AutoRE-CLI v0.1.6

AutoRE-CLI v0.1.6

This release adds bounded static byte proofs and rebuilds all five platforms
locally from source revision 952aef624adb0246d983834edf1b4e29ba16a638.

• recover-bytes <input> --addr <address> --output <results>/bytes.json uses
  one immutable input snapshot. It retains the full input hash, selected slice,
  original file offsets, read-only mapping basis and instruction provenance.
• File/stack loads, partial values, MOVK updates and overlapping ordered stores
  share checked byte semantics. Forward edges with a unique predecessor may
  carry memory facts; ambiguous joins and unknown effects preserve uncertainty.
• pair_loops proves supported loop bounds and arithmetic from CFG/IL def-use,
  independent of register names or text readability. Manually supplied plans
  remain unproved candidates.
• Guarded AArch64 pointer-table recovery preserves target order and duplicates,
  materializes case bodies, and keeps unresolved indirect jumps explicit.
• object_slot_links exposes symbolic load/store/copy relationships, source
  load addresses, widths, truncation and zero extension without requiring a
  particular Go compiler version.
• state_chains summarizes literal byte writes only through a unique initial
  state and a proved acyclic constant-state chain ending in return.
• AArch64 multiply-add/subtract and narrow scalar stores now reach the shared
  width-aware IL and byte recovery layers.

These are static candidates. Unknown call effects, ambiguous joins, arbitrary
state machines and unproved captured values remain unresolved. Object-slot
links do not prove Go capture names, initializer order, runtime layouts or
interface dynamic types. Recovered text does not establish runtime use.

All compilation and validation run locally; no GitHub Actions or remote CI is
used. Cross-platform format, architecture, provenance and checksum validation
is static. Native Windows/Linux runtime acceptance is not claimed. macOS
binaries are ad-hoc signed, not notarized; Windows is not Authenticode signed.

Download the matching AutoRE-CLI-0.1.6-<platform> archive or the standalone
AutoRE-CLI-0.1.6-auto-re-skill.zip, then verify SHA256SUMS.release.

AutoRE-CLI v0.1.5

AutoRE-CLI v0.1.5

This release improves bounded static investigation and refreshes all five
platform binaries from source revision
158ca044a1908e9ae2b39105d68ccbd4b333bc51.

• Recover structurally validated Go function inventories when a named table has
  rewritten magic. Real names and synthetic address labels are counted separately;
  inferred layout does not prove a compiler version or runtime ABI.
• Connect validated AArch64 formed addresses to indirect-call discovery and graph
  candidates. Unresolved calls provide bounded caller inspection actions.
• Preserve scalar/pair memory widths, ordered writes and SP writeback in IL, while
  retaining opaque semantics for unsupported forms. Function JSON includes bounded
  constant stack-byte evidence with unknown bytes, provenance and strict UTF-8.
• Add fold-pair-bytes for bounded, explicitly parameterized algebraic candidates.
  It does not execute instructions or prove that a binary uses the supplied plan.
• Suppress repeated inspection actions, add optional prior-receipt no-progress
  checks, and distinguish checkout diagnosis from duplicate installed Skills.
• Bound Go seed decoding by the next function boundary and expose separate
  load, discovery and serialization benchmark costs.
• Refresh public agent instructions, bilingual investigation guidance and helpers.

General file-backed copy propagation, automatic string-loop parameter proofs,
and string recovery through closure/state-machine chains remain unsupported by
this slice. Recovered text and inferred calls do not prove runtime behavior or
malicious intent.

All five binaries are built locally with the pinned Rust toolchain. No GitHub
Actions or remote CI is used. Cross-platform binary format, architecture,
provenance, signing and checksum checks are static; native Windows/Linux runtime
acceptance is not claimed. macOS binaries are ad-hoc signed, not notarized;
the Windows binary is not Authenticode signed.

Download the matching AutoRE-CLI-0.1.5-<platform> archive, or the standalone
AutoRE-CLI-0.1.5-auto-re-skill.zip, and verify SHA256SUMS.release before use.

