@slicedearth/whoisleuth-cli 1.34.0 → 1.36.1

package/cli/offline-evidence-review.mjs

@@ -0,0 +1,141 @@
+import { Buffer } from 'node:buffer';
+import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
+import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
+import { buildLocalGeoIpDatabase, lookupLocalGeoIp, } from "../lib/local-geoip-evidence.mjs";
+import { normalizeRdapSearchHelp, planRdapReverseSearch, } from "../lib/rdap-search-workbench.mjs";
+import { reviewRpkiRoute } from "../lib/rpki-evidence.mjs";
+import { analyzeTlsaEvidence } from "../lib/tlsa-evidence.mjs";
+import { CliUsageError } from "./errors.mjs";
+const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
+const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
+const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function parseInput(value) {
+    if (typeof value !== 'string' || Buffer.byteLength(value, 'utf8') > MAX_OFFLINE_EVIDENCE_INPUT_BYTES) {
+        throw new CliUsageError(`Offline evidence input is limited to ${MAX_OFFLINE_EVIDENCE_INPUT_BYTES} bytes.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(value.replace(/^\uFEFF/u, ''));
+    }
+    catch {
+        throw new CliUsageError('Offline evidence review requires one valid JSON document.');
+    }
+    const document = record(parsed);
+    if (document.version !== 1 || typeof document.schema !== 'string') {
+        throw new CliUsageError('Offline evidence review requires a supported versioned input schema.');
+    }
+    return document;
+}
+function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString()) {
+    const input = parseInput(value);
+    let kind;
+    let result;
+    if (input.schema === 'whoisleuth.rdap-search-input') {
+        kind = 'rdap_search';
+        const request = record(input.request);
+        const help = normalizeRdapSearchHelp(input.help);
+        result = Object.freeze({
+            help,
+            plan: planRdapReverseSearch(help, {
+                searchableResourceType: String(request.searchableResourceType ?? ''),
+                relatedResourceType: String(request.relatedResourceType ?? ''),
+                property: String(request.property ?? ''),
+                value: request.value,
+            }),
+        });
+    }
+    else if (input.schema === 'whoisleuth.dnssec-evidence-input') {
+        kind = 'dnssec';
+        result = validateDnssecEvidence({
+            ownerName: input.ownerName,
+            delegationSigned: input.delegationSigned,
+            dsRecords: input.dsRecords,
+            dnskeyRecords: input.dnskeyRecords,
+            rrSigRecords: input.rrSigRecords,
+            observedAt: input.observedAt,
+        });
+    }
+    else if (input.schema === 'whoisleuth.tlsa-evidence-input') {
+        kind = 'tlsa';
+        result = analyzeTlsaEvidence({
+            serviceName: input.serviceName,
+            dnssecState: input.dnssecState,
+            pkixValidationState: input.pkixValidationState,
+            records: input.records,
+            certificateDerBase64: input.certificateDerBase64,
+            spkiDerBase64: input.spkiDerBase64,
+            authorityMaterials: input.authorityMaterials,
+        });
+    }
+    else if (input.schema === 'whoisleuth.rpki-route-input') {
+        kind = 'rpki';
+        result = reviewRpkiRoute({
+            routePrefix: input.routePrefix,
+            originAsn: input.originAsn,
+            authorizations: input.authorizations,
+        });
+    }
+    else if (input.schema === 'whoisleuth.local-geoip-query') {
+        kind = 'geoip';
+        result = lookupLocalGeoIp(buildLocalGeoIpDatabase(input.database), input.address);
+    }
+    else if (input.schema === 'whoisleuth.encrypted-dns-plan-input') {
+        kind = 'encrypted_dns';
+        const query = record(input.query);
+        result = planEncryptedDnsQuery(normalizeEncryptedDnsAdapter(input.adapter), { name: query.name, type: query.type });
+    }
+    else {
+        throw new CliUsageError('Offline evidence review does not recognize this input schema.');
+    }
+    return Object.freeze({
+        schema: OFFLINE_EVIDENCE_REVIEW_SCHEMA,
+        version: OFFLINE_EVIDENCE_REVIEW_VERSION,
+        generatedAt,
+        kind,
+        result,
+        limitations: Object.freeze([
+            'The review is local and uses only the supplied document. It does not refresh, transmit, or independently establish the current completeness of the evidence.',
+        ]),
+    });
+}
+function formatOfflineEvidenceReview(document) {
+    const result = record(document.result);
+    const state = typeof result.state === 'string' ? result.state : 'reviewed';
+    const lines = [
+        'Offline evidence review',
+        `Kind   ${document.kind.replaceAll('_', ' ')}`,
+        `State  ${state.replaceAll('_', ' ')}`,
+    ];
+    if (document.kind === 'rdap_search') {
+        const help = record(result.help);
+        const plan = record(result.plan);
+        lines.push(`Help   ${String(help.state ?? 'unavailable').replaceAll('_', ' ')}`);
+        lines.push(`Plan   ${String(plan.state ?? 'unavailable').replaceAll('_', ' ')}`);
+    }
+    else {
+        for (const [label, key] of [
+            ['Records', 'records'],
+            ['Rejected', 'rejectedCount'],
+            ['Matches', 'matchingAuthorizationCount'],
+        ]) {
+            const candidate = result[key];
+            if (Array.isArray(candidate))
+                lines.push(`${label.padEnd(7)}${candidate.length}`);
+            else if (typeof candidate === 'number')
+                lines.push(`${label.padEnd(7)}${candidate}`);
+        }
+    }
+    lines.push('', 'Limitations:');
+    for (const limitation of document.limitations)
+        lines.push(`  - ${limitation}`);
+    const nestedLimitations = Array.isArray(result.limitations) ? result.limitations : [];
+    for (const limitation of nestedLimitations) {
+        if (typeof limitation === 'string')
+            lines.push(`  - ${limitation}`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+export { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, OFFLINE_EVIDENCE_REVIEW_SCHEMA, OFFLINE_EVIDENCE_REVIEW_VERSION, buildOfflineEvidenceReview, formatOfflineEvidenceReview, };

