@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/frontend/src/lib/analysis/lookup-claim-passport.js

@@ -0,0 +1,236 @@
+import { LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "./lookup-claim-readiness.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2, } from "./artifact-integrity.js";
+export const LOOKUP_CLAIM_PASSPORT_SCHEMA = 'whoisleuth.lookup-claim-passport';
+export const LOOKUP_CLAIM_PASSPORT_VERSION = 1;
+export const MAX_LOOKUP_CLAIM_PASSPORT_BYTES = 64 * 1024;
+export const MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS = 16;
+export const MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS = 16;
+export const LOOKUP_CLAIM_PASSPORT_TARGET_TYPES = ['domain', 'ipv4', 'ipv6', 'asn'];
+const SOURCE_STATES = new Set([
+    'complete',
+    'not_found',
+    'partial',
+    'skipped',
+    'unavailable',
+    'unknown',
+    'unsupported',
+]);
+const CLAIM_STATES = new Set(['ready', 'limited', 'not_ready']);
+const REQUIREMENT_IDS = new Set(LOOKUP_CLAIM_REQUIREMENT_IDS);
+const CLAIM_IDS = new Set(LOOKUP_CLAIM_IDS);
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+const HAS_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+const SEMVER_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+function text(value, maximum) {
+    return typeof value === 'string'
+        ? value.replace(CONTROL_CHARACTERS, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+function exactText(value, maximum) {
+    if (typeof value !== 'string' || value.length > maximum || HAS_CONTROL_CHARACTERS.test(value))
+        return '';
+    return value.trim();
+}
+function timestamp(value) {
+    if (typeof value !== 'string')
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function uniqueText(values, maximum = MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS) {
+    const output = [];
+    const seen = new Set();
+    for (const value of values.slice(0, maximum * 2)) {
+        const normalized = text(value, 400);
+        if (!normalized || seen.has(normalized))
+            continue;
+        output.push(normalized);
+        seen.add(normalized);
+        if (output.length >= maximum)
+            break;
+    }
+    return output;
+}
+function targetType(value) {
+    if (typeof value !== 'string' || !LOOKUP_CLAIM_PASSPORT_TARGET_TYPES.includes(value)) {
+        throw new TypeError('A supported Lookup target type is required for a claim passport.');
+    }
+    return value;
+}
+function domainTarget(value) {
+    const raw = exactText(value, 253).toLowerCase().replace(/\.$/u, '');
+    if (!raw || /[/\\?#@]/u.test(raw))
+        throw new TypeError('A canonical domain is required for a claim passport.');
+    let normalized = '';
+    try {
+        normalized = new URL(`http://${raw}`).hostname.toLowerCase().replace(/\.$/u, '');
+    }
+    catch { /* fail below */ }
+    if (!DOMAIN_RE.test(normalized))
+        throw new TypeError('A canonical domain is required for a claim passport.');
+    return normalized;
+}
+function ipv4Target(value) {
+    const raw = exactText(value, 64);
+    const parts = raw.split('.');
+    if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/u.test(part) || Number(part) > 255 || String(Number(part)) !== part)) {
+        throw new TypeError('A canonical IPv4 address is required for a claim passport.');
+    }
+    return raw;
+}
+function ipv6Target(value) {
+    const raw = exactText(value, 64).toLowerCase();
+    if (!raw || /[\[\]%/?#@]/u.test(raw))
+        throw new TypeError('A canonical IPv6 address is required for a claim passport.');
+    try {
+        const hostname = new URL(`http://[${raw}]/`).hostname;
+        const normalized = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+        if (!normalized.includes(':'))
+            throw new TypeError();
+        return normalized;
+    }
+    catch {
+        throw new TypeError('A canonical IPv6 address is required for a claim passport.');
+    }
+}
+function asnTarget(value) {
+    const raw = exactText(value, 32).toUpperCase().replace(/^AS/u, '');
+    if (!/^\d{1,10}$/u.test(raw) || Number(raw) < 1 || Number(raw) > 4_294_967_295) {
