Skip to content

Product audit — 2026-09-21

Executive assessment

iOS Developer Toolkit has a stronger foundation than its small version number suggests. It is a macOS PySide6 desktop application that turns a deliberately curated subset of pymobiledevice3, Xcode/CoreDevice, Developer Disk Image, RVI, backup, and evidence-preservation workflows into guided operations. Its differentiators are its explicit authorization boundaries, local-first evidence handling, typed acknowledgement for device-changing work, capability matrix, device compatibility observations, investigation-oriented live-log windows, and release artifacts with SBOMs and provenance.

Its primary product risk was reliability at the first screen. At audit start, the application imported the MobileBackup2 transport implementation while constructing the desktop UI, so a slow or damaged third-party transport import could prevent the interface from becoming available even though backup was not being used. Separately, DeviceScanner only consumed QProcess output from readiness signals and did not consume bytes still available when the child exited. That created a confirmed race: a packaged build could successfully run pymobiledevice3 usbmux list but parse an empty discovery buffer. The P0 implementation delivered with this audit moves transport imports into the backup worker and drains completion output before parsing; it also adds a deterministic fast-exit regression test.

The correct next investment is therefore a reliable startup and device-discovery foundation, not another device command. It makes the existing workbench usable for beginners, gives experts dependable process semantics, and establishes the abstraction needed before further QProcess-heavy workflows are added.

What exists today

The product has thirteen workspaces: Home, Device & DDI, Capability Matrix, Location Lab, Live Logs, Command Center, Installed Apps, Backup, Sideload IPA, Evidence Capture, Ecosystem Tools, Man Pages, and Scope & Safety. It currently provides 49 declarative guided command presets, a live-help/command-drift check, DDI mounting, RSD/CoreDevice/DVT checks, GPX location simulation with cleanup, separate Unified/syslog/oslog windows, installed app inventory, encrypted MobileBackup2 workflow, isolated UFADE launch, guided external MVT analysis, provenance-checked go-ios/idb/ipsw adapters, IPA inspection and installation, RVI/PCAP and artifact collection, guided case intake, support bundles, compatibility history, and keyboard-first navigation.

The repository is a Python 3.10+ PySide6 project with a bundled pymobiledevice3 runtime model. ios_developer_toolkit/app.py is a 5,600+ line MainWindow, while domain modules cover capability probing, collectors, live logs, location testing, IPA inspection, support bundles, and device compatibility. CI runs unit tests, compile checks, CLI help checks, and a headless GUI smoke test on macOS. Tagged release CI produces Apple Silicon and Intel bundles, CycloneDX SBOMs, checksums, and GitHub attestations. The app is ad-hoc signed, not Developer ID signed or notarized.

Strengths worth protecting

  • The command catalog is declarative, reviewed, parameter-validated, and avoids feeding guided fields into a shell.
  • The capability matrix makes the iOS developer stack legible: trust, Developer Mode, DDI, RSD, CoreDevice, DVT, lock state, and Web Inspector are distinguished rather than collapsed into “device failed.”
  • The safety model appropriately classifies host writes, device changes, and high-impact operations, and binds acknowledgement phrases to the selected target.
  • Live Logs is notably better than a terminal wrapper: it separates raw capture from rendered filtering, supports annotations as analyst claims rather than facts, preserves hashes, and explains capture boundaries.
  • Evidence cases use restrictive local permissions, store a local authorization acknowledgement, and state their chain-of-custody limits plainly.
  • The sanitized support bundle intentionally excludes identifiers, pairing material, raw captures, and user-entered values.
  • The product already has a real-device compatibility observation format that fingerprints a device rather than retaining its raw UDID.
  • Release engineering is unusually good for a young desktop project: dual architecture builds, SBOMs, third-party notices, checksums, and build provenance are present.

