@1aboveio/skills 0.20.2 → 0.20.4

package/skills/document-utils/reg-parser/scripts/validate_mandate.py

@@ -0,0 +1,242 @@
+#!/usr/bin/env python3
+"""Validate a mandate (Mode A — Clause Annotation Extract) Markdown file.
+
+Catches the failure modes specific to mandate extracts produced by the
+`reg-parser` skill:
+
+  - Agent left the raw template scaffolding behind (Status: RAW, HTML
+    comment placeholders, the embedded raw-text fenced block).
+  - One of the four canonical sections is missing or silently empty.
+  - Header metadata (Source attribution, jurisdiction/version/date) is
+    missing.
+  - Notes section is empty or stub.
+
+Optional --source <converted-md> enables citation-existence warnings:
+each `§<ref>` cited in the extract is fuzzy-matched against the source
+markdown. Missing citations emit warnings, not errors (refs are often
+restyled during extraction).
+
+Usage:
+    python3 validate_mandate.py <mandate.md> [--source <converted-md>]
+
+Exit code 0 = valid. Non-zero = errors found.
+"""
+
+import argparse
+import re
+import sys
+import os
+
+REQUIRED_SECTIONS = [
+    "Mandatory Downstream Agreement Clauses",
+    "Prohibited Conduct",
+    "Thresholds & Triggers",
+    "Audit & Oversight Rights",
+    "Notes",
+]
+
+# Markers an agent may use to indicate a section legitimately has no entries.
+EMPTY_MARKERS = ("_none_", "(none)", "n/a", "not applicable", "none.")
+
+# Header metadata keywords — at least one must appear in the header block
+# (between H1 and the first H2). Matches the conventions in the existing
+# extracts (visa-vars.md, hk-amlo-cap615.md).
+HEADER_KEYWORDS = ("source", "jurisdiction", "version", "effective", "updated", "date")
+
+# Patterns that indicate the agent left raw template artifacts behind.
+RAW_STATUS_RE = re.compile(r"^\s*>\s*\*?\*?Status:\*?\*?\s*RAW", re.IGNORECASE)
+RAW_TEXT_HEADING_RE = re.compile(r"^##\s+Raw Text\b", re.IGNORECASE)
+SCAFFOLDING_COMMENT_RES = [
+    re.compile(r"<!--\s*Agent:\s*replace", re.IGNORECASE),
+    re.compile(r"<!--\s*Format:\s*\*\*§\[ref\]"),
+    re.compile(r"<!--\s*Clauses the counterparty"),
+    re.compile(r"<!--\s*Explicitly prohibited"),
+    re.compile(r"<!--\s*Numeric thresholds"),
+    re.compile(r"<!--\s*Rights granted"),
+    re.compile(r"<!--\s*Jurisdiction scope, effective date"),
+]
+
+# A §-style citation. Captures common forms: §AACQ.C2.1, §76E,
+# §Sched.2 §2(1)(a), § 14(3)(b). The capturing group keeps just the
+# alphanumeric/punctuation token; the leading § is consumed.
+CITATION_RE = re.compile(r"§\s*([A-Za-z0-9][A-Za-z0-9.\-]*(?:\([^)]+\))*)")
+
+H1_RE = re.compile(r"^#\s+(.+?)\s*$")
+H2_RE = re.compile(r"^##\s+(.+?)\s*$")
+
+
+def split_sections(lines: list[str]) -> tuple[list[str], dict[str, list[str]]]:
+    """Return (header_lines, {section_title: body_lines})."""
+    header: list[str] = []
+    sections: dict[str, list[str]] = {}
+    current: str | None = None
+    seen_h1 = False
+
+    for line in lines:
+        if not seen_h1 and H1_RE.match(line):
+            seen_h1 = True
+            continue
+        h2 = H2_RE.match(line)
+        if h2:
+            current = h2.group(1).strip()
+            sections.setdefault(current, [])
+            continue
+        if current is None:
+            header.append(line)
+        else:
+            sections[current].append(line)
+
+    return header, sections
+
+
+def section_is_empty(body: list[str]) -> bool:
+    """A section is empty if it has no §-bullet entries AND no explicit
+    'none' marker."""
