@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/frontend/src/lib/analysis/external-findings-import.js

@@ -1,6 +1,6 @@
 import { normalizeDomain, openOrCreateCase, updateCase, } from "./case-model.js";
 export const EXTERNAL_FINDINGS_SCHEMA = 'whoisleuth.external-findings';
-export const EXTERNAL_FINDINGS_VERSION = 3;
+export const EXTERNAL_FINDINGS_VERSION = 4;
 export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
 export const MAX_EXTERNAL_FINDINGS = 100;
 export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
@@ -38,12 +38,18 @@ const STRUCTURED_OBSERVATION_KEYS = new Set([
     'value',
     'issuer',
     'notAfter',
+    'eventId',
+    'logId',
+    'certificateSha256',
+    'dnsNameCount',
+    'namesComplete',
 ]);
 const STRUCTURED_OBSERVATION_SCHEMAS = new Set([
     'whoisleuth.domain-observation-rows',
     'whoisleuth.dns-observation-rows',
     'whoisleuth.certificate-observation-rows',
 ]);
+const SHA256_RE = /^[a-f0-9]{64}$/u;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -86,7 +92,7 @@ function limitations(value, index) {
         unique.add(requiredText(item, 240, `Finding ${index + 1} limitation`));
     return [...unique];
 }
-function structuredObservation(value, index) {
+function structuredObservation(value, index, documentVersion) {
     if (value === undefined || value === null)
         return null;
     const item = record(value);
@@ -104,9 +110,44 @@ function structuredObservation(value, index) {
     const issuer = optionalText(item.issuer, 160, `Finding ${index + 1} certificate issuer`);
     const notAfter = iso(item.notAfter, `Finding ${index + 1} certificate expiry`, true);
     const certificateSchema = item.sourceSchema === 'whoisleuth.certificate-observation-rows';
+    if (certificateSchema && (field === 'certificateSha256' || field === 'fingerprintSha256') && !SHA256_RE.test(observationValue.toLowerCase())) {
+        throw new Error(`Finding ${index + 1} certificate observation value must be a SHA-256 hexadecimal digest.`);
+    }
     if (!certificateSchema && (issuer !== null || notAfter !== null)) {
         throw new Error(`Finding ${index + 1} non-certificate observation cannot declare certificate metadata.`);
     }
+    const declaresEventMetadata = ['eventId', 'logId', 'certificateSha256', 'dnsNameCount', 'namesComplete']
+        .some((key) => item[key] !== undefined && item[key] !== null);
+    let eventId = null;
+    let logId = null;
+    let certificateSha256 = null;
+    let dnsNameCount = null;
+    let namesComplete = null;
+    if (declaresEventMetadata) {
+        if (!certificateSchema || documentVersion < 4) {
+            throw new Error(`Finding ${index + 1} certificate-event metadata requires external-findings schema version 4.`);
+        }
+        eventId = requiredText(item.eventId, 64, `Finding ${index + 1} certificate event id`);
+        if (!/^[A-Za-z0-9_-]{1,64}$/u.test(eventId)) {
+            throw new Error(`Finding ${index + 1} certificate event id is invalid.`);
+        }
+        logId = requiredText(item.logId, 200, `Finding ${index + 1} certificate log id`);
+        certificateSha256 = requiredText(item.certificateSha256, 64, `Finding ${index + 1} certificate digest`).toLowerCase();
+        if (!SHA256_RE.test(certificateSha256)) {
+            throw new Error(`Finding ${index + 1} certificate event digest must be a SHA-256 hexadecimal digest.`);
+        }
+        if (certificateSha256 !== observationValue.toLowerCase()) {
+            throw new Error(`Finding ${index + 1} certificate event digest must match the structured observation value.`);
+        }
+        if (!Number.isSafeInteger(item.dnsNameCount) || Number(item.dnsNameCount) < 1 || Number(item.dnsNameCount) > 100) {
+            throw new Error(`Finding ${index + 1} certificate DNS name count is invalid.`);
+        }
+        dnsNameCount = Number(item.dnsNameCount);
+        if (typeof item.namesComplete !== 'boolean') {
+            throw new Error(`Finding ${index + 1} certificate name completeness is invalid.`);
+        }
+        namesComplete = item.namesComplete;
+    }
     return {
         sourceSchema: item.sourceSchema,
         sourceVersion: 1,
