@1aboveio/skills 1.0.9 → 1.0.11

package/skills/risk-compliance/tld-detection/references/decision.md

@@ -1,189 +0,0 @@
-# Risk decision
-
-After currency-amount-pair detection and same-descriptor baseline comparison,
-assign investigation-priority risk tiers. This is prioritization, not a finding
-that transaction laundering occurred.
-
-## Eligibility versus risk
-
-The cluster gate (at least three theoretical levels, fixed 2x adjacency, at
-least 100 exact-member attempts) determines which currency-amount pairs enter
-the result. Passing that gate does not by itself determine High, Medium, or Low
-risk.
-
-Risk uses independent post-membership evidence:
-
-- structural strength beyond the minimum, such as a fourth or later level
-- cluster share of its descriptor
-- authorization-success and suspected-fraud differences versus the same-
-  descriptor baseline
-- issuing-bank differences versus that baseline
-- transaction-date and BIN-country-local-hour differences versus that baseline
-- externally evidenced MCC or merchant-business mismatch; never infer this
-  from a suggestive descriptor name alone
-- payment-pattern evidence from [streams.md](streams.md), treated as separate
-  observations with known coverage and inference limits: unexpected inferred
-  pricing currency, tested source-to-top-up rate stability, low repeat-card or
-  decline-retry activity, and concentrated dates/hours. Do not count a business
-  hypothesis itself or correlated measurements as independent corroboration.
-
-Declare portfolio-specific thresholds for a materially different rate,
-distribution, or descriptor share in the run methodology before assigning
-risk. Do not invent universal cutoffs after seeing the results.
-
-## BIN-country evidence
-
-BIN country is post-membership evidence, not a partition, membership key, or
-veto. Pattern inference can use country to propose pricing currencies but
-cannot filter canonical members. Measure any canonical single-country
-concentration on the complete descriptor/currency/amount membership, never
-on a country-selected pattern slice as independent risk evidence. `Mixed` is neutral and must never reduce a risk tier by itself.
-
-For every Top 3 cluster BIN country, report both conditional views:
-
-```text
-cluster composition = cluster attempts in country / all cluster attempts
-country-slice coverage = cluster attempts in country /
-                         all attempts in the same descriptor and country
-```
-
-An exact **100% single-BIN-country cluster** is a standout characteristic in the canonical original-currency run. In the BIN-country base-currency sensitivity, BIN country constructs the target currency and is therefore not independent evidence; report 100% concentration descriptively but do not use it to raise the FX risk tier.
-Country-slice coverage explains how large that concentration is inside the
-descriptor-country population, but it has no fixed threshold and contributes
-no independent risk points. Values such as 20% or 33.8% are descriptive, not
-self-interpreting risk signals. Any value below 100% is not promoted merely
-because it is numerically high.
-
-## Risk tiers
-
-Assign exactly one tier to every identified currency-amount pair:
-
-| Tier | Use when |
-|---|---|
-| High | In the canonical run, an exact 100% single-country standout has at least one independent corroborating risk characteristic, or several independently strong non-country characteristics converge; FX concentration cannot raise tier |
-| Medium | At least two independent characteristics materially differ from the same-descriptor baseline, but High is not justified |
-| Low | The structural cluster gate is met, but observed corroborating evidence is limited or not material |
-
-Do not use a generic 0–100 score unless the business has approved and calibrated
-its weights and cutoffs. Missing fields reduce confidence and must be disclosed;
-they are not evidence that risk is Low.
-
-Sort report results `High → Medium → Low`. Within a tier, sort by the number and
-magnitude of independently supported characteristics, then by exact-member
-attempts. Preserve stable cluster IDs when sorting an existing result.
-
-## Reader-facing conclusion
-
-Write for a payment-risk operator, not the detector's implementer. The reader
-must understand who to review first, why, what remains unknown, and what to
-check next without opening the methodology or decoding cluster IDs.
-
-Begin each main report with one short decision summary, followed by Main
-findings and Next checks. Do not repeat a closing Verdict. Keep exhaustive
-cluster profiles and exposure tables in linked evidence. Use the same
-evidence-first approach in the final chat handoff.
