@1aboveio/skills 1.0.10 → 1.0.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (213) hide show
  1. package/.codex-plugin/plugin.json +1 -1
  2. package/.codex-plugin/resources.json +297 -216
  3. package/README.md +3 -3
  4. package/package.json +10 -8
  5. package/skills/app-dev/airflow/SKILL.md +1 -1
  6. package/skills/app-dev/android-foundation/SKILL.md +35 -37
  7. package/skills/app-dev/android-foundation/references/delivery-focus.md +4 -2
  8. package/skills/app-dev/android-foundation/references/feature-work.md +50 -0
  9. package/skills/app-dev/android-foundation/references/setup.md +24 -9
  10. package/skills/app-dev/android-foundation/references/workspace.md +81 -0
  11. package/skills/app-dev/android-foundation/scripts/workspace-runtime/bin/workspaces.mjs +52 -0
  12. package/skills/app-dev/android-foundation/scripts/workspace-runtime/native-workspace.mjs +239 -0
  13. package/skills/app-dev/android-foundation/scripts/workspace-runtime/workspace-lifecycle.mjs +2154 -0
  14. package/skills/app-dev/app-debug/SKILL.md +1 -1
  15. package/skills/app-dev/better-auth/SKILL.md +1 -1
  16. package/skills/app-dev/data-catalog/SKILL.md +1 -1
  17. package/skills/app-dev/data-quality/SKILL.md +1 -1
  18. package/skills/app-dev/ios-foundation/SKILL.md +15 -10
  19. package/skills/app-dev/ios-foundation/references/setup.md +25 -9
  20. package/skills/app-dev/ios-foundation/references/workspace.md +82 -0
  21. package/skills/app-dev/ios-foundation/scripts/workspace-runtime/bin/workspaces.mjs +52 -0
  22. package/skills/app-dev/ios-foundation/scripts/workspace-runtime/native-workspace.mjs +239 -0
  23. package/skills/app-dev/ios-foundation/scripts/workspace-runtime/workspace-lifecycle.mjs +2154 -0
  24. package/skills/app-dev/monorepo/SKILL.md +1 -1
  25. package/skills/app-dev/nextjs-fullstack/SKILL.md +1 -1
  26. package/skills/app-dev/prisma-setup/SKILL.md +1 -1
  27. package/skills/app-dev/pyspark/SKILL.md +1 -1
  28. package/skills/app-dev/python-backend/SKILL.md +1 -1
  29. package/skills/app-dev/shadcn/SKILL.md +1 -1
  30. package/skills/app-dev/zod-v4/SKILL.md +1 -1
  31. package/skills/cicd/cloud-build/SKILL.md +1 -1
  32. package/skills/cicd/cloud-debug/SKILL.md +1 -1
  33. package/skills/cicd/cloud-deploy/SKILL.md +1 -1
  34. package/skills/cicd/docker/SKILL.md +1 -1
  35. package/skills/cicd/github-actions/SKILL.md +1 -1
  36. package/skills/cicd/github-flow/SKILL.md +1 -1
  37. package/skills/cicd/google-cloud/SKILL.md +1 -1
  38. package/skills/cicd/mergify/SKILL.md +1 -1
  39. package/skills/cicd/podman/SKILL.md +1 -1
  40. package/skills/content/article-review/SKILL.md +1 -1
  41. package/skills/content/article-to-image/SKILL.md +1 -1
  42. package/skills/content/flowchart-svg/SKILL.md +1 -1
  43. package/skills/content/image-gen/SKILL.md +1 -1
  44. package/skills/content/mermaid/SKILL.md +1 -1
  45. package/skills/content/wechat-article-writer/SKILL.md +1 -1
  46. package/skills/content/wechat-publisher/SKILL.md +1 -1
  47. package/skills/content/wechat-search/SKILL.md +1 -1
  48. package/skills/content/xai-search/SKILL.md +1 -1
  49. package/skills/core/distill-writing/SKILL.md +3 -3
  50. package/skills/core/distill-writing/references/extraction.md +1 -1
  51. package/skills/core/doc-to-md/SKILL.md +1 -1
  52. package/skills/core/editorial-review/SKILL.md +82 -12
  53. package/skills/core/editorial-review/references/checklist.md +26 -1
  54. package/skills/core/house-style/SKILL.md +8 -3
  55. package/skills/core/house-style/references/analytical-reporting.md +123 -0
  56. package/skills/core/house-style/references/analytical-writing-patterns.md +79 -0
  57. package/skills/core/house-style/references/analytical-writing-research.md +129 -0
  58. package/skills/core/{write-doc → house-style}/references/bilingual.md +7 -5
  59. package/skills/core/house-style/references/definitions-and-metrics.md +86 -0
  60. package/skills/core/house-style/references/document-workflow.md +193 -0
  61. package/skills/core/house-style/references/initialization.md +66 -0
  62. package/skills/core/house-style/references/persistence.md +9 -4
  63. package/skills/core/house-style/references/rules.md +11 -4
  64. package/skills/core/house-style/scripts/init-guidance.mjs +213 -0
  65. package/skills/core/house-style/templates/analytical-report.md +54 -0
  66. package/skills/core/house-style/templates/gap-analysis.md +1 -1
  67. package/skills/core/plain-language/SKILL.md +2 -2
  68. package/skills/core/polish-cn/SKILL.md +9 -2
  69. package/skills/core/reg-parser/SKILL.md +3 -3
  70. package/skills/core/terminology/SKILL.md +8 -4
  71. package/skills/core/write-doc/SKILL.md +40 -151
  72. package/skills/core/write-report/SKILL.md +129 -0
  73. package/skills/core/{write-doc → write-report}/references/compliance-reports.md +4 -4
  74. package/skills/engineering/better-review/SKILL.md +37 -37
  75. package/skills/engineering/better-review/references/passes.md +35 -41
  76. package/skills/engineering/better-review/references/result.md +10 -9
  77. package/skills/engineering/e2e-test/SKILL.md +17 -17
  78. package/skills/engineering/e2e-test/references/authoring/playwright-config.md +11 -13
  79. package/skills/engineering/e2e-test/references/presentation-sweep.md +7 -7
  80. package/skills/engineering/e2e-test/references/reviewing.md +9 -11
  81. package/skills/engineering/e2e-test/references/route-manifest.md +1 -1
  82. package/skills/engineering/engineering/SKILL.md +124 -0
  83. package/skills/engineering/engineering/references/engineering-conventions.md +32 -0
  84. package/skills/engineering/engineering/references/feature-delivery.md +8 -0
  85. package/skills/engineering/engineering/references/init-scope.md +37 -0
  86. package/skills/engineering/engineering/scripts/init.mjs +160 -0