@@ -114,6 +155,11 @@ function structuredObservation(value, index) {
         value: observationValue,
         issuer,
         notAfter,
+        eventId,
+        logId,
+        certificateSha256,
+        dnsNameCount,
+        namesComplete,
     };
 }
 function findingKey(finding, sourceName) {
@@ -125,6 +171,7 @@ function findingKey(finding, sourceName) {
         finding.observedAt,
         finding.completeness,
         sourceName,
+        finding.structuredObservation?.eventId ?? '',
     ].join('\u0000');
 }
 export function parseExternalFindingsDocument(value) {
@@ -133,8 +180,8 @@ export function parseExternalFindingsDocument(value) {
         throw new Error('External findings must use the documented object shape without additional top-level fields.');
     }
     if (root.schema !== EXTERNAL_FINDINGS_SCHEMA
-        || ![1, 2, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
-        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, or ${EXTERNAL_FINDINGS_VERSION}.`);
+        || ![1, 2, 3, EXTERNAL_FINDINGS_VERSION].includes(Number(root.schemaVersion))) {
+        throw new Error(`External findings must use ${EXTERNAL_FINDINGS_SCHEMA} schema version 1, 2, 3, or ${EXTERNAL_FINDINGS_VERSION}.`);
     }
     const sourceValue = record(root.source);
     if (!sourceValue || !hasOnlyKeys(sourceValue, SOURCE_KEYS)) {
@@ -181,7 +228,7 @@ export function parseExternalFindingsDocument(value) {
             completeness: item.completeness,
             limitations: limitations(item.limitations, index),
             reference: optionalText(item.reference, 500, `Finding ${index + 1} reference`),
-            structuredObservation: structuredObservation(item.structuredObservation, index),
+            structuredObservation: structuredObservation(item.structuredObservation, index, Number(root.schemaVersion)),
         };
         const key = findingKey(finding, source.name);
         if (seen.has(key))
@@ -229,12 +276,28 @@ function existingPinKey(recordValue, finding, sourceName) {
         && (!observation || (pin.field === observation.field
             && pin.sourceSchema?.collection === 'external_observations'
             && pin.sourceSchema.schema === observation.sourceSchema
-            && pin.sourceSchema.version === observation.sourceVersion)))) ? findingKey(finding, sourceName) : '';
+            && pin.sourceSchema.version === observation.sourceVersion
+            && (observation.eventId === null || pin.certificateObservation?.eventId === observation.eventId))))) ? findingKey(finding, sourceName) : '';
 }
 function structuredPinFields(finding) {
     const observation = finding.structuredObservation;
     if (!observation)
         return {};
+    const certificateObservation = observation.eventId
+        && observation.logId
+        && observation.certificateSha256
+        && observation.dnsNameCount !== null
+        && observation.namesComplete !== null
+        ? {
+            eventId: observation.eventId,
+            logId: observation.logId,
+            certificateSha256: observation.certificateSha256,
+            issuer: observation.issuer,
+            notAfter: observation.notAfter,
+            dnsNameCount: observation.dnsNameCount,
+            namesComplete: observation.namesComplete,
+        }
+        : null;
     return {
         field: observation.field,
         category: finding.category,
@@ -243,6 +306,7 @@ function structuredPinFields(finding) {
             schema: observation.sourceSchema,
             version: observation.sourceVersion,
         },
+        certificateObservation,
     };
 }
 export function mergeExternalFindingsIntoCases(current, document, now = new Date().toISOString()) {

package/frontend/src/lib/analysis/investigation-capsule.js

@@ -1,6 +1,7 @@
-import { canonicalArtifactJson, sha256ArtifactDigest } from "./artifact-integrity.js";
+import { canonicalArtifactJson, canonicalArtifactJsonV2, sha256ArtifactDigest, sha256ArtifactDigestV2, SORTED_JSON_V2, } from "./artifact-integrity.js";
 export const INVESTIGATION_CAPSULE_SCHEMA = 'whoisleuth.investigation-capsule';
-export const INVESTIGATION_CAPSULE_VERSION = 1;
+export const INVESTIGATION_CAPSULE_VERSION = 2;
+export const LEGACY_INVESTIGATION_CAPSULE_VERSION = 1;
