@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/experience/layered-detail.md

@@ -0,0 +1,205 @@
+# Layered Detail
+
+Output reveals information in four layers, from summary to raw. Users control depth.
+
+---
+
+## The Four Layers
+
+| Layer | Name | Contents | Default For |
+|-------|------|----------|-------------|
+| 1 | Summary | Single finding, confidence indicator | Novice |
+| 2 | Context | Finding + source count + related items | Practitioner |
+| 3 | Technical | Full analysis, timestamps, all sources | Specialist |
+| 4 | Raw | Unprocessed data + full metadata | Specialist (`/raw`) |
+
+---
+
+## Navigation Commands
+
+| From | Command | Result |
+|------|---------|--------|
+| Summary | `/context` | Layer 2 |
+| Context | `/technical` | Layer 3 |
+| Technical | `/raw` | Layer 4 |
+| Any layer | `/summary` | Return to Layer 1 |
+| Any layer | `/layer [1-4]` | Jump directly |
+
+---
+
+## Layer Format Examples
+
+### Layer 1 — Summary
+
+```
+Email: john.doe@example.com
+Confidence: High  |  Sources: 3
+/context for more  |  /raw for data
+```
+
+### Layer 2 — Context
+
+```
+Email: john.doe@example.com
+Type: Professional  |  Confidence: 87%
+First seen: 2019  |  Last verified: 2024
+Sources: 3 (LinkedIn, company site, conference bio)
+Related: 2 phone numbers, 1 address
+/technical for full analysis
+```
+
+### Layer 3 — Technical
+
+```
+━━━ FINDING: Email ━━━
+Value:         john.doe@example.com
+Classification: Professional
+Confidence:    87%
+Seen:          2019-03-15 → 2024-01-20
+
+Source Chain:
+  [1] linkedin.com/in/johndoe (verified 2024-01-20)
+  [2] example.com/team (scraped 2023-11-10)
+  [3] techconf.org/speakers-2019 (archived 2019-03-15)
+
+Pattern: firstname.lastname@domain — corporate standard
+Risk:    None
+Linked:  2 phones · 1 address · 4 social profiles
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+/summary | /raw | /export | /chrono
+```
+
+### Layer 4 — Raw
+
+```
+{"type":"email","value":"john.doe@example.com",
+ "confidence":0.87,"first_seen":"2019-03-15",
+ "last_verified":"2024-01-20","classification":"professional",
+ "sources":[{"url":"...","scraped":"..."},...],
+ "risk_indicators":[],"linked_findings":["ph:+1...","addr:..."]}
+```
+
+---
+
+## Reveal Triggers
+
+Detail layers surface automatically when conditions are met.
+
+| Condition | Layer Revealed |
+|-----------|---------------|
+| Risk score ≥ 8 | Technical (Layer 3) forced |
+| Conflicting sources | Context (Layer 2) auto-shown |
+| User types `/why` | Context for that finding |
+| Export requested | Technical minimum enforced |
+| Case template active | Layer set per template config |
+
+---
+
+## Terminology Translation Table
+
+Specialist terms are rendered in plain language in Novice tier.
+
+| Specialist Term | Novice Rendering |
+|-----------------|-----------------|
+| Reconnaissance | Subject information sweep |
+| Pivot | Follow a connection |
+| Dork | Targeted search query |
+| EXIF | Photo origin data |
+| WHOIS | Domain ownership record |
+| Subdomain | Sub-section of a site |
+| Geolocation | Physical location data |
+| Sock puppet | Fabricated identity |
+| PII | Personal identifiers |
+| IOC | Threat indicator |
+| TTPs | Behavioral signatures |
+
+Translation format in output:
+```
+We found EXIF data (photo origin information) embedded in the file.
+```
+
+---
+
+## User Preference Memory
+
+The system tracks per-command layer preferences across a session.
+
+| Tracked Signal | Adaptation |
+|----------------|------------|
+| User reached Layer 3 on `/sweep` twice | Default `/sweep` to Layer 2 |
+| User declined `/context` 3 times | Default stays Layer 1 |
+| User always types `/raw` after `/scan` | Pre-fetch Layer 4 |
+
+---
+
+## Finding Explanation — /clarify
+
+Decomposes a single finding into plain language at Layer 1 depth, regardless of current layer setting.