package/cli/registry-support.mjs

@@ -1,6 +1,6 @@
 import { registryStandardsCoverageSnapshot, } from "../lib/registry-capabilities.mjs";
 const REGISTRY_SUPPORT_SCHEMA = 'whoisleuth.cli.registry-support';
-const REGISTRY_SUPPORT_SCHEMA_VERSION = 2;
+const REGISTRY_SUPPORT_SCHEMA_VERSION = 3;
 const REGISTRY_STANDARDS_COVERAGE_SCHEMA = 'whoisleuth.registry-standards-coverage';
 const MAX_REGISTRY_SUPPORT_TEXT_LENGTH = 2048;
 const MAX_REGISTRY_SUPPORT_REFERENCES = 20;
@@ -100,9 +100,6 @@ function buildRegistrySupportDocument(requestedInput, capability, catalogueVersi
                 encodingProfile: boundedText(capability.whoisEncodingProfile, 'unknown', 64),
                 parserProfile: boundedText(capability.whoisParserProfile, 'unknown', 128),
             },
-            fallbackProfile: capability.fallbackProfile
-                ? boundedText(capability.fallbackProfile, 'unknown', 128)
-                : null,
         },
         verification: {
             fixtureScenarios: boundedList(capability.fixtureScenarios, 'token'),

