Workbench 0.1.4 — Summary clarity and curated themes

Workbench 0.1.4 — Summary clarity and curated themes

Experimental macOS ARM64 prerelease, continuing the ad-hoc signing profile.

Changes since 0.1.3

• Executive summary clauses supporting an AI Malicious verdict appear red;
  clauses supporting a Benign verdict appear green. Unrelated objective facts,
  chronology, limitations and contrary evidence keep their normal text color.
  Exact author-selected excerpts preserve formatting and clickable citations.
• The 16 screenshot-listed extras and three seasonal themes are deferred to the
  roadmap. The catalog has 18 remaining choices. Old selections resolve
  safely without rewriting their original preference or revision.
• Native Adventure CI now uses complete input comparisons. Both Adventure game
  editions remain available independently of the retired Adventure theme.
• The exact upstream BSD notice for proxy_tools 0.1.0 is included after verifying
  that the upstream, published archive and bundled implementation are identical.

The MCP backend remains 0.1.4 at 2887c77283da4a45860d8ac2f3042027401257a0,
including CryptoMem 0.5.0. This Workbench release changes presentation and
packaging; it does not add forensic detector capabilities or capture-platform
support. Saved evidence, cases, conversations, sealed reports and independent
human determinations are preserved. No model runs merely to view a report.

Validation and artifact provenance

• The isolated installed-wheel smoke passed all 299 application tests.
• Native ARM64 validation passed with 203 catalog plugins, no import failures,
  ten-tool MCP discovery, CryptoMem synthetic vectors and three synthetic analyzer
  invocations. First-run provisioning verified four bundled symbol packs with
  downloads blocked. Both Adventure editions passed gameplay and save checks.
• Code signatures and system-or-bundle-relative native linkage passed. The release
  audit checked layout, selected private filenames, contained symlinks, the addon
  allowlist, notices and 14,425 regular-file hashes. The ZIP passed its
  integrity check.
• Runtime and analyzer package versions match the preceding local build, except
  for Workbench's own 0.1.4 version. The matched proxy_tools notice is present in
  both the native notices and collected dependency license texts.

Measured 2026-11-03 from clean source
bc7dff51ba64b9c5ba5ff3fa3f2b3a17712ae453:
Volatility Workbench.app has 1,348,420,889 regular-file bytes
(1285.954370 MiB), excluding symlink aliases. The ZIP has
1,122,203,471 bytes (1070.216628 MiB), SHA-256
3f77572030f0f4c9e5abce9df1a2ada8865c2035ec9d1b5fe93e9618ee6281a6.
The matching MCP source
remains pinned. A later documentation-only measurement stamp does not require
rebuilding this artifact. Python 3.12/3.13 compatibility and installed-package
checks, synthetic browser regressions, security/SAST and code-quality CI passed.

Remaining limits

Ad-hoc signed; no Developer ID signing or Apple notarization is claimed.
Downloaded-app Gatekeeper/clean-Mac acceptance and broader accessibility testing
remain outstanding. The ARM64 application host does not imply support for
Apple-silicon memory captures. Existing forensic platform and symbol-matching
limits remain unchanged. Validation uses harmless synthetic/public fixtures;
no private evidence or live-model loop is used for release checks.

Workbench 0.1.3 — CryptoMem 0.5.0 backend

Workbench 0.1.3 adopts MCP 0.1.4 and CryptoMem 0.5.0 with aligned backend source and release-wheel pins. The existing ten MCP tools support opt-in English BIP-39 mnemonic checksum validation, Bitcoin WIF and BIP-32 xprv/tprv validation, and explicitly ambiguous transaction-ID candidates. Ordinary outputs mask secrets; complete extraction is explicit, private and local-only. Address defaults and UI behavior are preserved.

Validation used synthetic/public fixtures: all 272 application tests, installed-package smoke, 29 focused macOS tests, 11 security tests, native ARM64 runtime/assets and provenance checks, real ten-tool MCP across all three CryptoMem adapters, secret-reader/extraction guards, timeout and cancellation. Native runtime Python 3.12.15; production Python 3.12.13; Volatility 2.28.2; MCP SDK 2.3.0. See docs/RELEASE_0.1.3.md for detailed provenance.

The external Linux collection completed with successful exit and a ready receipt verifying all 10,255 catalog tables and matching metadata. It remains outside the native bundle. Exact captured-kernel symbols are always required. Linux/macOS real-memory validation remains outstanding; nested macOS submaps, Intel32, Apple-silicon captures and modern macOS remain unsupported. The ARM64 application host is distinct from capture architecture support.

