@slicedearth/whoisleuth-cli 2.1.0 → 2.3.0

package/packages/cases/case-record-operations.mjs

@@ -1,11 +1,103 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
+import { canonicalRegistrableDomain } from "../../lib/registrable-domain.mjs";
 import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
 import { CASE_SCHEMA_VERSION, MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
+import { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, } from "./case-record-decisions.mjs";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
 import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
 import { normalizeEvidenceHistory, } from "./case-evidence-model.mjs";
 import { appendCaseInvestigationBranch, caseInvestigationBranchReferences, normalizeCaseInvestigationBranches, updateCaseInvestigationBranch, } from "./case-investigation-branch-model.mjs";
+export { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, };
+export const MAX_CASE_OBJECTIVE_LENGTH = 320;
+export const MAX_CASE_INCIDENT_URL_LENGTH = 1_850;
+export const INCIDENT_CONTEXT_STATEMENT_PREFIX = 'Investigate incident URL: ';
+const OBJECTIVE_PREFIX = 'Objective: ';
+const RETENTION_SEPARATOR = ' | URL retained: ';
+function boundedContextText(value, maximum) {
+    return typeof value === 'string'
+        ? value.replace(/[\u0000-\u001f\u007f]/gu, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+export function normalizeCaseObjective(value) {
+    return boundedContextText(value, MAX_CASE_OBJECTIVE_LENGTH);
+}
+export function parseIncidentUrlContext(value) {
+    if (typeof value !== 'string' || !value || value.length > MAX_CASE_INCIDENT_URL_LENGTH)
+        return null;
+    if (/[\u0000-\u001f\u007f]/u.test(value) || value.trim() !== value)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname)
+        return null;
+    const hostname = parsed.hostname.toLowerCase().replace(/\.$/u, '');
+    const registrableDomain = canonicalRegistrableDomain(hostname);
+    if (!registrableDomain)
+        return null;
+    const exactUrl = parsed.toString();
+    if (exactUrl.length > MAX_CASE_INCIDENT_URL_LENGTH)
+        return null;
+    return Object.freeze({
+        exactUrl,
+        hostname,
+        registrableDomain,
+        originUrl: parsed.origin,
+        hasPath: parsed.pathname !== '/',
+        hasQuery: Boolean(parsed.search),
+        hasFragment: Boolean(parsed.hash),
+    });
+}
+export function caseInvestigationContext(record) {
+    if (!record)
+        return null;
+    for (const assertion of [...record.assertions].reverse()) {
+        if (assertion.kind !== 'next_step' || assertion.state !== 'open'
+            || !assertion.statement.startsWith(INCIDENT_CONTEXT_STATEMENT_PREFIX))
+            continue;
+        const incidentUrl = assertion.statement.slice(INCIDENT_CONTEXT_STATEMENT_PREFIX.length);
+        const parsed = parseIncidentUrlContext(incidentUrl);
+        if (!parsed || parsed.registrableDomain !== record.domain)
+            continue;
+        const rationale = assertion.rationale ?? '';
+        const separatorIndex = rationale.lastIndexOf(RETENTION_SEPARATOR);
+        const objective = separatorIndex > OBJECTIVE_PREFIX.length && rationale.startsWith(OBJECTIVE_PREFIX)
+            ? normalizeCaseObjective(rationale.slice(OBJECTIVE_PREFIX.length, separatorIndex))
+            : '';
+        const retention = separatorIndex >= 0 ? rationale.slice(separatorIndex + RETENTION_SEPARATOR.length) : '';
