Md. Fatin Shadab Turja

THE PROBLEM When a Windows PC slows down, fills up, or runs an unfamiliar process, most people can't tell what is safe to touch. Task Manager is cryptic, disk tools show sizes but not what is growing, and antivirus gives a verdict without an explanation. A chatbot can't see your machine, and giving an AI the power to kill processes or delete files is dangerous. WHAT MOONLIGHT DOES Moonlight is a local-first desktop investigator that answers two questions with evidence: "What is this process?" and "What is eating my disk?" • Local evidence pipeline: permitted process metadata, executable hashes and signature info feed nine transparent, testable rules that produce structured evidence. No single indicator is treated as proof of malware. A storage investigator finds fast-growing folders and ties growth to the writing process by exact PID plus creation time. • AI reasoning, kept separate: only minimized, redacted evidence goes to the model, which returns a schema-validated report: facts vs hypotheses, stated uncertainty, missing evidence, and constrained next steps. • A policy layer the model can't bypass: protected locations, path hardening, and a preview plus a fingerprint-bound confirmation token before any action runs. The AI never kills or deletes anything on its own, and every action is audit-logged. THE GAMIFIED WORLD Investigations are dull as walls of text, so Moonlight turns the device into an isometric world built from my own tileset artwork. Storage and processes appear as terrain and landmarks, an agent works in the world as an investigation runs, and a side panel offers controls and logs. It makes hidden system state approachable for non-experts, while the same evidence, policy and audit pipeline runs underneath. MEASURED, NOT ASSUMED An offline harness runs 143 labeled scenarios: 0/20 false positives from process rules, no dangerous storage misclassifications, 21/21 unsafe actions rejected by policy, and a reported recall of only 8/15 (53%) on simulated suspicious cases, which I publish rather than hide. 580+ automated tests, strict mypy, CI and secret scanning. STATUS Moonlight is a prototype, not an antivirus engine. The Meta model provider is implemented and tested. VISION A user-controlled desktop intelligence assistant: safe resource optimization and semantic file organization, with evidence and the user's consent at every step.