 function safeVersion(value) {
     return typeof value === 'string' && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(value)
         ? value
@@ -46,14 +47,14 @@ function analystProjection(record) {
 export async function buildInvestigationCapsule(input) {
     const analystRecords = input.includeAnalystRecords ? analystProjection(input.caseRecord) : null;
     const [evidenceDigest, briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        sha256ArtifactDigest(input.lookupEvidence),
-        sha256ArtifactDigest(input.brief),
-        sha256ArtifactDigest(input.graph),
-        analystRecords ? sha256ArtifactDigest(analystRecords) : Promise.resolve(null),
+        sha256ArtifactDigestV2(input.lookupEvidence),
+        sha256ArtifactDigestV2(input.brief),
+        sha256ArtifactDigestV2(input.graph),
+        analystRecords ? sha256ArtifactDigestV2(analystRecords) : Promise.resolve(null),
     ]);
     const evidenceSchema = safeSchema(input.lookupEvidence.schema);
     const evidenceVersion = safeSchemaVersion(input.lookupEvidence.schemaVersion);
-    return {
+    const unsigned = {
         schema: INVESTIGATION_CAPSULE_SCHEMA,
         schemaVersion: INVESTIGATION_CAPSULE_VERSION,
         generatedAt: iso(input.generatedAt),
@@ -70,7 +71,6 @@ export async function buildInvestigationCapsule(input) {
         investigationBrief: input.brief,
         graphSnapshot: input.graph,
         analystRecords,
-        integrity: { algorithm: 'SHA-256', briefDigest, graphDigest, analystRecordsDigest },
         limitations: [
             'The Lookup evidence file is linked by digest but is not embedded; keep or share that exact file separately when verification is required.',
             'Digest verification can detect changed content but does not establish who created the capsule. No digital signature is applied.',
@@ -80,12 +80,36 @@ export async function buildInvestigationCapsule(input) {
                 : 'Analyst decisions, assertions, notes, contacts, actions, and raw source payloads are excluded.',
         ],
     };
+    return {
+        ...unsigned,
+        integrity: {
+            algorithm: 'SHA-256',
+            canonicalization: SORTED_JSON_V2,
+            scope: 'capsule excluding integrity',
+            briefDigest,
+            graphDigest,
+            analystRecordsDigest,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
+        },
+    };
 }
 export async function verifyInvestigationCapsule(capsule) {
+    const current = capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION;
+    const legacy = capsule.schemaVersion === LEGACY_INVESTIGATION_CAPSULE_VERSION;
+    const integrityRecord = capsule.integrity;
+    if ((!current && !legacy)
+        || (current && (integrityRecord.canonicalization !== SORTED_JSON_V2
+            || integrityRecord.scope !== 'capsule excluding integrity'))
+        || (legacy && (Object.hasOwn(integrityRecord, 'canonicalization')
+            || Object.hasOwn(integrityRecord, 'scope')
+            || Object.hasOwn(integrityRecord, 'digestSha256')))) {
+        return { valid: false, brief: false, graph: false, analystRecords: null, whole: current ? false : null };
+    }
+    const projectionDigest = current ? sha256ArtifactDigestV2 : sha256ArtifactDigest;
     const [briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        sha256ArtifactDigest(capsule.investigationBrief),
-        sha256ArtifactDigest(capsule.graphSnapshot),
-        capsule.analystRecords ? sha256ArtifactDigest(capsule.analystRecords) : Promise.resolve(null),
+        projectionDigest(capsule.investigationBrief),
+        projectionDigest(capsule.graphSnapshot),
+        capsule.analystRecords ? projectionDigest(capsule.analystRecords) : Promise.resolve(null),
     ]);
     const brief = briefDigest === capsule.integrity.briefDigest;
     const graph = graphDigest === capsule.integrity.graphDigest;
@@ -94,12 +118,22 @@ export async function verifyInvestigationCapsule(capsule) {
         : capsule.integrity.analystRecordsDigest === null
             ? null
             : false;
-    return { valid: brief && graph && analystRecords !== false, brief, graph, analystRecords };
+    let whole = null;