+        if (!objective || (retention !== 'exact' && retention !== 'origin_only'))
+            continue;
+        return Object.freeze({
+            objective,
+            incidentUrl: parsed.exactUrl,
+            urlRetention: retention,
+            assertionId: assertion.id,
+            updatedAt: assertion.updatedAt,
+        });
+    }
+    return null;
+}
+export function caseInvestigationContextAssertion(input) {
+    const objective = normalizeCaseObjective(input.objective);
+    if (!objective)
+        throw new Error('Enter the investigation objective before retaining Incident context.');
+    const parsed = parseIncidentUrlContext(input.incidentUrl);
+    if (!parsed)
+        throw new Error(`Enter one absolute HTTP(S) Incident URL of at most ${MAX_CASE_INCIDENT_URL_LENGTH} characters without credentials.`);
+    const retention = input.retainExactUrl ? 'exact' : 'origin_only';
+    const retainedUrl = input.retainExactUrl ? parsed.exactUrl : parsed.originUrl;
+    return Object.freeze({
+        statement: `${INCIDENT_CONTEXT_STATEMENT_PREFIX}${retainedUrl}`,
+        rationale: `${OBJECTIVE_PREFIX}${objective}${RETENTION_SEPARATOR}${retention}`,
+        retainedUrl,
+        retention,
+    });
+}
 // ---------------------------------------------------------------------------
 // Case normalization
 // ---------------------------------------------------------------------------
@@ -66,7 +158,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     return {
         id: existing ? existing.id : safeId(record.id) || deterministicId(domain),
         domain,
-        status: normalizedStatus === 'resolved'
+        status: caseStatusRequiresClosure(normalizedStatus)
             && closures.records.length === 0 && !closures.preV13HistoryUnavailable
             ? 'reviewing'
             : normalizedStatus,
@@ -124,7 +216,7 @@ export function createCase(input, nowIso) {
     const closures = input.closure !== undefined
         ? appendCaseClosure(normalizeCaseClosureHistory(undefined, now), input.closure, now, observedEffects, actions)
         : normalizeCaseClosureHistory(undefined, now);
-    if (normalizeStatus(input.status) === 'resolved' && input.closure === undefined) {
+    if (caseStatusRequiresClosure(normalizeStatus(input.status)) && input.closure === undefined) {
         throw new Error('Opening a resolved case requires a deliberate closure reason and its linked review context.');
     }
     return {
@@ -266,7 +358,7 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.closure !== undefined) {
         closures = appendCaseClosure(closures, patch.closure, now, observedEffects, actions);
     }
-    if (patch.status === 'resolved' && patch.closure === undefined) {
+    if (caseStatusRequiresClosure(patch.status) && patch.closure === undefined) {
         throw new Error('Resolve this case through the deliberate closure review so the reason and evidence state remain explicit.');
     }
     const record = {
@@ -300,3 +392,148 @@ export function updateCase(cases, id, patch, nowIso) {
     next[index] = record;
     return { cases: next, record };
 }
+/**
+ * Records one reviewed conclusion as a single pure Case mutation. The selected
+ * observations become bounded Case pins before the decision is created, so the
+ * decision cannot point at absent evidence. Counterevidence is retained as a
+ * separate resolved contradiction assertion rather than being hidden inside a
+ * favourable disposition.
