NeuroTune v0.8.0-alpha.5 — Pi Agent, Local CLM and a Simpler Interface

NeuroTune v0.8.0-alpha.5

Pi agent, local CLM System One and reliable CI

Unsigned prerelease for controlled Windows 11 x64 testing, not a stable/general
release or a promise of performance gains. Keep independent backups and use a
disposable VM for system-changing tests. A green build and matching hashes do
not certify recovery or compatibility.

Downloads after publication

• NeuroTune_0.8.0-alpha.5_x64-setup.exe: unsigned per-machine NSIS installer.
• NeuroTune-0.8.0-alpha.5-win-x64.zip: complete portable app with both
  self-contained agents, the bundled Pi runtime, WPR profile, license and docs.
• SHA256SUMS: verify these against the downloaded assets before running them.

Windows 11 x64, WebView2 and normal UAC approval are required. System
Protection is required before Apply. SmartScreen may warn about unsigned
binaries. Earlier alpha tags/assets remain unchanged.

Changes since alpha.4

• Pi CORE investigation agent: the bounded investigation runs in a
  short-lived non-administrator Pi subprocess; credentials and provider calls
  stay in NeuroTune. First-launch setup offers ChatGPT, OpenRouter or Other.
• Fixed: non-admin helpers from an elevated NeuroTune. The UAC linked token
  is identification-level for a normal elevated process, so Pi and the optional
  workers could not start (Win32 1346) and every diagnosis silently used the
  local fallback. Helpers now run with a LUA-filtered, medium-integrity copy of
  NeuroTune's own token (Administrators deny-only, privileges removed). If the
  desktop refuses that token, helpers are declined cleanly and the diagnosis
  uses the local fallback with a clear reason.
• Fixed: rollback within 24 hours of a restore point. Windows silently
  skips a restore point requested within its default 24-hour window, so a
  rollback right after Apply (or an Apply after Windows Update made one) could
  never verify its point. NeuroTune lifts that limit for its own call only and
  restores the previous setting.
• Fixed: device rollback before a restart. A Device Manager disable that
  needs a restart is invisible until reboot; rollback now re-enables every
  device that was enabled before, so it is not disabled on the next boot.
• Local CLM as the default System One assistant: classification runs on
  this PC through scripts/clm-stack.ps1 install (about 9 GB). NeuroTune loads
  the encoder only for the classification that needs it and unloads it right
  after, inside a kill-on-close job, so it never occupies VRAM during
  measurements and stops when NeuroTune closes. Rizzo Flow and OpenRouter stay
  selectable.
• Simpler interface: five sidebar sections (Overview, Complete diagnosis,
  Measurements, Changes & restore, Settings) with the other pages as tabs, a
  guided path showing the current step and a single "Next step" action, and a
  Simple/Expert switch that hides rarely used technical controls by default.
• Italian interface and AI response language.
• Install CLM from the app: pinned, SHA-256 checked downloads, a private
  Python environment created by a non-administrator helper, and one real local
  classification before the assistant is enabled. Remove deletes all of it.
• Before/after report: export a readable, script-free HTML page with the
  measurement conditions, applied changes and measured differences.
• Scenario profiles: Competitive gaming, Streaming & recording and Quiet &
  efficient fill the objective, risk preset and notes in one click; approval,
  baselines and rollback are unchanged.
• Live FPS: while a game is recorded, a display-only panel shows FPS, 1% low
  and frame-time P99 from the game's DirectX presents. It never enters reports
  or decisions; Vulkan/OpenGL games may not report.
• Model failure guidance: rate limits, missing credits, unavailable models,
  upstream errors, unusable output and timeouts name the model and say how to
  recover, without echoing provider text or retrying automatically.
• Vulnerability & compromise review preset with six fixed read-only readers
  and 12 hardening registry snapshots.
• Reversible Device Manager controls for the latency presets: 18 allowlisted
  device.disable.* capabilities, journaled and rolled back like every action,
  never pre-selected, refusing devices that host input, storage or display.
• CI: the test step hung for 6 hours on every run since the Pi agent landed
  (the bug above). Actions are now pinned to commit SHAs, cargo-audit to
  0.22.2, the job has a 60-minute limit and hung tests are reported.

Preserved safety and privacy boundaries

AI output is untrusted advice. Only registered, reinspected capabilities enter
writes, with matching persisted approval, separate high-risk consent, workload
Baselines, verified restore point/backups and per-action verification/journaling.
Manual guidance and generated scripts remain inert. Failed writes attempt
verified rollback; incomplete recovery remains visible.

System-wide diagnostics, imported reports and screenshots never unlock Apply.
Scheduling/ISR/DPC traces do not measure FPS, ping or end-to-end input latency;
accepted comparisons require repeatable matching 3+3 workload captures. Advisory
audit has no workload benchmark or optimization Apply. Neither AI runs during
capture. Defender operations have separate consent and may quarantine/remove
files; restore points do not guarantee reversal.

Only consented prepared evidence reaches the selected provider. Redaction is
best-effort; pixels are not anonymized and may be resent each turn. Raw ETL stays
local and screenshot pixels are not persisted in run journals. System One is
advisory only: local CLM by default once you install it, cloud sources need
separate consent. No SCEWIN binary,
vendor driver, model weights, credential or runtime journal belongs in packages.
No BIOS writer, security bypass or automatic cleanup suite is bundled.

