@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/docs/cli.md

@@ -65,10 +65,14 @@ saved result without sending it anywhere:
 ```bash
 whoisleuth bulk domains.txt --csv
 whoisleuth discover example.com --preset common --jsonl
-whoisleuth verify-artifact lookup.json --json
+whoisleuth verify-artifact lookup.json --json --strict-exit
+whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit
+whoisleuth interchange-report workspace.json --json
 whoisleuth compare lookup.json --json
+whoisleuth diff earlier-bulk.json later-bulk.json --left-session session-1 --right-session session-2 --json
 whoisleuth brief lookup.json
 whoisleuth registry-doctor lookup.json --json
+whoisleuth registry-cohort retained-cohorts.jsonl --json
 ```
 
 Only one query is accepted by `lookup`; multi-input processing belongs to
@@ -86,6 +90,7 @@ generated manual, and `commands --json`.
 | Deep Lookup | Explicitly requested bounded RDAP, WHOIS, DNS, website, TLS, registrar-RDAP, and observed-network work where applicable. |
 | Compact deep Bulk | Uses the shared Lookup orchestration but omits full-only response fields and collectors. |
 | Offline review | Reads only the named bounded artefact or analyst-authored input and makes no network request. |
+| Isolated authorised action | Runs only when its dedicated command and per-run acknowledgement flags are supplied; it is never added to Lookup, Bulk, monitoring, or recipes. |
 
 Networked commands run from the local machine and contact the sources declared
 by their profile. They do not use the hosted login or hosted usage controls;
@@ -106,12 +111,12 @@ HTTP status, and a bounded explanation.
 
 | Goal | Commands |
 | --- | --- |
-| Investigate a target | `lookup`, `http`, `tls`, `posture`, `registry-support` |
+| Investigate a target | `lookup`, `http`, `tls`, `dnssec-validate`, `mail-transport`, `posture`, `registry-support` |
 | Review many targets | `bulk`, `discover`, `discover-scan`, `ct-search`, `ct-intake` |
 | Compare saved evidence | `compare`, `page-compare`, `diff`, `reconcile`, `timeline`, `mail-review` |
 | Review supplied evidence | `brief`, `review-evidence`, `registry-doctor`, `registry-cohort`, `source-report`, `sharing-review`, `map-observations` |
 | Plan and assure changes | `domain-control`, `monitor-once`, `assurance`, `change-packet`, `workflow-plan`, `workflow-run` |
-| Verify and package evidence | `case-pack`, `manifest`, `oam-export`, `verify-artifact`, `inspect-archive`, `sign-artifact`, `verify-signature`, `export` |
+| Verify and package evidence | `case-pack`, `manifest`, `oam-export`, `verify-artifact`, `interchange-report`, `inspect-archive`, `sign-artifact`, `verify-signature`, `export` |
 | Calibrate offline | `risk-calibrate`, `lookalike-calibrate` |
 | Operate the CLI | `doctor`, `registry-scaffold`, `commands`, `completion`, `manual` |
 
@@ -189,7 +194,7 @@ full contracts into the packaged reference.
 
 ### Offline artefact verification
 
-[Read the archive, saved Lookup, and signed-artefact verification contract.](cli-reference.md#offline-artefact-verification)
+[Read the archive, saved Lookup, Lookup-evidence, and signed-artefact verification contract.](cli-reference.md#offline-artefact-verification)
 
 ### Privacy-safe source reliability report
 
@@ -244,6 +249,18 @@ search contract.](cli-reference.md#workspace-archive-inspection)
 
 [Read the bounded TLS collection contract.](cli-reference.md#tls-intelligence)
 
+### Isolated cryptographic and mail transport review
+
+[Read the explicitly authorised DNSSEC, TLSA/DANE, STARTTLS, and SMTP transport contract.](cli-reference.md#isolated-cryptographic-and-mail-transport-review)
+The mail report keeps address selection, public revalidation, confirmed
+connection, and cryptographic address authentication as separate provenance;
+address authentication is unavailable when no address candidate was retained.
+If a DANE-TA TLSA usage 2 association is published, active collection retains
+only the observed leaf certificate and leaves that comparison partial without
+certificate-path construction and trust-anchor path validation. SMTP relay
+PKIX-TA usage 0 and PKIX-EE usage 1 records are retained as unsupported and
+cannot complete SMTP DANE assurance; a separate usage 3 match remains eligible.
+
 ### Registry-source comparison
 
