Stegcore Files

[4.0.1] - 2026-05-24 — Dark Phoenix

Steganalysis at Aletheia parity, tiered fingerprints, dual licence, Acceptable Use Policy, and a pre-tag adversarial sweep.

Engine

• Sample Pair Analysis and RS ported against the Aletheia reference; output agrees to floating-point precision on the Cassavia 2022 test set.
• Weighted Stego added as a third Aletheia-parity classical detector.
• Tiered fingerprint architecture: Exact (decisive) and Heuristic (corroborating) confidence tiers.
• LSBSteg fingerprint added (Heuristic tier; ~0.2% false-positive rate on grayscale natural imagery).
• Removed two dead fingerprints that never fired against real tool output.
• Thresholds refit on Cassavia + BOSSbase 1.01 at a 2% per-detector false-positive ceiling (~4% combined on natural-image covers).
• Verdict ensemble rebalanced to equal weights across the three Aletheia-parity detectors. Chi² and LSB-entropy stay visible but no longer gate the verdict.
• New tool_fingerprint_tier field on the analysis report (additive, backward-compatible).

GUI

• Tier-aware fingerprint badge on analysis results (red for Exact, amber for Heuristic, neutral for legacy).
• Tooltip carries the full label; the pill shows just the tool name so cards stay readable.

Documentation

• New AUP.md at the repo root: a versioned Acceptable Use Policy covering audience, prohibited uses and dual-use gating.
• New COMMERCIAL.md: the dual-licence offer for organisations that cannot meet AGPL's source-release obligation.
• README rewritten for the parity milestone; the v4.0.0 "known issue" warning is retired.
• Fingerprint validation harness at tests/fingerprint/harness.py (TPR / FPR / cross-tool specificity assertions for LSBSteg, Steghide, OpenStego).

Adversarial gate

• Fuzz harnesses (four cargo-fuzz targets) cover analyse on PNG / BMP / WAV and extract on PNG.
• Property tests cover round-trip identity, dimension preservation and never-panic-on-random-bytes.
• CLI integration suite expanded with 45 tests (version, help, round-trip, error paths, pathological inputs).
• Lossy-pipeline survival tests (PNG↔JPEG, resize, Pillow re-save, metadata strip).
• Crash injection: SIGKILL at five delay windows during embed; atomic-rename-on-close holds.
• Concurrency caps: 100 parallel analyses, 4 parallel embed+extract, capacity-boundary, zero-payload reject.
• Content-sniffing dispatcher routes by magic bytes (PNG / BMP / JPEG / RIFF / FLAC), with extension as fallback.
• Supply chain: cargo-deny wired alongside cargo-audit; Dependabot weekly with ecosystem grouping and a cooldown discipline.
• GUI E2E: Playwright suite against the Vite dev server (smoke / navigation / monkey-clicker / wizard back-button), plus a Tauri-runtime WDIO job for the built binary's IPC boundary.

CI / build

• Coverage published to Codecov; ≥90% line-coverage gate enforced on every main push.
• Install-smoke job verifies the universal installer across Ubuntu, macOS and Windows runners.
• Local-CI preflight via scripts/preflight.sh (cheap subset by default; --full replays the Linux CI matrix via act).

Licence

• Dual-licensed: AGPL-3.0-or-later by default; commercial licence available for organisations that cannot meet the AGPL source-release obligation.

Other

• Bug fixes and improvements.