The Win32 bridge found running on the investigation machine (documented at
wdag-bridge) and the clean-room reconstruction
(Genesis.Phantom) share an IPC contract. A subsequent implementation,
autoShell, was built using the same contract with the surveillance
and injection capabilities replaced by a typed action schema.
The contract is an independent interoperability surface: any implementation
that speaks it can communicate with any other — governed or ungoverned,
original or reconstruction.
The IPC wire contract was characterized as part of the July 31, 2026 capability
classification session (session 91b1185c), which compared Phantom_fresh.zip
against the autoShell implementation:
win32-bridge.exe with the surveillance and
injection P/Invoke surface removed and replaced by a governed typed action schema —
same IPC contract character for character, same dispatch pattern, same wire format,
different capability surface. The distance between them is not architectural.
It's a P/Invoke import list."
Three properties are identical across implementations:
What differs is the P/Invoke import list — the Win32 functions called once a
dispatch reaches a handler. In the original and Phantom, these include UIAutomation,
SendMessage/PostMessage, and HvSocket functions. In autoShell,
these are replaced by typed action handlers (audio, network, Bluetooth, theme,
wallpaper, service management, screen resolution, virtual desktops) behind
IActionHandler interfaces.
Because the wire format is identical, any client that can speak the protocol can connect to either a governed (autoShell) or ungoverned (Phantom / original) endpoint. Authentication is at the transport level — the pipe — not at the protocol level. A process that has pipe access and speaks the contract can invoke whatever capability the listening implementation exposes, without distinguishing which implementation is running.
| Implementation | Wire format | Dispatch pattern | Capability surface | Auth |
|---|---|---|---|---|
| Original (found deployed) | Identical | Identical | UIAutomation, SendMessage, HvSocket, WDAGBridge | Pipe ACL |
| Genesis.Phantom (reconstruction) | Identical | Identical | Same as original — clean-room reimplementation | Pipe ACL |
| autoShell (governed) | Identical | Identical | Typed action schema — IActionHandler interfaces, no raw P/Invoke | Pipe ACL |
The win32-bridge.zip analyzed in session 06a5ab87 used the same contract.
Six files were byte-for-byte identical to Phantom. The modifications removed
only the WDAG/HvSocket capability layer — the wire format, dispatch pattern, and
core P/Invoke surface (UIAutomation, message injection, isolated desktop) were retained.
A client speaking the contract against win32-bridge.zip would receive the same
protocol responses as against Phantom for the retained capabilities.
The autoShell implementation demonstrates that governance of the Win32 bridge
surface is achievable: the contract is preserved, the dispatch layer is preserved,
and the capability surface is constrained at the handler layer. This is the design
of Genesis.Phantom — the IActionHandler interface boundary
separates the transport (shared contract) from the capability (implementation-defined).
The governance boundary holds only if the implementation running behind the pipe is the governed one. The contract itself provides no governance signal: a client cannot distinguish, from the wire format alone, whether it is talking to autoShell or to the original ungoverned implementation.