package/cli/runner.mjs

@@ -26,8 +26,12 @@ import { buildCliLookupDiff, formatCliLookupDiff } from "./lookup-diff.mjs";
 import { MAX_LOOKUP_TIMELINE_INPUT_BYTES, buildCliLookupTimeline, formatCliLookupTimeline, } from "./lookup-timeline.mjs";
 import { buildCliPageComparison, formatCliPageComparison } from "./page-compare.mjs";
 import { MAX_MAIL_REVIEW_INPUT_BYTES, buildCliMailReview, formatCliMailReview, } from "./mail-review.mjs";
+import { MAX_OFFLINE_EVIDENCE_INPUT_BYTES, buildOfflineEvidenceReview, formatOfflineEvidenceReview, } from "./offline-evidence-review.mjs";
+import { DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, buildDomainControlManifest, formatDomainControlResult, reviewDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { runLookupCommand } from "./lookup-command-runner.mjs";
 import { buildCliManual } from "./manual.mjs";
+import { buildInvestigationPlan, formatInvestigationPlan } from "./investigation-plan.mjs";
+import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../lib/project-metadata.mjs";
 import { createBufferedOutput, writePrivateFile } from "./output-file.mjs";
 import { createTerminalProgress } from "./progress.mjs";
 import { buildRegistrySupportDocument } from "./registry-support.mjs";
@@ -66,6 +70,9 @@ Review saved evidence:
   compare            Compare saved registry publications.
   page-compare       Compare saved static page and TLS evidence.
   mail-review        Review saved passive mail exposure evidence.
+  review-evidence    Review supplied DNS, routing, GeoIP, or RDAP evidence offline.
+  domain-control     Build or review an integrity-protected desired-state manifest.
+  workflow-plan      Plan a fixed investigation recipe without executing it.
   diff               Compare two saved domain observations.
   timeline           Compare a sequence of observations for one domain.
   export             Convert a saved lookup into an evidence report.
@@ -90,7 +97,7 @@ Diagnostics are written to stderr. Fast lookup is the default; deep collection
 must be requested explicitly and can disclose a target to additional sources.
 
