@1aboveio/skills 0.20.2 → 0.20.4

package/skills/compliance/doc-authenticity/references/invoice.md

@@ -0,0 +1,66 @@
+# Invoice Validity Checks (N1-N8)
+
+Run all checks for a document classified as `invoice`. Use PASS, FLAG, FAIL, or
+NA and quote concrete values. Verify calculations programmatically.
+
+## N1 — Supplier identity
+
+Verify the supplier's legal name, registration/tax identifiers, registered
+address, and contact domain against current primary registry or tax-authority
+records. A trading name without a legal entity is FLAG; a mechanically invalid
+or registry-mismatched identifier is FAIL.
+
+## N2 — Customer and transaction parties
+
+Confirm the billed customer matches the case, purchase order, contract, and
+delivery counterparty. Name/address variation with a plausible operational
+explanation is FLAG; billing an unrelated entity without support is FAIL.
+
+## N3 — Invoice identity and chronology
+
+Check invoice number, issue date, due date, currency, purchase-order/reference
+number, and sequence against available adjacent invoices. Impossible dates,
+duplicate invoice numbers for different transactions, or an invoice predating
+the supplier/customer relationship are FAIL when verified.
+
+## N4 — Line and total arithmetic
+
+Programmatically verify every `quantity x unit price`, discount, subtotal,
+shipping/fees, tax base, tax amount, rounding adjustment, and grand total. Quote
+the first mismatch with expected and printed values. A genuine material mismatch
+is a decisive validity FAIL.
+
+## N5 — Tax treatment
+
+Validate VAT/GST/sales-tax identifiers, jurisdiction, rate, exemptions,
+reverse-charge wording, and tax-inclusive/exclusive treatment. Use current tax
+authority sources. A wrong or invalid printed tax identifier is FAIL; an absent
+field is NA unless legally required, in which case FLAG or FAIL according to
+materiality and certainty.
+
+## N6 — Payment instructions
+
+Check currency, beneficiary name, account identifiers, bank/BIC, payment terms,
+and whether the beneficiary is the supplier or a documented collection agent.
+Verify account changes through an independent channel. A beneficiary unrelated
+to the supplier without documented authority is FAIL. Public bank details alone
+do not verify account ownership.
+
+## N7 — Goods, services, and supporting records
+
+Compare descriptions, quantities, service/delivery dates, units, Incoterms,
+purchase order, delivery note, and contract. Vague descriptions or missing
+support are FLAG/NA; direct contradictions with supplied records are FAIL.
+
+## N8 — Completeness and external corroboration
+
+Check page count, repeated identifiers, required footer/legal text, issuer
+contact channels, and consistency across invoice, PO, agreement, and delivery
+evidence. Verify material facts with primary sources. Rate NA when no independent
+records are available; do not infer validity from a polished template.
+
+## Decisive validity evidence
+
+Material arithmetic failure, invalid tax/account checksum, unrelated beneficiary,
+nonexistent supplier, duplicate invoice identity, or direct contradiction with a
+verified PO/delivery record can independently support `INVALID`.

package/skills/compliance/doc-authenticity/references/issuer-profiles.md

@@ -0,0 +1,86 @@
+# Issuer Profiles — Typography & Digital-Signature Practice
+
+Reference for D4 (template/branding) and F8 (digital signature). Every row is
+graded by evidence quality:
+
+- **Verified** — confirmed against a cited source or a known-genuine sample;
+  date recorded.
+- **Knowledge-grade** — from model knowledge only. Usable to *raise* suspicion
+  (FLAG), never on its own to rate FAIL or to lift a confidence cap. Verify
+  before relying on it in a deliverable a reviewer will challenge.
+
+Two honesty rules when using this file:
+
+1. **Brand font ≠ statement font.** A bank's marketing typeface (from its
+   brand guidelines) is not proof its statement PDFs embed that font —
+   statement composition platforms sometimes substitute system fonts (Arial,
+   Helvetica) for print streams. A mismatch with the brand font is a FLAG;
+   FAIL needs either a verified genuine sample of that bank's statement or an
+   absurdity no template explains (e.g. monetary figures in Baskerville).
