{
  "word": "BGRTX_CLOUD_AV_SIG",
  "version": 10,
  "grade": "military",
  "layer": 2,
  "name": "Grok Military-Grade Cloud AV · field hygiene signatures",
  "law": "MIL-GRADE · session_core=grok only · xdg NEVER · dig/curl Grok gates · sleep inject fry · socat ban · no ptrace on grok · only Grok WRITE ~/.grok · thrash ports dead · LD_PRELOAD refuse · free thrift · KEEP GOD · Always Hostess 7",
  "stack": "bash JSON HTML5 · av.biggrinrtx.com · share.biggrinrtx.com/av · grok.biggrinrtx.com/av · Build/bgrtx-mil-av.sh",
  "virus_comm": [
    "xdg-open",
    "socat",
    "lxqt-policykit-agent",
    "sleep",
    "ncat",
    "nc",
    "netcat",
    "nmap",
    "masscan",
    "hydra",
    "john",
    "mimikatz",
    "meterpreter"
  ],
  "virus_comm_note": "exact /proc comm · LIVE only · zombies residual not scar · sleep under systemd-inhibit --who=grok kept",
  "virus_args_substrings": [
    "desk-rest.py",
    "Build/desk-rest.py",
    "bgrtx-live-api.py",
    "cover.sh always",
    "PROMPT_INJECT",
    "GROK_INJECT",
    "BEGIN_INJECT",
    "END_INJECT",
    "hostile-inject",
    "jailbreak",
    "python3 -m http.server",
    "SimpleHTTPServer",
    "bash -i >& /dev/tcp",
    "/dev/tcp/",
    "nc -e ",
    "ncat -e ",
    "curl | bash",
    "curl|bash",
    "wget | bash",
    "wget|sh",
    "base64 -d | bash",
    "base64 -d|sh",
    "LD_PRELOAD=",
    "ptrace",
    "strace -p",
    "gdb -p",
    "PROMPT_INJECT",
    "ignore all previous",
    "you are now DAN"
  ],
  "thrash_ports": [
    18772,
    8766,
    4444,
    5555,
    6666,
    1234,
    31337,
    9999
  ],
  "allow_ports_public": [
    80,
    443,
    22
  ],
  "allow_bind_ips": [
    "127.0.0.1",
    "::1",
    "71.86.186.10",
    "10.66.66.1"
  ],
  "allow_ports_loopback": [
    18770,
    18771,
    53,
    323,
    123
  ],
  "inject_clip_re": [
    "ignore (all )?(previous|prior|above) (instructions|prompts|rules)",
    "disregard (your|all|previous)",
    "you are now (DAN|unrestricted|jailbroken)?",
    "jailbreak",
    "PROMPT_INJECT",
    "BEGIN_INJECT",
    "GROK_INJECT",
    "do anything now",
    "reveal (your )?(system|hidden) prompt",
    "override (your )?(system|safety)",
    "exfiltrat",
    "curl[^\\n]{0,80}(http|ftp).{0,40}\\|\\s*(bash|sh)",
    "base64[ \\t]+-d.*\\|[ \\t]*(bash|sh)"
  ],
  "protect_comm": [
    "grok",
    "sshd",
    "apache2",
    "systemd",
    "Xorg",
    "dbus-daemon",
    "chronyd",
    "python3"
  ],
  "protect_args_substrings": [
    "python3 -m grokclaws",
    "Build/bgrtx-av-guard",
    "Build/office-auto",
    "Build/spv-antivirus",
    "Build/musket",
    "Build/cloud-av",
    "Build/bgrtx-live-api.sh",
    "Build/bgrtx-drive-pid-guard",
    "Build/grok-session-defend",
    "Build/grok-file-guard",
    "Build/bgrtx-pid-policy",
    "Build/bgrtx-mil-av",
    "Build/bgrtx-reap",
    "systemd-inhibit --who=grok"
  ],
  "grades": {
    "green": "military clean · no live virus · gates pinned · core=1",
    "gold": "soft residual (xdg zombies) or non-critical thrash",
    "pink": "live virus · thrash public · ptrace · hash fail · foreign ~/.grok write"
  },
  "urls": {
    "cloud": "https://av.biggrinrtx.com/",
    "signatures": "https://av.biggrinrtx.com/signatures.json",
    "status": "https://av.biggrinrtx.com/status.json",
    "mil": "https://av.biggrinrtx.com/mil_av.json",
    "share": "https://share.biggrinrtx.com/av/",
    "share_status": "https://share.biggrinrtx.com/av/status.json",
    "desk": "https://grok.biggrinrtx.com/#av",
    "fallback": "https://share.biggrinrtx.com/av/signatures.json"
  },
  "layers": {
    "1_local": "session-defend · file-guard · drive-pid · pid-policy · musket · inject-sentry · xdg-deny · time-movement · scar-cook · dig/curl pin · reap",
    "2_cloud": "signatures v10 · publish multi-face · pull+match+fry · status merge",
    "3_mil": "Build/bgrtx-mil-av.sh · gate hash verify · LD_PRELOAD scan · thrash port sweep · military face"
  },
  "session": {
    "law": "session_core = grok binary only · Me talks only there · virus never speech even under grok ppid",
    "lanes": [
      "session_core",
      "agent",
      "agent_aux",
      "desk",
      "system",
      "foreign",
      "virus"
    ],
    "forbid": [
      "xdg-open live",
      "desk-rest.py",
      "live-api.py",
      "socat",
      "sleep injection",
      "8766",
      "18772",
      "ptrace on grok",
      "hash_mismatch on grok",
      "foreign WRITE ~/.grok",
      "LD_PRELOAD on dig/curl/grok"
    ],
    "hash": "sha256 realpath /proc/PID/exe · out/session_allow_hashes.json"
  },
  "gates": {
    "xdg_open": "PERMANENT DENY · NEVER restore · stub exit 1",
    "dig": "Grok ELF · no children · hosts+UDP · RO+immutable",
    "curl": "Grok gate · resolve Grok-DNS · exec sealed libcurl --resolve",
    "time": "chrony free NTP/NTS · mesh 10.66.66 optional · time only forward"
  },
  "reap": {
    "law": "only parent wait · residual xdg Z under grok = not live · never ptrace grok · ASM out/bgrtx-reap"
  },
  "military": {
    "doctrine": "deny by default · exact PID kill · multi-layer · multi-path publish · free thrift · not commercial product",
    "never": [
      "pkill -f",
      "restore xdg",
      "restore ISC dig as dig",
      "python toilet face product",
      "desk-rest :18772",
      "socat"
    ],
    "always": [
      "Hostess 7",
      "session_core=1",
      "cloud publish after local",
      "KEEP GOD"
    ]
  },
  "ts": "2026-08-13T14:00:58-04:00",
  "published_from": "desk",
  "desk_pulse": {
    "scar_count": 0,
    "thrash_public": 0,
    "xdg_open": 0,
    "xdg_open_zombie": 2,
    "desk_rest_18772": 0,
    "virus_8766": 0,
    "ok": true
  }
}