home
$ cat journal/*.md | less

journal

# deep-dives, benchmarks, and notes from research
2026-09-15 // CopyGuard

From IRC Code-Theft War to a Modern Windows Sentinel

CopyGuard started around 2004 as an mIRC script war: a custom mSL + DLL copy guard that let people read code without taking it — freeze the remote editor, poison the clipboard, auto-respawn on exit, auth-gated quit. Two decades later the same instinct rebuilt it as 2.0 after an idle PC was eating 6–12% CPU for no visible reason: paste blocker, clipboard lock, autostart watchdog, and two processes that refuse to stay dead.

mircmslirc clipboardpaste-blocker.netwindows

the 2004 trick

  • Custom IRC patch — remote editor opened the script, then froze; visible, but no scrolling
  • DLL controls the clipboard while IRC.exe runs — copy anything, paste nowhere
  • Auto-respawn on exit via on *:EXIT — killing the client was a dead end
  • Only a proper, authenticated exit stopped it

the 2026 rebuild

  • Paste blocker swallows Ctrl+V/Shift+Insert for listed apps via keyboard hook
  • Clipboard lock caches text in RAM, empties clipboard on focus in, restores on focus out
  • Persistence sentinel watches every autostart location, alerts and optionally reverts changes
  • Two processes revive each other — stop.flag + authenticated cgctl is the owner's way out

the twist

  • Built to find what eats idle CPU — it found itself: DiskSentinel was hammering a failed USN journal read every 5s
  • Policy fix dropped CopyGuard to 0.4% CPU; the real background eater was ASUS bloatware
2026-09-09 // XG

pgvector 768-dim HNSW Retrieval + PyRIT Pentester Bridge

Migrated XG's memory from opaque JSONB arrays to native pgvector halfvec(768) columns with HNSW cosine indexes. Integrated PyRIT as an allowlist-gated pentest_scan MCP tool with a verified mock-sandbox harness. Found a pre-existing _log NameError that silently broke every memory write.

pgvectorhalfvechnsw ragpyritmcppostgres

headlines

  • jsonb → halfvec is only possible through text — safe migration is dual-write
  • PyRIT's default scorer wants OpenAI-compatible chat — adversarial chats use distinct JSON schemas
  • HTTP target prompt must live in the POST body, not headers
  • Blocking issue: swarm worker synthesizes "completed" results with zero artifacts

environment

  • Mac host: user void, workspace /Volumes/Xbyte/Projects/XG/
  • PostgreSQL 16 via Homebrew, pgvector source-built
  • Embedder: nomic-embed-text → 768-dim via ollama

built

  • Migration: scripts/migrate_embeddings.py
  • PyRIT pentest MCP tool: tools/pentest_scan.py
  • Mock sandbox harness + regression tests — all green
2026-09-01 // CopyGuard

High-CPU Investigation & Remediation

High CPU on a Windows PC was NOT CompatTelRunner. Root cause: CopyGuard's DiskSentinel module failing to read NTFS USN journal, re-querying every 5s. Secondary: WmiPrvSE at 140%+ CPU from broken LineageTracker WMI watcher.

copyguardcpudisk-sentinel usn-journalwmiwindows

root cause

  • DiskSentinel couldn't read USN journal (error 1784), retried every 5s
  • WmiPrvSE at 140%+ from orphaned WMI subscriptions
  • CompatTelRunner was NOT running

fix

  • Disabled broken modules via policy.json
  • Increased poll interval 5s → 30s
  • Recreated USN journal, cleaned orphaned WMI subscriptions
2026-08-27 // XG

Local LLM Failover & Planner Benchmark

When cloud free models go down, XG must keep operating. Built failover to LAN ollama. Benchmarked planner models: qwen2.5:14b is competent, qwen3:8b fails as planner despite correct tool-calling in isolation.

qwen2.5:14bqwen3:8bfailover ollamabenchmarkplanner

findings

  • qwen2.5:14b — correct task decomposition, drives full swarm to completion
  • qwen3:8b — tool-calls correctly in isolation but fails as planner
  • gemma3:12b — ruled out, cannot emit tool calls via ollama
  • Secondary: qwen2.5:14b defaults to Chinese unless pinned to English
2025-06-09 // Pulse

Zero-Budget IAM Command Centre

Full identity and access oversight, built in 3 months with zero budget and zero enterprise tools. No PAM, no CIEM — just Google Sheets, Notion, and Apps Script on cron jobs edited in nvim. Live user DB, internal-vs-external login monitoring, ghost-account tracker, RBAC visibility, calendar sync, a Slack bot that fed dev and HR in real time, and a Notion hub that onboarded new staff on day one.

iamzero-budgetapps-script google-sheetsnotionslackrbac

the stack

  • Google Apps Script (CLASP) on cron triggers, edited in nvim
  • Google Sheets as the live database; FastAPI/REST where spreadsheets weren't enough
  • Slack + Notion as the front door — tools people already lived in

what it did

  • Weekly HR export → live user DB — the baseline everything checked against
  • Login monitor distinguishing internal vs external access, tracking IP patterns
  • Ghost tracker cross-checked accounts across every system for abandoned/unknown identities
  • RBAC visibility per user across all tools
  • Calendar sync engine, Slack bot (bugs → dev, candidates → HR), Notion onboarding hub

the lesson

  • Zero budget forces the data model right — you can't buy the product that hides messy joins
  • Internal-vs-external visibility is most of entry-level IAM; ghost tracking is the rest
  • Pulse is what SF was built from
1
$ find gallery/ -type f \( -name '*.png' -o -name '*.jpg' -o -name '*.webp' \)

gallery

# screenshots, benchmarks, and visuals from projects
$ ls gallery/XG/
// orchestration, MCP, pgvector RAG, LLM red-teaming
💾
$ echo "add screenshots to gallery/XG/"
$ ls gallery/iConX/
// macOS menubar app — Swift, no Xcode, privilege elevation
💾
$ echo "add screenshots to gallery/iConX/"
$ ls gallery/XGcode/
// custom coding agent framework
💾
$ echo "add screenshots to gallery/XGcode/"
$ ls gallery/CopyGuard/
// autonomous watchdog — CPU investigation
💾
$ echo "add screenshots to gallery/CopyGuard/"