+        throw new TypeError('A canonical ASN is required for a claim passport.');
+    }
+    return `AS${Number(raw)}`;
+}
+function targetValue(type, value) {
+    if (type === 'domain')
+        return domainTarget(value);
+    if (type === 'ipv4')
+        return ipv4Target(value);
+    if (type === 'ipv6')
+        return ipv6Target(value);
+    return asnTarget(value);
+}
+function requirementId(value) {
+    if (typeof value !== 'string' || !REQUIREMENT_IDS.has(value)) {
+        throw new TypeError('The selected claim contains an unsupported evidence requirement.');
+    }
+    return value;
+}
+export async function buildLookupClaimPassport(input) {
+    if (input.readiness.version !== LOOKUP_CLAIM_READINESS_VERSION) {
+        throw new TypeError('The claim-readiness contract is not supported for passport export.');
+    }
+    if (input.readiness.entries.length > LOOKUP_CLAIM_IDS.length) {
+        throw new TypeError('The claim-readiness contract contains too many entries for passport export.');
+    }
+    const rawClaimId = exactText(input.claimId, 80);
+    if (!CLAIM_IDS.has(rawClaimId))
+        throw new TypeError('Select a current Lookup claim to export.');
+    const claimId = rawClaimId;
+    const selected = input.readiness.entries.find((entry) => entry.id === claimId);
+    if (!selected || !CLAIM_STATES.has(selected.state))
+        throw new TypeError('Select a current Lookup claim to export.');
+    if (selected.requirements.length < 1 || selected.requirements.length > MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS) {
+        throw new TypeError('The selected claim has an unsupported evidence-requirement count.');
+    }
+    const type = targetType(input.targetType);
+    const value = targetValue(type, input.target);
+    const generatedAt = timestamp(input.generatedAt) ?? new Date().toISOString();
+    const applicationVersion = exactText(input.applicationVersion, 80);
+    if (!SEMVER_RE.test(applicationVersion))
+        throw new TypeError('A valid application version is required for a claim passport.');
+    const lookupDepth = input.lookupDepth === 'deep' ? 'deep' : input.lookupDepth === 'fast' ? 'fast' : null;
+    if (!lookupDepth)
+        throw new TypeError('A completed Lookup depth is required for a claim passport.');
+    const requirementIds = new Set();
+    const requirements = selected.requirements.map((source) => {
+        const id = requirementId(source.id);
+        if (requirementIds.has(id) || !SOURCE_STATES.has(source.state)) {
+            throw new TypeError('The selected claim contains duplicate or invalid evidence requirements.');
+        }
+        requirementIds.add(id);
+        let evidenceId = null;
+        if (source.evidenceId !== null) {
+            const normalizedEvidenceId = exactText(source.evidenceId, 64);
+            if (!/^[a-z][a-z0-9_-]{0,63}$/u.test(normalizedEvidenceId))
+                throw new TypeError('The selected claim contains an invalid evidence source identifier.');
+            evidenceId = normalizedEvidenceId;
+        }
+        if (source.mode !== 'network_collection' && source.mode !== 'local_review') {
+            throw new TypeError('The selected claim contains an invalid evidence requirement mode.');
+        }
+        return Object.freeze({
+            id,
+            label: exactText(source.label, 160),
+            evidenceId,
+            mode: source.mode,
+            state: source.state,
+            observedAt: evidenceId ? timestamp(input.evidenceObservedAtById?.[evidenceId]) : null,
+            limitations: Object.freeze(uniqueText(source.limitations, 8)),
+        });
+    });
+    if (requirements.some((item) => !item.label))
+        throw new TypeError('The selected claim contains an invalid evidence label.');
+    const requiredEvidenceIds = requirements.map((item) => item.id);
+    const missingEvidenceIds = requirements.filter((item) => item.state !== 'complete').map((item) => item.id);
+    const riskModelVersion = Number.isSafeInteger(input.riskModelVersion)
