Every layer added floors. Almost none added standards. The diamonds are where the floors exist but the walls are missing or broken.
Each layer of the lineage now gets a formal standard. This is the SOSTLE of the PowerShell foundation — what every future contribution must satisfy to be sovereign-grade.
Scored on 12 dimensions. fleet_relevance / forgotten / proof_ready shown as bar triples. BOWER ≥ 0.90 = P0 critical.
| BOWER | REPO · ISSUE | TITLE | DIMS | KCF | LEAN THEOREM |
|---|---|---|---|---|---|
| 0.971 | SecretManagement #78 | Vault param discovery API 2,003 days stalled · forgotten: 1.00 | ADA-031ADA-035ADA-036 | vault_parameter_discovery_complete | |
| 0.944 | SecretManagement #227 ⚠ DATA LOSS | Set-Secret deletes unexpectedly 633 days · P0 BUG | ADA-031ADA-032ADA-035 | set_secret_nondestructive | |
| 0.932 | SecretManagement #118 | Service account vault support 1,880 days · all fleet svc accts affected | ADA-031ADA-033ADA-040 | service_account_vault_unlockable | |
| 0.928 | Win32-OpenSSH #1645 🔥 TODAY | install-sshd.ps1 does not add PATH 2,111 days · hit in prod Day 98 | ADA-033ADA-037ADA-038 | sshd_install_idempotent ⟐ Combo B: forge SSH hardening | |
| 0.909 | DSC #421 | Semantic exit codes for PS adapters 748 days · highest Rust ROI | ADA-031ADA-034ADA-041 | dsc_exit_code_semantic_invariant | |
| 0.898 | SecretManagement #93 | Expose PSCmdlet in vault extensions 1,941 days · 18 comments | ADA-031ADA-035 | vault_pscmdlet_exposure_complete ⟐ Combo A: vault lifecycle | |
| 0.890 | PowerShell #27409 ✨ FRESH | SSH remoting -F config file support 2 days old · 0 comments · CLAIM IT | ADA-031ADA-042 | ssh_remoting_config_respected proof_ready=1.0 (highest in mine) | |
| 0.888 | Win32-OpenSSH #2202 | AD auth via public key compatibility 824 days · enterprise fleet pattern | ADA-031ADA-037 | ad_pubkey_auth_idempotent ⟐ Combo B+C: SSH hardening | |
| 0.868 | vscode-powershell #3751 | 'Safe handle has been closed' debugger crash 1,600 days · actuarial 0.82 (most users) | ADA-033 | safehandle_cleanup_idempotent | |
| 0.860 | SecretManagement #77 | Hook into Register-SecretVault 2,003 days · combo A pair | ADA-035ADA-036 | register_vault_hook_idempotent ⟐ Must ship with #78 |
-- sshd_install_idempotent: PATH inclusion invariant -- Diamond: PowerShell/Win32-OpenSSH#1645 · Day 98 -- CATAOMAIN: PowerShell/SSH · KCF: ADA-037, ADA-038 -- Actuarial: 0.73 · Fleet: hit in prod today structure WslState where path_entries : List String sshd_running : Bool portproxy_map : List (Nat × String) def install_sshd (s : WslState) (sshd_path : String) : WslState := { s with path_entries := if sshd_path ∈ s.path_entries then s.path_entries else s.path_entries ++ [sshd_path] sshd_running := true } theorem sshd_install_idempotent (s : WslState) (p : String) : install_sshd (install_sshd s p) p = install_sshd s p := by simp [install_sshd] split_ifs with h -- PATH already present? · rfl · simp [List.mem_append] -- p ∈ path ++ [p] is trivially true sorry -- OPEN: List.mem_append_self · resolves with omega or decide
-- set_secret_nondestructive: vault count must not decrease on Set -- Diamond: PowerShell/SecretManagement#227 · Day 98 -- CATAOMAIN: PowerShell/Secrets · KCF: ADA-031, ADA-035 -- P0 BUG: ADA Vault Azure KV extension affected def Vault := String → Option String def vault_count (keys : Finset String) (v : Vault) : Nat := keys.card -- approximate: count non-None entries def set_secret_safe (v : Vault) (k val : String) : Vault := fun k' => if k' = k then some val else v k' theorem set_secret_nondestructive (v : Vault) (keys : Finset String) (k val : String) (hk : k ∈ keys) : vault_count keys (set_secret_safe v k val) ≥ vault_count keys v := by simp [vault_count] -- Finset.card is unchanged when key already in set sorry -- OPEN: le_refl · trivial once vault_count correctly tracks Option
-- ssh_remoting_config_respected: -F flag must propagate to ssh subprocess -- Diamond: PowerShell/PowerShell#27409 · Day 98 (filed 2 days ago!) -- CATAOMAIN: PowerShell/SSH · KCF: ADA-042 (NEW) -- proof_ready = 1.0 — this is a pure configuration pass-through theorem structure SshRemotingOptions where config_file : Option String -- -F flag identity_key : Option String -- -i flag jump_host : Option String -- -J flag def build_ssh_args (opts : SshRemotingOptions) : List String := (opts.config_file.map (["-F", ·]) |>.getD []) ++ (opts.identity_key.map (["-i", ·]) |>.getD []) theorem ssh_config_file_in_args (opts : SshRemotingOptions) (f : String) (h : opts.config_file = some f) : "-F" ∈ build_ssh_args opts := by simp [build_ssh_args, h] sorry -- OPEN: List.mem_append · trivial