SOVEREIGN_MANIFEST // CAP-2026 // FULL_SYSTEM_ARCHITECTURE

System Capabilities
& Power Index

A complete technical decomposition of every subsystem inside Averiz Sovereign. This document covers all 18 operational layers — from process governance and live entropy analysis to the cryptographic command authority system and the Ring 0 kernel driver interface.

Privilege Level SeDebugPrivilege / SYSTEM
Active Subsystems 18 Operational Layers
Version Beta v1.2 // ACE-ZENITH
Encryption Standard AES-256-GCM + DPAPI + TPM
Command Auth HMAC-SHA256 / VirtualLock
AI Integration Ollama / Gemini 1.5 Flash
SYSTEM_TOPOLOGY // RING_ARCHITECTURE

Engine Architecture

Averiz Sovereign is a layered system with a Svelte 5 frontend, a Go backend, and a direct interface to the Windows NT Kernel via raw syscalls and IOCTL. All critical commands route through the HMAC-authenticated Brain subsystem.

┌─────────────────────────────────────────────────────────────────┐
│                      AVERIZ SOVEREIGN                           │
│                                                                 │
│   ┌─────────────┐   ┌─────────────────┐   ┌────────────────┐  │
│   │  Frontend   │   │   Wails IPC     │   │  Go Backend    │  │
│   │ (Svelte 5)  │◄──│  (WebView2)     │──►│  (app.go)      │  │
│   └─────────────┘   └─────────────────┘   └───────┬────────┘  │
│                                                   │            │
│   ┌─────────────────────────────────────────────┐ │            │
│   │              KERNEL SUBSYSTEMS              │ │            │
│   │                                             │ │            │
│   │  ProcessMgr  │  SecurityMgr  │  VitalsMgr   │ │            │
│   │  RegistryMgr │  Brain (HMAC) │  EntropyMgr  │ │            │
│   │  NetworkMgr  │  Broadcaster  │  IdentityVlt  │ │            │
│   │  DriverClient│  Sentinel     │  DossierMgr  │ │            │
│   └─────────────────────────────────────────────┘ │            │
│                                                   │            │
│   ┌─────────────────────────┐  ┌─────────────────▼──────────┐  │
│   │  Security Sentinel      │  │  Ring 0 Driver Interface   │  │
│   │  (Rust DLL)             │  │  AverizDriver (IOCTL)      │  │
│   └─────────────────────────┘  └────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────┘
SUBSYSTEM_MANIFEST // 18_OPERATIONAL_LAYERS

Full Capability Index

Every active subsystem. Expand each entry for full technical details, implementation notes, and live behavior specifications.

