Condition
A clean incident scan could still hide an incomplete search.
AUR supply-chain incidents leave traces in installed packages, ALPM timelines, build artifacts, persistence paths, and shell history. Responders needed one tool that could detect those traces offline, refresh its incident data when connected, and guide recovery without rushing it.
Silence was not enough. If a root was missed or a file could not be read, the report had to expose that gap instead of presenting an unearned clean result.
Cause
No finding, no access, and no coverage are different answers.
A scanner can find no compromise indicator in the evidence it inspected while missing evidence elsewhere. Collapsing those outcomes into one success status gives the operator confidence the scan did not earn.
The source data has its own trust problem. Incident lists change, but replacing a known local baseline with an unverified network response makes freshness more important than integrity.
Correction
Record the search boundary beside the evidence.
Bundled campaign lists keep offline scans useful. Online scans parse and cache updates atomically without discarding the trusted baseline, while an integrity manifest protects the IOC registry and bundled data.
Every report carries retrieval dates, source details, hashes, and coverage counters. Incomplete coverage returns its own status even when no indicator appears. Recovery begins with a dry run, requires explicit application, creates backups, and verifies the result afterward.
Confirm
Each investigation ends with an account of what was known.
Package, timeline, artifact, IOC, audit, and hardening checks produce readable text or structured JSON. The report preserves what the toolkit inspected, what it missed, which sources it trusted, and which recovery actions ran.
Native Rust tests cover command routing, exit policy, report schemas, compressed logs, list integrity, incomplete coverage, and recovery safeguards. Those tests protect the meaning of a clean result as the toolkit grows.