1. Executive Summary

Coclico is an enterprise-grade Windows system management platform that combines real-time monitoring, workflow automation, deep system cleaning, and fully local artificial intelligence into a single, self-contained desktop application. Built on .NET 10 with the C# preview language version and the WPF-UI 4.2 design system, Coclico operates entirely offline -- executing all AI inference, telemetry analysis, and autonomous optimization on the local machine without any cloud dependency.

At its core, Coclico implements a continuous autonomous loop: Observe (telemetry collection via DynamicTracer with EWMA and Isolation Forest anomaly detection), Analyze (LLM-based cognitive decision-making backed by Roslyn AST analysis), Act (AutoPatcher for validated code modifications, QoS priority adjustments), and Validate (Digital Twin simulation ensuring cyclomatic complexity never increases). This loop executes every 30 seconds through a lock-free 3-stage pipeline built on System.Threading.Channels.

Version 1.0.4 (March 2026) represents a fully operational release across all architectural phases: dual-context LLamaSharp inference, Roslyn-powered source analysis with Halstead metrics, DPAPI-encrypted rollback snapshots, enterprise security policy enforcement, NDJSON audit trails with AI decision traceability, and a 28-node visual workflow automation editor.

2. General Overview

Coclico addresses the need for a comprehensive, privacy-first Windows system management tool that consolidates capabilities typically spread across dozens of separate utilities: process monitoring, application inventory, automated workflows, disk cleanup, memory optimization, software installation, and AI-assisted system administration.

Design Principles

• Zero Cloud -- All data, inference, and telemetry remain on the local machine. No network calls are made for AI functionality.
• Isolation -- The UI thread never directly invokes AI/LLM operations. All long-running work passes through service abstractions.
• Rollback Safety -- Every file write triggered by the autonomous core is preceded by a DPAPI-encrypted snapshot.
• Immutability -- DTOs, telemetry snapshots, and metric records use C# record types for thread-safe, allocation-efficient data flow.
• Digital Twin Gate -- AI-proposed code patches are validated against a weighted multi-metric model (CC, Halstead V/D/E, Maintainability Index) before any disk write.
• Administrator Elevation -- The application enforces UAC elevation at startup, required for WMI queries, process priority manipulation, and kernel-level memory operations.

Supported Languages

The application UI ships with 10 runtime-switchable localizations: French, English, German, Spanish, Italian, Japanese, Korean, Portuguese, Russian, and Chinese. Language changes take effect immediately without restarting the application.

3. Technical Architecture

3.1 Technology Stack

Compiler & Runtime Optimizations

The project file activates several .NET 10 performance features:

• TieredPGO=true -- Profile-Guided Optimization with tiered recompilation for hot methods.
• TieredCompilation=true -- Rapid startup via Tier-0 JIT, background promotion to optimized Tier-1.
• OptimizationPreference=Speed -- Compiler preference for execution speed over code size.
• ConcurrentGarbageCollection=true -- Background GC on dedicated threads to minimize UI pauses.
• ServerGarbageCollection=false -- Client-mode GC optimized for desktop workstation latency profiles.

3.2 Application Lifecycle

Shutdown Sequence

The App.OnExit method performs orderly disposal in a fixed sequence: ResourceGuard stop and dispose, ThemeService dispose, AiChatService dispose (unloading the LLM model), ProcessWatcher dispose, NetworkMonitor dispose, DynamicTracer final flush-to-disk, and finally ServiceContainer.Shutdown() which disposes the underlying IServiceProvider and calls Log.CloseAndFlush(). Each disposal step is independently try-caught to ensure subsequent services are still properly released.

3.3 Dependency Injection Container

The DI container is managed by ServiceContainer, a static wrapper around a Lazy<IServiceProvider> initialized with LazyThreadSafetyMode.ExecutionAndPublication. This guarantees exactly-once initialization across all threads.

Service Registration Categories

API Surface

• ServiceContainer.GetRequired<T>() -- Returns the required service or throws InvalidOperationException.
• ServiceContainer.GetOptional<T>() -- Returns the service or null if not registered.
• ServiceContainer.CreateScope() -- Creates a new DI scope for scoped service resolution.
• ServiceContainer.Shutdown() -- Disposes the provider and flushes Serilog; replaces the lazy with a throwing sentinel.

3.4 MVVM Pattern & UI Architecture

Coclico follows the Model-View-ViewModel (MVVM) pattern using CommunityToolkit.Mvvm 8.4.0. Views are defined in XAML under the Views/ directory, with corresponding ViewModels in ViewModels/. Services are injected into ViewModels via constructor injection.

