aeterna-rongroi 0.13.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

Added

• The landing page's footer and the README link the AETERNA Game Discord (https://discord.gg/eZ8CNrGe2b), a plain link; questions
  and false-positive reports still belong in GitHub Discussions.
• The landing page's link previews carry an image (og:image, twitter:card), so a link pasted into Discord or
  another chat shows a card with a picture.
• The landing page's FAQ is also in its JSON-LD as a FAQPage; a test fails when the eight questions on the page
  and in the JSON-LD differ.
• file_unread on an autostart row: why a file under the Windows folder was not hashed or checked (ADR 0084).
• llms.txt on the landing page's site (llmstxt.org): what the tool does and does not do, and links to the README,
  guides and the key ADRs. cargo xtask site fills its version, date and rule and selector counts from the
  published release, as it does for the pages.
• A game-window view, marked experimental, in the desktop app and the CLI (ADR 0078): after the latest-session
  statement, it lists the programs Windows recorded running in the 30 minutes before a FiveM session, during
  it, in the 30 minutes after it, and between its end and the scan, with the facts about each (recorded in
  which window, near how many sessions, its file no longer where it ran from, no verifiable signature, a name
  that contradicts its content, a path under a folder the account can write, loaded files outside the expected
  folders) and the ordinary causes of each. The facts are labels, never a score, a colour or a verdict; the list is
  ordered by how many identity facts hold, and its heading says that is a count, not a judgement. A fact that
  is not known says why, so it never looks like one that does not hold; an earlier session shows only its start.
  In SS mode the view names only the programs with an identity fact and counts the rest per window; Self mode
  shows all of them. A candidate's file details fold under its card: SHA-256 and signer certificate in full,
  content kind, the name in its version information, the download zone and website, and which collectors
  recorded it. Both consent screens say what the view reads, and the desktop's full-scan list now carries the
  CLI's recorded-files item.
• recorded_files, a new full collector (ADR 0079, ADR 0080): for each drive-rooted path that BAM, the Program
  Compatibility Assistant, UserAssist or the process list recorded, it reads the file for its content kind (whether
  its bytes match its name, whether data trails its end, whether a program is inside), SHA-256, signature,
  the original file name in its version information, and its Zone.Identifier stream (the download zone and
  the website's name; the rest of the address and the page that linked to it are dropped). Files are read
  nearest the last FiveM or GTA V time first, for up to 90 seconds. A file that cannot be read says why on its
  own row instead of making a gap for the whole run. Reading a file, including that stream, can move its
  last-access time on a PC that keeps one; this was measured and PRIVACY.md says so.
• userassist, a new standard collector (ADR 0080): which programs the account the scan runs as opened through
  Windows' shell, and when it last opened each. Paths are reported as BAM's are; an app name is reported as
  that name; shortcuts are counted, never listed; whether that account is the one signed in at the keyboard is
  said as same or other.
• event_fields, a new standard collector (ADR 0081): from four kinds of event it reads named fields only.
  A service or driver install (System 7045): when, whether it is a driver, and a SHA-256 fingerprint of its
  path (not the path, name or account). A clock change (Kernel-General 1, Security 4616): the times before and
  after, the reason number and whether a program in Windows' own folder made it; changes under a minute are
  only counted. A file Code Integrity refused (3033): a fingerprint of its path after the drive, how many times
  and when. A fingerprint matches only the same path, and SS mode shows it.
• prefetch emits run_times (every run time the file holds, at most eight, newest first) and, for the game,
  rundll32.exe and regsvr32.exe only, loaded_outside (ADR 0078, ADR 0082): how many files with a program's
  extension its loaded-file list names outside Windows, Program Files and FiveM's program folders. Only the
  number is reported, in both modes, never a path or a name. With no system volume to compare with it says
  loaded_outside_unknown.
• Parsers for a file's content kind, the original file name in a PE version resource, the Zone.Identifier text
  and UserAssist entries, each with fuzz targets; fuzz_evtx also covers the three event readers.
• cargo xtask coverage writes docs/coverage.md, a table of what is known about each rule (checks, baseline,
  trace ages, measurements), and rules/measured.csv is the ledger of where each was seen on which machine
  (ADR 0074). CI runs cargo xtask coverage --check; a gap never fails it. docs/rules-authoring.md says what
  stable needs.
• Lab replay (ADR 0076): lab/replay.sh boots a throwaway copy of the maintainer's Windows virtual machine with no
  network, runs one scenario from lab/scenarios/, scans and checks the scan, and cargo xtask lab-check
  compares a scan with a scenario's expect.yaml and prints the ledger rows. Seven scenarios are in, with
  their ledger rows.
• Lab replay also checks the game-window view (ADR 0076, amendment of 2026-10-27): a scenario's expect.yaml
  can list a candidate's facts and a clock change, a scenario can ask for a full scan on the lab machine only
  (ADR 0052, amendment of 2026-10-27), and three scenarios under lab/scenarios/game_windows/ show a renamed
  program run before a session, a downloaded program with its zone, and a clock change.
• A weekly workflow, windows watch (ADR 0075), scans each GitHub Windows image and compares only the shape of the
  report (build, rule states, collector field names; no values, paths or counts) with fixtures/watch/. It is
  never a required check.
• An advisory provenance job on pull requests reports commits that lack the project's attribution lines; it
  never fails a pull request.

