"Load average 15-18, CPU 89% idle, one PID eating 14 cores for 2 days — that's a ghost. BFAG finds it, names it, kills it. Luffy's crew doesn't negotiate with zombies."
7 WEAPON CLASSES
8 SILOS PATROLLED
ZOMBIE SCORE LIVE
GPU PHANTOM DETECTOR
RADAR GALAXY
γ₁ NTP DRIFT WATCH
7 WEAPON CLASSES · EVERY BUG TYPE IN THE SOVEREIGN FLEET
"Each weapon targets a different ghost. The zombie runs but does nothing. The phantom holds resources after it died. The haunt is the one nobody knows is there."
🧟
ZOMBIE SLAYER
CREW: LUFFY · CPU ZOMBIE
Finds processes: high CPU% x long runtime x zero output. The forge ollama runner was textbook: 1442% CPU, 48h running, 13.3GB RAM, 0 useful inference happening.
FORMULA:zombie_score = (cpu_pct/100) x runtime_h x (rss_gb/ram_total_gb) THRESHOLD:score > 5.0 = kill candidate. forge PID 66452 scored 287.8 = RECORD.
VSZ vs RSS mismatch. Processes holding RAM after the job is done. forge openclaw-gateway: 4.2GB RSS = 13% of 32GB cap. WSL2 .wslconfig memory cap = artificial ghost ceiling.
FORMULA:ghost_score = rss_gb / (ram_total_gb x 0.15) -- alert if any proc > 15% RAM THRESHOLD:score > 1.0 on non-inference process = investigate
ps aux --sort=-%mem | awk 'NR>1 && $4>5 {print $1,$2,$3,$4,$6,$11}' | head -15cat /proc/meminfo | grep -E 'MemAvailable|Dirty|AnonPages|Mapped'# Fix forge: set memory=64GB in C:\\Users\\lianli\\.wslconfig then wsl --shutdown
🖥
GPU PHANTOM
CREW: ZORO · VRAM PHANTOM
VRAM held by dead or idle process. nvidia-smi shows memory used but compute = 0. Three-blade check: VRAM used / process alive / compute running. All three must match.
FORMULA:phantom = VRAM > 2GB AND gpu_util < 1% for > 10min THRESHOLD:Dead PID with VRAM = instant phantom. nvidia-smi cross-ref ps.
FORMULA:haunt_score = dir_gb / (disk_total_gb x 0.05) -- any dir > 5% total = named haunt THRESHOLD:Single dir > 5% disk = haunt. Any drive > 85% = alert.
Load average >> actual work. forge: load 15.73, CPU 89% idle. The wraith = ollama thread dominating the scheduler even while not computing. One thread, all the load.
FORMULA:wraith_score = load_1m / cpu_count -- if > 0.8 AND cpu_idle > 60% = wraith THRESHOLD:forge had 15.73/32 = 0.49 ratio but 89% idle. Thread scheduler wraith confirmed.
Clock drift between silos. When clocks diverge: TLS fails silently, Trendal timestamps invalid, PEMCLAU provenance chains break. Invisible until 3am cert failure.
FORMULA:drift_score = abs(offset_ms) -- > 500ms = warning, > 2000ms = critical THRESHOLD:All silos should be < 50ms from msi01 S1. No chrony = ghost by default.
chronyc tracking | grep -E 'Reference|offset|RMS|Stratum'timedatectl show | grep -E 'NTP|Synchronized'# From msi01: chronyc -h 192.168.2.19 tracking | grep offset
📡
PORT SQUATTER
CREW: USOPP · PORT GHOST
Routes configured but serving nothing. /eose-kcf-helix existed for weeks pointing at missing HTML. forge :9341 = connection refused. Port claimed, process dead.
FORMULA:squatter_score = (routes_non200 / routes_total) x 100 THRESHOLD:> 10% routes non-200 = squatter audit. Missing HTML with live route = worst squatter.
for p in 9334 9337 9341 9351 9355 9362 9394 9400 9402 9404; do echo -n ":$p "; curl -s -o /dev/null -w '%{http_code}' --connect-timeout 2 http://localhost:$p/; echo; doness -tlnp | grep LISTEN | awk '{print $4, $6}'# For mefine routes: curl -s -o /dev/null -w '%{http_code}' https://pemos.ca/ROUTE
🎵
LOG ROT GHOST
CREW: BROOK · LOG GHOST
Yohohoho! Oldest logs in the fleet. Container logs without --max-size. systemd journals at capacity. portal-boot.log growing since Apr 29 on forge.