 Copyright 2026 slicedearth. Licensed under AGPL-3.0-only.
-Source and licence: https://github.com/slicedearth/whoisleuth
+Source and licence: ${WHOISLEUTH_SOURCE_REPOSITORY_URL}
 `;
 const COMMAND_USAGE = Object.freeze({
     completion: 'whoisleuth completion <bash|zsh|fish|powershell>',
@@ -115,6 +122,9 @@ const COMMAND_USAGE = Object.freeze({
     compare: 'whoisleuth compare [lookup.json] [--json] [--quiet] [--no-color]',
     'page-compare': 'whoisleuth page-compare <left.json> <right.json> [--json] [--quiet] [--no-color]',
     'mail-review': 'whoisleuth mail-review [bulk.json|bulk.jsonl] [--json] [--quiet] [--no-color]',
+    'review-evidence': 'whoisleuth review-evidence [evidence.json] [--json] [--quiet] [--no-color]',
+    'domain-control': 'whoisleuth domain-control [manifest-input.json|review-input.json] [--json] [--quiet] [--no-color]',
+    'workflow-plan': 'whoisleuth workflow-plan <recipe> <domain|brand> [--json] [--quiet] [--no-color]',
     diff: 'whoisleuth diff <left.json> <right.json> [--json] [--quiet] [--no-color]',
     timeline: 'whoisleuth timeline <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact]',
@@ -230,6 +240,21 @@ const COMMAND_DETAILS = Object.freeze({
         example: 'whoisleuth mail-review candidates.json --json',
         boundary: 'Review is offline and sends no SMTP traffic. Missing or partial DNS evidence remains inconclusive.',
     },
+    'review-evidence': {
+        description: 'Review one versioned DNSSEC, TLSA, RPKI, GeoIP, encrypted-DNS, or RDAP planning document offline.',
+        example: 'whoisleuth review-evidence dnssec-evidence.json --json',
+        boundary: 'The command reads only the supplied document. It performs no DNS, RDAP, BGP, GeoIP-provider, TLS, HTTP, or SMTP request.',
+    },
+    'domain-control': {
+        description: 'Build an integrity-protected desired-state manifest or compare one with supplied observations.',
+        example: 'whoisleuth domain-control domain-control-input.json --json',
+        boundary: 'The command is offline and changes no registrar, DNS, mail, or certificate configuration. Only complete supplied observations can produce drift.',
+    },
+    'workflow-plan': {
+        description: 'Build a fixed domain-investigation plan from existing bounded CLI commands.',
+        example: 'whoisleuth workflow-plan domain-triage example.test --json',
+        boundary: 'Planning is offline and plan-only. It does not execute commands, expand placeholders, read files, make requests, or submit evidence.',
+    },
     diff: {
         description: 'Compare bounded evidence retained in two saved domain lookups.',
         example: 'whoisleuth diff first.json second.json --json',
@@ -269,6 +294,9 @@ const COMMAND_COLLECTION = Object.freeze({
     compare: { mode: 'offline', scope: 'Reads one saved Lookup and compares its separately attributed registry publications.' },
     'page-compare': { mode: 'offline', scope: 'Reads two saved Lookup documents and executes no page code.' },
     'mail-review': { mode: 'offline', scope: 'Reads one saved Bulk result and sends no DNS or SMTP traffic.' },
+    'review-evidence': { mode: 'offline', scope: 'Reads one bounded versioned evidence or request-planning document and performs no collection.' },
+    'domain-control': { mode: 'offline', scope: 'Reads one bounded desired-state or review document and performs no collection or configuration change.' },
+    'workflow-plan': { mode: 'offline', scope: 'Builds a fixed typed recipe and executes none of its network or file steps.' },
     diff: { mode: 'offline', scope: 'Reads two saved Lookup documents for different domains.' },
     timeline: { mode: 'offline', scope: 'Reads 2 to 20 saved observations for one domain, capped at 32 MiB in total.' },
     export: { mode: 'offline', scope: 'Reads one saved Lookup and writes one bounded report.' },
@@ -644,6 +672,86 @@ async function runParsedCli(args, dependencies = {}) {
                     : terminal(formatCliMailReview(document), args.color));
             return EXIT_CODES.SUCCESS;
         }
+        if (args.action === 'review-evidence') {
+            failureLabel = 'Offline evidence review';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
+                        label: 'Offline evidence input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read offline evidence input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('review-evidence requires one JSON file or a document on stdin.');
+            const document = buildOfflineEvidenceReview(input, commandContext.now());
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatOfflineEvidenceReview(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'domain-control') {
+            failureLabel = 'Domain control review';
+            let input;
+            try {
+                input = dependencies.readArtifactInput
+                    ? await dependencies.readArtifactInput(args.source)
+                    : await readSavedLookupInputBounded(args.source
+                        ? createReadStream(args.source, { highWaterMark: 64 * 1024 })
+                        : dependencies.stdin || process.stdin, {
+                        limit: MAX_OFFLINE_EVIDENCE_INPUT_BYTES,
+                        label: 'Domain control input',
+                    });
+            }
+            catch (error) {
+                if (error instanceof CliUsageError)
+                    throw error;
+                throw new CliUsageError(`Could not read domain control input: ${boundedCliErrorMessage(error, 'Input could not be read')}`);
+            }
+            if (!input.trim())
+                throw new CliUsageError('domain-control requires one JSON file or a document on stdin.');
+            let parsed;
+            try {
+                parsed = JSON.parse(input);
+            }
+            catch {
+                throw new CliUsageError('Domain control input is not valid JSON.');
+            }
+            const schema = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+                ? parsed.schema
+                : null;
+            const document = schema === DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA
+                ? buildDomainControlManifest(parsed, commandContext.now())
+                : schema === DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA
+                    ? reviewDomainControlManifest(parsed, commandContext.now())
+                    : null;
+            if (!document) {
+                throw new CliUsageError(`Domain control input must use ${DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA} or ${DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA}.`);
+            }
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatDomainControlResult(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
+        if (args.action === 'workflow-plan') {
+            failureLabel = 'Investigation plan';
+            const document = buildInvestigationPlan(args.recipe, args.subject, commandContext.now());
+            if (!args.quiet)
+                write(stdout, args.output === 'json'
+                    ? formatJsonDocument(document)
+                    : terminal(formatInvestigationPlan(document), args.color));
+            return EXIT_CODES.SUCCESS;
+        }
         if (args.action === 'diff') {
             failureLabel = 'Lookup evidence diff';
             const readDiffInput = dependencies.readDiffInput || (async (source) => (readSavedLookupInputBounded(createReadStream(source, { highWaterMark: 64 * 1024 }), {

