Research

Empirical work, grouped by topic — not by session. Filename prefixes (s1a-, s1c-, s2b-, s2c-) carry the session provenance, so git blame plus those prefixes preserve the temporal trail without a dedicated session-N/ directory.

Discipline: every claim in this tree is either backed by a raw artifact (pcap, hex dump, syscall trace, disassembly listing) or by a direct upstream source quote — never by a guess. Anything still open is named explicitly as a gap and tracked in the relevant plan.

Topics

• protocol/ — wire captures, RemoteXPC framing, the S2.C spike experiment, and reference dumps. Start with the S2.C self-experiment.
• coredevice-internals/ — disassembly and static analysis of CoreDevice.framework and the surrounding XPC service plumbing on the macOS side. Start with the S1.A properties audit.
• environment/ — bridge / USB / wrapper-level measurements and audits. Start with the code audit findings.