A dual-math risk orchestration approach that closes the gap between reported compliance and actual operational integrity — the "watermelon metric effect," where a posture appears green on paper while harboring fatal operational exploits.
What this is: A governance instrument for corporate board, CxOs, regulators and policy-makers. The output is dispatch protocol for decision-makers, not a dashboard for engineers.
What it is not: A monitoring tool. A SIEM. A compliance checklist. A replacement for your existing stack.
Technology alone feeds and processes data. It does not interpret:
It pairs an additive compliance metric (Strategic Posture: context-weighted level + frozen-weight velocity) with a multiplicative weakest-link metric (Operational Blueprint: geometric-per-row, harmonic-across-rows, spectrally adjusted) over a shared 4×3 axiomatic/enabler matrix. The product of compliance and integrity deficit — not their difference — is the Watermelon Index, a one-sided deception detector that fires only when the rind is green and the flesh is red.
The orchestration is in the output shape. Every scoring cycle emits a structured decision vector, not a scalar:
| Field | Decides |
|---|---|
status (NOMINAL / CRITICAL) |
Severity tier, paging priority |
watermelon_index = A × (1−S) |
Route to compliance team (deception detected) |
honest_failure_index = (1−A) × (1−S) |
Route to ops team (visible failure, no deception) |
row_validations[4] |
Which domain to investigate first |
resonance_exploit_chain_detected |
Escalate to active threat-hunt |
velocity (ΔScore_A) |
Trajectory: intervene now or monitor |
temporal (N>1) |
Onset, persistence, trend, breaker history |
alpha_vector |
The α that produced this result (auditability) |
threat_intel_stale (bool) |
Weights are baseline, not live (24h fallback fired) |
threat_vector_anomaly (bool) |
Feed shifted abnormally between cycles (level/velocity divergence expected) |
The math doesn't produce a number to look at. It produces a dispatch protocol: who gets paged, where they look first, whether to escalate, and whether the situation is worsening or stabilizing.
This GitHub public repository houses not only the open-core architecture but every artifact that powers VoidMetric except for a few proprietary dynamics, built natively using Astro, Tailwind CSS and optimized for zero-cold-start execution inside serverless Cloudflare Workers environments.
VoidMetric operationalizes Systemic Integrity Axiomatic 4 and Enablers 3, which serves as a cognitive catalyst in consulting engagements, aligning every stakeholder without requiring them to possess the formal notation to understand business system capabilities while uncovering value creators. It maps corporate (strategic velocity) governance system, security intelligence and risk mitigation as a static 4 × 3 continuous matrix crossing four Axiomatic Domains (I) against three Technical Enablers (J):
| Axiomatic Domain (i) | Structures (j=0) | Contents (j=1) | Facilities (j=2) |
|---|---|---|---|
| 1. Function | Architecture / Policy | Logic / Source Code | Cloud Environments |
| 2. Features | RBAC / Identity | Crypto Parameters | API Gateways |
| 3. Elements | Configurations / Secrets | Data Assets / Payload | Storage Buckets |
| 4. Execution | Runtime Environments | Log / Telemetry Pipelines | Compute Infrastructure |
Formula indices are 0-based; table labels are 1-based for readability.
Input metrics are continuously streamed via automated edge scripts and normalized such that
Tracks the organization's compliance posture as a context-weighted level, and its rate of change as a frozen-weight velocity.
Level:
Velocity (frozen-weight delta):
Both computed on the same 4×3 matrix, same weights, same α. Δt = one scoring cycle. Input signal: raw
where
-
$\Delta Score_A > 0$ : improving -
$\Delta Score_A < 0$ : degrading -
$\Delta Score_A \approx 0$ : steady (ambiguous without Metric B context)
Note:
An uncompromising series system built around a Risk Switch: row verification vectors are aggregated via a weighted geometric product per row, then combined harmonically across rows so that any single collapsed row dominates the aggregate rather than being diluted by strong rows elsewhere.
