KDE Plasma 6.3 Wayland • Debian 13 Trixie • Kali Rolling • Parrot OS • Debian Linux 6.12 kernel
"As above, so below; as code, so mind."
Specification • Visual Tour • Architecture • Stealth Profiles • Vault Engine • Frontier AI • Tool Arsenal • Installation
| Pillar | Technology | Implementation Details |
|---|---|---|
| Desktop Core | KDE Plasma 6.3 Wayland | Translucent obsidian frosted glass, 24K Celtic Gold insignia, KWin compositor effects, and custom golden cursor trails. |
| System Base | Debian 13 (Trixie) | Surgical tri-repository overlay with Kali Rolling and Parrot OS Security APT pinning for 100% package cohesion. |
| Kernel Stack | Debian Linux 6.12 (stock) | Debian's standard linux-image-amd64 kernel with Intel UHD (i915) + NVIDIA Quadro hybrid graphics DRM auto-switching. |
| Sovereign Vault | Local secrets daemon | Resident daemon on 127.0.0.1:8787 (described as Argon2id + ChaCha20-Poly1305). It ships as a prebuilt binary whose source is not yet in this repo, so these crypto claims cannot be independently audited. |
| Frontier AI Forge | Autonomous Agent Swarm | Google Antigravity CLI, Aider AI, Cursor AI, Grok Bot, Claude Code, Cline, and Ollama offline LLM model runner. |
| Cloud Workstations | Full-Stack Developer Deck | Netlify CLI ops suite, Streamlit Studio ML dashboards, Node.js 20 (Debian), Python 3.13, Rust, Go, Foundry, and Solana. |
| Stealth & Privacy | NullAI Ghostmode | One-touch Tor transparent routing, MAC address spoofing, ephemeral hostname generation, and RAM memory scrubbing. |
| Security Arsenal | 215+ Tools | Pre-configured suites for AD exploitation, web auditing, binary reverse engineering, wireless warfare, and credential extraction. |
| Sovereign Tool Matrix | 59 Tools & 22 Enclave Daemons | 100% interactive workstation coverage in Zoth Studio v2 (28 In-Browser WebGPU/Client + 31 Sovereign Enclaves) on loopback ports :8094–:8120, :9393, :5225, :8787. |
| Live Boot & Install | Calamares 24K Sovereign | Hybrid UEFI & legacy BIOS bootloader with automatic GPT/Btrfs subvolume layout and optional LUKS disk encryption. |
1. Sovereign 24K Celtic Gold Master Desktop
The flagship KDE Plasma 6.3 Wayland experience: 24K Celtic Gold icons, alchemical typography, translucent frosted obsidian taskbar, and responsive desktop shortcuts for the complete sovereign workstation suite.
2. Applications Kickoff Menu (Celtic Gold Suite)
Every application category in the Kickoff menu features high-fidelity, hand-crafted 24K gold insignia. Fully customized with spacious navigation tabs, smooth hover scaling, and clean power/leave action buttons.
3. Zoth Sovereign Vault (zoth-vault)
Secrets manager front-end for a local daemon (designed around Argon2id and ChaCha20-Poly1305; the daemon is a prebuilt binary, see the note above). Features multi-vault management supporting Zoth Sovereign Vault, Bitwarden CLI (bw), KeePassXC, and UNIX Pass (GPG) with memory-only child process injection.
4. Aider AI Coding Agent Workstation (aider)
Dedicated pair programming terminal environment with telemetry, offline Ollama integration (100% private coding without external internet), Architect dual-reasoning mode, and automated git commits.
5. Netlify CLI Serverless & Edge Workstation (zoth-netlify)
Dedicated interactive terminal operations deck for Netlify: site linking, local server emulation (netlify dev), edge functions, environment variable synchronization, and one-command production deployments.
6. Streamlit Studio & ML Dashboard Station (zoth-streamlit)
Isolated Python environment with pre-bundled data science, machine learning, and cyber intelligence dashboards with live local server management on http://localhost:8501.