-
-The summary is at most three short sentences, each with one main point.
-Prioritize evidence, not descriptor volume alone; if no defensible priority
-exists, say so instead of forcing a target. Pattern labels are hypotheses:
-
-1. Name the first investigation target and the relevant time window; state
-   the highest detected-cluster tier when one exists. Use the exact descriptor
-   to locate the activity, not as proof of a verified merchant identity.
-2. Give the strongest observed reason in plain language, using only one or
-   two essential figures. Explain why that observation warrants review.
-3. State what the data cannot establish, including that investigation priority
-   is not confirmation of transaction laundering.
-
-The three-sentence limit applies to the summary, not the entire report.
-For a Chinese summary, keep each sentence within 80 characters and use at
-most two numerical facts across the whole summary, excluding its date window
-and identifiers. Move amounts, percentages,
-source/target currencies, thresholds, and technical labels to the explanation
-unless essential to the immediate business takeaway. Do not join many clauses
-with semicolons to squeeze a data inventory into it. Keep full anchor lists,
-cluster IDs, and by-tier exposure in supporting tables.
-
-Preserve the supplied fact scope: bind every figure to its stated descriptor,
-period, numerator, denominator, and metric. If any is missing, mark it unknown;
-do not resolve ambiguity by borrowing a nearby period or population. Never
-translate an authorization decline as a chargeback (`拒付`). Small samples
-limit generalization; their observed rates still describe those samples and
-must not be dismissed as meaningless. `Other pattern` can mean insufficient
-evidence: do not assert that a menu or e-commerce test failed, or that fields
-are missing, unless the run actually records that reason.
-
-### Supporting explanation
-
-Use Main findings and Next checks for the supporting explanation. Within each
-finding, present observed evidence first, then the supported pattern hypothesis
-and uncertainty, then its relationship to formal amount clusters. Only give
-intersection counts supported by saved row-level reconciliation. A preset menu
-can contain non-doubling prices; the three-level, fixed-2x, 100-attempt gate
-belongs to formal clusters, not to every top-up hypothesis.
-
-Use short subsections or bullets as needed:
-
-- **Who and why:** pair each prioritized descriptor's concrete observation
-  with its business meaning and an unresolved question. Different amount or
-  card-country patterns can justify checking whether several businesses share
-  a billing name; they do not prove that they do.
-- **What detection found:** report qualifying clusters and exact-member exposure
-  by tier with explicit denominators, or zero qualifying clusters and zero
-  identified-cluster exposure. Explain the tested pattern in ordinary words:
-  repeated amounts with a fixed doubling relationship and sufficient attempts.
-  Explain stream observations separately; the exact-amount test is not the
-  whole analysis.
-- **What to check next:** name specific observed orders or activity to reconcile
-  with products, websites, actual sellers, or fulfillment records. These are
-  bounded evidence-gathering suggestions, not findings or enforcement commands.
-  Do not claim those records were inspected when they were not.
-
-Use only evidence already established in the report. If evidence cannot support
-prioritizing a target or naming a useful follow-up, say so rather than inventing
-one. Do not recommend filing a SAR, terminating a merchant, or correcting an MCC.
-
-### No qualifying cluster and period focus
-
-No qualifying cluster means the tested pattern did not meet this run's gates,
-not that the merchant is safe or all suspicious activity was excluded. State
-this plainly, especially below 100 attempts. Keep descriptor-level investigation
-leads separate from formal cluster tiers and cluster exposure; do not assign
-a High/Medium/Low cluster tier to an unqualified lead. Missing fields and small
-samples constrain interpretation; they are not evidence of Low risk.
-Do not reclassify e-commerce or other-pattern rows as top-ups merely by obtaining
-their charge currency. Direct versus FX-converted is a subtype distinction only
-after a supported preset-menu hypothesis exists for those rows.
-
-For a month or active-merchant focus, lead with activity observed in that window.
-Separate historical findings, historical members' current-period slices, and
-independent current-period detection. No observed activity in the supplied files
-does not prove a business stopped operating. Never carry historical tier or
-exposure into the current period without current-period evidence. Keep canonical
-and FX findings separate.