+
+### Command
+
+```
+/clarify [finding_id]
+```
+
+### Behavior
+
+1. Fetch the finding by ID from the active case
+2. Resolve source reliability grade (A–F) from `analysis/confidence-scoring.md`
+3. Determine next recommended action based on trust_score and finding type
+4. Render using tier-appropriate template below
+
+### Output Templates
+
+**Novice — full template with glossary:**
+```
+[What]:       We found [desc].
+[Where]:      From [source_label] (reliability: [A-F grade]).
+[Confidence]: [label] ([score]/5).
+[Action]:     [next step].
+
+Glossary: [any specialist terms used, translated per terminology table]
+```
+
+**Practitioner — 2 sentences:**
+```
+[desc] — sourced from [source_label] (reliability: [A-F]), confidence [label].
+Next: [next step].
+```
+
+**Specialist — one-liner:**
+```
+[F-id] [type]: [desc] | [source_label] [A-F] | [score]/5 | [next step]
+```
+
+### Source Reliability Grades
+
+| Grade | Meaning                                |
+|-------|----------------------------------------|
+| A     | Primary / official record              |
+| B     | Verified third-party                   |
+| C     | Credible but unverified                |
+| D     | Single unconfirmed source              |
+| E     | Known unreliable source                |
+| F     | Fabricated or disputed                 |
+
+### Example (Novice)
+
+```
+/clarify F-003
+
+[What]:       We found an email address: john.doe@example.com.
+[Where]:      From LinkedIn (reliability: B — verified third-party).
+[Confidence]: High (4/5).
+[Action]:     Run /pivot --email john.doe@example.com to find linked accounts.
+
+Glossary: "pivot" means follow a connection to find more information.
+```
+
+---
+
+## Related Files
+
+- `experience/skill-tiers.md` — tier controls default layer
+- `experience/guidance-system.md` — hints when to go deeper
+- `analysis/confidence-scoring.md` — confidence values shown at each layer

package/skills/cti-expert/experience/skill-tiers.md

@@ -0,0 +1,164 @@
+# Skill Tiers
+
+Three tiers adapt output density and automation to user proficiency.
+
+---
+
+## Tier Overview
+
+| Tier | Profile | Output Density | Automation | Explanations |
+|------|---------|----------------|------------|--------------|
+| Novice | First cases, unfamiliar with OSINT | Minimal, curated | High | Built-in, always on |
+| Practitioner | Recurring use, knows core commands | Moderate detail | Selective | On request |
+| Specialist | Daily operator, builds custom workflows | Full data dump | Off by default | Reference only |
+
+---
+
+## Novice Tier
+
+### Behavior Specs
+
+| Parameter | Value |
+|-----------|-------|
+| Findings per screen | Max 3, ranked by relevance |
+| Technical vocabulary | Translated on first use |
+| Next-step prompts | Always provided |
+| Error handling | Full recovery path |
+| Confirmation gates | All operations |
+
+### Sample Output
+
+```
+/sweep example.com
+
+Novice output:
+  Located 3 social accounts for example.com.
+  [1] Twitter: @example
+  [2] LinkedIn: Example Inc
+  [3] Facebook: Example Co
+
+  Which should I examine first?
+  Type 1, 2, or 3 — or /skip to move on.
+```
+
+### Auto-Explain Triggers
+
+- Any command not used this session
+- Operations with 3+ parameters
+- Findings with threat score above 7
+- Any operation running longer than 30 seconds
+- All error conditions
+
+---
+
+## Practitioner Tier
+
+### Behavior Specs
+
+| Parameter | Value |
+|-----------|-------|
+| Findings per screen | Up to 10 with context |
+| Technical vocabulary | Defined via `/define [term]` |
+| Next-step prompts | Suggested when relevant |
+| Error handling | Short recovery steps |
+| Confirmation gates | Bulk operations only |
+
+### Sample Output
+
+```
+/sweep example.com
+
+Practitioner output:
+  3 social accounts — example.com:
+  - Twitter @example: 50K followers, active since 2010
+  - LinkedIn Example Inc: ~500 staff
+  - Facebook Example Co: 12K engagements
+
+  Continue: /dig 1  or  /chrono for activity pattern.