Changed

• Nothing in the report vouches for a program, a file or a PC (hard rule 9, ADR 0084):
  • The overview no longer says "benign", "No Wiping Found", "Continuous History" or "Offline Sealed". With
    no tamper evidence it says "Evidence only. This report cannot prove that a PC is clean." and that no log
    clearing was found in what was read. The tamper texts say that evidence of strength tamper was found,
    not that a log was cleared, because only some of the eleven tamper rules are about a cleared log.
  • "Copy for AI Analysis" asks for each observation's ordinary and other causes and what the unmeasured
    checks leave unknown, and tells the AI not to conclude that the PC is clean or was used to cheat.
  • A program named FiveM.exe, GTA5.exe, GTA5_Enhanced.exe, PlayGTAV.exe or FiveM_b…_GTAProcess.exe
    is a game-window candidate like any other, wherever it is; before, the name alone kept it out.
  • autostart hashes and signature-checks files under the Windows folder too, after the others and under a
    second 30-second budget. The consent text says so. Many Windows files read "No embedded signature",
    because Windows signs them through catalogs, which this program does not read.
  • The rules reference labels an allow block "What the rule expects", not "Legitimate software excluded".
• The first three rules are stable: a PCI device no longer present, a PCI device with no driver (problem
  code 28), and an input device no longer present. Each was seen found on the lab virtual machine (ADR 0070,
  ADR 0072), is measured on a client Windows build and is confronted by a baseline — the three conditions of
  ADR 0074 §5. What a rule says it shows and does not show is unchanged.
• The rules reference describes stable by those three conditions instead of "proven on real traffic".
• Three more rules are stable: Windows PowerShell's and PowerShell 7's script block logging turned off by a
  machine policy, and an event log file set read-only. Each was seen found in a lab replay (ADR 0076,
  lab/scenarios/), is measured on a client Windows build and is confronted by a baseline.
• A pull request that changes only documentation, the site or text skips the Rust compile and tests, and one
  that does not touch parsers, fixtures, fuzz or the lockfile skips the fuzz smoke run; a promotion from dev to
  main passes at once.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.13.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	d824025ccefacf0732dd7f456a10cf668e7226f2b54c52b6b0a6d205eb69e39c
aeterna-rongroi-cli-0.13.0-windows-x64.exe	Command line (does not use WebView2)	3b5344c2a79b27e3ee058388244e41c9f9845f2bf31c25434b75752f69674656

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 77 rule(s) · SHA-256 fc86daf8143d06f6421ebaab0d494aa8204dffba693c264d1325dd7b4b120bba. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.13.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.13.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.13.0 and no UNOFFICIAL BUILD banner.

If any of these ...

aeterna-rongroi 0.12.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

Human-First Summary View and AI Export capability (ADR 0045).
Users can now switch effortlessly between an approachable, friendly Overview Summary and the complete forensic Detailed Report. Includes a 4-node horizon timeline (History Origin, Last Boot, FiveM Play, and Current Scan), 3 quick-glance focus cards with reassuring explanations, category filters, and an AI Export button that packages a sanitized, privacy-safe forensic prompt with Windows usernames and SIDs masked for pasting into AI assistants.

Added

• Human-First Overview Summary View (apps/desktop, ADR 0045): Seamless tab switching between "Overview Summary" and "Detailed Report" with glider animation.
• Horizon Timeline: 4 interactive milestone cards detailing machine history continuity, last boot time, FiveM session status, and current scan integrity.
• Quick Glance & Reassurance Cards: 3 focus cards highlighting FiveM activity, history continuity (USN/Event Log clearing detection), and findings breakdown with plain-language explanations of benign causes.
• AI Export Button: Instant one-click clipboard export formatting report facts and observations into a neutral AI analysis prompt, automatically sanitizing user account directories (C:\Users\<user>\) and Windows security identifiers (SIDs).
• Strict Vector Icons: All emojis replaced with crisp inline SVG vector icons complying with Aeterna design standards.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.12.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	71a4cd42b9d0433fbeb92360ea24c20007fa07e98b95a6042f7f4062f269d74d
aeterna-rongroi-cli-0.12.0-windows-x64.exe	Command line (does not use WebView2)	008826120ffcb0226a289eeb8ec70a7b676869d68a694e61d36fe07af8435f2c

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 77 rule(s) · SHA-256 944035a48e3bbb47c3feaf5c81f5f7d09c44ddbdf77b16c148a52add3fb4cd5d. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.12.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.12.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.12.0 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit 55616ee by this workflow run.

aeterna-rongroi 0.10.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

A report can be kept. In SS mode the window takes a case code from the server, shows the SHA-256 of the report for
staff to note, and saves exactly that report where the player chooses; a file whose SHA-256 starts the same is the
report that was on screen. Every scan also reads the mice, keyboards and other input devices Windows remembers, for
their times: when one was taken out and another plugged in. Nothing is signed and nothing is sent.

Added

• Save this report, in SS mode only (ADR 0073). The consent screen takes an optional case code from the
  server (six Crockford base32 characters, shown XXX-XXX); the SS screen shows the code and the SHA-256 of the
  saved record, its first 16 characters large for staff to note, and Save writes exactly those bytes through
  Windows' own Save dialog: the SS view, every PCI and HID device, the code and when the scan ran. The CLI does
  the same with scan --mode ss --json --case-code CODE, printing the SHA-256 on standard error. Nothing is
  signed and nothing is sent; a matching digest shows only that a file is what was on screen (ADR 0040).
• The mice, keyboards and other input devices Windows remembers are read on every scan (hid_device, ADR 0072),
  present or not: the maker and model numbers, the driver (mouhid, kbdhid) and the times Windows stores; never a
  serial number or a name. One experimental context rule, an input device Windows set up earlier is not present
  now, and a timeline selector that puts every input device's times on the timeline, so a mouse taken out and
  another plugged in can be read beside the session. It cannot tell a box between the mouse and the PC from a mouse.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.10.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	fa24d6cae2ee7a153f307e004799aa406907cf607e0849da6a0ae3e3b00170ed
aeterna-rongroi-cli-0.10.0-windows-x64.exe	Command line (does not use WebView2)	53425f9daea50872038d5c5201db2651049f839df8c0b5905a9aec1de3c31e53

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 73 rule(s) · SHA-256 fbc0d3fb24bfe7c7de58c02c2d00f6889bee1e512e9a185806e6579f041545cb. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.10.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.10.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.10.0 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit d7c0b83 by this workflow run.

aeterna-rongroi 0.9.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

The first checks about DMA cards, and what they cannot show. Every scan now lists the PCI devices Windows remembers,
present or not, with a rule for a present one that has no driver and one for a device that is gone; how Windows started
each time, so a missing removal time can be read; and whether the firmware describes an IOMMU. A DMA card that
imitates an ordinary device, a cheat on a second PC and a box between the mouse and the PC still leave nothing here.

Added

• A windows_start collector: for each start of Windows its System log remembers, the time and BootType of
  Kernel-Boot event 27 — one number, nothing else of that event — and two timeline selectors that mark a start
  as after a full shutdown (0) or after a Fast Startup shutdown (1). Beside pci_device's times it tells the
  two cases apart: a device removed before a full shutdown has no removal time (ADR 0071, amending ADR 0018 and
  ADR 0024).
• The PCI devices Windows remembers are read on every scan (pci_device, ADR 0070), present or not, as model ids
  with their class code, driver, problem code and the times Windows stores; never a serial number. Two
  experimental rules: a PCI device has no driver installed (presence, problem code 28 — on an ordinary PC
  the host bridges have no driver service but no problem code) and a PCI device Windows set up earlier is not
  present now (context, with the last start of Windows it was present at, and a removal time only when Windows
  recorded one). A timeline selector puts the absent devices' times on the timeline. The consent text, PRIVACY.md
  and the screenshare guides say what is read and what it cannot show: a DMA card that imitates an ordinary device,
  and a mouse box.
• posture reports iommu_table: whether the firmware gives Windows an ACPI table describing an IOMMU — dmar
  (Intel VT-d), ivrs (AMD-Vi) or none — read from the table names alone, with no administrator rights. Not read
  on Arm PCs, where the field is a gap. A new experimental posture rule, "The firmware describes no IOMMU to
  Windows". It says nothing about whether Kernel DMA Protection is on, and nothing about any device (ADR 0038,
  amendment of 2026-10-15).
• Hosts can list the devices Windows remembers: DeviceSource::devices(bus) reads the PCI or HID enumerator
  through CfgMgr32, present devices and absent ones, each as a model id with no instance part (no serial number or
  board position), its PCI class code, driver service, problem code and the three times Windows stores, in whole
  seconds. A property that cannot be read is named as unreadable rather than read as "no value". No administrator
  rights are needed. pci_device reads the PCI half; no collector reads HID yet (ADR 0069, ADR 0070).

Changed

• ADR 0070 accepted (2026-10-15, all four questions as recommended): a pci_device collector over ADR 0069's
  source, with two rules — a present PCI device with no driver installed (problem code 28, presence) and a PCI
  device set up earlier that is not present now (context, saying "removed at" only beside a time Windows
  recorded) — and a timeline selector for absent devices. No HID collector yet.
• ADR 0069 amended with measurements in a virtual machine: a device removed while the PC was off is absent with
  LastArrivalDate = the last start it was present at and no LastRemovalDate; one removed during a Fast Startup
  shutdown gets LastRemovalDate = the resume, and the kernel's start time does not move then.
• ADR 0069 accepted (2026-10-15, all five questions as recommended): a read-only DeviceSource that lists the PCI
  and HID devices Windows remembers, present or not, with a model id (never an instance or serial), class code,
  driver service, problem code and the times Windows stores beside each. Measured first on one PC: no administrator
  rights needed, LastArrivalDate is re-written at each start, and LastRemovalDate is not written at shutdown. It
  does not detect a DMA card, and no rule may say a device was removed until what a card taken out while the PC is
  off leaves behind is measured.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.9.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	471bdff5a03ad871279668c0a609ee1977bc2386c0e4168fb72cfc8f23a5eff3
aeterna-rongroi-cli-0.9.0-windows-x64.exe	Command line (does not use WebView2)	42814afa85bd0206f4c07298499b61b488f4e2ad0352ffbae615b242226415a0

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 71 rule(s) · SHA-256 611b43dc321ba8a06373e8f50904162565e7e57432167e562bb65b920dcf0a02. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.9.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.9.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.9.0 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit def8f42 by this workflow run.

aeterna-rongroi 0.8.2

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

The checks are those of 0.8.1; two rules' text says what was measured. The hash check is one Command Prompt line
for every version, and the landing page and release.json take the version, files and rule count from the
published release, so other sites can show them without copying a number.

Added

• release.json on the landing page's site: the latest published release (version, tag, date, links, and each
  executable's name, size and SHA-256), for other sites to read instead of copying the version by hand.
  cargo xtask site builds it, and the landing page's version and download links, from the release list; it
  refuses when GitHub's digest of an executable differs from SHA256SUMS. Publishing a release redeploys the page,
  so a release no longer edits site/.
• release.json counts the release's rule set as stats (rules, timeline selectors, and rules by status), read
  from rules/ at the release tag rather than from dev, so a page can say how many rules a release ships without
  anyone typing the number; {{rongroi.rules}} gives it to the landing page.
• cargo xtask check-versions (CI): the README Status sections, the screenshare guides, the desktop manifests and
  every release file name in those pages name Cargo.toml's version, so a release pull request cannot miss one.