View-ViewModel Mapping

All UI-thread updates from background services use Dispatcher.InvokeAsync. The application explicitly sets the WPF animation frame rate to 60 FPS via Timeline.DesiredFrameRateProperty metadata override, and configures the minimum thread pool size to match Environment.ProcessorCount for optimal throughput.

3.5 Performance Tuning

• GC Latency -- GCSettings.LatencyMode is set to SustainedLowLatency at startup, dynamically adjusted by ResourceGuard between Interactive and SustainedLowLatency based on pressure levels.
• LOH Compaction -- Under Critical pressure, GCLargeObjectHeapCompactionMode.CompactOnce is engaged for the next GC cycle.
• ArrayPool -- The audit log reader uses ArrayPool<byte>.Shared for buffer allocation during reverse-reading of NDJSON files, avoiding GC pressure.
• FrozenSet -- Security policy patterns, program blacklists, and critical process lists use FrozenSet<string> for O(1) amortized lookup with zero ongoing allocation.
• SearchValues -- The installed programs blacklist uses SearchValues<string> for hardware-accelerated string matching on .NET 10.
• Channel-based Pipeline -- The OptimizationEngine uses BoundedChannelOptions with DropOldest policy, SingleReader=true, SingleWriter=true for lock-free inter-stage communication.
• TDigest -- Streaming quantile estimation (Dunning & Ertl 2019) for P95 latency computation without sorting the entire sample array.

4. Functional Modules

Coclico exposes eight primary functional modules via a left-sidebar navigation. Each module is implemented as a WPF UserControl with dedicated service layer support. All long-running operations are routed through FeatureExecutionEngine.RunFeatureAsync, which provides circuit-breaker semantics, lifecycle tracking, and telemetry recording.

4.1 Dashboard

The Dashboard provides a real-time overview of the host machine's health, refreshed every 3 seconds. All metrics are collected via P/Invoke (GlobalMemoryStatusEx) and WMI queries without any external process spawning.

Displayed Metrics

4.2 Applications

The Applications module maintains a comprehensive inventory of all software and games installed on the system. It aggregates data from eight distinct sources, each requiring a dedicated detection algorithm:

Features

• Double-click to launch any application directly.
• Rename applications (persisted in custom_apps_data.json).
• Change application category assignment.
• Manually add executables not detected by automated scanning.
• Filter and search across all sources.
• 6-hour in-memory cache for performance; manual refresh available.
• Intelligent blacklist filter using SearchValues<string> to exclude drivers, runtimes, SDKs, and other non-user-facing entries.

4.3 Flow Chains

Flow Chains is a visual drag-and-drop automation editor that allows users to construct complex multi-step workflows. Chains are persisted as JSON in %AppData%\Coclico\flow_chains.json and can be triggered manually, via global hotkeys (Ctrl+(Alt+)Key), or on automatic intervals.

Node Types (28 total)

Condition Operators (10 total)

Error Handling

Each PipelineStep supports an OnErrorAction enum controlling failure behavior:

• ContinueNext (default) -- Skip the failed step and proceed to the next.
• StopChain -- Halt the entire chain immediately.
• SkipToEnd -- Jump to the End node, bypassing all remaining steps.

Additionally, each step supports configurable RetryCount (0--10) and TimeoutSeconds parameters for resilient execution.

4.4 Quick Installer

The Quick Installer provides a graphical interface to the Windows Package Manager (Winget), enabling one-click installation of curated software packages without requiring command-line interaction.

Software Categories

• Internet -- Browsers, VPN clients, communication tools
• Runtimes -- .NET, Visual C++ Redistributable, Java
• Development -- IDEs, Git, Docker, compilers
• Gaming -- Game launchers, streaming tools
• Creation -- Media editors, design tools
• System -- Utilities, archivers, disk tools

The Winget scope (Machine or User) is configurable via Settings. Software definitions are loaded from an embedded software_list.json resource that ships with the application.

4.5 System Cleaning

The Cleaning module provides both a standard Windows Disk Cleanup integration and a proprietary deep cleaning engine. Before execution, the engine estimates the recoverable space per category.

Cleaning Categories (10 total)

The deep cleaning mode performs iterative, multi-pass deletion with retry logic for locked files. Results include per-category byte counts, file deletion counts, and elapsed time. The Windows Disk Cleanup utility (cleanmgr.exe) is launched as a separate elevated process with BelowNormal priority to avoid impacting system responsiveness.