7. Zoth Tor Privacy Browser (tor-browser)
Pre-bundled standalone Tor Browser located in /opt/tor-browser/ with multi-hop onion routing, automated circuit isolation, and zero third-party tracking.
8. Burp Suite Community Edition & Offensive Security
Preloaded industry-standard web intercepting proxy with custom Celtic Gold icon branding, alongside Caido, Nmap, Wireshark, Metasploit Framework, and Aircrack-ng.
9. ZothOS Cockpit Pro Operations Center (zoth-cockpit)
Premier flagship Electron operations dashboard & curses TUI fallback (--tui, --status, --json) featuring live animated circular dials, 60s rolling waveform sparklines, global cursor tracker sync, real-time network RX/TX throughput, top active process inspector, the full 21-Agent Sovereign Pantheon deck with zero-egress dispatch, daemon supervisor with live loopback log viewer, and instant 5-profile Reality Mode switching.
10. In-House Codex Manual & Documentation (zoth-docs)
Comprehensive offline documentation codex preloaded directly inside the operating system, detailing architectural invariants, tool guides, security best practices, and CLI cheatsheets.
graph TB
subgraph Core ["Sovereign Kernel & System Foundations"]
K[Debian Linux 6.12 Kernel]
D[Debian 13 Trixie Base]
K --> D
D --> APT1[Debian Stable APT]
D --> APT2[Kali Rolling Pinned]
D --> APT3[Parrot Security Pinned]
end
subgraph UI ["Glassmorphic Presentation Layer"]
W[KDE Plasma 6.3 Wayland]
TH[24K Celtic Gold Master Theme]
KO[Refined Kickoff Menu]
HUD[Apex Desktop Telemetry HUD]
W --- TH
W --- KO
W --- HUD
end
subgraph Security ["Cryptographic & Privacy Vaults"]
V[Rust Vault Daemon :8787]
A2[Argon2id Key Derivation]
C20[ChaCha20-Poly1305 Cipher]
GM[NullAI Ghostmode Tor Router]
V --> A2
V --> C20
end
subgraph AI ["Frontier AI & Autonomous Agents"]
AG[Google Antigravity CLI]
AD[Aider Coding Agent]
CR[Cursor AI Editor]
GK[Grok Bot Agent]
OL[Ollama Local Inference]
end
D --> W
D --> V
D --> GM
V -.->|RAM Secret Injection| AI
UI -.->|Direct Launch| AI
ZOTHOS allows instantaneous switching between operational states with zero logout or reboot required:
flowchart TD
A["ZOTHOS Environment Controller (zoth-mode)"] -->|zoth-mode gold| B["1. 🜂 Sovereign Gold (Default Master)"]
A -->|zoth-mode ghost| C["2. 🜁 NullAI Ghostmode (Stealth / Tor)"]
A -->|zoth-mode matrix| D["3. 🜄 Hermetic Matrix (Phosphor Rain)"]
A -->|zoth-mode win11| E["4. 🜃 Incognito Chameleon (Fluent Guise)"]
A -->|zoth-mode toggle| F["Instant Toggle: Gold Default ⇄ Ghostmode Stealth"]
B --> G["24K Solar Gold #FFD700, Master Seal, Sanctum Audio Cue, Direct Clearnet"]
C --> H["Spectral Cyan #00E5FF, Transparent Tor Proxy, MAC Spoofed, RAM Scrubbed"]
D --> I["Emerald Neon #00FF9D, Matrix Rain, JetBrains Mono, Cyber Audio Cue"]
E --> J["Enterprise Blue #0078D4, Windows 11 Decoy Taskbar & PowerShell Cover"]
| Mode / Profile | CLI Command | Audio Cue | Network State | Operational Purpose |
|---|---|---|---|---|
| Sovereign Gold (Default) | zoth-mode gold |
gold-sanctum.wav |
Direct Clearnet | Master sovereign workstation, 24K gold aesthetic, full hardware performance. |
| NullAI Ghostmode (Stealth) | zoth-mode ghost |
ghost-vapor.wav |
Transparent Tor Proxy | Full anti-surveillance cloak, MAC address randomization, ephemeral hostname, RAM cache wipe. |
| Hermetic Matrix | zoth-mode matrix |
matrix-chirp.wav |
Direct Clearnet | Emerald phosphor monospace terminal environment for low-latency coding and audits. |
| Incognito Chameleon | zoth-mode win11 |
win11-fluent.wav |
Direct Clearnet | Windows 11 Fluent decoy desktop for physical OPSEC in hostile corporate environments. |
| Instant Toggle | zoth-mode toggle |
Contextual | Contextual | Flip back and forth between Default Gold and Ghostmode Stealth with a single keystroke. |
The Zoth Sovereign Vault protects sensitive API keys, SSH credentials, private keys, and blockchain seeds. Decrypted secrets are injected directly into child process memory via RAM, ensuring zero secrets ever touch persistent disk storage.
