v0.6.1

What's New

• Per-artifact provenance grading with evidence chain display in Examiner Portal
• Provenance chain tooltips — hover any chain step for full audit detail (command, timing, input files, SHA-256)
• vhir restore — restore cases from backup including OpenSearch indices
• OpenSearch backup via vhir backup --include-opensearch
• Interactive vhir case init prompts when run with no arguments
• Wintools watchdog with automatic restart on crash

Bug Fixes

• Masquerade detection scoped to curated system binaries, reducing false positives
• Evidence staging — VHDX/container evidence auto-staged to SMB share for wintools access
• Plaso --storage_file argument compatibility
• Config file permissions on samba.yaml/network.yaml
• Typosquatting false positives on short filenames
• Audit ID regex now supports hyphenated examiner names
• Case_id cache invalidation on mid-session case switch
• EVTX-only directory ingest crash (UnboundLocalError)

Existing Installs

Run vhir update — pulls new code, reinstalls packages, restarts gateway. No migration needed.

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's New

• opensearch-mcp: programmatic ingestion of major forensic artifacts into OpenSearch, reducing LLM token usage while providing structured access to processed evidence
• Improved forensic knowledge guidance and MCP response hints to assist the LLM throughout the investigation
• Gateway stability enhancements for automatic recovery from dropped backend sessions
• Bug fixes across all repos

Full Changelog: v0.5.4...v0.6.0

v0.5.4

Full Changelog: v0.5.3...v0.5.4

v0.5.3

What's New

Provenance Support

• run_command gains input_files parameter for provenance chain linking
• Input detection cascade: LLM-provided → catalog auto-detect → parsed tokens
• Per-file SHA-256 hashing with 1GB cap
• result_summary now includes output_file, output_sha256, stdout_bytes, stdout_head for provenance chain walking

Audit Fixes

• audit.log() returns None on write failure (matches sift-common behavior)
• Audit dir fallback: invalid AIIR_CASE_DIR falls through to ~/.aiir/active_case (matches sift-common)

Documentation

• Clear Disclosure section added to README

Full Changelog: v0.5.2...v0.5.3

v0.5.2

Resilience fixes, sanitization alignment, examiner deferral.

v0.5.1

Full Changelog: v0.5.0...v0.5.1

v0.5.0

Initial release.