01 // PROCESS_GOVERNANCE
Process Management — "The Hitlist"
CreateToolhelp32Snapshot / taskkill /F /T / SetPriorityClass
EXTREME ● ACTIVE
  • Live Process Tree — Uses CreateToolhelp32Snapshot to enumerate every running process in a recursive parent-child hierarchy in real time. Full metadata: Name, PID, PPID, Thread Count, CPU%, RAM (Working Set), and full executable path.
  • 16-Worker Concurrent Pool — All process nodes are extracted simultaneously via a goroutine worker pool, achieving near-zero latency even with 500+ active processes.
  • CPU Calculation Method — Per-process CPU% is computed using kernel/user time deltas against total system time via GetProcessTimes — identical to Windows Task Manager's methodology.
  • Module Inspector — Enumerates every loaded DLL inside any process using TH32CS_SNAPMODULE. Reveals injected foreign libraries and hidden payloads.
  • Forced Termination — Kills an entire process tree (parent + all descendants) atomically using taskkill /F /T. Bypasses standard protection flags.
  • Priority Shifting — Sets CPU scheduling priority to Idle, Below Normal, Normal, Above Normal, High, or REALTIME via SetPriorityClass.
  • CPU Affinity Control — Binds any process to specific CPU cores via SetProcessAffinityMask, enabling hardware-level resource isolation.
  • Process Spawn — Launches new processes from the UI using hidden-window creation flags to avoid visual flicker.
02 // SECURITY_SUITE
Sovereign Security Suite
Anti-Debugger / Ghost Protocol / Self-Integrity / Behavioral Guard
EXTREME ● ACTIVE
  • Anti-Debugger (Dual-Layer) — Polls every 2 seconds using both the Rust Security Sentinel DLL and native kernel32.dll::IsDebuggerPresent. If a debugger (x64dbg, IDA Pro, WinDbg) is detected on a non-Founder session, Ghost Protocol activates.
  • Ghost Protocol (Honeypot Mode) — When activated, all system data feeds become deliberate deceptions. Process Tree returns fake malware processes. Network Matrix shows fake exploit connections on ports 4444 and 31337. Vitals report CPU: 100%, Cores: 1337. The operator sees real data; the attacker sees a fabricated system.
  • Self-Integrity Guard — Every 60 seconds, Averiz SHA-256 hashes its own executable and compares it to the hash captured at startup. Any binary modification, patch, or memory injection triggers a FATAL: BINARY_INTEGRITY_COMPROMISED event.
  • Behavioral Guard — Scans all processes every 10 seconds for thread count abuse. Any non-system process exceeding 150 threads is flagged as a potential exploit and written to a forensic breach log.
  • RAT Scanner — An immortal daemon polling every 15 seconds for known Remote Access Trojans: anydesk.exe, teamviewer.exe, rustdesk.exe, screenconnect.exe, winvnc.exe.
  • ETW Telemetry Watcher — Hooks into Windows Security Event Log (Event ID 4688) via wevtutil. Detects Audit Failure events in real time and fires frontend alerts.
  • Security Score Engine — Live 0–100 score: Debugger presence (−40), dangerous tools running (−15 each), missing admin privileges (−20).
03 // NUCLEAR_PROTOCOL
Reaper Protocol — "The Nuclear Option"
Mass Termination + Network Severance / Ctrl+Shift+F12 Panic Hotkey
EXTREME ● ACTIVE
  • Mass Process Termination — Iterates every running process and forcefully kills all non-whitelisted applications. Whitelist: explorer.exe, winlogon.exe, csrss.exe, smss.exe, lsass.exe, services.exe, wininit.exe, svchost.exe, and itself.
  • Simultaneous Network Severance — All network adapters are disabled atomically at the same moment processes are killed via netsh interface set interface.
  • Autonomous Trigger (90% Threat Score) — If the Brain's cognitive threat score reaches 90, the Reaper Protocol fires automatically without operator input.
  • Global Panic Hotkey — Ctrl + Shift + F12 is wired directly to the OS via user32.dll::RegisterHotKey (User32 hook, WM_HOTKEY). Works even when the Averiz window is not focused.
  • Manual Trigger — Available as a one-click operator action from the dashboard, signed through the Brain's HMAC verification chain.
// Brain routes the signed reaper command case "reaper": count, err := b.security.ReaperProtocol(b.process, b.network) return fmt.Sprintf("reaper protocol triggered: %d processes neutralized", count), nil // Auto-fires when threat score ≥ 90 if b.threatLevel >= 90 { go b.security.ReaperProtocol(b.process, b.network) }
04 // FREEZE_RAY
The Freeze Ray — Anti-Execution
NtSuspendProcess / Forensic Pause Mode
HIGH ● ACTIVE
  • Full Process Tree Suspension — Suspends an entire process tree (parent + children) in RAM using NtSuspendProcess. The process remains in memory but cannot execute any instructions.