sequenceDiagram
autonumber
actor Dev as Developer / Agent
participant CLI as zoth-vault CLI
participant Daemon as Rust Daemon (:8787)
participant Disk as Encrypted Vault File
participant Proc as Target Process (e.g. Aider / Cursor)
Dev->>CLI: zoth-vault run -- aider
CLI->>Daemon: GET /v1/export/env (Bearer Token)
Daemon->>Disk: Read & Decrypt with ChaCha20-Poly1305 Key
Daemon-->>CLI: Decrypted Key-Value Map in RAM
CLI->>Proc: Inject Environment Variables into Child Process Memory
Note over Disk,Proc: Keys never touch disk in decrypted state!
Proc->>Dev: Interactive Process Runs with Valid API Keys
# Check daemon health, status, and unlock state
zoth-vault status
# Store a secret key under encrypted storage
zoth-vault set OPENAI_API_KEY "sk-..." --provider openai --tags "ai,prod"
# List all stored secrets (masked by default)
zoth-vault list
# Reveal a single secret with auto-scrubbing terminal buffer
zoth-vault get OPENAI_API_KEY
# Zero-disk secret execution (injects keys directly into process RAM)
zoth-vault run -- aider
# Multi-Vault Switcher (Zoth Vault, Bitwarden, KeePassXC, UNIX Pass)
zoth-vaultZOTHOS ships with an autonomous AI developer stack configured out-of-the-box:
| Coding Agent / Tool | Launcher Command | Offline Local Support | Key Capabilities |
|---|---|---|---|
| Cursor AI | cursor |
Hybrid (Cloud / Local) | Visual AI code editor with agentic codebase indexing and multi-file editing. |
| Grok Bot | grok-bot |
Hybrid (Cloud / Local) | Autonomous research agent and neural reasoning assistant. |
| Aider AI Coding Agent | aider |
Yes (Local Ollama) | Terminal pair programming, git auto-commit, Architect mode, multi-file edits. |
| Google Antigravity Agent | antigravity / agy |
Yes (Ollama / Local APIs) | Agentic IDE with autonomous subagent spawning, skills, and browser control. |
| Claude Code Agent | claude |
No (Cloud API) | Anthropic agentic coding CLI with full codebase refactoring capabilities. |
| Cline Autonomous Agent | cline |
Yes (Local Ollama / OpenRouter) | Interactive agent with step-by-step task breakdown and MCP tool integration. |
| Nous Hermes Agent | hermes |
Yes (Local Models) | Autonomous agent runner with 70+ built-in developer skills. |
| OpenAI Codex CLI | codex |
No (Cloud API) | Fast terminal code generation and interactive diff patch assistant. |
| Ollama Model Runtime | ollama serve |
100% Offline | Resident local LLM engine running Qwen 2.5 Coder, Llama 3.2, and DeepSeek. |
ZOTHOS Linux 3.1 integrates with Zoth Studio v2 to provide 100% interactive workstation coverage across all 59 ecosystem tools (28 In-Browser WebGPU & Client Workstations + 31 Sovereign Enclave Workstations):
Every backend capability runs as an isolated daemon on localhost loopback (127.0.0.1) with zero telemetry:
| Port | Daemon Service | Technology | Operational Function |
|---|---|---|---|
:8094 |
neuro-memory-daemon |
Python / SQLite | Biological STDP synaptic vector memory & 3D Cosmic Nebula. |
