public/Invoke-OctaMalwareScan.ps1

function Invoke-OctaMalwareScan {
    <#
        .SYNOPSIS
        Thin wrapper over Windows Defender's own scan engine (research.md) - triggers a real
        Start-MpScan and reports real Get-MpThreatDetection results. Implements no independent
        malware-detection logic of its own (spec.md FR-008).
    #>

    [CmdletBinding()]
    param(
        [switch]$Full
    )

    $status = Get-MpComputerStatus -ErrorAction SilentlyContinue
    if (-not $status -or -not $status.AMServiceEnabled) {
        return [pscustomobject]@{
            Status  = 'DefenderNotActive'
            Message = 'Windows Defender is not the active antivirus engine on this system - Octa only wraps its scan, it does not implement independent detection.'
        }
    }

    $scanType = if ($Full) { 'FullScan' } else { 'QuickScan' }
    try {
        Start-MpScan -ScanType $scanType -ErrorAction Stop
    }
    catch {
        return [pscustomobject]@{ Status = 'Error'; Message = $_.Exception.Message }
    }

    $detections = @(Get-MpThreatDetection -ErrorAction SilentlyContinue)

    return [pscustomobject]@{
        Status       = 'Success'
        ScanType     = $scanType
        ThreatsFound = $detections.Count
        Detections   = $detections
    }
}