+    if (current) {
+        const { integrity, ...unsigned } = capsule;
+        whole = integrity.algorithm === 'SHA-256'
+            && integrity.canonicalization === SORTED_JSON_V2
+            && integrity.scope === 'capsule excluding integrity'
+            && integrity.digestSha256 === await sha256ArtifactDigestV2(unsigned);
+    }
+    return { valid: brief && graph && analystRecords !== false && whole !== false, brief, graph, analystRecords, whole };
 }
 export function investigationCapsuleFilename(capsule) {
     const target = capsule.target.value.toLowerCase().replace(/[^a-z0-9.-]+/gu, '-').replace(/^-|-$/gu, '').slice(0, 80) || 'lookup';
     return `whoisleuth-investigation-capsule-${target}-${capsule.generatedAt.slice(0, 10)}.json`;
 }
 export function serializeInvestigationCapsule(capsule) {
-    return `${canonicalArtifactJson(capsule)}\n`;
+    return `${capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION
+        ? canonicalArtifactJsonV2(capsule)
+        : canonicalArtifactJson(capsule)}\n`;
 }

package/frontend/src/lib/analysis/investigation-guide.js

@@ -1,10 +1,10 @@
 import { normalizeDomain } from "./case-model.js";
 import { parse } from 'tldts';
 export const INVESTIGATION_GUIDE_SCHEMA = 'whoisleuth.investigation-recipe';
-export const INVESTIGATION_GUIDE_VERSION = 4;
+export const INVESTIGATION_GUIDE_VERSION = 5;
 export const INVESTIGATION_GUIDE_LEGACY_VERSION = 1;
-export const INVESTIGATION_GUIDE_EXPORT_VERSION = 3;
-export const INVESTIGATION_GUIDE_SUPPORTED_VERSIONS = [2, 3, INVESTIGATION_GUIDE_VERSION];
+export const INVESTIGATION_GUIDE_EXPORT_VERSION = 4;
+export const INVESTIGATION_GUIDE_SUPPORTED_VERSIONS = [2, 3, 4, INVESTIGATION_GUIDE_VERSION];
 export const INVESTIGATION_GUIDE_EXPORT_SCHEMA = 'whoisleuth.investigation-recipe-summary';
 export const MAX_INVESTIGATION_GUIDE_DOMAIN_LENGTH = 253;
 export const MAX_INVESTIGATION_GUIDE_REVIEW_DOMAINS = 25;
@@ -16,6 +16,7 @@ const CONTROL_RE = /[\x00-\x1f\x7f]/u;
 const SAFE_TEMPLATE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const GUIDE_STATUSES = new Set(['active', 'paused']);
 const GUIDE_OUTCOMES = new Set(['pending', 'complete', 'partial', 'skipped']);
+const PRE_RESPONSE_RECIPE_IDS = new Set(['brand_sweep', 'infrastructure_pivot', 'new_domain_triage']);
 function stage(id, workspace, label, detail, expectedEvidence, requestImpact, prerequisite, completionCriteria, instructions, requiresApproval) {
     return Object.freeze({
         id,
@@ -91,6 +92,39 @@ export const INVESTIGATION_RECIPES = Object.freeze([
             stage('monitor', 'monitor', 'Record disposition', 'Review the bounded domain set carried from Bulk and create or update only the cases that need an analyst decision or follow-up plan.', 'A bounded review queue plus case records with dispositions, notes, evidence history, and optional monitoring intent.', 'Local case editing makes no request. Rescans and hosted-monitor changes remain separate explicit actions.', 'Review source provenance, limitations, and any scoring explanation before deciding.', 'The analyst records the required dispositions or explicitly skips retention; the recipe never decides automatically.', ['Review the domains carried from Bulk and open only the cases that need retention.', 'Record a disposition and any concise evidence-based follow-up for each retained case.', 'Mark the step reviewed when the retained cases reflect your decision.'], false),
         ]),
     }),
+    Object.freeze({
+        id: 'credential_impersonation_response',
+        label: 'Credential impersonation response',
+        summary: 'Review observed impersonation evidence, confirm the affected brand boundary, and prepare a local response packet from explicitly recorded routes.',
+        targetLabel: 'Domain under review',
+        stages: Object.freeze([