  87. package/skills/engineering/{contributing → engineering}/scripts/persist-conventions.mjs +1 -1
  88. package/skills/engineering/engineering-runtime/SKILL.md +1 -1
  89. package/skills/engineering/engineering-runtime/coherence/workflow.json +19 -19
  90. package/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs +1 -1
  91. package/skills/engineering/ensure-coverage/SKILL.md +22 -109
  92. package/skills/engineering/ensure-coverage/references/breadth/coverage-ledger.md +7 -5
  93. package/skills/engineering/ensure-coverage/references/breadth/surface-baseline.md +4 -4
  94. package/skills/engineering/ensure-coverage/references/breadth/surface-discovery.md +3 -3
  95. package/skills/engineering/ensure-coverage/references/depth/characterization.md +4 -65
  96. package/skills/engineering/ensure-coverage/references/depth/grading.md +5 -7
  97. package/skills/engineering/ensure-coverage/references/depth/mock-policy.md +6 -12
  98. package/skills/engineering/ensure-coverage/references/enforcement/ci-contract.md +1 -1
  99. package/skills/engineering/ensure-coverage/references/presentation/axis.md +6 -6
  100. package/skills/engineering/ensure-coverage/references/process/audit-mode.md +7 -23
  101. package/skills/engineering/ensure-coverage/references/process/output-template.md +18 -133
  102. package/skills/engineering/ensure-coverage/references/process/test-strategy.md +7 -12
  103. package/skills/engineering/ensure-coverage/scripts/README.md +12 -4
  104. package/skills/engineering/golden-path/SKILL.md +1 -1
  105. package/skills/engineering/harness-runtime/SKILL.md +3 -1
  106. package/skills/engineering/harness-runtime/bin/workspaces.mjs +52 -0
  107. package/skills/engineering/harness-runtime/native-workspace.mjs +239 -0
  108. package/skills/engineering/harness-runtime/references/workspaces.md +78 -0
  109. package/skills/engineering/harness-runtime/workspace-lifecycle.mjs +2154 -0
  110. package/skills/engineering/resolve-issues/SKILL.md +40 -61
  111. package/skills/engineering/resolve-issues/references/ci.md +13 -3
  112. package/skills/engineering/resolve-issues/references/delivery-progress.md +4 -3
  113. package/skills/engineering/resolve-issues/references/done.md +11 -2
  114. package/skills/engineering/resolve-issues/references/expire.md +9 -2
  115. package/skills/engineering/resolve-issues/references/implementation.md +33 -17
  116. package/skills/engineering/resolve-issues/references/preflight.md +3 -1
  117. package/skills/engineering/resolve-issues/references/principles.md +52 -0
  118. package/skills/engineering/resolve-issues/references/review.md +25 -15
  119. package/skills/engineering/resolve-issues/references/task-plan.md +64 -27
  120. package/skills/engineering/resolve-issues/references/workspaces.md +164 -0
  121. package/skills/engineering/resolve-issues/scripts/cleanup-runs.mjs +185 -317
  122. package/skills/engineering/resolve-issues/scripts/next-actions.mjs +44 -7
  123. package/skills/engineering/resolve-issues/scripts/rehydrate.mjs +36 -2
  124. package/skills/engineering/resolve-issues/scripts/review-verdict.mjs +9 -8
  125. package/skills/engineering/resolve-issues/scripts/workspace-lifecycle.mjs +1 -0
  126. package/skills/engineering/resolve-release/SKILL.md +1 -1
  127. package/skills/engineering/rush-issues/SKILL.md +7 -5
  128. package/skills/engineering/rush-release/SKILL.md +1 -1
  129. package/skills/engineering/test-quality/SKILL.md +19 -4
  130. package/skills/engineering/test-quality/references/lint.md +1 -1
  131. package/skills/engineering/test-quality/references/principles.md +2 -2
  132. package/skills/engineering/test-quality/references/testing-conventions.md +1 -1
  133. package/skills/risk-compliance/compliance-audit/SKILL.md +4 -8
  134. package/skills/risk-compliance/compliance-audit/references/audience-and-reports.md +12 -0
  135. package/skills/risk-compliance/contract-compare/SKILL.md +17 -1
  136. package/skills/risk-compliance/contract-review/SKILL.md +6 -1
  137. package/skills/risk-compliance/contract-review/references/report-stage.md +17 -0
  138. package/skills/risk-compliance/doc-authenticity/SKILL.md +11 -1
  139. package/skills/risk-compliance/fraud-detection/LICENSE +3 -0
  140. package/skills/risk-compliance/fraud-detection/SKILL.md +148 -0
  141. package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/archetypes/first-party-fraud.md +3 -2
  142. package/skills/risk-compliance/fraud-detection/references/archetypes/third-party-fraud.md +47 -0
  143. package/skills/risk-compliance/fraud-detection/references/collection-payout-features.md +151 -0
  144. package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/contexts/bank-transfer.md +4 -3
  145. package/skills/risk-compliance/fraud-detection/references/contexts/card-payment.md +70 -0
  146. package/skills/risk-compliance/fraud-detection/references/contexts/payment-collection.md +34 -0
  147. package/skills/risk-compliance/fraud-detection/references/contexts/payout.md +34 -0
  148. package/skills/risk-compliance/fraud-detection/references/enrichment.md +74 -0
  149. package/skills/risk-compliance/fraud-detection/references/entities.md +48 -0
  150. package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/feature-engineering.md +69 -33
  151. package/skills/risk-compliance/fraud-detection/references/feature-sql.md +150 -0
  152. package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/report-rationale.md +4 -2
  153. package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/report-template.md +45 -23
  154. package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/review-checklist.md +60 -20
  155. package/skills/risk-compliance/fraud-detection/references/workflow.md +216 -0
  156. package/skills/risk-compliance/fraud-detection/release-check.mjs +95 -0
