docs(worklist): the antivirus row reproduced from Defender's own history, and a row for the locally built exe #127

Open

d4nkn3ss wants to merge 1 commit from d4nkn3ss/Longshot:docs/worklist-antivirus-evidence into main

pull from: d4nkn3ss/Longshot:docs/worklist-antivirus-evidence

merge into: MagicBeanDev:main

MagicBeanDev:main

Conversation 1 Commits 1 Files changed 1 +2 -1

d4nkn3ss commented 2026-11-13 05:35:34 +00:00

Contributor

• Copy link
• Copy Markdown

Why

Players keep getting Defender's "Trojan" warning on the Builder download, and the worklist row for it still waits on Hookshot's SignPath application, which doesn't carry over to Longshot. It now has evidence from Defender itself, and a second problem the row didn't cover: the game exe built on the player's PC gets flagged too.

What changed

• docs: docs/worklist.md
  • Antivirus row: 2.0 to 2.9 (S1 5 × reach 0.57 × confidence 1.0, was 0.7: reproduced with Defender's own logs). It moves up to stay sorted.
    • The text now says what the detections are: cloud ML verdicts whose family changes per release.
    • It names the fix: Authenticode with a stable publisher (#46, #98), and meanwhile submitting each release's files to Microsoft as the software developer.
    • The owner is cleared: the SignPath application was Hookshot's.
  • New row, 1.8: the exe the Builder compiles on the player's PC is flagged (Program:Win32/Contebrew.A!ml). S0 8 × 0.57 × 0.4, one PC.

Flags and settings

None

Measurements

The evidence for the re-score: Defender's detection history (Get-MpThreatDetection) on one Windows 11 PC, Nov 7-10, Hookshot files from GitHub; the table is in #46 (comment).

main: 341d63a4 (2026-11-12)
this PR: docs/worklist-antivirus-evidence @ 08748007
Hardware: Windows 11, Defender engine 1.1.26100.4, signatures 1.463.271.0, cloud protection on
Scene: n/a (no game run)
Method: Defender's detection history read back (Get-MpThreatDetection, Get-MpThreat); the setups' signatures (Get-AuthenticodeSignature) and version info
How to reproduce: in PowerShell, Get-MpThreatDetection on a PC that downloaded a Hookshot release with Defender on

	main @ 341d63a4	this PR @ 08748007
Antivirus row: score, confidence, owner	2.0, 0.7, NotRexed (SignPath)	2.9, 1.0, none (fix: #46 / #98)
Locally built exe flagged	no row	1.8

Testing

Tested: the score arithmetic and the table's order (highest first); no check reads docs/worklist.md.

Full suite: python -I -B tests/run_all.py on this branch @ 08748007, Windows 11: 498 passed, 3 failed, 35 skipped. The failures: tests/test_check_third_party.py (#80), tests/test_setup_runtime.py (#118) and tests/test_release.py (#119), all failing on main the same way.

Not tested: whether a Longshot build is flagged the same way: there is no Longshot release yet. The local-exe row says so and stays at confidence 0.4.

Needs other testers: None

Screenshots

Nothing on screen

Risk and rollback

Docs only; reverting the commit is enough.

Issues

See #46

Checklist

For everyone

• One topic.
• The title is a Conventional Commit (type(scope): description).
• Rebased on current main.
• python -I -B tests/run_all.py run and passing (any failure that also fails on main is named above).
• Tested in the game, or what wasn't is named under Testing. (Docs only.)
• Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests).
• Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported. (Docs: the evidence and the before/after rows above.)
• No game files, dumps, build output or generated files.
• third_party/ untouched (a new folder with a PROVENANCE.md instead).
• The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled.

If applicable

• AI assistance recorded with Assisted-by: / Co-Authored-By: trailers.
• Docs updated.

