@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/{frontend/src/lib/analysis/bulk-domain-comparison.js → packages/investigation/bulk-domain-comparison.mjs}

@@ -1,8 +1,8 @@
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
-import { BULK_REVIEW_STALE_AFTER_DAYS } from "./bulk-retry-plan.js";
-export const BULK_DOMAIN_COMPARISON_SCHEMA = 'whoisleuth.domain-comparison';
-export const BULK_DOMAIN_COMPARISON_VERSION = 3;
+import { normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { BULK_REVIEW_STALE_AFTER_DAYS } from "./bulk-review-policy.mjs";
+import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_VERSION, } from "../contracts/investigation-portability.mjs";
+export { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_VERSION };
 function text(value, maximum = 500) {
     return typeof value === 'string'
         ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
@@ -164,6 +164,23 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
     });
     const compactTls = comparisonEvidenceContext(left, right, 'tls', tls);
     const source = context(left, right, 'Recorded source coverage', [], observedAt, options);
+    const profileContextsComparable = left.profileContext.sourceState === 'ready'
+        && right.profileContext.sourceState === 'ready'
+        && left.profileContext.activeProfileId === right.profileContext.activeProfileId
+        && left.profileContext.profileUpdatedAt === right.profileContext.profileUpdatedAt;
+    const profileContext = {
+        ...http,
+        source: 'Brand Profile comparison context',
+        leftSourceState: profileContextsComparable ? 'complete' : 'unavailable',
+        rightSourceState: profileContextsComparable ? 'complete' : 'unavailable',
+    };
+    const profileLimitations = profileContextsComparable
+        ? []
+        : [
+            left.profileContext.limitation,
+            right.profileContext.limitation,
+            'Official-asset comparison is withheld unless both rows retain the same ready Brand Profile provenance.',
+        ].filter(Boolean);
     const registrationConflicting = [left.availability, right.availability]
         .some((value) => ['conflict', 'conflicting'].includes(value.toLowerCase()));
     const rows = [
@@ -192,7 +209,7 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
         row('tracking', 'identity', 'Tracking identifiers', left.relationship.trackingIdentifiers, right.relationship.trackingIdentifiers, 'Normalised exact set comparison', http, ['Shared identifiers are an investigative lead, not proof of ownership.']),
         row('password-field', 'identity', 'Password field', left.hasPasswordField, right.hasPasswordField, 'Bounded static form observation', http),
         row('phishing-language', 'identity', 'Phishing-language indicator', left.phishingLanguageMatch, right.phishingLanguageMatch, 'Bounded explainable page-language signal', http, ['A wording match is a review lead, not proof of malicious intent.']),
-        row('official-assets', 'identity', 'Official asset reuse', left.reusesOfficialAssets, right.reusesOfficialAssets, 'Configured Brand Profile comparison', http),
+        row('official-assets', 'identity', 'Official asset reuse', profileContextsComparable ? left.reusesOfficialAssets : null, profileContextsComparable ? right.reusesOfficialAssets : null, 'Configured Brand Profile comparison', profileContext, profileLimitations),
         row('technology', 'technology', 'Technology identifiers', left.comparisonEvidence?.technology.ids ?? [], right.comparisonEvidence?.technology.ids ?? [], 'Normalised exact set comparison of at most 12 curated identifiers', compactTechnology, ['An unmatched identifier is not evidence that a technology is absent. Shared technologies do not establish common ownership or control.']),
         row('source-health', 'source', 'Recorded source coverage', sourceSummary(left), sourceSummary(right), 'Source-by-source compact state comparison', source, ['A source-state difference can reflect collection conditions rather than a domain change.']),
     ];
@@ -219,11 +236,13 @@ export function buildBulkDomainComparison(leftRaw, rightRaw, observedAtRaw = nul
                 'This compares normalised evidence already present in two saved observations for the same domain and makes no new request.',
                 'Missing, unavailable, and differently collected evidence remain distinct from an observed difference.',
                 'An observed difference can reflect changed collection conditions and does not by itself establish current state, ownership, intent, safety, or maliciousness.',
+                ...(!profileContextsComparable ? ['Profile-derived identity comparison is unavailable because the saved Brand Profile contexts are not ready and identical.'] : []),
             ]
             : [
                 'This compares compact settled evidence already present in Bulk and makes no new request.',
                 'Missing, unavailable, and differently collected evidence remain distinct from an observed difference.',
                 'Equality does not establish common ownership, infrastructure control, intent, safety, or maliciousness.',
+                ...(!profileContextsComparable ? ['Profile-derived identity comparison is unavailable because the saved Brand Profile contexts are not ready and identical.'] : []),
             ],
     };
 }
@@ -235,14 +254,14 @@ export async function buildBulkDomainComparisonExport(comparisonRaw, generatedAt
     const generatedAt = timestamp(generatedAtRaw) || new Date().toISOString();
     const unsigned = {
         schema: BULK_DOMAIN_COMPARISON_SCHEMA,
-        version: BULK_DOMAIN_COMPARISON_VERSION,
+        version: BULK_DOMAIN_COMPARISON_EXPORT_VERSION,
         generatedAt,
         comparison,
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/{frontend/src/lib/analysis/bulk-mail-exposure.js → packages/investigation/bulk-mail-exposure.mjs}