Weaknesses and user impact

Finding User impact Priority
GUI startup imported pymobiledevice3.lockdown through backup_worker before Backup was opened. A failure in one optional subsystem could block all workflows. Fixed in this audit by moving transport imports to the worker execution path. Resolved P0
DeviceScanner did not drain final QProcess stdout/stderr in its completion handler. A connected device could be invisible in the packaged UI despite the bundled CLI returning valid JSON. Fixed with completion-time draining and a real fast-exit QProcess regression test. Resolved P0
The repository pinned pymobiledevice3==10.11.0 while a clean Dependabot PR existed for 11.12.4 and upstream had newer releases. The app missed modern iOS tunnel fixes and could present stale command assumptions. Fixed with a validated upgrade to 11.15.1: the full test suite, GUI smoke test, CLI discovery, and all 49 live-help routes passed. Resolved P0
MainWindow owns dozens of process/buffer/timer lifecycles. Completion, cancellation, timeout, and output handling can diverge across workspaces; the scanner defect is evidence of that risk. P1
Release-only packaging was previously validated only after a tag was pushed. Dual-native pull-request smoke now builds and inspects the entire frozen app before release. Resolved P1
Source macos/Info.plist previously exposed an older version than pyproject.toml. Source, packaging, citation, and bundle metadata are synchronized and covered by tests. Resolved P1
Coverage remains weighted toward pure functions and host-only integration. Fast-exit discovery, process lifecycle, real live help, the complete 49-route drift UI, and both frozen architectures are covered; device-service behavior remains deliberately opt-in through the physical protocol. P1
The first-run experience assumes familiarity with DDI, RSD, and CoreDevice. Beginners receive good instructions, but not a single coherent “make my device ready” decision flow. P1
The README is extensive but is the dominant documentation surface. It is difficult to keep operational recipes, scope boundaries, architecture, release verification, and contributor guidance discoverable. P2

Beginner UX audit

The first screen has strong visual hierarchy and a useful six-step map, but it asks a new user to understand multiple Apple service layers before confirming the one prerequisite that matters: “Can this Mac see and trust my device?” A first-run assistant should remain optional, but should reduce the path to: connect → unlock/trust → verify connection → enable Developer Mode if needed → choose whether a task needs a DDI → run a safe first action.

The toolkit should keep its advanced vocabulary, but display it progressively. “RSD tunnel” is useful evidence for an expert; for a beginner it should be introduced as the iOS 17+ developer connection path, with the exact observed status and a one-click non-destructive recheck. The current reconnect guidance is careful not to restart SIP-protected/root-owned services, which is correct and should remain a hard boundary.

Expert UX audit

Experts need less prose and better state correlation. The next UI layer should expose a compact operation record for every command: target, transport, exact argv, start/end time, exit status, timeout/cancel reason, output paths, hashes, and prerequisite states. Existing Live Logs and Evidence Capture show the right pattern, but it is not shared by Command Center, DDI, app, and backup operations. Experts also need a clear distinction between an upstream command being available in live help, a device service being advertised, and a particular operation having completed successfully.

Missing product categories

The toolkit intentionally does not need to become an IDE, jailbreak suite, MDM, spyware scanner, signing service, or remote device farm. It can, however, become more useful in five bounded areas:

  1. A shared diagnostic/remediation engine that maps an operation to explicit prerequisites and reruns only the checks relevant to that operation.
  2. A centralized operation lifecycle service for QProcess/subprocess work, with start, final-drain, cancellation, timeout, structured result, and copyable support record semantics.
  3. A project-oriented developer workflow that can hand off to Xcode tools for test destinations, .xcresult inspection, and selected devicectl operations without pretending to replace Xcode.
  4. A scoped ecosystem handoff layer: MVT for consented backup analysis, ipsw for firmware research, and configurable external tool adapters rather than bundled forks.
  5. A device-lab/compatibility contribution path that can export redacted, opt-in capability observations and reproduce upstream pymobiledevice3 bugs with a standard report.

Architecture and maintainability audit

The project has good domain modules, immutable data classes, clear validation errors, and a runtime wrapper that makes frozen builds invoke internal workers safely. The central weakness is orchestration concentration. MainWindow manages process ownership, byte buffers, timers, error mapping, UI enablement, and output rendering for many unrelated workflows. That makes process behavior difficult to test and encourages near-duplicate cleanup logic.

The target architecture is not a wholesale framework rewrite. Keep PySide6 and the current declarative catalog. Introduce small domain-level operation records and a reusable Qt process controller, then migrate one workflow at a time. UI builders should consume typed readiness and operation results rather than parse child-process bytes. The first change in this direction is to ensure GUI import paths do not import transport-specific worker dependencies and that discovery always consumes terminal output.

Reliability, testing, and release audit

The existing CI/release pipeline is a substantial strength. Its gap is placement: tagged releases build the frozen app, but ordinary pull requests only test source. Add a scheduled or opt-in release-smoke workflow that builds one native frozen artifact and verifies the internal CLI, worker, GUI smoke path, bundle metadata, license inventory, and SBOM. Keep both full architecture builds for releases.

