Kaoru0822andClaude Opus 5.5 7857d2d329 fix(artifacts): apply the integrity policy to xar checksums and bound symlinks ...

- Inventory scans now verify xar extracted checksums themselves, under the
  caller's integrity policy. Under "fail" a mismatch still fails, now as
  artifact_integrity_mismatch with the logical path. Under
  "record-and-continue" the member stays in the graph as mismatched, with
  the declared and observed values, and is not expanded. A declared SHA-256
  becomes an integrity contradiction. Extraction keeps verifying in the reader.
- Read cpio symlink targets only up to 4096 bytes; longer declared targets
  are streamed past and recorded with a limitation instead of buffered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-07 12:50:52 +00:00

..

.vitepress

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00

adr

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00

assets

docs: add Discord community links to README

2026-10-05 17:36:29 +08:00

verification

fix(artifacts): apply the integrity policy to xar checksums and bound symlinks

2026-10-07 12:50:52 +00:00

android-analysis.md

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00

apple-application-analysis.md

docs(apple): describe directory-based framework plist ambiguity

2026-10-07 12:21:41 +00:00

architecture.mermaid

feat(browser): trace captured website source-map locations (#897)

2026-10-07 16:21:18 +08:00

browser-observation.md

feat(browser): trace captured website module imports (#879)

2026-10-07 14:59:52 +08:00

browser-scenario-contract.md

feat(browser): capture correlated network content and lifecycle evidence (#797)

2026-10-07 04:35:49 +08:00

capability-migration.md

refactor(managed): group capability workflows and verification (#926)

2026-10-07 19:22:04 +08:00

electron-observation.md

fix(tools)!: simplify direct invocation and harden boundary contracts (#555)

2026-10-05 20:16:44 +08:00

error-contract.schema.json

refactor!: simplify runtime tools and remove replay engines (#572)

2026-10-05 21:15:04 +08:00

firmware-analysis.md

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00

ghidra-dos.md

fix(ghidra): admit the 12.1 line and the install's JDK range (#840)

2026-10-07 12:24:36 +08:00

ghidra-nativeaot.md

fix(ghidra): admit the 12.1 line and the install's JDK range (#840)

2026-10-07 12:24:36 +08:00

ida-provider.md

feat(ida): add read-only GUI and headless MCP providers (#754)

2026-10-07 01:47:05 +08:00

index.md

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00

installation.md

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00

javascript-application-graph.md

refactor!: simplify runtime tools and remove replay engines (#572)

2026-10-05 21:15:04 +08:00

javascript-application-workflows.md

fix(javascript): keep mutated object initializer values unknown (#752)

2026-10-07 10:51:44 +08:00

javascript-artifact-reconstruction.md

fix(javascript): hash graph and evidence JSON incrementally (#646)

2026-10-06 11:54:55 +08:00

javascript-recovery.md

feat(javascript): recover readable modules with Wakaru (#848)

2026-10-07 12:46:13 +08:00

javascript-runtime-observation.md

docs: clarify onboarding and align provider guidance (#745)

2026-10-06 22:57:36 +08:00

javascript-runtime-reconciliation.md

fix(tools)!: simplify direct invocation and harden boundary contracts (#555)

2026-10-05 20:16:44 +08:00

managed-code-analysis.md

chore: merge main and resolve PR #889 conflicts

2026-10-07 17:28:56 +08:00

mcp-contracts.md

feat(evidence): accept exact retained application references (#734)

2026-10-06 20:17:59 +08:00

mcp-prompts.md

fix(target): explain the JavaScript directory analysis route (#733)

2026-10-06 19:53:08 +08:00

native-investigation.md

feat(native): decode chained fixups, binds, ObjC categories and properties

2026-10-07 12:18:24 +00:00

process-capture.md

fix(process): clarify Windows capture support and recovery (#798)

2026-10-07 04:20:53 +08:00

product-catalog.json

Merge remote-tracking branch 'origin/main' into feat/pkg-inventory

2026-10-07 12:44:32 +00:00

provider-evaluation.md

fix(ghidra): admit the 12.1 line and the install's JDK range (#840)

2026-10-07 12:24:36 +08:00

reconstruction-obligation-ledgers.md

refactor: return complete analysis results inline

2026-09-29 08:07:24 +08:00

reconstruction-readiness.md

fix(tools)!: simplify direct invocation and harden boundary contracts (#555)

2026-10-05 20:16:44 +08:00

roadmap.md

fix(ghidra): admit the 12.1 line and the install's JDK range (#840)

2026-10-07 12:24:36 +08:00

testing.md

Merge remote-tracking branch 'origin/main' into feat/pkg-inventory

2026-10-07 12:44:32 +00:00

tool-design.md

refactor!: simplify runtime tools and remove replay engines (#572)

2026-10-05 21:15:04 +08:00

user-visible-errors.csv

fix(target): explain the JavaScript directory analysis route (#733)

2026-10-06 19:53:08 +08:00

web-source-location.md

feat(browser): trace captured website source-map locations (#897)

2026-10-07 16:21:18 +08:00

website-module-trace.md

feat(browser): trace captured website module imports (#879)

2026-10-07 14:59:52 +08:00

website-script-export.md

feat(web): export captured scripts for JavaScript application analysis (#801)

2026-10-07 05:24:32 +08:00

windows-ghidra-p0.md

docs: publish VitePress documentation on GitHub Pages

2026-10-07 16:58:04 +08:00