71-wonderphi-vault
Asset valuation: $5,000,000,000. 30 batch recipes for encryption, signing, hashing, certificate lifecycle, secrets scanning, and redaction. Emit WonderPhi Compute plans; run across every CPU core. You have 10,000 evidence files to archive with tamper-evident hashes.
Think of ten thousand evidence files going into an archive tonight, each with a hash beside it so anyone can show later that nothing was touched. WonderPhi Vault turns that job into one plan file. It is a companion library to WonderPhi Compute: point a recipe at the folder and it writes a plain-text plan, one line per file. It encrypts nothing and signs nothing itself - it reads a folder and writes a text file - and WonderPhi Compute then runs every line in parallel across every CPU core.
Thirty recipes in nine categories cover the security chores of a careful operator: SHA-256 and SHA-512 sidecars and a combined manifest for an evidence bag, GPG encrypt, decrypt, sign and verify, AES-256 with a salted PBKDF2 password, password-locked 7-Zip archives, Authenticode signing of executables, certificate fingerprints and expiry, chain dumps, cipher audits, HSTS and CSP checks, scans for AWS keys, GitHub tokens, embedded private keys, Social Security and card-number patterns, metadata stripping from images, and batch SSH keypair generation. The recipes drive tools the operator already has: certutil, openssl, gpg, 7z, signtool, ssh-keygen, exiftool, curl and findstr. The library is one Python script of 317 lines, standard library only, Python 3.8 or higher, no network, no telemetry, and it never modifies wpc.exe.
This is working software for the compliance team, the forensics desk and the datacenter operator sealing records at scale. It ships with retail and industrial licenses. The buyer walks away with the script and all thirty recipes; the WonderPhi framework and the patent-pending claims stay with the inventor.
Description
Patent status: Patent pending — see PATENT_PORTFOLIO.md for the full portfolio of Christopher Gabriel Brown’s filings
IP protection: U.S. copyright (17 U.S.C. § 102(a)(1)) and applicable international treaties
WonderPhi Vault is a companion library to WonderPhi Compute that provides 30 batch recipes covering encryption, signing, hashing, certificate lifecycle management, secrets scanning, and PII redaction. It does not encrypt or sign anything itself — it reads a folder of input files (or a list of targets) and writes a plain-text .plan.wpc.txt file: one command per input, ready to feed to wpc.exe for parallel execution across every CPU core.
The entire tool is a single Python script — wpv-recipe.py — built on the Python standard library alone. There are zero external dependencies, zero pip install steps, no network access, and no telemetry. It requires Python 3.8 or higher. The recipes drive well-known, industry-standard command-line tools that must already be installed on the operator’s machine: certutil , openssl , gpg (Gpg4Win), 7z , signtool.exe , ssh-keygen , exiftool , curl , and findstr .
The library never modifies wpc.exe . The 10 Commandments (the constitutional framework of WonderPhi Compute) remain intact at all times.
All 30 recipes are organised into 9 categories. Each recipe operates in one of two input models: files (scan a folder for matching file extensions) or lines (one target per line in a text file).
sha256-each files certutil (built-in) SHA-256 each file to a sidecar — tamper-evident archive
sha256-manifest files certutil (built-in) SHA-256 each file + combined MANIFEST-sha256.txt (evidence bag); includes a barrier/post step that concatenates all individual hashes
verify-manifest files certutil (built-in) Re-hash each file and write current SHA-256 for post-transit verification
gpg-encrypt-each files gpg (Gpg4Win) GPG-encrypt each file to a recipient key (set --tag to recipient key ID)
gpg-decrypt-each files gpg (Gpg4Win) GPG-decrypt each ciphertext ( .gpg , .pgp , .asc ) to a sidecar
aes-encrypt-each files openssl AES-256-CBC + PBKDF2 encrypt each file (100,000 iterations, salted; password via --tag )
aes-decrypt-each files openssl AES-256-CBC + PBKDF2 decrypt each .enc file (password via --tag )
7z-encrypt-each files 7z (7-Zip) 7z-archive each file with AES-256 encryption, hidden filenames ( -mhe=on ), compression level 7 (password via --tag )
7z-decrypt-each files 7z (7-Zip) Extract each password-protected .7z into its own subfolder
signtool-sign-each files signtool.exe (Windows SDK) Authenticode-sign each PE/MSI ( .exe , .dll , .msi , .sys , .ocx ); set --tag to /f cert.pfx /p pass /tr timestamp /td sha256 /fd sha256
cert-fingerprint-each files openssl SHA-256 fingerprint of each PEM certificate file ( .pem , .crt , .cer , .key )
tls-cipher-audit lines openssl Attempt TLS 1.3 connection with a modern cipher suite on each host (cipher audit)
hsts-check lines curl (built-in) Fetch each URL and report the Strict-Transport-Security header
csp-check lines curl (built-in) Fetch each URL and report the Content-Security-Policy header
secret-scan-aws files findstr (built-in) Grep each source/document file for AWS access-key ID patterns ( AKIA / ASIA )
secret-scan-github files findstr (built-in) Grep each file for GitHub token patterns ( ghp_ , gho_ , ghs_ )
secret-scan-private-key files findstr (built-in) Grep each file for embedded PEM private-key headers ( BEGIN RSA PRIVATE KEY , BEGIN OPENSSH PRIVATE KEY , BEGIN EC PRIVATE KEY )
pii-scan-ssn files findstr (built-in) Grep each document for US Social Security Number patterns ( NNN-NN-NNNN )
pii-scan-cc files findstr (built-in) Grep each document for 16-digit credit-card number patterns
exif-strip-each files exiftool Strip ALL metadata from each image ( .jpg , .jpeg , .png , .tif , .tiff , .heic , .webp ) in-place after backup
sshkey-generate-batch lines ssh-keygen (built-in) Generate an ed25519 SSH keypair per name in the input list
authorized-keys-audit lines OpenSSH client Fetch and SHA-256 each remote host’s authorized_keys file
files 24 of 30 Recursively scans a folder for files matching the recipe’s extension globs. Supported glob sets: ANY (all files), CERTS_PEM ( .pem , .crt , .cer , .key ), DOCS ( .pdf , .docx , .doc , .txt , .md , .log , .csv , .json , .xml ), IMAGES ( .jpg , .jpeg , .png , .tif , .tiff , .heic , .webp ), BINS ( .exe , .dll , .msi , .sys , .ocx ), SOURCE ( .py , .js , .ts , .go , .rs , .java , .rb , .php , .c , .cpp , .h , .sh , .ps1 ).
