@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/cli/command-reference.mjs

@@ -14,6 +14,8 @@ Investigate:
   bulk               Triage newline-delimited targets with bounded concurrency.
   http               Inspect one homepage request and redirect chain.
   tls                Inspect one hostname's current certificate connection.
+  dnssec-validate    Validate one authorised DNSSEC chain in isolation.
+  mail-transport     Review selected authorised MX transports and STARTTLS.
   posture            Review DNS mail and domain-control posture.
 
 Discover:
@@ -23,7 +25,7 @@ Discover:
   discover-scan      Collect a bounded candidate review queue.
   registry-support   Explain local registry coverage without a request.
   registry-doctor    Diagnose a saved registry collection against local policy.
-  registry-cohort    Aggregate target-free registry quality cohorts.
+  registry-cohort    Build target-free registry quality timelines.
   registry-scaffold  Create a sanitised synthetic fixture scaffold.
 
 Review saved evidence:
@@ -33,7 +35,7 @@ Review saved evidence:
   compare            Compare saved registry publications.
   page-compare       Compare saved static page and TLS evidence.
   mail-review        Review saved passive mail exposure evidence.
-  review-evidence    Review supplied DNS, routing, GeoIP, RDAP, or trust-store evidence offline.
+  review-evidence    Review supplied DNS, routing, cryptographic, GeoIP, RDAP, or trust-store evidence offline.
   brief              Turn one saved Lookup into a bounded decision brief.
   case-pack          Build a reviewed browser-importable case package.
   domain-control     Build or review an integrity-protected desired-state manifest.
@@ -43,12 +45,13 @@ Review saved evidence:
   sharing-review     Lint a reviewed artifact before deliberate sharing.
   workflow-plan      Plan a fixed investigation recipe without executing it.
   workflow-run       Execute resumable approved steps from a fixed recipe.
-  diff               Compare two saved domain observations.
+  diff               Compare two compatible retained artefacts.
   reconcile          Reconcile independently labelled observations.
   timeline           Compare a sequence of observations for one domain.
   export             Convert a saved lookup into an evidence report.
   inspect-archive    Inspect a workspace archive, redacted by default.
   verify-artifact    Validate saved evidence or an integrity envelope offline.
+  interchange-report Report preserved and excluded field groups offline.
 
 Integrity and calibration:
   manifest           Record ordered artefact and configuration digests.
@@ -81,7 +84,7 @@ const COMMAND_USAGE = Object.freeze({
     manifest: 'whoisleuth manifest <artefact.json> [...] --workflow <label> [--configuration-digest <sha256:digest>] [--json] [--quiet] [--no-color]',
     'map-observations': 'whoisleuth map-observations [mapping.json] [--json] [--quiet] [--no-color]',
     'oam-export': 'whoisleuth oam-export [external-findings.json] [--json] [--quiet] [--no-color]',
-    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--junit|--markdown|--html] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose] [--strict-exit] [--fail-on <policies>] [--events] [--quiet] [--no-color]',
+    lookup: 'whoisleuth lookup <domain|IP|ASN> [--json|--junit|--markdown|--html] [--no-attribution] [--fast|--deep] [--observer <label>] [--vantage <label>] [--plan] [--summary|--verbose] [--strict-exit] [--fail-on <policies>] [--events] [--quiet] [--no-color]',
     bulk: 'whoisleuth bulk [file] [--json|--jsonl|--junit|--csv|--domains|--queries] [--registered-only|--inconclusive-only|--errors-only] [--fast|--deep] [--concurrency <1-8>] [--checkpoint <file> [--resume]] [--events] [--plan] [--fail-on <policies>]',
     'ct-search': 'whoisleuth ct-search <keyword> [--json] [--quiet] [--no-color]',
     'ct-intake': 'whoisleuth ct-intake [events.json] [--json] [--quiet] [--no-color]',
@@ -90,13 +93,16 @@ const COMMAND_USAGE = Object.freeze({
     posture: 'whoisleuth posture <domain> [--selectors <list>] [--retired-selectors <list>] [--mail-profile <profile>] [--json|--sarif --owned-domain] [--quiet] [--no-color]',
     http: 'whoisleuth http <domain> [--json] [--quiet] [--no-color]',
     tls: 'whoisleuth tls <hostname> [--json] [--quiet] [--no-color]',
+    'dnssec-validate': 'whoisleuth dnssec-validate <domain> --resolver <public-IP> --trust-anchor <anchor.json> --owned-or-authorized [--json] [--quiet] [--no-color]',
+    'mail-transport': 'whoisleuth mail-transport [input.json] --resolver <public-IP> --trust-anchor <anchor.json> --owned-or-authorized --active-probe [--json] [--quiet] [--no-color]',
     'registry-support': 'whoisleuth registry-support <domain|suffix> [--json] [--quiet] [--no-color]',
     'registry-doctor': 'whoisleuth registry-doctor [lookup.json] [--json] [--quiet] [--no-color]',
