@1aboveio/skills 0.20.1 → 0.20.3

package/skills/payment/similar-domain/references/fingerprints.md

@@ -0,0 +1,82 @@
+# Fingerprints
+
+What to record for each domain, and why each item identifies the people
+behind it rather than the industry it sits in. Record the value, the source
+you read it from, and the time. Categories are ordered by how much they
+usually pay off.
+
+## Page and tag fingerprints (strongest)
+
+These live inside the served HTML. They are set once by whoever configures
+the site and copied across every site that person manages.
+
+| Fingerprint | Why it identifies an operator |
+|---|---|
+| Analytics tokens (Cloudflare Web Analytics, Google Analytics / GTM container, Matomo, Yandex) | One account per operator; sharing it across brands is deliberate |
+| Ad and tracking pixels (Meta, TikTok, Snap, affiliate-network pixels) | Tied to a paying advertiser account |
+| Error-monitoring and session-replay keys (Sentry, Hotjar, Clarity, Smartlook) | Per-project keys from one engineering team |
+| Block-page or error-page template: HTML skeleton, CSS reset, odd literal values (a specific outline colour, a min-width), font stack | A shared codebase; brands change the logo and palette, not the skeleton |
+| Support-address pattern (`support@<brand>`) and the domain it points at | A mirror's support address names the parent brand |
+| Hard-coded partner hosts: CDN paths, API hosts, game or payment providers, chat widgets | Platform vendor and integration account |
+| Favicon and logo asset hashes | Reused assets across mirrors |
+| JavaScript bundle names and hashes | Same build pipeline |
+| Cookie names and consent-banner vendor IDs | Same front-end stack |
+
+Distinguish **operator-level** identifiers (analytics account, template)
+from **vendor-level** ones (a game provider, a chat widget). Vendor-level
+identifiers narrow the field but are shared across many unrelated
+operators.
+
+## Mail fingerprints (strong)
+
+| Fingerprint | Why |
+|---|---|
+| Exact SPF string, including the order of includes | The combination of mail vendors is chosen per operator; a byte-identical string across brands is rarely coincidence |
+| DKIM selectors | Per-sending-account |
+| MX target (Google, Microsoft 365, Zoho, self-hosted) | Splits clusters: an operator rarely runs two mail platforms |
+| Verification TXT records (Microsoft tenant ID, vendor verifications) | Tenant IDs identify one organisation; Google site-verification tokens are per-domain and do not pivot |
+| Mail-related subdomains from certificates (`mailer.`, `click.`, `email.updates.`) | Marketing-mail vendor and its account |
+
+## Registration fingerprints (medium to strong)
+
+| Fingerprint | Why |
+|---|---|
+| Registrar plus privacy-proxy service | Operators keep one registrar account per portfolio |
+| Creation and last-updated timestamps | Same-hour timestamps across domains mean one batch action |
+| Status-lock set (the exact combination of prohibited flags) | Set by registrar account defaults |
+| Registrant fields when not private (organisation, country, state) | Direct |
+| Expiry alignment | Renewed together |
+
+## DNS and hosting fingerprints (medium)
+
+| Fingerprint | Why |
+|---|---|
+| Nameserver pair | CDN providers assign pairs per account, but reuse pairs across many accounts; strong only combined with something else |
+| Hosting address and ASN when not behind a CDN | Direct, but shared hosting is common |
+| CNAME targets for `www`, `api`, `cdn`, `m` | Names the platform vendor and sometimes the tenant |
+| Subdomain naming from certificate transparency | Platform-specific patterns (`api.`, `cl.`, `evolutiongaming.`) and mirror schemes (`dd20--brand`) |
+| Wildcard certificate issuer and issuance cadence | Same automation |
+
+## Brand and naming fingerprints (candidate generators, not evidence)
+
+| Fingerprint | Use |
+|---|---|
+| Name stem and numbering scheme (`brand3`, `brand-9884`, `xx00--brand`) | Enumerate variants in step 3 |
+| Licence seal number and validator link | Pivot into the licence register in step 4 |
+| Legal entity, address, and licence text on the terms page | Entity pivot in step 4 |
+| Affiliate program name | Brand-list pivot in step 4 |
+| Sportsbook or casino platform named in the footer | Vendor-level filter |
+
+## Behaviour fingerprints (supporting)
+
+| Fingerprint | Use |
+|---|---|
+| Geo-block behaviour: which countries, what status code, challenge or branded page | Same edge configuration |
+| Redirect chain (`www` to apex, mirror to parent, country path) | Reveals the parent brand |
+| Response headers beyond the CDN defaults | Same origin stack |
+
+## Recording rule
+
+Every fingerprint row carries: domain, category, value, source (page,
+DNS, certificate log, WHOIS, archive, review site), and observed-at time.
+A fingerprint without a source cannot be re-checked and cannot be scored.