-
-### Chinese readability
-
-Introduce a descriptor as `账单名称`, retaining its exact value. Explain BIN
-country as where the card was issued, not customer location. Explain suspected-
-fraud rates as the share of authorization attempts declined with a suspected-
-fraud response, not confirmed fraud. Define the baseline as the relevant remaining
-attempts using the same-descriptor scope. A pattern-only comparison must be
-labeled separately and cannot replace the canonical cluster baseline.
-
-Do not use `敞口`, `精确成员`, `canonical`, `FXC*`, `menu-12 frozen`, or
-`standout` as a substitute for explaining the conclusion. Keep technical labels
-in supporting tables and methods. Explain the relevance of selected statistics;
-keep hypotheses as questions, not facts.
-
-Use the approved payment-pattern names from [terminology.md](terminology.md).
-Direct/FX-converted top-up and e-commerce names remain hypotheses, not verified
-business facts. Explain inferred top-up versus actual charge currencies; fixed
-amounts are supplementary, not a separate business class.
-
-Read back the conclusion without its tables. If who to review, why, and what
-is unknown are still unclear, rewrite during `editorial-review`, before `polish-cn`.
-Polishing cannot repair missing analytical explanation.
-
-First use of TLD is “transaction laundering (TLD)”. Proofread with
-[terminology.md](terminology.md).

package/skills/risk-compliance/tld-detection/references/streams.md

@@ -1,141 +0,0 @@
-# Payment-pattern inference
-
-Run after cleaning and before canonical descriptor-local clustering. Reader-facing
-reports call this **Payment patterns / 收款模式**, not upstream streams. A
-billing descriptor is not a verified merchant identity; different patterns do
-not prove that several businesses, websites, or cashiers share it.
-
-Patterns are descriptive hypotheses. Canonical clustering runs on every cleaned
-authorization in each descriptor, with exact original currency and amount keys.
-Do not split, filter, or reassign canonical members by inferred pattern or BIN
-country. The cluster baseline is the whole descriptor minus that cluster.
-Pattern-specific behavior can be shown separately, with its population stated;
-it must not replace this baseline or become a cluster tier of its own.
-
-## Business names
-
-| Report name | Chinese | Evidence and limits |
-|---|---|---|
-| Direct top-up pattern | 直接充值模式 | A supported preset menu whose inferred top-up currency equals the actual charge currency |
-| FX-converted top-up pattern | 换汇充值模式 | A supported preset menu in an inferred top-up currency different from the actual charge currency |
-| E-commerce pattern / Retail pattern | 电商模式 | Several distinct amounts resembling product list prices, possibly multiplied by one constant; actual goods and fulfillment remain unverified |
-| Other pattern | 其他模式 | No supported preset menu or e-commerce fit, insufficient sample, or ambiguous evidence; not evidence of low risk |
-
-For top-up hypotheses, show **inferred top-up currency / 推断充值币种** separately
-from **charge currency / 扣款币种**, which comes from the authorization file.
-The script's `wallet` is the inferred top-up currency, not an observed wallet
-balance. BIN-country legal tender is only one candidate, never proof of wallet
-currency or customer location. Distinguish direct versus FX-converted top-ups
-only after a supported preset-menu hypothesis exists for the same rows. Charge
-currency alone cannot turn e-commerce or other rows into top-ups. Single versus
-multiple currencies is an attribute, not the direct/FX distinction.
-
-Examples: USD 10/20/50 presets charged in USD are direct; EUR 10/20/50 presets
-charged in USD are FX-converted. EUR and GBP presets both charged in USD are
-multiple inferred top-up currencies within the FX-converted category. If one
-inferred EUR menu includes EUR and USD charges, report the direct and converted
-parts separately with counts; do not label all rows direct or all converted.
-These display subdivisions do not change canonical detection.
-
-Fixed amounts / 定额 are a supplementary pricing characteristic, not a
-fifth mutually exclusive business pattern. The display flags exact charge
-amounts observed on at least two distinct dates within the same charge currency;
-it does not claim all amounts or daily modes are fixed. Both top-ups and
-e-commerce can have fixed amounts. Same-currency fixed prices do not demonstrate frozen FX. Do not
-rename fixed amounts as batch, bot, generated traffic, or fraud without separate
-supporting evidence. Every business name is an inferred hypothesis, not a
-verified business identity.
