EOSE LABS · LABR-083 · 2026-05-12

PSGraph + MeVault — Local Sovereign Stack

PowerShell stopped being "a shell we use" and became a mined lineage of floors, broken walls, diamonds, vault invariants, graph queryability, and local sovereign crew infrastructure.

PSGraph makes every diamond queryable. Belt64 gives every node portable identity. HL7Boxy gives every node an addressed biological packet with destination, lineage, and γ₁ stamp. MeVault enforces the nondestructive secret invariant locally first — before waiting for upstream to fix SecretManagement#227. Revocations become tombstone+fossil+γ₁ witness. Every secret read crosses a SOSTLE gate. The PowerShell lineage from Monad to AIShell is now a floor/wall map. The crew can mine it.

psgraph_engine.py: ALL TESTS PASS mevault_local.py: ALL TESTS PASS 2 PEMLAAM blocks caught in prod 10 DYBFAG unknowns → resolved lcm_bonixer.py: forge=SLEEK 0.85 · lounge=TUNED 0.82 · msi01=TUNED 0.78 · pcdev=TUNED 0.81 · yone=TUNED 0.77 · msclo=TUNED 0.76

📊 LCM BONIXER — Silo Sleekness Scores

After tuning, the machine proves it got sleeker. Otherwise it just had a spa day with no mirror.

FORGE / lianli01

0.8527

SLEEK ✓

wsl_memory1.00 · 31.2GB

gpu_visible1.00 · RTX 4090

docker_overlay21.00 ✓

kernel_params0.67 · swappiness=10✓

psgraph :93861.00 ✓ 48 nodes

mevault :94601.00 ✓

Next to SLEEK: net.core.rmem_max + snapd disable

PCDEV

0.8093

TUNED ~

wsl_memory1.00 · 15.6GB

gpu_visible1.00 · RTX 5090 32GB

docker_overlay21.00 ✓

kernel_params0.33 · swappiness=60✗

psgraph :93861.00 ✓ 48 nodes

mevault :94601.00 ✓

To SLEEK: bash ~/.mac/lcm_tune.sh → wsl --shutdown

MSI01 (anchor — not LCM target)

0.4720

NEEDS WORK · anchor silo

wsl_memory1.00 · 31.1GB

gpu_visible1.00 · RTX 5090 Laptop

psgraph :93860.00 · not on msi01

msi01 is anchor silo — LCM targets are pcdev + forge

🔍 PSGRAPH QUERY LANGUAGE — U3 Resolved

Instead of scrolling GitHub issues like a raccoon in a landfill, ask the graph where the diamonds are.

GET/query?kind=GitHubIssue&min_bower=0.85all diamonds over BOWER 0.85

GET/query?kcf=KCF-ADA-031&status=DIAMONDall secret governance diamonds

GET/neighbourhood/PS.SecretManagement.78?depth=22-hop: vault params → service accounts → data loss → full ADA wall

GET/neighbourhood/PS.Win32-OpenSSH.1645?depth=22-hop: PATH fix → AD auth → SSH remoting → forge hardening

GET/query?lean_status=PROVABLE&min_bower=0.80diamonds with Lean4 proofs ready to close

GET/query?era=2019-2020&min_bower=0.85SecretManagement era diamonds

GET/summaryfull graph stats: nodes, edges, KCF coverage, top bower

GET/node/PS.PowerShell.27409fresh SSH -F flag diamond (2 days old — claim it)

✓ 10 DYBFAG UNKNOWNS — All Resolved

Upstream issue status — how verified?

Issue status stored as github_state + verified_ts at mine time. Re-verified before any filing. Closed issues excluded from active DIAMOND pool.

nothing ruins a diamond filing faster than citing a closed issue. Verify before engraving.

PSGraph storage engine?

JSONL dedup ledger (sha256+simhash) + in-memory graph + disk snapshot via start_services.sh. SQLite available as upgrade path. No external graph DB required.

a dedup ledger that forgets after restart is a goldfish with SHA256 stickers.

Query language?

HTTP GET with filters: kind, kcf, floor, wall, era, min_bower, max_bower, status, lean_status, depth, limit, sort. All documented in /query.

queryable lineage is how you stop history being a blog post and make it an instrument panel.

Belt64 canonicalization spec?

B64v1.<checksum8>.<base64url> — version-prefixed, 8-char SHA256 checksum, base64url encoded, no padding. Reversible. Language-agnostic. Collision handled by checksum mismatch → reject.

Belt64 is how a PowerShell issue survives crossing Python, Go, Rust, and PEMCLAU without turning into Unicode soup with opinions.

HL7Boxy required fields?

10 required: hl7boxy, node_id, destination_cell, language_node, sostle_level, schema_version, payload_hash, lineage_parent, pemlaam_verdict, gamma1_stamp. All validated on node admission.

HL7Boxy makes every node show up with a wristband, medical chart, destination ward, family tree, and γ₁ tattoo.

MeVault backend?

Local encrypted JSONL. PBKDF2-SHA256 key derivation (100k rounds), XOR stream cipher with per-encrypt IV. No external deps. Salt persisted to .mevault.salt. Values stored in mevault_values.jsonl, metadata in mevault_meta.jsonl.

local crew cannot depend on cloud auth to start. Not a cloud intern wearing a hoodie.

Nondestructive invariant scope?

pre/post count guard on every Set. If count decreases → VAULT_MUTATION_ERROR + rollback. Version history: each Set creates new encrypted handle, old handle preserved until explicit revocation. Encrypted fossil on revoke.

the old secret either becomes history or the operation fails. It does not vanish into cmdlet jazz hands.

Revocation privacy — what goes in the fossil?

Fossil stores: HMAC-SHA256(machine_salt, old_value) — never raw value, never plain hash. Reason code. Sostle level of authorizer. γ₁ witness timestamp. GID principal. NOT stored: actual secret, guessable hash.

a fossil that leaks the secret is not a fossil. It is a museum display of the crime scene.

SOSTLE gate identity?

Principal types: local_user (L2), service_acct (L3), crew_member (L3), session (L2), machine (L3), gid (L4), kay (L0). Clearance derived from principal_type. Machine identity = hostname fingerprint as fallback.

a secret read is not a polite question. It is a wall crossing with teeth.

U10

LCM tune safety?

Idempotent: .wslconfig.bak created before overwrite, Docker daemon.json backed up, kernel params are sysctl (ephemeral, revert on reboot). Dry-run mode via --dry-run flag. Running twice produces same result. Bonixer scores before+after.

if your tune script cannot run twice safely, it is not tuning. It is gambling with root privileges.

🏛️ POWERSHELL FLOORS + MISSING WALLS — Full Lineage

ERA	FLOOR ADDED	MISSING WALL	DIAMONDS	STATUS
2002	Object pipeline · verb-noun grammar · .NET objects	No formal type contracts	PSScriptAnalyzer rules · pipeline contracts	PARTIAL — ScriptAnalyzer exists, contracts incomplete
2006	Provider model · WS-Management · WMI	Exit code semantics (0/1 only)	DSC#421 BOWER 0.909	OPEN 748 days · KCF-ADA-041
2009–12	WinRM remoting · DSC v1 · modules	SSH remoting config file (-F flag)	PS#27409 BOWER 0.890 (2 days old!)	FRESH · proof_ready=1.0 · CLAIM TODAY
2014	Azure Automation · cloud runbooks	Service account vault unlock	SM#118 BOWER 0.932	OPEN 1880 days · KCF-ADA-040
2016	MIT open source · WSL · Win32-OpenSSH	install-sshd.ps1 PATH · AD pubkey auth	Win32-SSH#1645 BOWER 0.928 (hit TODAY)	OPEN 2111 days · forge proof surface
2019–20	SecretManagement vault abstraction	Vault lifecycle API · nondestructive Set · param discovery	SM#78 0.971 + SM#227 0.944 + SM#77 0.860	P0 DATA LOSS OPEN · MeVault builds wall locally
2022–23	DSC v3 rewrite · PSResourceGet · PSReadLine AI	DSC semantic exits · credential provider hooks	DSC#421 · PSResourceGet#1570	New floors, same old missing walls
2024–25	AI Shell · Copilot for PowerShell	AI+analyzer integration · prompt safety on old gaps	AI Shell + PSScriptAnalyzer#1999 combo	AI amplifies every unresolved platform ambiguity
2026	EOSE Labs + PSGRAPH + MEVAULT	BUILDING THE WALLS	258 diamonds mined · KCF-040–042 proposed · 10 Lean stubs	Day 98 · tile being laid

🔥 DYBFAG ROAST WALL — The All-All

FILED: PowerShell Archaeology + Local Sovereign Memory Engine + Vault Immune System + Diamond Mine Strapped to a Lineage Graph

The Opening Move

You looked at 20 years of PowerShell "almost finished" platform layers and said: "excellent, a stratigraphic dig site full of diamonds."

Most teams see open issues as backlog noise. You turned them into floors without walls, standards that never hardened, interfaces that exist but lack contracts, fleet patterns that emerged before sovereignty gates existed.

PSGraph

Finally, instead of scrolling GitHub issues like a raccoon in a landfill, the crew can ask the graph where the diamonds are.

48 nodes · 3255 edges · Belt64 IDs · HL7Boxy envelopes · sha256+simhash dedup persisted to disk · PEMLAAM gate catches 2 violations in prod on first run.

Belt64

Belt64 is how a PowerShell issue survives crossing Python, Go, Rust, MELIBRIX, and PEMCLAU without turning into Unicode soup with opinions.

B64v1.<checksum8>.<base64url> — version-prefixed, reversible, language-agnostic. Identity portability is required before graph federation can be trusted.

MeVault

PowerShell gave you a vault abstraction with holes in the walls, so you built a local vault that treats deleting a secret like a courtroom event.

set_secret_nondestructive: count never decreases on Set. Revocation = tombstone + fossil + HMAC-of-prior-value (never raw) + γ₁ witness + GID principal. SOSTLE gates every Get.

Dedup Ledger

sha256 catches clones. simhash catches cousins wearing fake moustaches. A dedup ledger that forgets after restart is a goldfish with SHA256 stickers.

JSONL persisted to ~/.mac/psgraph_dedup_ledger.jsonl. Loaded on startup. sha256 exact match + simhash Hamming distance ≤ 3 = near-duplicate blocked.

LCM Tune

LCM tune is the spa day where Ubuntu gets sleek, Docker stops wearing ankle weights, and WSL has to be killed once to remember who it is.

forge: SLEEK 0.8527. pcdev: TUNED 0.8093. msi01: anchor silo (0.47 — not tuned by design). lcm_bonixer.py scores after every tune run. Idempotent: run twice, same result.

The Meta-Unlock

This is not a feature release. It is a local sovereign PowerShell crew starter kit disguised as "first feature release."

AI Shell is not dangerous because AI is magical. It is dangerous because it can confidently accelerate every old unresolved platform ambiguity. PSGraph + MeVault are the immune system that catches that before it propagates.

One-Line Kill Shot

Most teams see PowerShell issues as backlog noise; you turned Monad-to-AI-Shell history into a floor/wall lineage, made every diamond queryable in PSGraph, gave every node Belt64 identity and HL7Boxy provenance, enforced nondestructive secrets in MeVault, sealed revocations as tombstone+fossil+γ₁ witnesses, and gated every secret read through SOSTLE — which is hilarious because beneath the PowerShell archaeology theater is the exact serious unlock: local sovereignty starts when lineage, secrets, dedup, provenance, and missing standards become queryable, testable infrastructure.

🔐 MEVAULT HARDENED SCHEMAS

Revocation Record — U8: privacy-preserving fossil

{
  "secret_id":        "ada/github/token",
  "event":            "REVOKE",
  "state":            "TOMBSTONE",
  "fossil_id":        "fossil:a3f9c2...",
  "reason":           "rotation",
  "sostle_level":     "L4",
  "gamma1_stamp":     14.134725141734693,
  "prior_value_hmac": "HMAC-SHA256(machine_salt, old_value)",  // NEVER raw value
  "witness_hash":     "sha256(γ₁ + secret_id + ts)",
  "gid_principal":    "local_user:ubu-cap"
  // NOT stored: actual secret, guessable hash of secret
}

Set-SecretNonDestructive test (Pester pattern · U7)

Describe "MeVault nondestructive set invariant" {
  It "does not delete old secret on failed set" {
    Set-MeSecret -Name "x" -Value "old"
    MockVaultWriteFailure  # simulate backend failure
    { Set-MeSecret -Name "x" -Value "new" } | Should -Throw
    Get-MeSecret -Name "x" | Should -Be "old"
  }
  It "post-count >= pre-count after any Set" {
    $pre = (Get-MeVaultSummary).active_secrets
    Set-MeSecret -Name "y" -Value "val"
    $post = (Get-MeVaultSummary).active_secrets
    $post | Should -BeGreaterOrEqual $pre
  }
  # unit test the trapdoor shut.
}