package/skills/payment/similar-domain/references/pivots.md

@@ -0,0 +1,66 @@
+# Pivots
+
+A pivot turns a fingerprint into the question "which other domains have
+this value?" and sends it to a source class that can answer. This file
+says which source class fits which fingerprint, what a hit means, and where
+the false positives come from. It does not prescribe tools or commands.
+
+## Source classes
+
+| Source class | Answers | Examples of the class |
+|---|---|---|
+| Page-source index | Which pages contain this string (token, CSS literal, hostname) | Code-search engines for HTML, URL scanners with body search, internet-scan datasets with HTTP bodies |
+| Passive DNS | Which domains have or had this nameserver, MX, TXT, CNAME, or address | Commercial passive-DNS services, historical DNS archives |
+| Certificate transparency | Which names appear on certificates, and when | Public CT log search |
+| Reverse WHOIS | Which domains share registrant fields, registrar, or timestamps | Reverse-WHOIS services, registrar-side history |
+| Web archive | What the site served before it was blocked or rebranded | Public web archives, cached copies |
+| Review aggregators | Operator, licence, launch year, affiliate program, complaints | Casino / merchant review directories, complaint forums |
+| Licence register | Every domain licensed under one number or entity | Regulator's public register |
+| Affiliate directory | Every brand an affiliate program pays for | Affiliate-program brand lists, affiliate forums |
+| Ordinary web search | Brand reviews, news, forum threads | General search — note it does not index page source |
+
+## Fingerprint to pivot map
+
+| Fingerprint | Pivot to | Hit means | Trap |
+|---|---|---|---|
+| Analytics or pixel token | Page-source index | Same account configured both sites | A token can be scraped and pasted by an affiliate site; check the hit is the brand's own domain, not a review page |
+| Block-page template literal | Page-source index | Same codebase | Framework defaults produce the same reset; pick a literal that is not in any public template |
+| Support-address pattern | Page-source index, web search | Mirror names its parent | None significant |
+| Exact SPF string | Passive DNS | Same mail-vendor set | Single common includes (a lone Google or Microsoft include) match millions of domains; pivot on the full string |
+| Microsoft tenant or vendor verification TXT | Passive DNS | Same organisation tenant | Google site-verification tokens are per domain; they do not pivot |
+| Nameserver pair | Passive DNS | Same CDN account, probably | CDN pairs are reused across accounts; always require a second fingerprint |
+| Hosting address / ASN | Passive DNS, internet-scan dataset | Same origin | Shared hosting; CDN fronting hides the origin entirely |
+| CNAME target | Passive DNS | Same platform tenant | Vendor-level unless the target embeds a tenant name |
+| Subdomain naming scheme | Certificate transparency | Same platform or mirror generator | Scheme may belong to the platform vendor, shared by its unrelated tenants |
+| Registrar + proxy + timestamp | Reverse WHOIS | Same registration batch | Popular registrar-proxy combinations are common; timestamps within minutes are the real signal |
+| Brand name stem | Certificate transparency, web search | Candidate mirror | A name match is a candidate only; confirm with a fingerprint |
+| Licence number | Licence register | Every domain under the licence | Registers lag; a delisted domain is history, not a false link |
+| Legal entity or address | Web search, page-source index (terms pages) | Same operator on paper | Corporate-service addresses are shared by hundreds of unrelated companies |
+| Affiliate program | Affiliate directory | Same marketing arm | Some programs serve several operators |
+
+## Running a pivot
+
+1. State the fingerprint, the source class, and the exact query.
+2. Record the hit count, even if zero. Zero from a source that cannot see
+   the fingerprint (web search for a token) is "not observable", not
+   "absent".
+3. For each hit, note which fingerprint produced it. A domain reached by
+   two independent pivots is already close to Confirmed.
+4. Filter high-noise pivots (nameserver pair, registrar, single mail
+   include) by intersecting with the set of hits from a strong pivot before
+   any of them becomes a candidate.
+5. Prefer pivots whose hit count is small. A pivot returning thousands of
+   domains is not evidence until narrowed.
+
+## Blocked-site pivots
+
+When the live site is unreachable:
+
+- Pivot on the block page itself (template, token, support address).
+- Use certificate history for subdomains and mirror schemes.
+- Use web archives for the pre-block or pre-rebrand HTML, which usually
+  still carries the same tokens.
+- Use mirrors that are reachable from the analyst's location; they share
+  the parent's fingerprints by design.
+- Use review aggregators for the entity chain; they visited the site from
+  an allowed location.