Changed

• README and screenshare guides: the hash check is one Command Prompt line that is the same for every version,
  for %f in (aeterna-rongroi-*-windows-x64.exe) do @certutil -hashfile %f SHA256, which prints each downloaded
  file's name above its hash (checked on Windows 11 build 26220); the release file names are written
  X.Y.Z.
• The two Windows PowerShell script block logging rules say what was measured instead of "not measured": on a
  GitHub-hosted runner, a machine policy set to 0 stopped every 4104 record, flagged ones included, and left 400
  written (ADR 0063, amendment). The command history rests on PSReadLine's source, which does not read the policy.
  ADR 0064 records that a Microsoft account was measured for the history's account comparison.
• The per-user script block logging rule says its policy was measured too: at 0 it silences the flagged blocks and
  leaves 400 written, and a machine policy decides when both are set (runner run 37925318316, ADR 0063).

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.8.2-windows-x64.exe	Desktop app (uses Microsoft WebView2)	2c306a1df0ef89947542e3921968c59627b2ca0e00f4f329efad90689f736fba
aeterna-rongroi-cli-0.8.2-windows-x64.exe	Command line (does not use WebView2)	a01938d7a08aa78e031cab39101dc9524ec07d464e7089ca6ef5f56c92cf5793

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 65 rule(s) · SHA-256 86181e3838f168267baf9c6633ab74a2902f5e347f6cc6caddb0d06c015e3cd1. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.8.2-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.8.2-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.8.2 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit 6978129 by this workflow run.

aeterna-rongroi 0.8.1

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

The checks are those of 0.8.0. A rule's text now says what a policy that switches Windows PowerShell's script
block logging off empties in this program's reading, and two sentences of the screenshare guides read right again.

Changed

• ADR 0065 accepted: websites known to hand out loaders, as SHA-256 hashes of hosts in a data file with no host,
  seller or link, matched through match_lists against a new download_host_sha256 that SS mode hides like the
  host; three per-source presence rules. Shared platforms are never listed, a row needs evidence a maintainer
  checks privately, and nothing ships until the first row exists.
• When a policy turns Windows PowerShell's script block logging off, the report now says what that empties
  (ADR 0063, amended 2026-10-09): the two Windows PowerShell posture rules' descriptions say the timeline then holds
  no flagged-block time and a full scan finds no kind of word in a flagged block, whatever ran, while the history
  and engine starts are not expected to be affected (not measured); the two selectors that read flagged blocks name
  the policy in their falsepositives; both screenshare guides say how a found row changes the reading of the
  PowerShell rows after it. Text only: a posture row is already listed in SS mode whatever its state.
• Screenshare guides: two release-history sentences that the 0.8.0 version bump had changed by mistake ("0.6.0 and
  0.8.0 add no rules", "0.6.0, 0.8.0 and 0.8.0") read 0.7.0 again.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.8.1-windows-x64.exe	Desktop app (uses Microsoft WebView2)	dee6629f9fbbf3d5fa7798ca3a25c2e8777d061515bb594c35ec1e0da2e5589c
aeterna-rongroi-cli-0.8.1-windows-x64.exe	Command line (does not use WebView2)	f43b0898e6bb752fb330900323378568089546ed17ce4f0509eb81fb390735cc

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 65 rule(s) · SHA-256 24b91cd86cd77763eef5466e6ffbe11b8c669337e2b229ccc8470b424ecc13f7. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.8.1-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.8.1-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.8.1 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit c718cff by this workflow run.

aeterna-rongroi 0.8.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

PowerShell. A standard scan puts on the timeline when PowerShell itself flagged a script, and counts deletions in
the folder where it keeps the history of typed commands. A full scan, which the player agrees to before it starts,
also reads which kinds of words PowerShell's commands held — a download that was run, a change to Microsoft
Defender, a cleared log — and keeps no command. Eight rules are new, all experimental.

Added

• powershell_text's history observations say whose history it is (ADR 0064, amended 2026-10-09): account is
  same or other as the scanning account equals the one Windows' sign-in screen last signed in
  (LastLoggedOnUserSID), or unknown; neither SID is reported. Measured on a runner with a second local
  administrator in the runner's session. The three history rules' falsepositives and both screenshare guides
  say what other means.
• A full scan reads which kinds of words PowerShell's commands held, never the commands (ADR 0064, third of
  three changes): a full collector, powershell_text, reads the account's PSReadLine history, the script blocks
  Windows PowerShell flagged and the command lines it was started with, hands each text to the parsers and keeps
  kinds, counts and times — how many commands ago for the history, which has no times. Six experimental rules,
  per source (history, Windows PowerShell start): downloaded something and ran it (presence), told Microsoft
  Defender to look away and cleared a log, the history or Prefetch (tamper); a timeline selector for the logs'
  download-then-execute times. A download's host is the one text kept: a new sensitive kind, download_host, shown
  in SS mode as %DOWNLOAD_HOST% unless the player agrees to its own question (CLI and desktop, both languages);
  an address is kept as its kind only. The full-scan question names PowerShell. Amended: the collectors'
  AGENTS.md, ADR 0052 §5 and §6, ADR 0060 §4 and PRIVACY.md, each naming this collector as the one exception;
  docs/architecture.md, the glossary and both screenshare guides describe it.
• rongroi-parsers::evtx::powershell_text (ADR 0064, second of three changes; ADR 0018 amended): reads the payload
  of exactly two kinds of record — a script block Windows PowerShell flagged (4104 level 3, its parts joined by
  ScriptBlockId) and the command line Windows PowerShell started with (400 HostApplication) — and classifies
  each where it is read, returning kinds, a time and at most a download host, never the text. records is
  unchanged. Tested on rendered records (parts out of order, a word split across parts, a missing part, the
  collisions, three renderings of a 400, a leak test) and, by an ignored test that prints counts only, on the
  development PC's two logs: 135 blocks and 1 546 starts in under a quarter of a second each. fuzz_evtx calls it.
• rongroi-parsers::powershell_text (ADR 0064, first of three changes): classifies a PowerShell history file, a
  script block's text or a command line into the fixed list of kinds as booleans — after undoing escapes, joined
  literals and up to two levels of encoded command — plus the host of the first download URL, reduced to a plain name
  or an address's kind. It keeps no other text; its tests assert that a password, a token, a path, a port and a query
  do not survive. A fuzz target, fuzz_powershell_text, seeded from four synthetic fixtures in
  fixtures/parsers/powershell-text/, joins the CI smoke run. Nothing calls it yet.
• PowerShell, without reading what it says (ADR 0063):
  • a timeline selector puts on the timeline the first and last time Windows PowerShell's operational log holds a
    script block PowerShell itself flagged as suspicious (event 4104, level 3) — never the script's text. Not a rule:
    the one PC measured held 369 such blocks in a day and a half, and a Windows Forms dialog is flagged;
  • the change journal counts a sixth folder, psreadline (%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine,
    where PowerShell keeps the history of commands typed into its window), the first that no other collector reads
    (ADR 0047, amendment for ADR 0063); two context, experimental rules read its deletions and renames, since
    PowerShell itself never deletes or renames the file. The folder's times join the journal's timeline selector;
  • consent text (CLI and desktop, both languages), PRIVACY.md, both screenshare guides and docs/architecture.md
    name them; three rules/unconfronted.csv rows, because no baseline carries a PowerShell log or the folder.