+```
+
+---
+
+## Specialist Tier
+
+### Behavior Specs
+
+| Parameter | Value |
+|-----------|-------|
+| Findings per screen | Raw structured data |
+| Technical vocabulary | Not defined |
+| Next-step prompts | Only via `/hint` |
+| Error handling | Status codes only |
+| Confirmation gates | Disabled (add `/confirm` flag to re-enable) |
+
+### Sample Output
+
+```
+/sweep example.com
+
+Specialist output:
+  [ACCTS:3]
+  [0] TW:@example | F:50K | EST:2010 | R:0.82
+  [1] LI:Example Inc | EMP:500 | R:0.91
+  [2] FB:Example Co | ENG:12K | R:0.76
+```
+
+---
+
+## Tier Switching
+
+### Manual
+
+```
+/tier novice
+/tier practitioner
+/tier specialist
+/tier auto          # reset to auto-detect
+```
+
+### Auto-Detection Signals
+
+| Signals → Novice | Signals → Specialist |
+|------------------|---------------------|
+| First session | Rapid command sequences |
+| Full-sentence input | Advanced flag usage |
+| Repeated similar commands | Custom dork construction |
+| High `/help` rate (>3 in 5 min) | Pipeline chaining |
+| Syntax errors > 2 consecutive | OSINT cert mention |
+
+### Tier Mismatch Prompts
+
+| Condition | Prompt |
+|-----------|--------|
+| Specialist + frequent `/help` | "Switch to Practitioner? `/tier practitioner`" |
+| Novice + advanced commands used correctly | "Try Practitioner tier? `/tier practitioner`" |
+| Novice + declining all explanations | "Speed things up with Practitioner mode? `/tier practitioner`" |
+
+### Persistence
+
+- Tier persists for the session
+- Stored in subject profile
+- Override per-command with `--tier [level]` flag
+
+---
+
+## Tier Feature Matrix
+
+| Feature | Novice | Practitioner | Specialist |
+|---------|--------|--------------|------------|
+| Output verbosity | Curated | Moderate | Raw |
+| Auto-explanation | Always | Never (on request) | Never |
+| Operation confirmation | All | Bulk only | None |
+| Error detail | Full guide | Steps | Code |
+| Progress display | Visual + text | Text | None |
+| Examples shown | Always | On demand | Never |
+| Glossary links | Auto-injected | Manual | None |
+| Tutorial offers | Frequent | Rare | Never |
+
+---
+
+## Related Files
+
+- `experience/layered-detail.md` — controls output depth per tier
+- `experience/guidance-system.md` — proactive hints by tier
+- `engine/command-router.md` — tier-aware command dispatch

package/skills/cti-expert/experience/tutorial.md

@@ -0,0 +1,198 @@
+# Tutorial — /onboard Command
+
+Guided introduction to the CTI Expert skill. Adapts depth to tier.
+
+---
+
+## Command
+
+```
+/onboard [--tier novice|practitioner|specialist]
+```
+
+- `--tier` overrides auto-detected tier for this session only
+- `--yolo` skips onboarding entirely and opens an empty case
+- Omitting `--tier` uses the tier stored in `workspace_metadata.tier`
+
+---
+
+## Auto-Trigger
+
+Suggested automatically when tier auto-detects as `novice` and
+`workspace_metadata.onboarding_completed` is absent. Prompt:
+```
+First session detected. Run /onboard to start, or /onboard --yolo to skip.
+```
+
+---
+
+## Tier Adaptation Table
+
+| Step | Topic                          | Novice       | Practitioner | Specialist   |
+|------|--------------------------------|--------------|--------------|--------------|
+| 1    | What is OSINT?                 | Full verbose | Skip         | Skip         |
+| 2    | Start a case demo              | Full verbose | Concise      | Concise      |
+| 3    | Read results — trust scores    | Full verbose | Concise      | Concise      |
+| 4    | Dig deeper — /branch /crossref | Full verbose | Concise      | Full verbose |
+| 5    | Report — /brief /report        | Full verbose | Concise      | Full verbose |
+
+---
+
+## Step 1 — What Is OSINT?
+
+*Novice only. Practitioners and Specialists skip to Step 2.*
+
+```
+OSINT (Open-Source Intelligence) means gathering information from
+publicly available sources — no hacking, no deception, no private
+databases. Everything collected comes from:
+
+  • Public websites and social media
+  • Government and court records
+  • Domain registration data (WHOIS)
+  • Breach disclosure databases
+  • News archives and academic sources
+
+Why it matters: Organizations use OSINT to vet partners, investigate
+fraud, track threat actors, and surface risks before they escalate.
