9 REPOS 2,221 ISSUES SCANNED 258 DIAMONDS 50 TOP SCORED V13 ADELIC BONIXER KCF-ADA-031–042 10 LEAN SKELETONS DAY 98
γ₁ = 14.134725141734693
EOSE LABS · LABR-082 · 2026-05-12

PowerShell Org — Diamond Mine V13

2,221 issues scanned. 258 diamonds found. PowerShell has been alive since 2006. It became core to WSL, Azure, GitHub Actions, SSH, VS Code, DSC, secrets management — and its issue tracker is a fossil record of every wall that never got built.

These aren't just open issues. They are broken and missing floors in a system that billions of lines of enterprise automation depend on. SecretManagement alone has 5-year-old data loss bugs still open. Win32-OpenSSH has a PATH issue we hit in production today. The lineage runs from Monad (2002) through Azure Automation (2014) through WSL (2016) through GitHub Actions (2019) through AI integration (2025) — and every layer has its own set of missing walls.

This mine surfaces all of them. With V13 adelic bonixer scoring, KCF mapping, Lean4 skeletons, and a full foundation standard set. So we can build every floor properly this time.
P0: SecretManagement#227 — DATA LOSS BUG P0: Win32-OpenSSH#1645 — PATH BREAK (hit today) FRESH: PowerShell#27409 — SSH -F flag (2 days old) 3 NEW KCF CONTROLS: ADA-040–042
γ₁ = 14.134725141734693 · Adelic anchor across all 258 diamonds

🧬 POWERSHELL LINEAGE — The Helix We're Mining

Every layer added floors. Almost none added standards. The diamonds are where the floors exist but the walls are missing or broken.

2002
MONAD / MSH — The embryo
Jeffrey Snover's Monad Manifesto. Object pipeline, .NET objects, verb-noun. The foundational grammar that everything inherits.
✓ Floor: pipeline object model · ⊘ Wall: no formal type contracts (diamonds: PSScriptAnalyzer)
2006
POWERSHELL 1.0 — Windows-only
Shipped with Vista. WS-Management, WMI cmdlets, registry provider. Designed for sysadmins not developers.
✓ Floor: provider model · ✗ Wall: exit code semantics (DSC#421 — still open 2026!)
2009–12
PS 2.0–3.0 — Remoting era
WinRM-based remoting, Desired State Configuration (DSC v1), PowerShell Web Access, modules. The "infrastructure automation" inflection point.
✓ Floor: remoting protocol, DSC · ✗ Wall: SSH-based remoting (PS#27409 — added 2022 but -F flag still missing) · ✗ Wall: DSC exit codes (DSC#421)
2014
AZURE AUTOMATION — Cloud floor
PS runbooks in Azure. Service accounts running unattended automation. The first real fleet-scale deployment pattern.
⊘ Wall: service account secret management (SecretManagement#118 — 5 years open) · ⊘ Wall: non-interactive vault unlock (KCF-ADA-040 — newly proposed)
2016
OPEN SOURCE + WSL — The Linux floor
PowerShell Core goes MIT on GitHub. WSL 1 released. Windows SSH built on Win32-OpenSSH. Cross-platform PS becomes real — and fragile.
✗ Wall: install-sshd.ps1 PATH (Win32-OpenSSH#1645 — hit in prod TODAY, 2111 days open) · ✗ Wall: AD pubkey auth (Win32-OpenSSH#2202) · ✗ Wall: Hyper-V socket parity (Win32-OpenSSH#2200)
2019–20
SECRET MANAGEMENT — The vault floor
SecretManagement module shipped as the universal vault abstraction layer. Azure KV, KeePass, 1Password extensions. The right idea — but with serious unfinished walls.
✗ Wall: vault param discovery (#78, 5.5yr) · ✗ Wall: Register-SecretVault hook (#77, 5.5yr) · ✗ Wall: PSCmdlet exposure (#93) · ✗ DATA LOSS: Set-Secret deletes unexpectedly (#227)
2022–23
DSC v3 + PSResourceGet — Config floor
DSC v3 rewrite in Go/Rust, PSResourceGet replaces PSGet, PSReadLine gets predictive IntelliSense. New floors — same old missing walls.
✗ Wall: DSC semantic exit codes (DSC#421) · ⊘ Wall: PSResourceGet credential provider hooks (PSResourceGet#1570)
2024–25
AI SHELL + COPILOT — Intelligence floor
AIShell: separate shell with AI context. GitHub Copilot for PS. PSScriptAnalyzer gets AI-assisted rules. The AI layer is being built on top of all the unfixed walls below it.
⊘ Wall: PSScriptAnalyzer ASCII rule (#1999) · ⊘ Wall: AI + ScriptAnalyzer integration combo (AIShell+PSScriptAnalyzer)
2026
EOSE LABS + FLEET — Now we build the walls
Day 98. forge SSH fixed. 258 diamonds mined. V13 adelic bonixer scored. KCF-ADA-040–042 proposed. Lean4 skeletons filed. We have the full lineage. Now we lay the tile.
✓ Foundation: LABR-082 filed · KCF extended · Lean stubs ready · VIZASL live