Changed

• ADR 0064 accepted: which kinds of words PowerShell's commands held, never the commands — a full collector
  that classifies PowerShell's history, its flagged script blocks and its start command lines into a fixed list of
  kinds and keeps no text but a download host behind its own question. It asks the owner first whether this
  project reads what a person typed at all, which three standing texts forbid today; the owner answered yes, under
  its conditions. Counts of each kind are recorded on the development PC and on a GitHub-hosted runner (run
  37764960415), whose PowerShell 7 log exists, unlike the PC's MSIX install.
• ADR 0063 accepted: what PowerShell already records, without reading what it says — a timeline selector for the
  script blocks PowerShell itself flags (event 4104, level 3) and a sixth folder for the change journal, the one
  PowerShell keeps its command history in, with two context rules; nothing for PowerShell 7 or event 400 yet.
  Measured on a Windows 11 PC; the owner decided its six questions as recommended on 2026-10-08.
• Screenshare guides (Thai and English), README and the landing page: the download check uses Command Prompt and
  certutil -hashfile <file> SHA256 instead of PowerShell's Get-FileHash, the CLI is run from an administrator
  Command Prompt, and the "downloaded from the internet" mark is removed from the file's Properties instead of with
  Unblock-File. PowerShell keeps its own records on the PC and Windows records when it last ran, so a check typed
  into it during a screenshare puts the call's own time over what was there. certutil's output and .\ in
  Command Prompt were checked on a Windows 11 PC (build 26220), and the 0.7.0 CLI was run from Command Prompt
  there: hash, version, SS scan in Thai and --json > report.json (UTF-8, the consent question on standard error).
• Screenshare guides: a section on comparing the report with what a server recorded — one clock (the report is
  UTC), a row near a server's flag is a question and not proof, whether the session statement fits the time the
  player connected, and which rows to read first for what a server saw. The program still reads nothing from a
  server and sends nothing to one.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.8.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	67986a242852e48c3ce89e6b4ab5e7103d11b022d8c26a9068a28f64a643a84d
aeterna-rongroi-cli-0.8.0-windows-x64.exe	Command line (does not use WebView2)	c277b9fb06200320113629831a0327b4a69d063752d286f4091251d4c7eca0ae

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 65 rule(s) · SHA-256 2baa648d7b57b1a2c9db12710d8fd2d6edcc102dc3d011ab0fcf3bb67211d980. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.8.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.8.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.8.0 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit dda7d0b by this workflow run.

aeterna-rongroi 0.7.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

The checks are those of 0.6.0: no collector, rule, report field or text changed. This release changes how the
window looks, and adds a landing page.

Changed

• The desktop window's look (ADR 0045, amendment of 2026-10-02, owner decision): a bright sky — a light blue
  ground with soft clouds, translucent white panels, rounded corners and pill buttons — in place of dark and gold.
  Styles only; no markup, text or behaviour changed. What section 7 fixed still holds: every state is shown by
  shape as well as colour (found a filled square, not found a grey open circle, never green, not measured a
  dashed circle), and the start-screen choices and the consent text are unchanged. Every text colour measures
  WCAG AA or better against its panel.
• Two typefaces are bundled with the program, so the window no longer depends on the fonts a PC has and still
  loads nothing from another host: Mali for headings, buttons and counts, Anuphan for running text, both by
  Cadson Demak under OFL-1.1 (LICENSES/OFL-1.1.txt, REUSE.toml, NOTICE).
• Consent: the agree and refuse buttons stay at the bottom of the window while the list is read, side by side
  and the same width. The scan's facts are a two-column table headed by the mode; found rows carry an edge as
  well as their square; the full-scan and administrator buttons are sized to their text.
• Checked in WebView2 155 on a Windows 11 PC (build 26220) without administrator rights; recorded in the
  ADR 0045 amendment.
• README: the Status section shows the latest release only, in plain words beside the technical detail, and
  names the tool the way people search for it, in English and Thai. Both screenshare guides cover this release.
• CI: the Windows job runs the script block logging measurement on a pull request only when a crate,
  rules/posture/, the toolchain, Cargo.toml/Cargo.lock or the workflow changed; every push to dev and
  main still runs it. The required check rust (windows) keeps its name.