-
-## Script and raw labels
-
-```bash
-python3 {baseDir}/scripts/detect_streams.py cleaned-authorizations.csv \
-  --rates rates_cache.json --fetch-rates 2026-07-01 2026-08-31 \
-  --amount-column amount --currency-column currency --date-column timestamp \
-  --descriptor-column descriptor --bin-country-column bin_country \
-  --response-column response --approval-values A001 --suspected-fraud-values D102 \
-  --account-column account --card-type-column card_type --avs-column avs --auth-column auth \
-  --output streams.json --markdown streams.md
-```
-
-Keep script filenames and existing raw `stream` fields for compatibility. A
-`<CCY> menu-10` or `menu-12` label with supported scheme coverage supplies a
-top-up hypothesis; determine direct/converted per actual charge currency, not
-from the raw name or country. `menu-none` lacks a supported preset menu and is
-reported as Other unless separately verified evidence supports a more specific
-interpretation. `retail x<k>` maps to E-commerce; `off-menu` and `small groups`
-map to Other. Keep the raw label in methodology or audit detail, not as the
-reader's explanation.
-
-`frozen` is a supplementary rate-consistency test result, not a business class.
-The raw `live` label means only that the frozen condition was not met; it may
-include insufficient day coverage or same-currency charges. Check the detail's
-tested attempts, days, source currency, and actual cross-rate movement before
-claiming floating or fixed conversion. Report untested evidence as unknown.
-
-## FX cache
-
-`--rates` is a daily cache `{base, rates:{YYYY-MM-DD:{CCY:rate}}}` quoted as
-units per one base unit; `--fetch-rates` uses Frankfurter v1 for discovery.
-Search backward from the actual transaction date, at most seven days by default.
-Do not use future or over-age rates. Missing rates must be reported and cannot
-be silently replaced by cache endpoints. `rates_carried_days` counts successful
-carry lookups by currency, not distinct days or transactions. Peg assumptions
-(SAR, AED, QAR, KWD, BHD, OMR, HKD) are built in; record their use.
-
-This discovery cache is separate from the Frankfurter v2 exact-date contract in
-[fx-conversion.md](fx-conversion.md). Missing discovery coverage does not remove
-rows from the canonical cleaned universe.
-
-## Detection detail
-
-Per descriptor and BIN-country group (default at least 80 attempts):
-
-1. Strong retail test: search a constant in 1.00 to 1.15 under which at least
-   30% of amounts resemble list prices (`x.99`, `x.95`, `x.98`, `x.00`), with
-   at least eight distinct base prices, against jittered controls. The fitted
-   constant is descriptive; it does not establish a tax, fee, markup, or fraud.
-2. For each candidate top-up currency (card-country legal tender, EUR, USD,
-   GBP, CHF), convert amounts using the day's source-to-candidate cross-rate;
-   find peaks within 1.2% and measure top-ten coverage, jittered control, and
-   daily median drift. Acceptance uses the configured coverage and excess
-   thresholds, or the lower coverage threshold with a supported preset scheme.
-3. Match peaks within 1.5% to the 10- or 12-scheme and supported scales. On-menu
-   rows form a descriptive group; other rows remain available for further
-   inference and canonical detection.
-4. Test rate consistency separately for each peak and actual charge currency:
-   at least three observations per day on at least four days. A fixed-FX
-   observation requires identical daily modal charge amounts, differing
-   source/top-up currencies, and at least 0.1% movement in that cross-rate.
-   Never pool incomparable source-currency amounts or use movement against an
-   unrelated cache base. Modal stability is not proof that every row is fixed.
-5. Apply the weak retail test to the remainder (20% coverage, five base prices),
-   then retain unclassified rows. Small-sample groups are retained separately.