+ */
+export function recordCaseConclusion(cases, id, input, nowIso) {
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
+    const disposition = normalizeDisposition(input.disposition);
+    const reviewReasonCode = normalizeReviewReasonCode(input.reviewReasonCode);
+    if (!isReviewedCaseDisposition(disposition)) {
+        throw new Error('Select a reviewed disposition before recording a conclusion.');
+    }
+    if (!reviewReasonCode) {
+        throw new Error('Select the reviewed reason before recording a conclusion.');
+    }
+    if (!Array.isArray(input.evidence) || !input.evidence.length) {
+        throw new Error('Select at least one observed fact for this conclusion.');
+    }
+    const invalidStance = input.evidence.find((item) => (!item || !['supports', 'contradicts', 'unresolved'].includes(item.stance)));
+    if (invalidStance)
+        throw new Error('A conclusion evidence relationship is invalid.');
+    if (!input.evidence.some((item) => item.stance === 'supports')) {
+        throw new Error('A conclusion requires at least one observed fact that supports it. Record only contradictory or unresolved material as an assertion instead.');
+    }
+    const current = cases.find((item) => item.id === id);
+    if (!current)
+        throw new Error('That case no longer exists.');
+    const existingPinIds = new Set(current.evidencePins.map((pin) => pin.id));
+    const withPins = updateCase(cases, id, {
+        evidencePins: input.evidence.map((item) => item.pin),
+    }, now);
+    const addedPins = withPins.record.evidencePins.filter((pin) => !existingPinIds.has(pin.id));
+    if (addedPins.length !== input.evidence.length) {
+        throw new Error('The selected conclusion evidence could not be retained completely.');
+    }
+    const supportingPinIds = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'supports' ? [pin.id] : []));
+    let concluded = updateCase(withPins.cases, id, {
+        disposition,
+        reviewReasonCode,
+        decision: {
+            summary: input.summary,
+            rationale: input.rationale,
+            evidencePinIds: supportingPinIds,
+        },
+    }, now);
+    const contradictionRelations = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'contradicts'
+        ? [{ evidencePinId: pin.id, stance: 'contradicts' }]
+        : []));
+    if (contradictionRelations.length) {
+        const retainedSummary = concluded.record.decisions.at(-1)?.summary ?? 'Analyst conclusion';
+        concluded = updateCase(concluded.cases, id, {
+            assertion: {
+                kind: 'contradiction',
+                statement: `Counterevidence considered for: ${retainedSummary}`,
+                rationale: input.rationale,
+                evidenceRelations: contradictionRelations,
+                state: 'resolved',
+            },
+        }, now);
+    }
+    const unresolvedRelations = addedPins.flatMap((pin, index) => (input.evidence[index]?.stance === 'unresolved'
+        ? [{ evidencePinId: pin.id, stance: 'unresolved' }]
+        : []));
+    if (unresolvedRelations.length) {
+        const retainedSummary = concluded.record.decisions.at(-1)?.summary ?? 'Analyst conclusion';
+        concluded = updateCase(concluded.cases, id, {
+            assertion: {
+                kind: 'unknown',
+                statement: `Unresolved evidence considered for: ${retainedSummary}`,
+                rationale: input.rationale,
+                evidenceRelations: unresolvedRelations,
+                state: 'open',
+            },
+        }, now);
+    }
+    return concluded;
+}
+export function recordCaseInvestigationContext(cases, id, input, nowIso) {
+    const current = cases.find((item) => item.id === id);
+    if (!current)
+        throw new Error('That case no longer exists.');
+    const parsed = parseIncidentUrlContext(input.incidentUrl);
+    if (!parsed || parsed.registrableDomain !== current.domain) {
+        throw new Error(`The Incident URL must belong to the Case domain ${current.domain}.`);
+    }
+    const context = caseInvestigationContextAssertion(input);
+    const existing = caseInvestigationContext(current);
+    return updateCase(cases, id, existing
+        ? {
+            assertionUpdate: {
+                id: existing.assertionId,
+                statement: context.statement,
+                rationale: context.rationale,
+                state: 'open',
+            },
+        }
+        : {
+            assertion: {
+                kind: 'next_step',
+                statement: context.statement,
+                rationale: context.rationale,