+            stage('lookup', 'lookup', 'Review impersonation evidence', 'Collect separately attributed deep evidence for the domain without treating visual or naming similarity as attribution.', 'Current registry, DNS, certificate, HTTP, page-identity, and source-health observations where supported.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm the target is in scope and do not enter a credential-bearing URL or secret.', 'Observed facts and missing sources are reviewed without making an ownership, intent, or harm conclusion.', ['Run the pre-filled Lookup in Deep mode.', 'Review exact page, redirect, certificate, and registration observations with their source states.', 'Create or update a Case only when the retained observations need reviewed follow-up.'], true),
+            stage('brands', 'brands', 'Confirm affected brand boundary', 'Review the saved Brand Profile that defines official and allowlisted references; do not infer an association from similarity.', 'An analyst-selected Brand Profile boundary, or an explicit decision to continue without one.', 'Local-only. Opening Brands makes no analysis request.', 'Know which saved profile, if any, is relevant to the affected party.', 'The relevant profile boundary is reviewed, or the stage is marked partial or skipped without creating an association.', ['Open the saved Brand Profiles list.', 'Review the official references and allowlists for the affected party.', 'Return to the guide without adding a profile association unless you deliberately selected one in Monitor.'], false),
+            stage('monitor', 'monitor', 'Prepare reviewed response', 'Open the Case response workspace, record only analyst-selected published recipient routes, and review packet preflight.', 'A Case action with recipient provenance and limitations plus an optional local draft packet that remains unsubmitted.', 'Local Case edits and packet generation make no request. WHOISleuth never sends the packet.', 'Retain supporting facts and reasoning before recording an external route; confirm the route manually.', 'The reviewed action and packet preflight are recorded, or the stage is partial or skipped without implying submission.', ['Open or create the pre-filled Case, then review its evidence and reasoning.', 'Record an analyst-selected published route with its source and limitations; do not claim it is reachable.', 'Open response preflight and prepare a local draft only if its required facts are complete.'], false),
+        ]),
+    }),
+    Object.freeze({
+        id: 'mail_abuse_response',
+        label: 'Mail abuse response',
+        summary: 'Review official mail posture and observed domain evidence before preparing a source-qualified, unsent response packet.',
+        targetLabel: 'Domain under review',
+        stages: Object.freeze([
+            stage('brands', 'brands', 'Review official mail posture', 'Review the affected Brand Profile and retained mail posture without treating a missing control as proof of abuse.', 'Analyst-selected official-domain, mail, and Brand Profile context with explicit availability states.', 'Local-only unless the analyst separately starts a Brand posture refresh.', 'Identify the affected profile and distinguish official infrastructure from the domain under review.', 'Relevant retained posture is reviewed, or unavailable context is marked partial rather than absent.', ['Open the saved Brand Profiles list.', 'Review official MX, SPF, DMARC, and approved-domain context where retained.', 'Do not refresh or change a profile unless that separate action is necessary and approved.'], false),
+            stage('lookup', 'lookup', 'Review domain and mail evidence', 'Collect current deep evidence for the domain and keep DNS, mail, registration, and page observations separately attributed.', 'Authority-aware availability plus bounded DNS, mail, TLS, HTTP, and page observations where supported.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm the domain is in scope; email content and mailbox data are outside this workflow.', 'Current observations and source failures are reviewed without claiming message origin, sender control, or maliciousness.', ['Run the pre-filled Lookup in Deep mode.', 'Review MX, SPF, DMARC, registration, certificate, HTTP, and page source states.', 'Retain only the evidence needed for a reviewed Case.'], true),