+    text = "\n".join(body).strip()
+    if not text:
+        return True
+    lower = text.lower()
+    if any(marker in lower for marker in EMPTY_MARKERS):
+        return False
+    if "**§" in text or re.search(r"^\s*§", text, re.MULTILINE):
+        return False
+    if "§" in text and re.search(r"§\s*[A-Za-z0-9]", text):
+        return False
+    return True
+
+
+def extract_citations(text: str) -> set[str]:
+    """Pull §-style citation tokens out of arbitrary text."""
+    return {m.group(1) for m in CITATION_RE.finditer(text)}
+
+
+def fuzzy_present(token: str, haystack_lower: str) -> bool:
+    """Best-effort: token appears in source if either the literal token
+    or a heavily-normalized form (lowercased, punctuation stripped) does.
+    """
+    if token.lower() in haystack_lower:
+        return True
+    norm = re.sub(r"[^a-z0-9]", "", token.lower())
+    if not norm:
+        return False
+    norm_haystack = re.sub(r"[^a-z0-9]", "", haystack_lower)
+    return norm in norm_haystack
+
+
+def validate(filepath: str, source_path: str | None) -> tuple[list[str], list[str]]:
+    """Return (errors, warnings)."""
+    errors: list[str] = []
+    warnings: list[str] = []
+
+    if not os.path.isfile(filepath):
+        return [f"File not found: {filepath}"], []
+
+    with open(filepath, "r", encoding="utf-8") as f:
+        raw = f.read()
+    lines = raw.splitlines()
+
+    # --- Raw template artifacts ---
+    for line_num, line in enumerate(lines, 1):
+        if RAW_STATUS_RE.match(line):
+            errors.append(
+                f"Line {line_num}: 'Status: RAW' marker still present — "
+                f"agent extraction not completed"
+            )
+        if RAW_TEXT_HEADING_RE.match(line):
+            errors.append(
+                f"Line {line_num}: '## Raw Text' section still present — "
+                f"remove the embedded raw-text dump after extraction"
+            )
+        for pat in SCAFFOLDING_COMMENT_RES:
+            if pat.search(line):
+                errors.append(
+                    f"Line {line_num}: leftover template scaffolding comment"
+                )
+                break
+
+    # --- Structure ---
+    header_lines, sections = split_sections(lines)
+
+    if not any(H1_RE.match(line) for line in lines):
+        errors.append("Missing H1 title (expected '# <Source> — Contract Obligation Extract')")
+
+    # Header metadata: at least one of Source/Jurisdiction/Version/etc.
+    header_text = "\n".join(header_lines).lower()
+    if not any(kw in header_text for kw in HEADER_KEYWORDS):
+        errors.append(
+            "Header metadata block missing — expected blockquote with "
+            "Source / Jurisdiction / Version / Effective Date"
+        )
+
+    # The Source attribution specifically is critical.
+    if "source" not in header_text:
+        errors.append("Header missing 'Source:' attribution")
+
+    # Required sections present
+    for required in REQUIRED_SECTIONS:
+        if required not in sections:
+            errors.append(f"Missing required section: ## {required}")
+
+    # Required content sections non-empty
+    for required in REQUIRED_SECTIONS[:-1]:  # everything except Notes
+        body = sections.get(required)
+        if body is not None and section_is_empty(body):
+            errors.append(
+                f"Section '## {required}' is empty — if there are no "
+                f"items, mark explicitly as '_None_'"
+            )
+
+    # Notes substance check
+    notes_body = sections.get("Notes")
+    if notes_body is not None:
+        notes_text = "\n".join(notes_body).strip()
+        if len(notes_text) < 50:
+            errors.append(
+                "Section '## Notes' is too short — include jurisdiction "
+                "scope, effective date, version, and caveats"
+            )
+
+    # --- Optional: citation existence check ---
+    if source_path:
+        if not os.path.isfile(source_path):
+            warnings.append(f"--source file not found: {source_path}")
+        else:
+            with open(source_path, "r", encoding="utf-8") as sf:
+                source_lower = sf.read().lower()
+            cites = extract_citations(raw)
+            missing = sorted(c for c in cites if not fuzzy_present(c, source_lower))