 [Read the normalised RDAP and WHOIS comparison contract.](cli-reference.md#registry-source-comparison)
@@ -258,7 +275,7 @@ search contract.](cli-reference.md#workspace-archive-inspection)
 
 ### Offline supplied-evidence review
 
-[Read the DNSSEC, DANE, zone-intent, portfolio, domain-change, and supplied-observation review contract.](cli-reference.md#offline-supplied-evidence-review)
+[Read the separate DNSSEC, route-origin, DANE/TLSA, zone-intent, portfolio, domain-change, and supplied-observation review contract.](cli-reference.md#offline-supplied-evidence-review)
 
 ### Domain control manifests
 
@@ -291,6 +308,8 @@ search contract.](cli-reference.md#workspace-archive-inspection)
 ### Lookup evidence export
 
 [Read normalised JSON, Markdown, and HTML export behaviour.](cli-reference.md#lookup-evidence-export)
+Saved Lookup JSON is byte-, nesting-, entry-, and per-container-bounded before parsing, and the
+completed evidence package must satisfy the stricter portable-tree contract.
 
 ## Safety and limitations
 

package/frontend/src/lib/analysis/acquisition-decision-packet.js

@@ -1,6 +1,6 @@
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
 export const ACQUISITION_DECISION_PACKET_SCHEMA = 'whoisleuth.acquisition-decision';
-export const ACQUISITION_DECISION_PACKET_VERSION = 1;
+export const ACQUISITION_DECISION_PACKET_VERSION = 2;
 export const ACQUISITION_DECISIONS = [
     'unresolved',
     'continue_manual_review',
@@ -80,10 +80,10 @@ export async function buildAcquisitionDecisionPacket(input) {
                 : []),
         ],
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/frontend/src/lib/analysis/artifact-integrity.js

@@ -19,3 +19,45 @@ export async function sha256ArtifactDigest(value) {
         .map((byte) => byte.toString(16).padStart(2, '0'))
         .join('')}`;
 }
+export const SORTED_JSON_V1 = 'sorted-json-v1';
+export const SORTED_JSON_V2 = 'sorted-json-v2';
+function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export function canonicalArtifactJsonV2(value) {
+    if (value === undefined)
+        return 'null';
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalArtifactJsonV2).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => compareCodeUnits(left, right));
+    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalArtifactJsonV2(entry)}`).join(',')}}`;
+}
+export async function sha256ArtifactDigestV2(value) {
+    const bytes = new TextEncoder().encode(canonicalArtifactJsonV2(value));
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return `sha256:${[...new Uint8Array(digest)]
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('')}`;
+}
+export function resolveArtifactCanonicalization(version, declaredCanonicalization, routes, label = 'Artifact') {
+    const route = routes.find((candidate) => candidate.version === version);
+    const expectedDeclaration = route?.explicit ? route.canonicalization : undefined;
+    if (!route || declaredCanonicalization !== expectedDeclaration) {
+        throw new TypeError(`${label} has an unsupported version or canonicalization.`);
+    }
+    return route.canonicalization;
+}
+export function canonicalArtifactJsonFor(value, canonicalization) {
+    return canonicalization === SORTED_JSON_V1
+        ? canonicalArtifactJson(value)
+        : canonicalArtifactJsonV2(value);
+}
+export function sha256ArtifactDigestFor(value, canonicalization) {
+    return canonicalization === SORTED_JSON_V1
+        ? sha256ArtifactDigest(value)
+        : sha256ArtifactDigestV2(value);
+}