  157. package/skills/risk-compliance/payment-analysis/SKILL.md +36 -17
  158. package/skills/risk-compliance/payment-analysis/references/auth-rate-actions.md +2 -2
  159. package/skills/risk-compliance/payment-analysis/references/report-template.md +10 -2
  160. package/skills/risk-compliance/payment-analysis/references/visualization.md +11 -1
  161. package/skills/risk-compliance/portfolio-payment-analysis/LICENSE +3 -0
  162. package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md +170 -0
  163. package/skills/risk-compliance/portfolio-payment-analysis/references/identity-and-reconciliation.md +46 -0
  164. package/skills/risk-compliance/portfolio-payment-analysis/references/metrics-and-reporting.md +170 -0
  165. package/skills/risk-compliance/portfolio-payment-analysis/references/risk-history.md +89 -0
  166. package/skills/risk-compliance/portfolio-payment-analysis/release-check.mjs +95 -0
  167. package/skills/risk-compliance/portfolio-payment-analysis/scripts/analyze.py +636 -0
  168. package/skills/risk-compliance/portfolio-payment-analysis/scripts/build_report.py +386 -0
  169. package/skills/risk-compliance/portfolio-payment-analysis/scripts/comparison_charts.py +425 -0
  170. package/skills/risk-compliance/portfolio-payment-analysis/scripts/csv_export.py +52 -0
  171. package/skills/risk-compliance/portfolio-payment-analysis/scripts/render.py +160 -0
  172. package/skills/risk-compliance/portfolio-payment-analysis/scripts/risk_history.py +435 -0
  173. package/skills/risk-compliance/similar-domain/SKILL.md +9 -4
  174. package/skills/risk-compliance/tld-detection/SKILL.md +124 -239
  175. package/skills/risk-compliance/tld-detection/agents/openai.yaml +1 -1
  176. package/skills/risk-compliance/tld-detection/references/clean.md +18 -51
  177. package/skills/risk-compliance/tld-detection/references/fx-conversion.md +56 -219
  178. package/skills/risk-compliance/tld-detection/references/metric-contract.md +109 -0
  179. package/skills/risk-compliance/tld-detection/references/pattern.md +99 -0
  180. package/skills/risk-compliance/tld-detection/references/report-template.md +49 -272
  181. package/skills/risk-compliance/tld-detection/scripts/detect_ladders.py +46 -13
  182. package/skills/risk-compliance/tld-detection/scripts/detect_patterns.py +346 -0
  183. package/skills/risk-compliance/tld-detection/scripts/detect_streams.py +51 -19
  184. package/skills/risk-compliance/tld-detection/scripts/profile_groups.py +109 -0
  185. package/skills/risk-compliance/tld-detection/scripts/render_charts.py +218 -0
  186. package/skills/risk-compliance/tld-detection/scripts/tld_common.py +243 -0
  187. package/skills/engineering/contributing/SKILL.md +0 -70
  188. package/skills/risk-compliance/fraud-analysis/SKILL.md +0 -114
  189. package/skills/risk-compliance/fraud-analysis/references/archetypes/third-party-fraud.md +0 -27
  190. package/skills/risk-compliance/fraud-analysis/references/contexts/card-payment.md +0 -30
  191. package/skills/risk-compliance/fraud-analysis/references/contexts/payment-collection.md +0 -20
  192. package/skills/risk-compliance/fraud-analysis/references/contexts/payout.md +0 -20
  193. package/skills/risk-compliance/fraud-analysis/references/workflow.md +0 -175
  194. package/skills/risk-compliance/tld-detection/references/chinese-polish.md +0 -55
  195. package/skills/risk-compliance/tld-detection/references/clustering.md +0 -235
  196. package/skills/risk-compliance/tld-detection/references/decision.md +0 -189
  197. package/skills/risk-compliance/tld-detection/references/streams.md +0 -141
  198. package/skills/risk-compliance/tld-detection/references/terminology.md +0 -95
  199. package/skills/risk-compliance/tld-detection/references/workflow.md +0 -95
  200. /package/skills/{engineering/contributing → core/write-report}/LICENSE +0 -0
  201. /package/skills/core/{write-doc → write-report}/references/reports/audit-report-template.md +0 -0
  202. /package/skills/core/{write-doc → write-report}/references/reports/external-assessment-template.md +0 -0
  203. /package/skills/core/{write-doc → write-report}/references/reports/management-report-template.md +0 -0
  204. /package/skills/core/{write-doc → write-report}/references/reports/vars-report-template.md +0 -0
  205. /package/skills/{engineering/contributing → core/write-report}/release-check.mjs +0 -0
  206. /package/skills/{risk-compliance/fraud-analysis → engineering/engineering}/LICENSE +0 -0
  207. /package/skills/engineering/{contributing → engineering}/references/tracker-conventions.md +0 -0
  208. /package/skills/{risk-compliance/fraud-analysis → engineering/engineering}/release-check.mjs +0 -0
  209. /package/skills/engineering/{contributing → engineering}/scripts/persist-conventions-core.mjs +0 -0
  210. /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/archetypes/authorized-payment-scam.md +0 -0
  211. /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/mechanisms/account-takeover.md +0 -0
  212. /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/taxonomy.md +0 -0
  213. /package/skills/risk-compliance/{fraud-analysis → fraud-detection}/references/terminology.md +0 -0
@@ -1,245 +1,130 @@
1
1
  ---
2
2
  name: tld-detection
3
3
  description: >
4
- Explicit-only. Potential TLD (transaction-laundering) clusters from an
5
- authorization extract: payment-pattern inference (direct or FX-converted
6
- top-up hypotheses, e-commerce patterns, fixed-amount characteristics), then
7
- descriptor-local exact original-currency amount pairs plus a separate
8
- BIN-country base-currency FX sensitivity when requested or indicated, with
9
- same-descriptor baseline contrasts, high/medium/low risk
10
- tiers, exposure sizing, and a plain-language investigation conclusion
11
- with a ≤3-sentence summary.