-    'registry-cohort': 'whoisleuth registry-cohort [lookups.json|lookups.jsonl] [--json] [--quiet] [--no-color]',
+    'registry-cohort': 'whoisleuth registry-cohort [lookups-or-reports.json|jsonl] [--json] [--quiet] [--no-color]',
     'registry-scaffold': 'whoisleuth registry-scaffold --profile <id> --suffix <suffix> --scenario <registered|not_found|inconclusive>',
-    'risk-calibrate': 'whoisleuth risk-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
+    'risk-calibrate': 'whoisleuth risk-calibrate [dataset.json] [--json|--summary-json] [--quiet] [--no-color]',
     'lookalike-calibrate': 'whoisleuth lookalike-calibrate [dataset.json] [--json] [--quiet] [--no-color]',
-    'verify-artifact': 'whoisleuth verify-artifact [artifact.json] [--passphrase-file <file>] [--json] [--quiet] [--no-color]',
+    'verify-artifact': 'whoisleuth verify-artifact [artifact.json] [--passphrase-file <file>] [--manifest <manifest.json> --manifest-entry <artifact-N>] [--json] [--strict-exit] [--quiet] [--no-color]',
+    'interchange-report': 'whoisleuth interchange-report [artifact.json] [--passphrase-file <file>] [--json] [--quiet] [--no-color]',
     'inspect-archive': 'whoisleuth inspect-archive [archive.json] [--passphrase-file <file>] [--search <value>] [--require-match] [--reveal] [--expect-content-digest <sha256:digest>] [--json]',
     'sign-artifact': 'whoisleuth sign-artifact [artifact.json] --private-key-file <file>',
     'verify-signature': 'whoisleuth verify-signature [package.json] [--public-key-file <file>] [--json] [--quiet] [--no-color]',
@@ -114,10 +120,10 @@ const COMMAND_USAGE = Object.freeze({
     'sharing-review': 'whoisleuth sharing-review [artifact.json] --marking <level> --recipient-scope <scope> --purpose <text> [--human-reviewed] [--personal-data-reviewed] [--redactions-confirmed] [--json]',
     'workflow-plan': 'whoisleuth workflow-plan <recipe> <domain|brand> [--json] [--quiet] [--no-color]',
     'workflow-run': 'whoisleuth workflow-run <recipe> <domain|brand> [--approve-network] [--resume <state.json>] [--json] [--quiet] [--no-color]',
-    diff: 'whoisleuth diff <left.json> <right.json> [--json] [--quiet] [--no-color]',
+    diff: 'whoisleuth diff <left.json> <right.json> [--left-session <id> --right-session <id>] [--json] [--quiet] [--no-color]',
     reconcile: 'whoisleuth reconcile <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
     timeline: 'whoisleuth timeline <observation.json> <observation.json> [...] [--json] [--quiet] [--no-color]',
-    export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact]',
+    export: 'whoisleuth export [lookup.json] [--markdown|--html|--compact] [--no-attribution]',
 });
 const COMMAND_DETAILS = Object.freeze({
     completion: {
@@ -200,6 +206,16 @@ const COMMAND_DETAILS = Object.freeze({
         example: 'whoisleuth tls example.test --json',
         boundary: 'One observed connection is point-in-time evidence and does not establish every address, edge, or historical certificate.',
     },
+    'dnssec-validate': {
+        description: 'Cryptographically validate one authorised DNSSEC chain from a supplied trust anchor through one selected public resolver.',
+        example: 'whoisleuth dnssec-validate example.test --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --json',
+        boundary: 'This isolated action is never invoked by Lookup, Bulk, monitoring, or recipes. It caps DNS queries, aliases, delegations, bytes, and duration; transport and validation failures remain separate, and secure is not a general safety verdict.',
+    },
+    'mail-transport': {
+        description: 'Review selected authorised MX endpoints, DNSSEC-qualified TLSA evidence, SMTP capabilities, and optional STARTTLS certificates.',
+        example: 'whoisleuth mail-transport selected-mx.json --resolver "$PUBLIC_RESOLVER_IP" --trust-anchor anchor.json --owned-or-authorized --active-probe --json',
+        boundary: 'This isolated action probes at most three selected MX hosts sequentially, reports selection, public revalidation, connection, and address authentication separately, sends only EHLO and optional STARTTLS, never retries, and performs no authentication, relay, recipient, mailbox, catch-all, or message test. If a DANE-TA TLSA usage 2 association is published, active collection retains only the leaf certificate and leaves that comparison partial without certificate-path construction and trust-anchor path validation. SMTP relay PKIX-TA usage 0 and PKIX-EE usage 1 records remain unsupported and cannot complete SMTP DANE assurance; a separate usage 3 match remains eligible.',
+    },
     'registry-support': {
         description: 'Explain the local registry capability profile for one domain or suffix.',
         example: 'whoisleuth registry-support example.test --json',
@@ -211,9 +227,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The command is offline. It distinguishes expected access constraints from collection results and does not contact a live registry.',