@@ -1,8 +1,7 @@
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-export const BULK_MAIL_EXPOSURE_SCHEMA = 'whoisleuth.bulk-mail-exposure';
-export const BULK_MAIL_EXPOSURE_VERSION = 1;
-export const MAX_BULK_MAIL_EXPOSURE_ROWS = 2_000;
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION, normalizeBulkProfileContext, normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
+import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, BULK_MAIL_EXPOSURE_VERSION, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../contracts/investigation-portability.mjs";
+export { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, BULK_MAIL_EXPOSURE_VERSION, MAX_BULK_MAIL_EXPOSURE_ROWS };
 const STATE_LABELS = {
     authenticated_mail: 'Receiving mail with SPF and DMARC',
     evidence_incomplete: 'Mail evidence incomplete',
@@ -16,7 +15,11 @@ function timestamp(value) {
         return null;
     return new Date(value).toISOString();
 }
-function baselineLabel(profile) {
+function baselineLabel(profile, profileSourceState) {
+    if (profileSourceState === 'loading')
+        return 'Brand Profile context loading';
+    if (profileSourceState === 'unavailable')
+        return 'Brand Profile context unavailable';
     if (profile === 'defensive_no_mail')
         return 'Configured no-mail baseline';
     if (profile === 'parked')
@@ -64,7 +67,21 @@ function stateDetail(state) {
     }
     return 'The compact scan did not retain enough settled DNS evidence to classify mail exposure.';
 }
-function relation(state, profile) {
+function relation(state, profile, profileSourceState, profileContextComparable, profileContextLimitation) {
+    if (profileSourceState !== 'ready') {
+        return {
+            baselineRelation: 'inconclusive',
+            baselineDetail: profileSourceState === 'loading'
+                ? 'Brand Profile context is still loading, so no profile-derived mail comparison is available.'
+                : 'Brand Profile context could not be read, so no profile-derived mail comparison is available.',
+        };
+    }
+    if (!profileContextComparable) {
+        return {
+            baselineRelation: 'inconclusive',
+            baselineDetail: profileContextLimitation || BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION,
+        };
+    }
     if (!profile || state === 'evidence_incomplete' || state === 'mail_auth_incomplete') {
         return {
             baselineRelation: 'inconclusive',
@@ -102,8 +119,16 @@ function relation(state, profile) {
         baselineDetail: 'The parked-domain profile is context rather than a claim about the expected candidate mail posture.',
     };
 }
-function rowLimitations(row, state) {
+function rowLimitations(row, state, profileSourceState, profileContextComparable, profileContextLimitation) {
     const output = [];
+    if (profileSourceState !== 'ready') {
+        output.push(profileSourceState === 'loading'
+            ? 'Brand Profile context was still loading; official-domain mail posture was not evaluated.'
+            : 'Brand Profile context was unavailable; official-domain mail posture was not evaluated.');
+    }
+    if (profileSourceState === 'ready' && !profileContextComparable) {
+        output.push(profileContextLimitation || BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION);
+    }
     const coverage = dnsCoverage(row);
     if (!coverage)
         output.push('DNS source coverage was not recorded for this compact result.');
@@ -115,30 +140,48 @@ function rowLimitations(row, state) {
         output.push('No explicit MX is not equivalent to a null MX or proof that the domain cannot receive mail.');
     }
     output.push('Mail configuration alone does not establish use, intent, control, safety, or maliciousness.');
-    return output.slice(0, 5);
+    return output.slice(0, 6);
 }
 export function buildBulkMailExposureReport(rowsRaw, options = {}) {
     const generatedAt = timestamp(options.generatedAt) ?? new Date().toISOString();
-    const officialDomains = [...new Set((options.officialDomains ?? [])
+    const profileSourceState = options.profileSourceState ?? 'ready';
+    const currentProfileContext = normalizeBulkProfileContext(options.currentProfileContext ?? (profileSourceState === 'ready'