12
- Not payment-analysis, fraud-analysis, or website research (similar-domain).
4
+ Explicit-only. Investigate potential transaction-laundering patterns in
5
+ transaction data using amount concentration, escalating amounts and pricing
6
+ patterns, with USD and BIN-country currency views, group profiles and priorities.
7
+ Not payment-analysis, fraud-detection, or website research.
13
8
  disable-model-invocation: true
14
- release-version: 0.44.1
9
+ release-version: 0.45.0
15
10
  ---
16
11
  **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
17
- # TLD Detection
18
-
19
- Find **potential TLD clusters** in an authorization extract. TLD here is
20
- transaction laundering, not a domain name: hidden activity stuffed under a
21
- normal MCC, often mixed across descriptors.
22
-
23
- First partition the cleaned authorizations by **descriptor**, then infer
24
- **payment patterns** inside each descriptor: a billing name is not a verified
25
- merchant identity. Patterns describe observed amount and behavior features;
26
- they do not partition canonical detection. The clustering key remains the
27
- original **currency-amount-pair** within the whole descriptor. Geometric
28
- relationships between exact anchors are a stuffing signal (掺量), not proof
29
- of hidden business. Presets converted from an inferred top-up currency can
30
- vary across dates and fragment exact ladders; pattern inference provides
31
- separate context for those observations. BIN country and inferred patterns
32
- are not canonical membership keys.
33
-
34
- The original-currency run is canonical. When the user requests home/base-
35
- currency detection, or when date-varying transaction amounts may conceal fixed
36
- prices in card-origin currencies, add the separate BIN-country base-currency
37
- FX sensitivity in [references/fx-conversion.md](references/fx-conversion.md).
38
- Never merge its `FXC*` membership, exposure, or risk tiers into canonical
39
- `C*` results.
40
-
41
- **Produce:** a concise investigation report, complete linked evidence, and a
42
- separate run-specific methodology document
43
- under `reports/tld-detection/`.
44
- **Do not produce:** confirmed laundering, a legal finding, or supervised
45
- fraud-rule packages (`fraud-analysis`).
46
-
47
- Paths under `references/` are relative to this skill.
48
-
49
- ## Workflow
50
-
51
- For a new analysis, follow these steps in order. For presentation-only work,
52
- first locate the accepted saved results, complete evidence, methodology, and
53
- original chart inventory. Verify their revision and scope, then go directly to
54
- step 5; do not rerun steps 1–4 or reinterpret accepted findings. If needed facts
55
- or charts are unavailable, disclose the gap and request the source artifacts
56
- instead of silently rebuilding them. Detail:
57
- [references/workflow.md](references/workflow.md).
58
-
59
- | Step | Do | Gate |
60
- |---|---|---|
61
- | 0 Pre-flight | File, grain, columns, window | Stop if auth grain, descriptor, amount, or currency column is missing; caption missing BIN country |
62
- | 1 Clean | Dedup | Record drop counts; do not filter BIN country |
63
- | 1b Patterns | Infer payment patterns with `scripts/detect_streams.py`; use direct top-up, FX-converted top-up, e-commerce, or other names; fixed amounts are a supplementary characteristic | Show coverage, inferred top-up currency, actual charge currency, and tested rate consistency; retain other and small-sample groups; names are hypotheses |
64
- | 2 Cluster | Run canonical detection on all cleaned attempts in each descriptor, irrespective of inferred pattern; add FX sensitivity separately; freeze exact keys and same-descriptor baseline | Partition = descriptor only; ≥3 levels; adjacent levels = 2x; ≥100 attempts; absolute residual cap per candidate currency |
65
- | 3 Risk | Assign high/medium/low investigation priority | In canonical results, Mixed BIN countries are neutral and exact 100% single-country concentration is a standout; FX concentration is descriptive only and cannot raise tier |
66
- | 4 Decision | Who to review, why, what is unknown, and what to check next | Summary ≤3 short sentences; supporting explanation allowed; no new evidence |
67
- | 5 Report | Answer highest-risk, cluster-characteristic, and exposure questions; write; `editorial-review`; `polish-cn` on Chinese; proofread | Preserve facts and tiers; sort high → medium → low; no confirmed-TLD wording |
68
-
69
- ### 0 — Pre-flight
70
-
71
- Authorization extract, one row per auth attempt. Record paths, time field,
72
- amount, currency, BIN/issuer country, descriptor, MCC, response. Grain and
73
- column aliases: [workflow.md](references/workflow.md).
74
-
75
- ### 1 — Clean
76
-
77
- [references/clean.md](references/clean.md). Deduplicate first. Do not
78
- FX-convert the canonical clustering key. Do not drop non-US BIN rows.