🤖 Generated with Claude Code

## Why Players keep getting Defender's "Trojan" warning on the Builder download, and the worklist row for it still waits on Hookshot's SignPath application, which doesn't carry over to Longshot. It now has evidence from Defender itself, and a second problem the row didn't cover: the game exe built on the player's PC gets flagged too. ## What changed - docs: `docs/worklist.md` - **Antivirus row: 2.0 to 2.9** (S1 5 × reach 0.57 × confidence 1.0, was 0.7: reproduced with Defender's own logs). It moves up to stay sorted. - The text now says what the detections are: cloud ML verdicts whose family changes per release. - It names the fix: Authenticode with a stable publisher (#46, #98), and meanwhile submitting each release's files to Microsoft as the software developer. - The owner is cleared: the SignPath application was Hookshot's. - **New row, 1.8**: the exe the Builder compiles on the player's PC is flagged (`Program:Win32/Contebrew.A!ml`). S0 8 × 0.57 × 0.4, one PC. ## Flags and settings None ## Measurements The evidence for the re-score: Defender's detection history (`Get-MpThreatDetection`) on one Windows 11 PC, Nov 7-10, Hookshot files from GitHub; the table is in https://git.magicbean.dev/MagicBeanDev/Longshot/issues/46#issuecomment-12689. main: 341d63a4 (2026-11-12) this PR: docs/worklist-antivirus-evidence @ 08748007 Hardware: Windows 11, Defender engine 1.1.26100.4, signatures 1.463.271.0, cloud protection on Scene: n/a (no game run) Method: Defender's detection history read back (`Get-MpThreatDetection`, `Get-MpThreat`); the setups' signatures (`Get-AuthenticodeSignature`) and version info How to reproduce: in PowerShell, `Get-MpThreatDetection` on a PC that downloaded a Hookshot release with Defender on | | main @ 341d63a4 | this PR @ 08748007 | |---|---|---| | Antivirus row: score, confidence, owner | 2.0, 0.7, NotRexed (SignPath) | 2.9, 1.0, none (fix: #46 / #98) | | Locally built exe flagged | no row | 1.8 | ## Testing **Tested:** the score arithmetic and the table's order (highest first); no check reads `docs/worklist.md`. **Full suite:** `python -I -B tests/run_all.py` on this branch @ 08748007, Windows 11: 498 passed, 3 failed, 35 skipped. The failures: `tests/test_check_third_party.py` (#80), `tests/test_setup_runtime.py` (#118) and `tests/test_release.py` (#119), all failing on `main` the same way. **Not tested:** whether a Longshot build is flagged the same way: there is no Longshot release yet. The local-exe row says so and stays at confidence 0.4. **Needs other testers:** None ## Screenshots Nothing on screen ## Risk and rollback Docs only; reverting the commit is enough. ## Issues See #46 ## Checklist ### For everyone - [x] One topic. - [x] The title is a Conventional Commit (`type(scope): description`). - [x] Rebased on current `main`. - [x] `python -I -B tests/run_all.py` run and passing (any failure that also fails on `main` is named above). - [x] Tested in the game, or what wasn't is named under Testing. (Docs only.) - [x] Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests). - [x] Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported. (Docs: the evidence and the before/after rows above.) - [x] No game files, dumps, build output or generated files. - [x] `third_party/` untouched (a new folder with a `PROVENANCE.md` instead). - [x] The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled. ### If applicable - [x] AI assistance recorded with `Assisted-by:` / `Co-Authored-By:` trailers. - [x] Docs updated. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

d4nkn3ss added 1 commit 2026-11-13 05:35:34 +00:00

docs(worklist): the antivirus row reproduced from Defender's own history (2.0 to 2.9), and a row for the locally built exe ... 087480072b

The antivirus row was owned by Hookshot's SignPath application, which doesn't carry over to Longshot. One Windows 11
PC's Defender history (Longshot #46) shows 7 detections of 5 setup builds, all cloud ML verdicts whose family changes
per release: confidence 0.7 to 1.0, the owner cleared, and the fix pointed at #46/#98. The game exe the Builder
compiles on the player's PC was flagged too (Program:Win32/Contebrew.A!ml), which signing release files can't cover:
a new row at 1.8.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

d4nkn3ss commented 2026-11-13 06:18:43 +00:00

Author

Contributor

• Copy link
• Copy Markdown

Full game-free suite run on this branch (Windows 11); the results and the failures that also fail on main are now under Testing. Marking ready.

