v0.6.4

Valhuntir 0.6.4 signs every approval and rejection with the examiner's own key, and vhir review --findings --verify checks them without a passphrase. Each finding's evidence is traced back to registered evidence and graded, in the portal, vhir review and reports, and ingest reads only input that traces to registered evidence, including evidence registered where it lies. Records from a registered folder or a shadow copy of an image, and threat-intel or triage lookups cited by their own id, trace and grade correctly; records indexed before 0.6.4 are named as such. Re-ingesting the same evidence keeps each record's first ingest. SRUM and prefetch records parsed through the Plaso fallback no longer gain a copy per run or shadow copy; existing cases get one more copy of them on the next re-ingest. Ingest waits for the examiner to confirm each host in the portal's Hosts tab, unless it matches an uploaded host list, and renaming or merging a host completes in cases with many indices. Plaso now parses Linux and macOS evidence. Codex and Open WebUI are supported clients, Claude Desktop is no longer supported, and Valhuntir's guidance ships as skills. Threat-intel enrichment can ask OpenCTI and MISP and records each platform's own answer; the backend is now threatintel-mcp and still answers to opencti-mcp. On Windows, sigcheck and autorunsc run with -c, tools are found by catalog name or binary and when installed after setup, Zimmerman tools get their CSV folder, catalog entries match each tool's help, Windows tools can read what SIFT tools wrote in the case, and a path the share doesn't show is refused rather than reported as an empty success. On SIFT, tools that need -e to select, a /dev source, Hayabusa's subcommands or .NET run as forensic work needs them. Many other bug fixes are included. To upgrade, run vhir update twice: the second run applies the pinned packages and offers to remove unused OpenCTI and CUDA leftovers. Approvals now need a signing key: run vhir config --upgrade-key, or let the first vhir approve convert your 0.6 passphrase. The wintools share is now vhir-cases: after updating SIFT, run vhir setup join-code and re-run the Windows installer, which now requires 64-bit Python 3.10 or later; a Windows box still mapped to the old share is moved to the new one. SIFT's stock [cases] share is no longer covered by Valhuntir's section, so disable it if unused. Thanks to David André (@elhoim) for the backup, restore, evidence and setup fixes (#13, #17, #18, #21, #23, #41) and the reports behind #11, #14, #15, #16 and #22.

Full changes: v0.6.3...v0.6.4