package/skills/payment/similar-domain/references/report-template.md

@@ -0,0 +1,76 @@
+# Report template
+
+Save:
+
+```text
+reports/similar-domain/<seed>_cluster.md
+```
+
+Use the first seed's registrable domain as `<seed>`; for multiple seeds
+use a short scope name the user recognises. No Markdown bold in the report
+body. After writing, grep banned strings in
+[terminology.md](terminology.md).
+
+```markdown
+# Domain cluster — <seed or scope>
+
+## Verdict
+## Cluster
+## Evidence matrix
+## Entity chain
+## Outliers
+## Coverage and caveats
+## Pivot log
+## Sources
+```
+
+## Chapter requirements
+
+### Verdict
+
+At most three sentences: which domains form a cluster, what the strongest
+evidence is, and which seeds do not belong. No new evidence here.
+
+### Cluster
+
+One row per domain, sorted Confirmed → Probable → Possible. Columns: domain,
+brand, role (parent, mirror, acquired brand), label, registered date,
+current operator (if known), strongest two links. Seeds that are Unrelated
+go in Outliers, not here.
+
+### Evidence matrix
+
+Domains as rows, fingerprints as columns, cell shows the shared value or a
+short marker. Include at least: analytics account, template, mail string
+or platform, nameserver pair, registrar and proxy, registration timestamp,
+licence or entity. This table is what lets a reader check the labels
+without rerunning the work.
+
+### Entity chain
+
+The operator history with dates: entities, licences, migrations, brand
+acquisitions. Present conflicting operator names as a dated sequence. Cite
+the page for each fact.
+
+### Outliers
+
+Every seed or candidate that was checked and rejected, with the
+fingerprints that differ. "Different brand" is not a reason; "different
+analytics account, different mail platform, different CDN account" is.
+
+### Coverage and caveats
+
+What could not be observed and why: geo-blocks, bot challenges, private
+registration, resolver artefacts, pivots not run for budget reasons,
+source classes not available. State whether the cluster is closed (a full
+pass added nothing) or open.
+
+### Pivot log
+
+One row per pivot: fingerprint, source class, query, hit count, domains
+kept. Empty pivots stay in the log; they are what makes a negative result
+credible.
+
+### Sources
+
+Every external page cited, as links.

package/skills/payment/similar-domain/references/scoring.md

@@ -0,0 +1,61 @@
+# Scoring
+
+Weight each link by how hard it is to share by accident, count independent
+signals, and label every domain.
+
+## Link strength
+
+| Signal | Strength | Reason |
+|---|---|---|
+| Same analytics, tag-manager, pixel, or error-monitoring account ID | Very strong | One paying account, one admin |
+| Same custom page template with non-default literals | Very strong | Shared codebase |
+| Mirror serves the parent's support address or redirects to it | Very strong | Self-declared |
+| Byte-identical SPF string with three or more vendor includes | Strong | Chosen combination of vendors |
+| Same organisation tenant ID in TXT records | Strong | One tenant |
+| Same registrar + proxy + timestamps within an hour | Strong | One batch action |
+| Licence register lists both domains under one licence | Strong | Authoritative, but lags reality |
+| Same registrar + proxy + identical lock set, days apart | Medium | Same account defaults |
+| Same CDN nameserver pair | Medium | Per account, but pairs are reused |
+| Same origin address or ASN outside a CDN | Medium | Shared hosting is common |
+| Same platform vendor, CNAME target, or subdomain scheme | Weak | Vendor-level |
+| Same affiliate program | Weak to medium | Some programs serve several operators |
+| Same game providers, bonus wording, licence authority | Weak | Industry-wide |
+| Similar brand name | Candidate only | Names are cheap |
+
+## Independence
+
+Two signals count as independent only if a different party controls
+each. Examples that count once, not twice: analytics token and block-page
+template (same front-end deployment); nameserver pair and CDN analytics
+token (same CDN account); registrar and proxy service (same registrar
+account). Examples that count separately: analytics token and SPF string;
+registration batch and page template; licence register and mail tenant.
+
+## Labels
+
+| Label | Rule |
+|---|---|
+| Confirmed | Two independent strong-or-better signals, or one very strong signal plus any medium one |
+| Probable | One strong or very strong signal, or two independent medium signals, or authoritative register listing without technical confirmation yet |
+| Possible | One medium signal, or vendor-level signals only, or a name-scheme candidate |
+| Unrelated | Checked, and the operator-level fingerprints differ (different analytics accounts, different template, different mail platform, different registrar behaviour) |
+
+Only Confirmed and Probable enter the loop as new seeds. Possible domains
+are parked with the one fingerprint that would promote them, so a later
+pass can pick them up.
+
+## Negative evidence
+
+A domain can share medium signals and still be Unrelated. Different mail
+platforms, different CDN accounts, different analytics accounts, and a
+registration years apart together outweigh a shared nameserver pair or
+shared licence authority. Say so explicitly in the outliers section
+rather than leaving the domain unlabelled.
+
+## Conflicts
+
+When technical evidence and corporate evidence disagree, report both and
+date them. Continuous technical evidence across a corporate break usually
+means an entity swap on one platform; continuous corporate evidence across
+a technical break usually means a platform migration. Neither breaks the
+cluster; both belong in the entity chain.

