🖥️ VGT WP-Desk — Operator OS for WordPress

"WordPress stays WordPress. The operator gets a hardened OS above it."
AGPLv3 — Local-first, framework-free and built for operators, not SaaS dashboards.

⚠️ V2 BETA TESTSYSTEM // STABLE RELEASE (v2.0.0)

VGT WP-Desk v2.0.0 is an Operator OS for WordPress powered by the GeDefense v8.0.0 Sovereign Security Fabric. This release represents the V2 Beta Test System marked as stable and engineered to the DIAMANT VGT SUPREME standard.

Found a bug or have an improvement suggestion? Open an issue or contact our team.

🔐 Security Posture

VGT WP-Desk v2.0.0 has undergone an exhaustive security posture and integrity review covering:

• The multi-window desktop runtime & RAM hibernation layers
• Native GeDefense v8.0.0 19-module kernel integration
• ThroneGuard Master role & capability isolation
• LoginPager sovereign authentication surfaces
• AJAX typed exception hierarchies (SecurityException, ValidationException, StorageException)
• Single-owner Frame Policy (WPDeskFramePolicy) preventing clickjacking and header stacking
• Zero external CDN dependencies & 100% same-origin isolation

Within the reviewed scope, no exploitable vulnerabilities were identified during the performed tests and review.

See: SECURITY_POSTURE.md

🔍 What is VGT WP-Desk?

VGT WP-Desk is a modular, zero-dependency WordPress Operator OS — an OS-style desktop layer that sits above WordPress and provides a unified control plane, hardened portal, multi-window workspace, and sovereign security matrix across every WordPress admin surface.

WordPress remains WordPress. Core and third-party plugin interfaces are untouched. WP-Desk provides the operating layer on top: multi-window workspace, persistent per-user desktop state, same-origin iframe isolation, unified Security Center, Build Center, Design System, and a hardened Frame Policy — all running without CDN calls, without build pipelines, without external runtimes.

Engineered under the Zero-Overheat Doctrine: vanilla JavaScript, PHP, and CSS only, served locally from the WordPress installation.

Classic WordPress Admin:
→ Fragmented sidebar navigation
→ Context-switching overhead
→ No persistent workspace state
→ Limited operational visibility
→ Inconsistent UI across modules
→ Vulnerable admin surfaces

VGT WP-Desk V2 Operator OS:
→ OS-style multi-window desktop for WordPress
→ Powered by GeDefense v8.0.0 Sovereign Security Kernel (19 Modules)
→ ThroneGuard Master boundary (14 toxic capabilities stripped)
→ LoginPager Cyberpunk auth surface & live preview cockpit
→ Per-user opt-in with classic admin fallback (?vgt_bypass=1)
→ Hook-preserving iframe workspace (IframeTransformer)
→ Automatic plugin-to-app mapping & Submenu popups
→ Folder Mode, layouts, widgets, and persistent state
→ Command Center for real-time diagnostics and runtime operations
→ VGT Build Center unifying Omega Vault, Chronos, and Book Reader
→ Unified Design System across all admin surfaces
→ Frame Policy + Portal Hardening (single-owner SAMEORIGIN / DENY)
→ Recovery Control Plane outside desktop
→ Classic Mode for incompatible screens (Customizer, Page Builders)
→ Sovereign telemetry without third-party tracking (Dattrack)
→ Local AI reasoning via VGTAstra
→ Zero-CDN, zero-build, zero-framework runtime

🏛️ Architecture

WordPress Admin Request
↓
Heuristic Session Detection (PHP Engine)
→ URL indicator: vgt_iframe=true
→ Sec-Fetch-Dest: iframe header
→ HTTP Referer analysis on form submissions
↓
GEDEFENSE v8.0.0 OPEN CORE SECURITY KERNEL (19 Modules)
→ ZEUS: Early pre-boot environment & execution shield
→ AEGIS WAF: 5-layer input normalization, stream inspection & anomaly scoring
  • Admin/editor exemption: SQLi/XSS weights zeroed; RCE/LFI active
  • WAF exception: edit_posts + post.php / edit.php / wp-json REST endpoints
→ CERBERUS: L0/L1 perimeter ban matrix before WordPress core boot
→ PROMETHEUS AI: Heuristic threat correlation & classification
→ TRINITY GRID: Cryptographic integrity verification & defense mesh
→ MORPHEUS RASP: Runtime application self-protection (SQL, code execution, path jail)
→ NEMESIS DECEPTION: Active honeypot decoys & tarpit engines
→ TITAN HARDENING: Strict security headers (XFO, CSP, COOP, COEP, CORP, HSTS) & 0700/0600 file perms
→ HADES: Path obfuscation, login cloaking & iframe continuity enforcement
→ AIRLOCK: Multipart/form-data binary & upload inspection (MIME finfo, SVG vector scan, traversal checks)
→ GHOST TRAP: Tarpit honeypots for bots & automated scanners (instant hard-ban)
→ STYX: Outbound egress shield & data exfiltration prevention
→ CHRONOS: Malware scanning engine & file integrity quarantine store
→ KEY VAULT: Argon2/Bcrypt superkey & cryptographic token vault
→ ORACLE AUDIT: Real-time forensic logging & audit trail
→ MODULE REGISTRY: Sovereign module manifest validation
→ THRONEGUARD MASTER: 14 toxic capabilities stripped from Administrator → Master exclusive
→ LOGINPAGER GATEWAY: Zero-dependency Cyberpunk login customization & live preview
↓
V2 Control Plane
→ WPDeskFramePolicy     ← single-owner X-Frame-Options, admin/embed → SAMEORIGIN, frontend → DENY
→ WPDeskIframePolicy    ← per-app classic vs. iframe routing (Builder/Customizer → classic tab)
→ WPDeskWidgetLayout    ← widget position validation + normalization (full-replace + localStorage)
→ WPDeskDesignSystem    ← shared tokens + components + compat across all admin surfaces
→ Module Registry       ← clean boot of integrated modules (GeDefense, Omega Vault, Chronos, Dattrack, Astra)
→ Pure Test Suite       ← control plane tests without full WP boot (frame / widgets / design / harden)
↓
Modular PHP Kernel
→ desktop.php             ← lightweight bootstrapper / loader only
→ WPDeskSettings          ← DB schema, settings tables; widget_positions as full-replace
→ WPDeskAppBuilder        ← admin portal URLs enforced; front-URLs → new tab
→ WPDeskPlugin            ← central controller: hooks, assets, AJAX dispatch, iframe rules
↓
Per-User Opt-in Check
→ Desktop mode off by default
→ Admin notice in classic backend → explicit per-user activation
→ vgt_bypass=1 cookie → classic view for session
↓
IframeTransformer + CSP Nonce Bridge
→ CSS-Grid injection into native WordPress list tables (Posts, Pages, Comments, Plugins)
→ 100% hook preservation (SEO columns, custom fields intact)
→ Portal Card Layout v2 + filemtime cache-bust
↓
Desktop Engine (9 Modules, Zero-Overheat)
→ core → windows → draggable → icons → menus → widgets → spotlight → modals → folders
→ VGTDeskEngine singleton — modules extend via Object.assign
→ WordPress dependency chain guarantees load order
↓
RAM Hibernation Layer
→ Minimized windows: iframe suspended to about:blank (memory freed)
→ Restore: last URL rehydrated from data-suspendedUrl
↓
Persistent Settings (Relational DB)
→ {prefix}vgt_desk_settings — UNIQUE(user_id, setting_key)
→ widget_positions: full-replace + localStorage backup (no delta-merge zombie states)