Added

• A landing page in site/, Thai at the root and English under en/, published to GitHub Pages by
  .github/workflows/pages.yml from dev. Static HTML and CSS only: no script, no tracker, no cookie, nothing
  loaded from another host. It carries a Google Search Console ownership tag, a token that loads and sends
  nothing. GOVERNANCE "How to release" step 1 now names the versions shown on the page, in the README's Status
  section and in the screenshare guides.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.7.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	55e9b9ba2eb94b8640a608dd239ea36d382974d950f04bfa7b0d49cf78aaa153
aeterna-rongroi-cli-0.7.0-windows-x64.exe	Command line (does not use WebView2)	ef75bb44cf76b51624fd4b7571b838f57dfff215ffdbbbf475bc3743bea31334

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 55 rule(s) · SHA-256 0ecefb2d55ee6f451ca6e9fca34ef3efc1d7fe292e9ddbf5d5126255ef011770. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.7.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.7.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.7.0 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit 93bf64d by this workflow run.

aeterna-rongroi 0.6.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

Added

• The session statement (ADR 0062, as amended on 2026-10-02): for each FiveM edition, its last session
  beside its own folders, in both modes, above the timeline, in the CLI and the desktop, English and Thai.
  The start is the earliest started_at of a running FiveM.exe (or Legacy's FiveM_b…_GTAProcess.exe) of
  that edition, else Prefetch's latest run of those names; the end is "still running" or BAM's latest, when not
  earlier than the start. Each source is compared with the start only — "before" beyond ten minutes, "after"
  otherwise, as minutes, hours or days: Legacy's logs, its data\cache and its resource cache index per launch
  mode (a launch source), Enhanced's whole log folder (a launch source, and its latest log write also against
  the end, owner decision 9 of 2026-10-02). Enhanced's per-server cache is not compared (owner decision 12):
  the server folder times the report holds change only when an entry is added or removed. Anchor times are
  printed to the second.
  A place not read keeps its reason; a db that could not be listed reads "not read: the folder could not be
  listed" (decision 2ก). Without Prefetch and BAM and with nothing running, it says when FiveM last ran is not
  known — never a comparison with the scan's time. Its ordinary causes are always printed, first a player
  standing still. Not evidence, never counted, nothing stored between scans. CrossSourceStatement gains
  kind (fivem_and_records, session), amending ADR 0061 section 3; REPORT_SCHEMA_VERSION stays 1.
• The trace ages row of Legacy's resource cache shows each launch mode's index folder creation date beside its
  oldest cache file's, never compared — or that the cache holds no cache file — and the section's causes gain
  four (ADR 0062 section 4).
• Synthetic fixture hosts session-elevated, session-limited-running, session-not-known and
  session-prefetch-off, with two Prefetch and three BAM synthetic files in fixtures/parsers/.
• fivem_dir: each Legacy resource cache observation (legacy_server_cache, per launch mode) carries its
  index, the fixed db subfolder — index_created_at and index_modified_at, the folder's own times from the
  listing the collector already made, and index_files, index_latest_created_at and
  index_latest_modified_at from one listing of db, never a file name (ADR 0062 section 6, amending ADR 0053
  section 1). An index that is not there carries no index field; one that cannot be listed keeps its own times
  and carries no count, without a gap, as an unreadable Enhanced server folder does; an empty one has
  index_files: 0. unconfirmed is not read. New fields only; no rule reads them; the session statement and
  the trace ages row show them (above).
• fivem_edition (legacy or enhanced) on process, bam and prefetch observations (ADR 0062,
  section 6): which of FiveM's two program folders — %LOCALAPPDATA%\FiveM\ or
  %LOCALAPPDATA%\FiveM for GTAV Enhanced\, below a profile — the path each collector already reads is
  below. process reads it from the image path, bam from the value name in any spelling, device paths
  included, and prefetch from the executable's own entry in the .pf file's string table. One shared
  match, rongroi_collectors::fivem_edition; the field is omitted for a path below neither folder, and no
  collector emits a path it did not emit before — BAM's device paths and Prefetch's string table stay
  withheld. New field only: no new reason, and REPORT_SCHEMA_VERSION stays 1. Three synthetic,
  uncompressed SCCA version 31 files in fixtures/parsers/prefetch/ seed fuzz_prefetch as well.
• process emits started_at, each running process's creation time in whole seconds, read through
  GetProcessTimes on the handle it already opens for the path with PROCESS_QUERY_LIMITED_INFORMATION
  (ADR 0062, owner decision 2). A time that cannot be read omits the field, as an unread path does
  (ADR 0010). Under the limited token, the ADR 0062 amendment measured the time and the path read for all
  six of FiveM's processes of the same account. It is read for ADR 0062's session statement only: it is
  not a timeline time in either mode (owner decision 8, 2026-10-02; Field::off_timeline), and no rule
  reads it. Fixture hosts gain an optional started_at per process.

Changed

• The SS consent question (CLI and desktop, both languages) and PRIVACY.md name process start times, the
  edition word on processes, Prefetch and BAM, Legacy's resource cache index times and the session statement
  (ADR 0062 owner decision 9 of 2026-10-01). docs/architecture.md, both screenshare guides ("what not to
  conclude") and the glossary (session, session statement) follow; ADR 0062 records "As built" and
  the owner decisions taken while building it, and ADR 0061 its amendment.
• ADR 0062 (accepted 2026-10-01, implemented by the entries above): FiveM's own folders beside its last session.
  A second kind of cross-source statement, one per edition, puts FiveM's log, cache and resource-cache index
  places beside the session they belong to — its start from a running FiveM process or Prefetch, its end from
  BAM — never beside the scan's own time, with the ordinary causes always printed and a record that was not
  read stated as "not known". The ADR records a read-only measurement on a Windows 11 PC and the owner's
  decisions.
• ADR 0062 amendment (accepted 2026-10-02): nine further sessions over two days on the same PC showed that
  FiveM writes its folders when something happens, not on a clock — standing still in game left Legacy's logs
  3.7 minutes and Enhanced's game logs 69 minutes older than the session's end, while every source was written
  at or after the session's start. Every source is therefore compared with the start only, and prefetch
  gained the edition word. Decisions taken while building it (ADR 0062 "As built"): Enhanced's logs are one
  source, the whole folder, with one end comparison on its latest write; Enhanced's per-server cache is not
  compared, because a server folder's own times do not move when its files are rewritten; process start times
  are not timeline times.