+            stage('monitor', 'monitor', 'Prepare mail-abuse response', 'Record a reviewed recipient route and use Case packet preflight without sending or claiming delivery.', 'A bounded Case action and optional local response draft with exact recipient provenance and limitations.', 'Local Case edits and packet generation make no request. WHOISleuth never sends the packet.', 'Confirm the intended recipient and retain the observed facts and limitations that support review.', 'The current action state and packet preflight are recorded, or the stage remains partial without a delivery conclusion.', ['Open or create the pre-filled Case and review its retained evidence.', 'Record only a deliberately selected published route, its source, and known limitations.', 'Use the response preflight to prepare a local draft; submission remains a separate manual action recorded later.'], false),
+        ]),
+    }),
+    Object.freeze({
+        id: 'domain_control_change_response',
+        label: 'Domain-control change response',
+        summary: 'Review retained control posture and current authority-aware evidence before documenting a bounded internal or provider response.',
+        targetLabel: 'Official domain',
+        stages: Object.freeze([
+            stage('brands', 'brands', 'Review retained control posture', 'Review the saved domain-control passport, posture matrix, and source limitations before interpreting a change.', 'Retained official-domain control observations with separately attributed registry, DNS, certificate, mail, and web states.', 'Local-only unless the analyst separately starts a posture refresh.', 'Confirm the domain belongs to the reviewed Brand Profile; a saved association is analyst-selected, not inferred.', 'The retained baseline and its completeness are understood, or the stage is partial when required context is unavailable.', ['Open the relevant saved Brand Profile.', 'Review the domain-control passport, portfolio matrix, and observation times.', 'Identify which source actually supports the suspected change and preserve unavailable states.'], false),
+            stage('lookup', 'lookup', 'Confirm current domain evidence', 'Collect a deliberate deep Lookup so current authority-aware evidence remains distinct from the retained baseline.', 'Current registry, registrar, DNS, certificate, HTTP, and page observations with explicit source health.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm a fresh collection is necessary and review its request implications.', 'The current result is reviewed against the retained baseline without converting incomplete evidence into removal or compromise.', ['Run the pre-filled Lookup in Deep mode.', 'Compare current observations with the retained control evidence source by source.', 'Record only facts and limitations that need a Case response.'], true),
+            stage('monitor', 'monitor', 'Document control-change response', 'Record an internal or provider action and review an optional response packet without automatic enforcement or submission.', 'A bounded Case action, due or follow-up dates, recipient provenance when external, and an optional unsubmitted packet.', 'Local Case edits and packet generation make no request. WHOISleuth never changes DNS, registrar, hosting, mail, or defensive systems.', 'Document supporting evidence and confirm any recipient route or internal owner manually.', 'The reviewed action state is recorded, or the stage is partial without a compromise, delivery, or remediation claim.', ['Open or create the pre-filled Case and retain the relevant comparison facts.', 'Record the internal owner or analyst-selected provider route, source, limitations, and follow-up dates.', 'Review packet preflight when a draft is useful; record submission or resolution only after it actually occurs.'], false),
+        ]),
+    }),
 ]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
@@ -239,10 +273,15 @@ export function investigationGuideHref(stageId, domain, recipeId = 'new_domain_t
         return `/discover?q=${encodeURIComponent(registrableGuideDomain(normalized))}#discovery-seed`;
     if (stageDefinition.workspace === 'bulk')
         return `/bulk?investigation=${encodeURIComponent(normalized)}#domains`;
-    if (stageDefinition.workspace === 'monitor')
-        return `/monitor?view=cases&investigation=1&domain=${encodeURIComponent(workingDomain)}#case-review-queue`;
-    if (stageDefinition.workspace === 'brands')
