UtiliVera Duplicates 0.9.0 audit

Methodology and immutable artifacts

The independent reviewer compared the frozen application with AllDup, Duplicate Cleaner, dupeGuru, Auslogics Duplicate File Finder, and Wise Duplicate Finder across exact proof, approximate-media boundaries, keeper protection, recovery, hard links, reporting, performance, accessibility, localization, packaging, and professional workflows. Claims below link to immutable public files whose hashes are listed in one machine-readable manifest.

• Complete eighth-round independent product audit
• 73-test candidate build and regression summary
• Independent installer audit Round 2
• Installer build and embedded-manifest evidence
• Silent install, CLI, reinstall, uninstall evidence
• Frozen 143-file package manifest
• Screenshot and 42-second video provenance
• Artifact sizes and SHA-256 manifest

Frozen identity

Executable: 353,792 bytes

5F59977C69A25CCCB9569D1ED3F4F2D8043E2336CCFCD4C14933A623C754D727

Portable ZIP: 2,408,368 bytes · SHA-256 FD77C6B4D683744671D6F373C6601A8AA2971F2AE6ECF968A74F50D9A49640D1. The package manifest records every installed relative path, byte size, and SHA-256.

Public unsigned installer: engineering PASS

Inno Setup 0.9.0 candidate: 3,951,536 bytes

81654330CE07F634AAF3FD29B742B0E401AF8E5849E4EE13EBF357889DEECA34

All 143 embedded files match the frozen source manifest. Silent installation, in-place reinstall, exact-scan CLI smoke test, silent uninstall, installed legal notices, and removal of the install directory, uninstall registration, and Start menu shortcut pass. User settings and recovery data are deliberately preserved to prevent data loss. The candidate checks for .NET Framework 4.8, but is not Authenticode-signed, is publicly available under the current unsigned-release policy. Independent installer Round 2 closed every internal P1; trusted code signing is planned after certificate approval.

Product audit result

The final independent product audit recorded P0=0, P1=0, P2=2 and 99/100. The remaining P2 items concern broader multi-frame video similarity and full self-containment of every archive path. The public installer remains unsigned and is disclosed as such.

Unsigned release rule and 30-day target

The independently audited installer is publicly available unsigned under the current release policy. Windows may show “Unknown publisher”; users must download only from utilivera.com and verify SHA-256. The continuous 30-day target begins at 2026-08-21T14:56:01Z and ends at 2026-09-20T14:56:01Z.