Upgrade safety

Settings, measurements and DPAPI credentials remain under
%LocalAppData%\NeuroTune; protected operation/run journals use
%ProgramData%\NeuroTune-journals\<Windows user SID>.
Nonempty legacy operations/runs are not imported or trusted automatically.
Use the previous build to resolve/review prior writes, preserve backups and
archive only reviewed journals. Never delete pending recovery or copy editable
JSON into protected storage. See SECURITY.md.

See alpha testing, providers,
privacy/security,
execution boundaries and
optional components.

NeuroTune v0.8.0-alpha.4 — DeepSeek Flash Diagnosis Reliability

NeuroTune v0.8.0-alpha.4 — DeepSeek Flash Diagnosis Reliability

Unsigned Windows 11 x64 prerelease for controlled testing, not a stable/general release or a promise of performance gains. Use a disposable VM and independent backups for system-changing tests. Alpha.1, alpha.2 and alpha.3 tags/assets are immutable and unchanged; alpha.3 does not contain these DeepSeek corrections.

Updated diagnosis

• Built-in DeepSeek uses documented JSON output and an explicit system-level planner contract, without assuming support for arbitrary custom/local endpoints.
• Stable short investigation-local evidence references are resolved exactly to original IDs before validation/storage. Unknown/unprovided IDs, oversized/repeated requests, unsafe tools and fabricated explicit values still fail closed. No fuzzy matching or extra privacy permission.
• Already-provided facts remain citable but no longer appear as new-evidence requests. Ordinary read-only follow-ups omit module; only driver-details accepts an observed .sys basename.
• Omitted finding values are resolved from the exact validated local fact. Model interpretation remains unverified assessment, not a measured observation or proof of a cause.
• Safe allowlisted validation causes identify the failed stage, without raw responses/arbitrary exception text. A validated retry clears its earlier stored error. No automatic inference retry, substitute model/provider or billing fallback.
• All manifests/lockfiles/components/UI/docs align to alpha.4. A shared-store test fixture is serialized to avoid a demonstrated test-only file-lock race; production recording checks are unchanged.

Downloads

Asset	Bytes	SHA-256
NeuroTune_0.8.0-alpha.4_x64-setup.exe	49,636,692	5a2f58b592a613f481b0ff5057bf9c08875291f45c7478839e2c26ecb964f83d
NeuroTune-0.8.0-alpha.4-win-x64.zip	67,212,697	5ecd7ef3fd94444b18fdbe4db5883e8378cd677fec72c791847e0d0718890bcc
SHA256SUMS	208	6ee2538d4dee758a64f42c72feeccc1450d82e77776a3335a15fac3443eb8f42

Extract the complete portable folder. Portable means no installation, not no elevation or persistent data. WebView2 and normal UAC approval are required. Installer is unsigned per-machine NSIS; SmartScreen warnings are possible. SHA-256 identifies bytes, not an authenticated publisher or installation safety.

Provenance and verification

Publication routing correction: GitHub initially published this draft under
untagged-cc498b76523640be4de3 instead of its intended version tag. The release
was reassociated with the existing annotated v0.8.0-alpha.4 tag; both refs
resolve to the same verified 1b1ddc0 commit. No tag ref, asset byte or checksum
was rewritten, and the temporary ref is retained for audit. Earlier releases
are unchanged.

• Annotated v0.8.0-alpha.4 source: merged main commit 1b1ddc0a32dabe933a7d14d89180c0da328f8a29, tree 57476b413f141e02fcd8ff2b9d0c94b8ece4cce8; includes functional corrections from #18 and release preparation from #19. GitHub verifies the merge commit's signature.
• Required successful main-source build: workflow run 37644540165, dispatched explicitly on that exact main commit after GitHub's PR/ref metadata became inconsistent. No autoapproval, main force-push, policy change or administrator merge was performed by the assistant.
• Fresh serial production build: clean/remapped self-contained .NET Agent/Telemetry, remapped Rust/Tauri, locked dependencies, NSIS and complete portable ZIP. Both sidecars embed 0.8.0-alpha.4+1b1ddc0a32dabe933a7d14d89180c0da328f8a29; UI embeds alpha.4. No diagnostic WebView overrides, debug port/profile or local username paths in the checked binaries.
• Local gates: 179 selected backend, 50 UI and 3 Rust tests, .NET format, frontend typecheck/lint/build, Rust fmt/standard locked Clippy, metadata and mocked browser regressions. README screenshots are mocked illustrations, not host/provider evidence.
• npm/NuGet/Cargo audits report no vulnerability entries; Cargo retains six unmaintained and one Linux glib unsoundness warning, without suppression.
• Installer extracted, not executed/installed: exact fresh sidecars/profile and embedded versions checked; UI differs only by Tauri's expected three-byte NSIS bundle-kind marker. Portable resources/documents/checksums match. Packaged state/offline parsing/redaction and consent-rejection checks passed without OAuth, provider inference, drivers or writers.
• Draft GitHub downloads match the local asset bytes/checksums and API sizes/digests. The actual GitHub tagged-source ZIP matches all 190 tagged blobs; internal plans, private artifacts and runtime journals are excluded.