     },
     'registry-cohort': {
-        description: 'Aggregate saved registry observations into privacy-safe suffix and capability-profile cohorts.',
+        description: 'Build privacy-safe suffix and capability-profile timelines from saved observations or retained cohort reports.',
         example: 'whoisleuth registry-cohort saved-lookups.jsonl --json',
-        boundary: 'This command is offline and omits domains, queries, and raw evidence. Cohorts below the fixed minimum sample remain insufficient.',
+        boundary: 'This command is offline and omits domains, queries, and raw evidence. Input families cannot be mixed, and retained samples are never assumed independent.',
     },
     'registry-scaffold': {
         description: 'Create a bounded synthetic WHOIS fixture scaffold for one existing capability profile.',
@@ -222,8 +238,8 @@ const COMMAND_DETAILS = Object.freeze({
     },
     'risk-calibrate': {
         description: 'Replay reviewed labels against the current explainable Risk model.',
-        example: 'whoisleuth risk-calibrate calibration.json --json',
-        boundary: 'Calibration is offline and diagnostic. It never trains, tunes, or changes the scoring model automatically.',
+        example: 'whoisleuth risk-calibrate calibration.json --summary-json',
+        boundary: 'Calibration is offline and diagnostic. The summary form omits record identifiers, domains, and evidence; neither form trains, tunes, or changes the scoring model automatically.',
     },
     'lookalike-calibrate': {
         description: 'Summarise reviewed candidate dispositions by mutation family without retaining domains.',
@@ -231,9 +247,14 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'Calibration is offline and diagnostic. It omits candidate identifiers, domains, notes, and evidence and never tunes generation or filtering automatically.',
     },
     'verify-artifact': {
-        description: 'Validate a supported archive, packet, manifest, or saved Lookup without printing evidence contents.',
-        example: 'whoisleuth verify-artifact workspace.json --json',
-        boundary: 'Verification is offline and redacted. Encrypted archives require an explicitly supplied passphrase file.',
+        description: 'Validate a supported archive, claim passport, packet, manifest, saved Lookup, or supported Lookup-evidence export without printing evidence contents.',
+        example: 'whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit',
+        boundary: 'Verification is offline and redacted. Encrypted archives require an explicitly supplied passphrase file; --strict-exit returns 4 when only an envelope or legacy projection integrity was verified.',
+    },
+    'interchange-report': {
+        description: 'Report what one recognised portable artefact preserves, excludes, and supports across browser and CLI workflows.',
+        example: 'whoisleuth interchange-report workspace.json --json',
+        boundary: 'The report is offline and metadata-only. It does not echo targets, contacts, notes, passphrases, evidence values, or an unrecognised schema string.',
     },
     'inspect-archive': {
         description: 'Summarise or search one workspace archive with redacted output by default.',
@@ -246,9 +267,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'The command never creates, stores, or transmits keys. Key custody and signer identity remain the operator\'s responsibility.',
     },
     'verify-signature': {
-        description: 'Verify the integrity and signature of one signed evidence package.',
+        description: 'Verify the cryptographic signature of one signed evidence package and report embedded-artifact assurance separately.',
         example: 'whoisleuth verify-signature packet.signed.json --json',
-        boundary: 'A valid signature proves package consistency for the embedded key, not the real-world identity or authority of its holder.',
+        boundary: 'A valid signature proves package consistency for the embedded key. It does not upgrade failed or unsupported embedded-artifact assurance or establish the holder\'s real-world identity or authority.',
     },
     'source-report': {
         description: 'Create a target-free reliability summary from a saved lookup.',
@@ -321,9 +342,9 @@ const COMMAND_DETAILS = Object.freeze({
         boundary: 'Only installed recipe commands can run. Network steps require explicit approval for each invocation, and analyst-selection placeholders always pause without interpretation.',
     },
     diff: {
-        description: 'Compare bounded evidence retained in two saved domain lookups.',
+        description: 'Compare two compatible retained Lookup, Bulk-session, or domain-portfolio artefacts.',
         example: 'whoisleuth diff first.json second.json --json',