package/frontend/src/lib/analysis/brand-profile-model.js

@@ -2,10 +2,12 @@
 // persistence and downloads; this module owns schema migration, semantic field
 // bounds, import merging, and exact serialized-byte accounting.
 import { normalizeDomain } from "./case-model.js";
+import { normalizeOpaqueReferenceId } from "./opaque-reference-id.js";
 import { normalizePageBaseline } from "./page-baseline.js";
 import { isInformativeFaviconHash } from "./utils.js";
 export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
 export const BRAND_PROFILE_SCHEMA_VERSION = 6;
+export const SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS = Object.freeze([2, 3, 4, 5, BRAND_PROFILE_SCHEMA_VERSION]);
 export const MAX_PROFILES = 100;
 export const MAX_PROFILE_VALUES = 200;
 export const MAX_PROFILE_VALUE_INPUTS = MAX_PROFILE_VALUES * 4;
@@ -24,7 +26,6 @@ export const MAX_DESIRED_POSTURE_RECORDS = 32;
 export const MAX_DESIRED_POSTURE_SUPPRESSIONS = 12;
 export const MAX_DESIRED_POSTURE_OBSERVATIONS = 12;
 export const MAX_DESIRED_POSTURE_CHANGE_WINDOWS = 8;
-const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -68,7 +69,7 @@ function boundedText(value, maximum = MAX_PROFILE_TEXT_LENGTH) {
     return value.slice(0, maximum * 4).replace(/\s+/g, ' ').trim().slice(0, maximum).trim();
 }
 export function normalizeBrandProfileId(value) {
-    return typeof value === 'string' && SAFE_ID_RE.test(value) ? value : null;
+    return normalizeOpaqueReferenceId(value);
 }
 function timestamp(value, fallback) {
     if (typeof value === 'string' && value.length <= 64 && !CONTROL_RE.test(value)) {
@@ -420,17 +421,39 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
     if (importedVersion !== null && importedVersion > BRAND_PROFILE_SCHEMA_VERSION) {
         throw new Error(`This Brand Profile file uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
-    if (![2, 3, 4, 5, BRAND_PROFILE_SCHEMA_VERSION].includes(importedVersion ?? 0)) {
-        throw new Error(`Expected a WHOISleuth Brand Profile export using schema 2, 3, 4, 5, or ${BRAND_PROFILE_SCHEMA_VERSION}.`);
+    if (!SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.includes(importedVersion ?? 0)) {
+        throw new Error(`Expected a WHOISleuth Brand Profile export using schema ${SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.join(', ').replace(/, ([^,]+)$/u, ', or $1')}.`);
+    }
+    const idNames = new Map();
+    const retainIdName = (id, name) => {
+        const nameKey = name.toLowerCase();
+        const previous = idNames.get(id);
+        if (previous !== undefined && previous !== nameKey) {
+            throw new Error('Brand Profile import reuses one exact identifier for different normalised profile names. No profiles were imported.');
+        }
+        idNames.set(id, nameKey);
+    };
+    for (const item of profileList(localRaw).slice(0, MAX_PROFILES * 4)) {
+        const value = record(item);
+        const id = normalizeBrandProfileId(value.id);
+        const name = boundedText(value.name, MAX_PROFILE_NAME_LENGTH);
+        if (id && name)
+            retainIdName(id, name);
     }
     const local = normalizeBrandProfileStore(localRaw).profiles;
+    for (const profile of local)
+        retainIdName(profile.id, profile.name);
     const byName = new Map(local.map((profile) => [profile.name.toLowerCase(), profile]));
     const input = profileList(importedRaw);
     let added = 0;
     let updated = 0;
     let skipped = Math.max(0, input.length - MAX_PROFILES * 4);
     for (const item of input.slice(0, MAX_PROFILES * 4)) {
-        const rawName = boundedText(record(item).name, MAX_PROFILE_NAME_LENGTH);
+        const value = record(item);
+        const rawName = boundedText(value.name, MAX_PROFILE_NAME_LENGTH);
+        const rawId = normalizeBrandProfileId(value.id);
+        if (rawId && rawName)
+            retainIdName(rawId, rawName);
         const existing = rawName ? byName.get(rawName.toLowerCase()) : null;
         const profile = normalizeBrandProfile(item, {
             existing,
@@ -442,6 +465,7 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
             skipped++;
             continue;
         }
+        retainIdName(profile.id, profile.name);
         if (existing) {
             byName.set(profile.name.toLowerCase(), profile);
             updated++;