Actual host evidence — not installer acceptance

On 2026-10-07 the configured deepseek-flash connection was exercised through the real desktop UI, native scans, WPR/ETL analysis and provider investigation. The reviewed functional corrections produced a validated explicit UI retry and a fresh Complete diagnosis: 12 accepted turns, 15 findings, 10 proposals, no fallback/error, Apply disabled. Real model discovery preserved Flash. No browser/provider mock or alternate ChatGPT model was used for those results.

All five owned 30-second system-wide diagnostic captures completed with valid quality/zero lost events; raw ETL was deleted after analysis, runs finished without changes, WPR stopped, inspected action values/operation history unchanged and settings byte-identical. The selected 12-turn/10-minute budget was not increased. Instrumentation used a private WebView profile and loopback-only CDP, removed from subsequent production builds. Private host profiles/journals/screenshots are not shipped.

This validates the corrected read-only source flow, not every provider/model, unattended reliability, exact alpha.4 installer/upgrade/uninstall, workload Baselines/performance gains, ACL denial, interruption/recovery, Defender, physical DPI/Narrator, live vision or optional components. Apply/rollback/recovery acceptance remains separately authorized in a disposable VM. No installation, Apply, rollback, optional-component installation or Defender remediation was run on the host.

Upgrade and safety

Preserve old recovery data. Nonempty legacy LocalAppData operations/runs are not imported, deleted or trusted automatically. Resolve/review prior writes with the previous build and archive only reviewed records; never delete pending recovery or copy editable JSON into protected journals.

AI output remains untrusted advice. System-wide diagnostics, imported reports and screenshots do not unlock Apply. Registered/reinspected actions still require persisted approval, matching workload Baselines, separate high-risk consent, restore point/backups and per-action verification. Scripts/manual proposals stay inert; neither AI runs during capture. Optional components stay default-off/not bundled; Defender has separate consent and may quarantine/remove files.

See release notes, testing, providers and upgrade safety.

NeuroTune v0.8.0-alpha.3 — Provider Selection and Diagnosis Reliability

NeuroTune v0.8.0-alpha.3 — Provider Selection and Diagnosis Reliability

Unsigned prerelease for controlled Windows 11 x64 testing, not a stable/general release or a promise of performance gains. Keep independent backups and use a disposable VM for system-changing tests. A green build and matching hashes do not certify native recovery or compatibility.

Downloads

• Installer: NeuroTune_0.8.0-alpha.3_x64-setup.exe — unsigned per-machine NSIS installer.
• Portable: NeuroTune-0.8.0-alpha.3-win-x64.zip — extract the complete folder, including both self-contained agents and the WPR profile. MIT license, README and release notes are included.
• Checksums: SHA256SUMS — verify downloaded bytes before running them.

Windows 11 x64 and WebView2 are required. Normal UAC approval is required; System Protection is required before Apply. Portable means no installation, not no elevation or persistent data. SmartScreen may warn because the binaries are not Authenticode signed. SHA-256 identifies bytes, not an authenticated publisher. Earlier releases remain unchanged.

Changes since alpha.2

• Complete model selection: API/local connections show an explicit Available models dropdown with all IDs returned by the selected endpoint, independent of the model already typed. Manual exact IDs remain supported. Discovery does not silently replace an API model; changing endpoint, protocol or credential clears stale choices. Model availability is provider-controlled: deepseek-v4-flash appears only if returned by the provider or explicitly entered manually. Discovery does not prove inference quota, diagnosis or image support.
• Clearer provider failures: safe HTTP status and ChatGPT app/plan allowance messages precede generic fallback explanations. No raw provider response bodies, automatic retries, alternate provider/model or API-billing fallback are added. This improves visibility; it does not establish or claim to fix the original VM DeepSeek failure's unknown cause.
• Retained incomplete review: failed investigations preserve local findings and their failure cause across restart, visibly marked Not completed. They grant no approval/Apply authority. Finish without changes closes the run explicitly while retaining its report.
• Earlier recovery preflight: legacy journals and unfinished retained runs block complete/advanced diagnosis before scan, capture or provider work. Errors name blocking paths, saved provider settings survive history-load failures, and Refresh rechecks history.
• PrimeBuild attribution: discreet, visible by PrimeBuild branding in full and compact navigation.
• Public documentation cleanup: user, provider, privacy and safety guides remain public; internal plans, historical audits and machine reports are no longer tracked. Current README screenshots use mocked data.
• Coherent alpha.3 metadata: npm/Cargo lockfiles, Tauri, .NET and UI versions agree.

Safety, privacy and upgrade boundaries

AI output is untrusted advice, not arbitrary shell, Registry or firmware write authority. Apply still requires registered/reinspected actions, persisted approval, separate high-risk consent, quality-valid workload Baselines, verified restore point/backups and per-action verification/journaling. Manual guidance and generated scripts remain inert. Failed writes attempt verified rollback; unfinished recovery remains visible.