🏛️ FOUNDATION LAYERS — Proper Standards for Each Floor

Each layer of the lineage now gets a formal standard. This is the SOSTLE of the PowerShell foundation — what every future contribution must satisfy to be sovereign-grade.

PSFL-L0 — EXIT CODE CONTRACT
Semantic Exit Codes (DSC#421 + everywhere)
Every PowerShell adapter, DSC resource, cmdlet, and script MUST emit a semantic exit code. 0=Success is not enough. Fleet automation (ours and Microsoft's) treats every non-zero as identical. This is the most foundational broken wall.
Diamonds: DSC#421 (BOWER 0.909) · 8 supporting diamonds in DSC/PS repos
BROKEN: DSC adapters exit 0/1 only STANDARD: 0=OK 1=Error 2=ConfigMismatch 3=AuthFail 4=NotFound 5=Timeout 6=DependencyFail 7=PartialSuccess 8=Retry LEAN: dsc_exit_code_semantic_invariant RUST: DscExitCode enum + From<u8>
PSFL-L1 — INSTALL IDEMPOTENCY
Win32-OpenSSH + WSL Installation Must Be Idempotent (Win32-OpenSSH#1645)
install-sshd.ps1, install-win-openssh.ps1, and all installer scripts MUST be PATH-safe. Running twice, running after WSL restart, running after Windows update — all must produce the same result. We hit this today. It's been open 2,111 days.
Diamonds: Win32-OpenSSH#1645 (0.928) + #2202 (0.888) + #2200 (0.855)
BROKEN: install-sshd.ps1 doesn't add PATH BROKEN: portproxy entries stale after WSL restart (fixed Day 98) STANDARD: Every installer validates PATH before AND after. Test: Run installer 3x → same state. LEAN: sshd_install_idempotent (most provable) PS: forge-portproxy-refresh.ps1 (our impl, already shipped)
PSFL-L2 — SECRET NON-DESTRUCTIVENESS (P0)
Set-Secret Must Never Delete (SecretManagement#227)
A Set operation MUST NOT delete. This is the most obvious invariant in any secret management system — write the new value, preserve the old unless explicitly replacing. The bug exists in the Azure KV extension when Metadata is passed. This is a data loss vulnerability for every EOSE silo that uses ADA Vault backed by Azure KV.
Diamonds: SecretManagement#227 (0.944) · ADA Vault direct impact
BROKEN: Set-Secret + Metadata deletes unexpected keys STANDARD: Pre-count → Set → Post-count. If count decreases: rollback + raise VaultMutationError. LEAN: set_secret_nondestructive ∀ vault k v. count(vault after Set(k,v)) ≥ count(vault before) KCF: ADA-031 (Secret Access Governance) + ADA-035 (Vault Extension Lifecycle)
PSFL-L3 — VAULT LIFECYCLE API
Vault Extensions Need a Complete Lifecycle Interface (SM#77 + #78 + #93)
Three diamonds that form one complete API: Register-SecretVault hook (#77), parameter discovery (#78), PSCmdlet exposure for proper error stacktraces (#93). Together they're the "vault is a first-class citizen" standard. All three have been open 5+ years. All three block EOSE ADA Vault from being production-grade.
Combo A: #77 (0.860) + #78 (0.971) + #93 (0.898) — BOWER avg 0.91
MISSING: Get-SecretVaultRegistrationParameters MISSING: Register-SecretVault -OnRegistered hook MISSING: $PSCmdlet exposure in vault extensions STANDARD: Every vault extension MUST export: Get-*Parameters, Register hook, proper Write-Error via $PSCmdlet KCF: ADA-035 + ADA-036