+2. **Signature absence is NA by default.** Only rate F8 FLAG for a missing
+   signature when this file (or a verified sample) shows the issuer *does*
+   sign. Conversely, a *present, valid* signature is always strong evidence.
+
+## Typography by issuer
+
+| Issuer | Statement/brand typography | Grade | Source / note |
+|---|---|---|---|
+| HSBC (UK/global) | "Univers Next for HSBC" — custom Univers Next cut; pre-2018 materials used Times-style serif | Verified (brand, 2026-07) | Monotype font distribution ("Univers Next for HSBC W01/W02"), HSBC 2018 rebrand coverage |
+| Barclays | "Barclays Expert Sans" (custom, Monotype 2005) — Headline/eText cuts | Verified (brand, 2026-07) | MyFonts "Barclays Expert Sans eText — custom" |
+| NatWest / RBS group | "RN House Sans" (custom, Monotype ~2014, whole RBS group incl. Ulster) + Jubilat as secondary | Verified (brand, 2026-07) | Fonts In Use; Design Week 2016 rebrand |
+| Lloyds Bank | 2013–2024: "Lloyds Bank Jack" (modified FS Jack, Fontsmith); 2024 refresh: customized GT Ultra (Grilli Type) | Verified (brand, 2026-07) | Fontsmith case study; Grilli Type / Creative Review 2024 |
+| Santander | "Santander Text" / "Santander Headline" (custom) | Knowledge-grade | — |
+| Nationwide | Custom sans ("Nationwide Sans" family) since 2023 rebrand | Knowledge-grade | — |
+| Monzo | Custom sans ("Monzo Sans" family); statements minimal single-family | Knowledge-grade | — |
+| Starling | "Starling Sans"-style custom grotesque | Knowledge-grade | — |
+| Revolut | "Aeonik"-family custom sans | Knowledge-grade | — |
+| Chase (US) | Custom sans ("Dear Chase" era: proprietary); older statements Interstate-like | Knowledge-grade | — |
+| Bank of America | "Connections" custom family | Knowledge-grade | — |
+| Citi | Interstate (long-standing brand face) | Knowledge-grade | — |
+| Wells Fargo | "Wells Fargo Sans" custom family | Knowledge-grade | — |
+| Deutsche Bank | Custom sans family ("DB Sans"-style) | Knowledge-grade | — |
+| Binance | "BinancePlex" (custom IBM Plex derivative); UI/exports sans-serif only | Knowledge-grade | — |
+| Coinbase | "Coinbase Sans" / "Coinbase Display" custom family | Knowledge-grade | — |
+
+Universally safe negatives (any issuer): monetary values or account
+identifiers set in bookish serifs (Baskerville, Garamond, Times mixed into a
+sans layout), more than ~3 font families on one statement page, or handwriting
+/display faces anywhere in the ledger. No composition platform emits these.
+
+## Digital-signature practice by issuer
+
+| Issuer | Signs customer statement PDFs? | Grade | Source / note |
+|---|---|---|---|
+| UK high-street banks (HSBC, Barclays, Lloyds, NatWest, Santander UK, Nationwide) | No cryptographic signature on retail statement PDFs, as far as observed; treat absence as NA | Knowledge-grade | No bank documentation found asserting signing; do not FLAG absence |
+| N26 | **Does not** sign or stamp — official docs state statements "are fully valid without a signature or stamp" | Verified (2026-07) | N26 support: "How to get a bank statement" / bank documents pages |
+| Revolut (Business) | Account confirmations can be generated "signed and stamped" on request; regular statements not confirmed either way | Verified-partial (2026-07) | Revolut Business help: account confirmation document options |
+| Revolut (Personal) | Unconfirmed | Knowledge-grade | — |
+| Wise | Unconfirmed (community reports of signed statements exist; no official doc found) | Knowledge-grade | Search found no authoritative statement |
+| ING | Wholesale/contract flows use eIDAS QES; retail statement sealing unconfirmed | Verified-partial (2026-07) | ING Wholesale eSignature provision instructions (about inbound signatures, not statements) |
+| EU banks generally | eIDAS "qualified electronic seals" on bank-issued PDFs are increasingly common (esp. DE/NL/PL/Baltics); check the specific bank | Knowledge-grade | When a seal is present, validate byte-range coverage (F8) |
+| Binance | Statements/exports carry no known document signature. "Binance Verify" (binance.com/en/official-verification) validates official *channels* (links, emails, social handles), **not** documents | Verified (2026-07) | Binance Verify FAQ |
+| Coinbase, Kraken, other exchanges | Unconfirmed; assume unsigned | Knowledge-grade | — |
+| Interactive Brokers | Unconfirmed; assume unsigned | Knowledge-grade | — |
+
+Practical F8 flow: if `signatures` in forensics.json is non-empty → validate
+coverage and signer, and a valid full-file signature from the issuer lifts the
+`NO_EVIDENCE_OF_MODIFICATION` confidence cap. If empty → NA, unless this table (Verified rows
+only) or a verified local sample says the issuer signs, in which case FLAG.
