# specter — Changelog

## v1.0.3 — 2026-06-22

- Add `--output jfind` to three finding-producing subcommands:
  - `specter hash <PATH>` — one `jfind/v1` asset-inventory finding
    per file. Specter is the only tool in the suite that populates
    the `Evidence.ssdeep` field (the jfind schema reserves it
    specifically for specter's fuzzy hash); sha256 also lands in
    `Evidence.sha256`. The full digest set (md5 / sha1 / sha256 /
    sha512 / ssdeep) is preserved in the finding's `raw` blob.
  - `specter scan <PATH>` — one `jfind/v1` finding per YARA hit.
    Per-hit `Evidence` records use
    `kind="specter-scan:<rule_id>"` with the file offset encoded in
    the `path` (`<file>@offset=<N>`). Category mapping:
    HIGH-severity malware / EICAR → `ict-incident`; IOC / C2 /
    exfil rules → `data-exposure`; other HIGH/CRITICAL → `vulnerability`;
    LOW/MEDIUM → `endpoint-anomaly`. MITRE attribution:
    T1027 (Obfuscated Files) for malware, T1071 (Application Layer
    Protocol) for IOC/C2.
  - `specter analyze <PATH>` — emits a rollup finding for the
    pipeline verdict + one per scanner hit + one per tamper signal.
    Rollup severity: CLEAN→Info, SUSPICIOUS/TAMPERED→Medium,
    MALICIOUS→Critical. Confidence from the pipeline's 0-100
    confidence: `<40`→Low, `<75`→Medium, `≥75`→High. Tamper findings
    carry MITRE TA0005 / T1070 (Indicator Removal).
- New `Format::Jfind` variant on the shared `Format` enum. The
  other subcommands (meta / binary / carve / timeline / strings /
  geo / diff / triage / cluster / batch / db / rules / evidence /
  report) still use the legacy value parsers and don't accept
  `--output jfind` yet — opt them in incrementally.
- New `ScanArgs` type (split from `PathOutputArgs`) so the
  `--output` value parser only advertises `jfind` on subcommands
  that actually emit it.
- 10 new unit tests in `jfind_emit.rs` covering severity mapping,
  per-rule category routing (malware → ict-incident, IOC →
  data-exposure, low → endpoint-anomaly), per-hit Evidence shape,
  truncation handling, confidence buckets, and round-trip through
  `jfind::types::Finding`.
- New deps: `jfind = { path = "../../jfind/rust" }`,
  `uuid = { version = "1", features = ["v4"] }`.
- Existing integration test bumped: `missing_subcommand_exits_2`
  (was `missing_subcommand_exits_3`) to match SUITE_STANDARDS.md §1.

## v1.0.2 — 2026-06-22

- Standardise exit codes per SUITE_STANDARDS.md §1 — missing-subcommand now exits 2 (was 3). Dispatch runtime failures now exit 3 (was 2). Per-subcommand 'HIGH findings present' still returns 2 (TODO: revisit; standard reserves 1 for findings-present semantics).