Downloads

Windows 10 22H2 or Windows 11, x64. There is no installer: download a file and run it.

File	What it is	SHA-256
aeterna-rongroi-0.6.0-windows-x64.exe	Desktop app (uses Microsoft WebView2)	7eecdd2af091806bf195ca576830ecbad24c296668af9b6d40eeec1dd9597dc4
aeterna-rongroi-cli-0.6.0-windows-x64.exe	Command line (does not use WebView2)	5f2b1c2bb86a27173abe3f8be27392274d1370c37903e8c191f424a40386eb40

SHA256SUMS lists the same hashes. The .cdx.json files are CycloneDX software bills of materials.

Rules bundle

Rule format 4 · 55 rule(s) · SHA-256 0ecefb2d55ee6f451ca6e9fca34ef3efc1d7fe292e9ddbf5d5126255ef011770. The report header of the program you run shows the same values.

Verify before you trust a result

1. In PowerShell, in the download folder: Get-FileHash .\aeterna-rongroi-0.6.0-windows-x64.exe — the hash must match SHA256SUMS.
2. With the GitHub CLI: gh attestation verify aeterna-rongroi-0.6.0-windows-x64.exe --repo aeterna/aeterna-rongroi --signer-workflow aeterna/aeterna-rongroi/.github/workflows/release.yml.
3. The program shows version 0.6.0 and no UNOFFICIAL BUILD banner.

If any of these checks fails, do not rely on the result.

Windows SmartScreen

These files are not code-signed yet (see GOVERNANCE.md), so Windows may warn before running them. Check the hash first.

ภาษาไทย

• โหลดไฟล์ exe แล้วเปิดได้เลย ไม่ต้องติดตั้ง · รุ่น CLI ไม่ใช้ WebView2
• ตรวจไฟล์ก่อนใช้: Get-FileHash ต้องตรงกับ SHA256SUMS และต้องไม่มีป้าย UNOFFICIAL BUILD — ถ้าไม่ตรง อย่าเชื่อผลตรวจนั้น
• ไฟล์ยังไม่ได้เซ็นโค้ด Windows SmartScreen อาจขึ้นเตือนตอนเปิด
• ผลตรวจเป็นหลักฐานประกอบให้คนตัดสิน ไม่ใช่คำตัดสินว่าเครื่องนี้โกงหรือไม่

---

Built from commit cb152a8 by this workflow run.

aeterna-rongroi 0.5.0

Pre-alpha. aeterna-rongroi shows evidence for a person to judge. It never proves that a PC is clean.

