Saltar al contenido principal

Zeq Antivirus

Endpoint protection without a signature database. Per-device agents emit security CLAIMS at the framework's 1.287 Hz HulyaPulse clock. The backend runs each claim through HF1–HF20 — the same anti-hallucination operators that score every audit row — and fires the av.threat.detected subscription tag when the composite crosses the three-gate (S_forensic ∧ protect001 ∧ protect002).

Why this is in the framework, not bolted on​

Zeq already shipped 80 % of the antivirus before Phase 1 started — the Phase 1 inventory (outputs/antivirus-phase1-design.md) showed that observer agents, HF1–HF20, ZEQ-PROTECT-001, the entangled state writer, the subscription schema, and the design-system app template were all present. Phase 2 ships the missing pieces:

  • protect002(t) = 0.5 + 0.3·sin(t/30) — the sibling-network envelope.
  • compositeForensic() — doctrine-default-weighted S_forensic.
  • fingerprintHash() — canonical-JSON sha256 of the claim for payload-free mesh matching.
  • trustScore() — POHC + cross-slug fire-count weighting.
  • fireSubscription() — the EX.J fanout writer.
  • /api/av/{claim,devices,threats,mesh-feed} — the four routes.
  • apps/packages/zeq-av-agent-linux/ — the Rust Linux agent.

Pages in this section​

The trigger gate (verbatim)​

S_forensic  ≥ 0.85
AND  protect001(phase) ≥ 0.388
AND  protect002(t)     ∈ [0.2, 0.8]

When all three hold, the server writes an av.claim audit row with operator_id='HF-CLAIM' AND fans out the av.threat.detected tag to every cross-slug subscriber. Trust-weighted peers raise the local composite by up to their POHC score; novel peers (POHC ≈ 0) move it by less than 0.05.

Composite formula​

S_forensic = (Σᵢ Sᵢ · wᵢ) / (Σᵢ wᵢ) · (1 + α · sin(2π · 1.287 · t))
α = 1.29 × 10⁻³  (DISPLAY.ALPHA_K — KO42)

Doctrine-default weights:

  • HF5, HF16, HF20 (legal, ethical-severity, binomial-truth) = 0.1667 each
  • everything else = 0.0294 each

Sum = 0.9999. The composite divisor uses the actual Σwᵢ of supplied scores so an agent that reports only 5 of 20 still gets a fair-magnitude composite.