79
-
80
- ### 1b — Payment patterns
81
-
82
- [references/streams.md](references/streams.md). Run
83
- `scripts/detect_streams.py` on the cleaned universe with a daily FX cache.
84
- Use **Direct top-up pattern / 直接充值模式**, **FX-converted top-up pattern /
85
- 换汇充值模式**, **E-commerce pattern / 电商模式**, and **Other pattern /
86
- 其他模式** in reader-facing reports. Compare the inferred top-up currency
87
- with the actual charge currency, not BIN-country legal tender, to distinguish
88
- direct from FX-converted top-ups. Fixed amounts are an additional feature,
89
- not a separate business class or proof of a fixed conversion rate. Raw `stream`
90
- labels remain available for audit. These inferred patterns cannot change
91
- canonical members, thresholds, or the same-descriptor baseline.
92
-
93
- ### 2 — Cluster
94
-
95
- [references/clustering.md](references/clustering.md). Build normalized
96
- descriptor partitions, then rank currency-amount-pairs inside each descriptor. Use
97
- `scripts/detect_ladders.py` to detect geometric anchor relationships with
98
- adjacent, currency-specific absolute residual caps. Every cluster must contain
99
- at least three theoretical levels with a fixed 2x relationship between adjacent
100
- levels (for example 1x, 2x, 4x, 8x); search both up and down from every candidate
101
- seed. A theoretical level may
102
- keep multiple exact anchors, but each additional anchor must clear the stated
103
- portfolio support floor. Freeze membership by exact descriptor, currency,
104
- and amount; keep only clusters with ≥100 authorization attempts. Compare each
105
- cluster with the baseline formed by removing that cluster from the same
106
- descriptor. Do not invent clusters from MCC or comparison features.
107
-
108
- If the FX sensitivity applies, run it only after the cleaned universe and
109
- canonical partitions are frozen. Follow
110
- [references/fx-conversion.md](references/fx-conversion.md) and its mandated
111
- Frankfurter v2 request/cache contract. Within each frozen canonical descriptor
112
- partition, `|P_FX|` is only its exact-date-converted attempts; use only `P_FX`
113
- for FX high-count and rung-pool thresholds and the FX same-descriptor baseline.
114
- Excluded rows stay outside FX detection and appear only in exclusion coverage
115
- and reconciliation to canonical `U`. Use `FXC1`, `FXC2`, ... ids and publish
116
- separate result and methodology files. Because BIN country constructs the
117
- target currency in this view, country concentration, including 100%, is
118
- descriptive only and cannot raise the FX tier.
119
-
120
- ### 3 — Risk
121
-
122
- [references/decision.md](references/decision.md). Assign every identified
123
- currency-amount pair exactly one investigation-priority tier: High, Medium,
124
- or Low. In canonical results, BIN-country mixture is neutral and exact 100%
125
- single-country concentration is a standout; separately report descriptor-
126
- country slice coverage without a threshold or risk points. In FX results,
127
- country concentration remains descriptive because it constructs the target
128
- currency and is not independent risk evidence.
129
-
130
- ### 4 — Decision
131
-
132
- Write a business-readable investigation conclusion following
133
- [references/decision.md](references/decision.md): who to review first, why,
134
- what remains unknown, and what evidence to check next. Limit the summary to
135
- **at most 3 short sentences**, not the full explanation. Keep detailed amounts
136
- and exposure in supporting tables; no qualifying cluster does not mean low risk.
137
-
138
- ### 5 — Report
139
-
140
- [references/report-template.md](references/report-template.md). Use three main
141
- sections: Period conclusion, Main findings, Next checks (Month conclusion for
142
- monthly reports). Within each finding, explain observed evidence before the
143
- payment-pattern hypothesis and its reconciled relationship to amount clusters.
144
- Pattern count is not a count of upstream businesses. If a supported menu has
145
- non-doubling presets, explicitly explain in the finding why its prices need
146
- not satisfy the formal cluster gate; do not leave that distinction implicit
147
- in separate amount lists. Terms:
148
- [references/terminology.md](references/terminology.md).
149
-
150
- Use the main-report, evidence, and methodology filenames listed in
151
- [report-template.md](references/report-template.md); provide matching Chinese
152
- Markdown and HTML where required.
153
-
154
- Keep the main report selective: supported findings and useful original charts,
155
- not repeated conclusions or exhaustive tables. Preserve every identified
156
- cluster, its descriptor share, comparisons, and by-tier/by-descriptor exposure
157
- in complete linked evidence. Sort High → Medium → Low, then by evidence
158
- strength and attempts inside each tier. Put the
159
- actual run's cleaning, partitioning, parameter selection, sensitivity evidence,
160
- baseline definition, and audit details in the methodology documents; link the
161
- three document types together. HTML is preferred when there are charts.
162
- Use new revision-qualified paths for delivered revisions; never overwrite prior
163
- outputs. Presentation-only revisions reuse frozen results without rerunning
164
- inference, detection, or risk assignment. Retain all valid original charts,
165
- putting important amount/rate charts inline and secondary views in expandable
166
- sections; verify chart payload fidelity and desktop/mobile rendering.
167
- Review the written documents with `editorial-review`
168
- (`{editorial-review baseDir}/SKILL.md`), naming
169
- [references/report-template.md](references/report-template.md) as its template. For Chinese deliverables,
170
- including a Chinese final chat handoff, then run `polish-cn`
171
- (`{polish-cn baseDir}/SKILL.md`) with the coverage, protected terms and guardrails in
172
- [references/chinese-polish.md](references/chinese-polish.md). Then verify factual
173
- fidelity, synchronize Markdown and HTML, and grep banned strings before delivery.