System-wide diagnostics, imported reports and screenshots never unlock Apply. Scheduling/ISR/DPC traces are not FPS, ping or end-to-end input-latency measurements; accepted comparisons require matching repeated 3+3 workload captures. Advisory audit has no optimization Apply. Neither assistant runs during capture. Defender operations have separate consent and may quarantine/remove files; restore points do not guarantee reversal.

Only consented prepared evidence reaches the selected provider. Redaction is best-effort, not anonymization. Raw ETL stays local; screenshot pixels are not anonymized, may be resent each turn and are not persisted in run journals. Optional System One remains default-off with separate download/cloud consent. No vendor driver, SCEWIN binary, model weights, credential, runtime journal, BIOS writer or security bypass is bundled.

Settings, measurements and DPAPI credentials remain under %LocalAppData%\NeuroTune; protected operation/run journals use %ProgramData%\NeuroTune-journals\<Windows user SID>. Nonempty legacy operations/runs are not automatically imported or trusted. Use the previous build to resolve/review prior writes, preserve independent backups and archive only reviewed journals. Never delete pending recovery or copy editable JSON into protected storage.

See security/upgrade guidance, alpha testing, provider setup, privacy/security, execution boundaries and optional components.

Build provenance and completed checks

• Source/tag commit: 3747bdefe97f5b8e57dce7e77c0c99d98c171776, reviewed PR #17 merged into main; includes #15/#16 fixes. Git tree: 2b6310e1f6d22cc7dce64af6af58bab491df373e.
• Fresh Windows x64 build with self-contained single-file agents and locked Rust dependencies. Local source paths were remapped; clean sidecar compilation avoids carrying stale unremapped incremental outputs.
• Local checks: 163 .NET tests excluding WindowsIntegration, 50 UI tests, 3 Rust tests, .NET format, frontend typecheck/lint/build, Rust fmt/standard Clippy, metadata and mocked browser regressions for models, legacy preflight, incomplete reviews, layouts, languages and privacy/security.
• Independent main CI records the full Windows build, tests, audits, installer and packaging results for this exact source commit.
• npm/NuGet: no known vulnerable dependencies. Cargo audit: no vulnerability entries; six unmaintained transitive-crate warnings and one Linux glib unsoundness warning, with no suppressions. Not a security certification.
• Read-only package checks: versions/commit identities, exact current documents, complete ZIP, matching fresh sidecars, production configuration without diagnostic WebView overrides, no local username path in binaries, and installer/portable equivalence except Tauri's expected three-byte NSIS bundle-kind marker. Installer extracted, not installed or executed. Packaged-agent checks used local state/offline parsing and rejected missing consent; no OAuth/provider, driver or writer execution.

Exact-installer install/uninstall, upgrades, elevated ACL denial, interruption/restart/recovery, actual Defender behavior, DPI/Narrator, live provider/vision access, optional components and physical workload gains remain separately authorized Windows 11 acceptance work. Source/mock and packaging checks do not certify those behaviors.

SHA-256

66ef516417bbf50df9aec0e31d72c39326ba88ce1cf1cff58d41b342d6d15795  NeuroTune_0.8.0-alpha.3_x64-setup.exe
7c872995091ca2f48f6097889984ccdd519cb2bba8459807bb6275ca0164e5e2  NeuroTune-0.8.0-alpha.3-win-x64.zip

NeuroTune v0.8.0-alpha.2 — Privacy, Security and Localized UI Preview

NeuroTune v0.8.0-alpha.2

Privacy, Security and Localized UI Preview

Unsigned prerelease for controlled Windows 11 x64 testing, not a stable/general
release or a promise of performance gains. Keep an independent backup and use
a disposable VM for system-changing tests. A successful build and matching
checksums do not certify installer safety, native recovery or actual optimization.

Downloads

• NeuroTune_0.8.0-alpha.2_x64-setup.exe: unsigned per-machine NSIS installer.
• NeuroTune-0.8.0-alpha.2-win-x64.zip: portable app with both self-contained
  agents, the WPR profile, MIT license and documentation. Extract the complete
  folder; do not move just the main executable.
• SHA256SUMS: SHA-256 checksums for the installer and portable archive.

"Portable" means no installation, not no elevation or persistent data.
Windows 11 x64 and WebView2 are required. Windows UAC approval is required for
the desktop app; System Protection must be enabled before applying changes.
Windows SmartScreen may warn because these alpha binaries are not Authenticode
signed. Hashes identify bytes, not an authenticated publisher.