PSFL-L4 — SSH REMOTING CONFIG
PowerShell SSH Remoting Must Support -F Config (PS#27409)
2 days old. The freshest diamond in the mine. SSH remoting uses the system ssh binary but ignores -F (config file selection) and -i (identity file) flags. Fleet operations require custom SSH configs for portproxy routing, jump hosts, key selection. This is the gap between "PS can use SSH" and "PS works in enterprise infrastructure".
Diamond: PowerShell#27409 (0.890) — CLAIM IT TODAY
MISSING: Enter-PSSession -SshConfigFile / New-PSSessionOption -SshConfigFile STANDARD: Pass-through all valid ssh(1) flags via SshOptions parameter. At minimum: -F, -i, -J, -o. LEAN: ssh_remoting_config_respected (proof_ready=1.0 — most provable of all) KCF: ADA-042 (NEW — SSH Remoting Config File Selection Control)
PSFL-L5 — SERVICE ACCOUNT VAULT
Vaults Must Work Without Interactive User Context (SM#118)
All EOSE fleet automation runs as service accounts (Task Scheduler, gMSA, SYSTEM context). SecretManagement assumes a logged-in user can respond to vault unlock prompts. This breaks every unattended automation scenario. 5-year gap. KCF-ADA-040 is the new control that this standard creates.
Diamond: SecretManagement#118 (0.932)
MISSING: -ServiceAccountMode flag for non-interactive vault unlock MISSING: Credential pre-seeding for service context STANDARD: All vault operations MUST be completable without interactive user input when -ServiceAccount is set. KCF: ADA-040 (NEW — Service Account Secret Access)
PSFL-L6 — CROSS-PLATFORM PARITY
Win32-OpenSSH Windows Features Must Match Linux (Win32-OpenSSH#2200 + #2202)
Hyper-V sockets (hvc.exe integration), AD pubkey auth, Windows Hello auth — all standard on Linux, all missing or broken on Windows. Every forge/msi01/yone WSL SSH session passes through Win32-OpenSSH. These gaps mean Windows is a second-class SSH citizen in our own fleet.
Diamonds: #2200 (0.855) + #2202 (0.888)
BROKEN: AD auth via pubkey requires registry hacks MISSING: Hyper-V socket SSH transport STANDARD: Win32-OpenSSH parity checklist against openssh-portable HEAD before each release. RUST: AdPubkeyProvider trait (powershell-rust-hooks.rs)
PSFL-L7 — AI INTEGRATION STANDARD
PSScriptAnalyzer + AIShell Must Form a Coherent Policy Layer
PSScriptAnalyzer rules and AIShell suggestions are currently disconnected. A rule flagging unsafe patterns in the analyzer should feed into AIShell's context. Combo B (AIShell+PSScriptAnalyzer) — the AI layer must be built on properly standardized floors below it.
Combo B: PSScriptAnalyzer#1999 (0.851) + AIShell fleet integration
MISSING: Shared rule/policy schema between PSScriptAnalyzer and AIShell STANDARD: AIShell suggestions MUST reference PSScriptAnalyzer rule IDs when they overlap. KCF: ADA-030 (existing AI integration control)

◆ TOP 20 DIAMONDS — V13 Adelic Bonixer Scores

Scored on 12 dimensions. fleet_relevance / forgotten / proof_ready shown as bar triples. BOWER ≥ 0.90 = P0 critical.