  • Malware Containment — Freezes active malware before it can delete files, exfiltrate data, phone home, or trigger a watchdog respawn process.
  • Forensic Window — Creates a stable analysis window. While a process is frozen, operators can inspect its modules, memory, and network connections before making a termination decision.
05 // HARDWARE_TELEMETRY
Live Hardware & System Vitals
PDH / GetSystemTimes / GlobalMemoryStatusEx / typeperf
HIGH ● ACTIVE
  • CPU Usage % — Delta-calculated via GetSystemTimes. Same methodology as Windows Task Manager. Accurate per-poll, not sampled.
  • GPU Usage % — Dual-method: primary via PDH \GPU Engine(*)\Utilization Percentage, fallback to typeperf streaming. Handles NVIDIA, AMD, and Intel Arc.
  • Network I/O (MB/s) — typeperf \Network Interface(*)\Bytes Received/sec and Bytes Sent/sec, aggregated across all interfaces.
  • Disk I/O (MB/s) — typeperf \PhysicalDisk(_Total)\Disk Read/Write Bytes/sec for global drive throughput.
  • RAM, Page File, Drive Inventory — GlobalMemoryStatusEx for RAM. Full drive scan C–Z via GetDiskFreeSpaceExW.
  • Network Ping (ms) — Live TCP probe to 8.8.8.8:53 every 2 seconds. Returns −1 if disconnected.
  • Hardware Identity — CPU Name, Thread Count, Motherboard, BIOS Version, OS Version — all read directly from Windows Registry hives.
  • Handle Count — Total system-wide handle count via GetPerformanceInfo.
06 // IDENTITY_VAULT
Identity Vault — DPAPI + TPM + AES-GCM
Argon2id / CryptProtectData / Hardware-Bound Authentication
HIGH ● ACTIVE
  • Layer 1 — Argon2id Password Hashing — All passwords hashed with Argon2id: 1 iteration, 64MB memory cost, 4 threads, 32-byte key. Silently migrates legacy SHA-256 hashes on first login.
  • Layer 2 — AES-256-GCM Encryption — The operator vault JSON is encrypted with a key derived from the machine's TPM Manufacturer ID (falls back to MachineGuid). Makes the vault unreadable on any other hardware.
  • Layer 3 — Windows DPAPI — The AES-encrypted blob is further wrapped with CryptProtectData, binding decryption to the specific Windows user account. A different user on the same machine cannot decrypt it.
  • Registry Storage — Final encrypted blob stored at HKCU\SOFTWARE\AverizSovereign\IdentityVault. No plaintext files.
  • HWID Binding — Accounts are bound to a SHA-256(MachineGuid + CPU) fingerprint, formatted as XXXX-XXXX-XXXX-XXXX. Login from a different machine triggers HARDWARE_BINDING_VIOLATION.
  • Operator Roles — Founder (first registered, bypasses debugger protection, full authority) and Pro. Founder rank is transferable between operators.
07 // ENTROPY_SHIELD
Ransomware Shield — Entropy Monitor
Shannon Entropy / ReadDirectoryChanges / Canary Trap
HIGH ● ACTIVE
  • Kernel-Level File Monitoring — Watches Documents, Desktop, and the canary trap directory using Windows ReadDirectoryChanges — a kernel event API with no polling overhead.
  • Shannon Entropy Analysis — When a file is written or modified, a 4KB chunk is read and Shannon Entropy is calculated. Files above 7.7 bits/byte (consistent with encryption or ransomware output) trigger an immediate alert.
  • Smart Whitelist — Common compressed formats (.zip, .7z, .rar, .png, .jpg, .mp4) are excluded from entropy checks to prevent false positives.
  • Canary Trap — On startup, Averiz creates %USERPROFILE%\.averiz_canary\ containing convincing decoy files: bank_vault.docx, private_key.pem, Passwords_Backup.txt. Any write to this folder fires an instant maximum-severity alert (entropy = 9.9), catching attackers who browse for sensitive data.
08 // NETWORK_MATRIX
Network Matrix
Process-to-Connection Mapping / Active TCP/UDP Intelligence
HIGH ● ACTIVE
  • System-Wide Connection Map — Captures all active TCP/UDP connections across the system and resolves each to its owning process name and PID.
  • Full Connection Detail — Local address, remote address, port, and connection state (ESTABLISHED, LISTEN, TIME_WAIT) for every socket.
  • Honeypot Deception — In Ghost Protocol mode, the Network Matrix returns fabricated connections attributed to fake malicious process names (AverizDecryptedPayload.exe, master_keys_dumper.exe) to mislead forensic analysts.
09 // REGISTRY_ENGINE
Registry Management & System Tweaks
20+ Active Tweaks / Registry Shield / Autorun Manager / Snapshot & Revert
HIGH ● ACTIVE
  • Registry Shield — Monitors startup keys in real time using RegNotifyChangeKeyValue (a kernel event, not polling). Unauthorized writes to HKLM\Run or HKCU\Run fire a breach event and increment the threat score.
  • Autorun Manager — Full read and delete access to all startup entries from both HKLM and HKCU.