+        && Number(input.riskModelVersion) >= 1
+        && Number(input.riskModelVersion) <= 1_000
+        ? Number(input.riskModelVersion)
+        : null;
+    const claimLabel = exactText(selected.label, 160);
+    const claimConclusion = exactText(selected.conclusion, 600);
+    const unsigned = {
+        schema: LOOKUP_CLAIM_PASSPORT_SCHEMA,
+        version: LOOKUP_CLAIM_PASSPORT_VERSION,
+        generatedAt,
+        application: { name: 'WHOISleuth', version: applicationVersion },
+        target: { type, value },
+        observation: { observedAt: timestamp(input.observedAt), lookupDepth },
+        claim: {
+            id: claimId,
+            label: claimLabel,
+            state: selected.state,
+            conclusion: claimConclusion,
+            requiredEvidenceIds,
+            missingEvidenceIds,
+            requirements,
+            limitations: uniqueText(selected.limitations),
+        },
+        models: {
+            claimReadiness: LOOKUP_CLAIM_READINESS_VERSION,
+            risk: riskModelVersion,
+        },
+        limitations: uniqueText([
+            input.readiness.limitation,
+            'This portable passport records evidence sufficiency for one point-in-time statement. It does not establish that the statement is true, current, safe, authorized, or attributable to an owner or actor.',
+            'The SHA-256 digest detects changes to this file. It does not authenticate the analyst, collection source, signer, or truth of the retained states.',
+            'Raw registry responses, contacts, page values, request paths, credentials, and browser-local records are excluded.',
+        ]),
+    };
+    if (!unsigned.claim.label || !unsigned.claim.conclusion)
+        throw new TypeError('The selected claim is incomplete.');
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
+    const document = Object.freeze({
+        ...unsigned,
+        claim: Object.freeze({
+            ...unsigned.claim,
+            requiredEvidenceIds: Object.freeze(requiredEvidenceIds),
+            missingEvidenceIds: Object.freeze(missingEvidenceIds),
+            requirements: Object.freeze(requirements),
+            limitations: Object.freeze(unsigned.claim.limitations),
+        }),
+        limitations: Object.freeze(unsigned.limitations),
+        integrity: Object.freeze({ algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 }),
+    });
+    const content = `${JSON.stringify(document, null, 2)}\n`;
+    if (new TextEncoder().encode(content).byteLength > MAX_LOOKUP_CLAIM_PASSPORT_BYTES) {
+        throw new TypeError('The claim passport exceeds its export byte limit.');
+    }
+    const safeTarget = value.toLowerCase().replace(/[^a-z0-9.-]+/gu, '-').replace(/^-|-$/gu, '').slice(0, 100) || 'target';
+    return Object.freeze({
+        document,
+        content,
+        filename: `whoisleuth-claim-${safeTarget}-${claimId}-${generatedAt.slice(0, 10)}.json`,
+    });
+}

package/frontend/src/lib/analysis/lookup-claim-readiness.js

@@ -0,0 +1,280 @@
+export const LOOKUP_CLAIM_READINESS_VERSION = 2;
+export const LOOKUP_CLAIM_IDS = [
+    'registration-state',
+    'current-web-observation',
+    'brand-resemblance',
+    'controlled-change',
+    'incident-response',
+    'network-context',
+];
+export const LOOKUP_CLAIM_REQUIREMENT_IDS = [
+    'authority-aware-availability',
+    'registry-rdap',
+    'registry-whois',
+    'registry-control-selection',
+    'dns-observation',
+    'http-observation',
+    'tls-observation',
+    'page-identity-observation',
+    'reviewed-brand-profile',
+    'reviewed-case-recipient',
+    'authoritative-rdap',
+];
+const MAX_TEXT = 320;
+const MAX_DIAGNOSTICS = 12;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+const LIMITED_STATES = new Set(['partial', 'unavailable', 'unknown']);
+const ABSENT_STATES = new Set(['skipped', 'unsupported']);
+export const LOOKUP_CLAIM_REQUIREMENTS = Object.freeze({
+    'authority-aware-availability': Object.freeze({ id: 'authority-aware-availability', label: 'Authority-aware availability decision', evidenceId: 'availability', mode: 'network_collection', href: '#registry' }),