The highest-value test additions are deterministic process-lifecycle tests: a process that writes valid discovery JSON and exits before readiness delivery; non-zero process errors with stderr only available at exit; cancellation while an operation is active; and clean relaunch without inheriting stale state. A physical-device matrix should remain opt-in, explicitly labeled, and never required to merge a change.

Security, privacy, and distribution audit

The app’s local-first posture is credible: no analytics, no cloud account, and support bundles are reviewed for data minimization. Improve it by surfacing a privacy inventory in the UI, documenting retention paths by workflow, and requiring review before any future export/upload integration. Do not collect telemetry by default.

Distribution remains the largest trust hurdle. A Developer ID certificate and notarization are unavailable without an Apple Developer Program membership, so the correct present posture is transparent ad-hoc signing, dual architecture artifacts, checksums, SBOMs, provenance, source reproducibility, and precise Gatekeeper instructions. Do not imply that ad-hoc signing makes the app generally trusted. When a signing identity becomes available, add notarized Developer ID releases and an automated post-notarization assessment step.

Ecosystem map and integration strategy

Project/tool What it offers Recommendation
pymobiledevice3 Core cross-platform protocol library/CLI: discovery, tunnels, DDI/DVT, logs, PCAP, backups, apps, Web Inspector. Primary dependency. Upgrade deliberately, keep live-help drift checks, and contribute minimal reproducible protocol or CLI fixes upstream.
Xcode devicectl, simctl, xctrace, rvictl Apple-supported macOS device, simulator, trace, and RVI tooling. Prefer for macOS-native actions; show exact preconditions and hand off rather than reimplementing Xcode.
libimobiledevice Mature cross-platform device library/CLIs for backup, syslog, crash reports, screenshot, pairing, and image mounting. Optional external adapter only. It overlaps with the current core and adds LGPL/GPL packaging complexity.
go-ios Cross-platform static CLI/library, JSON output, app/UI test and accessibility tooling, optional REST API. Learn from its JSON and device-lab design. Evaluate a user-configured adapter after a stable operation framework; do not bundle a second protocol stack now.
Facebook idb Simulator/device automation via a macOS companion and remote client. Do not embed. Offer documented interoperability for teams already using it; its private-framework and companion model is a separate product surface.
MVT Consented mobile-forensics analysis of iOS backups and IOC checking with its own forensic scope/license. Add a guided handoff/export later, not an embedded scanner. Do not make “clean” claims or weaken its warning model.
blacktop/ipsw Firmware/OTA research, device database, kernel/dyld analysis. Document as an external firmware-research companion. Do not turn this GUI into an IPSW reverse-engineering suite.

Upstream contribution candidates are concrete: report the fast-exit scanner packaging behavior as a Qt application lifecycle pattern if it reproduces outside this project; test the current pymobiledevice3 upgrade against the toolkit command catalog; and offer redacted iOS/macOS compatibility findings to its issue tracker when a command/service regression is isolated.

Competitive positioning

Need Toolkit position Better companion Product response
Developer readiness Strong guided DDI/RSD/DVT visibility Xcode Device Hub Make connection and prerequisites dependable first.
Raw protocol coverage Strong through pymobiledevice3 pymobiledevice3, go-ios, libimobiledevice Do not duplicate every CLI command; curate and expose evidence.
Simulator/device automation at scale Limited idb, Xcode, Appium/WDA ecosystems Add safe handoffs, not a competing farm.
Backup forensics Bounded acquisition/evidence support MVT Build consented MVT handoff with limitations, not a compromise verdict.
Firmware research Minimal ipsw Offer links/recipes and artifact provenance only.
Network capture Strong macOS RVI workflow rvictl + tcpdump/Wireshark Continue to clarify encrypted-payload and whole-stack limits.

Prioritized roadmap

P0 — make the existing product dependable

  • Remove eager transport imports from desktop startup; load backup transport only in the backup worker.
  • Drain final QProcess output for device discovery and add a deterministic fast-exit test.
  • Keep the pinned pymobiledevice3 runtime current through isolated upgrade checks, full tests, GUI smoke testing, and command-catalog live-help validation. The audit implementation validates and pins 11.15.1.
  • Add a connection diagnostic record that reports whether discovery failed to launch, returned malformed data, returned zero devices, or returned a selectable device. The audit implementation now provides this record in Device & DDI and the sanitized support bundle without raw discovery output or device identity.

P1 — turn diagnostics into a coherent workbench

  • Maintain typed subprocess lifecycles and OperationResult across the workbench. Device discovery, Man Pages, sequential command drift, DDI/developer-image actions, Installed Apps inventory/uninstall, and IPA inspection/install use the finite-operation controller. Command Center uses a typed interactive controller that retains explicit Stop controls without an arbitrary runtime limit. Backup preserves private stdin requests and validated progress events without an arbitrary completion timeout. Evidence Capture reassembles validated JSON-line events and reserves a graceful finalization window for partial artifacts, coverage, manifests, and hashes. Long-running live-log streams retain their purpose-built lifecycle and explicit Stop controls.
  • Make a contextual readiness pane for the selected action, with one-click scoped rechecks and copyable remediation.
  • Maintain the opt-in physical-device compatibility protocol and its explicit USB, usbmux, CoreDevice, developer-service, privacy, and state-changing test boundaries. A pre-release dual-architecture frozen-artifact smoke workflow is now present. The release builder rejects any bundled Mach-O whose minimum macOS version is newer than the advertised 13.0 floor or lacks the native release architecture.
  • Generate concise changelog/release notes from tested behavior. Source, bundle, citation, packaging, and third-party-source metadata drift is now covered by automated tests.
  • Maintain bounded Xcode project/device handoffs: selected-device devicectl details, RVI status, and native .xcresult/Instruments trace opening without parsing or reimplementing Apple's formats.

P2 — deepen expert workflows without scope creep

  • Maintain the session-local typed-operation journal, explicit structured JSON manifests, and universal Action Palette that exposes only eligible operations.
  • Maintain the guided MVT backup-analysis handoff with explicit consent, no password persistence, output isolation, and no “clean device” conclusion.
  • Maintain optional user-configured adapters for go-ios, idb, and ipsw, each with executable provenance, version/build display, bounded read-only probes, and an explicit independent-target boundary.
  • Maintain the focused documentation site split into quick start, architecture, safety, troubleshooting, release verification, contributor, physical-device testing, and product-audit paths.

P3 — ecosystem growth and scale

  • Maintain the opt-in sanitized compatibility export with an exact local preview, owner-only JSON and Markdown files, host/toolchain context, tested device family and build metadata, and no automatic upload.
  • Maintain local team/workspace profile import-export with a strict versioned schema, exact preview, owner-only export, active-operation guard, and no targets, paths, credentials, coordinates, parameters, case text, or output.
  • Blocked externally: notarized Developer ID distribution requires an eligible Apple Developer signing identity, which is not available for this project. The existing release remains explicitly ad-hoc signed and unnotarized.
  • Deferred by design: no device-lab service or account is in project scope. Add a provider-specific, optional adapter only after a concrete service, authentication model, data boundary, target-selection contract, and test environment are selected; do not add a speculative cloud abstraction.

Do not build

  • Jailbreak, passcode bypass, root filesystem acquisition, code-signing circumvention, or credential/profile theft features.
  • A permanent or stealth location-changing service. Location testing must remain explicit, visibly tracked, and clearable.
  • A general “run any destructive command” button or an automated recovery/restore/erase path.
  • An embedded MVT-like compromise verdict or claims that lack of findings proves a device is safe.
  • A cloud telemetry/sync system for device identifiers, logs, captures, backups, or case records.
  • A second bundled iOS protocol stack merely for feature-count parity.

Audit implementation status

The original single best next build—reliable startup and lossless device discovery—is complete. Backup protocol parsing is isolated from desktop startup, terminal discovery output is drained before evaluation, deterministic fast-exit tests exist, the connection diagnostic exposes failure layers without raw identity, and the project pins the validated pymobiledevice3 11.15.1 runtime.

The repository-side P0, P1, P2, compatibility-export, and local workspace-profile work is implemented on the audit branch and recorded below. The remaining P3 items are intentionally not represented as unfinished local code: notarization is blocked by the absent signing identity, and device-lab integration is deferred until a specific optional provider and data contract exist. CI and native frozen-artifact checks remain the acceptance authority for each pushed revision.

Continuous improvement log

Date Improvement Verification Follow-up boundary
2026-09-21 Moved backup transport imports out of desktop startup; fixed terminal output draining for usbmux discovery; added privacy-safe connection diagnostics. 75 tests, headless GUI smoke, source launcher verification, and deterministic QProcess tests passed. Real-device discovery remains separately opt-in and time-specific.
2026-09-21 Upgraded the pinned pymobiledevice3 runtime to 11.15.1 and reconciled source, bundle, citation, packaging, and third-party source metadata. CLI version reports 11.15.1; 94 tests and all 49 catalog live-help routes passed locally. The next packaged artifact must be built by CI before distribution.
2026-09-21 Added a dual-architecture frozen-artifact smoke workflow, CI command-catalog verification, and a native Mach-O minimum-version gate. A clean local build passed its full 77-test suite and produced a signed arm64 app; the host's Homebrew Python targets macOS 26, so the new 13.0 gate correctly stopped that incompatible local artifact before ZIP creation. GitHub Actions runs with MACOSX_DEPLOYMENT_TARGET=13.0; its first Apple Silicon and Intel runs remain required before distribution.
2026-09-21 Added a reusable typed finite-process controller and migrated device discovery to it. Real child-process tests cover terminal stdout/stderr, fast completion, launch failure, cancellation, timeout, and one-result semantics; the full suite now contains 81 tests. Migrate other finite QProcess workflows incrementally; long-running streams retain their separate lifecycle.
2026-09-21 Made live-help drift checks accept successful help emitted on either standard output or standard error. A clean GitHub runner exposed two false option mismatches while the same pinned CLI passed locally; the channel-specific regression test now preserves strict option matching without assuming a help stream. Re-run CI on a clean runner and retain failure for genuinely absent routes or options.
2026-09-21 Added an opt-in physical-device protocol with staged read-only, developer-service, and state-changing checks. The current host check found no Apple mobile USB device, no usbmux device, and no CoreDevice result, so no physical compatibility claim was made. Run the protocol with an authorized connected device and retain identifiers and raw evidence locally.
2026-09-21 Added contextual readiness for every guided command and corrected support-bundle capability aggregation. Command-specific tests cover untested, ready, not-applicable, and attention states; the GUI smoke verifies the new control by stable object ID. Readiness remains a point-in-time local probe and never substitutes for an actual command result.
2026-09-21 Migrated Man Pages live help to the shared finite-operation controller and normalized styled CLI help for command-drift checks. The GUI smoke now completes a real live-help request; controller relaunch tests reject stale output, and ANSI-split option tokens remain strictly verifiable. Sequential command drift and other finite workflows remain incremental migrations.
2026-09-21 Corrected the macOS compatibility gate and bounded native-build timing. The first clean dual-architecture run proved arm64 produced a macOS 11-compatible executable, which is compatible with the advertised macOS 13 floor; Intel exceeded the original 45-minute job limit. Re-run both native builders with reusable Nuitka caches and a 90-minute cap before merging.
2026-09-21 Expanded compatibility validation from the launcher to every bundled Mach-O and pinned a genuinely compatible Qt line. PySide6 6.11.2 wheel filenames advertise macOS 13, but direct otool inspection found Shiboken load commands requiring macOS 15; PySide6 6.9.3 Shiboken binaries declare macOS 12. The dual-native CI build must pass the full-bundle architecture and deployment-floor scan before release.
2026-09-21 Migrated sequential command-drift probes to the shared finite-operation controller. A clean Python 3.13 environment passed the 94-test suite and the GUI smoke now runs the entire 49-route drift check through the real asynchronous UI path. DDI, backup, app, and capture operations remain incremental controller migrations.
2026-09-22 Migrated DDI and Developer Mode actions to the shared finite-operation controller. The 95-test suite and 90-action GUI smoke passed; the smoke test now executes a real bounded host-only command through the migrated path. Backup, app, and capture operations remain incremental controller migrations.
2026-09-22 Migrated Installed Apps inventory and uninstall operations to the shared finite-operation controller. The 95-test suite and 90-action GUI smoke passed; the smoke test now renders a synthetic inventory through the migrated asynchronous result path. Backup, IPA inspection/install, and capture operations remain incremental controller migrations.
2026-09-22 Migrated local IPA inspection and device installation to the shared finite-operation controller with explicit five- and 15-minute limits. The 95-test suite and 90-action GUI smoke passed; the smoke test now validates typed inspection metadata, streamed installation output, and structured completion. Backup and evidence capture retain specialized worker lifecycles pending deliberate migration.