+        ? { sourceState: 'ready', activeProfileId: null, profileUpdatedAt: null, limitation: '' }
+        : { sourceState: 'unavailable' }));
+    const profile = profileSourceState === 'ready' ? options.profile ?? null : null;
+    const officialDomains = [...new Set((profileSourceState === 'ready' ? options.officialDomains ?? [] : [])
             .map((domain) => domain.trim().toLowerCase().replace(/\.$/u, ''))
             .filter(Boolean))].slice(0, 20);
+    let profileContextUnevaluatedCount = 0;
     const rows = rowsRaw
-        .map(normalizeBulkSessionResult)
+        .map((row) => normalizeBulkSessionResult(row))
         .filter((row) => Boolean(row))
         .filter((row) => row.trusted === null)
         .slice(0, MAX_BULK_MAIL_EXPOSURE_ROWS)
         .map((item) => {
         const state = exposureState(item);
+        const profileContextComparable = profileSourceState === 'ready'
+            && currentProfileContext.sourceState === 'ready'
+            && item.profileContext.sourceState === 'ready'
+            && item.profileContext.activeProfileId === currentProfileContext.activeProfileId
+            && item.profileContext.profileUpdatedAt === currentProfileContext.profileUpdatedAt;
+        const profileContextLimitation = profileContextComparable
+            ? item.profileContext.limitation
+            : item.profileContext.limitation || BULK_PROFILE_CONTEXT_MISMATCH_LIMITATION;
+        if (!profileContextComparable)
+            profileContextUnevaluatedCount += 1;
         return {
             domain: item.domain,
             state,
             label: STATE_LABELS[state],
             detail: stateDetail(state),
-            ...relation(state, options.profile ?? null),
+            ...relation(state, profile, profileSourceState, profileContextComparable, profileContextLimitation),
             mutationTypes: item.mutationTypes.slice(0, 40),
             registration: item.availability,
             sourceCoverage: item.sourceCoverage.slice(0, 12),
-            limitations: rowLimitations(item, state),
+            profileContextState: item.profileContext.sourceState,
+            profileContextLimitation,
+            limitations: rowLimitations(item, state, profileSourceState, profileContextComparable, profileContextLimitation),
         };
     });
     const counts = {
@@ -156,16 +199,22 @@ export function buildBulkMailExposureReport(rowsRaw, options = {}) {
         generatedAt,
         observedAt: timestamp(options.observedAt),
         baseline: {
-            profile: options.profile ?? null,
+            profile,
             officialDomains,
-            label: baselineLabel(options.profile ?? null),
+            label: baselineLabel(profile, profileSourceState),
             limitations: [
+                ...(profileSourceState === 'loading'
+                    ? ['Brand Profile context was loading, so profile-derived mail posture is inconclusive.']
+                    : profileSourceState === 'unavailable'
+                        ? ['Brand Profile context was unavailable, so profile-derived mail posture is inconclusive.']
+                        : []),
                 'The Brand Profile describes an analyst-configured official-domain posture; it is not a live observation.',
                 'Candidate similarity and mail configuration do not establish use, control, intent, safety, or maliciousness.',
             ],
         },
         rows,
         counts,
+        profileContextUnevaluatedCount,
         limitations: [
             'This review uses compact Bulk evidence already collected and makes no additional request.',
             'Null MX, no explicit MX, receiving mail, authentication gaps, and incomplete evidence remain separate states.',
@@ -176,13 +225,13 @@ export function buildBulkMailExposureReport(rowsRaw, options = {}) {
 export async function buildBulkMailExposureExport(report) {
     const unsigned = {
         schema: BULK_MAIL_EXPOSURE_SCHEMA,
-        version: BULK_MAIL_EXPOSURE_VERSION,
+        version: BULK_MAIL_EXPOSURE_EXPORT_VERSION,
         report,
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/{frontend/src/lib/analysis/bulk-review-export.js → packages/investigation/bulk-review-export.mjs}