174
-
175
- ## Progress
176
-
177
- Track a task plan. One item is `in_progress` at a time.
178
-
179
- 1. Pass pre-flight
180
- 2. Freeze cleaned universe and descriptor partitions
181
- 2b. Infer payment patterns and record them per descriptor without splitting detection
182
- 3. Assign High / Medium / Low risk tiers
183
- 4. Publish complete cluster evidence + same-descriptor baselines
184
- 5. Write main report: conclusion (≤3 sentences), findings, next checks
185
- 6. Link report, evidence, and run methodology; retain charts and prior revisions; run `editorial-review`, then `polish-cn` on Chinese; verify and proofread
186
-
187
- ## Boundary
188
-
189
- | Need | Skill |
190
- |---|---|
191
- | Potential TLD clusters, currency-amount pairs, stuffing / 掺量, MCC miscoding, descriptor mixing, upstream streams behind one descriptor | `tld-detection` |
192
- | Which websites, mirrors and operators sit behind a merchant domain | `similar-domain` |
193
- | Volume, journey Sankey, auth rate, decline mix, settlement overview | `payment-analysis` |
194
- | Proxy/confirmed fraud labels, holdout precision/recall, rule packages | `fraud-analysis` |
195
-
196
- A suspected-fraud *rate contrast* in this skill is not a fraud-analysis
197
- rule package.
198
-
199
- ## Reference index
200
-
201
- | Need | Read |
202
- |---|---|
203
- | Grain, columns, window | [workflow.md](references/workflow.md) |
204
- | Dedup | [clean.md](references/clean.md) |
205
- | Payment-pattern names, direct vs FX-converted top-ups, fixed-amount characteristics, behavior metrics | [streams.md](references/streams.md) |
206
- | Currency-amount pairs, anchors, same-descriptor baseline | [clustering.md](references/clustering.md) |
207
- | BIN-country base-currency FX sensitivity | [fx-conversion.md](references/fx-conversion.md) |
208
- | Business-readable conclusion and ≤3-sentence summary | [decision.md](references/decision.md) |
209
- | Report chapters | [report-template.md](references/report-template.md) |
210
- | Chinese polish coverage, protected terms, and fidelity checks | [chinese-polish.md](references/chinese-polish.md) |
211
- | Language / banned strings | [terminology.md](references/terminology.md) |
212
-
213
- ## Sanity check
214
-
215
- - [ ] Auth grain; dedup counts are stated; no BIN-country row filter
216
- - [ ] Partition key is normalized descriptor; missing descriptor is an explicit bucket
217
- - [ ] Payment-pattern inference ran; direct/FX-converted top-up, e-commerce, and other labels are hypotheses; inferred top-up and actual charge currencies are separate
218
- - [ ] Fixed amounts are a supplementary characteristic; fixed FX requires tested source-to-top-up rate movement, not same-currency prices or untested `live` labels
219
- - [ ] Canonical detection, exact membership, thresholds, and baseline use the whole descriptor; inferred patterns and BIN-country groups never filter members
220
- - [ ] Clustering key is original currency + amount, not USD
221
- - [ ] Canonical `C*` results use original amounts; any FX run is separate, uses `FXC*` ids, and does not alter canonical membership or exposure
222
- - [ ] FX run records as-of-date country→legal-tender mapping, the versioned immutable Frankfurter v2 exact-date request/cache facts, formula, minor-unit rounding, exclusions, and converted-universe coverage
223
- - [ ] Within each frozen descriptor, `|P_FX|` contains only exact-date-converted attempts; FX thresholds and same-descriptor baselines use only `P_FX`, while exclusions reconcile only to canonical `U`
224
- - [ ] FX country concentration is descriptive only because BIN country constructs the target currency; it does not independently raise risk
225
- - [ ] Each rung-pool currency has an explicit adjacent absolute-residual cap and sensitivity evidence
226
- - [ ] Multi-anchor levels state their portfolio support floor; final membership uses exact selected amount keys
227
- - [ ] Cluster attempts ≥100
228
- - [ ] Every cluster has a High / Medium / Low risk tier and results sort in that order
229
- - [ ] Currency-amount pairs show seed and representative anchors; `*` marks a multi-amount level
230
- - [ ] Same amount pair may recur across descriptor partitions; never merge them automatically
231
- - [ ] BIN country is post-membership reporting data, not a membership key; Mixed is neutral
232
- - [ ] Canonical exact 100% single-country concentration is a standout; FX concentration is descriptive only; descriptor-country coverage has no risk threshold
233
- - [ ] Each cluster baseline is the same descriptor after removing that cluster
234
- - [ ] Complete linked evidence, not the main report, uses one consolidated profile/comparison table per cluster; descriptor, seed, anchors, attempts, descriptor totals/share, MCC, and baseline metrics are not repeated in separate definition/characteristic/metric tables
235
- - [ ] Anchor table reports attempts, authorization success rate, and suspected-fraud share for every level, including n < 30
236
- - [ ] Characteristics contain descriptor total, cluster attempts/share, MCC, and cluster-vs-baseline auth rate, suspected-fraud share, top 3 banks, and top 3 BIN countries
237
- - [ ] Summary is ≤3 short sentences; explanation answers who to review, why, what remains unknown, and what to check next without decoding technical labels
238
- - [ ] No qualifying cluster is not described as low merchant risk; unqualified leads have no cluster tier or cluster exposure; current-period findings are separate from historical results
239
- - [ ] Report answers highest-risk, identified-cluster characteristics, and by-tier/by-descriptor exposure
240
- - [ ] Main report has exactly three sections: conclusion, findings, next checks; findings explain observations before hypotheses and reconciled cluster relationships
241
- - [ ] Main report, complete evidence, and methodology are separate and mutually linked; prior revisions and frozen facts remain intact
242
- - [ ] Valid original chart payloads are retained; important amount/rate charts are inline, secondary charts render on expansion, and desktop/mobile views are nonblank without page overflow
243
- - [ ] Zero families → ranking only; no descriptor-invented clusters
244
- - [ ] Language matches terminology.md; no confirmed-laundering claim
245
- - [ ] Documents passed `editorial-review`; Chinese report, evidence, methodology, chart captions, and handoff passed `polish-cn`; the model that ran is recorded, facts are unchanged, and Markdown / HTML agree
12
+ # TLD detection
13
+
14
+ Find patterns that warrant investigation, not proof of transaction laundering
15
+ (TLD). Declare selection thresholds and rating criteria before interpreting results.
