1201c25542
* fix(ci): retire unused internal analysis declarations * test: use an admitted app bundle for provider routing (cherry picked from commit00aa17f12a) * test: keep bundle routing coverage outside oversized group (cherry picked from commit8658353b0d) * fix(ci): align regression fixtures with current admission contracts * test: bind extraction close fixtures to their ZIP digest (cherry picked from commit626d0250db) * test(cli): match typed analysis outcomes in function detail fixture * test(ghidra): preserve empty Java property separator framing * test(electron): retain unknown IPC ownership for native module gaps * fix(electron): share source-scoped call path identity * test(captures): assert safe source identity on SAZ refusal * test(apple): match root occurrence kind to inventory manifest * fix(examples): align directory root occurrence identity * test(electron): align equivalent fixture assertions with upstream * test(process): assert retained capture root identity * test(windows): declare the PE fixture optional header * test(ci): refresh owned registration and verifier fixtures * test(setup): use owned registrations for refresh fixtures * test(process): control unavailable ownership in CLI cleanup fixture * test(process): guard controlled compiler output arguments * test(setup): align equivalent entrypoint guards with upstream * test(process): release the cleanup target through an owned gate * test(ci): align semantic identities and owned fixture facts * test(pcap): retain the upstream DNS wire fixture branch * test(pcap): use the canonical wire ownership fixture * test(pcap): assert exact DNS wire query labels * test(ci): preserve admission and ownership fixture prerequisites * test(ci): align authenticated fixture and cleanup boundaries * test(windows): align native artifact fixtures with upstream * test(android): request complete evidence for inline MCP contracts * test: avoid pinning diagnostic wording * test: verify cleanup diagnostics at their source * test: strengthen evidence and cleanup checks * test: avoid pinning registration guidance --------- Co-authored-by: Plastic-time <[email protected]> Co-authored-by: morluto <[email protected]>
DNS producer recordings
dns-raw-tree.json and dns-family-tree.json retain protocol trees from
actual official Wireshark 4.4.19 TShark output on generated, offline captures.
They contain no external network traffic. The projection keeps frame, the
DNS-family protocol tree and its corresponding raw tuple unchanged.
The first capture has two UDP responses whose displayed a.b.example names
have different wire labels (a.b / example versus a / b / example),
the same two responses in one TCP frame, and one response reassembled from two
TCP segments. Each response contains one compressed-owner IN A answer,
192.0.2.9.
The family capture has three IPv4 UDP responses, using source and destination
ports 53, 5353 and 5355 respectively. Each has ID 1, 2 or 3, flags 0x8180,
one IN A question for a.example, and one compressed-owner IN A answer with
TTL 60 and address 192.0.2.9. The mDNS answer class is 0x8001 (cache flush);
the other classes are 0x0001.
The verified family acquisition command is:
tshark -n -r dns-family.pcap -T json -x --no-duplicate-keys \
-Y 'dns || mdns || llmnr' -J 'frame dns mdns llmnr'
The three family names identify separate protocol trees and raw tuples;
all three trees expose child fields named dns.*. Filtering only dns
omits mDNS and LLMNR. Lowercase -j filters nested question/answer trees;
uppercase -J includes them.