AutoRE-CLI v0.1.4

AutoRE-CLI v0.1.4

AutoRE-CLI v0.1.4 refreshes the public five-platform distribution from source
revision de89c02c8cab17c9d6fd253413806b45ef482d45 with a fully locally rebuilt binary matrix
(toolchain: Rust 1.97.1 pinned channel; Linux arm64 via cross glibc GCC,
macOS via zig ld64 with ad-hoc ldid signatures, Windows x86-64 via the
pinned LLVM-MinGW 20260616 UCRT toolchain with +crt-static and a zero PE
timestamp).

Highlights

• Bounded Mach-O universal-binary parsing: slice count budget, order-independent
  overlap validation, and rejection of ambiguous duplicate CPU identities
  before any per-slice work.
• LLVM-verifier-clean experimental dump-llvm output: legal user_ symbol
  namespace, byte-hex string escaping, and explicit external-branch boundaries
  instead of undefined labels.
• Structured JSON error contracts everywhere: integer conversion limits,
  malformed sinks, and bundle receipts fail closed with bounded errors instead
  of tracebacks.
• Action preflight is now identical with or without an execution receipt;
  version probes read bounded dual streams; continuation runs take a
  configurable --timeout-seconds budget with process-group/job-object
  cleanup, bounded pipe finalization, and explicit timeout/cancel statuses.
• One-shot start_analysis.py launcher and the shared process_control.py
  lifecycle module join the managed Skill inventory.
• Release packaging now runs the full repository-distribution verification gate
  before producing any archive, selects every packaged file from the verified
  checksum inventory, requires the complete five-platform matrix, and
  cross-checks the standalone Skill ZIP byte-for-byte against the platform
  packages.

Download

Choose the package for your host:

• AutoRE-CLI-0.1.4-macos-arm64.tar.gz
• AutoRE-CLI-0.1.4-macos-x86_64.tar.gz
• AutoRE-CLI-0.1.4-linux-x86_64.tar.gz
• AutoRE-CLI-0.1.4-linux-arm64.tar.gz
• AutoRE-CLI-0.1.4-windows-x86_64.zip

The standalone Agent Skill is available as
AutoRE-CLI-0.1.4-auto-re-skill.zip.

Download SHA256SUMS.release from the same release and verify the archive
before extraction. Each platform package contains exactly one release binary,
the Agent Skill, offline installers, provenance, checksums, and notices.

Signing

• macOS binaries are ad-hoc signed, not Developer ID signed or notarized.
• Windows x86-64 is not Authenticode signed.
• Linux artifacts have no platform signing requirement.

Checksums prove consistency with this release; authenticate the release channel
before trusting its checksum file.

AutoRE-CLI v0.1.3

AutoRE-CLI v0.1.3

AutoRE-CLI v0.1.3 refreshes the public five-platform distribution from source
revision 253dcdf0c6834bd04af63e4ecaa45e6f5cf96d76.

Highlights

• Added a read-only Skill doctor for CLI/Skill version agreement, installed
  content drift, and duplicate registration.
• Added positive and negative trigger cases, a shorter discriminating Skill
  description, and direct narrow routing before open-ended report generation.
• Added versioned action receipts with exact CLI identity, argv, exit status,
  full stdout/stderr hashes, and bounded retained tails.
• Added versioned bundle verification receipts plus marker- and token-bound
  cleanup of exact validator-owned temporary trees.
• Enforced fixed bundle file/byte materialization limits and rejected actual
  payload size mismatches before reading or destination creation.
• Added POSIX and native PowerShell invocation guidance while preserving the
  static-only target safety boundary.

Download

Choose the package for your host:

• AutoRE-CLI-0.1.3-macos-arm64.tar.gz
• AutoRE-CLI-0.1.3-macos-x86_64.tar.gz
• AutoRE-CLI-0.1.3-linux-x86_64.tar.gz
• AutoRE-CLI-0.1.3-linux-arm64.tar.gz
• AutoRE-CLI-0.1.3-windows-x86_64.zip

The standalone Agent Skill is available as
AutoRE-CLI-0.1.3-auto-re-skill.zip.

Download SHA256SUMS.release from the same release and verify the archive
before extraction. Each platform package contains exactly one release binary,
the Agent Skill, offline installers, provenance, checksums, and notices.

Signing

• macOS binaries are ad-hoc signed, not Developer ID signed or notarized.
• Windows x86-64 is not Authenticode signed.
• Linux artifacts have no platform signing requirement.