+
+Legal note: OSINT is legal when sources are public. This skill
+never advises accessing private systems or deceiving subjects.
+
+[ Press Enter to continue ]
+```
+
+---
+
+## Step 2 — Start a Case Demo
+
+**Novice (verbose):**
+```
+Let's open a demo case to see how investigations work.
+
+  /case new --name "Tutorial Demo" --subject "example.com"
+
+This creates a fresh workspace with one subject: a domain.
+Subjects are the people, organizations, or infrastructure you
+are investigating. You can add more with /subject add.
+
+[ Press Enter to run the demo case ]
+```
+
+**Practitioner / Specialist (concise):**
+```
+Demo case: /case new --name "Tutorial Demo" --subject "example.com"
+Add subjects later with /subject add. Starting now.
+```
+
+---
+
+## Step 3 — Read Results — Trust Scores
+
+**Novice (verbose):**
+```
+After a scan you will see findings like this:
+
+  [F-001] Domain registered: 2018-03-12
+          Source: WHOIS (whois.verisign-grs.com)
+          Trust: ●●●●○  4/5  — Reliable registry data
+
+Trust scores run from 1 (unverified) to 5 (authoritative).
+  ●○○○○  1  Unverified — single unconfirmed source
+  ●●○○○  2  Low — needs corroboration
+  ●●●○○  3  Moderate — credible but not confirmed
+  ●●●●○  4  High — multiple consistent sources
+  ●●●●●  5  Authoritative — primary or official record
+
+Use /clarify F-001 to get a plain-language explanation of any finding.
+```
+
+**Practitioner / Specialist (concise):**
+```
+Trust scores: 1=unverified → 5=authoritative. Use /clarify [id]
+to decompose any finding. Scores ≤ 2 flag for /verify-finding.
+```
+
+---
+
+## Step 4 — Dig Deeper — /branch and /crossref
+
+**Novice (verbose):**
+```
+Findings often unlock new leads. Two key commands:
+
+  /branch F-001
+    Follow a finding outward. The domain registration date in F-001
+    might reveal a registrar account — which could link to other domains.
+
+  /crossref F-001 F-002
+    Compare two findings for shared attributes (same email, same IP,
+    same registrar). Connections surface patterns that a single
+    finding cannot show alone.
+
+When findings conflict, use /resolve to document the discrepancy
+rather than silently dropping one.
+```
+
+**Practitioner (concise):**
+```
+/branch [id] — follow a finding outward.
+/crossref [id] [id] — compare findings for shared attributes.
+/resolve — document conflicting findings.
+```
+
+*Specialist: full verbose (same as Novice).*
+
+---
+
+## Step 5 — Report — /brief and /report
+
+**Novice / Specialist (verbose):**
+```
+When your investigation is ready for delivery:
+
+  /brief
+    A 1-page executive summary. Written in plain language.
+    Includes: subject summary, key findings, confidence overview,
+    recommended actions.
+
+  /report [--format pdf|md|html]
+    Full structured report. Includes all findings, source citations,
+    coverage matrix, and limitations section.
+
+Always run /validate before generating a report.
+Tip: /coverage shows which discovery paths you have not yet tried.
+```
+
+**Practitioner (concise):**
+```
+/brief — executive summary. /report [--format] — full report.
+Run /validate first. /coverage shows unchecked paths.
+```
+
+---
+
+## Completion Tracking and --yolo
+
+On completion, write to `workspace_metadata`:
+
+```json
+{
+  "onboarding_completed": true,
+  "onboarding_tier":      "novice",
+  "onboarding_timestamp": "<ISO-8601>"
+}
+```
+
+Subsequent sessions skip the auto-trigger prompt.
+
+`/onboard --yolo` skips all steps immediately and writes
+`{ "onboarding_completed": true, "onboarding_skipped": true }`.
+
+---
+
+## Related Files
+
+- `experience/skill-tiers.md` — tier definitions and auto-detection
+- `experience/feedback-system.md` — quality feedback after investigation
+- `engine/workspace-manager.md` — workspace_metadata schema

package/skills/cti-expert/guides/walkthroughs/walkthrough-domain-sweep.md

@@ -0,0 +1,131 @@
+# Walkthrough: Domain Sweep
+
+Step-by-step case example. Target: `startup-example.io`
+Scenario: Pre-investment due diligence sweep on an early-stage company's domain infrastructure.