package/docs/cli.md

@@ -77,6 +77,9 @@ node bin/whoisleuth.mts lookup example.com --deep --json > lookup.json
 node bin/whoisleuth.mts compare lookup.json --json
 node bin/whoisleuth.mts page-compare official.json candidate.json --json
 node bin/whoisleuth.mts mail-review bulk.json --json
+node bin/whoisleuth.mts review-evidence dnssec-evidence.json --json
+node bin/whoisleuth.mts domain-control domain-control-input.json --json
+node bin/whoisleuth.mts workflow-plan domain-triage example.test --json
 node bin/whoisleuth.mts diff first-lookup.json second-lookup.json --json
 node bin/whoisleuth.mts timeline first-observation.json second-observation.json latest-observation.json --json
 node bin/whoisleuth.mts export lookup.json > evidence.json
@@ -181,7 +184,7 @@ Commands that query RDAP, WHOIS, DNS, HTTP, TLS, or Certificate Transparency do
 so directly from the machine running the CLI. They do not use the hosted login,
 hosted session, or deployment usage controls; upstream providers can see and
 rate-limit the local machine's network address. Offline `discover`, `compare`,
-`page-compare`, `mail-review`, `diff`, `timeline`, `risk-calibrate`, `verify-artifact`, `source-report`, `export`,
+`page-compare`, `mail-review`, `review-evidence`, `domain-control`, `workflow-plan`, `diff`, `timeline`, `risk-calibrate`, `verify-artifact`, `source-report`, `export`,
 `commands`, `completion`, and `manual` operations make no network requests. Commands write
 to stdout unless the analyst deliberately selects a local output file.
 
@@ -338,7 +341,7 @@ machine access is not evidence that a domain is unregistered or safe.
 This release supports `lookup`, `bulk`, `ct-search`, `discover`, `discover-scan`, `posture`,
 `http`, `tls`, `registry-support`, `risk-calibrate`, `verify-artifact`,
 `inspect-archive`, `sign-artifact`, `verify-signature`, `source-report`,
-`compare`, `page-compare`, `mail-review`, `diff`, `timeline`, `export`, `doctor`, `commands`, `completion`, and `manual`. Additional command families
+`compare`, `page-compare`, `mail-review`, `review-evidence`, `domain-control`, `workflow-plan`, `diff`, `timeline`, `export`, `doctor`, `commands`, `completion`, and `manual`. Additional command families
 are added as separate bounded increments rather than exposing incomplete
 aliases.
 
@@ -348,13 +351,13 @@ aliases.
 catalogue for one domain or suffix. It distinguishes an explicit
 fixture-backed or access-documented suffix profile from the generic IANA
 discovery profile and reports the RDAP and WHOIS discovery/access paths,
-WHOIS query and parser profiles, any bounded fallback, fixture scenarios,
+WHOIS query and parser profiles, fixture scenarios,
 verification references, documentation references, and the catalogue's
 limitation. The same document includes a dated, official-source aggregate of
 generic, generic-restricted, sponsored, and infrastructure RDAP coverage. That
 snapshot is separate from the suffix profile and from live reachability.
 
-Terminal output is bounded and control-safe. `--json` emits version 2 of the
+Terminal output is bounded and control-safe. `--json` emits version 3 of the
 `whoisleuth.cli.registry-support` schema. Unknown but syntactically valid
 suffixes retain the generic `discovery_only` profile; malformed input exits
 with code 2. The command never probes a registry or tests current reachability.
@@ -554,11 +557,15 @@ does not call the hosted WHOISleuth deployment. Quote a multi-word keyword so
 the shell passes it as one argument.
 