:8095/:8096 |
agent-egress-sentinel |
Python / TLS SNI | Autonomous zero-dependency network proxy & telemetry blocker. |
:8097 |
agent-mock-twin |
Python / JSON-RPC | Deterministic offline API replay twin for subagents. |
:8098/:8099 |
agent-prompt-firewall |
Python / Regex AST | Inline prompt injection defense & PII redactor. |
:8104 |
agent-flight-recorder |
Python / SQLite | Immutable cryptographic black box event traces. |
:8105 |
agent-capsule-jail |
Python / Cgroups | Linux kernel enclave sandbox with RAM/CPU quotas. |
:8106 |
agent-policy-auditor |
Python / Ed25519 | Cryptographic capability leaser & OWASP LLM auditor. |
:8107 |
etsy-pod-forge |
FastMCP / Pillow | Lifestyle mockup compositor & 2026 SEO tag optimizer. |
:8108 |
etsy-connector |
FastMCP / Open API v3 | Fee/margin modeling & syndicated draft product pusher. |
:8109 |
mcp-lens |
FastMCP / Inspector | Real-time Model Context Protocol JSON-RPC 2.0 sniffer. |
:8110/:8111 |
agent-budget-sentinel |
Python / Reverse Proxy | Real-time financial circuit breaker & LLM token spend limiter. |
:8112 |
agent-gods-eye |
Python / Shodan | Planetary OSINT threat radar & industrial asset mapper. |
:8113 |
shopify-connector |
FastMCP / GraphQL | Transpiles Etsy listings to Shopify draft products in ms. |
:8114 |
agent-voice-call |
Python / WebRTC P2P | Full-duplex voice calling cockpit with P2P audio streaming. |
:8115 |
printify-connector |
FastMCP / Open API v1 | 20% Premium margins calculation & apparel routing. |
:8116 |
gelato-connector |
FastMCP / Open API v2 | Localized production routing across 32 countries. |
:8117 |
pod-smart-router |
FastMCP / Python | Landed-cost & speed arbitration between Printify & Gelato. |
:8118 |
digital-asset-forge |
FastMCP / Pillow | Master 300 DPI multi-ratio wall art pack generator (98% margin). |
:8119 |
pod-mockup-forge |
FastMCP / Pillow | Photorealistic mockup studio with Lumen Matrix ink blending. |
:8120 |
pod-margin-sentinel |
FastMCP / Math Engine | Multi-channel break-even solver & 2026 fee simulator. |
:9393 |
zoth-civilization |
Node.js Server | 21-Agent society simulation, citizen tasks, & economic velocity. |
:5225 |
simplex-chat |
SimpleX Peer Bus | Sovereign end-to-end encrypted agent signal mesh. |
:8787 |
zoth-vault-daemon |
Rust / ChaCha20 | Memory-only cryptographic secrets injection engine. |
Recent sovereign hardening cadences have ported key tools (aeo-graph-engine, deepsearch-research-agent, promptmaster-studio, vector-search-engine, subsweep-lead-scanner, omnipost-social-engine, web-security-guard, jwt-inspector-guard, payload-entropy-studio, pwa-manifest-builder, regex-droid-builder, schema-illustrator-studio, polyglot-framework-exporter, audiocipher-stego-engine, cron-rhythm-studio, osint-scout-skill, cyber-turtle-studio, datamosh-glitch-studio, nexus-3d-scene-studio, ufo-sacred-geometry) to 100% in-browser client-side execution requiring zero external backend cloud infrastructure.