+
+---
+
+## Setup
+
+Open case workspace. Add `startup-example.io` as primary subject (type: domain).
+
+---
+
+## Step 1 — WHOIS and Registration History
+
+**Query:**
+```
+WHOIS lookup: startup-example.io
+Registrar history: viewdns.info/whois/?domain=startup-example.io
+```
+
+**Findings logged:**
+```
+FND-001  Registrant email: founders@startup-example.io  [HIGH — confirmed]
+FND-002  Registered: 2023-04-11  Expires: 2025-04-11  [INFO]
+FND-003  Registrar: Namecheap  Privacy: enabled  [INFO]
+```
+
+**Flag:** FND-002 — expiry < 60 days from case date. Domain at lapse risk.
+
+---
+
+## Step 2 — DNS Records
+
+**Query tools:** `dig`, `dnsdumpster.com`, `securitytrails.com`
+
+**Findings logged:**
+```
+FND-004  MX: mail.startup-example.io → Google Workspace  [INFO]
+FND-005  SPF record absent  [HIGH — exposure: email spoofing enabled]
+FND-006  DMARC record absent  [HIGH — exposure: phishing risk]
+FND-007  TXT: includes verification token for Stripe  [MEDIUM — reveals payment processor]
+```
+
+---
+
+## Step 3 — Subdomain Sweep
+
+**Method:** Certificate transparency (crt.sh), DNS brute-force, search operator query
+
+**Operator query:**
+```
+site:startup-example.io -www
+```
+
+**Subdomains discovered:**
+```
+SUB-002  api.startup-example.io        → responds HTTP 200  [INFO]
+SUB-003  staging.startup-example.io    → responds HTTP 200  [HIGH — public staging env]
+SUB-004  admin.startup-example.io      → responds HTTP 403  [MEDIUM — admin panel exists]
+SUB-005  mail.startup-example.io       → responds HTTP 200  [INFO]
+```
+
+**Flag:** SUB-003 — staging environment publicly accessible.
+
+---
+
+## Step 4 — Exposed Files Sweep
+
+**Operator queries:**
+```
+site:startup-example.io filetype:pdf
+site:startup-example.io filetype:env OR filetype:log
+site:startup-example.io intitle:"index of"
+```
+
+**Findings logged:**
+```
+FND-008  site:startup-example.io filetype:pdf → 3 results: pitch-deck-v2.pdf  [MEDIUM]
+FND-009  intitle:"index of" → open directory at /uploads/  [CRITICAL]
+FND-010  /uploads/ contains: user-export-2024-11.csv  [CRITICAL — PII exposure]
+```
+
+---
+
+## Step 5 — Credential Exposure Check
+
+**Tools:** HaveIBeenPwned (domain search), dehashed.com, pastebin operator queries
+
+**Operator queries:**
+```
+"@startup-example.io" site:pastebin.com
+"startup-example.io" "password" site:github.com
+```
+
+**Findings logged:**
+```
+FND-011  4 accounts from @startup-example.io in 2023 breach (LinkedIn scrape)  [HIGH]
+FND-012  GitHub repo: employee/config-backup — contains .env with DB_PASSWORD  [CRITICAL]
+```
+
+---
+
+## Step 6 — Exposure Summary
+
+```
+╔══ EXPOSURE SUMMARY: startup-example.io ═══════════════════════╗
+║  Subjects:  5  (domain + 4 subdomains)                        ║
+║  Findings:  12  (2 CRITICAL, 4 HIGH, 4 MEDIUM, 2 INFO)       ║
+║  Exposure:  CRITICAL (88/100)                                 ║
+╠═══════════════════════════════════════════════════════════════╣
+║  CRITICAL                                                     ║
+║  • Open directory /uploads/ with user PII export             ║
+║  • GitHub credential leak (DB password)                       ║
+║  HIGH                                                         ║
+║  • No SPF or DMARC records (email spoofing)                  ║
+║  • Public staging environment                                 ║
+║  • 4 accounts in breach database                             ║
+╚═══════════════════════════════════════════════════════════════╝
+```
+
+---
+
+## Step 7 — Report
+
+Format: F6 (threat-brief) for security team, F1 (leadership-brief) for investor.
+See [`output/reports/format-catalog.md`](../../output/reports/format-catalog.md).
+
+---
+
+*See also: [`guides/walkthroughs/walkthrough-person-lookup.md`](./walkthrough-person-lookup.md)*