Per-row geometric product:
Harmonic aggregation:
Each
Guarantee 1 (The Risk Switch): If any individual verification signal's confidence falls below a critical threshold (currently < 0.05), the breaker trips and
Note: The sigmoid cliff (k=10, x₀=0.5) and θ_breaker are co-located by construction, not by configuration. θ_breaker is derived from k and x₀ at commit time such that the breaker trips exactly where the sigmoid output equals the target floor. The co-location is a constraint enforced at commit, not a coincidence that holds for default parameters. Do not remove either; the system will not commit a configuration where they diverge.
The 4×4 Gram matrix is computed from the deficit vectors within a single snapshot:
The principal eigenvalue
where
Resonance flag:
A binary annotation: when the spectral penalty exceeds the resonance threshold, the system flags the pattern as a probable exploit chain.
Note: The Gram matrix measures concentration of absolute deficiency, not spread around a mean. Parallel deficit vectors (multiple domains weak in the same enabler) → rank-1 Gram → maximal penalty. Orthogonal deficits (each domain weak in a different enabler) → diagonal Gram → near-zero penalty. This is a concentration-of-deficiency detector, not a generic correlation detector.
Why 4×4: The 4th domain is what closes the structural evasion. With 3 domains (3 vectors in ℝ³), an attacker can place 3 mutually orthogonal deficit vectors and produce G = cI, zero penalty, zero detection. With 4 domains, that's geometrically impossible — you cannot place 4 mutually orthogonal vectors in ℝ³. The penalty has no structural blind spot.
Watermelon Index (Primary Diagnostic)
A deception detector that measures the divergence between administrative compliance and operational integrity. It peaks when the rind is green and the flesh is red — the case where checkmark compliance is masking a collapsed operational blueprint. It is zero when the two metrics agree in either direction.
WI is intentionally one-sided. It is a deception detector, not a severity ranker. The honest-failure case (both metrics low) is not deceptive — it is visible in the constituent metrics and caught by the Risk Switch. Flagging it here would dilute the diagnostic's purpose.
Under the Risk Switch floor (
Honest Failure Index (Companion Diagnostic)
The companion to the Watermelon Index. Where WI detects deception (compliance high, integrity low), HF detects honest failure (both low, visible, not masked). Together they tile the degraded space: any point where
Identity 1 (Complementary Tiling): For all
This identity provides a free check for unit testing: assert
HF is not a substitute for reading
Joint Reading:
| WI | HF | Diagnosis |
|---|---|---|
| High | Low | Watermelon — compliance masking failure |
| Low | High | Honest failure — both degraded, visible |
| Low | Low | Healthy — integrity intact |
Note: The WI/HF boundary is at
| Condition | Status |
|---|---|
| CRITICAL_RISK_SWITCH_TRIGGERED | |
| NOMINAL |
The status threshold (0.20) is wider than the breaker threshold (0.05): a system can be flagged CRITICAL without any single cell tripping the breaker, if the aggregate integrity is sufficiently degraded.
Note: Only two states by design: the consulting narrative is binary ("are we critical or not?"). A third tier would dilute the decision. If you need granularity, read
├── .github/workflows/ <-- CI Automation pipeline validations // planned
├── integrity-adapters/ <-- See note below
├── src/
│ ├── components/
│ │ └── Footer.astro
│ ├── config/
│ │ └── tenants.ts <-- Generic, auditable KV lookup logic. Actual tenant records
│ │ (domains, tenant IDs, endpoints) are never committed here —
│ │ they live in the private VM_TENANT_DIRECTORY KV namespace.
│ ├── layouts/
│ │ └── BaseLayout.astro
│ ├── lib/
│ │ └── scoring-engine.ts <-- Pure computation. No I/O, no side effects, zero-persistence.
│ │ Liftable into a separate authoritative Worker unchanged.
│ ├── middleware.ts <-- Session verification, role resolution (VoidMetric-controlled allow-list only)
│ └── pages/
│ ├── api/
│ │ ├── register.ts <-- OIDC handshake initiation (PKCE + nonce)
│ │ └── auth/
│ │ ├── callback.ts <-- Token exchange, JWT verification
│ │ └── signout.ts <-- RP-Initiated Logout
│ ├── architecture.astro
│ ├── index.astro
│ ├── integrity-portal.astro
│ └── login.astro
├── workers/
│ ├── ssii-consumer.ts <-- Queue consumer. Zero-payload-persistence: pure compute + structured log.
