Add read-only Windows WeChat plaintext snapshot reader

[xuewei-ai]

Summary

This is a clean replacement for the earlier draft approach. It is based directly on current upstream main at 2526175fba7e67b2ae6ab89461c48d32a3ce718b and deliberately excludes all extraction and decryption capabilities.

The new Skill only analyzes a plaintext SQLite snapshot that the user explicitly supplies. It never accesses Weixin.exe, reads process memory, obtains or stores keys, invokes DPAPI, decrypts SQLCipher databases, recovers WAL/SHM state, discovers source data, or controls the WeChat UI.

Requirement → evidence

Requirement	Evidence
Plaintext snapshot supplied explicitly	Required global --snapshot; no discovery or saved source-path fallback
Read-only inputs	SQLite mode=ro&immutable=1 plus PRAGMA query_only=ON
Fail closed on incomplete snapshot	Fixed required database set plus at least one message DB; every command validates first
Personal and business message families	Scans both message_*.db and biz_message_*.db
Correct compressed keyword search	Decodes Zstandard content before filtering, globally sorting, and limiting
No sender-direction guess	Uses optional user manifest identity; otherwise returns unknown
No raw internal identities in output	Opaque SHA-256-derived chat IDs; no wxid/group/sender username fields
No ambiguous first match	Sensitive commands accept only an exact listed chat_id
Private export default	%LOCALAPPDATA%\YichenWeChatVault\exports; every other destination needs --confirm-external-output
Independent sanitized fixtures	Invented schemas/messages in tests/fixture_factory.py, with no production import
Supply-chain controls	SHA-256-locked dependency, SPDX SBOM, third-party notice, full-SHA GitHub Actions
Provenance and rights	PROVENANCE.md, CONTRIBUTOR_GRANT.md, and contributor confirmation obtained before submission

The complete matrix is in yichen-wechat-windows-reader/REVIEW_EVIDENCE.md.

Validation

Submitted commit: fe589d60d719a5304469b583cf1a48e863a8348d

The candidate committed tree was exported with git archive into a clean directory on Windows and verified there:

• 9/9 independent synthetic fixture tests passed
• Skill Creator quick_validate.py passed
• git diff --check passed
• no user database, secret, memory dump, key material, or plaintext fixture database is committed

The final branch is exactly one commit ahead of current upstream main, with 15 intended files and no unrelated deletion. CI repeats the hash-locked install and all tests on windows-2022 from the submitted GitHub SHA.

Review boundary

This PR is intentionally Draft. PR #13 is unchanged and should remain unmerged.

[mcncarl]

Thanks for the contribution. The maintainer took over the remaining integration work, so no further contributor changes are needed.

Your original commit fe589d60d719a5304469b583cf1a48e863a8348d and CONTRIBUTOR_GRANT.md were preserved in history and reached main through #15 as merge commit e18fb2696437de4df50adbc51eafdef13094ad1b, after the exact-head Windows/Python 3.12 and repository contract checks passed.

GitHub has therefore marked this PR as merged. Thank you.