@@ -1,8 +1,8 @@
-import { normalizeBulkSessionResult, } from "./bulk-session-model.js";
-import { BULK_REVIEW_STATES, } from "./bulk-review-model.js";
-import { sha256ArtifactDigest } from "./artifact-integrity.js";
-export const BULK_REVIEW_MANIFEST_SCHEMA = 'whoisleuth.bulk-review-manifest';
-export const BULK_REVIEW_MANIFEST_VERSION = 1;
+import { normalizeBulkSessionResult, } from "../workspace/bulk-session-model.mjs";
+import { BULK_REVIEW_STATES, } from "../workspace/bulk-review-model.mjs";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
+import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, } from "../contracts/investigation-portability.mjs";
+export { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION };
 const MAX_MANIFEST_ROWS = 2_000;
 const REVIEW_STATE_SET = new Set(BULK_REVIEW_STATES);
 function timestamp(value, fallback) {
@@ -21,7 +21,7 @@ export async function buildBulkReviewManifest(input) {
     const observedAt = timestamp(input.observedAt, generatedAt);
     const states = reviewStateMap(input.reviewStates);
     const rows = input.rows
-        .map(normalizeBulkSessionResult)
+        .map((row) => normalizeBulkSessionResult(row))
         .filter((item) => Boolean(item))
         .slice(0, MAX_MANIFEST_ROWS)
         .map((item) => ({
@@ -30,6 +30,7 @@ export async function buildBulkReviewManifest(input) {
         resultState: item.status,
         scanDepth: item.scanDepth,
         sourceCoverage: item.sourceCoverage,
+        profileContext: { ...item.profileContext },
     }));
     const unsigned = {
         schema: BULK_REVIEW_MANIFEST_SCHEMA,
@@ -45,14 +46,14 @@ export async function buildBulkReviewManifest(input) {
         rows,
         limitations: [
             'This manifest records the explicit review selection and view context for a separate CSV export.',
-            'It contains compact source states only and excludes raw payloads, contact records, notes, and transient request state.',
+            'It contains compact source states and bounded row-level Brand Profile provenance only, and excludes raw payloads, Profile contents, contact records, notes, and transient request state.',
             'Reproducing the filters does not reproduce upstream responses or imply that evidence remains current.',
         ],
     };
-    const digestSha256 = await sha256ArtifactDigest(unsigned);
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
     const document = {
         ...unsigned,
-        integrity: { algorithm: 'SHA-256', digestSha256 },
+        integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 },
     };
     return {
         document,

package/packages/investigation/bulk-review-policy.mjs

@@ -0,0 +1 @@
+export const BULK_REVIEW_STALE_AFTER_DAYS = 7;

package/{frontend/src/lib/analysis/investigation-capsule.js → packages/investigation/investigation-capsule.mjs}

@@ -1,6 +1,8 @@
-import { canonicalArtifactJson, sha256ArtifactDigest } from "./artifact-integrity.js";
-export const INVESTIGATION_CAPSULE_SCHEMA = 'whoisleuth.investigation-capsule';
-export const INVESTIGATION_CAPSULE_VERSION = 1;
+import { canonicalArtifactJsonV2, sha256ArtifactDigestV2, SORTED_JSON_V2, } from "../evidence/artifact-integrity.mjs";
+import { LOOKUP_ASSET_GRAPH_SCHEMA, } from "./lookup-asset-graph.mjs";
+import { LOOKUP_INVESTIGATION_BRIEF_SCHEMA, LOOKUP_INVESTIGATION_BRIEF_VERSION, } from "./lookup-investigation-brief.mjs";
+import { INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, PUBLIC_INVESTIGATION_CAPSULE_VERSION, SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS, } from "../contracts/investigation-portability.mjs";
+export { INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, INVESTIGATION_CAPSULE_SCHEMA, INVESTIGATION_CAPSULE_VERSION, PUBLIC_INVESTIGATION_CAPSULE_VERSION, SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS, };
 function safeVersion(value) {
     return typeof value === 'string' && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(value)
         ? value
@@ -46,14 +48,14 @@ function analystProjection(record) {
 export async function buildInvestigationCapsule(input) {
     const analystRecords = input.includeAnalystRecords ? analystProjection(input.caseRecord) : null;
     const [evidenceDigest, briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        sha256ArtifactDigest(input.lookupEvidence),
-        sha256ArtifactDigest(input.brief),
-        sha256ArtifactDigest(input.graph),
-        analystRecords ? sha256ArtifactDigest(analystRecords) : Promise.resolve(null),
+        sha256ArtifactDigestV2(input.lookupEvidence),
+        sha256ArtifactDigestV2(input.brief),
+        sha256ArtifactDigestV2(input.graph),
+        analystRecords ? sha256ArtifactDigestV2(analystRecords) : Promise.resolve(null),
     ]);
     const evidenceSchema = safeSchema(input.lookupEvidence.schema);
     const evidenceVersion = safeSchemaVersion(input.lookupEvidence.schemaVersion);
-    return {
+    const unsigned = {
         schema: INVESTIGATION_CAPSULE_SCHEMA,
         schemaVersion: INVESTIGATION_CAPSULE_VERSION,
         generatedAt: iso(input.generatedAt),
@@ -61,31 +63,56 @@ export async function buildInvestigationCapsule(input) {
         target: { value: input.brief.target, type: input.brief.targetType },
         sourceContracts: [
             { id: 'lookup-evidence', schema: evidenceSchema, version: evidenceVersion, digest: evidenceDigest, embedded: false },
-            { id: 'investigation-brief', schema: input.brief.schema, version: input.brief.schemaVersion, digest: briefDigest, embedded: true },
-            { id: 'asset-graph', schema: 'whoisleuth.lookup-asset-graph', version: input.graph.version, digest: graphDigest, embedded: true },
+            { id: 'investigation-brief', schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version: LOOKUP_INVESTIGATION_BRIEF_VERSION, digest: briefDigest, embedded: true },
+            { id: 'asset-graph', schema: LOOKUP_ASSET_GRAPH_SCHEMA, version: input.graph.version, digest: graphDigest, embedded: true },
             ...(analystRecords && analystRecordsDigest
-                ? [{ id: 'analyst-records', schema: 'whoisleuth.case-analyst-records', version: 1, digest: analystRecordsDigest, embedded: true }]
+                ? [{
+                        id: 'analyst-records',
+                        schema: INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA,
+                        version: INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION,
+                        digest: analystRecordsDigest,
+                        embedded: true,
+                    }]
                 : []),
         ],
         investigationBrief: input.brief,
         graphSnapshot: input.graph,
         analystRecords,
-        integrity: { algorithm: 'SHA-256', briefDigest, graphDigest, analystRecordsDigest },
         limitations: [
             'The Lookup evidence file is linked by digest but is not embedded; keep or share that exact file separately when verification is required.',
             'Digest verification can detect changed content but does not establish who created the capsule. No digital signature is applied.',