🛡️ Security Center & GeDefense v8.0.0 Integration

VGT WP-Desk v2.0.0 features a completely overhauled Sicherheits-Center (VGTSecurityCenter) wired directly to the GeDefense v8.0.0 engine.

👑 ThroneGuard Master Boundary

ThroneGuard enforces a strict cryptographic boundary between ordinary WordPress Administrators and the Master Sovereign User:

• 14 Toxic Capabilities Stripped from Administrator: edit_plugins, activate_plugins, delete_plugins, install_plugins, update_plugins, edit_themes, install_themes, switch_themes, delete_themes, update_themes, edit_users, delete_users, create_users, promote_users.
• Hardware Deactivation Lock: Prevents disabling security plugins from the standard admin panel.
• Superkey Verification: Argon2/Bcrypt hashed master password required to unlock the Master Enclave.
• SHA256 HMAC Session Fingerprinting: IP and User-Agent cryptographically bound to the active session.

🎨 LoginPager Gateway

A modern, zero-dependency login customization engine embedded directly into GeDefense v8.0.0:

• Cyberpunk Glassmorphism UI: Frosted glass login card, glowing focus borders, cybernetic button styling.
• 2-Column Live Preview Cockpit: Interactive settings pane on the left, real-time simulated browser mockup on the right.
• 5 Color Presets: Cyber Cyan, Emerald Matrix, Purple Haze, Apex Gold, Crimson Core, plus custom hex color pickers.
• Zero External Dependencies: Built with pure CSS3 and Vanilla JS.

🧩 VGT Studio & Ops Modules

VGT WP-Desk integrates 5 sovereign tools directly into the Operator OS:

1. 🔐 VGT Omega Vault: AES-256-GCM encrypted form builder with drag-and-drop field designer and secure Com-Link vault.
2. 📖 VGT Book Reader: Embedded, zero-dependency PDF and digital book reader engine.
3. ⏳ VGT Chronos: Dynamic campaign timing, countdown builder, and scheduled page triggers.
4. 📊 VGT Dattrack: Privacy-focused local analytics engine with zero cloud telemetry.
5. 🧠 VGTAstra AI: Zero-dependency WordPress AI assistant with Groq reasoning pipelines for Gutenberg and backend assistance.

🎨 Design System

A unified, token-based design system across all 12 modules and admin surfaces:

assets/css/design-system/
├── tokens/        ← brand colors, spacing, radii, shadows
├── base/          ← resets, typography, scrollbars
├── components/    ← buttons, cards, badges, panels, tabs
└── compat/        ← WordPress admin override shims

Coverage — all modules on shared tokens: Security Center, GeDefense Suite, ThroneGuard, LoginPager, Recovery, Dattrack, Omega Vault, Book Reader, Chronos Builder, VGTAstra, Desktop Shell, and Portal Iframe.

🖼️ Portal & Iframe Hardening

• Frame Policy (WPDeskFramePolicy): Single-owner XFO policy (SAMEORIGIN for admin/embed, DENY for public frontend). Eliminates header stacking conflicts.
• Iframe Policy (WPDeskIframePolicy): Automatic classic-tab routing for incompatible tools (Customizer, Page Builders).
• Portal URL Resolution: Enforces admin portal URLs; external/front links open in a new tab.
• Portal Card Layout v2: Cache-busted via filemtime. Badge shown only on list screens (Posts, Pages, Comments, Plugins).
• Full-Bleed App Windows: 100vh sidebar, zero admin-bar 32px offset overlap.

🔒 Recovery Control Plane

Accessible outside the desktop shell via ?vgt_bypass=1 or the Tools menu:

🧩 Feature Matrix