vm-core/docs/skill/ALCHEMICAL_PATTERNS.md

VaultMesh Alchemical Patterns

Solve et Coagula — Dissolve and Coagulate

The Alchemical Framework

VaultMesh uses alchemical metaphors not as mysticism, but as precise operational language for system states and transformations.

Phases (Operational States)

Nigredo 🜁 — The Blackening

Meaning: Crisis, breakdown, decomposition Operational State: System under stress, incident in progress

Indicators:

• Active security incident
• Service degradation
• Guardian anchor failures
• Constitutional violations detected

Receipt Types During Nigredo:

• offsec_incident (severity: high/critical)
• obs_log_alert (severity: critical)
• gov_violation
• psi_phase_transition (to_phase: nigredo)

Actions:

• Incident response procedures activated
• Enhanced monitoring enabled
• Emergency powers may be invoked
• Transmutation processes initiated

{
  "type": "psi_phase_transition",
  "from_phase": "albedo",
  "to_phase": "nigredo",
  "trigger": {
    "event_type": "security_incident",
    "reference": "INC-2025-12-001",
    "severity": "critical"
  },
  "indicators": [
    "active_intrusion_detected",
    "guardian_alert_level_elevated"
  ]
}

---

Albedo 🜄 — The Whitening

Meaning: Purification, recovery, stabilization Operational State: Post-incident recovery, learning phase

Indicators:

• Incident contained
• Systems stabilizing
• Root cause analysis in progress
• Remediation being verified

Receipt Types During Albedo:

• offsec_remediation
• psi_transmutation (steps: extract, dissolve, purify)
• obs_health_snapshot (improving trends)

Actions:

• Post-incident review
• IOC extraction
• Rule generation
• Documentation updates

{
  "type": "psi_phase_transition",
  "from_phase": "nigredo",
  "to_phase": "albedo",
  "trigger": {
    "event_type": "incident_contained",
    "reference": "INC-2025-12-001"
  },
  "indicators": [
    "threat_neutralized",
    "services_recovering",
    "rca_initiated"
  ],
  "duration_in_nigredo_hours": 4.5
}

---

Citrinitas 🜆 — The Yellowing

Meaning: Illumination, new capability emerging Operational State: Optimization, enhancement

Indicators:

• New defensive capabilities deployed
• Performance improvements measured
• Knowledge crystallized into procedures
• Drills showing improved outcomes

Receipt Types During Citrinitas:

• psi_transmutation (steps: coagulate)
• psi_integration
• security_drill_run (outcomes: improved)
• auto_workflow_run (new capabilities)

Actions:

• Deploy new detection rules
• Update runbooks
• Train team on new procedures
• Measure improvement metrics

{
  "type": "psi_phase_transition",
  "from_phase": "albedo",
  "to_phase": "citrinitas",
  "trigger": {
    "event_type": "capability_deployed",
    "reference": "transmute-2025-12-001"
  },
  "indicators": [
    "detection_rules_active",
    "playbook_updated",
    "team_trained"
  ],
  "capabilities_gained": [
    "lateral_movement_detection_v2",
    "automated_containment_k8s"
  ]
}

---

Rubedo 🜂 — The Reddening

Meaning: Integration, completion, maturity Operational State: Stable, sovereign operation

Indicators:

• All systems nominal
• Capabilities integrated into BAU
• Continuous improvement active
• High resilience demonstrated

Receipt Types During Rubedo:

• psi_resonance (harmony_score: high)
• obs_health_snapshot (all_green)
• mesh_topology_snapshot (healthy)
• treasury_reconciliation (balanced)

Actions:

• Regular drills maintain readiness
• Proactive threat hunting
• Continuous compliance monitoring
• Knowledge sharing with federation

{
  "type": "psi_phase_transition",
  "from_phase": "citrinitas",
  "to_phase": "rubedo",
  "trigger": {
    "event_type": "stability_achieved",
    "reference": "phase-assessment-2025-12"
  },
  "indicators": [
    "30_days_no_critical_incidents",
    "slo_targets_met",
    "drill_outcomes_excellent"
  ],
  "maturity_score": 0.92
}

---

Transmutation (Tem Pattern)

Transmutation converts negative events into defensive capabilities.

The Process

┌─────────────────────────────────────────────────────────────────┐
│                      PRIMA MATERIA                              │
│                (Raw Input: Incident/Vuln/Threat)                │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  STEP 1: EXTRACT                                                │
│  • Identify IOCs (IPs, domains, hashes, TTPs)                   │
│  • Document attack chain                                        │
│  • Capture forensic artifacts                                   │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  STEP 2: DISSOLVE (Solve)                                       │
│  • Break down into atomic components                            │
│  • Normalize to standard formats (STIX, Sigma)                  │
│  • Map to frameworks (MITRE ATT&CK)                             │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  STEP 3: PURIFY                                                 │
│  • Remove false positives                                       │
│  • Validate against known-good                                  │
│  • Test in isolated environment                                 │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  STEP 4: COAGULATE (Coagula)                                    │
│  • Generate detection rules (Sigma, YARA, Suricata)             │
│  • Create response playbooks                                    │
│  • Deploy to production                                         │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  STEP 5: SEAL                                                   │
│  • Emit transmutation receipt                                   │
│  • Link prima materia to philosopher's stone                    │
│  • Anchor evidence chain                                        │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│                    PHILOSOPHER'S STONE                          │
│              (Output: Defensive Capability)                     │
└─────────────────────────────────────────────────────────────────┘

Transmutation Contract

{
  "transmutation_id": "psi-transmute-2025-12-06-001",
  "title": "SSH Brute Force to Detection Capability",
  "initiated_by": "did:vm:human:sovereign",
  "initiated_at": "2025-12-06T10:00:00Z",
  "input_material": {
    "type": "security_incident",
    "reference": "INC-2025-12-001",
    "prima_materia_hash": "blake3:incident_evidence..."
  },
  "target_phase": "citrinitas",
  "transmutation_steps": [
    {
      "step_id": "step-1-extract",
      "name": "Extract Prima Materia",
      "action": "extract_iocs",
      "expected_output": "cases/psi/transmute-001/extracted_iocs.json"
    },
    {
      "step_id": "step-2-dissolve",
      "name": "Dissolve (Solve)",
      "action": "normalize_to_stix",
      "expected_output": "cases/psi/transmute-001/stix_bundle.json"
    },
    {
      "step_id": "step-3-purify",
      "name": "Purify",
      "action": "validate_iocs",
      "expected_output": "cases/psi/transmute-001/validated_iocs.json"
    },
    {
      "step_id": "step-4-coagulate",
      "name": "Coagulate",
      "action": "generate_sigma_rules",
      "expected_output": "cases/psi/transmute-001/sigma_rules/"
    },
    {
      "step_id": "step-5-seal",
      "name": "Seal",
      "action": "emit_receipt",
      "expected_output": "receipts/psi/psi_events.jsonl"
    }
  ],
  "witnesses_required": ["brick-01", "brick-02"],
  "success_criteria": {
    "rules_deployed": true,
    "detection_verified": true,
    "no_false_positives_24h": true
  }
}

Transmutation Receipt

{
  "type": "psi_transmutation",
  "transmutation_id": "psi-transmute-2025-12-06-001",
  "timestamp": "2025-12-06T16:00:00Z",
  "input_material": {
    "type": "security_incident",
    "reference": "INC-2025-12-001",
    "prima_materia_hash": "blake3:abc123..."
  },
  "output_capability": {
    "type": "detection_rules",
    "reference": "sigma-rule-ssh-brute-force-v2",
    "philosophers_stone_hash": "blake3:def456..."
  },
  "transformation_summary": {
    "iocs_extracted": 47,
    "rules_generated": 3,
    "playbooks_updated": 1,
    "ttps_mapped": ["T1110.001", "T1021.004"]
  },
  "alchemical_phase": "citrinitas",
  "witnesses": [
    {
      "node": "did:vm:node:brick-01",
      "witnessed_at": "2025-12-06T15:55:00Z",
      "signature": "z58D..."
    }
  ],
  "tags": ["psi", "transmutation", "ssh", "brute-force"],
  "root_hash": "blake3:transmute..."
}

---

Resonance

Resonance measures cross-system synchronization and harmony.

Resonance Factors

Factor	Weight	Measurement
Anchor Health	0.25	Time since last anchor, failure rate
Receipt Consistency	0.20	Hash chain integrity, no gaps
Mesh Connectivity	0.20	Node health, route availability
Phase Alignment	0.15	All subsystems in compatible phases
Federation Sync	0.10	Witness success rate
Governance Compliance	0.10	No active violations

Harmony Score

harmony_score = Σ(factor_weight × factor_score) / Σ(factor_weight)

Interpretation:

• 0.90 - 1.00: Rubedo — Full sovereignty
• 0.70 - 0.89: Citrinitas — Optimizing
• 0.50 - 0.69: Albedo — Stabilizing
• 0.00 - 0.49: Nigredo — Crisis mode

Resonance Receipt

{
  "type": "psi_resonance",
  "resonance_id": "resonance-2025-12-06-12",
  "timestamp": "2025-12-06T12:00:00Z",
  "harmony_score": 0.94,
  "factors": {
    "anchor_health": 1.0,
    "receipt_consistency": 0.98,
    "mesh_connectivity": 0.95,
    "phase_alignment": 0.90,
    "federation_sync": 0.85,
    "governance_compliance": 1.0
  },
  "current_phase": "rubedo",
  "subsystem_phases": {
    "guardian": "rubedo",
    "oracle": "rubedo",
    "mesh": "citrinitas",
    "treasury": "rubedo"
  },
  "dissonance_notes": [
    "mesh slightly below harmony due to pending node upgrade"
  ],
  "tags": ["psi", "resonance", "harmony"],
  "root_hash": "blake3:resonance..."
}

---

Integration

Integration crystallizes learnings into permanent capability.