Checksums prove consistency with this release; authenticate the release channel
before trusting its checksum file.

AutoRE-CLI v0.1.2

AutoRE-CLI v0.1.2

AutoRE-CLI v0.1.2 refreshes the public five-platform distribution from source
revision 35380fa076394ff4f63bb6ab0665bc58d18bcd04.

Highlights

• Hardened archive containment, output integrity, artifact transactions,
  bounded control-file reads, streaming hashes, and split-output ownership.
• Added bounded XAR/CPIO validation and safer trusted UPX helper identity and
  launch handling.
• Expanded static ELF PLT and PE eager, ordinal, and delay-import recovery.
• Expanded DWARF compressed-section, split-range, type-unit, inherited
  attribute, call-site, return-type, and aggregate member-size recovery.
• Corrected additional AArch64 load, PAC, and atomic effects plus x86 string
  and Windows syscall-gateway effects.
• Improved structured Go/Rust language evidence, selector failure behavior,
  evidence pagination, and Agent Skill continuation validation.

Download

Choose the package for your host:

• AutoRE-CLI-0.1.2-macos-arm64.tar.gz
• AutoRE-CLI-0.1.2-macos-x86_64.tar.gz
• AutoRE-CLI-0.1.2-linux-x86_64.tar.gz
• AutoRE-CLI-0.1.2-linux-arm64.tar.gz
• AutoRE-CLI-0.1.2-windows-x86_64.zip

The standalone Agent Skill is available as
AutoRE-CLI-0.1.2-auto-re-skill.zip.

Download SHA256SUMS.release from the same release and verify the archive
before extraction. Each platform package contains exactly one release binary,
the Agent Skill, offline installers, provenance, checksums, and notices.

Signing

• macOS binaries are ad-hoc signed, not Developer ID signed or notarized.
• Windows x86-64 is not Authenticode signed.
• Linux artifacts have no platform signing requirement.

Checksums prove consistency with this release; authenticate the release channel
before trusting its checksum file.

AutoRE-CLI v0.1.1

AutoRE-CLI v0.1.1

AutoRE-CLI is a public binary distribution for bounded, evidence-backed static
reverse engineering by human analysts and AI agents.

Highlights

• Static-only analysis of ELF, PE/COFF, Mach-O, universal Mach-O, object files,
  and explicitly identified raw shellcode.
• Agent-oriented JSON with budgets, warnings, completion state, evidence
  strength, verified bundles, and exact next actions.
• Function, CFG, LLIL/MLIL/HLIL/CUSTOM IL, pseudo, call/data reference, PE,
  Go/Rust evidence, protection, archive/replay, and semantic diff surfaces.
• Offline fail-closed installer and verifier.
• Agent Skill for bounded, iterative investigation.
• Five host targets, now including Windows x86-64.

Download

Choose exactly one approximately 7–8 MB platform package:

• AutoRE-CLI-0.1.1-macos-arm64.tar.gz
• AutoRE-CLI-0.1.1-macos-x86_64.tar.gz
• AutoRE-CLI-0.1.1-linux-x86_64.tar.gz
• AutoRE-CLI-0.1.1-linux-arm64.tar.gz
• AutoRE-CLI-0.1.1-windows-x86_64.zip

The standalone Agent Skill is available as
AutoRE-CLI-0.1.1-auto-re-skill.zip.

Download SHA256SUMS.release from the same release and verify the archive
before extraction. After extraction, run ./verify.sh on macOS/Linux or:

py -3 scripts/autore_distribution.py verify

on Windows. The internal verifier checks the complete extracted file set,
binary provenance, Skill inventory, public-content boundary, and SHA-256.

Public Repository Boundary

This repository publishes compiled binaries plus the MIT-licensed Agent Skill,
helpers, installer, verifier, release automation, controlled demo source, and
documentation. The Rust engine implementation, private specifications, samples,
and analysis output are not published.

Signing

• macOS binaries are ad-hoc signed, not Developer ID signed or notarized.
• Windows x86-64 is not Authenticode signed.
• Linux artifacts have no platform signing requirement.

Checksums prove consistency with this release; authenticate the release channel
before trusting its checksum file.