Changes

Added

• How far back the traces reach (ADR 0061), in both modes and in both front ends. A new view section
  lists, for each event log, Prefetch, BAM, PCA, the change journal and each of FiveM's log, crash and cache
  folders, the oldest time the source still holds, its whole days before the scan, how much it holds, what
  the source ordinarily keeps — reviewed text in the new rules/ages/<collector>.yaml, with its references
  and whether Microsoft documents it, translated in rules/i18n/th.yaml — and, for a source that was not
  read, the reason: not_admin reads "not read without administrator rights — not known", never empty. The
  event logs the bundle's rules and selectors read are listed first, each with its size beside its maximum;
  the rest fold into one line. Collectors declare this with Collector::age, copied into the additive
  Report.age_fields. Above the rows are anchors, UTC dates in the new ReportHeader.anchors, where no
  rule reads them, each shown with what ordinarily resets it: boot_time; InstallDate, as "installed or
  last feature-upgraded"; the earliest installation date Windows Setup kept and how many it kept (not
  documented by Microsoft, no subkey name emitted); the change journal's creation date; the system drive
  root's and $Recycle.Bin's creation dates through a new FilesystemSource::times; and FiveM's program
  folders. fivem_dir's FiveM.exe observations gain program_folder_created_at and, for Legacy,
  app_folder_created_at. usn's journal observation gains journal_created_on, the date the journal
  identifier gives when read as a time — undocumented, computed inside the host, never the identifier —
  amending ADR 0047. One cross-source statement, computed in the view and never a rule or evidence, puts
  FiveM's side beside Prefetch, BAM and PCA only when Prefetch or BAM was read, holds no entry for the names
  the FiveM timeline selectors list, and reaches back before FiveM's folders were last written; a record not
  read is "not known", PCA alone never makes it, and the ordinary causes are always printed with it. The
  report records which timeline selectors the bundle held (Report.timeline_selectors). No verdict, score,
  ranking or colour. The consent question (CLI and desktop, both languages), PRIVACY.md, ADR 0034's note,
  docs/architecture.md, the glossary and both screenshare guides say what is read and shown; the CLI takes
  the section's and the statement's fixed words from the desktop's locale files. Two synthetic fixture hosts
  cover a PC read with and without administrator rights.
• What Code Integrity and Microsoft Defender already record, read through the existing evtx collector
  with no new read, field or reason (ADR 0059, accepted by the owner on 2026-09-30). One context,
  experimental rule: Microsoft Defender recorded that its real-time protection was switched off
  (event 5001), whose ordinary causes lead with the PC's maker, because both GitHub-hosted runner images
  measured carried one. Two timeline selectors, not rules, because both were measured on ordinary machines
  and the program does not read which file or what threat: the first and last time Code Integrity recorded
  Windows refusing to load a file (3033, 3077), and Defender's detections (1116, 1117). SS mode now shows
  those times on its timeline, and the consent screen, the app's consent text and PRIVACY.md say so.
  Each pins provider, channel and event id; the negative fixtures are the neighbouring ids (3089, 5000,
  5007) and the same id from another provider. No baseline holds either log, so the three have
  rules/unconfronted.csv rows. A Windows 11 PC recorded 476 3033 events on 15 days, 17 driver refusals by a
  Microsoft driver policy, and no 5001; a timed scan of the official 0.4.0 CLI there read all 414 logs,
  the Defender log 375th, inside the 30-second budget (20.9 s for the whole scan, on a warm file cache).
• The autostart collector: what Windows starts by itself (ADR 0060). Program services (Type 0x10 or
  0x20), Run and RunOnce values under HKLM, its WOW6432Node view and HKCU, and every Exec
  action of the scheduled tasks read from their XML files under %SystemRoot%\System32\Tasks, parsed by a
  new rongroi_parsers::task (quick-xml, already in the lockfile) with a fuzz target. Each entry reports
  where it is registered, whether it starts by itself, and the file it starts — its path, the kind of folder
  it is in and, outside the Windows folder, its SHA-256 and embedded signature under a 30-second budget of
  its own. No argument is ever read into a report. Without administrator rights the task files are
  refused, which is not_admin for tasks alone; one file refused to an elevated read is an access_denied
  gap for tasks alone. SS mode never shows a Run value's or a task's name (view::SS_WITHHELD_FIELDS).
  One posture rule, experimental: a program that starts by itself has no valid embedded signature and is
  outside the Windows and Program Files folders. The resolver's refusals are shared with driver_service,
  whose behaviour is unchanged. A host reads this account's SID, compared with a task's principal and
  never reported. The consent question, PRIVACY.md, both READMEs and both screenshare guides say what is
  read.
• The defender_exclusion collector: what Microsoft Defender is told not to scan (ADR 0060, section 9).
  The value names of Exclusions\Paths, Processes and Extensions under Defender's own key and its
  policy key, each with its kind, which key set it and, for a path or a process, whether it covers one of
  FiveM's three folders (a drive root included; never for a wildcard); of IpAddresses only the count,
  never an address. Refused without administrator rights (not_admin), as measured on a runner and a
  Windows 11 PC. One posture rule, experimental: a Defender exclusion covers a FiveM folder. The consent
  question, PRIVACY.md, both READMEs and both screenshare guides say what is read.
• The first rules that read the change journal's counts: four context, experimental rules for a
  deletion and for a rename in FiveM for GTA V Legacy's plugin folder and in FiveM for GTA V Enhanced's asi
  folder, each with a positive and a negative fixture (ADR 0047, amendment of 2026-09-30). Each row says
  the journal does not record which program changed a file. baseline-elevated-win11 confronts the
  Legacy pair; no baseline describes Enhanced, so its pair has rules/unconfronted.csv rows. No rule reads
  the Prefetch, event log or Program Compatibility Assistant counts.
• Every found and not_found row of the change journal now shows the span the journal held when it was
  read — on one Windows 11 PC, 39 minutes, in two readings — or says it held no record, in both modes, so
  "not found" reads as "nothing within this span". The pairing is made in rongroi-core::view
  (ReportView::row_bands), so the CLI and the desktop app cannot disagree.

Changed

• ADR 0058, parked by the owner on 2026-09-30: reading FiveM's own logs for the servers a PC joined, as a
  second full-tier collector, is not built. Two read-only measurements on a Windows 11 PC found no server
  endpoint in either edition's logs — join lines carry no address, name or port. The ADR records the log
  files' names, sizes, line formats and times, keeps the collector's design (a tolerant parser reporting
  partial, endpoints as server identities hidden in SS mode, no plugin names) as undecided
  recommendations, and states the measurement that would reopen it. ADR 0052's row for this source says it
  is parked.
• ADR 0060 (accepted 2026-09-30) records the design of the two collectors shipped above: an autostart collector for what Windows starts by itself —
  program services, Run/RunOnce under HKLM, its 32-bit view and HKCU, and scheduled tasks read from
  their files — with each file's path, SHA-256 and embedded signature, never a command line's arguments; and a
  defender_exclusion collector for Microsoft Defender's exclusions, readable with administrator rights only.
  Two experimental posture rules: a program that starts by itself with no valid embedded signature outside
  the Windows and Program Files folders, and an exclusion that covers a FiveM folder. The ADR records a
  GitHub-hosted runner's measurement under an elevated and a standard account, and a Windows 11 PC's under an
  elevated and a limited token, and the owner's nine decisions of 2026-09-30.
• ADR 0061 (accepted 2026-09-30, the owner deciding its eight questions) records the design shipped above: how old
  each trace source is, beside when parts of the PC were set up. A "trace ages" section lists, per source
  (each Event Log, Prefetch, BAM, PCA, the USN journal and FiveM's own folders), the oldest time it still
  holds, how much it holds, its ordinary retention with a reference or an "undocumented" mark, and the reason
  when it was not read — not_admin reads "not known", never empty. Anchors in the header are dates with their
  ordinary resets, never one "machine age": InstallDate is shown as "installed or last feature-upgraded".
  One cross-source statement, computed in the view and never a rule, puts FiveM's presence beside Windows'
  records of programs that ran, with the causes that produce the same result. No verdict, score or ranking;
  a reinstall and a new PC stay indistinguishable. A read-only probe on a Windows 11 PC found that a feature
  upgrade reset InstallDate, the Windows and profile folders, key write times and every Event Log's oldest
  record, while Windows Setup's record of earlier installations, the system drive root and the USN journal
  identifier read as a time all reached back more than seven years and agreed to the day; BAM he...