Changes since alpha.1

• Privacy/security investigation: a fifth prompt specialization covers
  privacy policies, protections, detections, persistence and Windows health.
  Reports expose 15 checks, cited sources, limitations and missing evidence.
  Model omissions, unknown/unavailable evidence and imported reports cannot
  silently become a verified whole-PC audit.
• Separate Advisory audit mode: local evidence, a consented AI investigation,
  reviewable report and Finish. No workload Baseline or optimization Apply.
  Complete audits pause on a cancellable prepared-evidence preview before any
  provider transmission. A preset cannot change mode or grant scanner consent.
• Separate Defender operations: quick/full scans have independent resource,
  remediation and network/cloud/sample-submission consent plus confirmation.
  Protected pre-command journals preserve uncertain/interrupted operations.
  Scan return or empty history does not prove a clean PC; scan operations are
  not linked as verified audit coverage. Defender may quarantine/remove threats
  under its configured policy; restore points do not guarantee reversal.
• Privileged recovery hardening: Administrators/SYSTEM-owned operation/run
  storage under ProgramData, bounded reads and flushed atomic replacement.
  Unsafe ACLs, reparse paths, unsupported schemas, mismatched identities and
  malformed snapshots fail closed. GPU/custom-plan recovery survives missing
  disposable source inputs; core parking restores the captured scheme.
• Stricter execution and evidence gates: opposing actions and mismatched
  journal/run identities are rejected. Missing comparison coverage or new
  regressions cannot justify favorable Keep. PresentMon imports require process
  attribution but remain evidence with unverified session provenance.
• Windows utility/process boundaries: absolute utility resolution, bounded
  output/deadlines and stricter child handling. Native response pipes are made
  non-inheritable so the independent capture watchdog does not hold IPC open.
• Localized desktop: English, Simplified Chinese, Japanese, Spanish and
  Russian UI and application-owned response-language preferences. Grouped
  navigation, clearer diagnosis/review, light/dark/system appearance, keyboard
  focus and quiet/reduced-motion behavior remain part of the interface.
• Current N-logo branding: startup, overview, sidebar, favicon and Windows
  icons use the purple/white mark. The README adds plastic technology badges,
  a redesigned banner, current-frontend screenshots and workflow/trust diagrams.
• Dependency correction: source-map-js 1.2.2 addresses
  GHSA-68fv-2mgg-jv7q without relaxing the dependency-audit gate.
• Consistent release metadata: UI, npm/Cargo lockfiles, Tauri and .NET
  components now declare 0.8.0-alpha.2. The release-metadata check also rejects
  mismatched application versions in both lockfiles.

Preserved boundaries

The selected AI investigates evidence through bounded, registered read-only
follow-ups. Its output is untrusted advice, not arbitrary shell/Registry/firmware
write authority. Apply requires registered, reinspected actions, matching
persisted approval, separate high-risk consent, valid workload Baselines,
mandatory verified restore point/backups and per-action verification/journaling.
Manual guidance and generated scripts stay inert. Failed writes attempt
reverse-order rollback; incomplete recovery remains visible.

Scheduling/ISR/DPC traces do not measure FPS, ping/jitter or end-to-end input
latency. A 1+1 comparison is exploratory; the repeated gate needs at least 3+3
matching, quality-valid workload captures. System-wide diagnostics and imported
reports/screenshots cannot unlock Apply. Neither assistant runs during captures.

Provider choice and inference costs remain explicit. OpenRouter, OpenAI,
Anthropic, DeepSeek and compatible/custom or local loopback models are supported;
eligible ChatGPT plan/credits access is provider-controlled. No automatic provider
or API-billing fallback is offered. Prepared evidence requires consent; raw ETL
stays local. Redaction is best-effort, not guaranteed anonymization. Screenshot
pixels are not anonymized and may be resent each turn; they are not persisted in
run journals.

Optional System One advice is default-off and cannot approve writes. Local
installation downloads multi-GB third-party assets; cloud classification has
separate credentials/consent/costs. Non-admin workers are not network/filesystem
sandboxes. SCEWIN export needs an explicitly approved user-supplied package;
no AMI binaries, BIOS writer, security bypass, TronScript or arbitrary cleanup
executor is bundled.

Upgrade safety

Settings, measurements and DPAPI-encrypted credentials remain under
%LocalAppData%\NeuroTune. Privileged operation/run journals and Registry
exports use %ProgramData%\NeuroTune-journals\<Windows user SID>; Defender
operations use a separate protected defender-scans store.

Legacy LocalAppData operations/runs are not imported. Use the previous build
to finish/review recovery, preserve independent backups and resolve prior writes,
then archive only reviewed journals. Never delete pending recovery or copy old
JSON into protected storage to bypass the gate. See SECURITY.md.

Verification and remaining acceptance

The release is rebuilt from the version-aligned sources; packaging checks cover
complete agent/profile inclusion and exact document copies. The published
SHA256SUMS must be verified against the downloaded files before running them.
Fresh build/test/audit and artifact-check results are recorded on the GitHub
release; historical test results are not current-candidate certification.

Real installer install/uninstall, elevated token/ACL denial, legacy upgrades,
interruption/I/O recovery, actual Defender behavior, native DPI/Narrator,
physical AMD/NVIDIA repeatability, provider/vision calls and optional component
installation remain separately authorized Windows 11 acceptance work. No such
acceptance or measured performance gain is implied by publishing this alpha.
The packages contain no user credentials, runtime journals, model weights,
SCEWIN binaries or vendor drivers.

See the test guide,
privacy/security scope,
execution boundaries and
optional components.