package/skills/payment/similar-domain/references/terminology.md

@@ -0,0 +1,37 @@
+# Terminology
+
+| Term | Meaning in this skill |
+|---|---|
+| Seed | A domain the user supplied or a Confirmed/Probable domain fed back into the loop |
+| Fingerprint | Any identifier on a domain that is not the brand name and can be shared across domains |
+| Pivot | A reverse query: "which other domains carry this fingerprint?" |
+| Candidate | A domain returned by a pivot or a name scheme, not yet scored |
+| Cluster | The set of Confirmed and Probable domains linked by operator-level fingerprints |
+| Operator-level | A fingerprint tied to one paying account or one codebase (analytics ID, template, mail tenant) |
+| Vendor-level | A fingerprint tied to a platform many operators use (game provider, CDN, chat widget) |
+| Mirror | A domain serving or redirecting to a parent brand to evade blocking, usually numbered or hyphenated |
+| Entity chain | The dated sequence of legal operators, licences, and migrations behind a brand |
+| Closed cluster | A full loop pass added no domain |
+| Open cluster | Expansion stopped for budget or access reasons; unexplored pivots are listed |
+
+## Language
+
+- Say "linked", "shares", "same account", "same template" for technical
+  evidence. Say "operated by", "licensed to" only with a cited entity
+  source.
+- Say "not observable" when a source class cannot see the fingerprint;
+  say "absent" only when a source that can see it returned nothing.
+- Say "Unrelated on current evidence" rather than "unrelated"; the
+  negative is bounded by the pivots run.
+- Name the source class, not a product, when describing what was queried,
+  unless the user asked for the tool.
+
+## Banned strings in the report body
+
+- "owned by" or "same company" without an entity citation in the same
+  paragraph
+- "confirmed" applied to ownership (Confirmed is a label for a link, not a
+  legal finding)
+- "definitely", "certainly", "no doubt"
+- "unrelated" without "on current evidence" or an outliers row
+- Any fingerprint value presented without a source