  • Persistence Scanner — Scans HKLM Run, HKLM RunOnce, HKCU Run, and HKLM Winlogon for suspicious persistence entries — primary malware survival locations.
  • Registry Snapshot & Revert — Exports the current state of critical hives to a .reg backup file. Can re-import any snapshot via a native file dialog.
  • Power Tweaks — Activate Ultimate Performance power plan, disable hibernation.
  • Privacy Tweaks — Disable Windows telemetry (AllowTelemetry=0), disable Cortana, disable SMBv1, disable Remote Registry service.
  • Gaming Mode — Force Windows Game Mode on via registry.
  • Network Tweaks — TCP AutoTuning optimization, Winsock reset, DNS flush.
  • Nuclear Clean — Flush DNS + Winsock reset + wipe %TEMP% + wipe C:\Windows\Temp + wipe C:\Windows\Prefetch in one command.
  • File Shredder — Multi-pass zero-overwrite file destruction via a PowerShell script with configurable pass count. Data is unrecoverable after execution.
  • Debloat Suite — Remove AppX packages (Xbox, Bing, Zune), disable SysMain (Superfetch), disable Compatibility Appraiser task.
  • OS Repair — Launch sfc /scannow in a visible terminal, restart Explorer shell.
10 // COMMAND_AUTHORITY
The Brain — Cryptographic Command Authority
HMAC-SHA256 / Nonce Replay Protection / VirtualLock / Autonomous Threat Response
HIGH ● ACTIVE
  • HMAC-SHA256 Command Signing — Every destructive action (kill process, reaper, tweak execution, network lock) must carry a valid HMAC-SHA256 signature. Commands without a valid signature are rejected and flagged as anomalies.
  • Nonce Replay Protection — Each command nonce is valid for only 30 seconds and is tracked in a map. Replayed commands are rejected even if the signature is valid.
  • RAM-Locked Session Key — The 32-byte random session key is locked into physical RAM using windows.VirtualLock. It cannot be written to the pagefile or extracted via memory dump tools.
  • Autonomous Response Thresholds — Threat ≥ 60% → Auto-lock all network adapters. Threat ≥ 90% → Auto-fire Reaper Protocol. Threat ≥ 70% → Subsystem lockdown (only reaper, status, lock_network allowed).
  • Anomaly Accumulator — Every security event (RAT detection, debugger detection, registry violation, unauthorized command) adds a weighted severity score. The cumulative total drives autonomous response.
11 // AI_SENTRY
Intelligent Sentry — AI System Analyst
Ollama / Gemini 1.5 Flash / Autonomous Heuristic Kill
HIGH ● ACTIVE
  • Offline-First Architecture — Queries a local Ollama/Llama3 instance at http://127.0.0.1:11434 first. All analysis stays on-device with no external telemetry.
  • Cloud Fallback — If local AI is unavailable, queries Google Gemini 1.5 Flash via a user-supplied BYOK API key.
  • Heuristic Process Analysis — Sends any process's Name, PID, CPU%, Memory (KB), and executable path to the AI for classification: THREAT or SAFE.
  • Autonomous Kill with Safety Gate — If the AI classifies a process as THREAT, Averiz kills it automatically. A hardcoded safety gate prevents autonomous kills of whitelisted system processes (explorer.exe, lsass.exe, csrss.exe, etc.).
  • System Diagnosis Mode — Feeds live CPU, RAM, Handle count, and Uptime into the AI for an enterprise-grade bottleneck analysis report.
12 // PRIVILEGE_ENGINE
Privilege Escalation Engine
SeDebugPrivilege / SYSTEM Token Theft from winlogon.exe
EXTREME ● ACTIVE
  • SeDebugPrivilege Escalation — Enables SeDebugPrivilege on Averiz's process token. This grants read/write access to the memory space of any process, including SYSTEM-level processes — enabling killing and inspection of otherwise protected targets.
  • SYSTEM Token Theft (Fallback) — If SeDebugPrivilege fails, Averiz opens winlogon.exe, duplicates its SYSTEM-level process token using DuplicateTokenEx, and impersonates it via SetThreadToken. This achieves full SYSTEM authority.
  • Automatic on Every Boot — The escalation sequence runs automatically during startup. God Mode is a baseline requirement, not an optional feature.
func (a *App) EscalatePrivileges() error { // Step 1: Try direct privilege token adjustment if err := a.EnableSeDebugPrivilege(); err == nil { return nil } // Step 2: Steal the SYSTEM token from winlogon.exe if err := a.StealSystemToken(); err != nil { return err } // Step 3: Re-enable SeDebugPrivilege under SYSTEM context return a.EnableSeDebugPrivilege() }
13 // NEURAL_BRIDGE
NeuralBridge & Broadcaster — Secure IPC
TLS-1.3 Local Server / AES Stealth Stream / Self-Signed RSA-2048
MEDIUM ● ACTIVE
  • TLS-Encrypted Local Server — Binds to 127.0.0.1:9999 (falls back to 10000, 10001) using a self-signed RSA-2048 certificate generated fresh at every startup.
  • AES Stealth Broadcast Stream — The Broadcaster module encrypts all event telemetry using a key derived from the AVERIZ_MASTER_KEY environment variable, or an ephemeral per-session key if unset.