- Instant Client Utility: AST linting, Web Crypto SHA-384 hashing, L-System generation, and DoH reconnaissance execute 100% in the browser.
- Dual Monetization Funnel: Glassmorphic sales banner ($19 founding lifetime vs $79 regular), dual Stripe + Solana DePay checkout rails, frosted glass output paywall blurs, and 1-click license unlocks (
?licensed=true). - Triple-Viewport Automated Verification: Headless Chrome tests verify 0 console errors and 0px horizontal overflow across mobile (390px), tablet (820px), and desktop (1425px).
- CPU Thermal Ceiling: Maintained strictly < 55.0°C under continuous autonomous builder cadences.
- Whisper-Quiet Operation: Cooling fans locked at 0 RPM during standard workloads via passive heat dissipation.
- Turbo Boost Lock:
no_turbo = 1enforced to prevent thermal throttling and acoustic disruption. - Kokoro Voice Standby: Kokoro TTS (
:9394) kept strictly OFFLINE in Thermal Guard Standby when not actively generating speech.
See the complete 59-tool operational guide in ZOTHOS_TOOLS_CATALOG.md.
certipy/certipy-ad: Active Directory Certificate Services (AD CS) enumeration and abuse tool (ESC1–ESC13).kerbrute: Fast Kerberos pre-auth brute-forcing, user enumeration, and TGT harvesting.coercer: Automatic Windows RPC authentication coercer (MS-RPRN, MS-EFSR, MS-DFSNM).peass(linPEAS&winPEAS): Privilege Escalation Awesome Scripts Suite preloaded in/usr/bin/linpeasand/usr/share/peass/.bloodhound&neo4j: Visual Active Directory domain attack path analysis.impacket-scripts&responder: Complete NTLM relaying, SMB capture, and RPC protocol manipulation.evil-winrm&netexec: Modern Windows remote execution and post-exploitation.
httpx: ProjectDiscovery multi-purpose HTTP probe toolkit (resolutions, ports, TLS, status, technology detection).subfinder: Fast passive subdomain discovery aggregating 40+ OSINT sources.katana: Next-generation crawler and spidering framework with headless browser parsing.gowitness: Automated web screenshotting utility via headless Chromium for rapid visual triage.trufflehog: High-entropy secret and private key scanner with live key verification across repos and filesystems.caido: Modern, fast Rust-based intercepting proxy and web security suite.burpsuite&zaproxy: Industry-standard web vulnerability inspection suites.sqlmap,ffuf,feroxbuster,nikto,commix: High-speed fuzzers and injection audit tools.
- Tor Browser: Official standalone bundle preloaded in
/opt/tor-browser/with multi-hop onion routing. - NullAI Ghostmode (
zoth-ghost): Transparent Tor routing (AnonSurf), MAC address randomization, and memory scrubbing. keepassxc: Secure offline password and credential vault with YubiKey / hardware key support.veracrypt: Plausibly deniable multi-platform disk and file container encryption with hidden volumes.onionshare: Anonymous peer-to-peer file sharing, private chat, and ephemeral site hosting over Tor.age: Modern, simple file encryption tool with UNIX philosophy.bleachbit: Deep system cache, memory, and browser artifact scrubber.zoth-netkill: Instant emergency hardware network killswitch.
ZOTHOS is delivered as a bootable hybrid ISO compatible with UEFI and legacy BIOS systems.