+            if missing:
+                preview = ", ".join(f"§{c}" for c in missing[:8])
+                more = "" if len(missing) <= 8 else f" (+{len(missing) - 8} more)"
+                warnings.append(
+                    f"{len(missing)} citation(s) not found in source: {preview}{more}"
+                )
+
+    return errors, warnings
+
+
+def main() -> None:
+    p = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    p.add_argument("filepath", help="Path to mandate Markdown file")
+    p.add_argument(
+        "--source",
+        help="Optional path to the converted source Markdown for citation checks",
+    )
+    args = p.parse_args()
+
+    errors, warnings = validate(args.filepath, args.source)
+
+    for w in warnings:
+        print(f"  ⚠️  {w}", file=sys.stderr)
+
+    if errors:
+        print(f"❌ Validation failed for {args.filepath}:", file=sys.stderr)
+        for err in errors:
+            print(f"  • {err}", file=sys.stderr)
+        sys.exit(1)
+    print(f"✅ {args.filepath} is valid.")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -342,7 +342,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
       "contentDigest": "eff6c7b5931bce5b2265a619bccddd371a89df6ce7bc2edc74f11d00060a71dd",
       "digestExcludes": []
@@ -355,7 +355,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
       "contentDigest": "d97abeff7bdc5ae2e4be2f631d09dba46d4753ce1e67334793364329af59f066",
       "digestExcludes": []
@@ -368,9 +368,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
-      "contentDigest": "00cfdd3e5bfbc3e37b1369ad93aae91161e671829760a8867ea9be25047ba461",
+      "contentDigest": "fe2ec3bae2bfec2dbef19db30ab0272391d7c1d9b6893341a76a9f339adefc57",
       "digestExcludes": []
     },
     {
@@ -381,7 +381,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
       "contentDigest": "58b0556228a9271cf9e33727a05fc08a4fdfd29512ec0936b169f0a55d60e6ef",
       "digestExcludes": []
@@ -394,9 +394,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
-      "contentDigest": "4664873230f22de2fcf46b7b529570cfedabdc850620031d8f96baf89fcdc5b4",
+      "contentDigest": "d28dd4d3c4394df0cc7e6b48d0e5daa7d2277701ea459e39fba99acf1d8ff670",
       "digestExcludes": []
     },
     {
@@ -407,9 +407,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
-      "contentDigest": "cd9f398f6d8d1df7c2d944d3bec014e788535638014f327783f074757bfb4f49",
+      "contentDigest": "56fb5843788c9073b0d5a65ffa72bd7d2fa80dc6a1ff06fb0e19fab513c51502",
       "digestExcludes": []
     },
     {
@@ -420,7 +420,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
       "contentDigest": "f048fd00c69f2dc666fc7a3096cfeee6dfba73933bfb69602f3f0e26159798cc",
       "digestExcludes": []
@@ -433,7 +433,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
       "contentDigest": "d533684db4483cfc90be2aa7161980b6548057ef18a4b54f0cdbcd53c79dd46d",
       "digestExcludes": []
@@ -446,15 +446,15 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2"
+        "version": "0.20.4"
       },
-      "contentDigest": "f7f56f7e33b2b12c3043df0f4729447dfccd181daa79936ff62da38df91d5175",
+      "contentDigest": "86a91b567eabe6143a4ecac3cbec7271da252978202f292e287bb3a8da95a797",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "455424f618fddc62d553f7c89282887d6b449b278eb0335b72bf415f760f1b34",
+  "releaseIdentity": "ffa735d74d402c79fbd8cbca332b415422884ee88f914412d4aa88c2d1353cb9",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",
@@ -512,7 +512,7 @@
         "sourceId": "first-party",
         "sourceType": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.20.2",
+        "version": "0.20.4",
         "installPath": null,
         "members": [
           "harness-runtime",
@@ -528,7 +528,7 @@
         "commands": [
           {
             "transport": "npm",
-            "command": "npx @1aboveio/skills@0.20.2 install --group engineering-workflow --yes"
+            "command": "npx @1aboveio/skills@0.20.4 install --group engineering-workflow --yes"
           }
         ],
         "onFailure": {

package/skills/engineering/engineering-runtime/scripts/workflow-coherence.mjs

@@ -154,6 +154,10 @@ const TEST_FIXTURE = /\.fixtures?\.[^.]+$/;
 export function publishedContentExcluded(name) {
   return name.startsWith('.')