package/skills/payment/similar-domain/references/workflow.md

@@ -0,0 +1,79 @@
+# Workflow detail
+
+SKILL.md is the index. This file is the procedure those steps run.
+
+## Input
+
+One or more **seed domains** (bare domain or URL) and the question behind
+them. Typical questions:
+
+| Question | What the cluster must answer |
+|---|---|
+| "Are these domains related?" | Which seeds share an operator, and on what evidence |
+| "Who is behind this site?" | Entity chain with dates and licence |
+| "Find the mirrors / sister sites" | Every domain the same operator runs, labelled by confidence |
+| "Merchant background check" | Cluster plus history: licence changes, operator migrations, complaints |
+
+Optional context that changes the work: a transaction file whose descriptor
+URL is the seed, a date range, a jurisdiction of interest, or a list of
+domains the user already believes are related (treat that list as
+hypotheses, not facts).
+
+## Access limits
+
+Expect at least one of these on every gambling, adult, crypto, or
+high-risk-merchant seed:
+
+- **Geo-block page** (403 with a branded page) — the page itself is a
+  fingerprint: template, analytics token, support address, favicon.
+- **Bot challenge** (Cloudflare "Just a moment") — nothing behind it is
+  visible; use subdomains, certificate history, archives, and mirrors
+  instead.
+- **Private registration** — the proxy service, registrar, dates, and lock
+  set are still visible and still cluster.
+- **Local resolver artefacts** — a VPN or proxy on the analyst machine can
+  return fake addresses (for example the 198.18.0.0/15 range). Do not use
+  those as hosting fingerprints; use nameservers, certificates, and
+  third-party passive DNS instead.
+
+Record each limit in the report's coverage caveats.
+
+## Order that must not move
+
+Fingerprint → pivot → expand names → entity → score → loop → report.
+
+Fingerprint the seed completely before running any pivot. Pivots run on
+fingerprints, not on brand names; the name scheme (step 3) is a candidate
+generator that must be confirmed by a fingerprint. Entity research (step 4)
+names and dates the cluster but never adds a domain that has no technical
+link unless a licence register or the operator's own terms page lists it
+explicitly. Scoring (step 5) happens before a domain enters the loop, so the
+loop never expands on a Possible.
+
+## Loop discipline
+
+Each pass:
+
+1. Take every domain labelled Confirmed or Probable that has not yet been
+   fingerprinted.
+2. Fingerprint it fully (step 1).
+3. Pivot on any fingerprint not already pivoted (step 2). Skip pivots whose
+   result is already known from an earlier pass.
+4. Score new candidates (step 5).
+
+Stop when a full pass adds no domain, or when the user's question is
+answered and the remaining candidates are mirrors of brands already in the
+cluster. State the stop reason in the report.
+
+Set a budget before starting: a cluster of a large offshore operator can
+run past a hundred domains. When the budget is hit, report the cluster as
+"open" and list the unexplored pivots.
+
+## What counts as done
+
+- Every seed has a label and a row in the evidence matrix.
+- Every non-seed member has at least one fingerprint link to a seed or to
+  another Confirmed member.
+- The entity chain explains the cluster's history where sources allow.
+- Outliers (seeds that did not join) are explained by absence of shared
+  fingerprints, not just by a different brand.

package/skills/payment/tld-detection/SKILL.md

@@ -1,11 +1,14 @@
 ---
 name: tld-detection
 description: >
-  Explicit-only. Potential TLD (transaction-laundering) clusters from
-  descriptor partitions, then exact currency-amount pairs, with same-descriptor
-  baseline contrasts, high/medium/low risk tiers, exposure sizing, and a
-  ≤3-sentence decision.
-  Not payment-analysis or fraud-analysis.
+  Explicit-only. Potential TLD (transaction-laundering) clusters from an
+  authorization extract: stream inference first (wallet currency, preset
+  menus, frozen-rate batches, retail constants per descriptor and BIN-country
+  group), then exact original-currency amount pairs plus a separate
+  BIN-country base-currency FX sensitivity when requested or indicated, with
+  same-stream or same-descriptor baseline contrasts, high/medium/low risk
+  tiers, exposure sizing, and a ≤3-sentence decision.
+  Not payment-analysis, fraud-analysis, or website research (similar-domain).
 disable-model-invocation: true
 ---
 
@@ -15,11 +18,23 @@ Find **potential TLD clusters** in an authorization extract. TLD here is
 transaction laundering, not a domain name: hidden activity stuffed under a
 normal MCC, often mixed across descriptors.
 
-First partition the cleaned authorizations by **descriptor**. Inside each
-descriptor, the clustering key is the **currency-amount-pair**. Geometric
-relationships between exact anchors are the stuffing signal (掺量). BIN
-country is not a membership key; report it in the cluster-versus-baseline
-comparison after membership is frozen.
+First partition the cleaned authorizations by **descriptor**, then infer the
+**streams** inside each descriptor: a billing name is not a merchant, and one
+descriptor can carry a casino cashier, a shop checkout and a generated batch
+at once. Inside each stream, the clustering key is the
+**currency-amount-pair**. Geometric relationships between exact anchors are
+the stuffing signal (掺量) for traffic priced in the processing currency;
+cashier menus converted live from a wallet currency do not form exact
+ladders and are found by stream inference instead. BIN country is not a
+membership key; report it in the cluster-versus-baseline comparison after
+membership is frozen.
+
+The original-currency run is canonical. When the user requests home/base-
+currency detection, or when date-varying transaction amounts may conceal fixed
+prices in card-origin currencies, add the separate BIN-country base-currency
+FX sensitivity in [references/fx-conversion.md](references/fx-conversion.md).
+Never merge its `FXC*` membership, exposure, or risk tiers into canonical
+`C*` results.
 