-            'The graph and brief are bounded projections of collected and derived evidence, not attribution, ownership, safety, availability, or maliciousness conclusions.',
+            'The graph and canonical Decision Fact brief are bounded projections of collected and derived evidence, not attribution, ownership, safety, availability, or maliciousness conclusions.',
             analystRecords
                 ? 'Analyst decisions and assertions were deliberately included; review them for sensitive or personal information before sharing.'
                 : 'Analyst decisions, assertions, notes, contacts, actions, and raw source payloads are excluded.',
         ],
     };
+    return {
+        ...unsigned,
+        integrity: {
+            algorithm: 'SHA-256',
+            canonicalization: SORTED_JSON_V2,
+            scope: 'capsule excluding integrity',
+            briefDigest,
+            graphDigest,
+            analystRecordsDigest,
+            digestSha256: await sha256ArtifactDigestV2(unsigned),
+        },
+    };
 }
 export async function verifyInvestigationCapsule(capsule) {
+    const current = capsule.schemaVersion === INVESTIGATION_CAPSULE_VERSION;
+    const publicVersion = capsule.schemaVersion === PUBLIC_INVESTIGATION_CAPSULE_VERSION;
+    const integrityRecord = capsule.integrity;
+    if ((!current && !publicVersion)
+        || integrityRecord.canonicalization !== SORTED_JSON_V2
+        || integrityRecord.scope !== 'capsule excluding integrity') {
+        return { valid: false, brief: false, graph: false, analystRecords: null, whole: false };
+    }
     const [briefDigest, graphDigest, analystRecordsDigest] = await Promise.all([
-        sha256ArtifactDigest(capsule.investigationBrief),
-        sha256ArtifactDigest(capsule.graphSnapshot),
-        capsule.analystRecords ? sha256ArtifactDigest(capsule.analystRecords) : Promise.resolve(null),
+        sha256ArtifactDigestV2(capsule.investigationBrief),
+        sha256ArtifactDigestV2(capsule.graphSnapshot),
+        capsule.analystRecords ? sha256ArtifactDigestV2(capsule.analystRecords) : Promise.resolve(null),
     ]);
     const brief = briefDigest === capsule.integrity.briefDigest;
     const graph = graphDigest === capsule.integrity.graphDigest;
@@ -94,12 +121,17 @@ export async function verifyInvestigationCapsule(capsule) {
         : capsule.integrity.analystRecordsDigest === null
             ? null
             : false;
-    return { valid: brief && graph && analystRecords !== false, brief, graph, analystRecords };
+    const { integrity: _integrity, ...unsigned } = capsule;
+    const whole = integrityRecord.algorithm === 'SHA-256'
+        && integrityRecord.canonicalization === SORTED_JSON_V2
+        && integrityRecord.scope === 'capsule excluding integrity'
+        && integrityRecord.digestSha256 === await sha256ArtifactDigestV2(unsigned);
+    return { valid: brief && graph && analystRecords !== false && whole, brief, graph, analystRecords, whole };
 }
 export function investigationCapsuleFilename(capsule) {
     const target = capsule.target.value.toLowerCase().replace(/[^a-z0-9.-]+/gu, '-').replace(/^-|-$/gu, '').slice(0, 80) || 'lookup';
     return `whoisleuth-investigation-capsule-${target}-${capsule.generatedAt.slice(0, 10)}.json`;
 }
 export function serializeInvestigationCapsule(capsule) {
-    return `${canonicalArtifactJson(capsule)}\n`;
+    return `${canonicalArtifactJsonV2(capsule)}\n`;
 }

package/packages/investigation/lookup-artefact-inputs.mjs

@@ -0,0 +1 @@
+export {};

package/{frontend/src/lib/analysis/lookup-asset-graph.js → packages/investigation/lookup-asset-graph.mjs}

@@ -1,3 +1,5 @@
+import { LOOKUP_ASSET_GRAPH_SCHEMA, LOOKUP_ASSET_GRAPH_VERSION, } from "../contracts/investigation-portability.mjs";
+export { LOOKUP_ASSET_GRAPH_SCHEMA, LOOKUP_ASSET_GRAPH_VERSION };
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
 const MAX_NODES = 72;
 const MAX_EDGES = 120;
@@ -158,7 +160,7 @@ export function buildLookupAssetGraph(input) {
     const target = hostname(input.target);
     if (!target) {
         return {
-            version: 2,
+            version: LOOKUP_ASSET_GRAPH_VERSION,
             targetId: '',
             nodes: [],
             edges: [],
@@ -705,7 +707,7 @@ export function buildLookupAssetGraph(input) {
         }
     }
     return {
-        version: 2,
+        version: LOOKUP_ASSET_GRAPH_VERSION,
         targetId,
         nodes: [...nodes.values()],
         edges: [...edges.values()],