     || name === 'node_modules'
+    || name === '__pycache__'
+    || name === 'evals'
+    || name === 'samples'
+    || name === 'tests'
     || name.endsWith('-workspace')
     || name.endsWith('.test.mjs')
     || TEST_FIXTURE.test(name);

package/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -86,7 +86,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.20.2',
+    version: '0.20.4',
   },
   matt: {
     id: 'matt-pocock',

package/skills/payment/similar-domain/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/payment/similar-domain/SKILL.md

@@ -0,0 +1,178 @@
+---
+name: similar-domain
+description: >
+  Find the domains, mirrors, and operating entities related to one or more seed
+  domains: collect technical fingerprints (analytics IDs, block-page templates,
+  DNS, mail, certificates, registration), reverse-pivot on each fingerprint,
+  score every link, and expand until the cluster stops growing. Use whenever
+  the user gives a domain or URL and asks who is behind it, whether several
+  sites are related or the same operator, for sister sites, mirror domains,
+  the cluster, or a merchant-website background check — even if they never say
+  similar-domain. Stops at websites, mirrors and operators: anything inside
+  transaction data (streams, preset menus, amount ladders) is tld-detection,
+  and transaction-level fraud rules are fraud-analysis.
+---
+
+# Similar Domain
+
+Start from a seed domain and find every other domain that the same people run.
+A cluster is defined by **shared infrastructure**, not by shared branding or
+shared industry. Corporate records (operator, licence, affiliate program)
+confirm and name the cluster; they do not create it on their own.
+
+The method is a loop: read fingerprints off a domain, ask "who else has this?"
+for each fingerprint, score what comes back, and feed every new domain back
+into the loop.
+
+**Produce:** a scored cluster with an evidence matrix, the entity chain behind
+it, and a ≤3-sentence verdict, under `reports/similar-domain/`.
+**Do not produce:** an ownership claim with no corporate evidence, a cluster
+built from one weak signal, or a list of every site on the same CDN.
+
+Paths under `references/` are relative to this skill.
+
+## Workflow
+
+Follow these steps in order. Detail:
+[references/workflow.md](references/workflow.md).
+
+| Step | Do | Gate |
+|---|---|---|
+| 0 Pre-flight | Seeds, question, jurisdiction, access limits | Stop if there is no resolvable domain; note geo-blocks and challenge pages |
+| 1 Fingerprint | Record every non-brand identifier on each domain | Every fingerprint has a source and a timestamp; local resolver artefacts are flagged |
+| 2 Pivot | Reverse-search each fingerprint for other domains | Each pivot is logged with source class and hit count; high-noise pivots are filtered by a second fingerprint |
+| 3 Expand names | Enumerate mirror and numbering variants of every brand found | Candidates are only kept if they share a fingerprint from step 1 |
+| 4 Entity | Operator, licence, address, affiliate program, terms page | Each entity fact cites a page; conflicting operator names are kept, not resolved by guess |
+| 5 Score | Weight every link; label each domain | Two independent strong signals for Confirmed; one for Probable; nothing weaker than Possible enters the cluster table |
+| 6 Loop | Send every new Confirmed or Probable domain back to step 1 | Stop when a full pass adds no new domain |
+| 7 Report | Verdict, cluster table, evidence matrix, entity chain, outliers, pivot log | ≤3-sentence verdict; no ownership wording without an entity citation |
+
+### 0 — Pre-flight
+
+Record the seed domains, what the user actually wants to know (same
+operator? mirrors? merchant background?), and any jurisdiction or time limits.
+Note what you cannot see: geo-blocks, bot challenges, private WHOIS. A blocked
+site still yields a block page, DNS, certificates, and history, so blocking is
+a finding, not a dead end. Grain and limits:
+[workflow.md](references/workflow.md).
