WP Manifestindependent plugin directory
manifest / users / xophz-compass-polos

Xophz POLOS WP RegistryHigh-severity findings · 6 findingsOpen the reportD

Multi-scale fractal consensus engine with quadratic voting, liquid proxy delegation, Circle Web-of-Trust, and federated w4 cross-node governance.

by Hall of the Gods, Inc. · github.com/hallofthegods/xophz-compass-polos · website

★ 0stars
8release downloads
v26.9.21latest · 1mo ago

Install

Download xophz-compass-polos-26.9.21.zip From the v26.9.21 release on GitHub, Sep 22, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hallofthegods/xophz-compass-polos/releases/download/v26.9.21/xophz-compass-polos-26.9.21.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/hallofthegods/xophz-compass-polos ↗

Xophz POLOS (xophz-compass-polos)

Category: Command Deck · Group: Governance · Version: 26.5.1

A multi-scale fractal consensus engine with quadratic voting, liquid proxy delegation, Circle Web-of-Trust (WoT), and federated w⁴ cross-node governance for COMPASS and YouMeOS.

Description

Xophz POLOS (Greek Pólos, the celestial axis and True North pivot) enables collective decision-making across scales: from the sovereign individual to student pods, university faculties, municipal townships, and planetary networks.

It operates on WordPress primitives with high-performance REST APIs, supporting quadratic credit voting (cost = votes^2) to resist plutocratic influence, dynamic governance circles, and peer vouching.

Core Capabilities

  • Quadratic Credit Voting: Mathematical power scaling where voice credit expenditure equals votes squared, ensuring balanced community governance.
  • Liquid Proxy Delegation: Topic-specific proxy voting delegation enabling specialists to vote on behalf of community members.
  • Fractal Scopes: Scoped decision-making rings spanning Sovereign Self, Circle / Pod, Guild, and Polis (Local Node).
  • Circle Web-of-Trust: Dunbar-scale peer attestation matrix anchoring human uniqueness without centralized identity collection.
  • Federated w⁴ Mesh: Cross-node consensus sync and cryptographic Merkle tallies without centralized PII storage.

Requirements

  • WordPress 5.8+, PHP 7.4+
  • Compatible standalone or bundled with Xophz COMPASS

REST API Endpoints (/wp-json/xophz-compass-polos/v1)

Method Route Description
GET /scopes Retrieve active governance circles and scopes
POST /scopes Create a new fractal governance scope
GET /ballots Fetch active ballots and proposals
POST /ballots Publish an initiative or ballot
POST /vote Submit quadratic vote payload and burn nullifier
GET, POST /delegates Retrieve or assign liquid delegation proxies
POST /vouch Record peer trust vouch for Circle Web-of-Trust
GET /stats Retrieve node telemetry, average quorum, and credit metrics
POST /federation/handshake Ingest w⁴ asymmetric key handshakes
POST /federation/sync-tally Ingest Merkle-verified quadratic tallies
GET, POST /federation/peers Manage trusted remote peer nodes

License

GPL-2.0+

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v26.9.21 latest
Sep 22, 2026 1mo ago
xophz-compass-polos-26.9.21.zip
2
v26.9.22
Sep 22, 2026 1mo ago
xophz-compass-polos-26.9.22.zip
0
v26.9.4
Sep 5, 2026 1mo ago
xophz-compass-polos-26.9.4.zip
5
v26.9.5
Sep 5, 2026 1mo ago
xophz-compass-polos-26.9.5.zip
1
D grade

Security

Xophz POLOS 26.9.21-627 · audited by WP Registry

High-severity findings.

4 high 2 medium
Audited release
26.9.21-627
Findings
6
Worst severity
high
Content hash
e6ae24c5d2ab7e485e75f179…

Findings

  • high Unauthenticated federation handshake writes peer nodes to database

    missing_permission_callback

    POST /wp-json/xophz-polos/v1/federation/handshake uses permission_callback __return_true and handle_federation_handshake() performs $wpdb->replace into polos_nodes with attacker-controlled node_id, endpoint_url, and public_key. Any visitor can inject federation peers without authentication or signature verification.

    includes/class-xophz-compass-polos-api.php:89-96

    Recommendation

    Require signed handshake (shared secret/HMAC) or manage_options; validate peer keys before writing polos_nodes.

  • high Unauthenticated federation sync-tally accepts attacker tallies

    missing_permission_callback

    POST /federation/sync-tally is public (__return_true) and stores tallies/merkle_root in a site transient for 30 days. Unauthenticated callers can poison federated vote tallies used by the governance UI.

    includes/class-xophz-compass-polos-api.php:98-105

    Recommendation

    Authenticate peer nodes (signed requests) before accepting tallies; verify merkle proofs against trusted peers.

  • high Unauthenticated federation handshake writes peer nodes to database

    missing_permission_callback

    POST /wp-json/xophz-polos/v1/federation/handshake uses permission_callback __return_true. handle_federation_handshake accepts node.node_id, w4_address, public_key, and metadata and $wpdb->replace()s into polos_nodes as status=active. The request auth parameter is parsed into $auth but never validated. An unauthenticated visitor can register arbitrary peer endpoints into the federation table.

    includes/class-xophz-compass-polos-api.php:88-528

    Recommendation

    Require shared-secret/HMAC verification of peer identity (use $auth), or gate with manage_options / a pre-shared federation key. Reject unknown nodes by default.

  • high Unauthenticated federation sync-tally accepts attacker tallies

    missing_permission_callback

    POST /federation/sync-tally is also __return_true. handle_federation_sync_tally stores initiative_id, node_id, tallies, and merkle_root into a 30-day transient without verifying the peer signature or merkle proof. Unauthenticated attackers can poison federated vote aggregations.

    includes/class-xophz-compass-polos-api.php:97-560

    Recommendation

    Authenticate peer sync with the registered public key / shared secret, verify merkle_root against votes, and reject sync from unregistered node_ids.

  • medium Any logged-in user can create governance scopes

    missing_capability

    POST /scopes uses check_user_auth() which only requires is_user_logged_in()/read. create_scope() inserts into polos_scopes with no manage_options gate, so Subscribers can create fractal governance scopes.

    includes/class-xophz-compass-polos-api.php:20-30

    Recommendation

    Restrict scope/ballot creation to manage_options or a dedicated polos_manage capability.

  • medium Any logged-in user can create governance scopes

    missing_capability

    POST /scopes uses check_user_auth which returns true for any logged-in user (including Subscriber). create_scope inserts into polos_scopes with attacker-controlled name/parent_id/scope_type/quorum_threshold. Governance structure can be manipulated by low-privilege accounts.

    includes/class-xophz-compass-polos-api.php:26-211

    Recommendation

    Require a dedicated capability (e.g. manage_options or a custom polos_manage_scopes) for scope/ballot creation.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →