Logicytics v4.0.0

Major release

Logicytics v4.0.0 replaces the legacy script-oriented collector with a typed, run-oriented Windows evidence-collection framework.

Stats for #398

• 309 commits ahead of the merge base with main
• 224 files changed: 30,751 additions and 6,007 deletions
• 66 shipped, isolated core collectors
• 252 test cases across 29 test modules
• 22 dedicated documentation pages
• Requires Python 3.11+

Highlights

• Isolated per-collector workers with private workspaces, temporary directories, cancellation, retry, memory, artifact-count, and output-size limits.
• Deterministic planning and manifest-backed runs, with artifact provenance, SHA-256 integrity data, ZIP packages, and hash sidecars.
• Strict preflight: static validation, runtime metadata probing, capability enforcement, plugin quarantine, and integrity-keyed probe caching.
• Typed configuration via logicytics.yaml; legacy mode aliases remain supported.
• Five named collection modes: quick, balanced, standard, offline, and thorough.
• Opt-in plugin model: plugins must declare security metadata and pass the same validation boundary as core collectors.
• Expanded Windows evidence coverage across system, process, network, event logs, storage, registry, wireless, encryption, browser, media, USB, and diagnostics specialties.
• Safer execution controls for sensitive capabilities, elevation, USB/offline collection, package publication, reboot/shutdown, and update operations.
• Improved CLI lifecycle output, preflight progress, diagnostics, local usage history, temporary-workspace handling, and mode-agnostic performance checks.
• Complete operator, architecture, configuration, safety, output, troubleshooting, plugin-authoring, and verification documentation, plus wiki publishing automation.

Breaking changes and migration

• The legacy CODE/ implementation and MODS/ extension model are removed.
• Legacy vulnscan assets and collector are not part of v4.
• The canonical package is now logicytics/; run through python -m logicytics.
• Use logicytics.yaml as the single configuration source.
• Evidence is now owned by each manifest-backed run directory rather than global ACCESS/, RUNS/, LOGS/, or PACKAGES/ stores.
• Plugins are Python-only, opt-in PluginCollector modules under plugins/.
• Normal CLI commands require the managed virtual environment; the installer is the supported system-Python entry point.

Getting started

python -m logicytics.cli.installer
.\.venv\Scripts\Activate.ps1
python -m logicytics preflight
python -m logicytics plan --profile standard
python -m logicytics run --profile standard --acknowledge-authorization

What's Changed (PR's)

• Delete .github/workflows/stale.yml by @DefinetlyNotAI in #329

• Reset implementation for v4 architecture by @DefinetlyNotAI in #398

• [StepSecurity] Apply security best practices by @step-security-bot in #403

Full Changelog: v3.6.1...v4.0.0