@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/experience/feedback-system.md

@@ -0,0 +1,176 @@
+# Feedback System
+
+Investigation quality feedback loops. Surface actionable signals during and after investigation phases.
+
+---
+
+## Coverage Feedback
+
+Triggers automatically after `/validate` or `/coverage` completes.
+
+### Trigger Condition
+
+```
+if coverage_score < 60%:
+    show coverage feedback
+```
+
+### Output Template
+
+```
+Coverage: [score]% ([checked]/[total] paths)  ◀ Below 60% threshold
+
+Unchecked high-priority paths:
+  • [path_label] → try: [suggested_command]
+  • [path_label] → try: [suggested_command]
+
+Run /blind-spots for a ranked gap list with suggested commands.
+```
+
+### Suggested Commands by Path Type
+
+| Unchecked Path Category | Suggested Command      |
+|-------------------------|------------------------|
+| Identity / name query   | `/sweep --identity`    |
+| Breach / exposure       | `/scan --breach`       |
+| Social media            | `/scan --social`       |
+| Legal / court records   | `/search --legal`      |
+| Domain / DNS            | `/scan --dns`          |
+| Email pivot             | `/pivot --email`       |
+
+---
+
+## Confidence Feedback
+
+Flags findings with `trust_score <= 2` that lack corroborating sources.
+
+### Trigger Condition
+
+Evaluated after any `/scan`, `/sweep`, or `/branch` command completes.
+
+```
+for each finding where trust_score <= 2 and corroboration_count == 0:
+    flag for verification
+```
+
+### Output Template
+
+```
+Low-confidence findings needing corroboration:
+  [F-id]  [type]  Trust: [score]/5  —  [brief description]
+           └─ Suggested: /verify-finding [F-id]
+
+[count] finding(s) flagged. Use /verify-finding [id] to add sources.
+```
+
+### Suppression
+
+If user runs `/verify-finding` and result is still trust_score <= 2,
+show once more with note: "Corroboration attempted — confidence
+remains low. Document limitation in report."
+
+---
+
+## Investigation Quality Score — /quality
+
+Composite 0–100 score summarizing investigation completeness.
+
+### Command
+
+```
+/quality
+```
+
+### Scoring Formula
+
+| Component              | Weight | Source                              |
+|------------------------|--------|-------------------------------------|
+| Coverage               | 30%    | coverage_score from coverage matrix |
+| Source diversity       | 20%    | unique source domains / findings    |
+| Finding verification   | 20%    | findings with trust_score >= 3      |
+| Conflict resolution    | 15%    | flagged conflicts with resolution   |
+| Citation completeness  | 15%    | findings with source_url present    |
+
+```
+quality_score = (
+    (coverage_score        * 0.30) +
+    (source_diversity_pct  * 0.20) +
+    (verification_rate     * 0.20) +
+    (conflict_resolution   * 0.15) +
+    (citation_completeness * 0.15)
+)
+```
+
+### Score Bands
+
+| Score   | Label        | Meaning                                      |
+|---------|--------------|----------------------------------------------|
+| 0–39    | Insufficient | Not ready for any report format              |
+| 40–59   | Developing   | Executive summary only; note major gaps      |
+| 60–74   | Acceptable   | Standard report with limitations section     |
+| 75–89   | Strong       | Full report; document minor gaps             |
+| 90–100  | Exemplary    | All paths attempted, findings corroborated   |
+
+### Output Template
+
+```
+━━━ INVESTIGATION QUALITY ━━━━━━━━━━━━━━━━━━
+  Overall:              [score]/100  ([label])
+
+  Coverage:             [val]%  × 0.30  = [component]
+  Source diversity:     [val]%  × 0.20  = [component]
+  Finding verification: [val]%  × 0.20  = [component]
+  Conflict resolution:  [val]%  × 0.15  = [component]
+  Citation completeness:[val]%  × 0.15  = [component]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Top improvement actions:
+  1. [action with largest score gain]
+  2. [action with second-largest gain]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+---
+
+## Tier Display Rules
+
+| Tier         | Coverage Feedback       | Confidence Feedback    | /quality Display         |
+|--------------|-------------------------|------------------------|--------------------------|
+| Novice       | Always show             | Always show            | Always show              |
+| Practitioner | Show after each phase   | Show after each phase  | Show after each phase    |
+| Specialist   | Show if score < 40%     | On demand only         | On demand only (`/quality`) |
+
+### Phase Boundaries (Practitioner trigger points)
+
+A "phase" ends when the user runs any of:
+- `/validate`
+- `/coverage`
+- `/brief`
+- `/report`
+
+---
+
+## Workspace Metadata Integration
+
+Quality score and feedback state are persisted between sessions:
+
+```json
+{
+  "feedback": {
+    "last_quality_score":       82,
+    "last_quality_timestamp":   "<ISO-8601>",
+    "low_confidence_flagged":   ["F-003", "F-007"],
+    "low_confidence_resolved":  ["F-003"],
+    "coverage_feedback_shown":  true
+  }
+}
+```
+
+---
+
+## Related Files
+
+- `validation/coverage-matrix.md` — coverage_score source
+- `validation/verification-checklist.md` — citation completeness data
+- `analysis/confidence-scoring.md` — trust_score definitions
+- `experience/skill-tiers.md` — tier display rule context

package/skills/cti-expert/experience/guidance-system.md

@@ -0,0 +1,234 @@
+# Guidance System
+
+Proactive and reactive guidance that keeps cases moving without interrupting flow.
+
+---
+
+## Guidance Types
+
+| Type | Trigger | Delivery | Dismissable |
+|------|---------|----------|-------------|
+| Inline hint | After 3 consecutive similar commands | Single line | Yes |
+| Recovery guide | Error condition | Structured block | No (until resolved) |
+| Confirmation gate | Destructive or bulk operation | Prompt | Yes (Specialist tier) |
+| Risk alert | Finding with risk ≥ 8 | Flagged block | Requires acknowledgment |
+| Next-step suggestion | Operation completes | Footer line | Yes |
+
+---
+
+## Confirmation Gates
+
+### When Required
+
+**Always prompt:**
+- Deleting saved cases
+- Exporting data with PII
+- Bulk operations (>50 results affected)
+- Running resource-heavy sweeps
+- Sharing findings externally
+
+**Never prompt (Novice override):**
+- Read-only queries
+- Status checks
+- Navigation
+- Help requests
+
+### Gate Formats
+
+**Standard gate:**
+```
+Confirm: Delete case "Q4 Vendor Check" ?
+
+This removes:
+  - 23 saved findings
+  - Associated timeline
+  - Case notes
+
+Type YES to confirm, or NO to cancel.
+```
+
+**Destructive gate:**
+```
+DESTRUCTIVE ACTION
+
+Purging all case history removes:
+  • 156 case records
+  • 2,340 findings
+  • All saved timelines
+
+This cannot be reversed.
+
+To proceed, type: PURGE-ALL
+To cancel: NO
+```
+
+### Confirmation Shortcuts by Tier
+
+| Tier | Confirm | Cancel |
+|------|---------|--------|
+| Novice | Full word "yes" | "no" or Escape |
+| Practitioner | "y" or "yes" | "n" or "no" |
+| Specialist | "y" | "n" or Ctrl+C |
+
+---
+
+## Recovery Guidance
+
+### Error Template Structure
+
+Each error delivers: what failed → plain-language reason → fix steps → alternative path.
+
+**Unknown command:**
+```
+Unrecognized: "rekcon example.com"
+Did you mean: /sweep example.com
+
+Try: /sweep example.com
+List all commands: /help
+```
+
+**Missing parameter:**
+```
+/sweep requires a target.
+
+Try:
+  /sweep example.com        (domain)
+  /sweep user@example.com   (email)
+  /sweep "Jane Smith"       (subject name)
+```
+
+**Rate limit:**
+```
+Request rate exceeded. Pause: 45 seconds.
+
+While waiting:
+  /results     — review current findings
+  /status      — check case progress
+  /help tips   — efficiency techniques
+```
+
+**No results:**
+```
+No records found for "xyzabc123456".
+
+Possible causes:
+  • Spelling variation
+  • Target has minimal online presence
+  • Too new to be indexed
+
+Alternatives:
+  /sweep with broader terms
+  /dork for specialized search
+  /help search-techniques
+```
+
+---
+
+## Risk Alerts
+
+### Alert Levels
+
+| Level | Icon | Trigger | Required Action |
+|-------|------|---------|-----------------|
+| Informational | — | Context note | None |
+| Caution | ⚠ | Ambiguous finding | Review suggested |
+| High | ! | Risk score ≥ 7 | Acknowledge |
+| Critical | !! | Risk score ≥ 9 | Explicit confirmation |
+
+### Alert Templates
+
+**Caution (multiple subjects match):**
+```
+⚠ Multiple subjects match "John Smith" — Boston area.
+Verify target identity before proceeding.
+/verify-subject for help
+```
+
+**High (sensitive data in scope):**
+```
+! Sensitive data in scope:
+  • Home address
+  • Family member details
+  • Private contact information
+
+Handle per your jurisdiction's data regulations.