16
+
17
+ ## Data contract
18
+
19
+ One row represents one **transaction**. Require transaction time, transaction ID,
20
+ currency, amount, MCC, billing descriptor, MID, card scheme, card BIN, card issuer,
21
+ and card BIN country. Record column aliases, types and missingness. Use the requested
22
+ reporting period; otherwise state the cleaned data's observed time range.
23
+
24
+ Missing required columns or unresolved transaction identities block analysis.
25
+ Request the data or an explicit aggregation rule; do not substitute authorization
26
+ attempts or orders. A constant MID needs an established value and scope. The prepared
27
+ script input requires nonempty identity and business fields; resolve missing values
28
+ before running it. BIN country may be null: retain that transaction in USD if valid,
29
+ and explicitly exclude its BIN-country view. Status fields may independently be
30
+ unknown. Never invent missing dimensions or merge unknown scopes.
31
+ Follow [transaction preparation](references/clean.md) for deduplication and normalization.
32
+
33
+ Rates additionally require transaction-level authorization status and a suspected-
34
+ fraud indicator or documented response-code mapping. Missing status is unknown,
35
+ not failure or zero fraud. Report coverage and withhold complete-population rates
36
+ when classifications are incomplete. A separately labeled known-only rate may
37
+ accompany coverage, but cannot replace the requested total-denominator rate.
38
+
39
+ ## 1. Pattern sniffing
40
+
41
+ Prepare two views from the same cleaned transactions: **USD-converted amounts**
42
+ and **BIN-country-currency amounts**. Follow [FX conversion](references/fx-conversion.md)
43
+ for dated mappings, exact-date quotes, rounding and exclusions. Partition each view
44
+ by MID, normalized billing descriptor and target currency within the reporting period.
45
+ Keep the views distinct even when both target USD.
46
+
47
+ Look independently for:
48
+
49
+ - **Amount concentration:** repeated prices such as 8.00 or 9.9. Declare minimum
50
+ transaction count and share before selection; a concentration needs no ladder.
51
+ - **Escalating amounts:** doubling prices such as 8, 16, 32, 64. Default to at least
52
+ three levels and 100 transactions. Keep the multiplier at 2x; record any changes
53
+ to level count, minimum support or discovery tolerances.
54
+ - **Pricing patterns:** supported preset menus such as 10, 20, 50, FX-converted
55
+ menus, or retail-like prices sharing a fitted multiplier. Keep inferred pricing
56
+ currency separate from charge currency and BIN-country currency.
57
+
58
+ Read [pattern.md](references/pattern.md) for detection methods, eligibility and
59
+ membership. Freeze exact transaction IDs for every group and amount keys where
60
+ applicable. Retain below-threshold and insufficient-evidence candidates without
61
+ priority tiers. Pricing groups follow the same profiling and rating steps; they do
62
+ not need to pass the escalation gates.
63
+
64
+ Supply prepared transaction views; these scripts do not fetch rates or prepare
65
+ live FX conversions. Follow the [script and metric contract](references/metric-contract.md)
66
+ for the dataset schema, exclusions, output schemas and formulas. Replace `{baseDir}`
67
+ with the absolute skill directory and use thresholds agreed for the analysis. Input and
68
+ output paths below are relative to the working directory; these values are examples:
69
+
70
+ ```bash
71
+ python3 "{baseDir}/scripts/detect_patterns.py" dataset.json groups.json \
72
+ --pattern concentration --concentration-min-count 30 --concentration-min-share .2 \
73
+ --pattern escalating --cap USD=.15 \
74
+ --pattern pricing --pricing-currency EUR --pricing-rates rates.json
75
+ python3 "{baseDir}/scripts/profile_groups.py" dataset.json groups.json profile.json
76
+ python3 "{baseDir}/scripts/render_charts.py" profile.json charts.html --overwrite
77
+ ```
78
+
79
+ Give `--cap` for every target currency in the prepared views. `--pricing-rates`
80
+ is optional and supplies an exact-date adapter, not a live feed; see
81
+ [pattern.md](references/pattern.md). Pricing quotes use UTC transaction dates;
82
+ profiles use the declared reporting timezone. `profile_groups.py` accepts optional `--tier-edges`
83
+ followed by sorted decimal boundaries. Outputs refuse replacement unless
84
+ `--overwrite` is explicit; omit it above for a new chart path.
85
+
86
+ ## 2. Group profiling
87
+
88
+ Compare each eligible group with the **out-group**: converted transactions in the
89
+ same MID, descriptor, view, target currency and period, minus that group's IDs.
90
+ Other groups remain in the out-group; conversion exclusions do not. Save membership
91
+ and population counts. Groups can overlap across patterns or views: use the union
92
+ of transaction IDs for combined totals and state how overlapping tiers are handled.
93
+
94
+ For both populations, present daily amount-tier counts, success and suspected-fraud
95
+ rates, transaction counts and shares, and 24-hour counts. Declare the timezone,
96
+ default UTC, and show status coverage and unavailable rates. See the
97
+ [metric contract](references/metric-contract.md) for denominators, zero-filling and
98
+ reconciliation. Add issuer, BIN-country, MCC and card-scheme composition where useful.