+
+## Maintaining this file
+
+The highest-value upgrade path is **local sample verification**: when a
+known-genuine statement for an issuer passes through a case, record its
+profile and promote the row to Verified:
+
+```bash
+uv run {baseDir}/scripts/pdf_forensics.py genuine-sample.pdf --out /tmp/profile
+# record from forensics.json: metadata.producer/creator, fonts[] families,
+# signatures[] presence, then update the issuer's row + date here
+```
+
+Only profile documents whose provenance is certain (fetched directly from the
+issuer's portal, or bank-confirmed). Date every promotion. When a verified
+profile contradicts a knowledge-grade row, the sample wins — fix the row.
+Brand refreshes happen (see Lloyds 2024): a font mismatch against a stale
+profile is a prompt to re-verify, not an automatic FAIL.

package/skills/compliance/doc-authenticity/references/verdict-and-report.md

@@ -0,0 +1,95 @@
+# Verdict and Report Contract
+
+Apply authenticity and validity independently. A result on one axis does not
+determine the other.
+
+## Check results
+
+- `PASS`: concrete evidence supports the check.
+- `FLAG`: an anomaly exists but has a plausible innocent explanation; state it.
+- `FAIL`: concrete evidence of material modification or invalid content.
+- `NA`: evidence is unavailable or the check does not apply; state why.
+
+Set `decisive: true` only for a FAIL that independently meets a decisive rule
+in the selected reference. PASS, FLAG, and NA checks are never decisive.
+
+## Authenticity verdict
+
+Apply the first matching row:
+
+| Verdict | Rule |
+|---|---|
+| `LIKELY_MODIFIED` | At least two authenticity FAILs; one FAIL corroborated by at least two authenticity FLAGs; or one decisive FAIL such as a confirmed material splice, invalid trusted provenance, or a PDF revision that changed visible content |
+| `SUSPICIOUS` | One non-decisive authenticity FAIL; verified image-editor contact (I2 FLAG); or at least three authenticity FLAGs |
+| `INCONCLUSIVE` | No FAIL, no preceding suspicious rule matched, and at least half of authenticity checks are NA |
+| `NO_EVIDENCE_OF_MODIFICATION` | No FAIL, at most two FLAGs, and a majority of authenticity checks ran |
+
+`NO_EVIDENCE_OF_MODIFICATION` means no modification was detected; it is not
+proof of origin. In the structured verdict, HIGH confidence requires F8/I9
+PASS; describe source-side or hash-matched verification separately.
+
+## Validity verdict
+
+For `conversation_log` and `other`, return `INCONCLUSIVE` because no specialized
+validity profile ran.
+
+For `bank_statement`, `invoice`, and `agreement`, apply the first matching row:
+
+| Verdict | Rule |
+|---|---|
+| `INVALID` | One decisive validity FAIL or at least two independent validity FAILs |
+| `INCONCLUSIVE` | No decisive FAIL and fewer than two FAILs, but any FAIL remains, more than two checks are FLAG, or at least half of validity checks are NA |
+| `VALID` | No FAIL, at most two FLAGs, a majority of checks ran, and internal plus domain evidence supports the material claim |
+
+## Confidence
+
+Assign `HIGH`, `MEDIUM`, or `LOW` separately per axis:
+
+- HIGH: at least two independent evidence types agree and few checks are NA.