Build provenance and completed checks

• Source/tag commit: 8bacbacf8eb652e6522c214b05ac0e460cb91b6b. All package manifests and the UI declare 0.8.0-alpha.2.
• Fresh Windows x64 build: .NET 8.0.425, Node.js 24.19.0 and Rust 1.98.1. Agents are self-contained single-file builds; Rust was built with --locked. Local source paths were remapped during compilation.
• Local checks passed: 162 .NET source tests (WindowsIntegration excluded), 48 UI tests, 3 Rust tests, release metadata including lockfiles, format, lint, production build and Clippy.
• npm/NuGet reported no known vulnerabilities. Cargo audit reported zero vulnerability entries and seven informational warnings (six unmaintained transitive crates and Linux glib unsoundness). No advisories were suppressed. These results are not a security certification.
• Read-only artifact checks verified embedded versions, complete ZIP contents, exact packaged documents, matching fresh sidecars, no diagnostic WebView override and matching installer/portable application resources apart from Tauri's expected three-byte NSIS bundle-kind marker. No installer or application was executed for these artifact checks.
• Release preparation PR #14 aligns main; its CI run reports the independent full build status.

Correction of the initial source-only tag

Before the first binary upload, v0.8.0-alpha.2 was advanced from the initial source-only snapshot a0403c8bcb95a89ac8ff2e44b82181f55da9e35b to the version-aligned release commit above. Earlier source archives of this tag are not equivalent to the completed release. v0.8.0-alpha.1 and its assets remain unchanged.

SHA-256

6b816ee21d88809da7f34ef1b314466bb4def697ff5da4bd643b959ab4a0e2cb  NeuroTune_0.8.0-alpha.2_x64-setup.exe
78d43f11fe22a7d312b48b83b8d7ce75f382e45542d16cc801e5a1f0e42a98f6  NeuroTune-0.8.0-alpha.2-win-x64.zip

NeuroTune v0.8.0-alpha.1 - AI-led Investigation Preview

NeuroTune v0.8.0-alpha.1

AI-led Investigation Preview

An unsigned prerelease for controlled Windows 11 x64 testing, not a promise
of optimal tuning or measured performance gains. Keep an independent backup;
use a disposable VM for system-changing acceptance tests.

Highlights

• One complete diagnosis: local scan, workload preparation, three automatic
  matching WPR captures, local quality checks and then the selected AI's
  investigation. Without a running workload, a single system-wide diagnostic
  remains non-benchmark evidence and cannot unlock apply.
• Real progress and cancellation: actual phases, bounded operation logs,
  elapsed/countdown timers and owned-recorder cleanup. Both assistants stay
  inactive during measurements; the existing watchdog finalizes captures if
  the app closes. Completed reports are retained on investigation failure.
• AI-led, bounded follow-ups: the main model can challenge local hypotheses
  and request fixed read-only Windows readers for counters, pressure, storage,
  displays, devices, networking, services, recent event metadata and observed
  drivers. The default 12-turn/10-minute budget is configurable; no arbitrary
  shell, model-supplied query/path, web research or firmware operation is a tool.
• Four prompt specializations: overall performance, system latency, network
  optimization and system stability. These guide reasoning on every turn, not
  predetermined tweaks. Risk, evidence, budgets and approval stay independent;
  saved FPS/efficiency goals retain their original meaning.
• Optional supporting files: up to 8 reports/screenshots, including 4 images,
  with editable inert-text previews, local preparation and explicit privacy and
  model-vision consent. Reports are limited to 40,000 characters each / 80,000
  combined; prepared images are PNG, at most 1600 px per side and 768 KiB each.
  These remain unverified user-supplied sources. Images are not anonymized and
  may be sent on every investigation turn; pixels are not saved in local run
  history. No external application is launched and no image/model fallback or
  separate OCR provider is silently used.
• Official ChatGPT browser authorization: PKCE, verified identity, encrypted
  per-user credentials, saved accounts and a native model dropdown. Eligible
  plan/credits usage stays separate from API-key billing; no cookie/Codex
  impersonation or automatic billing fallback. Preview eligibility, models and
  usage availability are controlled by OpenAI, not guaranteed by NeuroTune.
• Optional System One assistance: default-off managed local Rizzo Flow topic
  classification with pinned downloads, explicit installation consent, a real
  install smoke test and one-shot non-admin workers, or a separately consented
  OpenRouter classifier with its own encrypted key/model and API costs. Advice
  is uncalibrated, non-causal and cannot replace evidence or authorize writes.
  Elevated launches require Windows' verified linked standard-user UAC token
  with the same user and medium integrity; otherwise they refuse (including
  environments without UAC split tokens). No desktop ACL changes or
  administrator fallback are attempted. Non-admin execution is not a
  filesystem/network sandbox.
• Optional export-only firmware support: explicitly approved local SCEWIN
  packages can export settings; offline text imports remain unverified. Hashes
  identify files, not vendor authenticity. Driver/elevation risks and unknown
  values are visible; there is no BIOS import/write or security-bypass command,
  automatic SCEWIN download, or claim of motherboard compatibility.
• Review and decline: risk-ordered proposals show evidence, trade-offs,
  uncertainty, prerequisites and reversal. Outside-catalog ideas remain manual
  guidance/inert scripts, not write authority. Finish without changes safely
  closes a prewrite run while preserving the report. AI failure never becomes
  a deterministic executable substitute plan.
• Read-only comparison explanation: the selected AI can explain valid
  aggregates in the chosen focus without altering metrics or keep/rollback
  decisions. Improved measurement charts preserve missing-evidence and
  interrupt-attribution caveats.
• Readiness-driven dark startup: branded pre-JS presentation, no artificial
  minimum delay and no wait for optional model discovery. Restrained CSS motion
  stops for reduced-motion users and observed recording intervals.

