v2.2.0

156 tools and 15 prompts (2.1.0 had 13): investigate_feature and check_reimplementation are new prompts. No
breaking changes.

• Model gateways. Every tool's input schema stays inside the subset the strictest model gateways accept (no $ref
  or combinators, one declared type, typed array items, depth ≤ 10); corvus status names any tool outside it.
• Untrusted-content marker. Every result that may quote the analyzed file, errors included, carries
  untrustedContent: true and source: analysis_target in its provenance.
• Long engine opens. An open that outlasts the call's deadline answers with its stage and seconds so far
  (details.stage, details.seconds); calling again picks up the same open.
• Captures. summarize_file view=pcap reads pcap and pcapng as a stream: flows, DNS names and answers, TLS server
  names and ALPN (split ClientHellos joined) and HTTP/1.x requests, with every cap stated. search_container kind=endpoint also reads pcap captures and Fiddler .saz sessions.
• Formats. New summarize_file views: sqlite (own B-tree reader: schema, row counts, sample rows), flutter
  (Dart AOT snapshot version, features and engine build id) and rust (cargo-auditable dependency lists in ELF, PE
  and Mach-O). get_pe_info reports ELF CET, BTI and PAC from the GNU property note, and reads 8-byte aligned notes
  correctly.
• Linux and Android crash dumps. open_minidump, dump_stack, read_dump_memory and bucket_minidumps read ELF
  core files: threads, registers, the signal, modules matched by build id, and stacks unwound through .eh_frame.
• Native. survey_features finds crypto and hash constants (AES, SHA-2, MD5, SHA-1, CRC-32, Blowfish, ChaCha,
  TEA, FNV, MurmurHash3) and more anti-analysis checks (hypervisor ids, analysis-tool names).
  search_instructions value=min..max searches a constant range. NativeAOT frozen strings name their MethodTable.
• Engines. set_native_type with a no-return prototype stops the callers' flow at the call in IDA and Ghidra.
  ghidra_script compiles a script once per source and runs installed scripts by name= with arguments.
  get_engine_status lists Ghidra's analysis errors and warnings.
• Evidence. read_result format=evidence bundles kept results or the latest calls with their provenance;
  format=verify runs them again and names what changed. The new prompts walk from a behaviour to the code behind it
  and check a reimplementation by emulation.
• Android and Unity. get_android_device_info gains view=processes|features|services|settings|files.
  unity_overview reads Mono APKs, zipped Windows and Linux titles in place, and WebGL builds.
• Release testing. test.ps1 -Full -Reuse reruns only the test families whose inputs changed since their last
  pass; patch releases gate on it, minor releases still run the whole exhaustive suite.