morluto and Cursor Agent
6a2b690440
fix(environment): preserve capture evidence during state inference ( #9897 )
...
fix(environment): preserve evidence when inferring and serving state
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-11 00:14:27 -05:00
N0zoM1z0 and gensokyo-dev
22a3ba263e
refactor(ntfs): select metadata details from the retained identity index
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
1a8a9b749a
perf(ntfs): make detailed MFT pages opt in for journal queries
...
Keep inventory counts inline and preserve explicit 1–32 record detail requests. The real 26-record Windows sample serialized 57,946 metadata bytes before detail selection.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
c51ac43f9c
fix(ntfs): retain valid entries before malformed attribute list tails
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
710c353bff
feat(ntfs): page MFT metadata alongside journal events
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
96086e9c1f
feat(ntfs): report bounded V4 extents and unknown history coverage
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
f8ed4d16a0
feat(ntfs): decode V3 journal identities without false MFT joins
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
699cb72c48
feat(ntfs): validate resident and nonresident attribute metadata
...
Keep attribute parsing at the verified record boundary and retain only the identity index for journal joins.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
411804afbf
feat(ntfs): expose source file names and lossless metadata
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
morluto and Cursor Agent
81c09773be
fix(hopper): scope recovery guidance to the caller lifetime ( #9905 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-11 00:09:05 -05:00
N0zoM1z0 and gensokyo-dev
ffac2e0c99
perf(ntfs): reuse validated acquisitions and MFT identity lookups
...
Retain one completed pair per resource scope, revalidate selected file state on every page, invalidate failures, and clear retained bytes at shutdown. Keep cold CLI process costs explicit.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
7771fb7123
fix(ntfs): describe the journal page row limit
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2847464189
perf(ntfs): decode journal pages at their requested offsets
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
58edc31638
fix(ntfs): leave unused MFT reference identities unresolved
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
48ee3f02fd
fix(ntfs): consume the parsed record identity verdict
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
6e8cd0bc5e
test(ntfs): use valid protected acquisition records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
3c54f3ce4e
fix(ntfs): preserve acquisition access and I/O failures
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2e34aa0433
feat(ntfs): seal paired journal acquisitions as Evidence
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
c0b3c18b8a
feat(ntfs): page correlated journal observations by source offset
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
afed309f0f
fix(ntfs): exclude invalid MFT extents from journal matching
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
a3ff69f5ba
feat(artifacts): report MFT file-name coverage
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
a44d457745
feat(ntfs): correlate USN entries by full MFT identity
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2be301f894
feat(ntfs): decode USN journal version 2 records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
73bc95d23f
feat(ntfs): decode resident MFT file names after fixups
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
morluto
d3899717b2
fix(browser): compare resource inventories with directional coverage ( #9935 )
2026-11-11 00:03:03 -05:00
morluto
3eae278da5
fix(frida): preserve unknown capture policy facts ( #9934 )
2026-11-10 23:56:32 -05:00
morluto and Cursor Agent
133a849b2e
fix(browser-scenario)!: preserve scenario evidence and coverage ( #9896 )
...
* fix(browser-scenario): page captured text on Unicode boundaries
* fix(browser-scenario): retain popup events when open metadata exceeds its budget
* fix(browser-scenario): redact saved secrets across wire encodings
* fix(browser-scenario)!: record parsed request actions in evidence
BREAKING CHANGE: New captures with request actions that save nothing include save: [] in the recorded parameters. Their scenario and Evidence digests can differ from older captures of the same scenario. Read retained captures with their original recorded digests and use the newly recorded digest for new captures.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 23:48:13 -05:00
morluto and Cursor Agent
a6e02657e6
fix(artifacts): preserve unknown relationship coverage ( #9904 )
...
* fix(artifacts): preserve unknown relationship coverage
* fix(artifacts): retain producer relationship availability
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:52:59 -05:00
morluto
72b07c58d4
fix(wasm): bind known WABT source provenance to its verified release ( #9927 )
2026-11-10 22:52:21 -05:00
morluto and Cursor Agent
4d711acffd
fix(settings): report Ghidra limits for the operations that use them ( #9903 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:54 -05:00
morluto and Cursor Agent
5821506eb2
fix(native): preserve Mach-O source and decode facts ( #9902 )
...
* fix(native): retain Mach-O file identity through completion
* fix(native): distinguish malformed Mach-O encryption facts
* fix(native): preserve Mach-O command and dylib coverage
* fix(native): preserve Apple dispatch fixup and declaration facts
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:26 -05:00
morluto
3c736dfe11
fix(targets): reject ambiguous native image selections ( #9933 )
...
fix(targets): refuse ambiguous slice and file mappings
2026-11-10 22:50:13 -05:00
morluto
82abd9e6ca
fix(v8): validate complete payload scan coverage ( #9928 )
2026-11-10 22:49:40 -05:00
morluto
29b41a7d94
fix(coverage): validate boundary identifiers at request admission ( #9919 )
2026-11-10 22:49:26 -05:00
morluto
41bd808c1f
fix(symbols): match exact Objective-C protocol labels ( #9938 )
2026-11-10 22:49:01 -05:00
morluto
847d59c947
fix(python): validate shared pyc header facts ( #9929 )
2026-11-10 22:47:29 -05:00
morluto
d39699ad0c
fix(validation): stop lexical failures before semantic conversions ( #9924 )
2026-11-10 22:47:18 -05:00
morluto
281db61890
fix(ntfs): preserve header facts alongside invalid fixup sequences ( #9923 )
2026-11-10 22:47:04 -05:00
N0zoM1z0 and gensokyo-dev
f8fc572e4a
fix(ntfs): report contradictory declared record identities
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
ab9e5fa204
fix(ntfs): require space for the first attribute marker
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
8d45cb45c4
fix(ntfs): validate first attribute bounds in FILE records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
7712e3185e
fix(ntfs): retain incomplete coverage alongside fixup mismatches
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
466149169e
fix(ntfs): validate aligned FILE record extents
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1c2626edbd
fix(ntfs): reject reserved update sequence values
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
14030e2f11
fix(ntfs): expose unrecognized FILE record flag bits
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
9505c73824
fix(artifacts): retain only the bounded MFT header sample
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1a446cdade
fix(ntfs): label the system flag independently of extensions
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1ef7f02cae
test(ntfs): group MFT header and fixup regressions
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
5d10337709
feat(artifacts): expose a bounded sample of MFT record headers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
8eadb872f2
fix(ntfs): preserve full-width MFT log sequence numbers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00