│ │ No KV, no D1, no Durable Objects. Results are ephemeral.
│ │
│ └── dispatcher.ts <-- Consumes posture change events / reads posture cache for context
│
├── astro.config.mjs
└── wrangler.jsonc
integrity-adapters/— Download here for independent VoidMetric deployment or running only a specific open-source platform adapter.
(Note: an earlier register.astro UI page has been superseded — login.astro now submits directly to api/register.ts. See open items in project tracking for its final disposition. Project structure is being reconsidered and any changes should appear in the public repository immediately.)
- Core: The centralized orchestration engine scoping roles, handling baseline policy, risk calculations and compliance rules.
- Dedicated Executive Window: Strategic, high-fidelity business impact console displaying financial loss modeling, legal/PR playbooks and risk indexes.
- Dedicated Technical Window: Deep-dive operating window for security posture, infrastructure conditions, application/live code vulnerabilities and system-level mitigation controls.
- CREM / CTEM Center: Fully open, business-aligned framework handling security intelligence, continuous risk and threat exposure management.
- UI Overrides: Automated dashboard redlining and screen-takeovers that inject incident maps during a crisis.
- Audio Klaxons: Low-frequency, pulsing acoustic cues and automated browser-based text-to-speech voice notifications.
- Cross-Device Notification: Simultaneous multi-channel blast dialing, text pushes, and mobile system-level audio bypasses.
Computation runs asynchronously via a Cloudflare Queue. The consumer receives a pre-normalized, blinded 12-node telemetry stream, executes the scoring engine in memory, and emits a structured log. No metric data is persisted — no KV, no D1, no Durable Objects. Results exist only in the log stream.
{
"type": "signal_update",
"tenantId": "acme-corp",
"paddedStream": [
{ "maskedValue": 0.95, "row": 0, "col": 0, "lastTelemetryHeartbeat": 1754899200 }
],
"threatIntelVector": [0.0, 0.0, 0.0],
"timestamp": 1754899200
}{
"metric_a_compliance": 0.8438,
"metric_b_integrity": 0.0150,
"status": "CRITICAL_RISK_SWITCH_TRIGGERED",
"watermelon_index": 0.8288,
"honest_failure_index": 0.0150,
"row_validations": [0.9331, 0.9164, 0.0000, 0.9167],
"spectral_analysis": {
"chaos_index_penalty": 0.03211,
"principal_eigenvalue": 1.20441,
"resonance_exploit_chain_detected": false
}
}The compute pipeline processes pre-normalized, blinded telemetry nodes only — it never receives a raw SIEM finding or credential directly.
- Isolated Service Processing Units: For enterprise and sovereign customers connecting active identity providers (Okta, Microsoft Entra ID, Ping Identity) alongside security intelligence APIs and active logging environments (Tenable, Microsoft Sentinel, CrowdStrike, AWS CloudTrail):
Data ingestion, identity token exchange, string parsers, normalization functions (
Tenant identity records (domains, Azure/Okta/Ping tenant IDs, IdP endpoints) are stored exclusively in a private Cloudflare KV namespace, populated out-of-band during customer onboarding, and are never committed to this public repository. The lookup logic that queries this data is open for audit; the records it queries are not.
Engineered as a Stateless, Zero-Persistence, Edge-Native, Non-Linear Operational Validation Engine, the compute pipeline itself processes telemetry in real-time fluid memory without writing metric data to disk. A narrow, explicitly-scoped exception exists for tenant onboarding-status tracking — a small key-value store holding only onboarding-completion flags and invite lists per tenant domain. This is control-plane bookkeeping, not telemetry storage, and holds no metric values, raw signals, or credentials.
This guarantees that your enterprise credentials — SIEM/webhook tokens, IdP client secrets, tenant identity records, and platform role assignments — never enter the public codebase and are isolated within private, non-public runtime data stores and service boundaries, while the compute engine's own math, the federation protocol logic, and the role-based access model remain fully open for audit.
(A stronger, cryptographic-at-rest guarantee for this isolated data is a planned follow-up, not yet implemented — this document will be updated when that lands.)