Integration Types

Type	Description	Example
rule_integration	Detection rule becomes standard	Sigma rule added to baseline
playbook_integration	Response procedure formalized	IR playbook updated
capability_integration	New system feature	Auto-containment enabled
knowledge_integration	Documentation updated	Threat model revised
training_integration	Team skill acquired	Drill proficiency achieved

Integration Receipt

{
  "type": "psi_integration",
  "integration_id": "integration-2025-12-06-001",
  "timestamp": "2025-12-06T18:00:00Z",
  "integration_type": "rule_integration",
  "source": {
    "transmutation_id": "psi-transmute-2025-12-06-001",
    "capability_hash": "blake3:def456..."
  },
  "target": {
    "system": "detection_pipeline",
    "component": "sigma_rules",
    "version": "v2.1.0"
  },
  "integration_proof": {
    "deployed_at": "2025-12-06T17:30:00Z",
    "verified_by": ["brick-01", "brick-02"],
    "test_results": {
      "true_positives": 5,
      "false_positives": 0,
      "detection_rate": 1.0
    }
  },
  "crystallization_complete": true,
  "tags": ["psi", "integration", "detection"],
  "root_hash": "blake3:integration..."
}

---

Oracle Insights

Significant findings from the Compliance Oracle that warrant receipting.

Insight Types

Type	Description
compliance_gap	New gap identified
regulatory_change	Regulation updated
risk_elevation	Risk level increased
deadline_approaching	Compliance deadline near
cross_reference	Connection between frameworks

Insight Receipt

{
  "type": "psi_oracle_insight",
  "insight_id": "insight-2025-12-06-001",
  "timestamp": "2025-12-06T14:00:00Z",
  "insight_type": "compliance_gap",
  "severity": "high",
  "frameworks": ["AI_Act", "GDPR"],
  "finding": {
    "summary": "Model training data lineage documentation incomplete for Annex IV requirements",
    "affected_articles": ["AI_Act.Annex_IV.2.b", "GDPR.Art_30"],
    "current_state": "partial_documentation",
    "required_state": "complete_lineage_from_source_to_model"
  },
  "recommended_actions": [
    "Implement data provenance tracking",
    "Document all training data sources",
    "Create lineage visualization"
  ],
  "deadline": "2026-08-02T00:00:00Z",
  "confidence": 0.92,
  "oracle_query_ref": "oracle-answer-2025-12-06-4721",
  "tags": ["psi", "oracle", "insight", "ai_act", "gdpr"],
  "root_hash": "blake3:insight..."
}

---

Magnum Opus Dashboard

The Magnum Opus is the great work — the continuous refinement toward sovereignty.

Dashboard Metrics

┌─────────────────────────────────────────────────────────────────┐
│                     MAGNUM OPUS STATUS                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Current Phase: RUBEDO 🜂                Harmony: 0.94          │
│  Time in Phase: 47 days                                         │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │ Phase History (90 days)                                  │   │
│  │ ████████████░░░░████████████████████████████████████████│   │
│  │ NNNAAACCCCCNNAACCCCCCCCCCRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR│   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
│  Transmutations                  Integrations                   │
│  ├─ Active: 2                    ├─ This Month: 7              │
│  ├─ Completed: 34                ├─ Total: 156                 │
│  └─ Success Rate: 94%            └─ Crystallized: 142          │
│                                                                 │
│  Resonance Factors                                              │
│  ├─ Anchor Health:      ████████████████████ 1.00              │
│  ├─ Receipt Integrity:  ███████████████████░ 0.98              │
│  ├─ Mesh Connectivity:  ███████████████████░ 0.95              │
│  ├─ Phase Alignment:    ██████████████████░░ 0.90              │
│  ├─ Federation Sync:    █████████████████░░░ 0.85              │
│  └─ Governance:         ████████████████████ 1.00              │
│                                                                 │
│  Recent Oracle Insights: 3 (1 high severity)                    │
│  Next Anchor: 47 min                                            │
│  Last Incident: 47 days ago                                     │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

CLI Commands

# Phase status
vm-psi phase current
vm-psi phase history --days 90

# Transmutation
vm-psi transmute start --input INC-2025-12-001 --title "SSH Brute Force"
vm-psi transmute status transmute-2025-12-001
vm-psi transmute complete transmute-2025-12-001 --step coagulate

# Resonance
vm-psi resonance current
vm-psi resonance history --days 30

# Integration
vm-psi integrate --source transmute-2025-12-001 --target detection_pipeline

# Opus
vm-psi opus status
vm-psi opus report --format pdf --output opus-report.pdf