The Porter, which keeps the gate

What the Porter does#

The porter kept the gate of a lord's household: who came in, and who went out. The Porter does the same for your PC. Every 30 minutes it looks at what's new since the last look, and tells you who made it and whether it's what it says it is.

It only looks. It never deletes, moves, blocks or disables anything.

With Castellan's developer features on, the Toller holds the Porter's office, and the Porter works behind it, still doing its own rounds.

The Porter comes with the Household license.

What it watches#

The first time it looks, everything already there is taken as known, and nothing is raised. After that, only what's new, or what changed, is listed, under New since you last looked, until you acknowledge it.

How it decides#

For each newcomer it checks the file behind it: the download itself, or the program an entry runs.

• Who signed it, and whether the signature is valid.
• Whether it matches the publisher's checksum, when the publisher gave one beside the file (a .sha256 file, or a list like SHA256SUMS).
• Where it was downloaded from, as your browser noted it.
• Whether Microsoft Defender found something in it.

Then each gets a verdict:

What to do about each is in What to do about something new.

Its notes#

For each newcomer, a small AI model on this PC writes a sentence or two on what it probably is, and who makes it: "A tool that syncs your photos. Made by Thing Co, according to its signature." Each note says where it was written, "note from the NPU, unverified", say.

The note decides nothing: the verdict is code's alone. A file can claim any name, so trust the facts and the verdict, not the note. Without the local AI, every check and verdict still runs, with no notes. See Set up the local AI.

Its page#

The Porter's page is at http://porter.localhost:18686/, and Open on its card in Castellan goes there.

• New since you last looked: each newcomer with its verdict, why, the facts about it, what changed for a change, and its note. Acknowledge marks one seen; Acknowledge all marks everything shown.
• At the gate: each of the six places, how many entries it knows, and who signed each one.
• Recently acknowledged, and How it decides.
• Run now looks at once; Settings is in the title bar.

Acknowledging only changes the Porter's own list. Nothing on your PC changes.

Its settings#

What it can't see#

• It looks every 30 minutes, so a download that comes and goes between two looks is never seen. Run now looks at once.
• Windows' own scheduled tasks and Microsoft-signed services aren't watched.
• Store apps aren't among the installed programs it watches.
• A checksum only proves the file is the one listed, if the list came from the publisher too.