4.6 Scanner

The Scanner module performs a comprehensive audit of all installed applications, producing a detailed inventory with the following fields per application: name, version, publisher, estimated size, installation path, detection source, and installation date. Results are sortable and filterable. The scanning process uses the same multi-source detection engine as the Applications module (Section 4.2).

4.7 RAM Cleaner

The RAM Cleaner module provides kernel-level memory optimization through direct Windows API calls via P/Invoke. It displays real-time RAM statistics (physical used/total, virtual commit charge, pagefile size) and offers manual or automated cleaning.

P/Invoke API Surface

Memory Operations

The following kernel-level operations are performed via NtSetSystemInformation:

• Empty Working Sets (SystemMemoryListInformation, command 2) -- Trims the working set of all processes.
• Flush Modified List (command 3) -- Writes dirty pages to the pagefile.
• Purge Standby List (command 4) -- Frees cached standby pages.
• Purge Low-Priority Standby (command 5) -- Frees priority-0 standby pages only.
• Memory Combine -- Deduplicates identical memory pages.
• .NET GC Collect -- Forces a full garbage collection with LOH compaction.
• System File Cache Flush -- Resets the system file cache size limits.
• Pool Non-Paged Cleanup -- Reclaims non-paged pool memory.
• Heap Compaction -- Compacts the process heap via HeapCompact.

Privilege escalation is performed per-operation by acquiring SeDebugPrivilege and SeIncreaseQuotaPrivilege through the AdjustTokenPrivileges API. The automatic mode supports both interval-based triggers and threshold-based triggers (when RAM usage exceeds a configurable percentage).

4.8 AI Assistant

The AI Assistant is an in-application conversational interface powered by a local GGUF language model. It provides contextual help across all Coclico modules, answering user questions about features, guiding step-by-step through complex operations, and adapting its response language to match the user's input language. The assistant is described in full technical detail in Section 5.

5. Local AI Engine

Coclico implements a fully local LLM inference stack using LLamaSharp 0.26, the C# binding for llama.cpp. The engine loads a single GGUF model file (resource/model/IA-support-chat.gguf) and creates two isolated execution contexts from the same model weights. This dual-context architecture eliminates contention between interactive user chat and background autonomous optimization tasks.

5.1 Dual-Executor Architecture

Context Specifications

Immutable Context Swap Pattern

Context reset is performed without blocking consumers through Interlocked.Exchange:

var newCtx = new ChatCtx(_model.CreateContext(params));
Interlocked.Exchange(ref _chatCtx, newCtx)?.Dispose();

This atomic swap ensures that any in-flight read of _chatCtx completes on the old context while subsequent reads use the new one. The old context is disposed after the exchange. The chat context automatically resets after 6 conversation turns to prevent context window saturation.

Short-Term Memory

The chat executor maintains a sliding window of the last 4 conversation turns (MaxMemoryTurns = 4), summarized into a compact memory block injected at session start. User messages are truncated to 100 characters and AI responses to 150 characters within the memory block to conserve context window budget. After every 6 turns (AutoResetAfterTurns = 6), the context is silently reset with the memory block re-injected to prevent quality degradation.

5.2 Automatic Memory Release

The AI model consumes approximately 2.5 GB of RAM when loaded. To optimize resource usage on machines where the AI assistant is not continuously active, Coclico implements a configurable idle timeout mechanism:

1. After each inference operation (chat or engine), a timer is reset to the configured idle period (default: 5 minutes).
2. When the timer fires, OnIdleTimeout executes with Interlocked.CompareExchange guard to prevent concurrent unload attempts.
3. The unload sequence acquires all three semaphores (_initLock, _chatSem, _engineSem) in order, then disposes both contexts and the model weights.
4. A forced GC collect is triggered via MemoryCleanerService.ForceGcCollect() to immediately reclaim the freed native memory.
5. On the next user interaction, InitializeAsync transparently reloads the model with the same GPU-first, CPU-fallback strategy.

5.3 Retrieval-Augmented Generation (RAG)

The AI assistant is augmented with a local RAG pipeline implemented in RagService. At startup, all Markdown files in resource/docs/ are indexed using a hybrid scoring system:

Indexing Pipeline

1. Chunking -- Documents are split at Markdown headers (#{1,3}). Each chunk retains its section title as metadata. Chunks smaller than 40 characters are discarded.
2. Tokenization -- Text is lowercased, split on non-word boundaries (including accented characters), filtered through a stop-word list, and stemmed using a custom SimpleStemmer.
3. TF-IDF Vectorization -- Term Frequency (TF) and Inverse Document Frequency (IDF, BM25 variant) vectors are computed per chunk. The IDF formula uses the BM25 smoothing: log((N - df + 0.5) / (df + 0.5) + 1).
4. Pre-computed Norms -- Cosine similarity norms are pre-computed at index time to avoid runtime square-root operations.