package/frontend/src/lib/analysis/bulk-domain-comparison.js

@@ -1,8 +1,9 @@
 import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
 import { BULK_REVIEW_STALE_AFTER_DAYS } from "./bulk-retry-plan.js";
 export const BULK_DOMAIN_COMPARISON_SCHEMA = 'whoisleuth.domain-comparison';
 export const BULK_DOMAIN_COMPARISON_VERSION = 3;
+export const BULK_DOMAIN_COMPARISON_EXPORT_VERSION = 4;
 function text(value, maximum = 500) {
     return typeof value === 'string'
         ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
@@ -164,6 +165,23 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
     });
     const compactTls = comparisonEvidenceContext(left, right, 'tls', tls);
     const source = context(left, right, 'Recorded source coverage', [], observedAt, options);
+    const profileContextsComparable = left.profileContext.sourceState === 'ready'
+        && right.profileContext.sourceState === 'ready'
+        && left.profileContext.activeProfileId === right.profileContext.activeProfileId
+        && left.profileContext.profileUpdatedAt === right.profileContext.profileUpdatedAt;
+    const profileContext = {
+        ...http,
+        source: 'Brand Profile comparison context',
+        leftSourceState: profileContextsComparable ? 'complete' : 'unavailable',
+        rightSourceState: profileContextsComparable ? 'complete' : 'unavailable',
+    };
+    const profileLimitations = profileContextsComparable
+        ? []
+        : [
+            left.profileContext.limitation,
+            right.profileContext.limitation,
+            'Official-asset comparison is withheld unless both rows retain the same ready Brand Profile provenance.',
+        ].filter(Boolean);
     const registrationConflicting = [left.availability, right.availability]
         .some((value) => ['conflict', 'conflicting'].includes(value.toLowerCase()));
     const rows = [
@@ -192,7 +210,7 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalised exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
         row('password-field', 'identity', 'Password field', left.hasPasswordField, right.hasPasswordField, 'Bounded static form observation', http),
         row('phishing-language', 'identity', 'Phishing-language indicator', left.phishingLanguageMatch, right.phishingLanguageMatch, 'Bounded explainable page-language signal', http, ['A wording match is a review lead, not proof of malicious intent.']),
-        row('official-assets', 'identity', 'Official asset reuse', left.reusesOfficialAssets, right.reusesOfficialAssets, 'Configured Brand Profile comparison', http),
+        row('official-assets', 'identity', 'Official asset reuse', profileContextsComparable ? left.reusesOfficialAssets : null, profileContextsComparable ? right.reusesOfficialAssets : null, 'Configured Brand Profile comparison', profileContext, profileLimitations),
         row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalised exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
         row('source-health', 'source', 'Recorded source coverage', sourceSummary(left), sourceSummary(right), 'Source-by-source compact state comparison', source, ['A source-state difference can reflect collection conditions rather than a domain change.']),
     ];
@@ -219,11 +237,13 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
                 'This compares normalised evidence already present in two saved observations for the same domain and makes no new request.',
                 'Missing, unavailable, and differently collected evidence remain distinct from an observed difference.',
                 'An observed difference can reflect changed collection conditions and does not by itself establish current state, ownership, intent, safety, or maliciousness.',
+                ...(!profileContextsComparable ? ['Profile-derived identity comparison is unavailable because the saved Brand Profile contexts are not ready and identical.'] : []),
             ]
             : [
                 'This compares compact settled evidence already present in Bulk and makes no new request.',
                 'Missing, unavailable, and differently collected evidence remain distinct from an observed difference.',
                 'Equality does not establish common ownership, infrastructure control, intent, safety, or maliciousness.',
+                ...(!profileContextsComparable ? ['Profile-derived identity comparison is unavailable because the saved Brand Profile contexts are not ready and identical.'] : []),
             ],
     };
 }
@@ -235,14 +255,14 @@ export async function buildBulkDomainComparisonExport(comparisonRaw, generatedAt
     const generatedAt = timestamp(generatedAtRaw) || new Date().toISOString();
     const unsigned = {
         schema: BULK_DOMAIN_COMPARISON_SCHEMA,
-        version: BULK_DOMAIN_COMPARISON_VERSION,
+        version: BULK_DOMAIN_COMPARISON_EXPORT_VERSION,
         generatedAt,
         comparison,
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/frontend/src/lib/analysis/bulk-mail-exposure.js

