Platform Architecture, CLI & API Reference

The Exultia daemon (`exultia`, aliased to `xul` on Linux/BSD, and compiled natively as `exultia.exe` on Windows Server) is a host-resident remediation, patch orchestration, and compliance drift enforcement agent for Linux, BSD, POSIX UNIX, and Windows Server (2019/2022/2025) systems. It operates on a strict unidirectional pull architecture: advisory manifests are fetched from upstream Vantage and Argent REST endpoints (or read from a local air-gapped directory), correlated locally against installed packages, Windows KBs, and configuration/Registry states, and applied with pre-image SHA-256 state snapshots.

Unlike observation-only scanners that transmit host package inventories to an external SaaS backend, `exultia` performs all correlation and state tracking locally inside `/var/lib/exultia/state.db` (or `C:\ProgramData\Exultia\state.db` on Windows Server). Routine operations transmit zero hostnames, IP addresses, package trees, or cryptographic inventories. Operators can pre-configure all daemon runtime settings visually in the Account Console (`/account?tab=config`) and download a ready-to-sideload `exultia.conf`.

To prevent unplanned service restarts or host reboots during peak production hours, the daemon separates remediations into two execution tiers (configurable via the `Remediation Execution Mode` and `Off-Peak Maintenance Window` controls in `/account?tab=config`):

• Tier 1 (Non-Reboot Immediate Mitigations): Includes drop-in service configuration files (e.g., `/etc/ssh/sshd_config.d/`, NGINX/Apache directives), runtime kernel `sysctl` overrides, Windows MSRC Registry virtual patches (`HKLM\SYSTEM\CurrentControlSet\...`), consolidated IP/domain firewall blocklists (Linux `nftables`/`iptables` and Windows Defender Firewall `Exultia-Vantage-Block` rules for IPSum, OpenPhish, and Emerging Threats Compromised Host daily digests), and zero-reboot kernel/OS hotpatches (`CONFIG_LIVEPATCH` / eBPF CO-RE on Linux and Zero-Reboot Hotpatches on Windows Server). Tier 1 mitigations never restart the host.

• Tier 2 (Staged Vendor Package, Windows Update & Database Updates): Invokes the distribution's native package manager (`apt-get --only-upgrade`, `dnf update --security`, `zypper patch --category security`, `apk upgrade`, `pacman -Syu`), the Windows Update Agent COM API (`Microsoft.Update.Session` filtering `RebootRequired=false` vs. deferred maintenance-window cumulative KBs), and supported database engines (`postgresql`, `mysql`, `mariadb`, `mongodb`, `redis`, `valkey`, `mssql`).

When synchronizing with the Vantage Threat Intelligence Feed, the daemon's feed normalizer (`fetch_and_normalize_feed`) automatically detects consolidated daily digest records (`UVI-IPSUM-DAILY-YYYY-MM-DD`, `UVI-OPENPHISH-DAILY-YYYY-MM-DD`, and `UVI-ET-COMPROMISED-DAILY-YYYY-MM-DD`).

Instead of executing thousands of separate shell invocations for individual indicators, the daemon inspects `isGroupedDigest`, `groupedIndicators` (for IPSum C2/scanner IPs and Emerging Threats Compromised Host IPv4/IPv6 blacklists), and `groupedUrls` (for OpenPhish URLs/domains), deduplicates the indicator array in memory, and writes a consolidated blocklist file (`/etc/exultia/ipsum-blocklist.txt`, `/etc/exultia/openphish-domains.txt`, or `/etc/exultia/et-compromised-ips.txt`) with an atomic rollback pre-image. You can toggle daily blocklist enforcement via `Enforce Daily Consolidated IPSum, OpenPhish & Emerging Threats Compromised Host Blocklists` in `/account?tab=config`.

The Exultia daemon is distributed exclusively as a compiled, symbol-stripped native executable with zero Python source code (`.py`), zero `.pyz` zipapp archives, and zero `exultia_cli` `.pyc` bytecode exposed on disk. All core modules (`engine`, `daemon`, `main`, `models`, `livepatch`, `compliance_drift`, `provenance`, `webhook`, `__main__`) are compiled via Cython and GCC (`-O2 -g0`) into stripped native C extensions (`.so` on Linux, `.pyd` on Windows Server via MinGW-w64) with docstrings, code comments, and signatures removed (`strip -s`).

Both the installer (`install.sh`) and the daemon's runtime self-hardening gate enforce strict OS-level permissions so unprivileged local users cannot read, copy, extract, or execute the binary or state database:

The Exultia daemon and Argent/Vantage advisory engines have been tested and validated across the following operating system distributions, immutable/container platforms, and BSD/UNIX environments. Each target maps to its native package or atomic image manager and deterministic rollback handler: