552 lines
19 KiB
Markdown
552 lines
19 KiB
Markdown
# VaultMesh Alchemical Patterns
|
||
|
||
> *Solve et Coagula — Dissolve and Coagulate*
|
||
|
||
## The Alchemical Framework
|
||
|
||
VaultMesh uses alchemical metaphors not as mysticism, but as precise operational language for system states and transformations.
|
||
|
||
## Phases (Operational States)
|
||
|
||
### Nigredo 🜁 — The Blackening
|
||
|
||
**Meaning**: Crisis, breakdown, decomposition
|
||
**Operational State**: System under stress, incident in progress
|
||
|
||
**Indicators**:
|
||
- Active security incident
|
||
- Service degradation
|
||
- Guardian anchor failures
|
||
- Constitutional violations detected
|
||
|
||
**Receipt Types During Nigredo**:
|
||
- `offsec_incident` (severity: high/critical)
|
||
- `obs_log_alert` (severity: critical)
|
||
- `gov_violation`
|
||
- `psi_phase_transition` (to_phase: nigredo)
|
||
|
||
**Actions**:
|
||
- Incident response procedures activated
|
||
- Enhanced monitoring enabled
|
||
- Emergency powers may be invoked
|
||
- Transmutation processes initiated
|
||
|
||
```json
|
||
{
|
||
"type": "psi_phase_transition",
|
||
"from_phase": "albedo",
|
||
"to_phase": "nigredo",
|
||
"trigger": {
|
||
"event_type": "security_incident",
|
||
"reference": "INC-2025-12-001",
|
||
"severity": "critical"
|
||
},
|
||
"indicators": [
|
||
"active_intrusion_detected",
|
||
"guardian_alert_level_elevated"
|
||
]
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
### Albedo 🜄 — The Whitening
|
||
|
||
**Meaning**: Purification, recovery, stabilization
|
||
**Operational State**: Post-incident recovery, learning phase
|
||
|
||
**Indicators**:
|
||
- Incident contained
|
||
- Systems stabilizing
|
||
- Root cause analysis in progress
|
||
- Remediation being verified
|
||
|
||
**Receipt Types During Albedo**:
|
||
- `offsec_remediation`
|
||
- `psi_transmutation` (steps: extract, dissolve, purify)
|
||
- `obs_health_snapshot` (improving trends)
|
||
|
||
**Actions**:
|
||
- Post-incident review
|
||
- IOC extraction
|
||
- Rule generation
|
||
- Documentation updates
|
||
|
||
```json
|
||
{
|
||
"type": "psi_phase_transition",
|
||
"from_phase": "nigredo",
|
||
"to_phase": "albedo",
|
||
"trigger": {
|
||
"event_type": "incident_contained",
|
||
"reference": "INC-2025-12-001"
|
||
},
|
||
"indicators": [
|
||
"threat_neutralized",
|
||
"services_recovering",
|
||
"rca_initiated"
|
||
],
|
||
"duration_in_nigredo_hours": 4.5
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
### Citrinitas 🜆 — The Yellowing
|
||
|
||
**Meaning**: Illumination, new capability emerging
|
||
**Operational State**: Optimization, enhancement
|
||
|
||
**Indicators**:
|
||
- New defensive capabilities deployed
|
||
- Performance improvements measured
|
||
- Knowledge crystallized into procedures
|
||
- Drills showing improved outcomes
|
||
|
||
**Receipt Types During Citrinitas**:
|
||
- `psi_transmutation` (steps: coagulate)
|
||
- `psi_integration`
|
||
- `security_drill_run` (outcomes: improved)
|
||
- `auto_workflow_run` (new capabilities)
|
||
|
||
**Actions**:
|
||
- Deploy new detection rules
|
||
- Update runbooks
|
||
- Train team on new procedures
|
||
- Measure improvement metrics
|
||
|
||
```json
|
||
{
|
||
"type": "psi_phase_transition",
|
||
"from_phase": "albedo",
|
||
"to_phase": "citrinitas",
|
||
"trigger": {
|
||
"event_type": "capability_deployed",
|
||
"reference": "transmute-2025-12-001"
|
||
},
|
||
"indicators": [
|
||
"detection_rules_active",
|
||
"playbook_updated",
|
||
"team_trained"
|
||
],
|
||
"capabilities_gained": [
|
||
"lateral_movement_detection_v2",
|
||
"automated_containment_k8s"
|
||
]
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
### Rubedo 🜂 — The Reddening
|
||
|
||
**Meaning**: Integration, completion, maturity
|
||
**Operational State**: Stable, sovereign operation
|
||
|
||
**Indicators**:
|
||
- All systems nominal
|
||
- Capabilities integrated into BAU
|
||
- Continuous improvement active
|
||
- High resilience demonstrated
|
||
|
||
**Receipt Types During Rubedo**:
|
||
- `psi_resonance` (harmony_score: high)
|
||
- `obs_health_snapshot` (all_green)
|
||
- `mesh_topology_snapshot` (healthy)
|
||
- `treasury_reconciliation` (balanced)
|
||
|
||
**Actions**:
|
||
- Regular drills maintain readiness
|
||
- Proactive threat hunting
|
||
- Continuous compliance monitoring
|
||
- Knowledge sharing with federation
|
||
|
||
```json
|
||
{
|
||
"type": "psi_phase_transition",
|
||
"from_phase": "citrinitas",
|
||
"to_phase": "rubedo",
|
||
"trigger": {
|
||
"event_type": "stability_achieved",
|
||
"reference": "phase-assessment-2025-12"
|
||
},
|
||
"indicators": [
|
||
"30_days_no_critical_incidents",
|
||
"slo_targets_met",
|
||
"drill_outcomes_excellent"
|
||
],
|
||
"maturity_score": 0.92
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Transmutation (Tem Pattern)
|
||
|
||
Transmutation converts negative events into defensive capabilities.
|
||
|
||
### The Process
|
||
|
||
```
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ PRIMA MATERIA │
|
||
│ (Raw Input: Incident/Vuln/Threat) │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
│
|
||
▼
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ STEP 1: EXTRACT │
|
||
│ • Identify IOCs (IPs, domains, hashes, TTPs) │
|
||
│ • Document attack chain │
|
||
│ • Capture forensic artifacts │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
│
|
||
▼
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ STEP 2: DISSOLVE (Solve) │
|
||
│ • Break down into atomic components │
|
||
│ • Normalize to standard formats (STIX, Sigma) │
|
||
│ • Map to frameworks (MITRE ATT&CK) │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
│
|
||
▼
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ STEP 3: PURIFY │
|
||
│ • Remove false positives │
|
||
│ • Validate against known-good │
|
||
│ • Test in isolated environment │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
│
|
||
▼
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ STEP 4: COAGULATE (Coagula) │
|
||
│ • Generate detection rules (Sigma, YARA, Suricata) │
|
||
│ • Create response playbooks │
|
||
│ • Deploy to production │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
│
|
||
▼
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ STEP 5: SEAL │
|
||
│ • Emit transmutation receipt │
|
||
│ • Link prima materia to philosopher's stone │
|
||
│ • Anchor evidence chain │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
│
|
||
▼
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ PHILOSOPHER'S STONE │
|
||
│ (Output: Defensive Capability) │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
### Transmutation Contract
|
||
|
||
```json
|
||
{
|
||
"transmutation_id": "psi-transmute-2025-12-06-001",
|
||
"title": "SSH Brute Force to Detection Capability",
|
||
"initiated_by": "did:vm:human:sovereign",
|
||
"initiated_at": "2025-12-06T10:00:00Z",
|
||
"input_material": {
|
||
"type": "security_incident",
|
||
"reference": "INC-2025-12-001",
|
||
"prima_materia_hash": "blake3:incident_evidence..."
|
||
},
|
||
"target_phase": "citrinitas",
|
||
"transmutation_steps": [
|
||
{
|
||
"step_id": "step-1-extract",
|
||
"name": "Extract Prima Materia",
|
||
"action": "extract_iocs",
|
||
"expected_output": "cases/psi/transmute-001/extracted_iocs.json"
|
||
},
|
||
{
|
||
"step_id": "step-2-dissolve",
|
||
"name": "Dissolve (Solve)",
|
||
"action": "normalize_to_stix",
|
||
"expected_output": "cases/psi/transmute-001/stix_bundle.json"
|
||
},
|
||
{
|
||
"step_id": "step-3-purify",
|
||
"name": "Purify",
|
||
"action": "validate_iocs",
|
||
"expected_output": "cases/psi/transmute-001/validated_iocs.json"
|
||
},
|
||
{
|
||
"step_id": "step-4-coagulate",
|
||
"name": "Coagulate",
|
||
"action": "generate_sigma_rules",
|
||
"expected_output": "cases/psi/transmute-001/sigma_rules/"
|
||
},
|
||
{
|
||
"step_id": "step-5-seal",
|
||
"name": "Seal",
|
||
"action": "emit_receipt",
|
||
"expected_output": "receipts/psi/psi_events.jsonl"
|
||
}
|
||
],
|
||
"witnesses_required": ["brick-01", "brick-02"],
|
||
"success_criteria": {
|
||
"rules_deployed": true,
|
||
"detection_verified": true,
|
||
"no_false_positives_24h": true
|
||
}
|
||
}
|
||
```
|
||
|
||
### Transmutation Receipt
|
||
|
||
```json
|
||
{
|
||
"type": "psi_transmutation",
|
||
"transmutation_id": "psi-transmute-2025-12-06-001",
|
||
"timestamp": "2025-12-06T16:00:00Z",
|
||
"input_material": {
|
||
"type": "security_incident",
|
||
"reference": "INC-2025-12-001",
|
||
"prima_materia_hash": "blake3:abc123..."
|
||
},
|
||
"output_capability": {
|
||
"type": "detection_rules",
|
||
"reference": "sigma-rule-ssh-brute-force-v2",
|
||
"philosophers_stone_hash": "blake3:def456..."
|
||
},
|
||
"transformation_summary": {
|
||
"iocs_extracted": 47,
|
||
"rules_generated": 3,
|
||
"playbooks_updated": 1,
|
||
"ttps_mapped": ["T1110.001", "T1021.004"]
|
||
},
|
||
"alchemical_phase": "citrinitas",
|
||
"witnesses": [
|
||
{
|
||
"node": "did:vm:node:brick-01",
|
||
"witnessed_at": "2025-12-06T15:55:00Z",
|
||
"signature": "z58D..."
|
||
}
|
||
],
|
||
"tags": ["psi", "transmutation", "ssh", "brute-force"],
|
||
"root_hash": "blake3:transmute..."
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Resonance
|
||
|
||
Resonance measures cross-system synchronization and harmony.
|
||
|
||
### Resonance Factors
|
||
|
||
| Factor | Weight | Measurement |
|
||
|--------|--------|-------------|
|
||
| Anchor Health | 0.25 | Time since last anchor, failure rate |
|
||
| Receipt Consistency | 0.20 | Hash chain integrity, no gaps |
|
||
| Mesh Connectivity | 0.20 | Node health, route availability |
|
||
| Phase Alignment | 0.15 | All subsystems in compatible phases |
|
||
| Federation Sync | 0.10 | Witness success rate |
|
||
| Governance Compliance | 0.10 | No active violations |
|
||
|
||
### Harmony Score
|
||
|
||
```
|
||
harmony_score = Σ(factor_weight × factor_score) / Σ(factor_weight)
|
||
```
|
||
|
||
**Interpretation**:
|
||
- 0.90 - 1.00: **Rubedo** — Full sovereignty
|
||
- 0.70 - 0.89: **Citrinitas** — Optimizing
|
||
- 0.50 - 0.69: **Albedo** — Stabilizing
|
||
- 0.00 - 0.49: **Nigredo** — Crisis mode
|
||
|
||
### Resonance Receipt
|
||
|
||
```json
|
||
{
|
||
"type": "psi_resonance",
|
||
"resonance_id": "resonance-2025-12-06-12",
|
||
"timestamp": "2025-12-06T12:00:00Z",
|
||
"harmony_score": 0.94,
|
||
"factors": {
|
||
"anchor_health": 1.0,
|
||
"receipt_consistency": 0.98,
|
||
"mesh_connectivity": 0.95,
|
||
"phase_alignment": 0.90,
|
||
"federation_sync": 0.85,
|
||
"governance_compliance": 1.0
|
||
},
|
||
"current_phase": "rubedo",
|
||
"subsystem_phases": {
|
||
"guardian": "rubedo",
|
||
"oracle": "rubedo",
|
||
"mesh": "citrinitas",
|
||
"treasury": "rubedo"
|
||
},
|
||
"dissonance_notes": [
|
||
"mesh slightly below harmony due to pending node upgrade"
|
||
],
|
||
"tags": ["psi", "resonance", "harmony"],
|
||
"root_hash": "blake3:resonance..."
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Integration
|
||
|
||
Integration crystallizes learnings into permanent capability.
|
||
|
||
### Integration Types
|
||
|
||
| Type | Description | Example |
|
||
|------|-------------|---------|
|
||
| `rule_integration` | Detection rule becomes standard | Sigma rule added to baseline |
|
||
| `playbook_integration` | Response procedure formalized | IR playbook updated |
|
||
| `capability_integration` | New system feature | Auto-containment enabled |
|
||
| `knowledge_integration` | Documentation updated | Threat model revised |
|
||
| `training_integration` | Team skill acquired | Drill proficiency achieved |
|
||
|
||
### Integration Receipt
|
||
|
||
```json
|
||
{
|
||
"type": "psi_integration",
|
||
"integration_id": "integration-2025-12-06-001",
|
||
"timestamp": "2025-12-06T18:00:00Z",
|
||
"integration_type": "rule_integration",
|
||
"source": {
|
||
"transmutation_id": "psi-transmute-2025-12-06-001",
|
||
"capability_hash": "blake3:def456..."
|
||
},
|
||
"target": {
|
||
"system": "detection_pipeline",
|
||
"component": "sigma_rules",
|
||
"version": "v2.1.0"
|
||
},
|
||
"integration_proof": {
|
||
"deployed_at": "2025-12-06T17:30:00Z",
|
||
"verified_by": ["brick-01", "brick-02"],
|
||
"test_results": {
|
||
"true_positives": 5,
|
||
"false_positives": 0,
|
||
"detection_rate": 1.0
|
||
}
|
||
},
|
||
"crystallization_complete": true,
|
||
"tags": ["psi", "integration", "detection"],
|
||
"root_hash": "blake3:integration..."
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Oracle Insights
|
||
|
||
Significant findings from the Compliance Oracle that warrant receipting.
|
||
|
||
### Insight Types
|
||
|
||
| Type | Description |
|
||
|------|-------------|
|
||
| `compliance_gap` | New gap identified |
|
||
| `regulatory_change` | Regulation updated |
|
||
| `risk_elevation` | Risk level increased |
|
||
| `deadline_approaching` | Compliance deadline near |
|
||
| `cross_reference` | Connection between frameworks |
|
||
|
||
### Insight Receipt
|
||
|
||
```json
|
||
{
|
||
"type": "psi_oracle_insight",
|
||
"insight_id": "insight-2025-12-06-001",
|
||
"timestamp": "2025-12-06T14:00:00Z",
|
||
"insight_type": "compliance_gap",
|
||
"severity": "high",
|
||
"frameworks": ["AI_Act", "GDPR"],
|
||
"finding": {
|
||
"summary": "Model training data lineage documentation incomplete for Annex IV requirements",
|
||
"affected_articles": ["AI_Act.Annex_IV.2.b", "GDPR.Art_30"],
|
||
"current_state": "partial_documentation",
|
||
"required_state": "complete_lineage_from_source_to_model"
|
||
},
|
||
"recommended_actions": [
|
||
"Implement data provenance tracking",
|
||
"Document all training data sources",
|
||
"Create lineage visualization"
|
||
],
|
||
"deadline": "2026-08-02T00:00:00Z",
|
||
"confidence": 0.92,
|
||
"oracle_query_ref": "oracle-answer-2025-12-06-4721",
|
||
"tags": ["psi", "oracle", "insight", "ai_act", "gdpr"],
|
||
"root_hash": "blake3:insight..."
|
||
}
|
||
```
|
||
|
||
---
|
||
|
||
## Magnum Opus Dashboard
|
||
|
||
The Magnum Opus is the great work — the continuous refinement toward sovereignty.
|
||
|
||
### Dashboard Metrics
|
||
|
||
```
|
||
┌─────────────────────────────────────────────────────────────────┐
|
||
│ MAGNUM OPUS STATUS │
|
||
├─────────────────────────────────────────────────────────────────┤
|
||
│ │
|
||
│ Current Phase: RUBEDO 🜂 Harmony: 0.94 │
|
||
│ Time in Phase: 47 days │
|
||
│ │
|
||
│ ┌─────────────────────────────────────────────────────────┐ │
|
||
│ │ Phase History (90 days) │ │
|
||
│ │ ████████████░░░░████████████████████████████████████████│ │
|
||
│ │ NNNAAACCCCCNNAACCCCCCCCCCRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR│ │
|
||
│ └─────────────────────────────────────────────────────────┘ │
|
||
│ │
|
||
│ Transmutations Integrations │
|
||
│ ├─ Active: 2 ├─ This Month: 7 │
|
||
│ ├─ Completed: 34 ├─ Total: 156 │
|
||
│ └─ Success Rate: 94% └─ Crystallized: 142 │
|
||
│ │
|
||
│ Resonance Factors │
|
||
│ ├─ Anchor Health: ████████████████████ 1.00 │
|
||
│ ├─ Receipt Integrity: ███████████████████░ 0.98 │
|
||
│ ├─ Mesh Connectivity: ███████████████████░ 0.95 │
|
||
│ ├─ Phase Alignment: ██████████████████░░ 0.90 │
|
||
│ ├─ Federation Sync: █████████████████░░░ 0.85 │
|
||
│ └─ Governance: ████████████████████ 1.00 │
|
||
│ │
|
||
│ Recent Oracle Insights: 3 (1 high severity) │
|
||
│ Next Anchor: 47 min │
|
||
│ Last Incident: 47 days ago │
|
||
│ │
|
||
└─────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
### CLI Commands
|
||
|
||
```bash
|
||
# Phase status
|
||
vm-psi phase current
|
||
vm-psi phase history --days 90
|
||
|
||
# Transmutation
|
||
vm-psi transmute start --input INC-2025-12-001 --title "SSH Brute Force"
|
||
vm-psi transmute status transmute-2025-12-001
|
||
vm-psi transmute complete transmute-2025-12-001 --step coagulate
|
||
|
||
# Resonance
|
||
vm-psi resonance current
|
||
vm-psi resonance history --days 30
|
||
|
||
# Integration
|
||
vm-psi integrate --source transmute-2025-12-001 --target detection_pipeline
|
||
|
||
# Opus
|
||
vm-psi opus status
|
||
vm-psi opus report --format pdf --output opus-report.pdf
|
||
```
|