-        return `/brands?new=1&domain=${encodeURIComponent(normalized)}#official-domains`;
+    if (stageDefinition.workspace === 'monitor') {
+        const response = typeof recipeId === 'string' && recipeId.endsWith('_response') ? '&response=1' : '';
+        return `/monitor?view=cases&investigation=1${response}&domain=${encodeURIComponent(workingDomain)}#case-review-queue`;
+    }
+    if (stageDefinition.workspace === 'brands') {
+        return typeof recipeId === 'string' && recipeId.endsWith('_response')
+            ? '/brands'
+            : `/brands?new=1&domain=${encodeURIComponent(normalized)}#official-domains`;
+    }
     return stageDefinition.path;
 }
 export function investigationGuideApprovedHref(guide, stageId) {
@@ -324,9 +363,10 @@ export function parseInvestigationGuide(value) {
     const domain = normalizeInvestigationGuideDomain(input.domain);
     const createdAt = timestamp(input.createdAt);
     const updatedAt = timestamp(input.updatedAt);
-    if (!recipe || !domain || !createdAt || !updatedAt)
+    if (!recipe || !domain || !createdAt || !updatedAt
+        || (input.version !== INVESTIGATION_GUIDE_VERSION && !PRE_RESPONSE_RECIPE_IDS.has(recipe.id)))
         return null;
-    const supportsTemplate = input.version === 3 || input.version === INVESTIGATION_GUIDE_VERSION;
+    const supportsTemplate = input.version === 3 || input.version === 4 || input.version === INVESTIGATION_GUIDE_VERSION;
     const template = supportsTemplate && input.template !== null && input.template !== undefined
         ? normalizeInvestigationGuideTemplateSnapshot(input.template, recipe.id)
         : null;
@@ -361,7 +401,9 @@ export function parseInvestigationGuide(value) {
                 outcome: guideOutcome(item?.outcome),
                 approvedAt: nullableTimestamp(item?.approvedAt),
                 openedAt: nullableTimestamp(item?.openedAt),
-                reviewNote: input.version === INVESTIGATION_GUIDE_VERSION ? boundedReviewNote(item?.reviewNote) : null,
+                reviewNote: input.version === 4 || input.version === INVESTIGATION_GUIDE_VERSION
+                    ? boundedReviewNote(item?.reviewNote)
+                    : null,
                 updatedAt: timestamp(item?.updatedAt) || updatedAt,
             };
         }),

package/frontend/src/lib/analysis/investigation-template-model.js

@@ -1,10 +1,12 @@
 import { INVESTIGATION_RECIPES, normalizeInvestigationGuideTemplateSnapshot, } from "./investigation-guide.js";
 export const INVESTIGATION_TEMPLATE_SCHEMA = 'whoisleuth.investigation-templates';
-export const INVESTIGATION_TEMPLATE_VERSION = 1;
+export const INVESTIGATION_TEMPLATE_VERSION = 2;
+export const INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS = [1, INVESTIGATION_TEMPLATE_VERSION];
 export const MAX_INVESTIGATION_TEMPLATES = 20;
 export const MAX_INVESTIGATION_TEMPLATE_STORE_BYTES = 256 * 1024;
 export const MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES = 384 * 1024;
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
+const LEGACY_RECIPE_IDS = new Set(['brand_sweep', 'infrastructure_pivot', 'new_domain_triage']);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -17,12 +19,12 @@ function timestamp(value) {
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
 }
-function template(raw) {
+function template(raw, sourceVersion = INVESTIGATION_TEMPLATE_VERSION) {
     const value = record(raw);
     const snapshot = normalizeInvestigationGuideTemplateSnapshot(value);
     const createdAt = timestamp(value?.createdAt);
     const updatedAt = timestamp(value?.updatedAt);
-    return snapshot && createdAt && updatedAt
+    return snapshot && createdAt && updatedAt && (sourceVersion !== 1 || LEGACY_RECIPE_IDS.has(snapshot.recipeId))
         ? { ...snapshot, createdAt, updatedAt }
         : null;
 }
@@ -35,11 +37,12 @@ export function normalizeInvestigationTemplateStore(raw) {
         && Number(value.version) > INVESTIGATION_TEMPLATE_VERSION) {
         throw new Error('This investigation-template collection uses a newer schema and cannot be read safely.');
     }
+    const sourceVersion = Array.isArray(raw) ? INVESTIGATION_TEMPLATE_VERSION : Number(value?.version) || INVESTIGATION_TEMPLATE_VERSION;