Flash the ISO to a USB flash drive (minimum 16 GB recommended):
sudo dd if=zothos-3.1-amd64.iso of=/dev/sdX bs=4M status=progress conv=fsync- Username:
neo - Password:
zoth - Root Password:
zoth - Sudo: Full passwordless privileges for user
neo
Launch the 24K Gold Calamares graphical installer from the desktop icon or terminal:
launch-calamaresFeatures automated GPT partition initialization, dedicated 1GB FAT32 EFI System Partition (/boot/efi), Btrfs/ext4 root layout, optional full-disk LUKS encryption, and native UEFI NVRAM registration.
| Shortcut / Command | Context | Action |
|---|---|---|
Ctrl + Alt + T |
Global Desktop | Open Zoth Konsole terminal |
Super |
Global Desktop | Open Applications Kickoff menu |
Alt + F2 |
Global Desktop | KRunner universal command prompt |
Super + D |
Global Desktop | Minimize / show desktop |
Super + L |
Global Desktop | QuickLock screen session lock |
zoth-mode toggle |
Terminal | Instant toggle between Sovereign Gold & Ghostmode Stealth |
zoth-vault |
Terminal | Sovereign Vault interactive manager |
zoth-cockpit |
Terminal | Full-screen curses operations dashboard |
zoth-fastfetch |
Terminal | Display alchemical system banner and telemetry |
zoth-netlify |
Terminal | Netlify CLI serverless operations workstation |
zoth-streamlit |
Terminal | Streamlit Studio data & ML application runner |
aider |
Terminal | Aider AI coding agent workstation |
cursor |
Terminal / GUI | Cursor AI Code Editor |
grok-bot |
Terminal / GUI | Grok Bot Autonomous Desktop Agent |
tor-browser |
Terminal / GUI | Launch pre-bundled Tor Privacy Browser |
zoth-docs |
Terminal / GUI | Open in-house ZothOS Codex Manual |
ZOTHOS is built using a customized Debian Live Build framework with surgical repository overlay:
config/includes.chroot/: In-tree root filesystem overlay for custom binaries, icon themes, Plasma configs, and systemd units.config/package-lists/: Layered package configurations across desktop, opsec, offensive security, and AI stacks.build/pack-iso.sh: High-density XZ SquashFS compressor and xorriso ISO packager.
What is in place today, and what is not:
| Item | Status |
|---|---|
| Release checksums | ✅ SHA-256 published for every release. Detects corruption, not tampering. |
| Release signatures | ⏳ release-sign.yml signs SHA256SUMS with Sigstore cosign (keyless, GitHub OIDC) plus SLSA provenance from the next release on. v3.1.0 and earlier are unsigned. See docs/VERIFYING.md. |
| Reproducible builds | ⏳ In progress: SOURCE_DATE_EPOCH, deterministic squashfs, optional snapshot.debian.org pin. Not bit-for-bit reproducible yet. See REPRODUCIBLE_BUILDS.md. |
| OpenSSF Scorecard | ✅ Workflow runs and publishes results (score was 1.0/10 at the Oct 2026 audit; fixes since then should raise it). |
| Static analysis | ✅ CodeQL (JS/TS, Python, Actions) and Semgrep on every push. |
| SBOM | ✅ SPDX + CycloneDX of the source tree on every push and release (sbom.yml). |
| OpenSSF Best Practices badge | ❌ Not registered yet. |
| VirusTotal | ❌ Not submitted (files are too large for VirusTotal). |
| Third-party audit | An automated third-party audit (Scorecard, CodeQL, Semgrep, secret scanning, SBOM/vuln scans) was run in Oct 2026; its P0 findings are fixed in main. Not a human pentest. |
Known live-image defaults you should understand before using ZOTHOS on a real network
(fixed passwords reset at boot, passwordless sudo) are documented in SECURITY.md.
# Verify a signed release (next release onward)
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/NullAITech/zoth-os/\.github/workflows/release-sign\.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS- ZOTHOS Linux: MIT — see LICENSE. Upstream components keep their own licenses.
- Core Engine & Architecture: Engineered by NullAI Tech (nullai.tech).
- Upstream Foundations: Debian GNU/Linux, KDE Plasma, Kali Linux, and Parrot Security OS.