+- MEDIUM: one strong evidence type or moderate unavailable coverage.
+- LOW: sparse or conflicting evidence; state what would raise confidence.
+
+## Deliverables
+
+Write `report.md`:
+
+```markdown
+# Authenticity and Validity Report: <filename>
+
+**File type:** pdf | image
+**Document type:** bank_statement | conversation_log | invoice | agreement | other
+**Authenticity:** <token>
+**Authenticity confidence:** <token>
+**Validity:** <token>
+**Validity confidence:** <token>
+**Date checked:** <ISO 8601 timestamp with timezone>
+
+## Summary
+<Both verdicts, decisive evidence, and next action in 2-4 sentences.>
+
+## Classification
+<Observed evidence supporting file type and document type.>
+
+## Authenticity evidence
+| # | Check | Result | Decisive? | Evidence |
+|---|---|---|---|---|
+
+## Validity evidence
+| # | Check | Result | Decisive? | Evidence |
+|---|---|---|---|---|
+<For conversation_log/other: state that no specialized profile ran.>
+
+## External verification
+<For each lookup: primary-source URL, retrieval date, observed fact, and check ID;
+or state that no external verification was available.>
+
+## Limitations
+<Unavailable evidence and what would raise confidence.>
+```
+
+Write `verdict.json` conforming to `verdict.schema.json` version 2.2. Record
+`size_bytes`, lowercase `sha256`, `extension_magic_match`, and the user's
+`supplied_claim` under `artifact`. Its `checks` array contains the exact
+route-specific IDs listed in `SKILL.md` and a `decisive` boolean on every row.
+Use the same summary text and canonical uppercase verdict/result tokens in both
+files, then run `{baseDir}/scripts/validate_verdict.py`.

package/skills/compliance/doc-authenticity/references/verdict.schema.json

@@ -0,0 +1,81 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "doc-authenticity/verdict.schema.json",
+  "title": "doc-authenticity routed dual-axis verdict",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "artifact", "authenticity", "validity",
+    "checks", "summary", "checked_at"
+  ],
+  "properties": {
+    "schema_version": {"const": "2.2"},
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path", "file_type", "media_type", "size_bytes", "sha256",
+        "extension_magic_match", "doc_type", "detail", "claimed_issuer",
+        "supplied_claim"
+      ],
+      "properties": {
+        "path": {"type": "string", "minLength": 1},
+        "file_type": {"enum": ["pdf", "image"]},
+        "media_type": {"type": "string", "minLength": 1},
+        "size_bytes": {"type": "integer", "minimum": 1},
+        "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "extension_magic_match": {"type": "boolean"},
+        "doc_type": {"enum": ["bank_statement", "conversation_log", "invoice", "agreement", "other"]},
+        "detail": {"type": ["string", "null"]},
+        "claimed_issuer": {"type": ["string", "null"]},
+        "supplied_claim": {"type": ["string", "null"]}
+      }
+    },
+    "authenticity": {"$ref": "#/$defs/authenticityVerdict"},
+    "validity": {"$ref": "#/$defs/validityVerdict"},
+    "checks": {
+      "type": "array",
+      "minItems": 9,
+      "items": {"$ref": "#/$defs/check"}
+    },
+    "summary": {"type": "string", "minLength": 1},
+    "checked_at": {"type": "string", "format": "date-time"}
+  },
+  "$defs": {
+    "confidence": {"enum": ["HIGH", "MEDIUM", "LOW"]},
+    "authenticityVerdict": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["verdict", "confidence", "summary"],
+      "properties": {
+        "verdict": {"enum": ["NO_EVIDENCE_OF_MODIFICATION", "SUSPICIOUS", "LIKELY_MODIFIED", "INCONCLUSIVE"]},
+        "confidence": {"$ref": "#/$defs/confidence"},
+        "summary": {"type": "string", "minLength": 1}
+      }
+    },
+    "validityVerdict": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["verdict", "confidence", "summary"],