+Type ACKNOWLEDGE to continue.
+```
+
+**Critical (protected subject):**
+```
+!! Subject may be a protected individual.
+Review applicable laws before proceeding.
+You accept full legal responsibility for this case.
+Type: I-ACCEPT-RESPONSIBILITY  or  /abort
+```
+
+---
+
+## Proactive Hints
+
+Hints appear after behavioral patterns, not on a timer.
+
+| Pattern | Hint |
+|---------|------|
+| Three `/sweep` runs on same target | "Try `/connections` to map linked accounts" |
+| Email found without domain | "Run `/sweep [domain]` to find the associated site" |
+| Timeline has gaps >2 years | "Use `/dork` with date ranges to fill gaps" |
+| Same command used 5+ times | "Save as case template: `/template save [name]`" |
+| High error rate | "Switch to guided flow: `/flow [type]`" |
+
+### Hint Preferences
+
+```
+/hints on      — enable proactive hints
+/hints off     — hints only on /hint command
+/hints quiet   — hints stored, review with /hints review
+```
+
+System suppresses hints that were dismissed within the last 2 minutes or declined 3+ times.
+
+---
+
+## Success Signals
+
+### Completion Format
+
+```
+Done: 23 findings for example.com  (2m 34s)
+
+  5 emails  |  8 subdomains  |  3 documents  |  1 security flag
+
+/summary | /timeline | /export
+```
+
+### Partial Completion
+
+```
+Done (partial): 15 findings — 2 sources unavailable.
+
+  Skipped: LinkedIn (rate limited)  ·  Twitter API (maintenance)
+
+Results may be incomplete. Retry skipped sources: /retry-skipped
+```
+
+---
+
+## Message Tokens
+
+| Token | Meaning |
+|-------|---------|
+| `✓` | Step completed |
+| `○` | Step pending |
+| `⏳` | Step in progress |
+| `⚠` | Caution |
+| `!` | High risk |
+| `!!` | Critical |
+| `—` | Informational |
+
+---
+
+## Related Files
+
+- `experience/skill-tiers.md` — tier controls gate and hint frequency
+- `experience/case-progress.md` — progress display during active operations
+- `engine/error-handling.md` — error classification and routing

package/skills/cti-expert/experience/guided-flows/flow-domain-sweep.md

@@ -0,0 +1,275 @@
+# Flow: Domain Sweep
+
+Guided 6-step flow for comprehensive domain intelligence collection and risk assessment.
+
+---
+
+## Flow Metadata
+
+| Field | Value |
+|-------|-------|
+| Activation | `/flow domain-sweep` |
+| Skill tier | Novice to Practitioner |
+| Duration | 8–20 min depending on scope |
+| Output | Risk score + prioritized action list |
+| Use cases | Pre-purchase checks, routine monitoring, vendor review |
+
+---
+
+## Step 1: Target & Authorization
+
+### 1a — Domain Entry
+
+```
+Domain Sweep  |  Step 1 of 6
+
+Enter the target domain (e.g., example.com):
+> _
+```
+
+Validation runs automatically:
+```
+✓ Format valid: example.com
+✓ Resolves to IP: 203.0.113.45
+✓ Server responds
+Proceeding…
+```
+
+### 1b — Sweep Scope
+
+```
+Select sweep depth:
+
+  1. Surface  (3 min)  — registration, SSL, headers
+  2. Standard (8 min)  — + subdomains, tech stack, exposure
+  3. Full     (20 min) — + enumeration, vuln testing, dorks
+
+Scope (1/2/3):
+```
+
+| Scope | Duration | Checks |
+|-------|----------|--------|
+| Surface | 3 min | Reg · SSL · headers |
+| Standard | 8 min | + Subdomains · tech · common exposure |
+| Full | 20 min | + Directory enum · dork suite · CVE scan |
+
+### 1c — Authorization Confirmation
+
+```
+⚠ Authorization required
+
+You are about to sweep: example.com
+
+Valid authorization includes:
+  ✓ You own this domain
+  ✓ Written consent from the owner
+  ✓ Active bug bounty program covers it
+  ✗ No authorization → do not proceed
+
+Do you have authorization? (yes / no)
+```
+
+If no:
+```
+Without authorization, active scanning may violate laws and ToS.
+Passive reconnaissance (WHOIS, public records) is still available.
+
+Continue with passive-only sweep? (yes / no)
+```
+
+---
+
+## Step 2: Registration & Infrastructure
+
+System collects: registrar, dates, nameservers, IP, hosting, CDN.
+
+```
+Step 2 of 6 — Registration & Infrastructure
+[██████░░░░] 60%
+```
+
+### Registration Block
+
+```
+Domain: example.com
+Registrar:  Namecheap, Inc.