2026-09-22 Replaced the Backup workspace's blocking, hand-buffered process path with a password-safe typed controller. 98 tests and the 90-action GUI smoke passed; real child-process tests cover stdin-only credentials, validated streamed events, malformed-protocol termination, and one-result cancellation. Evidence capture still needs a lifecycle designed around partial-artifact finalization rather than a generic finite command.
2026-09-22 Added a typed Evidence Capture controller and close-safe graceful finalization. 102 tests and the 90-action GUI smoke passed; real child-process tests cover fragmented JSON events, final-drain parsing, cancellation through case-finished, malformed-protocol finalization, and forced stop after the finalization deadline. Physical-device collection remains opt-in; review each case manifest and hash inventory before relying on it.
2026-09-22 Added native Apple developer-tool handoffs for selected-device CoreDevice details, RVI status, Xcode projects, test results, and Instruments traces. 106 tests and a 94-action GUI smoke passed; tests validate the exact selected-device and RVI commands and reject missing or unrelated local targets. The toolkit displays native output and opens native formats; it does not claim a stable schema for human devicectl output or reimplement Xcode.
2026-09-22 Migrated Command Center guided, advanced, finite, and streaming commands to a typed interactive-process lifecycle. 109 tests and the 94-action GUI smoke passed; real child-process tests cover final stdout/stderr draining, launch failure, idempotent cancellation, and no arbitrary runtime limit. Command output remains session-local unless the user explicitly preserves it through a task-specific evidence workflow.
2026-09-22 Added a session-local operation journal and explicit per-operation JSON manifests across the primary typed workflows. 113 tests and a 95-action GUI smoke passed; tests cover immutable bounded history, exact argument retention, output hashing without raw-output embedding, owner-only export, and overwrite refusal. Capability Matrix, Location Lab, Live Logs, and Command Drift retain their stronger workflow-specific records rather than duplicating raw or high-volume events into this journal.
2026-09-22 Added a keyboard-first Action Palette computed from current device and process eligibility. 116 tests and a 96-action GUI smoke passed; smoke coverage verifies disconnected-state preset filtering, host-preset access, search behavior, stable control identity, and the ⌘ K shortcut. Guided presets are selected for review rather than executed, and eligibility is checked again at activation.
2026-09-22 Added a guided external MVT handoff for consented decrypted-backup analysis. 121 tests and a 110-action GUI smoke passed; tests cover executable provenance, secret-environment removal, backup structure/encryption checks, isolated output, explicit IOC arguments, offline defaults, version validation, and an end-to-end synthetic analysis process. MVT stays separately installed; the toolkit accepts no password and never translates completion or absent findings into a clean-device verdict.
2026-09-22 Added separately installed go-ios, idb Companion, and ipsw adapters with provenance validation. 126 tests and a 134-action GUI smoke passed; tests cover catalog identity, discovery, executable hashing, changed-binary rejection, upstream version/build formats, secret and target-routing removal, and a synthetic validate/probe lifecycle. These tools keep their own discovery, pairing, tunnel, target, network, licensing, and support models; only bounded inventory probes are exposed.
2026-09-22 Added a focused Material for MkDocs documentation site and pull-request/push workflow. mkdocs build --strict --clean passes locally; the site routes beginners, developers, investigators, release verifiers, and contributors to canonical repository material without copying the complete README. GitHub Pages publication occurs only after a documentation change reaches main; the site-build dependency is not part of the application bundle.
2026-09-22 Added previewed, sanitized JSON and Markdown export for real-device compatibility observations. The 129-test suite and 136-action GUI smoke passed; focused tests cover removal of device identity and stored fingerprints, common path/email redaction, owner-only files, overwrite refusal, empty-history rejection, and both report formats. Exports remain manual and local; model/build/connection metadata can still identify a small fleet, so the exact payload is previewed before saving and never uploaded.
2026-09-22 Added local team/workspace profile import and export for reviewed non-sensitive control defaults. The 133-test suite and 138-action GUI smoke passed; tests cover strict parsing, known workspaces and presets, bounds, forward-compatible extra fields, owner-only files, overwrite refusal, size limits, round trips, and synthetic GUI application. Profiles never contain targets, paths, credentials, coordinates, command parameters, case text, or output; import changes controls only and is blocked while operations are active.

Research sources