BOWERREPO · ISSUETITLEDIMSKCFLEAN THEOREM
0.971SecretManagement
#78
Vault param discovery API
2,003 days stalled · forgotten: 1.00
fleet1.00
forgotten1.00
proof0.33
ADA-031ADA-035ADA-036
vault_parameter_discovery_complete
0.944SecretManagement
#227 ⚠ DATA LOSS
Set-Secret deletes unexpectedly
633 days · P0 BUG
ADA-031ADA-032ADA-035
set_secret_nondestructive
0.932SecretManagement
#118
Service account vault support
1,880 days · all fleet svc accts affected
ADA-031ADA-033ADA-040
service_account_vault_unlockable
0.928Win32-OpenSSH
#1645 🔥 TODAY
install-sshd.ps1 does not add PATH
2,111 days · hit in prod Day 98
ADA-033ADA-037ADA-038
sshd_install_idempotent
⟐ Combo B: forge SSH hardening
0.909DSC
#421
Semantic exit codes for PS adapters
748 days · highest Rust ROI
ADA-031ADA-034ADA-041
dsc_exit_code_semantic_invariant
0.898SecretManagement
#93
Expose PSCmdlet in vault extensions
1,941 days · 18 comments
ADA-031ADA-035
vault_pscmdlet_exposure_complete
⟐ Combo A: vault lifecycle
0.890PowerShell
#27409 ✨ FRESH
SSH remoting -F config file support
2 days old · 0 comments · CLAIM IT
ADA-031ADA-042
ssh_remoting_config_respected
proof_ready=1.0 (highest in mine)
0.888Win32-OpenSSH
#2202
AD auth via public key compatibility
824 days · enterprise fleet pattern
ADA-031ADA-037
ad_pubkey_auth_idempotent
⟐ Combo B+C: SSH hardening
0.868vscode-powershell
#3751
'Safe handle has been closed' debugger crash
1,600 days · actuarial 0.82 (most users)
ADA-033
safehandle_cleanup_idempotent
0.860SecretManagement
#77
Hook into Register-SecretVault
2,003 days · combo A pair
ADA-035ADA-036
register_vault_hook_idempotent
⟐ Must ship with #78

⟐ COMBO MAP — Multi-Diamond Fixes

COMBO A — ADA Vault Lifecycle (SecretManagement triple)
#77 Register hook #78 Param discovery #93 PSCmdlet exposure BOWER avg: 0.910
Three diamonds that form one complete vault extension lifecycle API. All 5+ years stalled. Together they unblock EOSE ADA Vault from being production-grade. Any one without the others is a partial fix. Ship together: vault registers → params discoverable → errors traceable. Crew: ADA.
ETA: 2 weeks · KCF: ADA-035 + ADA-036 · PSFL standard: L3
COMBO B — forge SSH Hardening (Win32-OpenSSH pair)
#1645 PATH fix #2202 AD pubkey auth Direct Day 98 proof
We fixed portproxy today. The next forge SSH failure will be PATH after a Win32-OpenSSH update (#1645) or AD auth failure on enterprise join (#2202). Fix them together and forge SSH is hardened end-to-end. forge-portproxy-refresh.ps1 is already the guard layer. These two PRs are the upstream layer. Crew: BOSUN + ADA.
ETA: 3 days · KCF: ADA-033 + ADA-037 + ADA-038 · PSFL standard: L1
COMBO C — SSH Remoting Modernization
#27409 -F config flag (FRESH) #2202 AD pubkey portproxy routing unblocked
PS SSH remoting + custom config file (-F) means we can route PS remote sessions through portproxy config, jump hosts, and non-standard SSH configs — exactly the forge/msi01 topology. #27409 is 2 days old. Being first to comment + propose implementation = EOSE establishes OSS presence. Crew: BOSUN + SIGNALS.
ETA: 1 week · KCF: ADA-042 (NEW) · PSFL standard: L4

