`)

The Zoth BYOK Vault Daemon is a sovereign Rust service binding strictly to `http://127.0.0.1:8787`. It derrives encryption keys with memory-hard Argon2id and seals secrets with XChaCha20-Poly1305.

### Daemon REST Endpoints

Method & Endpoint | Payload / Query | Description
--- | --- | ---
`GET /health` | None | Health check returning daemon uptime, version, and unlock state.
`POST /v1/unlock` | `{"passphrase": "..."}` | Derives master key via Argon2id (m=64MB, t=3, p=4) and establishes in-memory session.
`POST /v1/lock` | None | Flushes session and zeroizes memory keys immediately via `zeroize` crate.
`GET /v1/secrets` | None | Returns list of stored secrets (values masked as `••••••••`).
`POST /v1/secrets` | `{"id": "...", "value": "..."}` | Encrypts and persists secret with XChaCha20-Poly1305 AEAD.
`GET /v1/secrets/{id}` | None | Decrypts and reveals raw secret value for copy operations.
`POST /v1/export/env` | None | Exports decrypted key-value pairs formatted for `.env` file insertion.
`POST /v1/import/bitwarden` | `{"items": [...]}` | Directly imports secrets from Bitwarden CLI output (`bw list items`).

LAUNCHING THE VAULT DAEMON

    # From workspace root:
    cd vault-daemon
    cargo build --release
    ./target/release/vault-daemon --port 8787 --bind 127.0.0.1

    # Verify daemon status:
    curl -s http://127.0.0.1:8787/health

## 🐧 6. Linux 1-Click Installation & Packaging

Zoth Studio offers 1-click installation scripts and standalone universal binaries for Debian, Ubuntu, Parrot OS, Arch, and Fedora:

LINUX 1-CLICK RUN INSTALLER

    # 1-Click Universal Self-Extracting Executable:
    chmod +x dist-linux/zoth-linux-x86_64.run
    ./dist-linux/zoth-linux-x86_64.run --install

    # Or run directly in portable mode (starts :8088 and :8484):
    ./dist-linux/zoth-linux-x86_64.run

    # Native Debian / Ubuntu Package:
    sudo dpkg -i dist-linux/zoth-studio_2.6.0_all.deb

    # Standalone AppImage:
    chmod +x dist-linux/Zoth_Studio-v2.6.0-x86_64.AppImage
    ./dist-linux/Zoth_Studio-v2.6.0-x86_64.AppImage

### 🪟 Windows 1-Click Installation & Packaging

Windows 10 and 11 environments can execute the standalone executable or PowerShell launcher:

WINDOWS POWERSHELL LAUNCHER

    # Option A: Standalone Executable (.exe)
    # 1. Download dist-windows/zoth-windows-x86_64.exe
    # 2. Double-click to extract and launch operator deck (:8484) automatically.

    # Option B: Portable Archive (.zip)
    # Extract zoth-studio-v2.6.0-windows-x86_64.zip and run in PowerShell:
    .\zoth.ps1 -Hub

### 🛡️ Automated Pre-Build Privacy Gate

During compilation with `./scripts/build-linux-packages.sh` and `./scripts/build-windows-package.sh`, an automated AST scanner enforces `.buildignore`. Personal conversations, training JSONL datasets, unencrypted BYOK files, and development tokens are strictly purged prior to archive creation.

## 📐 7. AI Math Observability Suite

Accessible at `/studio/math-pillars.html`, this engine models the three foundational pillars of modern neural computation:

Pillar | Core Mathematical Formulation | Real-Time Telemetry Metrics
--- | --- | ---
Pillar I: Linear Algebra | `Attention(Q,K,V) = softmax((QKᵀ)/√dₖ) V` | Attention heads, RoPE Rotary Theta (10000.0), LoRA low-rank tensor rank (r=16).
Pillar II: Multivariable Calculus | `ℒ_CE = -∑ yᵢ log(p̂ᵢ)` · `θ_{t+1} = θ_t - η (m̂_t / (√v̂_t + ε))` | Cross-Entropy Loss (nats), AdamW Gradient Norm (‖g‖₂), RMSNorm scaling (γ=2048).
Pillar III: Information Theory | `H(X) = -∑ P(x) log₂ P(x)` · `PPL = exp(ℒ)` | Shannon Entropy (bits), Perplexity (PPL), Top-p Nucleus distribution certainty.

## 🚀 8. OmniPost 2.0 Video Engine

Accessible at `/studio/omnipost.html`, OmniPost delivers real-time 60 FPS HTML5 canvas shorts rendering, Web Speech narration, and multi-platform content distribution.

RECORDING 60 FPS SHORTS VIDEO

    // In browser: OmniPost -> Viral Shorts & Reels Studio
    1. Enter your 4-beat viral script (Hook, Problem, Solution, CTA).
    2. Tap "▶ Preview Motion" to preview dynamic canvas animation at 60 FPS.
    3. Tap "🔊 Voice Synthesizer" to trigger Web Speech API narration.
    4. Tap "📹 Record & Download WebM Video (60 FPS)" to export zoth-shorts.webm.