Search Pipeline

At query time, the RAG engine applies a dual-score ranking:

• BM25 Score (60% weight) -- Okapi BM25 with parameters k1=1.5, b=0.75, normalized against the maximum BM25 score in the corpus.
• Cosine Similarity (40% weight) -- TF-IDF cosine similarity between the query vector and each chunk vector.

The top-K results (default K=2, max 350 characters total) are injected into the LLM prompt as a [Doc] context block, positioned between the system prompt and the user message.

5.4 Inference Parameters

The engine context uses significantly lower temperature (0.1) and top-K (10) to produce deterministic, parseable JSON output. The chat context uses slightly higher creativity parameters for natural conversational responses.

6. Autonomous Core

The autonomous core represents Coclico's self-governing optimization subsystem. It continuously monitors system health, analyzes code quality, and applies validated improvements through a multi-stage pipeline with comprehensive safety gates. The core loop follows the Observe-Analyze-Act-Validate pattern described in the architecture vision.

6.1 OptimizationEngine -- 3-Stage Pipeline

The OptimizationEngineService implements a lock-free, channel-based pipeline that executes every 30 seconds. The pipeline uses three concurrent Task stages communicating through bounded channels with DropOldest semantics.

Stage 1: Collect

Gathers system metrics using MemoryCleanerService and DynamicTracerService:

• CPU utilization percentage
• RAM usage (MB used, MB total, percentage)
• Top 5 processes by working set memory
• MemoryCleaner P95 latency from TDigest
• EWMA anomaly detection via Isolation Forest

Stage 2: Decide

If the AI model is loaded, the engine constructs a JSON-structured prompt containing the serialized SystemMetrics record plus optional hotspot context from the SourceAnalyzer. The LLM is instructed to respond exclusively in JSON with a fixed schema:

{
  "ProcessId": 1234,
  "ProcessName": "chrome",
  "TargetPriority": "BelowNormal",
  "Reason": "...",
  "RcaSummary": "Root cause analysis...",
  "NoAction": false
}

If the AI is unavailable or fails, the engine falls back to a deterministic scoring algorithm using AdaptiveScorer. The scorer computes a weighted sum of normalized CPU, RAM, disk I/O, and history features with self-adjusting weights:

score = wCPU * cpuScore + wRAM * ramScore + wDisk * diskScore + wHistory * histScore

Default weights: CPU=0.4, RAM=0.3, Disk=0.2, History=0.1. After each ineffective action, weights are adjusted (CPU weight increases, others decrease) and re-normalized to sum to 1.0.

Stage 3: Execute

Parses the JSON response, extracts the action, and applies it through the IResourceAllocator interface. Before any priority change, a rollback snapshot is created. Critical system processes (system, smss, csrss, wininit, winlogon, lsass, services, svchost, explorer, coclico) are protected from priority modification.

Anomaly Detection: Isolation Forest

The IsolationForestDetector implements the Liu et al. (2008) algorithm adapted for streaming data. Configuration: 100 trees, subsample size of 64, anomaly threshold of 0.65. The forest is initially fit after 20 observations and refitted every 50 observations from a rolling buffer of 500 samples. When an anomaly is detected (score > 0.65), per-feature Z-scores are computed to identify which metrics deviate beyond 2 standard deviations.

6.2 SourceAnalyzer -- Roslyn AST Analysis

The SourceAnalyzerService performs static analysis on C# source files using the Roslyn Microsoft.CodeAnalysis.CSharp library (version 4.12.0). It traverses the syntax tree of every .cs file (excluding bin/ and obj/ directories) and computes per-method complexity metrics.

Computed Metrics

Severity Classification

Methods with severity "Low" and fewer than 20 lines are excluded from hotspot reporting to focus attention on meaningful optimization targets. Hotspots are sorted by severity rank (descending), then by cyclomatic complexity (descending).

6.3 Digital Twin (StateValidator)

The StateValidatorService maintains an in-memory index of all C# source files, acting as a "Digital Twin" of the codebase. It performs the following functions:

Indexing

• Parses every .cs file using Roslyn and records per-file snapshots with SHA-256 hashes (first 16 hex characters).
• Implements incremental indexing: files whose hash matches the cached value are skipped, avoiding redundant reparsing.
• Stale files (deleted since last index) are automatically removed from the index.

Patch Simulation

When the AutoPatcher proposes a code modification, the Digital Twin simulates the change by computing a weighted improvement score across five normalized metrics:

score = 0.35 * normCC
      + 0.15 * normLines
      + 0.20 * normVolume
      + 0.15 * normDifficulty
      + 0.15 * normEffort

Each normalization is computed as the negative delta divided by the original value plus one, meaning reductions in complexity yield positive scores. A patch is approved only if score > 0.05 (the improvement threshold). This multi-dimensional gate ensures that the cyclomatic complexity, code volume, and Halstead difficulty do not regress, even if one metric improves.

6.4 AutoPatcher (CodePatcher)

The CodePatcherService manages the lifecycle of AI-proposed code modifications, from proposal through validation to application. It supports two operational modes:

Audit-Only Mode (Default Enterprise)

When CodePatcherAuditOnly = true (the default), patches are validated by the Digital Twin but not applied to disk. Instead, they are recorded as proposals in a pending queue. An authorized human can then review, approve, or reject each proposal through the API:

• GetPendingProposals() -- Returns all pending patch proposals.
• ApproveAndApplyAsync(proposal) -- Re-validates through the Digital Twin, creates a rollback snapshot, and applies the patch. Logs the approval with Actor: "Human".
• RejectProposalAsync(proposal, reason) -- Removes from pending and logs the rejection with the provided reason.

Patch Application Pipeline

1. Digital Twin Validation -- SimulatePatch() computes the weighted improvement score.
2. Source Drift Detection -- Verifies the original method source still exists in the current file contents via string containment check.
3. Rollback Snapshot -- IRollbackService.CreateSnapshot() persists the entire file contents before modification.
4. AST-Based Replacement -- MethodReplacer.ReplaceMethod() uses Roslyn to locate the target method in the syntax tree and replace it, preserving surrounding code structure.
5. Disk Write -- File.WriteAllTextAsync() writes the patched source.
6. Audit Trail -- A full audit entry is logged with the action type, actor, target, success status, and delta metrics.

The history buffer retains the last 100 patch results (applied, rejected, and proposed). The pending proposals queue is capped at 50 entries.

7. Security

7.1 Zero Cloud Architecture

Coclico is designed as a strictly offline application. No telemetry, logs, AI inference data, or user information is transmitted to any external server. The AI model runs entirely on-device using llama.cpp via the LLamaSharp binding. All user data is stored under %AppData%\Coclico\ and never leaves the machine.

The only outbound network activity is the optional update check service, which polls for new application versions every 5 minutes. This service can be disabled in settings.

7.2 Rollback Service & DPAPI Encryption

The RollbackService provides a comprehensive state preservation mechanism for all system-modifying operations. Every file write triggered by the autonomous core (AutoPatcher, QoS changes) is preceded by a mandatory snapshot.

Architecture

• Dual Storage -- Snapshots are stored both in-memory (ConcurrentDictionary, capacity: 50) and on disk (%AppData%\Coclico\snapshots\).
• DPAPI Encryption -- Disk-persisted snapshots are encrypted using ProtectedData.Protect() with DataProtectionScope.CurrentUser. Only the Windows user account that created the snapshot can decrypt it.
• Metadata Tracking -- Each snapshot records: unique GUID, context name (e.g., CodePatcher.App.xaml.cs.OnStartup), creation timestamp, state type name, and serialized size in bytes.
• Insertion-Order Eviction -- When the in-memory capacity (50) is exceeded, the oldest snapshot is evicted from memory (it remains on disk).
• Pruning -- At application exit, snapshots older than 30 days are deleted from both memory and disk.

Rollback API

string CreateSnapshot<T>(string contextName, T state)
T? Rollback<T>(string snapshotId)
IReadOnlyList<SnapshotMetadata> GetHistory(int maxCount = 20)
void Delete(string snapshotId)
void Prune(TimeSpan olderThan)

7.3 Security Policy Engine

The SecurityPolicyService enforces command-level security restrictions for all Flow Chain operations. It maintains three categories of blocked patterns and one category of protected paths:

Default Blocked Patterns (Hardcoded, Non-Suppressible)

Enterprise Policy Merge

Organizations can deploy a custom policy file at %AppData%\Coclico\security-policy.json. The service loads this file at startup and merges its patterns with the hardcoded defaults using HashSet.UnionWith(). The hardcoded defaults can never be removed, only supplemented. After merging, all pattern sets are converted to FrozenSet<string> for O(1) lookup performance. Regex wildcards are compiled with RegexOptions.Compiled and a 100ms execution timeout to prevent ReDoS attacks.