GPU PHANTOM SCAN — Zoro nvidia-smi --query-gpu=name,memory.used,memory.free,utilization.gpu,utilization.memory --format=csv,noheadernvidia-smi --query-compute-apps=pid,used_memory,process_name --format=csv,noheader 2>/dev/null | head -10# Cross-ref: if nvidia-smi shows VRAM used but ps shows PID dead = PHANTOM
nvidia-smi --query-compute-apps=pid --format=csv,noheader | while read pid; do ps -p $pid -o pid,comm > /dev/null 2>&1 || echo "PHANTOM pid=$pid (dead process holding VRAM)"; done
Threshold: VRAM > 2GB held AND gpu_utilization < 1% for > 600s = phantom. Dead PID with VRAM = instant phantom.
4
DISK HAUNT SCAN — Robin df -h | grep -v tmpfs | grep -v snapfuse | awk '$5+0 > 80 {print "ALERT disk_pressure:", $0}'du -h --max-depth=2 ~ 2>/dev/null | sort -hr | head -20find / -xdev -size +500M -type f 2>/dev/null | grep -v '/proc\|/sys\|/snap\|/mnt' | sort -k5 -rn | head -15
Threshold: any drive > 85% = alert. Any single dir > 5% of disk = named haunt. Ollama blobs: check for duplicates.
5
CPU WRAITH SCAN — Sanji uptime | awk '{print "load:", $(NF-2), $(NF-1), $NF}' && nproc && cat /proc/loadavg# Wraith = high load + high idle
top -bn1 | head -5 | grep -E "%Cpu|load"# Find the wraith thread
top -H -bn1 | awk '$9>50 {print "WRAITH_THREAD:", $1, $8, $9"%", $12}' | head -10
Threshold: (load_1m / cpu_count > 0.8) AND (cpu_idle > 60%) = wraith present. Drill to threads: top -H.
6
NTP DRIFT GHOST SCAN — Chopper chronyc tracking 2>/dev/null | grep -E "Reference|offset|RMS|Stratum"timedatectl show 2>/dev/null | grep -E "NTP|Synchronized|TimeUSec"# From msi01: check all silos
for h in 192.168.2.12 192.168.2.19 192.168.2.23 192.168.2.16; do
echo -n "$h offset: "
ssh -o ConnectTimeout=3 ubu-cap@$h 'chronyc tracking 2>/dev/null | grep "System time"' 2>/dev/null || echo "UNREACHABLE"
done
Threshold: offset > 500ms = warning. > 2000ms = critical. No chrony configured = ghost by default.
7
PORT SQUATTER SCAN — Usopp # Check all configured PEMOS ports
for p in 9334 9337 9341 9350 9351 9355 9362 9394 9400 9402 9404 9413 9412; do
code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 http://localhost:$p/ 2>/dev/null)
echo ":$p -> $code"
done# What's actually listening vs what should be
ss -tlnp | grep LISTEN | awk '{print $4}' | sort
Threshold: configured port with 000/connection refused = squatter. 404 with correct service = missing HTML squatter (like /eose-kcf-helix).
PORT SQUATTER — Usoppfor p in 9334 9337 9341 9351 9362 9400 9402; do echo -n ":$p "; curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 http://localhost:$p/; echo; done000 = squatter. 404 with live route = missing HTML squatter.
8
LOG ROT — Brookfind /var/log /home -name "*.log" -size +100M 2>/dev/null | xargs ls -lh 2>/dev/null | sort -k5 -rh | head -10journalctl --disk-usage 2>/dev/nullLog > 500MB = rot. No --max-size on containers = rot candidate.
RADAR GALAXY · FLEET GHOST THREAT MAP · LIVE PULSE
"Every silo is an orbit. The pulse intensity = threat level. Green = clean. Amber = watch. Red = ghost confirmed. The center is gamma1 — the only truly clean anchor."