-        boundary: 'Comparison is offline. Missing, unavailable, equal, and different evidence remain separate states.',
+        boundary: 'Comparison is offline. Multi-session Bulk exports require explicit session IDs, and missing, unavailable, equal, and different evidence remain separate states.',
     },
     reconcile: {
         description: 'Reconcile bounded values across independently labelled observations of one domain.',
@@ -338,7 +359,7 @@ const COMMAND_DETAILS = Object.freeze({
     export: {
         description: 'Convert one saved lookup into a versioned evidence report.',
         example: 'whoisleuth export lookup.json --markdown',
-        boundary: 'Exports preserve source attribution and limitations. Compact output intentionally omits raw registry payloads.',
+        boundary: 'The saved Lookup is capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Exports preserve evidence-source attribution and limitations. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.',
     },
 });
 const COMMAND_COLLECTION = Object.freeze({
@@ -358,13 +379,16 @@ const COMMAND_COLLECTION = Object.freeze({
     posture: { mode: 'network', scope: 'Accepts one domain and performs bounded DNS queries only.' },
     http: { mode: 'network', scope: 'Accepts one domain and follows only the bounded SSRF-guarded homepage redirect workflow.' },
     tls: { mode: 'network', scope: 'Accepts one public hostname and opens one bounded certificate connection.' },
+    'dnssec-validate': { mode: 'network', scope: 'Accepts one authorised domain, one public resolver IP, and one local trust-anchor file; DNS-over-TCP validation is capped at 32 queries and 15 seconds.' },
+    'mail-transport': { mode: 'network', scope: 'Accepts at most three selected authorised MX hosts, uses one public resolver, and performs sequential bounded SMTP connections with no retries.' },
     'registry-support': { mode: 'offline', scope: 'Reads the embedded registry capability catalogue for one domain or suffix.' },
     'registry-doctor': { mode: 'offline', scope: 'Reads one saved Lookup and the embedded registry capability catalogue.' },
-    'registry-cohort': { mode: 'offline', scope: 'Reads at most 500 saved Lookups and emits target-free suffix/profile cohort counts.' },
+    'registry-cohort': { mode: 'offline', scope: 'Reads at most 500 saved Lookups or retained cohort reports from one unmixed family and emits bounded target-free timelines.' },
     'registry-scaffold': { mode: 'offline', scope: 'Reads the embedded registry capability catalogue and prints one synthetic fixture template.' },
     'risk-calibrate': { mode: 'offline', scope: 'Reads one bounded reviewed-label dataset and changes no model or evidence.' },
     'lookalike-calibrate': { mode: 'offline', scope: 'Reads at most 5,000 reviewed candidate labels from one dataset capped at 2 MiB.' },
-    'verify-artifact': { mode: 'offline', scope: 'Reads one selected bounded archive, packet, manifest, or saved Lookup document.' },
+    'verify-artifact': { mode: 'offline', scope: 'Reads one selected bounded artefact and, when explicitly supplied, one manifest whose selected entry is compared by exact bytes and canonical identity.' },
+    'interchange-report': { mode: 'offline', scope: 'Reads one selected bounded portable artefact and emits fixed compatibility metadata only.' },
     'inspect-archive': { mode: 'offline', scope: 'Reads one selected bounded workspace archive with redacted output by default.' },
     'sign-artifact': { mode: 'offline', scope: 'Reads one selected artefact and one local private key without transmitting either.' },
     'verify-signature': { mode: 'offline', scope: 'Reads one selected signed package and optional local public key.' },
@@ -382,7 +406,7 @@ const COMMAND_COLLECTION = Object.freeze({
     'sharing-review': { mode: 'offline', scope: 'Reads one artefact capped at 15 MiB, emits only bounded schema/version metadata and no content values, and performs no transmission.' },
     'workflow-plan': { mode: 'offline', scope: 'Builds a fixed typed recipe and executes none of its network or file steps.' },
     'workflow-run': { mode: 'network', scope: 'Runs only concrete fixed-recipe steps; network collection requires --approve-network and analyst-selection steps always pause.' },
-    diff: { mode: 'offline', scope: 'Reads two saved Lookup documents for different domains.' },
+    diff: { mode: 'offline', scope: 'Reads two compatible retained artefacts capped at 8 MiB each and retains no source paths.' },
     reconcile: { mode: 'offline', scope: 'Reads 2 to 5 saved observations for one domain, capped at 32 MiB in total.' },
     timeline: { mode: 'offline', scope: 'Reads 2 to 20 saved observations for one domain, capped at 32 MiB in total.' },
     export: { mode: 'offline', scope: 'Reads one saved Lookup and writes one bounded report.' },

package/cli/completion.mjs

@@ -2,21 +2,28 @@ import { CLI_COMMANDS } from "./arguments.mjs";