+    'registry-rdap': Object.freeze({ id: 'registry-rdap', label: 'Registry RDAP evidence', evidenceId: 'rdap', mode: 'network_collection', href: '#registry' }),
+    'registry-whois': Object.freeze({ id: 'registry-whois', label: 'Registry WHOIS evidence', evidenceId: 'whois', mode: 'network_collection', href: '#registry' }),
+    'registry-control-selection': Object.freeze({ id: 'registry-control-selection', label: 'Registry control evidence selected by the availability authority', evidenceId: null, mode: 'network_collection', href: '#registry' }),
+    'dns-observation': Object.freeze({ id: 'dns-observation', label: 'DNS observation', evidenceId: 'dns', mode: 'network_collection', href: '#evidence-dns' }),
+    'http-observation': Object.freeze({ id: 'http-observation', label: 'HTTP observation', evidenceId: 'http', mode: 'network_collection', href: '#evidence-http' }),
+    'tls-observation': Object.freeze({ id: 'tls-observation', label: 'TLS observation', evidenceId: 'tls', mode: 'network_collection', href: '#evidence-tls' }),
+    'page-identity-observation': Object.freeze({ id: 'page-identity-observation', label: 'Page identity observation', evidenceId: 'page-identity', mode: 'network_collection', href: '#evidence-page' }),
+    'reviewed-brand-profile': Object.freeze({ id: 'reviewed-brand-profile', label: 'Reviewed Brand Profile', evidenceId: null, mode: 'local_review', href: '#case-response' }),
+    'reviewed-case-recipient': Object.freeze({ id: 'reviewed-case-recipient', label: 'Reviewed case and recipient route', evidenceId: null, mode: 'local_review', href: '#case-response' }),
+    'authoritative-rdap': Object.freeze({ id: 'authoritative-rdap', label: 'Authoritative RDAP evidence', evidenceId: 'rdap', mode: 'network_collection', href: '#registry' }),
+});
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function text(value, maximum = MAX_TEXT) {
+    return String(value ?? '')
+        .replace(CONTROL_CHARACTERS, ' ')
+        .replace(/\s+/gu, ' ')
+        .trim()
+        .slice(0, maximum);
+}
+function timestamp(value) {
+    if (typeof value !== 'string')
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function evaluateRequirements(requirements) {
+    const missing = requirements.filter((requirement) => requirement.state !== 'complete');
+    const limitations = missing.flatMap((requirement) => {
+        const detail = requirement.limitations[0] || requirement.state.replaceAll('_', ' ');
+        return [`${requirement.label}: ${detail}`];
+    }).slice(0, 8);
+    if (!missing.length) {
+        return {
+            state: 'ready',
+            requiredEvidence: requirements.map((item) => item.label),
+            missingEvidence: [],
+            requiredEvidenceIds: requirements.map((item) => item.id),
+            missingEvidenceIds: [],
+            limitations,
+            requirements,
+        };
+    }
+    const observedCount = requirements.filter((requirement) => !ABSENT_STATES.has(requirement.state) && requirement.state !== 'unknown').length;
+    const hasLimited = requirements.some((requirement) => LIMITED_STATES.has(requirement.state));
+    return {
+        state: observedCount > 0 && hasLimited ? 'limited' : 'not_ready',
+        requiredEvidence: requirements.map((item) => item.label),
+        missingEvidence: missing.map((item) => item.label),
+        requiredEvidenceIds: requirements.map((item) => item.id),
+        missingEvidenceIds: missing.map((item) => item.id),
+        limitations,
+        requirements,
+    };
+}
+function requirement(id, coverage, override) {
+    const definition = LOOKUP_CLAIM_REQUIREMENTS[id];
+    const evidence = definition.evidenceId ? coverage.get(definition.evidenceId) : undefined;
+    const state = override?.state ?? evidence?.state ?? 'unknown';
+    const limitations = override?.limitation
+        ? [override.limitation]
+        : evidence?.limitations.length
+            ? evidence.limitations.slice(0, 8)
+            : state === 'complete'
+                ? []
+                : [evidence?.statusLabel || 'Not supplied'];