  • Binary Protocol — Custom framing: 4-byte big-endian length prefix + time-bucketed SHA-256 packet header magic (0x41565853). Rejects malformed or unauthenticated packets.
  • External Module Interface — Future Averiz modules or operator tools can connect to the NeuralBridge for authenticated telemetry streaming.
14 // FLIGHT_RECORDER
Sovereign Sentinel — Black Box
Always-On Event Logger / Heartbeat / Atomic Wrap
MEDIUM ● ACTIVE
  • Always-On Event Logger — Records every security event, kernel action, anomaly, and admin directive with precise timestamps. Acts as a forensic black box.
  • Sentinel.Watch() Wrapper — Every critical function call is wrapped atomically: the Sentinel logs the operation name, the originating module, and the outcome.
  • Liveness Heartbeat — A heartbeat system continuously proves the Sentinel thread is alive and responsive.
  • Polymorphic Named Pipe — The Security Watchdog communicates with the Rust Sentinel DLL via a randomized named pipe (AverizGhost-[16-byte-hex]), making the communication channel undiscoverable via static analysis.
15 // FORENSIC_INTEL
Forensic Dossier System
Automated 6-Hour Reports / HTML Executive Report / CSV Export
MEDIUM ● ACTIVE
  • Executive HTML Report — One-click generation of a classified-styled forensic HTML report to the Desktop, containing vitals, HWID, uptime, and process count.
  • Automated 6-Hour Dossier — A background timer fires every 6 hours to auto-generate a comprehensive state snapshot: HWID, system vitals, all active network connections, process count, and the full event log.
  • Forensic CSV Export — Any live data grid (process list, network matrix, persistence scan results) can be exported to a timestamped CSV file for external analysis.
  • Founder Diagnostics JSON — Full engine state dump as structured JSON for programmatic debugging.
16 // DAEMON_FRAMEWORK
Immortal Daemon Framework
Auto-Restart on Crash / Goroutine Supervision / Context-Aware Lifecycle
MEDIUM ● ACTIVE
  • Auto-Healing Threads — The SpawnImmortalDaemon framework ensures any goroutine that panics or crashes is automatically restarted after a 3-second cooling period with zero operator intervention.
  • Active Immortal Daemons — RATScanner (15s), ETWWatcher (5s), BackgroundOptimizer (6h), ExpoAttack (when demo mode active).
  • Context-Aware Lifecycle — All daemons are bound to the application's lifecycle context. Clean shutdown terminates all daemons gracefully without leaking goroutines.
17 // ANTI_TAMPER
Anti-Tamper & Anti-Reverse Engineering
Polymorphic Hash / Anti-Dump / Rust Sentinel / Canary Decoys
HIGH ● ACTIVE
  • Polymorphic Execution Hash — A build-time hash changes the Ring 0 driver device symlink name each build, making static driver path discovery impossible.
  • Anti-Dump (VirtualLock) — The HMAC session key is memory-locked via VirtualLock, preventing it from being extracted via pagefile analysis or memory dump tools.
  • Rust Anti-Debugger DLL — The security_sentinel.dll is a separate Rust-compiled binary. Its anti-debugger hooks are harder to intercept than pure Go/Windows API calls.
  • Canary Decoy Files — bank_vault.docx and private_key.pem are placed in a hidden directory. Accessing them triggers immediate breach alerts.
  • Randomized Pipe Channel — The Sentinel communicates through a named pipe with a 16-byte random hex suffix per session. No static signature to hook.
18 // RING_0_INTERFACE
Ring 0 Kernel Driver Interface
IOCTL / HMAC Challenge-Response / Polymorphic Device Path — In Development
EXTREME ⚙ IN DEV
  • User-Space Driver Client — A fully-built IOCTL client interfaces with a kernel-mode Windows driver via DeviceIoControl. The client infrastructure is complete.
  • HMAC Challenge-Response Handshake — Before any IOCTL is accepted, the driver issues a 32-byte nonce. The client must respond with the correct HMAC-SHA256(nonce, shared_secret). Unauthorized processes cannot communicate with the driver.
  • Polymorphic Device Path — The driver's device symlink (\\.\AverizDriver_[hash]) is dynamically generated using a build-time hash. Static analysis cannot predict the device name.
  • Planned: HWID Spoofing — Kernel-level modification of hardware identifiers. Not yet implemented.
  • Planned: EDR Stripping — Remove Endpoint Detection & Response hooks from kernel memory. Not yet implemented.
  • Planned: Process Hollowing — Kernel-assisted process hollowing injection. Not yet implemented.
  • Planned: Force File Deletion — Delete files locked by the kernel or other processes. Not yet implemented.
SYSTEM_POWER_INDEX // FULL_CAPABILITY_MATRIX