99
+
100
+ ## 3. Rating and decision
101
+
102
+ Assign **investigation priority** from independent, material profile differences:
103
+
104
+ - **High:** several independent, materially adverse observations converge.
105
+ - **Medium:** at least two independent material differences warrant follow-up,
106
+ but High is not supported.
107
+ - **Low:** adequate observed evidence provides little corroboration beyond the
108
+ amount pattern. Insufficient evidence leaves a group unrated, not automatically Low.
109
+
110
+ State the basis, sample size, materiality criteria and confidence. Avoid counting
111
+ correlated observations twice or inventing a calibrated numeric score. BIN country
112
+ constructs the target currency in that view, so its concentration cannot independently
113
+ raise priority. MCC and descriptor alone do not establish a business mismatch.
114
+ No qualifying group does not establish low merchant risk.
115
+
116
+ Explain whom to review, why, what remains unknown, and which orders, products,
117
+ sellers or fulfillment records to check next. Do not claim unperformed checks or
118
+ recommend enforcement from these patterns alone. Keep current and historical findings
119
+ separate.
120
+
121
+ ## Deliver
122
+
123
+ Write a concise report in the requested language, preserving evidence, methodology
124
+ and useful charts under revision-qualified paths in `reports/tld-detection/`.
125
+ Read `{house-style baseDir}/references/analytical-reporting.md` and its required
126
+ references, and use `{write-report baseDir}/SKILL.md` with the frozen analysis for the
127
+ report stage. If a required skill or reference is unavailable, report the blocker.
128
+ Follow [reporting](references/report-template.md) for evidence contents, terminology,
129
+ review and presentation-only revisions; do not rerun analysis for report writing. The scripts produce detection, profiles and
130
+ charts; interpretation, priority and the final report still require analyst judgment.
@@ -1,6 +1,6 @@
1
1
  interface:
2
2
  display_name: "TLD Detection"
3
- short_description: "Risk-tiered TLD clusters from exact currency-amount pairs"
3
+ short_description: "Investigate transaction amount patterns across currency views"
4
4
 
5
5
  policy:
6
6
  # Codex counterpart to SKILL.md disable-model-invocation: true
@@ -1,51 +1,18 @@
1
- # Data cleaning
2
-
3
- Run on the authorization extract before any clustering. Record every drop
4
- count in the run-specific methodology and retain the cleaned census in linked evidence.
5
-
6
- Do not filter to US-BIN here. Issuer country remains available for the
7
- cluster-versus-baseline Top 3 BIN-country comparison.
8
-
9
- ## 1. Exact-row dedup
10
-
11
- Drop bitwise-duplicate rows (same values in every column used). Count
12
- them. They are extract artefacts, not extra attempts.
13
-
14
- ## 2. Identity dedup
15
-
16
- If `Transaction ID` / `Auth ID` is unique when present, keep one row per
17
- id (first by time).
18
-
19
- Otherwise, if `Order ID` is present, keep one row per
20
- (`Order ID`, time, amount, currency, masked PAN / last4 if present).
21
- Retries of the same order at different times stay distinct.
22
-
23
- If none of those identities exist, **skip this step** — keep the
24
- exact-row-deduped table and say identity-dup was skipped. Do not stop
25
- the run. Do not invent a customer id from BIN + amount.
26
-
27
- ## 3. Amount and currency
28
-
29
- - The canonical clustering key uses the **original** amount and currency. A BIN-country base-currency sensitivity may derive a separate key only after this cleaned universe is frozen; see [fx-conversion.md](fx-conversion.md).
30
- - Normalize `10`, `10.0`, `10.00` to the same decimal key.
31
- - Drop rows with missing amount or currency; count them.
32
- - Do not FX-convert before clustering. A 9.99 EUR rung is not a 9.99 USD
33
- rung. Amount sums later stay inside one currency; never add EUR to USD.
34
-
35
- ## 4. Missing dimensions
36
-
37
- Rows with missing descriptor or BIN / issuer country stay in the
38
- clustering universe. Missing descriptors enter the `UNKNOWN_DESCRIPTOR`
39
- partition; missing countries enter the `UNKNOWN_BIN_COUNTRY` reporting
40
- bucket after membership is frozen.
41
-
42
- ## Output of this step
43
-
44
- A cleaned table plus a one-line census:
45
-
46
- ```
47
- raw N → exact-dup drop n1 → identity-dup drop n2 (or skipped)
48
- → missing amount/currency n3 → cleaned universe U
49
- ```
50
-
51
- All later attempt counts use `U`, not `raw N`.
1
+ # Transaction preparation
2
+
3
+ Record source rows, duplicate removals, unresolved IDs, exclusions and the final
4
+ transaction count. Remove only demonstrably identical extract duplicates. Inspect
5
+ all rows sharing a transaction ID: conflicting times, statuses, amounts or other
6
+ events may represent retries or state changes. Never keep the first row by default
7
+ or collapse conflicting records without an explicit, documented transaction-level
8
+ aggregation rule. If no rule resolves them, stop and ask; do not silently switch
9
+ to authorization-attempt or order grain. Preserve a row-to-transaction audit map.
10
+
11
+ Normalize currency codes, exact decimal amounts and descriptor whitespace/case;
12
+ do not fuzzy-merge descriptors or strip suffixes without documented semantics.
13
+ Keep MID separate. Resolve missing identity and business values before preparing
14
+ script input; the validator rejects incomplete required values instead of silently
15
+ dropping rows. BIN country and metric statuses are the documented exceptions.
16
+ Keep rows with missing BIN country in the USD view when otherwise valid;
17
+ they cannot enter the BIN-country view without a valid mapping. See
18
+ [FX conversion](fx-conversion.md). Never sum amounts in different currencies.