Runtime Verification API

bool IsCommandBlocked(string normalizedCmd)
bool IsPowerShellBlocked(string normalizedPs)
bool IsProtectedPath(string lowerCasePath)

7.4 Audit Log (NDJSON)

The AuditLogService implements an append-only, Newline-Delimited JSON (NDJSON) audit trail. Each entry is written to a daily file (audit-{yyyy-MM-dd}.log) under %AppData%\Coclico\audit\.

Audit Entry Schema

record AuditEntry(
    DateTimeOffset Timestamp,
    string Actor,           // "OptimizationEngine", "CodePatcher", "Human", ...
    string Action,          // "AiDecision", "PatchApplied", "ProposalRejected", ...
    string Target,          // "SystemMetrics", "App.xaml.cs::OnStartup", ...
    bool Success,
    string? Details,
    AiDecisionContext? AiDecision  // optional LLM prompt/response traceability
)

record AiDecisionContext(
    string Prompt,
    string RawResponse,
    string DecisionMode     // "Cognitive" or "Fallback"
)

Implementation Details

• Write Serialization -- A SemaphoreSlim(1,1) ensures atomic, ordered writes.
• Reverse Read -- GetRecentAsync reads entries from the end of files using a block-based reverse reader with ArrayPool<byte>.Shared for zero-allocation buffering.
• Pruning -- At application startup, audit files older than AuditRetentionDays (configurable in Settings) are deleted.
• AI Traceability -- Every OptimizationEngine cycle logs the full prompt and raw LLM response in the AiDecisionContext field, providing complete reproducibility of autonomous decisions.

8. Telemetry & Observability

8.1 Structured Logging (Serilog)

Coclico uses Serilog 4.2.0 with the File sink 6.0.0 for structured, rolling daily log files. Logs are written to %AppData%\Coclico\logs\coclico-{date}.log with a 14-day retention policy. The output template includes millisecond-precision timestamps, three-character uppercase level indicators, and the source context for precise log filtering.

Log Configuration

Template: [{Timestamp:yyyy-MM-dd HH:mm:ss.fff} {Level:u3}] [{SourceContext}] {Message:lj}{NewLine}{Exception}
Minimum Level: Debug
Rolling Interval: Day
Retained Files: 14
Integration: Microsoft.Extensions.Logging via Serilog.Extensions.Logging 8.0.0

Logging Conventions

• LoggingService.LogInfo(message) -- Informational events, startup milestones, cycle completions.
• LoggingService.LogError(message) -- Error conditions that are handled but notable.
• LoggingService.LogException(ex, context) -- Full exception with stack trace and caller context.
• Every service method logs entry and exit points with parameter summaries and return value descriptions.

8.2 DynamicTracer -- EWMA & Isolation Forest

The DynamicTracerService provides application-level performance instrumentation with statistical anomaly detection capabilities.

Metric Collection

• Ring Buffer -- A ConcurrentQueue-based ring buffer with a capacity of 2,000 snapshots. Overflow evicts the oldest entry via TryDequeue.
• TDigest Quantiles -- Each operation name has an associated TDigest (compression=100, Dunning & Ertl 2019 algorithm) for streaming P95 estimation without full-sort overhead.
• Periodic Flush -- Every 30 seconds, the buffer is serialized to %AppData%\Coclico\telemetry\metrics-{date}.json. Files older than 14 days are pruned.

API Surface

IDisposable BeginOperation(string name, string? category, IReadOnlyDictionary<string, object>? tags)
void Record(string name, TimeSpan elapsed, ...)
IReadOnlyList<MetricSnapshot> GetRecentMetrics(int maxCount = 100)
MetricAggregate? GetAggregate(string operationName)  // Min, Max, Avg, P95, SampleCount

The BeginOperation method returns a disposable span that records elapsed time using Stopwatch.GetTimestamp() and Stopwatch.GetElapsedTime() for high-resolution timing.

Anomaly Detection Pipeline

The Isolation Forest detector (IsolationForestDetector) processes multi-dimensional feature vectors (CPU%, RAM%, DiskIO latency) from the OptimizationEngine:

The anomaly score is computed as 2^(-avgPathLength / c(n)) where c(n) is the average path length of an unsuccessful search in a BST: 2(ln(n-1) + 0.5772) - 2(n-1)/n. Scores closer to 1.0 indicate higher anomaly likelihood.