 import { INVESTIGATION_PLAN_RECIPES } from "./investigation-plan.mjs";
 const COMMON_OPTIONS = Object.freeze(['--help', '--output', '--force', '--config', '--profile']);
 const OPTIONS_BY_COMMAND = Object.freeze({
-    lookup: ['--json', '--junit', '--markdown', '--html', '--fast', '--deep', '--observer', '--vantage', '--plan', '--summary', '--verbose', '--strict-exit', '--fail-on', '--events', '--quiet', '--no-color'],
+    manifest: ['--workflow', '--configuration-digest', '--json', '--quiet', '--no-color'],
+    'map-observations': ['--json', '--quiet', '--no-color'],
+    'oam-export': ['--json', '--quiet', '--no-color'],
+    lookup: ['--json', '--junit', '--markdown', '--html', '--no-attribution', '--fast', '--deep', '--observer', '--vantage', '--plan', '--summary', '--verbose', '--strict-exit', '--fail-on', '--events', '--quiet', '--no-color'],
     bulk: ['--json', '--jsonl', '--junit', '--csv', '--domains', '--queries', '--registered-only', '--inconclusive-only', '--errors-only', '--fast', '--deep', '--concurrency', '--checkpoint', '--resume', '--events', '--plan', '--fail-on', '--quiet', '--no-color'],
     'ct-search': ['--json', '--quiet', '--no-color'],
+    'ct-intake': ['--json', '--quiet', '--no-color'],
     discover: ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--snapshot', '--json', '--jsonl', '--domains', '--quiet', '--no-color'],
     'discover-scan': ['--tlds', '--preset', '--families', '--keyboard', '--dictionary', '--fast', '--deep', '--scan-limit', '--chunk-size', '--concurrency', '--resolver', '--allowlist', '--checkpoint', '--resume', '--observation-snapshot', '--registered-only', '--inconclusive-only', '--acquisition-only', '--suppressed-only', '--events', '--plan', '--fail-on', '--json', '--jsonl', '--csv', '--domains', '--quiet', '--no-color'],
     posture: ['--selectors', '--retired-selectors', '--mail-profile', '--json', '--sarif', '--owned-domain', '--quiet', '--no-color'],
     http: ['--json', '--quiet', '--no-color'],
     tls: ['--json', '--quiet', '--no-color'],
+    'dnssec-validate': ['--resolver', '--trust-anchor', '--owned-or-authorized', '--json', '--quiet', '--no-color'],
+    'mail-transport': ['--resolver', '--trust-anchor', '--owned-or-authorized', '--active-probe', '--json', '--quiet', '--no-color'],
     'registry-support': ['--json', '--quiet', '--no-color'],
     'registry-doctor': ['--json', '--quiet', '--no-color'],
     'registry-cohort': ['--json', '--quiet', '--no-color'],
     'registry-scaffold': ['--profile', '--suffix', '--scenario'],
-    'risk-calibrate': ['--json', '--quiet', '--no-color'],
+    'risk-calibrate': ['--json', '--summary-json', '--quiet', '--no-color'],
     'lookalike-calibrate': ['--json', '--quiet', '--no-color'],
-    'verify-artifact': ['--passphrase-file', '--json', '--quiet', '--no-color'],
+    'verify-artifact': ['--passphrase-file', '--manifest', '--manifest-entry', '--json', '--strict-exit', '--quiet', '--no-color'],
+    'interchange-report': ['--passphrase-file', '--json', '--quiet', '--no-color'],
     'inspect-archive': ['--passphrase-file', '--search', '--require-match', '--reveal', '--expect-content-digest', '--json', '--quiet', '--no-color'],
     'sign-artifact': ['--private-key-file'],
     'verify-signature': ['--public-key-file', '--json', '--quiet', '--no-color'],
@@ -30,34 +37,42 @@ const OPTIONS_BY_COMMAND = Object.freeze({
     'domain-control': ['--json', '--quiet', '--no-color'],
     'monitor-once': ['--previous', '--limit', '--concurrency', '--fail-on', '--json', '--junit', '--quiet', '--no-color'],
     assurance: ['--json', '--quiet', '--no-color'],
+    'change-packet': ['--json', '--quiet', '--no-color'],
     'sharing-review': ['--marking', '--recipient-scope', '--purpose', '--human-reviewed', '--personal-data-reviewed', '--redactions-confirmed', '--json', '--quiet', '--no-color'],
     'workflow-plan': ['--json', '--quiet', '--no-color'],
     'workflow-run': ['--approve-network', '--resume', '--json', '--quiet', '--no-color'],
-    diff: ['--json', '--quiet', '--no-color'],
+    diff: ['--left-session', '--right-session', '--json', '--quiet', '--no-color'],
     reconcile: ['--json', '--quiet', '--no-color'],
     timeline: ['--json', '--quiet', '--no-color'],
-    export: ['--markdown', '--html', '--compact'],
+    export: ['--markdown', '--html', '--compact', '--no-attribution'],
     completion: [],
     commands: ['--json', '--quiet', '--no-color'],
     doctor: ['--network', '--json', '--quiet', '--no-color'],
     manual: [],
 });
 const COMMAND_DESCRIPTIONS = Object.freeze({
+    manifest: 'Build an evidence manifest offline',
+    'map-observations': 'Normalise passive DNS observations offline',
+    'oam-export': 'Export an observation-archive map offline',
     lookup: 'Collect one domain, IP, or ASN',
     bulk: 'Run bounded multi-target collection',
     'ct-search': 'Search certificate observations',
+    'ct-intake': 'Normalise certificate observations offline',
