v1.2.0 — Pipeline Canary + Sysmon Telemetry + Repo Polish

v1.2.0 — Honest Non-Zero Coverage

Pipeline canary (positive control)

• Unique per-run marker verifies execute→collect→normalize→match is healthy
• Gate logic: campaign won't proceed if canary fails
• Canary marker: purpleloop-canary-d4899a4c
  Canary: DETECTED on windows (evidence: 2 events) — one-command health check
• Negative test: stop telemetry → canary fails; restore → DETECTED

Windows Sysmon detection

• Windows Wazuh agent now forwards Microsoft-Windows-Sysmon/Operational channel
• Sysmon Event ID 1 flowing with image, commandLine, parentImage, user fields
• Windows Sigma rule with positive/negative fixtures
• End-to-end test: real Sysmon event → normalize → match → DETECTED

Repo presentation

• README overhaul: badges, architecture, results, quickstart
• Repo About: description + 15 topics + homepage
• SECURITY.md + CONTRIBUTING.md
• Release notes rewritten for v1.0.0 and v1.1.0
• GitHub Pages enabled

Coverage

• Windows: DETECTED (73 Sysmon events, canary confirmed)
• Linux: NO_TELEMETRY (Sysmon-for-Linux pending)