-
-Up to three rounds per group. Every threshold is a CLI option echoed under
-`parameters`. Country helps candidate inference but is not a canonical member
-filter. A single-country pattern selected using country cannot supply an
-independent country-concentration risk signal; canonical concentration must be
-computed on the complete exact descriptor/currency/amount membership.
-
-## Reported behavior and investigation
-
-In the main report, show observed amounts and relevant behavior before the
-supported pattern hypothesis, its uncertainty, and its relationship to formal
-amount clusters. Keep exhaustive pattern tables in linked evidence. Pattern/
-cluster intersections require saved row-level reconciliation to both
-populations; matching labels are not enough. A preset menu can contain
-non-doubling prices. Do not apply formal cluster eligibility (three levels,
-fixed 2x, 100 attempts) to every pattern hypothesis.
-
-Report attempts, distinct masked-card counts, repeat-card share, decline retries,
-UTC hour concentration, address-verification presence, 3-D Secure presence,
-authorization success, and suspected-fraud responses with their denominators.
-Masked-card identifiers and missing fields limit interpretation. Compare these
-features as observations, not proof of players, shops, bots, or upstream owners.
-
-A shared preset across currencies can justify checking common pricing; it does
-not prove a common cashier. Different presets can justify checking whether more
-than one business shares a billing name; they do not prove multiple businesses.
-Investigate products, orders, sellers, and fulfillment before making business
-claims. Never infer fees or fictitious tax from an unexplained fitted constant.

package/skills/risk-compliance/tld-detection/references/terminology.md

@@ -1,95 +0,0 @@
-# Terminology
-
-Use these terms in TLD reports. Read before writing. After writing, run
-the proofread in `SKILL.md`.
-
-TLD in this skill is **transaction laundering**. Spell it out on first
-use as **transaction laundering (TLD)**. The English report title is the first
-use and must carry that expansion. It is not a top-level domain.
-
-## Canonical glossary
-
-| English | Chinese | Do not write |
-|---|---|---|
-| transaction laundering (TLD) | 交易清洗（TLD） | 把 TLD 写成域名；洗钱结案 |
-| potential TLD currency-amount pair | 潜在 TLD 币种金额对 | 已确认 TLD；TLD 商户 |
-| cluster (report section) | 币种金额对 | 客户簇；客群；分群结果 |
-| anchor detection | 锚点识别 | 客户聚类（对业务读者） |
-| currency-amount-pair | 币种金额对 | 金额币种对；金额对；price point（作指标名时） |
-| descriptor partition | descriptor 分区 | 客群；BIN 国家分区 |
-| BIN-country attribution component | BIN 国家归因组件 | 客户国家；成员分区 |
-| geometric anchor family | 币种金额对 | 阶梯（业务报告中）；价格带；SKU |
-| stuffing | 掺量 | 注水（可括注一次）；corridor |
-| MCC miscoding | MCC 错配 | 改 MCC；纠正 MCC |
-| descriptor | descriptor / 账单描述；业务结论可用账单名称 | 商户名（指 descriptor 时） |
-| baseline | 基线 | 对照组（可括注）；everything else |
-| all authorization attempts | 全部授权尝试 | U（业务报告中）；原始全量 |
-| US-BIN | US BIN / 美国发卡 | 美国交易（指卡BIN时） |
-| attempt | 授权尝试 | 交易（指授权行时） |
-| approval | 授权成功 | 批准 |
-| authorization decline | 授权拒绝 | 拒付（指授权响应时） |
-| auth rate | 授权成功率 | 转化率 |
-| suspected fraud | 疑似欺诈 | 已确认欺诈；正文里写 D102（表内代码可留） |
-| BIN country / issuer country | 发卡行国家 / BIN 国家 | 客户国家；收货国；发卡国 |
-| cluster composition by BIN country | BIN 国家占 Cluster | 客户国家占比 |
