ONE SHIELD DEFENDER LIVE v0.2 — PRIVATE DEVELOPMENT PREVIEW
2026-10-12 | MCHILS EBX / ONE

WHAT THIS IS
A Windows 10/11 x64 foreground monitor of Microsoft Defender antivirus posture,
firewall and recent threat history. Windows Defender remains the antivirus that
actually scans, blocks, quarantines and remediates threats. ONE Shield does NOT
introduce a second antivirus engine, filter driver or kernel extension.

FEATURES
- Read-only, on-demand Defender real-time protection and signature status.
- Read-only Windows Defender active threat count and past-24h detection count.
- Accurate distinction between active findings and successfully remediated history.
- Windows Defender Firewall, Windows OS uptime, Windows Update service collectors.
- Continuous foreground polling with configurable 60–3600 second interval.
- Optional one-way HTTPS reporting of minimal signed summaries with explicit consent.
- Reuses per-user DPAPI-protected key from the ONE Device Pair utility.
- No malware filenames, paths, threat IDs, user identities or clipboard content uploaded.
- No automatic system service, task, persistence, network ports, remote actions,
  file scanning, quarantine, Defender configuration change, or firewall edits.

PREREQUISITES
- Windows 10/11 x64, legitimate Microsoft Defender installation, and user authorization.
- For optional telemetry, activate your ONE account with MFA, generate a pairing
  ticket, and enroll this Windows USER with the ONE Device Pair utility FIRST.
- Only then opt in to reports with BOTH -upload and -consent-confirmed.
- Test only on an approved test PC, not production customer endpoints.

EXAMPLES (PowerShell, from extracted release folder)
  .\ONE-Shield-Defender-Live-v0.2-Windows-x64.exe -list-agents
  .\ONE-Shield-Defender-Live-v0.2-Windows-x64.exe -modules antivirus,threats
  .\ONE-Shield-Defender-Live-v0.2-Windows-x64.exe -watch -cycles 3 -interval-seconds 60
  .\ONE-Shield-Defender-Live-v0.2-Windows-x64.exe -watch -interval-seconds 300 -upload -consent-confirmed

The last example requires an enrolled account/device and intentionally sends
signed posture/alert claims to the tenant-specific ONE Shield dashboard.
Close the foreground terminal or press Ctrl+C to stop monitoring.
No telemetry is transmitted by default.

SECURITY / RELEASE GATE
- Windows executable is UNSIGNED and has not passed Windows binary runtime tests.
- Server-side cross-build, Go vet, 7 Go unit tests: PASS (2026-10-12).
- Windows Defender read-only commands tested separately on an authorized Windows 11 PC.
- Device-pairing, signed-report API and isolation have prior isolated unit tests.
- Full live telemetry end-to-end test on paired Windows device is STILL PENDING.
- Do not say ONE Shield is certified antivirus, endpoint prevention, EDR or SOC.
- Must undergo signed Windows release, authorized test-device install, consent,
  end-to-end security validation, event retention verification and independent review.
- Do not disable Microsoft Defender or install competing antivirus engines.

CUSTOMER ACCESS:
  https://accounts.one-desk.72.61.93.56.nip.io/shield
  https://one-desk.72.61.93.56.nip.io/links/
