AUR Response Toolkit Architecture

AUR Response Toolkit Architecture An architecture diagram generated by Archify. Operator · Intent + scope · Architecture component Operator Intent + scope CLI parser · Commands + exit codes · Architecture component CLI parser Commands + exit codes Response engine · Scan + recovery gate · Read-only analysis boundary Response engine Scan + recovery gate System adapters · pacman + runtime IOCs · Read-only analysis boundary System adapters pacman + runtime IOCs Bounded inspection · Bounded SHA-256 reads · Read-only analysis boundary Bounded inspection Bounded SHA-256 reads Campaign corpus · Lists + IOC registry · Read-only analysis boundary Campaign corpus Lists + IOC registry Integrity verifier · Registry + list hashes · Read-only analysis boundary Integrity verifier Registry + list hashes Evidence output · JSON + state + exit · Architecture component Evidence output JSON + state + exit command + explicit scope Parsed + RunOptions collect host evidence untrusted observations corpus + SHA-256 verified campaign data bounded observations findings + counters + status Read-only analysis boundary Legend Frontend Backend Database Security External

Evidence before remediation

  • • Bounded readers treat package material as hostile
  • • Integrity checks authenticate bundled campaign inputs

Stable contracts

  • • CLI parsing owns command and flag behavior
  • • Reports preserve JSON, state, and exit-code semantics

Explicit recovery

  • • Destructive paths require operator-selected recovery commands
  • • The same engine owns scan, audit, recovery, and policy