+Registered: 2018-03-15
+Expires:    2025-03-15  ⚠ 45 days remaining
+Status:     Active
+Privacy:    Enabled  ✓
+Nameservers: ns1.cloudflare.com · ns2.cloudflare.com
+DNSSEC:     Enabled  ✓
+```
+
+### Infrastructure Block
+
+```
+IP:        203.0.113.45
+Provider:  AWS  us-east-1
+Server:    nginx/1.24.0
+CDN:       CloudFlare  ✓
+Regions:   Multi-region  ✓
+```
+
+Flags automatically raised:
+```
+⚠ Domain expires in 45 days — renew to prevent takeover risk.
+```
+
+---
+
+## Step 3: Security Configuration
+
+System checks SSL/TLS, security headers, HTTPS enforcement.
+
+```
+Step 3 of 6 — Security Configuration
+[████████░░] 80%
+```
+
+### TLS Block
+
+```
+Certificate:
+  Status:  Valid  ✓
+  Issuer:  Let's Encrypt
+  Expiry:  89 days
+  Type:    DV
+
+Protocol support:
+  TLS 1.3  ✓ | TLS 1.2  ✓ | TLS 1.1  ✗ (disabled)
+  Forward secrecy  ✓ | HSTS  ✓
+
+Grade: A+
+```
+
+### Headers Block
+
+```
+Header                       Status
+────────────────────────────────────
+Strict-Transport-Security    ✓
+Content-Security-Policy      ✓
+X-Frame-Options              ✓
+X-Content-Type-Options       ✓
+Referrer-Policy              ✓
+Permissions-Policy           ✗ Missing
+X-XSS-Protection             ✓
+
+Score: 6/7  |  Grade: A
+```
+
+Missing header detail auto-shown with fix instructions.
+
+---
+
+## Step 4: Exposure Check
+
+Searches for leaked files, open directories, exposed interfaces.
+
+```
+Step 4 of 6 — Exposure Check
+[████████░░] 80%
+```
+
+### Clean Result
+
+```
+Exposure check: no significant findings.
+
+Checked:
+  ✗ Config files (.env, web.config)  — none
+  ✗ Backup files (.bak, .old)        — none
+  ✗ Open directory listings          — none
+  ✗ Admin interfaces                 — none
+  ✗ Source repositories (.git)       — none
+
+Exposure risk: LOW
+```
+
+### Issues Found Format
+
+```
+⚠ Exposure findings:
+
+  [MEDIUM]  Backup file at /config.php.bak — may contain credentials
+  [MEDIUM]  Directory listing enabled at /assets/
+  [LOW]     robots.txt exposes /admin/ /api/ /internal/
+
+Total exposure score: 3.5/10
+```
+
+---
+
+## Step 5: Technology & Vulnerabilities
+
+Identifies stack, versions, third-party services, CVE matches.
+
+```
+Step 5 of 6 — Technology Detection
+[██████░░░░] 60%
+```
+
+```
+Stack:
+  nginx 1.24.0    ✓ current
+  PHP 8.1.27      ✓ current
+  Laravel 10.40   ✓ current
+  jQuery 3.7.1    ✓ current
+
+Third-party:
+  Google Analytics 4 · CloudFlare · AWS S3 · reCAPTCHA v3
+
+CVE check: 47 entries checked — 0 affecting this stack  ✓
+```
+
+---
+
+## Step 6: Risk Report
+
+```
+Step 6 of 6 — Risk Report
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+DOMAIN SWEEP REPORT  |  example.com
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Overall Grade: A-    Risk Score: 2.3/10
+
+Category Scores:
+  Registration:  9/10  ✓
+  TLS/SSL:      10/10  ✓
+  Headers:       9/10  ✓
+  Exposure:      8/10  ✓
+  Technology:   10/10  ✓
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+### Priority Actions
+
+```
+Priority  Item                        Timeline
+────────────────────────────────────────────────
+Medium    Renew domain (45 days)      Within 30 days
+Medium    Remove /config.php.bak      This week
+Low       Add Permissions-Policy      Next deploy
+Low       Disable /assets/ listing    Next deploy
+```
+
+### Export
+
+```
+1. Executive summary (PDF)
+2. Technical report (PDF)
+3. Findings CSV
+4. JSON export
+5. Remediation checklist
+
+Select (1–5): _
+```
+
+---
+
+## Related Files
+
+- `experience/case-templates/tpl-security-review.md` — template version
+- `techniques/domain-intelligence.md` — manual sweep techniques
+- `engine/collection-engine.md` — source orchestration