Full game-free suite run on this branch (Windows 11); the results and the failures that also fail on main are now under Testing. Marking ready.

d4nkn3ss changed title from WIP: docs(worklist): the antivirus row reproduced from Defender's own history, and a row for the locally built exe to docs(worklist): the antivirus row reproduced from Defender's own history, and a row for the locally built exe 2026-11-13 06:18:44 +00:00

Some checks are pending

Hide checks

CI / Conventional Commit title (pull_request) Blocked by required conditions

Details

CI / Python source checks (ubuntu-24.04, part 1/2) (pull_request) Blocked by required conditions

Details

CI / Python source checks (ubuntu-24.04, part 2/2) (pull_request) Blocked by required conditions

Details

CI / SPIR-V fixtures (global narrow load/store, direct surface atomics, F2I immediate) (pull_request) Blocked by required conditions

Details

CI / Workflow lint (actionlint) (pull_request) Blocked by required conditions

Details

Third-party parts / As their notes say (pull_request) Blocked by required conditions

Details

Third-party parts / The same as upstream (pull_request) Blocked by required conditions

Details

PR description / Description follows the template (pull_request_target) Successful in 7s

Details

This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.

Some workflows are waiting to be reviewed.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u 'docs/worklist-antivirus-evidence:d4nkn3ss-docs/worklist-antivirus-evidence'

git switch 'd4nkn3ss-docs/worklist-antivirus-evidence'

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/accessibility

Barriers for people with disabilities

  

area/audio

Sound and music

  

area/input

Controllers, keyboard, mouse

  

area/install

Installing, updating, building from your game

  

area/menu

In-game menu and settings

  

area/renderer

Vulkan renderer, shaders, effects

  

area/saves

Save files

  

area/upscaling

DLSS, FSR, frame generation

  

good first issue

A good start for a new contributor

  

gpu/amd

AMD GPUs

  

gpu/igpu

Integrated GPUs

  

gpu/intel

Intel GPUs

  

gpu/nvidia

NVIDIA GPUs

  

help wanted

Extra hands or knowledge wanted

  

kind

bug

Something doesn't work as it should

  

kind

chore

Build, CI, dependencies, tidying

  

kind

docs

Documentation

  

kind

feature

A new feature or an improvement

  

kind

performance

Frame rate, frame time, loading, memory

  

kind

question

A question rather than a change

  

needs measurements

Waiting for before/after measurements

  

platform/linux

Linux only

  

platform/steam-deck

Steam Deck

  

platform/windows

Windows only

  

preview

Maintainers: deploy a preview of this PR's website (read its changes first). Removed after the run.

  

priority

critical

Crashes, data loss, or blocks most players

  

priority

high

Important: next in line

  

priority

low

Nice to have

  

status

blocked

Waits on something else first

  

status

confirmed

Reproduced or agreed on

  

status

duplicate

Already reported or proposed

  

status

invalid

Not a problem in this project

  

status

needs-info

Waiting for more information from the reporter

  

status

wontfix

Will not be worked on

  

testing wanted

Wanted: a test on other hardware (posts a test request in #test-requests)

No labels

area/accessibility

area/audio

area/input

area/install

area/menu

area/renderer

area/saves

area/upscaling

good first issue

gpu/amd

gpu/igpu

gpu/intel

gpu/nvidia

help wanted

kind

bug

kind

chore

kind

docs

kind

feature

kind

performance

kind

question

needs measurements

platform/linux

platform/steam-deck

platform/windows

preview

priority

critical

priority

high

priority

low

status

blocked

status

confirmed

status

duplicate

status

invalid

status

needs-info

status

wontfix

testing wanted

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

MagicBeanDev/Longshot!127

No description provided.