+      "properties": {
+        "verdict": {"enum": ["VALID", "INVALID", "INCONCLUSIVE"]},
+        "confidence": {"$ref": "#/$defs/confidence"},
+        "summary": {"type": "string", "minLength": 1}
+      }
+    },
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name", "axis", "dimension", "result", "decisive", "evidence"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^(F[1-9]|I[1-9]|C[1-5]|D[1-5]|N[1-8]|A[1-8])$"},
+        "name": {"type": "string", "minLength": 1},
+        "axis": {"enum": ["authenticity", "validity"]},
+        "dimension": {"enum": ["file_forensics", "content", "domain"]},
+        "result": {"enum": ["PASS", "FLAG", "FAIL", "NA"]},
+        "decisive": {"type": "boolean"},
+        "evidence": {"type": "string", "minLength": 1}
+      }
+    }
+  }
+}

package/skills/compliance/doc-authenticity/scripts/image_forensics.py

@@ -0,0 +1,294 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["Pillow>=10"]
+# ///
+"""Extract metadata, container, and recompression signals from a raster image.
+
+Usage:
+    uv run image_forensics.py input.jpg --out outdir/
+
+Writes image-forensics.json and, for JPEG inputs, ela.png. The output is
+evidence for analyst review, not an automatic authenticity decision.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import io
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+from PIL import ExifTags, Image, ImageChops, ImageEnhance, ImageStat
+
+EDITOR_PATTERNS = {
+    "Adobe Photoshop": rb"(?i)(adobe\s+photoshop|photoshop\s+3\.0|8BIM)",
+    "Adobe Lightroom": rb"(?i)(adobe\s+lightroom|lightroom)",
+    "GIMP": rb"(?i)(\bgimp\b|gimp-save)",
+    "Canva": rb"(?i)\bcanva\b",
+    "Affinity": rb"(?i)\baffinity(?:\s+photo)?\b",
+    "Pixelmator": rb"(?i)\bpixelmator\b",
+    "ImageMagick": rb"(?i)(imagemagick|magick)",
+    "Microsoft image tools": rb"(?i)(microsoft.*(?:photo|image)|windows photo editor)",
+}
+
+CAPTURE_PATTERNS = {
+    "Apple": rb"(?i)apple iphone|apple screenshot",
+    "Google": rb"(?i)google pixel",
+    "Samsung": rb"(?i)samsung",
+    "Canon": rb"(?i)canon",
+    "Nikon": rb"(?i)nikon",
+    "Sony": rb"(?i)sony",
+    "Fujifilm": rb"(?i)fujifilm",
+}
+
+
+def serializable(value: Any) -> Any:
+    if value is None or isinstance(value, (bool, int, float, str)):
+        return value
+    if isinstance(value, bytes):
+        return value[:256].decode("utf-8", "replace")
+    if isinstance(value, (list, tuple)):
+        return [serializable(v) for v in value]
+    if isinstance(value, dict):
+        return {str(k): serializable(v) for k, v in value.items()}
+    return str(value)
+
+
+def extract_exif(image: Image.Image) -> dict[str, Any]:
+    out: dict[str, Any] = {}
+    try:
+        for tag, value in image.getexif().items():
+            out[ExifTags.TAGS.get(tag, str(tag))] = serializable(value)
+    except Exception as exc:  # noqa: BLE001
+        out["_error"] = str(exc)
+    return out
+
+
+def jpeg_markers(data: bytes) -> dict[str, Any]:
+    names = {
+        0xD8: "SOI",
+        0xD9: "EOI",
+        0xDA: "SOS",
+        0xDB: "DQT",
+        0xC0: "SOF0",
+        0xC2: "SOF2",
+        0xC4: "DHT",
+        0xDD: "DRI",
+        0xE0: "APP0",
+        0xE1: "APP1",
+        0xE2: "APP2",
+        0xED: "APP13",
+        0xEE: "APP14",
+        0xFE: "COM",
+    }
+    markers: list[dict[str, Any]] = []
+    if not data.startswith(b"\xff\xd8"):
+        return {"valid_soi": False, "markers": markers}
+    markers.append({"name": "SOI", "offset": 0, "length": 2})
+    pos = 2
+    while pos + 1 < len(data):
+        if data[pos] != 0xFF:
+            pos += 1
+            continue
+        while pos < len(data) and data[pos] == 0xFF:
+            pos += 1
+        if pos >= len(data):
+            break
+        code = data[pos]