Execution and privacy boundaries

NeuroTune still executes only registered, reinspected capabilities after
matching persisted approvals, separate high-risk consent, required restore
points/backups and verification. Manual scripts are inert. System-wide captures,
user reports and screenshots cannot substitute for valid workload baselines.
Scheduling/ISR/DPC traces do not measure FPS, ping/jitter or end-to-end input
latency; attribution, configuration, source grades and heuristics are not
causal proof.

Prepared report text and file names/hashes remain in local run evidence;
screenshot pixels are transient. Best-effort redaction is not guaranteed
anonymization. Review all previews before consenting to cloud transmission.

Validation and remaining acceptance

• Local automated validation: 99 .NET, 28 UI and 2 Rust tests passed, plus
  typecheck/lint, formatting and production/native builds. Elevated CI without a
  verified standard-user token checks safe worker refusal, not inference;
  local unelevated tests
  exercise Unicode/environment isolation and cancellation. Rust audit is a CI
  gate. Vitest/mocker is patched to 4.1.11 for GHSA-82fw-gwwq-j7x9.
• Mocked browser checks cover orchestration, four presets, separate consent,
  final review/decline, keyboard, reduced motion and a narrow/scaled layout.
  Supporting-file checks use the published agent for actual local normalization,
  PNG bounds, report redaction and hashes; recording and main AI are mocked.
• Real elevated complete diagnosis against a representative workload, all
  cancellation/app-close paths and native cold-start anti-flash presentation
  still need desktop acceptance. Historic VM results are not fresh validation
  of this build.
• Live main-provider/vision planning, fresh ChatGPT account/refresh/revocation
  variations, managed local installation/inference/resource use and authorized
  auxiliary OpenRouter calls remain separate acceptance work. Existing-account
  ChatGPT model discovery succeeded; this does not prove planning or eligibility
  for other accounts.
• No compatible approved SCEWIN package has established vendor authenticity,
  driver/export safety or board compatibility. Export execution remains untested.
• Full Narrator and physical 150%/200% scaling acceptance, thermal/measurement
  repeatability and performance comparisons against a generic CLI prompt remain
  pending. No benchmark benefit or optimality guarantee is claimed.
• CPU-Z/GPU-Z vendor-specific report adapters, GUI automation, automatic image
  acquisition, external application/driver catalogs, firmware writers and
  supervised GPU IRQ-affinity writes remain unsupported or gated. The first
  reviewed external artifact and version-feed adapters are still pending.

See investigation and execution boundaries,
optional components, the
test guide and the
historical validation matrix.

Distribution and verification

The release assets are an unsigned per-machine NSIS installer, a portable ZIP
with both self-contained agents and SHA256SUMS. Windows SmartScreen may warn:
PrimeBuild does not provide an Authenticode signature for this free alpha.
Verify the downloaded asset's SHA-256 against SHA256SUMS before running it.

"Portable" means installation is not required; settings, reports, encrypted
credentials and rollback data still live under %LocalAppData%\NeuroTune.
The ZIP/installer contains no user's credentials, optional model weights,
SCEWIN binaries or vendor drivers. Optional downloads require their own consent
and third-party license/trust review; NeuroTune's MIT license does not grant
redistribution rights to those packages.

NeuroTune v0.5.0-alpha.1 — Deep Inventory Preview

NeuroTune v0.5.0-alpha.1

This prerelease expands NeuroTune from a small settings check into a phased system inventory with an objective-aware local conflict graph.

Highlights

• Versioned schema-v3 evidence bundle
• 83 vetted gaming, graphics, scheduler, memory, network, power, input, security, and policy Registry probes
• Hardware and firmware inventory through native Windows APIs: motherboard, BIOS/UEFI, CPUID, DIMMs, configured memory speed/voltage where exposed, displays, storage reliability, thermal zones, and virtualization security
• BCD overrides, file-system filters, power capabilities, driver inventory, device errors, network components, adapter properties, software, services, startup, and tuning/overlay signals
• Five real scan phases with progress streamed from the local .NET agent to Tauri
• Deterministic conflict graph naming every involved evidence ID/value, relationship type, confidence, affected objective, and counterproductive effect
• AI findings and recommendations remain bound to locally verified evidence
• Up to eight minutes for provider synthesis instead of the previous short timeout
• AI-recommended, conflict-fix, and all-supported action views
• High-risk supported actions remain selectable with stronger confirmation
• Reversible grouped repairs for manual GPU TDR and legacy global TCP overrides
• Explicitly labelled DDR4 XMP/DOCP heuristic when configured speed exceeds the standard 3200 MT/s ceiling

Firmware boundary

Windows does not reliably expose XMP/DOCP/EXPO state, PBO, complete timings, or trustworthy factory-vs-current voltage data on every platform. NeuroTune reports unavailable evidence instead of guessing. PawnIO is detected when already installed but is not downloaded, installed, or used automatically in this build.