8.3 ResourceGuard -- Pressure Levels

The ResourceGuardService monitors Coclico's own resource footprint using System.Reactive observables with a 2-second polling interval. It computes the application's CPU usage (delta-based), working set, and private memory, then maps the overall system state to one of four pressure levels:

The service exposes a PressureChanged event that other services can subscribe to for adaptive behavior (e.g., the OptimizationEngine could reduce its analysis scope under Critical pressure). Metric collection runs on the Rx Scheduler.Default background thread, with UI property updates dispatched to the WPF dispatcher via ObserveOn(DispatcherScheduler).

9. Website

Coclico includes a companion marketing and documentation website built with modern web technologies, designed for performance, accessibility, and internationalization.

Technology Stack

Internationalization

The website supports 4 languages with dedicated routing and locale files:

• French (/fr/) -- Primary language
• English (/en/)
• German (/de/)
• Spanish (/es/)

Translation strings are managed through TypeScript locale modules under src/i18n/locales/. The root index.astro page handles locale detection and routing. Additional content sections include dedicated pages for changelog, documentation, FAQ, guides, and wiki.

Build & Deploy

npm run dev      # Local development server
npm run build    # Production static build
npm run preview  # Preview production build
npm run check    # Astro type checking

10. Prerequisites & Deployment

System Requirements

Build Instructions

# Restore NuGet packages
dotnet restore

# Build the application
dotnet build Coclico/Coclico.csproj

# Run the application (requires admin elevation)
dotnet run --project Coclico/Coclico.csproj

# Run all tests
dotnet test

# Run specific test class
dotnet test --filter "FullyQualifiedName~ServiceCore"

Deployment Artifacts

An Inno Setup script (Coclico_Setup.iss) is included for producing a Windows installer. The installer packages the compiled application, the GGUF model file, resource documentation, and the .NET runtime prerequisite check.