This is an ad-hoc signed ARM64 macOS prerelease, without Developer ID signing or Apple notarization. The native app contains 1,352,402,393 regular-file bytes (1289.751428 MiB), excluding symlink aliases. The ZIP is 1,126,118,069 bytes (1073.949880 MiB), built from clean source acdf84a. No evidence, case state, recovered secrets or external Linux collection is included.

Volatility Workbench 0.1.2

Workbench 0.1.2 adopts MCP 0.1.3 and bundles CryptoMem 0.4.0's experimental legacy Intel64 macOS adapter alongside Windows and Linux. All three commands use the existing ten MCP tools, manual selection, offline execution and XP-independent discovery. No UI redesign or separate detector is added.

Use the existing legacy Mac symbol pack only when its Darwin kernel exactly matches the captured image. Nested submaps (including ordinary shared-region maps), Intel32/Apple-silicon Mac captures and modern macOS are unsupported. Real-memory Mac and Linux validation remain outstanding. The application running on Apple silicon is distinct from support for Apple-silicon captures.

The native Mac app remains an ad-hoc signed prerelease, not Apple-notarized. The additional 10,255-table Linux collection remains in the configured external symbol store, outside the app and Git. Exact kernel matching is always required.

Workbench 0.1.1: Linux CryptoMem, macOS arm64 (ad-hoc signed)

Workbench 0.1.1

Adopts core 0.1.2 and its pinned CryptoMem 0.3.0 release. Linux x86-64
memory-image analysis is available through the existing MCP discovery and
execution tools. Windows command/output behavior is preserved. Both CryptoMem
commands remain available when the legacy Windows XP add-on is disabled.

The backend contains a pinned catalog and explicit installer for 10,255 community
Linux x86-64 symbol tables. Installed tables use the existing configured symbol
store and offline index; the 19.53 GiB collection is not copied into the app
bundle or redownloaded during app upgrades. The existing four official starter
packs remain bundled. Exact captured-kernel symbols are required, and other
Linux architectures remain unsupported until tested.

Validation uses synthetic fixtures and real installed analyzer/MCP invocations,
including a clearly failed Linux scan with unsatisfied kernel/symbol requirements.
A successful empty result is not substituted for missing symbols. No private
images are opened or uploaded. Real-memory Linux CryptoMem validation remains
outstanding. This release does not add a Linux desktop build or redesign the UI.

Local macOS arm64 packaging is ad-hoc signed unless built separately with a valid
Developer ID identity and notarized. Ad-hoc validation is not notarization.

The local macOS arm64 build passed native runtime/dependency checks, first-run
provisioning of all four packs with network access blocked, discovery of both
CryptoMem 0.3.0 commands with XP enabled/disabled, actual ten-tool MCP discovery
and a synthetic Linux missing-kernel failure, input-integrity checks, signature
verification and native library linkage checks. The app catalog contains 202
commands with zero import failures. The installed Python package suite passed
272 tests. No real memory image was used.

Artifact source: 8015921c801dd80036321dc61c28062ad4969026 (the subsequent README
size stamp is documentation only). Backend release source:
5e3affb9c9fcf1be2e6b463194cef488518c7ff6. The native artifact uses CPython 3.12.15,
Volatility 2.28.2, CryptoMem 0.3.0 and MCP 2.3.0. It is ad-hoc signed and has not
been Apple-notarized.

Download Volatility-Workbench-macos-arm64.zip (1,126,050,594 bytes) and verify
it against SHA256SUMS. artifact.json records package versions, hashes and
source provenance. The archive is ad-hoc signed, not Apple-notarized; it is
provided as a prerelease for local validation. See the repository's MACOS_APP
instructions for installation and signing requirements.

The complete Linux community collection is an explicit additional 19.53 GiB
operator download through core's symbols-install --linux-all command, not part
of this ZIP. No capture data or recovered content is included in these assets.

Workbench 0.1.0 — independent application

Initial independent Workbench release, extracted from volatility-mcp at 3ecc22e1275467879005556f5340fbc863bc3281.

Includes the existing case explorer, sequential jobs, Codex case adapter, reports, coins and three themes. Shared forensic code is an installable dependency pinned to core 376d338494465df402338db9360b48e9e11a7bfc (0.1.0, API revision 1).

Verified with 34 Workbench regressions, isolated installed-wheel/automatic-core installation, both MCP protocol modes, saved-case browser checks, and GitHub CI on Python 3.12/3.13. A weekly/manual updater tests eligible dependency updates before proposing a PR. No application auto-update or case-data migration occurs.