No kernel minifilter claim
Current realtime protection is user-space monitoring of configured high-risk locations, not full-disk kernel interception.
Native protection controls without a crowded dashboard.
Windows 0.4.0 is the current Production Candidate. It is designed around Smart Scan, file/folder inspection, a resilient user-space Guard, quarantine/recovery, history and verifiable update paths.
Current capabilities
What the Windows candidate is built to do.
✓
Smart ScanFast inspection of common high-risk locations and selected content.
✓
File and native folder scanSingle-file and recursive folder workflows with progress, cancellation and long Unicode path handling.
✓
Guard + supervisorUser-space monitoring with bounded queues, restart backoff and polling fallback.
✓
Sealed quarantineStored payload identity is bound to metadata and SHA-256 is verified on restore.
✓
Signed application updatesHTTPS + Ed25519 + SHA-256 manifests with required signed expiration.
✓
Signed Threat PacksImmutable versions, expiry, rollback handling and production-feed release verification.
Truthful scope
What this page intentionally does not claim.
No ransomware rollback claim
Mass-encryption signals can support correlation, but the product does not claim automatic malicious-process termination or filesystem rollback.
No production ML/cloud reputation claim
Those capabilities are not presented as shipping production protections unless separately implemented and validated.
Stable is evidence-gated
x64/ARM64 lifecycle, Defender coexistence, DPI/Unicode, upgrade/rollback and controlled corpus evidence must be bound to the final release SHA.
Follow the verified Windows release path.
Commercial Stable publication stays blocked until signing and evidence gates pass.
aq.kingai.work