@@ -1,7 +1,8 @@
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
+import { BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION, normalizeBulkProfileContext, normalizeBulkSessionResult, } from "./bulk-session-model.js";
 export const BULK_MAIL_EXPOSURE_SCHEMA = 'whoisleuth.bulk-mail-exposure';
 export const BULK_MAIL_EXPOSURE_VERSION = 1;
+export const BULK_MAIL_EXPOSURE_EXPORT_VERSION = 2;
 export const MAX_BULK_MAIL_EXPOSURE_ROWS = 2_000;
 const STATE_LABELS = {
     authenticated_mail: 'Receiving mail with SPF and DMARC',
@@ -16,7 +17,11 @@ function timestamp(value) {
         return null;
     return new Date(value).toISOString();
 }
-function baselineLabel(profile) {
+function baselineLabel(profile, profileSourceState) {
+    if (profileSourceState === 'loading')
+        return 'Brand Profile context loading';
+    if (profileSourceState === 'unavailable')
+        return 'Brand Profile context unavailable';
     if (profile === 'defensive_no_mail')
         return 'Configured no-mail baseline';
     if (profile === 'parked')
@@ -64,7 +69,21 @@ function stateDetail(state) {
     }
     return 'The compact scan did not retain enough settled DNS evidence to classify mail exposure.';
 }
-function relation(state, profile) {
+function relation(state, profile, profileSourceState, profileContextComparable, profileContextLimitation) {
+    if (profileSourceState !== 'ready') {
+        return {
+            baselineRelation: 'inconclusive',
+            baselineDetail: profileSourceState === 'loading'
+                ? 'Brand Profile context is still loading, so no profile-derived mail comparison is available.'
+                : 'Brand Profile context could not be read, so no profile-derived mail comparison is available.',
+        };
+    }
+    if (!profileContextComparable) {
+        return {
+            baselineRelation: 'inconclusive',
+            baselineDetail: profileContextLimitation || BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION,
+        };
+    }
     if (!profile || state === 'evidence_incomplete' || state === 'mail_auth_incomplete') {
         return {
             baselineRelation: 'inconclusive',
@@ -102,8 +121,16 @@ function relation(state, profile) {
         baselineDetail: 'The parked-domain profile is context rather than a claim about the expected candidate mail posture.',
     };
 }
-function rowLimitations(row, state) {
+function rowLimitations(row, state, profileSourceState, profileContextComparable, profileContextLimitation) {
     const output = [];
+    if (profileSourceState !== 'ready') {
+        output.push(profileSourceState === 'loading'
+            ? 'Brand Profile context was still loading; official-domain mail posture was not evaluated.'
+            : 'Brand Profile context was unavailable; official-domain mail posture was not evaluated.');
+    }
+    if (profileSourceState === 'ready' && !profileContextComparable) {
+        output.push(profileContextLimitation || BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION);
+    }
     const coverage = dnsCoverage(row);
     if (!coverage)
         output.push('DNS source coverage was not recorded for this compact result.');
@@ -115,30 +142,48 @@ function rowLimitations(row, state) {
         output.push('No explicit MX is not equivalent to a null MX or proof that the domain cannot receive mail.');
     }
     output.push('Mail configuration alone does not establish use, intent, control, safety, or maliciousness.');
-    return output.slice(0, 5);
+    return output.slice(0, 6);
 }
 export function buildBulkMailExposureReport(rowsRaw, options = {}) {
     const generatedAt = timestamp(options.generatedAt) ?? new Date().toISOString();
-    const officialDomains = [...new Set((options.officialDomains ?? [])
+    const profileSourceState = options.profileSourceState ?? 'ready';
+    const currentProfileContext = normalizeBulkProfileContext(options.currentProfileContext ?? (profileSourceState === 'ready'
+        ? { sourceState: 'ready', activeProfileId: null, profileUpdatedAt: null, limitation: '' }