-| descriptor-country slice coverage | Cluster 占 Descriptor 对应 BIN 国家 | BIN 国家风险率；国家命中率 |
-| canonical exact single-country standout | canonical 原币 100% 单一 BIN 国家 standout | 高国家占比；接近 100% |
-| BIN-country local hour | BIN 国家当地小时 | 客户所在地时间；统一美国东部时间 |
-| this analysis window | 当前分析时段内 | 本窗口 |
-| MCC vs descriptor | MCC 与 descriptor 合理性 | 纠正 MCC；改 MCC |
-| verdict | 结论 | 长文综述（作结论部分时） |
-| High / Medium / Low risk | 高风险 / 中风险 / 低风险 | Supported；Weak；Ladder only；已确认 TLD |
-| risk exposure | 风险敞口 | 已确认 TLD 影响；定罪金额 |
-| payment pattern (raw script field: stream) | 收款模式 | 上游流；业务流；已确认业务类型 |
-| Direct top-up pattern | 直接充值模式 | 已确认充值；按发卡行国家猜充值币种 |
-| FX-converted top-up pattern | 换汇充值模式 | 多币种等于换汇；已确认换汇充值 |
-| E-commerce pattern / Retail pattern | 电商模式 | 已确认电商；已核实商品或履约 |
-| Other pattern | 其他模式 | 低风险模式；无风险 |
-| inferred top-up currency (script: wallet) | 推断充值币种 | 已确认钱包币种；发卡行国家法币等于充值币种 |
-| charge currency | 扣款币种 | 推断充值币种（指授权文件币种时） |
-| preset menu | 预设充值档位 | 阶梯（指菜单时）；手续费 |
-| fixed amounts (supplementary feature) | 定额特征 | 独立定额模式；固定金额等于固定汇率 |
-| frozen source-to-top-up rate (tested) | 固定换汇特征（经检验） | 机器人；已确认套现；未检验即固定汇率 |
-| retail constant | 标价系数 | 税率；手续费率；虚假税项 |
-| generated traffic hypothesis | 疑似批量生成（需独立证据） | 固定金额即生成流量；已确认欺诈交易 |
-
-Keep proper nouns: Visa, MasterCard, BIN, IIN, MCC, MID, Worldpay,
-Pazien, Order ID, descriptor. Tables may show response codes; prose uses
-疑似欺诈 / suspected fraud.
-
-## Pattern naming
-
-Use the four payment-pattern names in reader-facing headings and tables. They
-are business hypotheses from authorization data, not verified businesses or
-successful settlements. Show inferred top-up currency separately from actual
-charge currency. Direct versus FX-converted depends on whether those currencies
-match; number of currencies is a separate attribute. Fixed amounts are a
-supplementary feature applicable to top-ups or e-commerce, not an exclusive class.
-Keep `menu-10`, `menu-12`, `frozen`, `live`, `retail x<k>`, and `off-menu` only
-as raw audit labels; explain their limits using [streams.md](streams.md).
-
-## Axis and UI
-
-- Canonical amount axes use and name the cluster's **original transaction
-  currency** (`授权尝试金额 USD`, `授权尝试金额 EUR`). FX amount axes use and
-  name the **target BIN-origin legal-tender currency**. Never mix currencies on
-  one axis in either view.
-- Date charts use each series' share of attempts by UTC transaction date.
-- Time charts use each BIN country's local hour, falling back to UTC when no
-  timezone is configured. Normalize Cluster and Baseline independently.
-- HTML footer: data-source filenames only. No skill name.
-
-## Banned strings (grep after writing)
-
-Chinese: `走廊`, `杠杆`, `转化率`, `赋能`, `抓手`, `闭环`, `打法`,
-`本窗口`, `已确认 TLD`, `已确认交易清洗`, `洗钱`, `发卡国`, `客群运营`,
-`客户簇`, `金额币种对`
-
-English: `deposit fee` or `surcharge` for a converted preset, `bot` as a finding, `confirmed laundering`, `confirmed TLD`, `money laundering`,
-`SAR`, `file a SAR`, `top-level domain`, `customer country`,
-`conversion rate` (when meaning auth rate), `corridor`, `price band`
-(as the cluster name)
-
-`洗钱` is banned as a finding. If a source document uses the legal term,
-quote it in supporting evidence and keep the report on potential TLD
-currency-amount pairs.

package/skills/risk-compliance/tld-detection/references/workflow.md

@@ -1,95 +0,0 @@
-# Workflow detail
-
-SKILL.md is the index. This file is the procedure those steps run.
