N0zoM1z0 and gensokyo-dev
3c54f3ce4e
fix(ntfs): preserve acquisition access and I/O failures
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
55f344a77b
docs(ntfs): describe paired acquisition and timeline paging
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
01a7e2c3b7
feat(ntfs): expose the journal timeline through CLI and MCP
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2e34aa0433
feat(ntfs): seal paired journal acquisitions as Evidence
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
c0b3c18b8a
feat(ntfs): page correlated journal observations by source offset
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
afed309f0f
fix(ntfs): exclude invalid MFT extents from journal matching
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
a3ff69f5ba
feat(artifacts): report MFT file-name coverage
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
a44d457745
feat(ntfs): correlate USN entries by full MFT identity
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2be301f894
feat(ntfs): decode USN journal version 2 records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
73bc95d23f
feat(ntfs): decode resident MFT file names after fixups
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
morluto
a18867e623
fix(mcp): retain artifact comparisons after terminal cancellation ( #9945 )
2026-11-11 00:03:21 -05:00
morluto
d3899717b2
fix(browser): compare resource inventories with directional coverage ( #9935 )
2026-11-11 00:03:03 -05:00
morluto
755d58d29a
fix(deno): preserve raw specifier BOM characters ( #9949 )
...
fix(artifacts): preserve Deno specifier BOM characters
2026-11-11 00:02:03 -05:00
morluto
b725586fbf
fix(artifacts): isolate cancelled PyInstaller parse attempts ( #9961 )
2026-11-10 23:59:13 -05:00
morluto
e2bdfcee75
fix(uninstall): stop purging after skill removal failure ( #9947 )
2026-11-10 23:58:52 -05:00
morluto
647ebc2645
fix(artifacts): preserve bundle cleanup lease ownership ( #9948 )
...
fix(artifacts): retain bundle resource cleanup ownership
2026-11-10 23:58:30 -05:00
morluto
5d0391b06e
fix(ghidra): retain failed temporary probe resources ( #9970 )
...
fix(ghidra): retain failed probe descriptor cleanup
2026-11-10 23:58:22 -05:00
morluto
3eae278da5
fix(frida): preserve unknown capture policy facts ( #9934 )
2026-11-10 23:56:32 -05:00
morluto and Cursor Agent
133a849b2e
fix(browser-scenario)!: preserve scenario evidence and coverage ( #9896 )
...
* fix(browser-scenario): page captured text on Unicode boundaries
* fix(browser-scenario): retain popup events when open metadata exceeds its budget
* fix(browser-scenario): redact saved secrets across wire encodings
* fix(browser-scenario)!: record parsed request actions in evidence
BREAKING CHANGE: New captures with request actions that save nothing include save: [] in the recorded parameters. Their scenario and Evidence digests can differ from older captures of the same scenario. Read retained captures with their original recorded digests and use the newly recorded digest for new captures.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 23:48:13 -05:00
morluto and Cursor Agent
a6e02657e6
fix(artifacts): preserve unknown relationship coverage ( #9904 )
...
* fix(artifacts): preserve unknown relationship coverage
* fix(artifacts): retain producer relationship availability
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:52:59 -05:00
morluto
72b07c58d4
fix(wasm): bind known WABT source provenance to its verified release ( #9927 )
2026-11-10 22:52:21 -05:00
morluto and Cursor Agent
4d711acffd
fix(settings): report Ghidra limits for the operations that use them ( #9903 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:54 -05:00
morluto and Cursor Agent
5821506eb2
fix(native): preserve Mach-O source and decode facts ( #9902 )
...
* fix(native): retain Mach-O file identity through completion
* fix(native): distinguish malformed Mach-O encryption facts
* fix(native): preserve Mach-O command and dylib coverage
* fix(native): preserve Apple dispatch fixup and declaration facts
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:26 -05:00
morluto
3c736dfe11
fix(targets): reject ambiguous native image selections ( #9933 )
...
fix(targets): refuse ambiguous slice and file mappings
2026-11-10 22:50:13 -05:00
morluto
82abd9e6ca
fix(v8): validate complete payload scan coverage ( #9928 )
2026-11-10 22:49:40 -05:00
morluto
29b41a7d94
fix(coverage): validate boundary identifiers at request admission ( #9919 )
2026-11-10 22:49:26 -05:00
morluto
41bd808c1f
fix(symbols): match exact Objective-C protocol labels ( #9938 )
2026-11-10 22:49:01 -05:00
morluto
847d59c947
fix(python): validate shared pyc header facts ( #9929 )
2026-11-10 22:47:29 -05:00
morluto
d39699ad0c
fix(validation): stop lexical failures before semantic conversions ( #9924 )
2026-11-10 22:47:18 -05:00
morluto
281db61890
fix(ntfs): preserve header facts alongside invalid fixup sequences ( #9923 )
2026-11-10 22:47:04 -05:00
2885347cde
test(ghidra): remove the retired processor-context suite ( #9915 )
...
* test(ghidra): keep the bridge context contract out of an empty suite
Source tests collect src/ghidra/GhidraFunctionValues.test.ts directly.
The empty describe failed that file with "No test found in suite" even
though every shard passed. Assert the bridge bindings at file level.
* test(ghidra): retire superseded source-text context assertions
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com >
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-10 21:20:07 -05:00
N0zoM1z0 and gensokyo-dev
a6a2527ade
fix(artifacts): revalidate cached MFT observations
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
f8fc572e4a
fix(ntfs): report contradictory declared record identities
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
ab9e5fa204
fix(ntfs): require space for the first attribute marker
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
8d45cb45c4
fix(ntfs): validate first attribute bounds in FILE records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
7712e3185e
fix(ntfs): retain incomplete coverage alongside fixup mismatches
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
466149169e
fix(ntfs): validate aligned FILE record extents
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1c2626edbd
fix(ntfs): reject reserved update sequence values
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
b16d18f198
test(artifacts): cover independently cancelled MFT traversals
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
14030e2f11
fix(ntfs): expose unrecognized FILE record flag bits
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
9505c73824
fix(artifacts): retain only the bounded MFT header sample
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1a446cdade
fix(ntfs): label the system flag independently of extensions
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1ef7f02cae
test(ntfs): group MFT header and fixup regressions
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
7b86474be7
test(artifacts): use the MFT traversal iterable contract
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
5d10337709
feat(artifacts): expose a bounded sample of MFT record headers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
8eadb872f2
fix(ntfs): preserve full-width MFT log sequence numbers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
f170175ec8
fix(artifacts): retry interrupted MFT preparation
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
fbe09f84df
fix(artifacts): verify MFT source before publishing metadata
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
ebb480ba22
fix(ntfs): buffer the admitted MFT byte range once
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
da1f029c2f
fix(artifacts): admit MFT captures through CLI and MCP
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00