Harden source runtime recovery

.github/workflows/docs.yml

@@ -0,0 +1,75 @@
+name: Documentation
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/docs.yml"
+      - "docs/**"
+      - "mkdocs.yml"
+      - "requirements/docs.txt"
+      - "README.md"
+      - "SECURITY.md"
+      - "CONTRIBUTING.md"
+      - "SOURCE_AVAILABILITY.md"
+      - "THIRD_PARTY_NOTICES.md"
+  pull_request:
+    paths:
+      - ".github/workflows/docs.yml"
+      - "docs/**"
+      - "mkdocs.yml"
+      - "requirements/docs.txt"
+      - "README.md"
+      - "SECURITY.md"
+      - "CONTRIBUTING.md"
+      - "SOURCE_AVAILABILITY.md"
+      - "THIRD_PARTY_NOTICES.md"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: documentation-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build documentation site
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements/docs.txt
+      - name: Install documentation dependencies
+        run: python -m pip install --disable-pip-version-check --requirement requirements/docs.txt
+      - name: Build strict documentation site
+        run: python -m mkdocs build --strict --clean
+      - uses: actions/configure-pages@v6
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      - uses: actions/upload-pages-artifact@v5
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        with:
+          path: site
+
+  deploy:
+    name: Publish documentation site
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5

.gitignore

@@ -2,6 +2,9 @@
 venv/
 build/
 dist/
+site/
+output/
+.playwright-cli/
 ios_developer_toolkit/deployment/
 packaging/deployment/
 *.egg-info/
@@ -18,6 +21,9 @@ reports/
 ios-case-*/
 ufade-acquisitions/
 UFADE Acquisitions/
+mvt-analyses/
+MVT Analyses/
+mvt-analysis-*/
 location-logs/
 Location Logs/
 iOS Developer Toolkit Location Logs/
@@ -33,6 +39,8 @@ nuitka-crash-report.xml
 *.pcapng
 *.ufd
 *.ufdr
+*.stix
+*.stix2
 
 # Packages, profiles, and developer-image payloads
 *.cer

CONTRIBUTING.md

@@ -54,6 +54,13 @@ venv/bin/python -m ios_developer_toolkit.ipa_inspector --help
 QT_QPA_PLATFORM=offscreen venv/bin/python -m ios_developer_toolkit --toolkit-internal-smoke-test
 ```
 
+Documentation changes must also pass the strict site build:
+
+```bash
+venv/bin/python -m pip install --requirement requirements/docs.txt
+venv/bin/python -m mkdocs build --strict --clean
+```
+
 Prefer a real, authorized integration check when the change touches device discovery, pairing, developer services, DDI handling, tunnels, backup, installation, location simulation, logging, or packet capture. State exactly which host, device family, OS version, connection path, and cleanup action were tested, without publishing a unique identifier.
 
 Changes to packaging must additionally build the native app, run its embedded CLI and GUI smoke checks, verify the expected Mach-O architecture, and pass `codesign --verify --deep --strict`. The app must contain a matching `Contents/Resources/BOM.cdx.json`, `SOURCE_AVAILABILITY.md`, and the generated `Contents/Resources/Licenses/` inventory; `scripts/verify_release_metadata.py` enforces those links. Release assets must remain separate for Apple Silicon and Intel until a verified universal build exists, and the release workflow must retain checksums plus build-provenance and SBOM attestations.

SOURCE_AVAILABILITY.md

@@ -13,3 +13,5 @@ The prebuilt application is accompanied by an architecture-specific CycloneDX SB
 The release-critical upstream source locations and license information are recorded in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). In particular, the packaged `pymobiledevice3` release is available at its [matching upstream tag](https://github.com/doronz88/pymobiledevice3/tree/v11.15.1), including its GPL-3.0-or-later license. The project’s public tagged source, package inventory, and embedded notices are intended to make the source and license boundary inspectable before redistribution.
 
 PySide6/Qt, Nuitka, CPython, and every other dependency remain subject to their own terms. Consult the generated `Contents/Resources/Licenses/` inventory in the application and the matching SBOM for the exact package set. This document is an availability and attribution statement, not legal advice.
+
+Optional UFADE, MVT, go-ios, idb, and ipsw integrations launch user-managed external installations. Their source is not part of the application bundle or release SBOM; consult their upstream repositories and licenses for the exact external version selected by the operator. The Ecosystem Tools workspace records the resolved executable path, SHA-256, and reported version or build identity for go-ios, idb Companion, and ipsw before enabling a probe.

THIRD_PARTY_NOTICES.md

@@ -20,7 +20,9 @@ Each architecture-specific release also contains:
 
 The generated package inventory is intentionally more detailed than this summary and includes transitive Python dependencies. A package whose wheel does not contain a license text is identified as such in the inventory and linked to its declared project source when available.
 
-UFADE is an optional, separately installed external provider. The toolkit does not bundle UFADE. Other projects named in the README as design references are not copied, imported, or linked unless the README explicitly says otherwise.
+UFADE, MVT, go-ios, idb, and ipsw are optional, separately installed external providers. The toolkit does not bundle those projects. MVT remains subject to the [MVT License](https://license.mvt.re/1.1/) and its consent and interpretation boundaries. [go-ios](https://github.com/danielpaulus/go-ios), [idb](https://github.com/facebook/idb), and [ipsw](https://github.com/blacktop/ipsw) each declare the MIT License in their upstream repositories. Their adapter only validates and launches a user-selected executable; their source and binary remain outside this project and its release SBOM. Other projects named in the README as design references are not copied, imported, or linked unless the README explicitly says otherwise.
+
+The documentation workflow uses pinned [Material for MkDocs](https://github.com/squidfunk/mkdocs-material) 9.7.7 under its MIT license. It is a site-build dependency only and is not bundled in the macOS application or application SBOM.
 
 See [SOURCE_AVAILABILITY.md](SOURCE_AVAILABILITY.md) for the project source location, matching tagged source, and upstream source locations for bundled third-party components.