diff --git a/VALIDATION.txt b/VALIDATION.txt index 6e10354..01d9f7a 100644 --- a/VALIDATION.txt +++ b/VALIDATION.txt @@ -229,3 +229,17 @@ inventory entries matched a freshly prepared copy. It processed 1,117,532 record two missing-file review events, no supplemental IOC or file-hash hit. Status remains partial: ten binary-file read stops and 106,842 decoding failures, with no matching or inventory errors. These counts are not compromise indicators. + + +A separate supplemental log recheck completed over 4,604,594 records in 1,711 +files using four triage-library workers. Original and working-copy SHA-256 +inventories matched. No supplemental rule, indicator or original-file hash hit +was found. Coverage remains partial: 788 text read stops (776 database files, +12 binary login/scoreboard files) and 1,338,016 decoding failures. No matching +errors occurred. This focused recheck did not repeat unchanged public rules or +perform another correlation pass. A failed earlier database run was excluded. + +The streaming recheck agreed with the standard engine on raw, Base64, URL-encoded, +process-list and benign fixtures. Saved process/permission collection records +were reviewed separately. Private rules, indicators, records and evidence remain +outside the public repository. These results do not establish absence of compromise.