# Verification — AegisGuard 0.3.1

Date: 2026-08-30  
Target: local Windows owner build  
Compiler policy: optimized AnyCPU, warnings as errors, no NuGet or network dependency

## Result

**PASS — 59 harmless tests, 0 failures; final UI/logo smoke exit 0.**

This verifies the stated local behavior. It is not a third-party penetration test, malware certification, runtime game-compatibility certification, or proof that every threat will be detected.

## Build

- `build.cmd`: PASS
- `build-tests.cmd`: PASS
- Compiler warnings: 0 (warnings are errors)
- File version: `0.3.1.0`
- Product version: `0.3.1.0`
- Manifest: `asInvoker`, `uiAccess=false`
- External package downloads: none

## Brand and icon validation

- Embedded WPF resource `AegisGuard.Assets.Logo.png`: present and loadable
- Embedded production logo: 512 × 512, 32-bit ARGB
- Production and source PNG corner alpha: 0 (transparent)
- Source PNG: 1,254 × 1,254, 32-bit ARGB
- Executable Windows icon extraction: PASS
- ICO frames: 16, 20, 24, 32, 40, 48, 64, 128, and 256 pixels
- Defender differentiation: no four-panel/quadrant layout, Windows logo, cross, checkmark, or Defender-blue silhouette

## Automated suite

Final result: **59 passed, 0 failed**.

Coverage includes:

- embedded AegisGuard logo loading and exact production dimensions;
- stable logo manifest-resource identity;
- Windows executable icon extraction;
- Windows Security health reads;
- heuristic score/hash/reason behavior;
- owner-controlled exact SHA-256 indicators;
- HMAC audit-chain integrity and protected tail-truncation detection;
- encrypted quarantine, authenticated metadata, byte-identical restore, and no-overwrite lifecycle;
- IPv4 TCP and UDP endpoint-table reads and bounded ownership fields;
- SCAR voice disabled by default;
- runtime non-interference flags locked;
- firewall mutation blocked before any command launch;
- Defender command launch blocked;
- known game-library and exact-root protection;
- ordinary document paths not over-suppressed;
- sensitive wildcard-listener prioritization and verdict disclaimer;
- cache stale-metadata counts, game-path skip, and no deletion;
- passive snapshot availability, timing bound, and 0–100 score bound;
- public IPv4 validation and legacy exact-rule argument formatting;
- protected legacy firewall-record compatibility;
- read-only WFP and Defender event readers;
- controlled fixture cleanup.

The test had to run in the signed-in user context because Windows DPAPI intentionally requires that profile. Its test root was isolated and removed when the suite finished.

## Runtime smoke

- Command shape: `AegisGuard.exe --smoke-ui --data-root <isolated path>`
- Background file/network monitor: disabled by smoke mode
- Window construction: PASS
- All pages, including SCAR Core: constructed without an unhandled exception
- Automatic close after three seconds: PASS
- Exit code: 0
- Temporary smoke data: removed after the test

## Performance sample on this PC

Read-only local sampling from the 0.3 telemetry implementation while normal endpoint activity was present. The 0.3.1 branding patch does not change that sampling path:

| Check | Samples | Average | Maximum | Workload |
|---|---:|---:|---:|---|
| Raw TCP + UDP inventory | 25 | 30.68 ms | 57.28 ms | 235 TCP + 44 UDP rows in final sample |
| Full SCAR capture + scoring | 15 | 39.42 ms | 91.40 ms | 282 observations in final sample |

SCAR sleeps between samples: 5 seconds when endpoints change and 12 seconds when stable. Timing varies with process/endpoint count and machine load.

## Static non-interference review

- External network-client API search: no implementation hit; the only textual hit was an inert heuristic test fixture containing `Invoke-WebRequest example.invalid`.
- Process-control/launch API search: no implementation hit after release hardening.
- Cache/SCAR deletion API search: no hit.
- Credential/device-identifier scan: no sensitive photo value or local gateway credential included; only a generic security warning about passwords.
- Firewall execution: no command executor remains. `ApplyAsync` returns a cancelled locked result.
- Defender execution: no command executor remains. Public bridge methods throw a non-interference exception.
- External application opening: no process-launch implementation remains.

## Artifact facts

- `AegisGuard.exe` SHA-256 before packaging: `234BE52CA47E4606BB83C665FCF65D9018D99C1EEDD7E850F48D9E469FAD1541`
- `AegisGuard.SelfTest.exe` SHA-256 before packaging: `EB3FD304B7C47C16B39F51827FCD5BB2146EAA72B3C3C6185DA6B53BF8C566A3`
- Authenticode: **NotSigned**

The final package checksum manifest is authoritative if any pre-package hash above differs after a deliberate rebuild.

## Remaining owner checks

- Open the packaged application and confirm the visual design at the owner's preferred display scaling.
- Press **Test SCAR voice** only when audio output is acceptable.
- Observe a normal gaming session and confirm there is no subjective performance impact. Automated checks cannot substitute for that owner runtime acceptance.