-
-## Input
-
-Typical file: `Authorizations_*.csv`. Grain: **one authorization attempt**.
-
-Amount, currency, and descriptor columns are required. BIN/issuer country,
-issuing bank, MCC, and response are expected for characteristics; a missing
-optional column is captioned. Missing descriptor values enter an explicit
-partition bucket; missing BIN-country values enter a reporting bucket after
-membership is frozen. Do not drop those rows.
-
-Settlements and chargebacks are not the clustering universe. Do not join
-them into `U`. If only settlements exist, stop and say the clustering
-grain is auth attempts.
-
-## Column aliases
-
-Use the first present name. Record the alias actually used.
-
-| Role | Common names |
-|---|---|
-| Time | `Timestamp`, `Auth timestamp`, `Transaction date` |
-| Amount | `Amount`, `Transaction amount`, `Requested amount` |
-| Currency | `Currency`, `Transaction currency`, `Auth currency` |
-| BIN / issuer country | `BIN country`, `IIN country`, `Issuer country`, `Card country` |
-| Issuing bank | `Issuing bank`, `Issuer`, `Issuer name`, `Bank name` |
-| Descriptor | `Billing descriptor`, `Descriptor`, `Soft descriptor`, `Submerchant`, `DBA` |
-| MCC | `MCC`, `Merchant category code` |
-| Response | `Response code`, `Response message`, `Auth response` |
-| Identity | `Order ID`, `Transaction ID`, `Auth ID` |
-| Card | `IIN`, `BIN`, `Payment method`, `Card type`, masked `Account` |
-
-Portfolio constants (MID, acquirer, entry method) are recorded once. They
-are not partition or clustering keys.
-
-## Window
-
-Default: min→max of the time field on the **cleaned** universe. If the user
-names a week or month, cut there and state it.
-
-## Response classes
-
-Recompute from the file. Pazien-style defaults when those codes exist:
-
-| Class | Typical |
-|---|---|
-| Approval | A001 / message contains approval |
-| Suspected fraud | D102 / message contains suspected fraud |
-| Other decline | remaining non-approvals |
-
-Suspected-fraud decline ≠ confirmed fraud loss. Do not treat D102 as a
-positive label for `fraud-analysis`.
-
-## What this skill is looking for
-
-Transaction laundering in this book usually shows up as:
-
-1. **MCC miscoding** — different kinds of goods mixed under one “normal” MCC
-2. **Descriptor mixing** — several customer types share a billing name, or
-   one TLD customer is split across several descriptors
-3. **Stuffing / 掺量** — a geometric amount ladder riding the same MCC as
-   legitimate traffic
-
-Descriptor defines the initial partition, while BIN country and MCC do not.
-Geometrically related currency-amount anchors inside each descriptor define
-membership. BIN country and issuing bank are reported only after membership
-is frozen.
-
-## Order that must not move
-
-These analytical steps apply to new detection runs. For presentation-only
-revisions, verify the accepted saved artifacts and go directly to reporting;
-do not repeat cleaning, inference, clustering, or risk assignment.
-
-Clean → descriptor partition → payment-pattern inference (context only) → exact currency-amount pairs across each whole descriptor → same-descriptor baseline → decide → report.
-
-Inferred patterns never change canonical members, eligibility thresholds, or
-baseline. Their own descriptive breakdowns are separately labeled and do not
-receive formal cluster tiers.
-
-Comparison features must not create a cluster that amount detection did not
-find. Decision adds no evidence: it translates established observations into
-a business-readable conclusion with a ≤3-sentence summary and concise
-supporting explanation, following [decision.md](decision.md). Publish the
-three-section main report, complete linked evidence, and separate methodology
-in [report-template.md](report-template.md). Presentation revisions reuse frozen
-results and preserve earlier outputs; they do not rerun analysis.
-
-Report writing ends with `editorial-review`, then, for Chinese output, `polish-cn`
-with [chinese-polish.md](chinese-polish.md), followed only by fidelity checks, HTML
-synchronization, and proofreading before delivery. Neither step can change
-detection, membership, exposure, risk tiers, or conclusions.