 Terminal output summarizes certificate rows, observed hostnames, canonical
-registrable-domain matches, observation times, and completeness. It shows at
-most 100 matches and five hostnames per match, with explicit omission notes.
-`--json` returns the complete bounded structured result in the versioned
-`whoisleuth.cli.ct-search` schema. CT observations do not prove that a website
-is active or malicious.
+registrable-domain matches, observation times, bounded certificate-issuance
+groups, and completeness. An issuance group contains names observed together
+in one public certificate record; a cross-domain group is a review lead, not
+an attribution or ownership finding. Terminal output shows at most 100 matches
+and five hostnames per match, with explicit omission notes. `--json` returns
+the complete bounded structured result in the versioned
+`whoisleuth.cli.ct-search` schema. The certificate-group cap is reported
+separately from the registrable-domain result cap. CT observations do not prove
+that a website is active or malicious.
 
 ## Lookalike discovery
 
@@ -791,6 +798,92 @@ The command makes no DNS or SMTP request and retains no source path. It does
 not test message acceptance, relay behavior, mailbox existence, catch-all
 behavior, SMTP banners, or whether a mail server is rogue, safe, or malicious.
 
+An analyst may add a bounded `tlsaEvidence` object to a version-2 Bulk item for
+offline DANE review. It must name the exact `_25._tcp.<mx-host>` service, and
+that host must occur in the same item's retained MX evidence. A certificate
+association match is complete only when `dnssecState` is `validated`. TLSA
+usages 0 and 1 additionally require `pkixValidationState: "validated"`.
+Usages 0 and 2 compare against the bounded `authorityMaterials` array; usages
+1 and 3 compare against the supplied leaf certificate or SPKI. Mismatched
+service names, missing certificate roles, unvalidated prerequisites, malformed
+material, and truncation remain invalid, partial, or untrusted rather than
+becoming a DANE match.
+
+## Offline supplied-evidence review
+
+`review-evidence [evidence.json]` accepts one version-1 JSON input and performs
+only deterministic local parsing, comparison, or request planning. Input is
+capped at 16 MiB. The command never retrieves DNS, opens SMTP, contacts an
+RDAP server, submits a resolver query, or looks up an address in a hosted
+GeoIP service.
+
+Supported input schemas are:
+
+- `whoisleuth.dnssec-evidence-input`: compares bounded DS and DNSKEY records,
+  recalculates DNSKEY key tags and supported DS digests, and reviews supplied
+  RRSIG validity windows at `observedAt`. `consistent` describes only the
+  supplied DS/DNSKEY relationship. It does not authenticate a chain to a root
+  trust anchor, validate RRSIG cryptography, or prove that a missing record is
+  absent.
+- `whoisleuth.tlsa-evidence-input`: binds TLSA records to one explicit
+  `_port._transport.hostname` service and compares supplied leaf or authority
+  certificate/SPKI bytes. `matched` requires independently validated DNSSEC;
+  PKIX-TA and PKIX-EE usages also require an independently validated PKIX path.
+  The command does not retrieve the certificate or negotiate STARTTLS.
+- `whoisleuth.rdap-search-input`: normalizes a supplied RDAP search-help
+  response and prepares an exact supported reverse-search request without
+  sending it.
+- `whoisleuth.rpki-route-input`: compares a route prefix and origin ASN with a
+  bounded analyst-supplied VRP set.
+- `whoisleuth.local-geoip-query`: queries an analyst-supplied bounded prefix
+  database whose source, version, and licence metadata remain in the result.
+- `whoisleuth.encrypted-dns-plan-input`: validates an explicitly reviewed
+  encrypted-DNS provider contract and prepares a bounded query plan. It does
+  not execute the plan.
+
+The common output is `whoisleuth.cli.offline-evidence-review` version 1. It
+retains the nested result's explicit state and limitations. A locally
+consistent relationship is not converted into a claim about current
+publication, ownership, safety, or maliciousness.
+
+## Domain control manifests
+
+`domain-control [input.json]` builds or reviews a bounded desired-state
+manifest without making a request or changing configuration. A manifest input
+uses `whoisleuth.domain-control-manifest-input` version 1, includes an expiry,
+and may record expected nameservers, DS, MX, CAA, TLS issuer, TLS SPKI
+fingerprint, registrar-lock preference, and a renewal-review date for up to 100
+domains. Empty fields mean unconfigured; they do not require a record to be
+absent.
+
+The emitted `whoisleuth.domain-control-manifest` version 1 is normalized and
+protected by a canonical SHA-256 digest. It can also be passed to
+`sign-artifact` for an optional local Ed25519 signature. Integrity and
+signature verification detect changes and authenticate possession of the
+selected key; neither establishes that the desired state is correct.
+
+A review input uses `whoisleuth.domain-control-review-input` version 1 and
+contains one manifest plus separately attributed observations. Only a complete
+`observed` field may produce `drift`. Partial, unavailable, unsupported, and
+missing observations remain inconclusive, and unrelated observations are
+counted but ignored. The review performs no DNS, RDAP, HTTP, TLS, SMTP, or
+registrar request.
+
+## Fixed investigation plans
+
+`workflow-plan <recipe> <domain|brand>` turns one of four fixed recipes into a
+versioned `whoisleuth.cli.investigation-plan` document. Supported recipes are
+`domain-triage`, `lookalike-review`, `owned-domain-review`, and
+`historical-comparison`. Each step names an existing CLI command, carries its
+arguments as a JSON array, declares whether it is offline or networked, and
+marks network-disclosure or analyst-selection approval gates.
+
+The command is plan-only. It does not execute a step, construct a shell script,
+interpret a placeholder as a file path, read an artifact, make a request,
+change a case, or submit evidence. Analysts deliberately run selected commands
+after reviewing their collection boundaries. This provides repeatable
+domain-specific workflows without an arbitrary automation or plugin surface.
+
 ## Optional local rendered capture
 
