Zero Breach 0.1.4

Zero Breach 0.1.4 improves two optional coverage paths without changing the ordinary scan's read-only, offline operation.

With --patterns, local files named by per-user Windows COM registrations are examined before the broad folders, within a 128-path safety cap. A registration is context, not a spyware detection; only a matching published Candiru file rule becomes a pattern finding. Explicit --pattern-path still scans only the selected path. Windows DNS history now reads up to 50,000 retained events (previously 20,000), and reports any older retained events that were not read as a coverage gap rather than implying a complete clean result. The tool neither enables DNS logging nor recovers events that were never retained.

The suggested larger file cap was not added: both published Candiru rules explicitly require files below about 1 MB, so scanning larger files could not make these rules detect them. The optional pattern engine still requires Python 3.9+ and the pinned YARA-X installation in the README; the default scanner needs Python 3.8+ and no added package. No match is not proof that a device is free of spyware.

Validation

• 277 local tests passed with the optional engine (one expected permission skip) and without it (eight expected skips).
• All 19 CI jobs passed on the frozen pull request: Windows, macOS and Linux suites, optional-engine jobs, smoke scans and reproducible build.
• A read-only check on a Windows machine found 19 eligible COM paths: 14 scanned, five oversized files reported as coverage gaps, and no matches. Synthetic tests covered a DNS match past the old 20,000-event cap and incomplete retained history.
• The signed scanner rebuilt byte-for-byte from merged source. An independent Astra review found no release blocker after CI passed.

Download and verify

Download zero-breach.py. Its SHA-256 is:

5ab89ef3dda3579dfc0b4930b0d66290fdc755611afd91e28c373e30fe9996cc

The scanner and the 15-file checksum manifest are signed with ArchiveGenocide's established key, fingerprint C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. Compare it with ArchiveGenocide's verification page and follow SIGNING.md. Both signatures verified using a public-only keyring; an altered scanner was rejected. Earlier releases remain available unchanged.