 **Produce:** cluster results and a separate run-specific methodology document
 under `reports/tld-detection/`.
@@ -37,8 +52,9 @@ Follow these steps in order. Detail:
 |---|---|---|
 | 0 Pre-flight | File, grain, columns, window | Stop if auth grain, descriptor, amount, or currency column is missing; caption missing BIN country |
 | 1 Clean | Dedup | Record drop counts; do not filter BIN country |
-| 2 Cluster | Partition; rank pairs; identify anchors; freeze exact keys; compare with same-descriptor baseline | Partition = descriptor; ≥3 levels; adjacent levels = 2x; ≥100 attempts; absolute residual cap per candidate currency |
-| 3 Risk | Assign high/medium/low investigation priority | Mixed BIN countries are neutral; exact 100% single-country concentration is a standout |
+| 1b Streams | Infer wallet currency, preset menu, frozen-rate batches, retail lists per descriptor and BIN-country group with `scripts/detect_streams.py` | Every stream label carries coverage, day drift, scheme share; off-menu remainder is reported, never dropped |
+| 2 Cluster | Run canonical original-currency detection inside each stream; add the separate FX sensitivity when applicable; freeze exact keys; compare with the same-stream baseline (same-descriptor when the descriptor has one stream) | Partition = descriptor, sub-partitioned by stream; ≥3 levels; adjacent levels = 2x; ≥100 attempts; absolute residual cap per candidate currency |
+| 3 Risk | Assign high/medium/low investigation priority | In canonical results, Mixed BIN countries are neutral and exact 100% single-country concentration is a standout; FX concentration is descriptive only and cannot raise tier |
 | 4 Decision | Conclusion + basis for the book | ≤3 sentences; no new evidence |
 | 5 Report | Answer highest-risk, cluster-characteristic, and exposure questions; write + proofread | Sort high → medium → low; no confirmed-TLD wording |
 
@@ -51,7 +67,20 @@ column aliases: [workflow.md](references/workflow.md).
 ### 1 — Clean
 
 [references/clean.md](references/clean.md). Deduplicate first. Do not
-FX-convert the clustering key. Do not drop non-US BIN rows.
+FX-convert the canonical clustering key. Do not drop non-US BIN rows.
+
+### 1b — Streams
+
+[references/streams.md](references/streams.md). Run
+`scripts/detect_streams.py` on the cleaned universe with a daily FX cache.
+It converts each charge into candidate wallet currencies (the card country's
+legal tender, EUR, USD, GBP, CHF), finds the values charges pile up on, and
+peels each descriptor-country group into streams: a wallet-currency preset
+menu (10-scheme or 12-scheme), a retail price list times one constant, a
+frozen-rate batch, or off-menu. Streams are the unit for the behaviour
+contrast (repeat cards, retry after decline, hour concentration, address
+verification, 3-D Secure) and for the same-descriptor baseline in step 2.
+A descriptor with several streams is several upstreams; say so.
 
 ### 2 — Cluster
 
@@ -68,14 +97,27 @@ and amount; keep only clusters with ≥100 authorization attempts. Compare each
 cluster with the baseline formed by removing that cluster from the same
 descriptor. Do not invent clusters from MCC or comparison features.
 
+If the FX sensitivity applies, run it only after the cleaned universe and
+canonical partitions are frozen. Follow
+[references/fx-conversion.md](references/fx-conversion.md) and its mandated
+Frankfurter v2 request/cache contract. Within each frozen canonical descriptor
+partition, `|P_FX|` is only its exact-date-converted attempts; use only `P_FX`
+for FX high-count and rung-pool thresholds and the FX same-descriptor baseline.
+Excluded rows stay outside FX detection and appear only in exclusion coverage
+and reconciliation to canonical `U`. Use `FXC1`, `FXC2`, ... ids and publish
+separate result and methodology files. Because BIN country constructs the
+target currency in this view, country concentration, including 100%, is
+descriptive only and cannot raise the FX tier.
+
 ### 3 — Risk
 
 [references/decision.md](references/decision.md). Assign every identified
 currency-amount pair exactly one investigation-priority tier: High, Medium,
-or Low. BIN-country mixture is neutral and never downgrades a cluster. Treat
-an exact 100% single-BIN-country cluster as a standout; separately report the
-cluster's share of that descriptor-country slice without using an arbitrary
-coverage threshold or risk points.
+or Low. In canonical results, BIN-country mixture is neutral and exact 100%
+single-country concentration is a standout; separately report descriptor-
+country slice coverage without a threshold or risk points. In FX results,
+country concentration remains descriptive because it constructs the target
+currency and is not independent risk evidence.
 
 ### 4 — Decision
 
@@ -84,7 +126,10 @@ book. A one-line table per cluster is allowed under that.
 
 ### 5 — Report
 
-[references/report-template.md](references/report-template.md). Terms:
+[references/report-template.md](references/report-template.md). The cluster
+report opens with the stream table (one row per stream: label, attempts,
+share, countries, behaviour), because the reader needs to know how many
+upstreams share the descriptor before reading any cluster. Terms:
 [references/terminology.md](references/terminology.md).
 
 ```text
@@ -112,6 +157,7 @@ Track a task plan. One item is `in_progress` at a time.
 
 1. Pass pre-flight
 2. Freeze cleaned universe and descriptor partitions
+2b. Run stream inference and record streams per descriptor
 3. Assign High / Medium / Low risk tiers
 4. Publish descriptor currency-amount pairs + same-descriptor baselines
 5. Write ≤3-sentence decision
@@ -121,7 +167,8 @@ Track a task plan. One item is `in_progress` at a time.
 
 | Need | Skill |
 |---|---|
-| Potential TLD clusters, currency-amount pairs, stuffing / 掺量, MCC miscoding, descriptor mixing | `tld-detection` |
+| Potential TLD clusters, currency-amount pairs, stuffing / 掺量, MCC miscoding, descriptor mixing, upstream streams behind one descriptor | `tld-detection` |
+| Which websites, mirrors and operators sit behind a merchant domain | `similar-domain` |
 | Volume, journey Sankey, auth rate, decline mix, settlement overview | `payment-analysis` |
 | Proxy/confirmed fraud labels, holdout precision/recall, rule packages | `fraud-analysis` |
 
@@ -134,7 +181,9 @@ rule package.
 |---|---|
 | Grain, columns, window | [workflow.md](references/workflow.md) |
 | Dedup | [clean.md](references/clean.md) |
+| Wallet currency, preset menus, frozen-rate batches, retail constants, behaviour metrics | [streams.md](references/streams.md) |
 | Currency-amount pairs, anchors, same-descriptor baseline | [clustering.md](references/clustering.md) |
+| BIN-country base-currency FX sensitivity | [fx-conversion.md](references/fx-conversion.md) |
 | ≤3-sentence conclusion | [decision.md](references/decision.md) |
 | Report chapters | [report-template.md](references/report-template.md) |
 | Language / banned strings | [terminology.md](references/terminology.md) |
@@ -143,7 +192,13 @@ rule package.
 
 - [ ] Auth grain; dedup counts are stated; no BIN-country row filter
 - [ ] Partition key is normalized descriptor; missing descriptor is an explicit bucket
+- [ ] Stream inference ran; each descriptor lists its streams with coverage, scheme, drift and behaviour, and the off-menu remainder
+- [ ] A frozen-rate stream is reported as generated traffic evidence, not as player deposits
 - [ ] Clustering key is original currency + amount, not USD
+- [ ] Canonical `C*` results use original amounts; any FX run is separate, uses `FXC*` ids, and does not alter canonical membership or exposure
+- [ ] FX run records as-of-date country→legal-tender mapping, the versioned immutable Frankfurter v2 exact-date request/cache facts, formula, minor-unit rounding, exclusions, and converted-universe coverage
+- [ ] Within each frozen descriptor, `|P_FX|` contains only exact-date-converted attempts; FX thresholds and same-descriptor baselines use only `P_FX`, while exclusions reconcile only to canonical `U`
+- [ ] FX country concentration is descriptive only because BIN country constructs the target currency; it does not independently raise risk
 - [ ] Each rung-pool currency has an explicit adjacent absolute-residual cap and sensitivity evidence
 - [ ] Multi-anchor levels state their portfolio support floor; final membership uses exact selected amount keys
 - [ ] Cluster attempts ≥100
@@ -151,9 +206,9 @@ rule package.
 - [ ] Currency-amount pairs show seed and representative anchors; `*` marks a multi-amount level
 - [ ] Same amount pair may recur across descriptor partitions; never merge them automatically
 - [ ] BIN country is post-membership reporting data, not a membership key; Mixed is neutral
-- [ ] Exact 100% single-country concentration is a standout; descriptor-country coverage is shown without a risk threshold
+- [ ] Canonical exact 100% single-country concentration is a standout; FX concentration is descriptive only; descriptor-country coverage has no risk threshold
 - [ ] Each cluster baseline is the same descriptor after removing that cluster
-- [ ] Definition summary contains only descriptor, seed, anchors, and attempts