+                evidenceRelations: [],
+                state: 'open',
+            },
+        }, nowIso);
+}
+export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
+    const now = caseTimestampOrNull(nowIso) || new Date().toISOString();
+    const current = cases.find((item) => item.id === id);
+    if (!current)
+        throw new Error('That case no longer exists.');
+    const beforePinIds = new Set(current.evidencePins.map((pin) => pin.id));
+    const withPin = updateCase(cases, id, {
+        evidencePin: {
+            field: 'case.recheck_comparison',
+            category: 'recheck',
+            label: 'Recheck comparison',
+            value: input.comparisonSummary,
+            source: input.source,
+            sourceState: 'reviewed',
+            observedAt: input.observedAt,
+            collectionDepth: input.collectionDepth,
+            completeness: input.completeness,
+            truncated: false,
+            limitations: input.limitations,
+        },
+    }, now);
+    const comparisonPin = withPin.record.evidencePins.find((pin) => !beforePinIds.has(pin.id));
+    if (!comparisonPin)
+        throw new Error('The recheck comparison could not be retained.');
+    return updateCase(withPin.cases, id, {
+        observedEffectReview: {
+            state: input.state,
+            observedAt: input.observedAt,
+            sourceClass: 'analyst',
+            source: input.source,
+            completeness: input.completeness,
+            evidencePinId: comparisonPin.id,
+            followUpAt: input.followUpAt,
+            limitations: input.limitations,
+        },
+    }, now);
+}

package/packages/cases/case-record-projection.mjs

@@ -0,0 +1,218 @@
+import { PUBLIC_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { caseStatusIsClosed } from "./case-record-decisions.mjs";
+const PRESERVE = Object.freeze({
+    durable: 'preserve', internal: 'preserve', trusted: 'preserve', public: 'preserve',
+});
+const PUBLIC_TRANSFORM = Object.freeze({ ...PRESERVE, public: 'transform' });
+const PUBLIC_EXCLUDE = Object.freeze({ ...PRESERVE, public: 'exclude' });
+const SHARED_EXCLUDE = Object.freeze({ ...PRESERVE, trusted: 'exclude', public: 'exclude' });
+const SHARED_REDACT = Object.freeze({ ...PRESERVE, trusted: 'redact', public: 'redact' });
+const TRUSTED_REDACT_PUBLIC_EXCLUDE = Object.freeze({
+    ...PRESERVE, trusted: 'redact', public: 'exclude',
+});
+const PUBLIC_REDACT = Object.freeze({ ...PRESERVE, public: 'redact' });
+function fieldRule(key, treatment, value, options = {}) {
+    const audienceExclusions = Object.freeze(Object.fromEntries(Object.entries(options.audienceExclusions ?? {}).map(([audience, exclusion]) => [
+        audience,
+        Object.freeze({ ...exclusion }),
+    ])));
+    for (const audience of ['internal', 'trusted', 'public']) {
+        const requiresExplanation = treatment[audience] === 'exclude' || treatment[audience] === 'redact';
+        if (requiresExplanation !== Boolean(audienceExclusions[audience])) {
+            throw new TypeError(`Case field ${key} must explain every redacted or excluded ${audience} treatment exactly once.`);
+        }
+    }
+    return Object.freeze({
+        key,
+        treatment,
+        value,
+        nestedSensitiveFields: Object.freeze([...(options.nestedSensitiveFields ?? [])]),
+        audienceExclusions,
+    });
+}
+function preservedField(key) {
+    return fieldRule(key, PRESERVE, (record) => record[key]);
+}
+const PUBLIC_OBSERVED_EFFECT_LIMITATION = 'Independent observed-effect review records were excluded from this public Case pack.';
+const PUBLIC_CLOSURE_LIMITATION = 'Deliberate closure records were excluded from this public Case pack.';
+function publicObservedEffectHistory(preV13HistoryUnavailable) {
+    return {
+        reviews: [],
+        omitted: 0,
+        preV13HistoryUnavailable,
+        limitations: [
+            ...(preV13HistoryUnavailable
+                ? ['Migrated from a pre-v13 Case; earlier independent observed-effect review history is unavailable.']
+                : []),
+            'Observed-effect reviews are independent point-in-time records; provider workflow events do not create or replace them.',
+            PUBLIC_OBSERVED_EFFECT_LIMITATION,
+        ].sort(),
+    };
+}
+function publicClosureHistory(preV13HistoryUnavailable) {
+    return {
+        records: [],
+        omitted: 0,
+        preV13HistoryUnavailable,
+        limitations: [
+            ...(preV13HistoryUnavailable
+                ? ['Migrated from a pre-v13 Case; earlier deliberate closure history is unavailable.']