+
+### 1 — Fingerprint
+
+[references/fingerprints.md](references/fingerprints.md). Collect
+everything about the domain that is not the brand name: registration facts,
+DNS and mail records, certificate history, analytics and pixel IDs, the
+block-page or error-page template, support-address pattern, hard-coded
+partner hosts, and naming scheme. Record each with where it came from.
+Fingerprint the seed fully before pivoting; a half-collected profile makes
+later pivots look independent when they are not.
+
+### 2 — Pivot
+
+[references/pivots.md](references/pivots.md). For each fingerprint, query the
+source class that can answer "who else has this": page-source indexes for
+analytics IDs and templates, passive DNS for nameservers and mail records,
+certificate transparency for subdomains and naming schemes, reverse WHOIS for
+registration batches. Ordinary web search does not index page source; do not
+treat an empty web-search result as a negative. Filter noisy pivots
+(shared CDN nameservers, common mail includes) by requiring a second
+fingerprint before a hit becomes a candidate.
+
+### 3 — Expand names
+
+Brands that rotate mirrors follow a scheme: numbered suffixes, hyphenated
+digits, double-dash prefixes, country TLDs. Enumerate the scheme for every
+brand found and keep only the variants that share a step-1 fingerprint.
+A name match alone is a candidate, never a member.
+
+### 4 — Entity
+
+[references/entities.md](references/entities.md). Once a brand name exists,
+collect the legal entity, licence number, address, and affiliate program from
+the site's own terms page and from review aggregators, then reverse each of
+those: licence registers list every domain under one licence, affiliate
+programs list every brand they pay for, entity names appear in other sites'
+terms pages. Keep conflicting operator names side by side with dates; operators
+migrate and the conflict is often the history.
+
+### 5 — Score
+
+[references/scoring.md](references/scoring.md). Weight each link by how hard
+it is to share by accident. One analytics account or one custom template is
+very strong; one registrar or one CDN nameserver pair is medium. Two signals
+from the same vendor account count once. Label each domain Confirmed,
+Probable, Possible, or Unrelated, and keep the reasoning visible in the
+evidence matrix.
+
+### 6 — Loop
+
+Every Confirmed or Probable domain becomes a new seed and goes through steps 1
+to 5. Possible domains are parked with the fingerprint that would promote them.
+Stop when a complete pass finds nothing new, or when the user's question is
+answered and further expansion would only add mirrors.
+
+### 7 — Report
+
+[references/report-template.md](references/report-template.md). Terms:
+[references/terminology.md](references/terminology.md).
+
+```text
+reports/similar-domain/<seed>_cluster.md
+```
+
+Lead with the verdict, then the cluster table sorted Confirmed → Probable →
+Possible, the evidence matrix (domain × fingerprint), the entity chain with
+dates, outliers that were checked and rejected, coverage caveats, and the
+pivot log. Grep banned strings after writing.
+
+## Progress
+
+Track a task plan. One item is `in_progress` at a time.
+
+1. Pass pre-flight
+2. Fingerprint every seed
+3. Run and log pivots
+4. Expand naming schemes
+5. Collect entity chain
+6. Score and label
+7. Loop until no new domain
+8. Write report and proofread
+
+## Boundary
+
+| Need | Skill |
+|---|---|
+| Related domains, mirrors, sister sites, who runs a website, merchant-site background | `similar-domain` |
+| Anything inside a transaction file: upstream streams behind a descriptor, wallet currency, preset menus, frozen-rate batches, retail constants, currency-amount ladders | `tld-detection` (`scripts/detect_streams.py`, then the ladder run) |
+| Supervised fraud labels, holdout precision/recall, rule packages | `fraud-analysis` |
+| Volume, journey, auth rate, decline mix | `payment-analysis` |
+
+A domain cluster from this skill can feed a merchant-risk decision; it is not
+itself a fraud finding. When the user also has authorization data for the
+merchant, hand that part to `tld-detection`: this skill stops at the websites,
+mirrors and operators.