+        : { sourceState: 'unavailable' }));
+    const profile = profileSourceState === 'ready' ? options.profile ?? null : null;
+    const officialDomains = [...new Set((profileSourceState === 'ready' ? options.officialDomains ?? [] : [])
             .map((domain) => domain.trim().toLowerCase().replace(/\.$/u, ''))
             .filter(Boolean))].slice(0, 20);
+    let profileContextUnevaluatedCount = 0;
     const rows = rowsRaw
-        .map(normalizeBulkSessionResult)
+        .map((row) => normalizeBulkSessionResult(row))
         .filter((row) => Boolean(row))
         .filter((row) => row.trusted === null)
         .slice(0, MAX_BULK_MAIL_EXPOSURE_ROWS)
         .map((item) => {
         const state = exposureState(item);
+        const profileContextComparable = profileSourceState === 'ready'
+            && currentProfileContext.sourceState === 'ready'
+            && item.profileContext.sourceState === 'ready'
+            && item.profileContext.activeProfileId === currentProfileContext.activeProfileId
+            && item.profileContext.profileUpdatedAt === currentProfileContext.profileUpdatedAt;
+        const profileContextLimitation = profileContextComparable
+            ? item.profileContext.limitation
+            : item.profileContext.limitation || BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION;
+        if (!profileContextComparable)
+            profileContextUnevaluatedCount += 1;
         return {
             domain: item.domain,
             state,
             label: STATE_LABELS[state],
             detail: stateDetail(state),
-            ...relation(state, options.profile ?? null),
+            ...relation(state, profile, profileSourceState, profileContextComparable, profileContextLimitation),
             mutationTypes: item.mutationTypes.slice(0, 40),
             registration: item.availability,
             sourceCoverage: item.sourceCoverage.slice(0, 12),
-            limitations: rowLimitations(item, state),
+            profileContextState: item.profileContext.sourceState,
+            profileContextLimitation,
+            limitations: rowLimitations(item, state, profileSourceState, profileContextComparable, profileContextLimitation),
         };
     });
     const counts = {
@@ -156,16 +201,22 @@ export function buildBulkMailExposureReport(rowsRaw, options = {}) {
         generatedAt,
         observedAt: timestamp(options.observedAt),
         baseline: {
-            profile: options.profile ?? null,
+            profile,
             officialDomains,
-            label: baselineLabel(options.profile ?? null),
+            label: baselineLabel(profile, profileSourceState),
             limitations: [
+                ...(profileSourceState === 'loading'
+                    ? ['Brand Profile context was loading, so profile-derived mail posture is inconclusive.']
+                    : profileSourceState === 'unavailable'
+                        ? ['Brand Profile context was unavailable, so profile-derived mail posture is inconclusive.']
+                        : []),
                 'The Brand Profile describes an analyst-configured official-domain posture; it is not a live observation.',
                 'Candidate similarity and mail configuration do not establish use, control, intent, safety, or maliciousness.',
             ],
         },
         rows,
         counts,
+        profileContextUnevaluatedCount,
         limitations: [
             'This review uses compact Bulk evidence already collected and makes no additional request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
@@ -176,13 +227,13 @@ export function buildBulkMailExposureReport(rowsRaw, options = {}) {
 export async function buildBulkMailExposureExport(report) {
     const unsigned = {
         schema: BULK_MAIL_EXPOSURE_SCHEMA,
-        version: BULK_MAIL_EXPOSURE_VERSION,
+        version: BULK_MAIL_EXPOSURE_EXPORT_VERSION,
         report,
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/frontend/src/lib/analysis/bulk-retry-plan.js