Safety boundary

The model cannot execute commands, scripts, firmware writes, arbitrary Registry changes, or unknown actions. Every supported write still requires explicit approval, a verified System Restore point, affected Registry exports, local verification, and a rollback journal.

Install

1. Download NeuroTune_0.5.0-alpha.1_x64-setup.exe and its .sha256 file.
2. Verify the installer SHA-256 value.
3. Run the unsigned installer and launch NeuroTune as administrator.
4. Enable Windows System Protection before applying any action.

Alpha limitations

• The installer is unsigned and may trigger Windows SmartScreen.
• In-phase scan cancellation, low-level optional telemetry, and trustworthy offline component baselines remain tracked in issue #3.
• Apply and rollback require further validation in disposable Windows 10 and Windows 11 virtual machines.

Use this build for evaluation only and review every selected action before approval.

NeuroTune v0.4.0-alpha.1 — Evidence Preview

NeuroTune v0.4.0-alpha.1

This prerelease makes diagnosis goal-aware and evidence-checked instead of presenting the same catalog on every PC.

Highlights

• Choose a target: balanced, frame rate, system latency, network latency, or efficiency
• Add relevant games and workloads before requesting a diagnosis
• Inspect 30 curated performance, gaming, graphics, memory, and network Registry values
• Collect display mode, form factor, page-file policy, virtualization-based security, and other hardware context
• Detect selected policy conflicts and manual overrides locally
• Require every model finding to return an exact evidence ID and value from the local scan
• Reject recommendations that do not reference verified evidence or a compiled action ID
• Show only actions justified by the current diagnosis
• Select all, select safe-only, customize the plan, or print/save the report as PDF
• Restore selected manual LargeSystemCache, DisablePagingExecutive, and MPO overrides through reversible actions

Safety boundary

The model still cannot execute commands, scripts, arbitrary Registry changes, or unknown actions. Every approved operation requires a verified System Restore point, affected Registry exports, local verification, and a rollback journal.

Install

1. Download NeuroTune_0.4.0-alpha.1_x64-setup.exe and its .sha256 file.
2. Verify the installer SHA-256 value.
3. Run the unsigned installer and launch NeuroTune as administrator.
4. Enable Windows System Protection before applying changes.

Alpha limitations

• Hardware/firmware inspection is not yet equivalent to CPU-Z or HWiNFO.
• The Registry scan is curated rather than exhaustive.
• The installer is unsigned, so Windows SmartScreen may warn.
• Apply and rollback still require validation in disposable Windows 10 and Windows 11 virtual machines.

Use this build for evaluation only and review every selected action before approval.

NeuroTune v0.3.0-alpha.1 — Tauri Preview

NeuroTune v0.3.0-alpha.1

This prerelease replaces the original WPF prototype with a modern Tauri 2 and React desktop experience while preserving NeuroTune's local safety boundary.

Highlights

• New guided Overview → Provider → Scan → Review → Activity workflow
• System-synchronized light and dark themes with manual override
• Automated semantic-token contrast checks
• OpenRouter, OpenAI, Anthropic, DeepSeek, custom, and local model connections
• OpenRouter browser authorization with PKCE and a loopback callback
• Ollama, LM Studio, and vLLM presets through OpenAI-compatible endpoints
• HTTPS enforcement for remote custom providers; plain HTTP only on loopback
• DPAPI-protected credentials and OAuth-issued keys
• Verified System Restore points, Registry backups, per-action journaling, and rollback
• Recovery warning for interrupted operations

Install

1. Download NeuroTune_0.3.0-alpha.1_x64-setup.exe and its .sha256 file.
2. Verify the installer SHA-256 value.
3. Run the installer and launch NeuroTune as administrator.
4. Enable Windows System Protection before applying changes.

Alpha limitations

• The installer is unsigned, so Windows SmartScreen may warn.
• Diagnosis is intentionally constrained to the current local profile and compiled action catalog; comprehensive Registry conflict and hardware-specific policy analysis is not included yet.
• ChatGPT Plus and Claude Pro subscriptions cannot be used as API credentials. Browser authorization is exposed only where an official third-party flow is available.
• Apply and rollback still require validation in disposable Windows 10 and Windows 11 virtual machines.

Use this build for evaluation only. Review every proposed change and keep independent backups of important data.

NeuroTune v0.1.0 — Alpha Preview

Initial Alpha Preview

This is the first downloadable NeuroTune prototype for Windows 10 and Windows 11 (x64). It is retained for traceability and has been superseded by ongoing alpha development on main.

Included

• Basic WPF setup, analysis, optimization, and rollback screens
• BYOK support for OpenRouter, OpenAI, and Anthropic
• Local Windows profiling and a strict action allowlist
• System Restore point, Registry exports, operation journal, and rollback
• DPAPI-protected API keys and redacted local logs

Installation

1. Download NeuroTune-win-x64.zip and verify its SHA-256 checksum.
2. Extract the archive.
3. Run NeuroTune.exe as administrator.
4. Ensure System Protection is enabled before applying an optimization.

Important

This build is unsigned, incomplete, and intended only for disposable Windows virtual machines. Windows SmartScreen may display a warning. Do not treat this release as production-ready software.