User Data Locations

Appendix A: Directory Structure

Coclico/
+-- Coclico.slnx                    # Solution file
+-- CLAUDE.md                       # AI assistant project instructions
+-- README.md                       # English README
+-- README.fr.md                    # French README
+-- LICENSE                         # Open source
+-- Coclico_Setup.iss               # Inno Setup installer script
+-- docs/                           # Project documentation
+-- Coclico/                        # Main application project
|   +-- Coclico.csproj              # Project file (.NET 10, WinExe)
|   +-- App.xaml / App.xaml.cs      # Application entry point
|   +-- MainWindow.xaml / .cs       # Shell window with navigation
|   +-- AssemblyInfo.cs             # Assembly metadata
|   +-- app.manifest                # UAC elevation manifest
|   +-- Properties/                 # Launch settings
|   +-- Models/
|   |   +-- LaunchMode.cs           # Startup mode enum
|   |   +-- WorkflowPipeline.cs     # Pipeline, Step, Connection models
|   +-- Views/
|   |   +-- DashboardView.xaml      # System metrics dashboard
|   |   +-- ProgramsView.xaml       # Application library
|   |   +-- WorkflowPipelinesView.xaml  # Flow Chain visual editor
|   |   +-- InstallerView.xaml      # Winget GUI
|   |   +-- CleaningView.xaml       # Disk cleanup
|   |   +-- ScannerView.xaml        # Application audit
|   |   +-- RamCleanerView.xaml     # Memory optimization
|   |   +-- AiChatView.xaml         # AI chat interface
|   |   +-- SettingsView.xaml       # Application settings
|   |   +-- HelpView.xaml           # Help / about
|   |   +-- ProfileWindow.xaml      # User profile editor
|   |   +-- SplashWindow.xaml       # Startup splash screen
|   |   +-- LauncherWindow.xaml     # First-run configuration
|   |   +-- AdminPromptWindow.xaml  # UAC elevation dialog
|   |   +-- AvatarCropWindow.xaml   # Avatar image cropper
|   |   +-- RuleSelectionDialog.xaml # Flow Chain rule picker
|   |   +-- PipelineLink.cs         # Visual link renderer
|   +-- ViewModels/
|   |   +-- DashboardViewModel.cs
|   |   +-- CleaningViewModel.cs
|   |   +-- ScannerViewModel.cs
|   |   +-- SettingsViewModel.cs
|   |   +-- WorkflowPipelinesViewModel.cs
|   +-- Services/
|   |   +-- ServiceContainer.cs     # Static DI wrapper
|   |   +-- AiChatService.cs        # Dual-context LLamaSharp
|   |   +-- IAiService.cs           # AI service interface
|   |   +-- RagService.cs           # BM25+Cosine RAG engine
|   |   +-- OptimizationEngineService.cs  # 3-stage pipeline
|   |   +-- IOptimizationEngine.cs
|   |   +-- SourceAnalyzerService.cs     # Roslyn AST analysis
|   |   +-- ISourceAnalyzer.cs
|   |   +-- StateValidatorService.cs     # Digital Twin
|   |   +-- IStateValidator.cs
|   |   +-- CodePatcherService.cs        # AutoPatcher
|   |   +-- ICodePatcher.cs
|   |   +-- DynamicTracerService.cs      # Telemetry + TDigest
|   |   +-- IDynamicTracer.cs
|   |   +-- ResourceGuardService.cs      # Pressure level monitor
|   |   +-- ResourceAllocatorService.cs  # Process priority QoS
|   |   +-- IResourceAllocator.cs
|   |   +-- RollbackService.cs           # DPAPI-encrypted snapshots
|   |   +-- IRollbackService.cs
|   |   +-- SecurityPolicyService.cs     # FrozenSet policy engine
|   |   +-- ISecurityPolicy.cs
|   |   +-- AuditLogService.cs           # NDJSON audit trail
|   |   +-- IAuditLog.cs
|   |   +-- FeatureExecutionEngine.cs    # Circuit-breaker wrapper
|   |   +-- MemoryCleanerService.cs      # P/Invoke RAM operations
|   |   +-- CleaningService.cs           # Disk cleanup engine
|   |   +-- InstalledProgramsService.cs  # 8-source app detection
|   |   +-- InstallerService.cs          # Winget integration
|   |   +-- WorkflowService.cs           # CRUD + execution
|   |   +-- SettingsService.cs           # JSON settings persistence
|   |   +-- ThemeService.cs              # Dark/light theme engine
|   |   +-- LocalizationService.cs       # 10-language runtime switch
|   |   +-- ProfileService.cs            # User profile management
|   |   +-- CacheService.cs              # In-memory caching
|   |   +-- ICacheService.cs
|   |   +-- LoggingService.cs            # Serilog facade
|   |   +-- NetworkMonitorService.cs     # Network state tracking
|   |   +-- ProcessWatcherService.cs     # Process lifecycle events
|   |   +-- StartupService.cs            # Windows startup registration
|   |   +-- StartupHealthService.cs      # Boot health diagnostics
|   |   +-- KeyboardShortcutsService.cs  # Global hotkey registration
|   |   +-- ToastService.cs              # WPF notification toasts
|   |   +-- TrayService.Win32.cs         # System tray P/Invoke
|   |   +-- UpdateCheckService.cs        # Version update polling
|   |   +-- UpdateManager.cs             # Update download/apply
|   |   +-- UserAccountService.cs        # Windows user account info
|   |   +-- SecretScanService.cs         # Credential leak detection
|   |   +-- SecurityHelpers.cs           # Privilege escalation utils
|   |   +-- SeverityClassifier.cs        # Log severity mapping
|   |   +-- AiActionParser.cs            # LLM response JSON parser
|   |   +-- OptimizationAction.cs        # Action record type
|   |   +-- Algorithms/
|   |       +-- IsolationForestDetector.cs  # Liu et al. 2008
|   |       +-- TDigest.cs                  # Dunning & Ertl 2019
|   |       +-- MethodReplacer.cs           # Roslyn AST replacement
|   |       +-- SimpleStemmer.cs            # Token stemmer for RAG
|   +-- Converters/                 # WPF value converters
|   +-- Resources/
|   |   +-- icone/                  # Application icons
|   |   +-- software_list.json      # Winget package definitions
|   +-- resource/
|       +-- model/                  # GGUF AI model file
|       +-- docs/                   # RAG knowledge base (Markdown)
+-- Coclico.Tests/                  # xUnit + Moq test project
+-- Installer/                      # Inno Setup resources
+-- website/                        # Astro 5 companion website
    +-- astro.config.mjs
    +-- tailwind.config.mjs
    +-- package.json
    +-- tsconfig.json
    +-- public/                     # Static assets
    +-- src/
        +-- components/             # Astro/HTML components
        +-- layouts/                # Page layouts
        +-- pages/                  # Route pages (fr, en, de, es)
        +-- styles/                 # Global CSS
        +-- i18n/
            +-- index.ts            # i18n router
            +-- locales/            # fr.ts, en.ts, de.ts, es.ts