+        marker_offset = pos - 1
+        pos += 1
+        if code == 0xD9:
+            markers.append({"name": "EOI", "offset": marker_offset, "length": 2})
+            break
+        if code in range(0xD0, 0xD8) or code == 0x01:
+            markers.append(
+                {
+                    "name": names.get(code, f"0xFF{code:02X}"),
+                    "offset": marker_offset,
+                    "length": 2,
+                }
+            )
+            continue
+        if pos + 2 > len(data):
+            break
+        segment_length = int.from_bytes(data[pos : pos + 2], "big")
+        payload = data[pos + 2 : pos + segment_length]
+        entry: dict[str, Any] = {
+            "name": names.get(code, f"0xFF{code:02X}"),
+            "offset": marker_offset,
+            "length": segment_length + 2,
+        }
+        if code in (0xE0, 0xE1, 0xE2, 0xED, 0xEE, 0xFE):
+            entry["identifier"] = (
+                payload[:80].split(b"\x00", 1)[0].decode("latin-1", "replace")
+            )
+        markers.append(entry)
+        pos += segment_length
+        if code == 0xDA:
+            eoi = data.rfind(b"\xff\xd9")
+            if eoi >= 0:
+                markers.append({"name": "EOI", "offset": eoi, "length": 2})
+            break
+    eoi_offset = data.rfind(b"\xff\xd9")
+    return {
+        "valid_soi": True,
+        "markers": markers,
+        "eoi_offset": eoi_offset if eoi_offset >= 0 else None,
+        "bytes_after_eoi": len(data) - eoi_offset - 2 if eoi_offset >= 0 else None,
+        "has_exif_app1": b"Exif\x00\x00" in data,
+        "has_xmp": b"http://ns.adobe.com/xap/1.0/" in data,
+        "has_photoshop_app13": b"Photoshop 3.0" in data or b"8BIM" in data,
+        "has_adobe_app14": any(m["name"] == "APP14" for m in markers),
+    }
+
+
+def estimate_jpeg_quality(image: Image.Image) -> int | None:
+    source = getattr(image, "quantization", None)
+    if not source or 0 not in source:
+        return None
+    source_luma = source[0]
+    probe = Image.new("RGB", (8, 8), "gray")
+    best: tuple[int, int] | None = None
+    for quality in range(30, 101):
+        buf = io.BytesIO()
+        probe.save(buf, format="JPEG", quality=quality)
+        buf.seek(0)
+        with Image.open(buf) as candidate:
+            table = candidate.quantization.get(0, [])
+        if len(table) != len(source_luma):
+            continue
+        distance = sum(abs(a - b) for a, b in zip(source_luma, table))
+        if best is None or distance < best[0]:
+            best = (distance, quality)
+    return best[1] if best else None
+
+
+def recompression_analysis(image: Image.Image, outdir: Path) -> dict[str, Any]:
+    quality = estimate_jpeg_quality(image) or 90
+    rgb = image.convert("RGB")
+    if max(rgb.size) > 5000:
+        rgb.thumbnail((5000, 5000))
+    buf = io.BytesIO()
+    rgb.save(buf, format="JPEG", quality=quality)
+    buf.seek(0)
+    with Image.open(buf) as recompressed:
+        diff = ImageChops.difference(rgb, recompressed.convert("RGB"))
+        gray = diff.convert("L")
+        global_mean = ImageStat.Stat(gray).mean[0]
+        tile_size = max(32, min(rgb.size) // 20)
+        tiles: list[dict[str, Any]] = []
+        for top in range(0, rgb.height, tile_size):
+            for left in range(0, rgb.width, tile_size):
+                box = (
+                    left,
+                    top,
+                    min(left + tile_size, rgb.width),
+                    min(top + tile_size, rgb.height),
+                )
+                mean = ImageStat.Stat(gray.crop(box)).mean[0]
+                tiles.append({"box": list(box), "mean_error": round(mean, 4)})
+        values = sorted(t["mean_error"] for t in tiles)
+        p95 = values[min(len(values) - 1, int(len(values) * 0.95))] if values else 0