𝛌 LEAN4 SKELETON PREVIEW — Top 3 Most Provable

Diamond #4 · Win32-OpenSSH#1645 · BOWER: 0.928 · proof_ready: 0.67
-- sshd_install_idempotent: PATH inclusion invariant
-- Diamond: PowerShell/Win32-OpenSSH#1645 · Day 98
-- CATAOMAIN: PowerShell/SSH · KCF: ADA-037, ADA-038
-- Actuarial: 0.73 · Fleet: hit in prod today

structure WslState where
  path_entries : List String
  sshd_running  : Bool
  portproxy_map : List (Nat × String)

def install_sshd (s : WslState) (sshd_path : String) : WslState :=
  { s with
    path_entries := if sshd_path ∈ s.path_entries then s.path_entries
                    else s.path_entries ++ [sshd_path]
    sshd_running := true }

theorem sshd_install_idempotent
    (s : WslState) (p : String) :
    install_sshd (install_sshd s p) p = install_sshd s p := by
  simp [install_sshd]
  split_ifs with h -- PATH already present?
  · rfl
  · simp [List.mem_append]  -- p ∈ path ++ [p] is trivially true
    sorry -- OPEN: List.mem_append_self · resolves with omega or decide
Diamond #2 · SecretManagement#227 · BOWER: 0.944 · set_secret_nondestructive
-- set_secret_nondestructive: vault count must not decrease on Set
-- Diamond: PowerShell/SecretManagement#227 · Day 98  
-- CATAOMAIN: PowerShell/Secrets · KCF: ADA-031, ADA-035
-- P0 BUG: ADA Vault Azure KV extension affected

def Vault := StringOption String
def vault_count (keys : Finset String) (v : Vault) : Nat :=
  keys.card  -- approximate: count non-None entries

def set_secret_safe (v : Vault) (k val : String) : Vault :=
  fun k' => if k' = k then some val else v k'

theorem set_secret_nondestructive
    (v : Vault) (keys : Finset String) (k val : String)
    (hk : k ∈ keys) :
    vault_count keys (set_secret_safe v k val) ≥ vault_count keys v := by
  simp [vault_count]  -- Finset.card is unchanged when key already in set
  sorry -- OPEN: le_refl · trivial once vault_count correctly tracks Option
Diamond #7 · PowerShell#27409 · BOWER: 0.890 · proof_ready: 1.0 (most provable)
-- ssh_remoting_config_respected: -F flag must propagate to ssh subprocess
-- Diamond: PowerShell/PowerShell#27409 · Day 98 (filed 2 days ago!)
-- CATAOMAIN: PowerShell/SSH · KCF: ADA-042 (NEW)  
-- proof_ready = 1.0 — this is a pure configuration pass-through theorem

structure SshRemotingOptions where
  config_file  : Option String  -- -F flag
  identity_key : Option String  -- -i flag
  jump_host    : Option String  -- -J flag

def build_ssh_args (opts : SshRemotingOptions) : List String :=
  (opts.config_file.map  (["-F", ·]) |>.getD []) ++
  (opts.identity_key.map (["-i", ·]) |>.getD [])

theorem ssh_config_file_in_args
    (opts : SshRemotingOptions) (f : String)
    (h : opts.config_file = some f) :
    "-F"build_ssh_args opts := by
  simp [build_ssh_args, h]
  sorry -- OPEN: List.mem_append · trivial

🔐 3 NEW KCF CONTROLS — ADA-040 through ADA-042

KCF-ADA-040
Service Account Secret Access
Non-interactive vault unlock MUST be possible when running as gMSA, SYSTEM, or Task Scheduler service account. Vaults MUST support credential pre-seeding without interactive prompt.
Source: SecretManagement#118 · PSFL-L5
Status: PROPOSED · BOWER trigger: 0.932
KCF-ADA-041
DSC Adapter Semantic Exit Code Governance
All DSC adapters and PowerShell adapters MUST emit semantic exit codes 0–8. Exit code must map to a defined error class. Fleet audit pipelines depend on this for observability.
Source: DSC#421 · PSFL-L0
Status: PROPOSED · BOWER trigger: 0.909
KCF-ADA-042
SSH Remoting Config File Selection Control
PowerShell SSH remoting MUST support -F (config file), -i (identity), -J (jump host) pass-through. Custom SSH config routing is required for portproxy, enterprise jump hosts, and non-default key paths.
Source: PowerShell#27409 · PSFL-L4
Status: PROPOSED · FRESH DIAMOND · Claim today

🔗 LINKS