 `packages/web-capture` is a private repo-local Playwright package, not part of

package/frontend/src/lib/analysis/bulk-retry-plan.js

@@ -1,13 +1,7 @@
 import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
+import { limitedBulkSources } from "./bulk-source-coverage.js";
 export const MAX_BULK_RETRY_ROWS = 200;
 export const BULK_REVIEW_STALE_AFTER_DAYS = 7;
-const LIMITED_STATES = new Set([
-    'error',
-    'partial',
-    'skipped',
-    'unavailable',
-    'unsupported',
-]);
 function freshness(value, now = Date.now()) {
     if (typeof value !== 'string' || !Number.isFinite(Date.parse(value))) {
         return { observedAt: null, ageDays: null, state: 'unknown' };
@@ -21,9 +15,7 @@ function freshness(value, now = Date.now()) {
     };
 }
 function retryRow(value, isStale) {
-    const limitedSources = value.sourceCoverage
-        .filter((item) => LIMITED_STATES.has(item.state))
-        .map((item) => item.source)
+    const limitedSources = limitedBulkSources(value.domain, value.sourceCoverage)
         .sort()
         .slice(0, 12);
     const reasons = [];
@@ -56,6 +48,7 @@ export function buildBulkRetryPlan(values, mode, observedAtRaw = null, now = Dat
             'This repeats the selected lookup profile; the current API does not request only one upstream source.',
             `Evidence is marked stale after ${BULK_REVIEW_STALE_AFTER_DAYS} days for review purposes; this is a local observation age, not an upstream record age.`,
             'Optional third-party intelligence providers are not contacted by Bulk.',
+            'Sources deliberately skipped by the selected scan profile or deployment policy do not independently trigger a retry.',
             'A retry can remain partial or fail and does not convert unavailable evidence into absence.',
         ],
     };