+- [ ] Each cluster uses one consolidated profile/comparison table; descriptor, seed, anchors, attempts, descriptor totals/share, MCC, and baseline metrics are not repeated in separate definition/characteristic/metric tables
 - [ ] Anchor table reports attempts, authorization success rate, and suspected-fraud share for every level, including n < 30
 - [ ] Characteristics contain descriptor total, cluster attempts/share, MCC, and cluster-vs-baseline auth rate, suspected-fraud share, top 3 banks, and top 3 BIN countries
 - [ ] Decision prose is ≤3 sentences (conclusion + basis)

package/skills/payment/tld-detection/references/clean.md

@@ -26,7 +26,7 @@ the run. Do not invent a customer id from BIN + amount.
 
 ## 3. Amount and currency
 
-- Clustering key uses the **original** amount and currency.
+- The canonical clustering key uses the **original** amount and currency. A BIN-country base-currency sensitivity may derive a separate key only after this cleaned universe is frozen; see [fx-conversion.md](fx-conversion.md).
 - Normalize `10`, `10.0`, `10.00` to the same decimal key.
 - Drop rows with missing amount or currency; count them.
 - Do not FX-convert before clustering. A 9.99 EUR rung is not a 9.99 USD

package/skills/payment/tld-detection/references/clustering.md

@@ -5,6 +5,14 @@ as **approximate geometric ladders** inside each descriptor, then decompose
 each qualifying ladder into BIN-country attribution components and contrast
 it against the remainder.
 
+## Streams first
+
+Run [streams.md](streams.md) before ranking pairs. When a descriptor carries
+several streams, treat each stream as the partition for rung pools, ladders
+and the baseline; report descriptor totals alongside. Exact-key detection
+finds frozen-rate batches (they are exact, geometric and repeated); it does not
+find live-converted menus, which stream inference reports as menu streams.
+
 ## Descriptor partition
 
 Partition key = `normalized descriptor`.
@@ -26,7 +34,10 @@ fraud rates, and local-hour shapes as attribution components.
 
 ## Currency-amount-pair
 
-Key = (`currency`, `amount`) on the original (not FX-converted) amount.
+Key = (`currency`, `amount`) on the original (not FX-converted) amount. This is
+the canonical key. A requested BIN-country base-currency analysis is a separate
+sensitivity under [fx-conversion.md](fx-conversion.md), never a replacement for
+or input to canonical membership.
 
 Count = authorization **attempts** in the current partition. Rank
 descending by count. Ties: smaller amount first, then currency code.
@@ -195,10 +206,13 @@ authorization, suspected-fraud, issuing-bank, date, and local-hour behavior as
 independent characteristics under thresholds declared in the run methodology.
 
 For each Top 3 cluster BIN country, report both its share of the cluster and
-the cluster's share of all attempts in the same descriptor-country slice. An
-exact 100% single-country cluster is a standout. `Mixed` is neutral, and
-country-slice coverage is descriptive only: do not set a universal threshold
-or award risk points for values such as 20% or 33.8%.
+the cluster's share of all attempts in the same descriptor-country slice. In
+the canonical original-currency run only, an exact 100% single-country cluster
+is a standout. `Mixed` is neutral, and country-slice coverage is descriptive
+only: do not set a universal threshold or award risk points for values such as
+20% or 33.8%. In the FX sensitivity, even 100% concentration is descriptive,
+must be captioned as constructed by the target-currency mapping, and cannot
+raise the FX tier.
 
 ## What not to do
 
@@ -206,9 +220,10 @@ or award risk points for values such as 20% or 33.8%.
 - Do not discover ladders across descriptor boundaries.
 - Do not use BIN country as a ladder partition or membership key.
 - Do not k-means the amounts.
-- Do not convert to USD and then look for ladders.
+- Do not convert to USD or another currency and use that result as the canonical ladder run. Keep any BIN-country base-currency detection in the separate FX sensitivity.
 - Do not search only upward from the busiest rung.
 - Do not use a percentage tolerance across amounts.
+- Do not turn stream inference into cluster membership: its relative tolerance is discovery in the wallet currency; canonical membership stays exact on original currency and amount.
 - Do not assign every amount inside an interval; select finite exact anchors first.
 - Do not retain a low-support additional anchor merely because it is near a primary anchor.
 - Do not report a cluster with fewer than three theoretical levels.