+    return Object.freeze({ ...definition, state, limitations: Object.freeze(limitations) });
+}
+function readinessEntry(input) {
+    const evaluated = evaluateRequirements(input.requirements);
+    return { id: input.id, label: input.label, conclusion: input.conclusion, href: input.href, ...evaluated };
+}
+function comparisonDiagnostics(comparison, sourceLabel, observedAt) {
+    const source = record(comparison);
+    const fields = Array.isArray(source.fields) ? source.fields.slice(0, 32) : [];
+    const registryTime = timestamp(observedAt.registry);
+    const comparedTime = timestamp(observedAt.compared);
+    const timeGapHours = registryTime !== null && comparedTime !== null
+        ? Math.round(Math.abs(registryTime - comparedTime) / 3_600_000)
+        : null;
+    const output = [];
+    for (const item of fields) {
+        const field = record(item);
+        if (text(field.status, 64) !== 'conflict')
+            continue;
+        const label = text(field.label, 100) || 'Registration field';
+        const normalizedLabel = label.toLowerCase();
+        let hypothesis = 'Different source publication scope or update timing';
+        let detail = `Registry RDAP and ${sourceLabel} published different normalized values. Review the exact values and source timestamps.`;
+        const basis = ['Material normalized-value difference'];
+        if (timeGapHours !== null && timeGapHours >= 1) {
+            hypothesis = 'Collection-time or publication-lag difference';
+            detail = `The sources were observed about ${timeGapHours} hour${timeGapHours === 1 ? '' : 's'} apart. A change or publication delay could explain the difference, but this is not established.`;
+            basis.push('Different observation times');
+        }
+        else if (/contact|registrant|administrative|technical|abuse/u.test(normalizedLabel)) {
+            hypothesis = 'Disclosure or source-role difference';
+            detail = `Registration contact publications can differ by source role, disclosure policy, privacy service, or update timing. The available evidence does not identify which explanation applies.`;
+            basis.push('Contact-related field');
+        }
+        else if (/status|nameserver|name server|dnssec/u.test(normalizedLabel)) {
+            hypothesis = 'Registry and delegated-service publication difference';
+            detail = `Operational and registry publications can update at different times or represent different layers. Directly review the current authoritative evidence before treating this as a configuration change.`;
+            basis.push('Operational registration field');
+        }
+        else if (/registrar|sponsor/u.test(normalizedLabel)) {
+            hypothesis = 'Sponsorship publication or transfer timing difference';
+            detail = `A transfer, reseller relationship, source normalisation, or publication delay could explain the difference. None is proven by this comparison alone.`;
+            basis.push('Registrar-related field');
+        }
+        output.push({
+            id: `${sourceLabel === 'WHOIS' ? 'whois' : 'registrar-rdap'}-${normalizedLabel.replace(/[^a-z0-9]+/gu, '-').replace(/^-|-$/gu, '') || output.length}`,
+            field: label,
+            hypothesis,
+            detail,
+            basis,
+        });
+    }
+    return output;
+}
+export function buildLookupClaimReadiness(input) {
+    const coverage = new Map(input.coverage.entries.map((entry) => [entry.id, entry]));
+    const targetType = text(input.targetType, 20);
+    const settledAvailability = !['', 'unknown', 'inconclusive', 'error'].includes(text(input.availabilityState, 40));
+    const observedAvailability = requirement('authority-aware-availability', coverage);
+    const registrationRequirements = [settledAvailability
+            ? observedAvailability
+            : Object.freeze({
+                ...observedAvailability,
+                state: observedAvailability.state === 'complete' ? 'partial' : observedAvailability.state,
+                limitations: Object.freeze([