     const source = Array.isArray(raw) ? raw : Array.isArray(value?.templates) ? value.templates : [];
     const templates = [];
     const seen = new Set();
     for (const candidate of source.slice(0, MAX_INVESTIGATION_TEMPLATES * 2)) {
-        const normalized = template(candidate);
+        const normalized = template(candidate, sourceVersion);
         if (!normalized || seen.has(normalized.id))
             continue;
         seen.add(normalized.id);
@@ -115,8 +118,8 @@ function strictImport(raw) {
     if (Number(value.version) > INVESTIGATION_TEMPLATE_VERSION) {
         throw new Error('This investigation-template export uses a newer schema and cannot be imported safely.');
     }
-    if (value.version !== INVESTIGATION_TEMPLATE_VERSION) {
-        throw new Error(`Expected investigation-template schema ${INVESTIGATION_TEMPLATE_VERSION}.`);
+    if (!INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS.includes(Number(value.version))) {
+        throw new Error(`Expected investigation-template schema 1 or ${INVESTIGATION_TEMPLATE_VERSION}.`);
     }
     return normalizeInvestigationTemplateStore(value).templates;
 }

package/frontend/src/lib/analysis/lookup-asset-graph.js

@@ -372,7 +372,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(networkContext),
             limitations: limitations(networkContext.limitations),
             lenses: ['all'],
-            href: '#evidence-network-context',
+            href: '#evidence-network',
         });
     }
     const networkLabel = text(network.name || network.holder || network.handle, 180);
@@ -390,7 +390,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(networkContext),
             limitations: limitations(networkContext.limitations),
             lenses: ['all'],
-            href: '#evidence-network-context',
+            href: '#evidence-network',
         });
     }
     for (const cidr of textList(network.cidrs, 8)) {
@@ -407,7 +407,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(networkContext),
                 limitations: limitations(networkContext.limitations),
                 lenses: ['all'],
-                href: '#evidence-network-context',
+                href: '#evidence-network',
             });
         }
     }
@@ -437,7 +437,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(input.pageIdentity),
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
             boundary: trustBoundary(canonicalHost, finalHost || target),
         }, 'Publisher-declared canonical origin', identitySource);
     }
@@ -451,7 +451,7 @@ export function buildLookupAssetGraph(input) {
             completeness: sourceCompleteness(input.pageIdentity),
             limitations: limitations(record(input.pageIdentity).limitations),
             lenses: ['identity'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
             boundary: trustBoundary(openGraphHost, finalHost || target),
         }, 'Publisher-declared Open Graph origin', identitySource);
     }
@@ -466,7 +466,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A declared form action does not prove that a user submitted data or that the endpoint received it.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
                 boundary: trustBoundary(host, finalHost || target),
             }, 'External form-action origin', identitySource);
         }
@@ -482,7 +482,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A static resource reference does not prove that a browser loaded the resource or disclosed data to it.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
                 boundary: trustBoundary(host, finalHost || target),
             }, 'External resource origin', identitySource);
         }
@@ -498,7 +498,7 @@ export function buildLookupAssetGraph(input) {
                 completeness: sourceCompleteness(input.pageIdentity),
                 limitations: ['A shared identifier is a relationship lead and does not establish common ownership or control.'],
                 lenses: ['identity'],
-                href: '#evidence-page-identity',
+                href: '#evidence-page',
             }, text(identifier.type, 80), identitySource);
         }
     }