+                : []),
+            'Closure records are deliberate analyst actions and do not establish absence, safety, provider performance, or legal sufficiency.',
+            PUBLIC_CLOSURE_LIMITATION,
+        ].sort(),
+    };
+}
+/**
+ * The complete current Case field policy. Browser persistence and ordinary
+ * exports deliberately share the `durable` projection. Case-pack audiences
+ * must classify every field here before a new Case property can compile.
+ */
+const CASE_FIELD_RULES = Object.freeze({
+    id: preservedField('id'),
+    domain: preservedField('domain'),
+    status: fieldRule('status', PUBLIC_TRANSFORM, (record, profile) => (profile === 'public' && caseStatusIsClosed(record.status) && record.closures.records.length
+        ? 'reviewing'
+        : record.status)),
+    disposition: preservedField('disposition'),
+    reviewReasonCode: fieldRule('reviewReasonCode', PRESERVE, (record) => record.reviewReasonCode ?? null),
+    brandProfileIds: fieldRule('brandProfileIds', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : [...record.brandProfileIds]), {
+        audienceExclusions: { public: { label: 'Brand Profile references', order: 2 } },
+    }),
+    tags: fieldRule('tags', PRESERVE, (record) => [...record.tags]),
+    notes: fieldRule('notes', SHARED_EXCLUDE, (record, profile) => (profile === 'trusted' || profile === 'public'
+        ? []
+        : record.notes.map((item) => ({ ...item }))), {
+        audienceExclusions: {
+            trusted: { label: 'Case notes', order: 1 },
+            public: { label: 'Case notes', order: 1 },
+        },
+    }),
+    source: preservedField('source'),
+    evidenceHistory: fieldRule('evidenceHistory', PRESERVE, (record) => structuredClone(record.evidenceHistory)),
+    evidencePins: fieldRule('evidencePins', PRESERVE, (record) => structuredClone(record.evidencePins)),
+    decisions: fieldRule('decisions', PRESERVE, (record) => structuredClone(record.decisions)),
+    actions: fieldRule('actions', TRUSTED_REDACT_PUBLIC_EXCLUDE, (record, profile) => (profile === 'public'
+        ? []
+        : profile === 'trusted'
+            ? structuredClone(record.actions).map((item) => ({ ...item, recipient: '[redacted]' }))
+            : structuredClone(record.actions)), {
+        nestedSensitiveFields: ['recipient'],
+        audienceExclusions: {
+            trusted: { label: 'Recipient values', order: 2 },
+            public: { label: 'Actions and recipient values', order: 3 },
+        },
+    }),
+    assertions: fieldRule('assertions', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : structuredClone(record.assertions)), {
+        audienceExclusions: { public: { label: 'Analyst assertions', order: 4 } },
+    }),
+    manualTrail: fieldRule('manualTrail', SHARED_REDACT, (record, profile) => (profile === 'trusted' || profile === 'public'
+        ? structuredClone(record.manualTrail).map((item) => ({ ...item, target: null }))
+        : structuredClone(record.manualTrail)), {
+        nestedSensitiveFields: ['target'],
+        audienceExclusions: {
+            trusted: { label: 'Manual trail targets', order: 3 },
+            public: { label: 'Manual trail targets', order: 6 },
+        },
+    }),
+    sightings: fieldRule('sightings', PRESERVE, (record) => structuredClone(record.sightings)),
+    observedEffects: fieldRule('observedEffects', PUBLIC_REDACT, (record, profile) => (profile === 'public'
+        ? publicObservedEffectHistory(record.observedEffects.preV13HistoryUnavailable)
+        : structuredClone(record.observedEffects)), {
+        audienceExclusions: {
+            public: { label: 'Independent observed-effect reviews and closure history', order: 8 },
+        },