+                    ...observedAvailability.limitations,
+                    'The authority-aware availability state is not settled.',
+                ].slice(0, 8)),
+            })];
+    const availabilitySource = text(input.availabilitySource, 24).toLowerCase();
+    const controlledRegistrationRequirements = availabilitySource === 'rdap'
+        ? [requirement('registry-rdap', coverage)]
+        : availabilitySource === 'whois'
+            ? [requirement('registry-whois', coverage)]
+            : [requirement('registry-control-selection', coverage, {
+                    state: 'unknown',
+                    limitation: 'The availability authority did not select a registry control source.',
+                })];
+    const webRequirements = [requirement('http-observation', coverage), requirement('tls-observation', coverage)];
+    const entries = [];
+    if (targetType === 'domain') {
+        entries.push(readinessEntry({
+            id: 'registration-state',
+            label: 'Registration-state statement',
+            conclusion: 'Whether an authority-aware registered, available, or inconclusive statement can be made.',
+            requirements: registrationRequirements,
+            href: '#registry',
+        }));
+        entries.push(readinessEntry({
+            id: 'current-web-observation',
+            label: 'Current website statement',
+            conclusion: 'Whether the current HTTP and TLS observation is complete enough to describe what responded.',
+            requirements: webRequirements,
+            href: '#web-evidence',
+        }));
+        if (input.task === 'brand' || input.hasActiveProfile) {
+            entries.push(readinessEntry({
+                id: 'brand-resemblance',
+                label: 'Brand-resemblance assessment',
+                conclusion: 'Whether reviewed brand context and page identity evidence support a bounded resemblance assessment.',
+                requirements: [
+                    requirement('page-identity-observation', coverage),
+                    requirement('reviewed-brand-profile', coverage, {
+                        state: input.profileSourceState === 'unavailable'
+                            ? 'unavailable'
+                            : input.hasActiveProfile === true
+                                ? 'complete'
+                                : 'unknown',
+                        ...(input.profileSourceState === 'unavailable'
+                            ? { limitation: 'The browser-local Brand Profile source is unavailable.' }
+                            : input.hasActiveProfile === true
+                                ? {}
+                                : { limitation: 'No reviewed Brand Profile is active.' }),
+                    }),
+                ],
+                href: '#evidence-page',
+            }));
+        }
+        if (input.task === 'owned' || input.task === 'acquisition') {
+            entries.push(readinessEntry({
+                id: 'controlled-change',
+                label: 'Controlled-change planning',
+                conclusion: 'Whether registration and DNS evidence are complete enough to prepare a reviewed change plan.',
+                requirements: [...registrationRequirements, ...controlledRegistrationRequirements, requirement('dns-observation', coverage)],
+                href: '#evidence-dns',
+            }));
+        }
+        if (input.task === 'incident') {
+            entries.push(readinessEntry({
+                id: 'incident-response',
+                label: 'Incident response handoff',
+                conclusion: 'Whether current web evidence and a reviewed recipient route are present for a response packet.',
+                requirements: [
+                    requirement('http-observation', coverage),
+                    requirement('page-identity-observation', coverage),
+                    requirement('reviewed-case-recipient', coverage, {
+                        state: input.hasCaseSection === true && (input.responseRecipientCount ?? 0) > 0 ? 'complete' : 'unknown',