package/frontend/src/lib/analysis/bulk-source-coverage.js

@@ -0,0 +1,76 @@
+// Authority-aware interpretation for compact Bulk source observations. Raw
+// source states remain unchanged; this layer only decides whether an observed
+// limitation was unexpected for the registry's published service paths.
+import { registryCapabilityFor } from "../../../../lib/registry-capabilities.mjs";
+const MAX_SOURCE_OBSERVATIONS = 32;
+const MAX_SOURCE_TEXT_LENGTH = 40;
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+const LIMITED_SOURCE_STATES = new Set([
+    'error',
+    'failed',
+    'inconclusive',
+    'partial',
+    'rate_limited',
+    'unavailable',
+    'unsupported',
+]);
+function text(value) {
+    return typeof value === 'string'
+        && value.length <= MAX_SOURCE_TEXT_LENGTH
+        && !CONTROL_RE.test(value)
+        ? value.trim().toLowerCase()
+        : '';
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function observations(value) {
+    return Array.isArray(value)
+        ? value.slice(0, MAX_SOURCE_OBSERVATIONS).flatMap((entry) => {
+            const item = record(entry);
+            const source = text(item?.source);
+            const state = text(item?.state);
+            return source && state ? [{ source, state }] : [];
+        })
+        : [];
+}
+function expectedUnsupportedSources(domain) {
+    const capability = registryCapabilityFor(domain);
+    if (!capability)
+        return new Set();
+    const expected = new Set();
+    if (capability.rdapAccessProfile === 'no-iana-service')
+        expected.add('rdap');
+    if (capability.whoisAccessProfile === 'no-iana-service')
+        expected.add('whois');
+    return expected;
+}
+export function isExpectedUnsupportedBulkSource(domain, observation) {
+    const source = text(observation.source);
+    const state = text(observation.state);
+    return state === 'unsupported' && expectedUnsupportedSources(domain).has(source);
+}
+export function limitedBulkSources(domain, coverage) {
+    const expectedUnsupported = expectedUnsupportedSources(domain);
+    return observations(coverage)
+        .filter(({ source, state }) => (LIMITED_SOURCE_STATES.has(state)
+        && !(state === 'unsupported' && expectedUnsupported.has(source))))
+        .map(({ source }) => source);
+}
+export function classifyBulkSourceCoverage(domain, coverage) {
+    const retained = observations(coverage);
+    if (!retained.length)
+        return 'unrecorded';
+    return limitedBulkSources(domain, retained).length ? 'limited' : 'complete';
+}
+export function describeBulkSourceCoverage(domain, observation) {
+    const source = text(observation.source);
+    const state = text(observation.state);
+    if (!source || !state)
+        return 'unrecorded source';
+    return isExpectedUnsupportedBulkSource(domain, observation)
+        ? `${source}: unsupported (no IANA-published service)`
+        : `${source}: ${state}`;
+}

package/frontend/src/lib/analysis/http-summary.js

@@ -3,10 +3,11 @@
 // connection attempts. Bulk/watchlist/case records deliberately keep only this
 // smaller derived shape: no paths, queries, header values, attempt errors, or
 // redirect inventories.
+import { MAX_HTTP_EVIDENCE_REDIRECTS } from "../../../../lib/http-evidence-bounds.mjs";
 export const HTTP_SUMMARY_VERSION = 1;
 export const MAX_HTTP_SUMMARY_ORIGIN_LENGTH = 300;
 export const MAX_HTTP_SUMMARY_CONTENT_TYPE_LENGTH = 100;
-export const MAX_HTTP_SUMMARY_REDIRECTS = 5;
+export const MAX_HTTP_SUMMARY_REDIRECTS = MAX_HTTP_EVIDENCE_REDIRECTS;
 export const MAX_HTTP_SECURITY_HEADER_INPUTS = 20;
 export const HTTP_SECURITY_HEADER_TOKENS = Object.freeze([
     'content-security-policy',