@@ -30,7 +30,7 @@ function retryRow(value, isStale) {
 export function buildBulkRetryPlan(values, mode, observedAtRaw = null, now = Date.now()) {
     const observationFreshness = freshness(observedAtRaw, now);
     const candidates = values
-        .map(normalizeBulkSessionResult)
+        .map((row) => normalizeBulkSessionResult(row))
         .filter((value) => Boolean(value))
         .map((value) => retryRow(value, observationFreshness.state === 'stale'))
         .filter((value) => Boolean(value));

package/frontend/src/lib/analysis/bulk-review-export.js

@@ -1,8 +1,8 @@
 import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
 import { BULK_REVIEW_STATES, } from "./bulk-review-model.js";
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "./artifact-integrity.js";
 export const BULK_REVIEW_MANIFEST_SCHEMA = 'whoisleuth.bulk-review-manifest';
-export const BULK_REVIEW_MANIFEST_VERSION = 1;
+export const BULK_REVIEW_MANIFEST_VERSION = 2;
 const MAX_MANIFEST_ROWS = 2_000;
 const REVIEW_STATE_SET = new Set(BULK_REVIEW_STATES);
 function timestamp(value, fallback) {
@@ -21,7 +21,7 @@ export async function buildBulkReviewManifest(input) {
     const observedAt = timestamp(input.observedAt, generatedAt);
     const states = reviewStateMap(input.reviewStates);
     const rows = input.rows
-        .map(normalizeBulkSessionResult)
+        .map((row) => normalizeBulkSessionResult(row))
         .filter((item) => Boolean(item))
         .slice(0, MAX_MANIFEST_ROWS)
         .map((item) => ({
@@ -30,6 +30,7 @@ export async function buildBulkReviewManifest(input) {
         resultState: item.status,
         scanDepth: item.scanDepth,
         sourceCoverage: item.sourceCoverage,
+        profileContext: { ...item.profileContext },
     }));
     const unsigned = {
         schema: BULK_REVIEW_MANIFEST_SCHEMA,
@@ -45,14 +46,14 @@ export async function buildBulkReviewManifest(input) {
         rows,
         limitations: [
             'This manifest records the explicit review selection and view context for a separate CSV export.',
-            'It contains compact source states only and excludes raw payloads, contact records, notes, and transient request state.',
+            'It contains compact source states and bounded row-level Brand Profile provenance only, and excludes raw payloads, Profile contents, contact records, notes, and transient request state.',
             'Reproducing the filters does not reproduce upstream responses or imply that evidence remains current.',
         ],
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/frontend/src/lib/analysis/bulk-review-model.js

@@ -1,4 +1,5 @@
 import { normalizeDomain } from "./case-model.js";
+import { normalizeBulkPresentationSortKey } from "./bulk-sort.js";
 export const BULK_REVIEW_SCHEMA = 'whoisleuth.bulk-review';
 export const BULK_REVIEW_SCHEMA_VERSION = 1;
 export const MAX_BULK_REVIEW_PRESETS = 24;
@@ -8,7 +9,7 @@ export const MAX_BULK_REVIEW_NAME_LENGTH = 80;
 export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
-const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'errors']);
+const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'profile_unevaluated', 'errors']);
 const SOURCE_FILTERS = new Set(['', 'complete', 'limited', 'failed']);
 const LIFECYCLE_FILTERS = new Set(['', 'new', 'expiring', 'aged', 'unknown']);
 const AGE_FILTERS = new Set(['', '7d', '30d', '90d', '365d', 'older', 'unknown']);
@@ -50,7 +51,7 @@ function normalizeView(raw) {
         ? [...new Set(value.signalFilters.filter((item) => typeof item === 'string' && SIGNAL_FILTERS.has(item)))].slice(0, SIGNAL_FILTERS.size)
         : [];
     const sortKey = typeof value.sortKey === 'string' && SORT_KEYS.has(value.sortKey)
-        ? value.sortKey
+        ? normalizeBulkPresentationSortKey(value.sortKey)
         : 'risk';
     return {
         primaryFilter: setValue(value.primaryFilter, PRIMARY_FILTERS, 'all'),