     discover: 'Generate lookalike candidates offline',
     'discover-scan': 'Collect a supervised candidate review queue',
     posture: 'Review DNS and mail posture',
     http: 'Inspect one homepage request',
     tls: 'Inspect one TLS connection',
+    'dnssec-validate': 'Validate an authorised DNSSEC chain',
+    'mail-transport': 'Review selected authorised SMTP transports',
     'registry-support': 'Explain local registry coverage',
     'registry-doctor': 'Diagnose saved registry collection',
-    'registry-cohort': 'Aggregate target-free registry quality cohorts',
+    'registry-cohort': 'Build target-free registry quality timelines',
     'registry-scaffold': 'Create a sanitised registry fixture scaffold',
     'risk-calibrate': 'Replay reviewed Risk labels offline',
     'lookalike-calibrate': 'Summarise reviewed lookalike yield offline',
     'verify-artifact': 'Validate saved evidence offline',
+    'interchange-report': 'Report portable artefact fidelity offline',
     'inspect-archive': 'Inspect an archive locally',
     'sign-artifact': 'Sign a reviewed artefact locally',
     'verify-signature': 'Verify a signed evidence package',
@@ -71,10 +86,11 @@ const COMMAND_DESCRIPTIONS = Object.freeze({
     'domain-control': 'Build or review a domain control manifest',
     'monitor-once': 'Run one bounded domain control review',
     assurance: 'Review domain change, recovery, or retirement plans',
+    'change-packet': 'Build a reviewed change packet offline',
     'sharing-review': 'Lint an artefact before deliberate sharing',
     'workflow-plan': 'Plan a fixed investigation recipe',
     'workflow-run': 'Execute approved fixed-recipe steps',
-    diff: 'Compare two saved domain lookups',
+    diff: 'Compare two compatible retained artefacts',
     reconcile: 'Reconcile independently labelled observations',
     timeline: 'Build same-domain history from saved lookups',
     export: 'Convert a lookup to an evidence report',
@@ -105,6 +121,15 @@ const FILE_OPTIONS = Object.freeze([
     '--observation-snapshot',
     '--previous',
     '--resume',
+    '--trust-anchor',
+]);
+const FILE_POSITIONAL_COMMANDS = new Set([
+    'manifest',
+    'map-observations',
+    'oam-export',
+    'ct-intake',
+    'change-packet',
+    'mail-transport',
 ]);
 const TEXT_OPTIONS = Object.freeze([
     '--families',
@@ -121,7 +146,7 @@ const TEXT_OPTIONS = Object.freeze([
     '--vantage',
 ]);
 function commandOptions(command) {
-    return [...COMMON_OPTIONS, ...(OPTIONS_BY_COMMAND[command] || [])].join(' ');
+    return [...COMMON_OPTIONS, ...OPTIONS_BY_COMMAND[command]].join(' ');
 }
 function bashCompletion() {
     const cases = CLI_COMMANDS.map((command) => `    ${command}) options="${commandOptions(command)}" ;;`).join('\n');
@@ -153,6 +178,9 @@ ${valueCases}
 ${cases}
     *) options="--help" ;;
   esac
+  case " ${[...FILE_POSITIONAL_COMMANDS].join(' ')} " in
+    *" \${command} "*) [[ "\${current}" != -* ]] && COMPREPLY=( $(compgen -f -- "\${current}") ) && return ;;
+  esac
   COMPREPLY=( $(compgen -W "\${options}" -- "\${current}") )
 }
 complete -F _whoisleuth_completion whoisleuth
@@ -190,6 +218,10 @@ ${valueCases}
 ${cases}
     *) options=(--help) ;;
   esac
+  if [[ " ${[...FILE_POSITIONAL_COMMANDS].join(' ')} " == *" \${command} "* && "\${words[CURRENT]}" != -* ]]; then
+    _files
+    return
+  fi
   compadd -- \${options[@]}
 }
 if [[ "\${funcstack[1]}" == "_whoisleuth" ]]; then
@@ -200,14 +232,14 @@ fi
 `;
 }
 function fishCompletion() {
-    const commandLines = CLI_COMMANDS.map((command) => (`complete -c whoisleuth -n '__fish_use_subcommand' -a '${command}' -d '${COMMAND_DESCRIPTIONS[command] || command}'`));
+    const commandLines = CLI_COMMANDS.map((command) => (`complete -c whoisleuth -n '__fish_use_subcommand' -a '${command}' -d '${COMMAND_DESCRIPTIONS[command]}'${FILE_POSITIONAL_COMMANDS.has(command) ? ' -F' : ''}`));
     const optionLine = (condition, option) => {
         const name = option.replace(/^--/u, '');
         const fileValue = FILE_OPTIONS.includes(option);
         const requiresValue = fileValue || [...Object.keys(VALUE_OPTIONS), ...TEXT_OPTIONS].includes(option);
         return `complete -c whoisleuth -n '${condition}' -l ${name}${requiresValue ? ' -r' : ''}${fileValue ? ' -F' : ''}`;
     };
-    const commonCondition = `__fish_seen_subcommand_from ${CLI_COMMANDS.join(' ')}`;
+    const commonCondition = 'not __fish_use_subcommand';
     const commonOptionLines = COMMON_OPTIONS.map((option) => optionLine(commonCondition, option));
     const optionLines = Object.entries(OPTIONS_BY_COMMAND).flatMap(([command, options]) => (options.map((option) => optionLine(`__fish_seen_subcommand_from ${command}`, option))));
     const valueLines = Object.entries(VALUE_OPTIONS).flatMap(([option, values]) => (values.map((value) => `complete -c whoisleuth -n '__fish_prev_arg_in ${option}' -a '${value}'`)));