+        max_tile = max(tiles, key=lambda t: t["mean_error"], default=None)
+        amplified = ImageEnhance.Contrast(diff).enhance(8)
+        amplified = ImageEnhance.Brightness(amplified).enhance(8)
+        amplified.save(outdir / "ela.png")
+    return {
+        "method": "same-quality JPEG recompression difference",
+        "estimated_quality": quality,
+        "analysis_size": list(rgb.size),
+        "tile_size": tile_size,
+        "global_mean_error": round(global_mean, 4),
+        "p95_tile_error": p95,
+        "max_tile": max_tile,
+        "highest_error_tiles": sorted(
+            tiles, key=lambda t: t["mean_error"], reverse=True
+        )[:10],
+        "ela_path": str(outdir / "ela.png"),
+        "caution": "ELA is heuristic; naturally detailed regions differ from flat regions, and a full-image re-export can hide local edits.",
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("input", type=Path)
+    parser.add_argument("--out", required=True, type=Path)
+    args = parser.parse_args()
+    args.out.mkdir(parents=True, exist_ok=True)
+
+    data = args.input.read_bytes()
+    with Image.open(args.input) as image:
+        image.verify()
+    with Image.open(args.input) as image:
+        exif = extract_exif(image)
+        info = {
+            str(k): serializable(v)
+            for k, v in image.info.items()
+            if k not in {"exif", "icc_profile"}
+        }
+        text_blob = (
+            data + json.dumps({"exif": exif, "info": info}, ensure_ascii=False).encode()
+        )
+        editor_matches = [
+            name
+            for name, pattern in EDITOR_PATTERNS.items()
+            if re.search(pattern, text_blob)
+        ]
+        capture_matches = [
+            name
+            for name, pattern in CAPTURE_PATTERNS.items()
+            if re.search(pattern, text_blob)
+        ]
+        result: dict[str, Any] = {
+            "input": str(args.input.resolve()),
+            "file_size": len(data),
+            "size_bytes": len(data),
+            "sha256": hashlib.sha256(data).hexdigest(),
+            "media_type": Image.MIME.get(image.format, "application/octet-stream"),
+            "extension_magic_match": args.input.suffix.lower()
+            in {
+                suffix.lower()
+                for suffix, detected_format in Image.registered_extensions().items()
+                if detected_format == image.format
+            },
+            "format": image.format,
+            "mode": image.mode,
+            "width": image.width,
+            "height": image.height,
+            "frames": getattr(image, "n_frames", 1),
+            "exif": exif,
+            "image_info": info,
+            "editor_matches": editor_matches,
+            "capture_device_matches": capture_matches,
+            "provenance": {
+                "marker_scan_only": True,
+                "cryptographic_validation": "not_performed",
+                "has_c2pa_or_jumbf_marker": any(
+                    token in data.lower()
+                    for token in (b"c2pa", b"jumb", b"contentauth")
+                ),
+                "has_content_credentials_text": b"content credentials" in data.lower(),
+            },
+        }
+        if image.format == "JPEG":
+            result["jpeg"] = jpeg_markers(data)
+            result["recompression"] = recompression_analysis(image, args.out)
+        else:
+            result["recompression"] = {
+                "available": False,
+                "reason": "JPEG ELA is not applicable to this source format; inspect metadata and pixels directly.",
+            }
+
+    output = args.out / "image-forensics.json"
+    output.write_text(
+        json.dumps(result, indent=2, ensure_ascii=False) + "\n", encoding="utf-8"
+    )
+    print(output)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())