lines 6 of 30 Reads a text file with one target (hostname, URL, or name) per line. Blank lines and lines beginning with # are ignored.
--tag VALUE Value substituted for {tag} in generated commands — recipient key, password, certificate flags, etc. (default: current timestamp YYYYMMDD-HHMMSS )
Each recipe specifies the tool it drives. The tool must be installed and on the operator’s PATH on the machine where wpc.exe runs the plan. Five of the nine tool families are built into Windows and require no installation.
Every generated plan begins with the # WPC v1 header line, followed by metadata comments recording the recipe name, description, input model, tag value, and task count. The body contains one shell command per line — each command operates on a single input file or target. Recipes that include a post-processing step (e.g. sha256-manifest ) insert a barrier comment ( # --- barrier --- combine hashes into a manifest --- ) followed by the manifest-concatenation command. The plan is saved as UTF-8 text with the extension .plan.wpc.txt .
Separation of concerns The library writes the plan. WonderPhi Compute runs the plan. Nothing in this library executes any security operation directly.
Zero dependencies Uses only Python standard-library modules: argparse , fnmatch , sys , pathlib , datetime .
No network access The generator never opens a socket, never phones home, never sends telemetry.
Constitutional integrity Never modifies wpc.exe . The 10 Commandments remain intact.
Template-driven recipes Each recipe is a Python dictionary with name , cat , model , needs , inputs , out_ext , desc , tmpl , and optional post fields. Adding a new recipe requires only appending one dictionary to the RECIPES list.
Deterministic output Given the same input folder and tag, the plan is identical. No randomness.
7-Zip archive recipes AES-256 7-Zip internal KDF Compression level 7 ( -mx=7 ), hidden filenames ( -mhe=on )
GPG symmetric recipe Default GPG cipher (AES-256) GPG internal (S2K) Batch mode, passphrase via --tag
GPG asymmetric recipes Recipient’s public-key cipher N/A (public-key) --trust-model always , batch mode
Tamper-evident archive of an evidence folder python wpv-recipe.py sha256-manifest .\evidence
GPG-encrypt every export to a recipient key python wpv-recipe.py gpg-encrypt-each .\exports --tag ops@company.com
7z with AES-256 and hidden filenames for compliance archival python wpv-recipe.py 7z-encrypt-each .\records --tag "AlphaBravo7Charlie!"
Code-sign every DLL/EXE in a build output python wpv-recipe.py signtool-sign-each .\dist --tag "/f cert.pfx /p pass /tr http://timestamp.digicert.com /td sha256 /fd sha256"
Strip EXIF from every image before publishing python wpv-recipe.py exif-strip-each .\photos
Check TLS certificate HSTS headers for every domain python wpv-recipe.py hsts-check .\domains.txt
Dry-run — see how many files match python wpv-recipe.py sha256-each .\evidence --check
Retail Single-User LICENSE Perpetual, non-exclusive, non-transferable. Tied to the buyer, not to any machine. No seat count, no activation, no telemetry. Personal and commercial use for output delivered to yourself or your own employer. No redistribution.
Industrial (Commercial) LICENSE-INDUSTRIAL.txt Perpetual, non-exclusive, non-transferable. Covers all machines, VMs, containers, and cloud instances operated by a single legal entity. No seat count, no machine limit, no annual renewal. Production and customer-facing workloads permitted. No resale, SaaS, or white-label use without a separate OEM licence.
Both licences are governed by the laws of the State of Georgia, United States of America, with exclusive jurisdiction in the state or federal courts sitting in Gwinnett County, Georgia.
wpv-recipe.py 317 14,968 bytes The recipe generator — Python, standard library only. Contains all 30 recipe definitions, the file/line scanner, and the plan emitter.
README.md 125 4,150 bytes Product documentation: overview, recipe list, usage examples, CLI options, and file manifest.
INDEX.md 44 3,322 bytes Full recipe table — 30 rows with recipe name, category, input model, external tool requirement, and description.
LICENSE 127 4,919 bytes WonderPhi Software License v1.0.0 — Retail Single-User.
LICENSE-INDUSTRIAL.txt 147 6,163 bytes WonderPhi Software License v1.0.0 — Industrial (Commercial License).
release/wonderphi-vault-v1.0.0.zip — 8,944 bytes Release archive of version 1.0.0.
How this is delivered
This package ships on a single Blu-ray disc, posted to the delivery address on your order. The archive on the disc is AES-256 encrypted; the passphrase is sent separately, by email, once the disc is despatched — so the disc alone is of no use to anyone who intercepts it.
Discs are despatched by tracked, signed-for post. Allow 5 business days for mastering and verification before despatch.
© 2026 Christopher Gabriel Brown. All rights reserved.
Photo
Footnotes
- Product number 8521.
- Family: wonderphi.
- Purchase: When you buy, you buy the use of that blueprint only.