@@ -226,7 +258,7 @@ ${valueLines.join('\n')}
 function powershellCompletion() {
     const commandOptions = Object.fromEntries(CLI_COMMANDS.map((command) => [
         command,
-        [...COMMON_OPTIONS, ...(OPTIONS_BY_COMMAND[command] || [])],
+        [...COMMON_OPTIONS, ...OPTIONS_BY_COMMAND[command]],
     ]));
     return `# WHOISleuth PowerShell completion
 Register-ArgumentCompleter -Native -CommandName whoisleuth -ScriptBlock {
@@ -240,9 +272,16 @@ ${Object.entries(VALUE_OPTIONS).map(([option, values]) => `    '${option}' = @($
     'completion' = @('bash', 'zsh', 'fish', 'powershell')
     'workflow-plan' = @(${INVESTIGATION_PLAN_RECIPES.map((value) => `'${value}'`).join(', ')})
   }
+  $fileCommands = @(${[...FILE_POSITIONAL_COMMANDS].map((command) => `'${command}'`).join(', ')})
   $elements = @($commandAst.CommandElements | ForEach-Object { $_.Extent.Text })
   $command = if ($elements.Count -gt 1) { $elements[1] } else { '' }
   $previous = if ($elements.Count -gt 1) { $elements[$elements.Count - 1] } else { '' }
+  if ($fileCommands -contains $command -and -not $wordToComplete.StartsWith('-')) {
+    Get-ChildItem -Path "${'$'}wordToComplete*" -File -ErrorAction SilentlyContinue | ForEach-Object {
+      [System.Management.Automation.CompletionResult]::new($_.FullName, $_.Name, 'ProviderItem', $_.FullName)
+    }
+    return
+  }
   $candidates = if ($elements.Count -le 2) {
     @($commands) + @('--help', '--version')
   } elseif ($command -eq 'completion' -and $elements.Count -le 3) {

package/cli/config-profile.mjs

@@ -1,8 +1,8 @@
 import { Buffer } from 'node:buffer';
-import { open } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { CliUsageError } from "./errors.mjs";
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
 export const CLI_CONFIG_SCHEMA = 'whoisleuth.cli.config';
 export const CLI_CONFIG_VERSION = 1;
 export const MAX_CLI_CONFIG_BYTES = 64 * 1024;
@@ -91,16 +91,11 @@ function parseProfileDocument(input) {
     return Object.freeze({ schema: CLI_CONFIG_SCHEMA, version: CLI_CONFIG_VERSION, ...(root.defaultProfile ? { defaultProfile: root.defaultProfile } : {}), profiles: Object.freeze(profiles) });
 }
 async function readConfigFile(path) {
-    const handle = await open(path, 'r');
-    try {
-        const metadata = await handle.stat();
-        if (metadata.size > MAX_CLI_CONFIG_BYTES)
-            throw new CliUsageError('CLI configuration is limited to 64 KiB.');
-        return await handle.readFile({ encoding: 'utf8' });
-    }
-    finally {
-        await handle.close();
-    }
+    return readBoundedRegularTextFile(path, {
+        maximumBytes: MAX_CLI_CONFIG_BYTES,
+        label: 'CLI configuration',
+        allowSymbolicLink: true,
+    });
 }
 function suppliedGroups(argumentsList) {
     const groups = new Set();
@@ -114,6 +109,14 @@ function suppliedGroups(argumentsList) {
     return groups;
 }
 export async function resolveCliProfileArguments(argv, options = {}) {
+    // registry-scaffold owns --profile as the capability template to generate.
+    // Do not reinterpret it as a global CLI-default profile.
+    if (argv[0] === 'registry-scaffold') {
+        if (argv.includes('--config')) {
+            throw new CliUsageError('registry-scaffold does not accept global CLI configuration options.');
+        }
+        return [...argv];
+    }
     const retained = [];
     let configPath = null;
     let profileName = null;
@@ -153,7 +156,7 @@ export async function resolveCliProfileArguments(argv, options = {}) {
     catch (error) {
         if (error instanceof CliUsageError)
             throw error;
-        throw new CliUsageError(`Could not read CLI configuration from ${selectedPath}.`);
+        throw new CliUsageError('CLI configuration could not be read as a bounded regular file.');
     }
     const document = parseProfileDocument(input);
     const selectedName = profileName || document.defaultProfile;

package/cli/ct-event-intake.mjs

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { exactKeys, requireBoundedString, requireIsoTimestamp, requireRecord, } from "../lib/bounded-contract-normalizers.mjs";
 export const CT_EVENT_BATCH_SCHEMA = 'whoisleuth.ct-event-batch';
@@ -21,6 +22,15 @@ const EVENT_KEYS = new Set([
     'limitations',
 ]);
 const SHA256_RE = /^[a-f0-9]{64}$/u;
+function eventId(logId, certificateSha256, observedAt) {
+    return createHash('sha256')
+        .update(logId)
+        .update('\u0000')
+        .update(certificateSha256)
+        .update('\u0000')
+        .update(observedAt)
+        .digest('hex');
+}
 function optionalText(value, label, maximum) {
     if (value === undefined || value === null || value === '')
         return null;
@@ -80,6 +90,7 @@ export function buildCtEventFindings(inputRaw) {
             throw new TypeError(`events[${eventIndex}].completeness must be complete or partial.`);
         }