+                        ...(input.hasCaseSection === true && (input.responseRecipientCount ?? 0) > 0
+                            ? {}
+                            : { limitation: 'A reviewed case and recipient route are not both available.' }),
+                    }),
+                ],
+                href: '#case-response',
+            }));
+        }
+    }
+    else if (targetType === 'ip' || targetType === 'ipv4' || targetType === 'ipv6' || targetType === 'asn') {
+        entries.push(readinessEntry({
+            id: 'network-context',
+            label: 'Network registration statement',
+            conclusion: 'Whether the observed network registration context is complete enough to describe the resource.',
+            requirements: [requirement('authoritative-rdap', coverage)],
+            href: '#registry',
+        }));
+    }
+    const disagreements = [
+        ...comparisonDiagnostics(input.registryComparison, 'WHOIS', {
+            registry: input.observedAt?.registry,
+            compared: input.observedAt?.whois,
+        }),
+        ...comparisonDiagnostics(input.registrarPublicationComparison, 'Registrar RDAP', {
+            registry: input.observedAt?.registry,
+            compared: input.observedAt?.registrar,
+        }),
+    ].slice(0, MAX_DIAGNOSTICS);
+    const counts = {
+        ready: 0,
+        limited: 0,
+        not_ready: 0,
+    };
+    for (const entry of entries)
+        counts[entry.state] += 1;
+    return {
+        version: LOOKUP_CLAIM_READINESS_VERSION,
+        entries,
+        disagreements,
+        counts,
+        limitation: input.decisionSupport.counts.conflicts
+            ? 'Readiness describes evidence sufficiency, not truth. Registration-source explanations are bounded hypotheses and require review of the original observations.'
+            : 'Readiness describes evidence sufficiency, not truth, ownership, intent, safety, or eligibility.',
+    };
+}

package/frontend/src/lib/analysis/lookup-decision-support.js

@@ -2,6 +2,21 @@ const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
 const MAX_TEXT = 320;
 const MAX_ENTRIES = 24;
 const MAX_ACTIONS = 6;
+export const MAX_LOOKUP_PRESENTED_ACTIONS = 3;
+const LOOKUP_TASK_EVIDENCE_KINDS = new Set([
+    'delegation', 'dependency', 'dns', 'form', 'http', 'identity', 'mail', 'page',
+    'posture', 'ptr', 'redirect', 'tls',
+]);
+const TASK_ACTION_ID = Object.freeze({
+    acquisition: 'review-acquisition-dependencies',
+    brand: 'review-page-identity',
+    owned: 'review-owned-posture',
+});
+const ACTION_PRIORITY = Object.freeze({
+    high: 0,
+    medium: 1,
+    low: 2,
+});
 const TASK_GUIDANCE = Object.freeze({
     general: Object.freeze({
         label: 'General investigation',
@@ -275,7 +290,7 @@ function identityEntries(input) {
             title: 'The declared canonical origin differs from the observed final origin',
             detail: `${finalHost} served the page while the document declared ${canonicalHost} as canonical.`,
             sources: ['HTTP', 'HTML'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
         });
     }
     if (finalHost && openGraphHost && !sameRegistrableScope(finalHost, openGraphHost, registrableDomain)) {
@@ -286,7 +301,7 @@ function identityEntries(input) {
             title: 'The Open Graph URL points outside the observed final origin',
             detail: `${finalHost} served the page while Open Graph metadata declared ${openGraphHost}. Publisher metadata is a claim, not identity proof.`,
             sources: ['HTTP', 'HTML'],
-            href: '#evidence-page-identity',
+            href: '#evidence-page',
         });
     }
     return output;
@@ -338,12 +353,40 @@ function prioritizeEntries(entries, task) {
     return [...entries].sort((left, right) => {
         const leftBoost = taskBoost[task].some((prefix) => left.id.startsWith(prefix)) ? -1 : 0;
         const rightBoost = taskBoost[task].some((prefix) => right.id.startsWith(prefix)) ? -1 : 0;
-        return leftBoost - rightBoost
-            || importance[left.importance] - importance[right.importance]
