maxtac-asb-ipsw-cve-history-loop

name	maxtac-asb-ipsw-cve-history-loop
description	Use this skill when Apple Systems research needs a loop over IPSW or OTA firmware diffs, Apple security advisories, CVEs, build provenance, and binary/source patch archaeology to identify patched Apple components, infer why they changed, and enrich an ASB threat model.

MaxTAC ASB IPSW CVE History Loop

Use this loop for Apple build-specific patch archaeology. It correlates public CVE/advisory information with IPSW/OTA diffs and extracted artifacts. A changed binary is a lead, not a finding, until root cause, reachability, and security boundary are proven.

Setup

1. Define the Apple research question: CVE root cause, quiet hardening, ASB component prioritization, vulnerable/fixed build comparison, mitigation-bypass lead, or subsystem threat model.
2. Select comparable builds: product version, build number, device class, restore identity, OTA/IPSW type, architecture, and RSR/beta caveats.
3. Initialize IPSW provenance with maxtac-asb-ipsw before extraction or diffing.
4. Create Core loop state:

python3 <core-workflow-skill-dir>/scripts/loop.py init \
  --root <workspace-root> \
  --loop-id <id> \
  --kind ipsw-cve-history \
  --owner-plugin maxtac-apple-systems \
  --target "<Apple component or build pair>" \
  --scope "<device/build/advisory/component range>" \
  --summary "Correlate Apple CVE/advisory history with IPSW binary and metadata diffs." \
  --positive-gate "Advisory or diff item has build provenance, changed artifact mapping, root-cause hypothesis, reachability implication, and follow-up disposition." \
  --negative-gate "Item lacks comparable builds, artifact provenance, symbol/diff anchor, or reachability/security-boundary interpretation." \
  --output "research/apple-firmware/<case-id>/" \
  --output "research/artifacts/ipsw-cve-history/<id>/" \
  --output "models/<model-id>/"

5. Add loop items for advisories, CVEs, changed binaries, changed sandbox/entitlement/launchd metadata, kernelcache/KEXT deltas, dyld shared cache members, and suspicious strings or symbols.

Iterate

For each item:

1. Preserve build provenance and exact extraction commands with ipsw-provenance.py.
2. Diff semantically: UUIDs, symbols, strings, selectors, entitlements, sandbox rules, launchd jobs, imports, function starts, user-client methods, MIG routines, syscalls, or Mach traps.
3. Map changed artifacts to components and attack surfaces.
4. Form a root-cause hypothesis and a fix hypothesis, labeled as candidate until proven.
5. Check reachability: process identity, entitlement, sandbox, TCC, IPC, service, driver, WebKit, local/remote actor, or physical/device state.
6. Hand off to Binary or Source when decompilation, p-code, CFG, OpenGrep, fuzzing, or runtime proof is needed.
7. Update Core model, corpus, and loop item with evidence and blockers.

Gates

Positive closure requires:

• comparable build provenance and artifact hashes;
• exact changed artifact and diff anchor;
• advisory/CVE or quiet-hardening correlation;
• root-cause and reachability implication, even if candidate;
• follow-up disposition: Binary, Source, proof, model update, corpus note, or rejected/non-security.

Negative closure requires:

• mismatched device/build, missing extraction provenance, broad file-only diff, no symbol/string/function anchor, or no reachable attack surface;
• blocker captured in loop item and IPSW packet.

Output

Use IPSW provenance bundles for raw artifacts. Use Core models for build-specific architecture and invariants. Use corpus notes for durable Apple subsystem history. Use ledgers only for surviving primitives or chains.

Hard Rules

• Do not present file changes as ASB evidence without reachability and security-boundary reasoning.
• Do not compare mismatched builds without recording the caveat.
• Do not flatten Apple build IDs into the stable knowledge structure; use corpus tags and model refs.
• Do not skip provenance before extracting or diffing firmware artifacts.