What problem does it solve? Determining whether an open-source repository was compromised requires correlating evidence across git history, GitHub APIs, archived web pages, and immutable event logs, which is slow and error-prone when done manually. ## Core Features & Use Cases - 7-Phase Investigation Framework: Orchestrates up to 5 specialist sub-agents covering local git analysis, GitHub REST API, Wayback Machine, GH Archive/BigQuery, and IOC enrichment. - Evidence Store with Integrity Checks: A CLI tool records every finding with SHA-256 hashes, chain-of-custody logging, and verification states to prevent fabricated claims. - Hypothesis Validation & Reporting: Mechanically validates cited evidence IDs before accepting hypotheses and generates a structured forensic report with timeline, IOC list, and recommendations. - Use Case: After a maintainer account is suspected of being hijacked, run the framework to recover force-pushed commits, detect deleted PRs, and produce an evidence-backed compromise verdict. ## Quick Start Ask the agent to investigate the GitHub repository owner/repo for signs of supply-chain compromise and generate a forensic report.
