Zero Breach 0.1.3

Zero Breach 0.1.3 adds an optional, experimental Candiru file-pattern check to the existing scanner. The ordinary scan is unchanged and still needs only Python 3.8 or newer. With Python 3.9 or newer, install the pinned optional YARA-X dependency and run zero-breach.py --patterns to check selected local files against two published, attributed Candiru/DevilsTongue rules. Use --pattern-path ABSOLUTE_PATH to specify a file or folder; it can be repeated. The check reads bounded bytes and reports inaccessible or skipped locations as coverage gaps.

This can flag some known file patterns that an exact file hash misses. It does not inspect memory, detect arbitrary variants, establish active infection, or scan phones for Pegasus. A hit needs investigation; no hit is not proof that a device is safe. Historical AdFection indicators have the same limits described in the previous release.

Validation

• The final pull request passed all 19 CI checks: default tests and smoke scans on Windows, macOS and Linux; optional-pattern tests on all three; reproducible build.
• Local optional-engine suite: 269 tests, one expected platform skip. The existing default scan remains available without the optional engine.
• Inside a disposable, network-isolated VM, two hash-verified Candiru-tagged files matched. One was absent from the previous exact-hash list. A clean corpus of 226 Debian/Python files produced zero matches. This small validation set does not quantify sensitivity or false-positive rate. No malware sample is distributed in this release.
• Independent Astra code and signed-artifact review found no remaining blocker.

Download and verify

Download zero-breach.py. The exact scanner SHA-256 is:

1a1eb0e76cd2791349be9861840a5756940c3a950a134b5436bc7f9d1b50e3b8

The scanner and 15-file checksum manifest are signed with ArchiveGenocide's established key, fingerprint C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. Compare it with ArchiveGenocide's verification page, then follow SIGNING.md. The released signatures were independently verified using a public-only keyring; an altered scanner was rejected.

For optional setup and safe interpretation, read the README and detection-upgrade notes. Source tag v0.1.3 points to merge commit 982c405bf0186d30d91c7d7635ad595be780b238; the signed scanner was rebuilt from the merged source with identical bytes. Previous release assets remain unchanged.