Authorized Artifact Evidence Workflow
Mission Control can import an authorized package artifact through the local helper. The artifact is copied into the Core quarantine, hashed, and inspected without installation or execution.
Operator flow
- Open a research case in Mission Control and enter the research action token.
- Open Local artifact evidence.
- Select a
.nupkg,.zip,.vsix,.gem, or.whlthat you are authorized to analyze. - Confirm the ecosystem, package name, and version. Select Import Authorized Artifact.
- Confirm the SHA-256 and quarantine state. Select Inspect safely.
- Review archive members, lifecycle files, public URLs, external IP candidates, hashes, and limitations.
- Select Extract IOC Candidates. Every candidate remains pending until reviewed.
- Approve only indicators that are supported by the evidence. Generic registry and vendor URLs are suppressed.
- Use the comparison action for exact local artifacts or compare a local artifact with a registry intake.
- Record registry availability separately from the case status. A removed package is not automatically malicious, and an unavailable package is not proof that it was removed.
Raw bytes remain in local, owner-only quarantine. They are not sent to Supabase, Render, Cloudflare, or an AI provider. Dynamic analysis remains a separate, approval-gated workflow.
CLI recovery path
The same operations are available to a local operator when the browser helper is unavailable:
secopsai research artifact list
secopsai research artifact import --path ./package.nupkg --ecosystem nuget --package Example --version 1.0.0
secopsai research artifact show ART-...
secopsai research artifact verify ART-...
secopsai research analysis run ART-...
secopsai research analysis compare ART-LEFT ART-RIGHT
secopsai research ioc-candidates extract RSC-...
secopsai research ioc-candidates review IOC-C-... --decision approved
secopsai research subject state SUB-... --registry-state removed --reason "Official flat-container returned 404 after prior availability"
secopsai research partner-request create RSC-... --recipient [email protected] --reason "Request exact archived artifact and provenance"
The Core CLI does not accept arbitrary shell commands for analysis. An optional NuGet analyzer is configured only as a pinned Docker image and is run with no network, read-only filesystem, dropped capabilities, and bounded resources.