The Nexus Operator Application
Twenty-five years of real-time strategy games already trained millions of operators.
We didn't invent a new interaction model. We adopted the one that already works.
Nexus is a Bevy/Rust/ECS native application running on the operator's Windows, MacOS, or Linux machine.
CesiumJS 3D globe | Program-supplied geospatial data | Vestigium (CCE custom Cesium-based globe)
Live fleet telemetry. Hardware-bound, YubiKey-gated, two-factor kill-switch.
- Drag-select to group. Right-click to send. Shift + right-click to queue.
- Ctrl+[1-9] to bind a squad.
- C for formation picker. L for line. W for wedge. C for circle. P for perimeter.
- A gamer is mission-ready in minutes, not weeks.
The talent pool is no longer constrained by who has 80+ hours of classroom time available.
The Crown Jewel: Tamper-Evident Audit Ledger
A chain no one. Including us. Can rewrite.
Every operator command and every node-executed action is written to a SHA-256 hash-chained, SQLite-authoritative, per-node-replicated immutable ledger.
- Block hashes are byte-identical across the Python and Rust implementations.
- CI golden-vector tests turn cross-language drift into a build failure rather than a silent audit-corruption mode.
- Every admitted node holds a full local replica. Verifies the chain independently every 2.5 minutes.
- Loss of the coordinator does not erase authority grants, mission configurations, or safety envelopes. They are on disk at every node.
- A compromised hive cannot silently rewrite history. Divergence is detected on the next verify cycle, by every participant in the swarm.
For an evaluator, the practical consequence is direct: a post-mission forensic pivot on any single ULID correlation ID can reconstruct the full chain. Operator click to kinetic result. Cryptographic certainty.
LLM-Agnostic Inference Substrate
Local vLLM today. Sovereign cloud tomorrow. Classified enclave the day after. No re-integration.
Our reasoning substrate is wire-compatible with both OpenAI and Ollama. Any client written against either standard plugs into Nexus with zero code changes.
- Hot-swap, dual-model, tensor-parallel, and smart-route orchestration modes ship today.
- Currently runs on Nvidia 5090 + 4090 with tensor parallelism enabled by default.
- Supports AWQ, GPTQ, and FP16 weights. LoRA adapters sideload for capability composition.
- Bridge to vLLM, Azure OpenAI, classified-enclave inference, or local Ollama as a configuration change. Not a re-integration.
For OTA / IDIQ procurement, this is a procurement feature: the contracting authority can specify the sovereign inference stack per theater or per classification level. We don't fight that requirement. We make it a config change.
DDIL Resilience
It works when nothing else does
Byzantine-fault-tolerant peer consensus
It works when nothing else does
Military operations transpire in environments where networks fail. Nexus + Hive0s is engineered to keep working when connectivity degrades or disappears.
Four transport tiers
Byzantine-fault-tolerant peer consensus
It works when nothing else does
Bluetooth, WiFi, LoRa, LTE
Automatic dispatcher failover.
The operator never manages radios.
Byzantine-fault-tolerant peer consensus
Byzantine-fault-tolerant peer consensus
Byzantine-fault-tolerant peer consensus
When the coordinator is unreachable; Squads continue executing cached missions and coordinating among themselves indefinitely.
Local AI inference fallback
Identity rotation without service interruption
Byzantine-fault-tolerant peer consensus
on the operator workstation. The desktop reasoning engine keeps serving when the hive is degraded.
Hardware-token authorization
Identity rotation without service interruption
Identity rotation without service interruption
for every kinetic-relevant command. YubiKey today; CAC and PIV adaptable.
Identity rotation without service interruption
Identity rotation without service interruption
Identity rotation without service interruption
The rotation cadence is a deployment-tunable parameter.
Architecture That Scales with You
Three components. One signed transport. End-to-end identity binding.
- Operator intent at one end of the chain. Kinetic action at the other.
- Every hop Lucile-identity-bound and ledger-visible.
- One end-to-end signed transport: secured transport and C2 as a single capability, not as two components sold separately.
- ED25519 identity, HMAC-SHA256 record layer. Long-term identity is an ED25519 keypair plus fingerprint per node and per operator (Lucile L1). The shipped L4 record layer applies a per-peer HMAC-SHA256 secret to every protected request. Headers: `X-Lucile-Fingerprint`, `X-Lucile-Counter`, `X-Lucile-Timestamp`, `X-Lucile-Sig`. Counter and timestamp enforce anti-replay.
- Fleet management built-in: signed self-update with rollback, no separate fleet manager required.
- Identity rotation without service interruption. ED25519 keys rotate on a deployment-tunable cadence with cryptographic transition certificates.
Who We Serve
DoW Program Offices
Blue-UAS-Cleared Frame Primes
Blue-UAS-Cleared Frame Primes
NSTXL OTA, Drone Dominance, IDIQ vehicles, DARPA, DIU, APFIT. Need a software-layer integration counterparty for any Blue-UAS-cleared frame? That's us.
Blue-UAS-Cleared Frame Primes
Blue-UAS-Cleared Frame Primes
Blue-UAS-Cleared Frame Primes
We're open to teaming for OTA and IDIQ submissions. We bring the software layer. You bring the platform. Together: a Nexus-controlled asset under one operator and one immutable audit trail.
Allied Government Auditors
Blue-UAS-Cleared Frame Primes
Allied Government Auditors
Cross-language hash verifiability means an allied-government auditor who only trusts their own reference implementation can still verify the chain, byte-identical to ours.