+        return importance[left.importance] - importance[right.importance]
+            || leftBoost - rightBoost
             || left.title.localeCompare(right.title);
     }).slice(0, 16);
 }
+function normalizedTaskEvidenceKinds(values) {
+    return new Set((values ?? [])
+        .slice(0, 24)
+        .filter((value) => (typeof value === 'string' && LOOKUP_TASK_EVIDENCE_KINDS.has(value))));
+}
+function supportsDecisionDestination(href, evidence) {
+    if (href === '#evidence-tls')
+        return evidence.has('tls');
+    if (href === '#evidence-http')
+        return evidence.has('http') || evidence.has('redirect');
+    if (href === '#evidence-page') {
+        return evidence.has('page') || evidence.has('identity') || evidence.has('form');
+    }
+    if (href === '#evidence-certificate-policy')
+        return evidence.has('tls') || evidence.has('dns');
+    return true;
+}
+function supportsTaskAction(task, targetType, evidence) {
+    if (targetType !== 'domain')
+        return false;
+    const requiredKinds = {
+        acquisition: ['dns', 'mail', 'tls', 'http', 'page', 'dependency'],
+        brand: ['page', 'identity', 'form', 'redirect'],
+        owned: ['delegation', 'mail', 'tls', 'posture'],
+    };
+    return requiredKinds[task]?.some((kind) => evidence.has(kind)) ?? false;
+}
 export function buildLookupDecisionSupport(input) {
+    const availableEvidence = normalizedTaskEvidenceKinds(input.availableEvidence);
     const entries = prioritizeEntries([
         ...comparisonEntries(input.registryComparison, 'registry-whois'),
         ...comparisonEntries(input.registrarPublicationComparison, 'registry-registrar'),
@@ -351,7 +394,8 @@ export function buildLookupDecisionSupport(input) {
         ...certificatePolicyEntries(input.certificatePolicyReview),
     ], input.task);
     const actions = [];
-    const firstConflict = entries.find((entry) => entry.state === 'conflict');
+    const firstConflict = entries.find((entry) => entry.state === 'conflict'
+        && supportsDecisionDestination(entry.href, availableEvidence));
     if (firstConflict) {
         actions.push({
             id: 'review-priority-conflict',
@@ -383,7 +427,7 @@ export function buildLookupDecisionSupport(input) {
             priority: 'medium',
         });
     }
-    if (input.task === 'brand') {
+    if (supportsTaskAction(input.task, input.targetType, availableEvidence) && input.task === 'brand') {
         actions.push({
             id: 'review-page-identity',
             label: 'Review identity and credential evidence',
@@ -393,7 +437,7 @@ export function buildLookupDecisionSupport(input) {
             priority: 'medium',
         });
     }
-    else if (input.task === 'acquisition') {
+    else if (supportsTaskAction(input.task, input.targetType, availableEvidence) && input.task === 'acquisition') {
         actions.push({
             id: 'review-acquisition-dependencies',
             label: 'Review transfer dependencies',
@@ -403,7 +447,7 @@ export function buildLookupDecisionSupport(input) {
             priority: 'medium',
         });
     }
-    else if (input.task === 'owned') {
+    else if (supportsTaskAction(input.task, input.targetType, availableEvidence) && input.task === 'owned') {
         actions.push({
             id: 'review-owned-posture',
             label: 'Review delegation and posture evidence',
@@ -435,6 +479,17 @@ export function buildLookupDecisionSupport(input) {
         },
     };
 }
+export function projectLookupNextActions(actions, task) {
+    const taskActionId = TASK_ACTION_ID[task];
+    return actions
+        .slice(0, MAX_ACTIONS)
+        .map((action, index) => ({ action, index }))
+        .sort((left, right) => (ACTION_PRIORITY[left.action.priority] - ACTION_PRIORITY[right.action.priority]
+        || Number(right.action.id === taskActionId) - Number(left.action.id === taskActionId)
+        || left.index - right.index))
+        .slice(0, MAX_LOOKUP_PRESENTED_ACTIONS)
+        .map(({ action }) => action);
+}
 function timingByEvidence(timing) {
     const output = new Map();
     if (!timing)