Power Matrix

All 18 operational layers indexed by power tier and deployment status.

Capability Power Status
Live Process Tree (all threads)🔴 EXTREME● ACTIVE
SeDebugPrivilege Escalation🔴 EXTREME● ACTIVE
SYSTEM Token Theft (winlogon)🔴 EXTREME● ACTIVE
Reaper Protocol (mass kill + net lock)🔴 EXTREME● ACTIVE
Global Panic Hotkey (Ctrl+Shift+F12)🔴 EXTREME● ACTIVE
Ghost Protocol (Honeypot Deception)🔴 EXTREME● ACTIVE
Freeze Ray (NtSuspendProcess)🟠 HIGH● ACTIVE
Anti-Debugger (Rust Sentinel DLL)🟠 HIGH● ACTIVE
Self-Integrity Guard (SHA-256 check)🟠 HIGH● ACTIVE
Ransomware Shield (Shannon Entropy)🟠 HIGH● ACTIVE
Registry Shield (Real-time Watch)🟠 HIGH● ACTIVE
Identity Vault (DPAPI + AES + TPM)🟠 HIGH● ACTIVE
Brain (HMAC Signed Commands)🟠 HIGH● ACTIVE
Autonomous Threat Response🟠 HIGH● ACTIVE
Intelligent Sentry (Ollama / Gemini AI)🟠 HIGH● ACTIVE
Canary Trap Files🟠 HIGH● ACTIVE
Live HW Telemetry (CPU/GPU/RAM/Disk)⬜ MEDIUM● ACTIVE
Network Matrix (process-to-connection)⬜ MEDIUM● ACTIVE
Registry Tweaks (20+ categories)⬜ MEDIUM● ACTIVE
ETW Security Event Watcher⬜ MEDIUM● ACTIVE
Forensic Dossier Generation⬜ MEDIUM● ACTIVE
NeuralBridge TLS IPC Server⬜ MEDIUM● ACTIVE
Immortal Daemon Framework⬜ MEDIUM● ACTIVE
Ring 0 Kernel Driver🔴 EXTREME⚙ IN DEVELOPMENT
HWID Spoofing (Ring 0)🔴 EXTREME— NOT IMPLEMENTED
EDR Stripping (Ring 0)🔴 EXTREME— NOT IMPLEMENTED
OPERATOR_RISK_ASSESSMENT // READ_BEFORE_ENGAGING

Operational Risk Index

Averiz possesses absolute execution authority. Improper use of certain systems carries irreversible consequences. Understand these vectors before engaging high-power protocols.

RISK-01 // DATA_DESTRUCTION
Reaper Protocol
Triggering the Reaper Protocol mercilessly terminates all non-whitelisted applications. Any unsaved work — documents, video projects, code editors — is permanently destroyed with no recovery path.
RISK-02 // OS_INSTABILITY
Deep Service Termination
Killing certain OS services beyond the whitelist (csrss.exe, wininit.exe) will cause an immediate Blue Screen of Death or system crash. The whitelist is a safety net, not a guarantee.
RISK-03 // HARDWARE_LOCKOUT
Identity Vault Binding
The Identity Vault is bound to your motherboard's unique identifiers. Replacing the motherboard or clearing TPM keys without a pre-export of your configuration results in permanent operator lockout.
RISK-04 // NETWORK_DEADLOCK
Network Lockdown
Engaging the network isolation features without understanding the reversal procedure can result in an indefinitely disconnected machine, requiring a physical reboot or safe-mode network reset.