+
+## Reference index
+
+| Need | Read |
+|---|---|
+| Inputs, limits, order that must not move | [workflow.md](references/workflow.md) |
+| What to collect per domain and why it identifies an operator | [fingerprints.md](references/fingerprints.md) |
+| Which source class answers each "who else" question, and the traps | [pivots.md](references/pivots.md) |
+| Operator, licence, affiliate, terms-page pivots | [entities.md](references/entities.md) |
+| Link weights, independence, labels | [scoring.md](references/scoring.md) |
+| Report chapters | [report-template.md](references/report-template.md) |
+| Language and banned strings | [terminology.md](references/terminology.md) |
+
+## Sanity check
+
+- [ ] Seeds, question, and access limits are stated; blocked sites are still fingerprinted
+- [ ] Every fingerprint has a source and a timestamp; local resolver artefacts are excluded
+- [ ] Every pivot is logged with source class, query, and hit count, including empty ones
+- [ ] Noisy pivots (CDN nameservers, common mail includes) never add a domain on their own
+- [ ] Name-scheme candidates are kept only when they share a fingerprint
+- [ ] Entity facts cite the page they came from; conflicting operator names are dated, not merged
+- [ ] Two signals from one vendor account are counted once
+- [ ] Every cluster member has a label and the matrix shows why
+- [ ] Loop ran until a full pass added nothing, or the stop reason is stated
+- [ ] Verdict is ≤3 sentences; no "owned by" without an entity citation
+- [ ] Outliers checked and rejected are listed with the reason

package/skills/payment/similar-domain/references/entities.md

@@ -0,0 +1,58 @@
+# Entities
+
+Step 4 names and dates the cluster. It runs after at least one brand name
+is known and after the technical links exist; it explains the cluster, it
+does not replace the evidence.
+
+## What to collect per brand
+
+| Fact | Where it usually is |
+|---|---|
+| Legal operator name and company number | Site footer, terms and conditions, "about" page, review aggregators |
+| Licence authority and number | Footer seal, validator link, regulator register |
+| Registered address | Terms page, regulator register |
+| Launch year and relaunches | Review aggregators, archives, certificate history |
+| Affiliate program | Footer "Affiliates" link, affiliate directories |
+| Platform vendor | Footer, script hosts, review sites |
+| Previous operators | Older reviews, forum threads, archive snapshots |
+| Complaint patterns | Review aggregators, complaint forums |
+
+Record each fact with its page and the date the page was written or
+captured. Review aggregators disagree with each other because operators
+migrate; keep every version with its date rather than picking one.
+
+## Entity pivots
+
+| Have | Reverse into | Yields |
+|---|---|---|
+| Operator name | Aggregator "owner" pages, licence register, web search of terms-page text | Brand list under that operator |
+| Licence number | Regulator register | Every licensed domain, including ones with no technical link yet |
+| Affiliate program | Affiliate directories and forums | Brands marketed together |
+| Address | Web search | Other entities at the address; treat corporate-service addresses as noise |
+| Platform vendor | Vendor's client list, review sites | Vendor-level neighbours; filter, do not add |
+| Previous operator | Same as operator name | The migration path (for example Curaçao entity → transitional entity → Anjouan entity) |
+
+## Migration patterns worth expecting
+
+Offshore operators reorganise often. Common shapes:
+
+- **Entity swap, same platform** — the brand keeps its template and
+  tokens; only the footer entity and licence change. Technical evidence
+  stays continuous; corporate evidence shows a break.
+- **Brand acquisition** — an old, once-reputable domain is bought and
+  relaunched on a new operator's platform. Registration date is old;
+  everything else matches the new cluster. Weight the technical evidence.
+- **Mirror farms** — numbered or hyphenated domains registered in batches,
+  each redirecting or serving the parent brand. They inherit every
+  fingerprint and are usually Confirmed on the first pass.
+- **White-label tenants** — several unrelated operators on one vendor
+  platform share vendor-level fingerprints but not operator-level ones.
+  This is the main source of false clusters.
+
+## Adding a domain from entity evidence alone
+
+Allowed only when the source is authoritative for domain membership: a
+regulator's licence register, or the operator's own terms page listing its
+domains. Label such domains Probable until a technical fingerprint
+confirms them. Aggregator sister-site lists are hypotheses to test, not
+grounds for membership.