Welcome
A fully local, zero-trust runtime that splits every privileged operation into isolated, self-defending agents — so a single breach never conquers the machine.
The Plagues Protocol is the ultra-minimalist, zero-trust local RPC substrate that powers every interaction inside XRUIOS (Walker Industries' cross-platform framework / OS / abstraction layer). It pairs Eclipse (post-quantum encrypted app-to-app transport), Notary (code-signing + on-disk anti-tamper), and Pariah Cybersecurity (the PQC primitives + SecureData) into a runtime where nothing trusts anything by default.
Windows • Linux • Fully Offline • Post-Quantum Resistant • No BS
 |
 |
|---|---|
| Code by WalkerDev “Loving coding is the same as hating yourself” Discord |
Art by Kennaness “When will I get my isekai?” Bluesky • ArtStation |
How it works
The Plagues Protocol enforces a cryptographically-sealed boundary on the same machine between three kinds of process, brokered by a single trusted core.
At a high level
-
The XRUIOS.Manager is the trusted core. It checksums and launches the workers, holds the master key and every per-app password, and is the only thing that talks to a worker or relays data between apps.
-
Workers (the Plagues part) are tiny, single-purpose services that own one privileged capability each — an account handler, a calendar store, a device bridge. A worker verifies its own on-disk footprint before it serves a byte, and it will only complete a handshake with the Manager.
-
Apps are ordinary programs. They never see a worker and never hold the master key. They ask the Manager, the Manager checks XRUIOS.Permission, and only then does the answer come back.
At the wire level
Every hop is an Eclipse channel: mutual authentication with a pre-shared key + an ephemeral Kyber key exchange, then AES-256-GCM with per-message nonces and an HMAC transcript. Injecting a false request or reading a real one from another local process is, by design, not feasible.
Philosophy
The Plagues Protocol follows three rules:
-
Never trust the caller — identity is bound by the tier above (the Manager, then the app), never self-reported.
-
Contain, don't just permit — a permission decides what's allowed; the cryptographic boundary makes everything else impossible.
-
A single breach can never conquer the machine — a fully compromised userland app still cannot escalate, cannot reach a worker, and cannot exfiltrate privileged data.
"A single breach can never conquer the machine."
Dependencies
Everything is a free, open-source Walker Industries library. Plagues consumes them as DLL references — you don't rebuild them into your solution.
| Library | Role |
|---|---|
| Eclipse | Secure app-to-app transport: enrollment, Kyber handshake, AES-256-GCM sessions. |
| Notary | Post-quantum code-signing + Blake3 file-tree anti-tamper. |
| Pariah Cybersecurity | The PQC primitives (Kyber, Dilithium), SecureData, the encrypted store, the AntiTamper watchdog. |
| XRUIOS.Permission | The policy authority — an encrypted {requester → {capability: level}} store. |
| KeeperOfTomes | Directory change-detection for the certificate vault. |
| Secure Store | Per-user local key/value used for address discovery. |
Target framework: .NET 9 for the Plagues projects; the referenced DLLs target .NET 8 and are consumed cleanly.
Where to go next
- New to the shape of it? → 1 - Architecture Overview
- Building a worker (a new capability)? → 2 - Creating a Worker
- Building an app (a consumer)? → 3 - Creating an App
- Want the fastest start? → 5 - The Visual Studio Template
- Want the real examples? → 0 - Overview in Examples
- Want the security details? → 4 - Security Model and Threat Boundaries
License & Artwork
Code: NON-AI MPL 2.0
Artwork: © Kennaness — NO AI training. NO reproduction. NO exceptions.
Unauthorized use of the artwork — including but not limited to copying, distribution, modification, or inclusion in any machine-learning training dataset — is strictly prohibited and will be prosecuted to the fullest extent of the law.