         const limitations = boundedLimitations(event.limitations, `events[${eventIndex}].limitations`);
+        const retainedEventId = eventId(logId, certificateSha256, observedAt);
         return names.map((name) => ({
             domain: name,
             category: 'certificate',
@@ -96,6 +107,11 @@ export function buildCtEventFindings(inputRaw) {
                 value: certificateSha256,
                 issuer,
                 notAfter,
+                eventId: retainedEventId,
+                logId,
+                certificateSha256,
+                dnsNameCount: names.length,
+                namesComplete: completeness === 'complete',
             },
         }));
     });
@@ -105,7 +121,7 @@ export function buildCtEventFindings(inputRaw) {
         || left.observedAt.localeCompare(right.observedAt)
         || left.structuredObservation.value.localeCompare(right.structuredObservation.value))
         .filter((item) => {
-        const key = `${item.domain}\u0000${item.observedAt}\u0000${item.structuredObservation.value}`;
+        const key = `${item.domain}\u0000${item.observedAt}\u0000${item.structuredObservation.value}\u0000${item.structuredObservation.eventId}`;
         if (seen.has(key))
             return false;
         seen.add(key);
@@ -127,17 +143,31 @@ export function buildCtEventFindings(inputRaw) {
             break;
     }
     const truncated = selected.length < unique.length;
+    const selectedNamesByEvent = new Map();
+    for (const finding of selected) {
+        const retainedEventId = finding.structuredObservation.eventId;
+        selectedNamesByEvent.set(retainedEventId, (selectedNamesByEvent.get(retainedEventId) ?? 0) + 1);
+    }
     const findings = selected.map((finding) => Object.freeze({
         ...finding,
+        structuredObservation: Object.freeze({
+            ...finding.structuredObservation,
+            namesComplete: finding.structuredObservation.namesComplete
+                && selectedNamesByEvent.get(finding.structuredObservation.eventId) === finding.structuredObservation.dnsNameCount,
+        }),
         limitations: Object.freeze([
             ...finding.limitations,
             'The supplied event is an observation, not proof that the certificate was served by the named domain or that the domain operator requested it.',
+            ...(finding.structuredObservation.namesComplete
+                && selectedNamesByEvent.get(finding.structuredObservation.eventId) !== finding.structuredObservation.dnsNameCount
+                ? ['The bounded import did not retain every DNS name from this certificate event.']
+                : []),
             ...(truncated ? [`The batch contained ${unique.length} unique domain observations; this import preserves the first ${MAX_CT_EXTERNAL_FINDINGS} in deterministic order.`] : []),
         ].slice(0, 8)),
     }));
     return Object.freeze({
         schema: 'whoisleuth.external-findings',
-        schemaVersion: 3,
+        schemaVersion: 4,
         source,
         findings: Object.freeze(findings),
     });

package/cli/discovery-observation-snapshot.mjs

@@ -1,9 +1,9 @@
 import { createHash } from 'node:crypto';
-import { open } from 'node:fs/promises';
 import { availabilityState, bulkDnsSummary } from "./bulk-output.mjs";
-import { CliUsageError } from "./errors.mjs";
+import { boundedCliInputError, CliUsageError } from "./errors.mjs";
 import { writePrivateFile } from "./output-file.mjs";
 import { isValidAsciiDomainName } from "../lib/hostname.mjs";
+import { readBoundedRegularTextFile } from "../lib/bounded-file.mjs";
 export const CLI_DISCOVERY_OBSERVATION_SCHEMA = 'whoisleuth.cli.discovery-observation-snapshot';
 export const CLI_DISCOVERY_OBSERVATION_VERSION = 2;
 export const MAX_DISCOVERY_OBSERVATION_BYTES = 8 * 1024 * 1024;
@@ -158,22 +158,16 @@ function parseObservationSnapshot(text, expectedDigest) {
 }
 async function readExisting(path) {
     try {
-        const handle = await open(path, 'r');
-        try {
-            const metadata = await handle.stat();
-            if (!metadata.isFile() || metadata.size > MAX_DISCOVERY_OBSERVATION_BYTES) {
-                throw new CliUsageError(`Discovery observation snapshots are limited to ${MAX_DISCOVERY_OBSERVATION_BYTES} bytes.`);
-            }
-            return await handle.readFile({ encoding: 'utf8' });
-        }
-        finally {
-            await handle.close();
-        }
+        return await readBoundedRegularTextFile(path, {
+            maximumBytes: MAX_DISCOVERY_OBSERVATION_BYTES,
+            label: 'Discovery observation snapshot',
+            allowSymbolicLink: true,
+        });
     }
     catch (error) {
         if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
             return null;
-        throw error;
+        throw boundedCliInputError(error, 'Discovery observation snapshot');
     }
 }
 function currentAttempt(domain, item, previous, generatedAt, deep) {