+    }),
+    closures: fieldRule('closures', PUBLIC_REDACT, (record, profile) => (profile === 'public'
+        ? publicClosureHistory(record.closures.preV13HistoryUnavailable)
+        : structuredClone(record.closures)), {
+        audienceExclusions: {
+            public: { label: 'Independent observed-effect reviews and closure history', order: 8 },
+        },
+    }),
+    branches: fieldRule('branches', PUBLIC_EXCLUDE, (record, profile) => (profile === 'public' ? [] : structuredClone(record.branches ?? [])), {
+        audienceExclusions: { public: { label: 'Investigation branches', order: 5 } },
+    }),
+    createdAt: preservedField('createdAt'),
+    updatedAt: preservedField('updatedAt'),
+});
+function projectCase(record, profile) {
+    const projected = {};
+    for (const key of Object.keys(CASE_FIELD_RULES)) {
+        const rule = CASE_FIELD_RULES[key];
+        Object.defineProperty(projected, key, {
+            configurable: true,
+            enumerable: true,
+            value: rule.value(record, profile),
+            writable: true,
+        });
+    }
+    return projected;
+}
+export function projectCaseForDurableWrite(record) {
+    return projectCase(record, 'durable');
+}
+export function projectCaseForAudience(record, audience) {
+    return projectCase(record, audience);
+}
+/** Field names used by the bounded hidden-copy defence, derived from policy. */
+export const CASE_AUDIENCE_SENSITIVE_FIELD_NAMES = Object.freeze([...new Set(Object.entries(CASE_FIELD_RULES).flatMap(([key, rule]) => {
+        const audienceTreatments = [rule.treatment.trusted, rule.treatment.public];
+        const sensitive = audienceTreatments.some((value) => value === 'exclude' || value === 'redact');
+        return sensitive ? [key, ...rule.nestedSensitiveFields] : [];
+    }))]);
+export const CASE_RECORD_FIELD_NAMES = Object.freeze(Object.values(CASE_FIELD_RULES).map((rule) => rule.key));
+const OUTSIDE_SCHEMA_EXCLUSIONS = Object.freeze({
+    internal: Object.freeze({ label: 'Raw upstream payloads and credentials are outside the case schema.', order: 1 }),
+    trusted: Object.freeze({ label: 'Raw upstream payloads and credentials', order: 4 }),
+    public: Object.freeze({ label: 'Raw upstream payloads and credentials', order: 7 }),
+});
+function currentAudienceExclusions(audience) {
+    const entries = [
+        ...Object.values(CASE_FIELD_RULES).flatMap((rule) => (rule.audienceExclusions[audience] ? [rule.audienceExclusions[audience]] : [])),
+        OUTSIDE_SCHEMA_EXCLUSIONS[audience],
+    ];
+    const orderByLabel = new Map();
+    const labelByOrder = new Map();
+    for (const entry of entries) {
+        if (!entry.label || entry.label.length > 160 || entry.label.trim() !== entry.label
+            || !Number.isSafeInteger(entry.order) || entry.order < 1 || entry.order > 64) {
+            throw new TypeError('Case audience exclusion metadata is malformed or exceeds its bound.');
+        }
+        const prior = orderByLabel.get(entry.label);
+        if (prior !== undefined && prior !== entry.order) {
+            throw new TypeError(`Case audience exclusion ${entry.label} has conflicting presentation order.`);
+        }
+        const priorLabel = labelByOrder.get(entry.order);
+        if (priorLabel !== undefined && priorLabel !== entry.label) {
+            throw new TypeError(`Case audience exclusions ${priorLabel} and ${entry.label} share a presentation order.`);
+        }
+        orderByLabel.set(entry.label, entry.order);
+        labelByOrder.set(entry.order, entry.label);
+    }
+    return Object.freeze([...orderByLabel]
+        .sort((left, right) => left[1] - right[1])
+        .map(([label]) => label));
+}
+const CURRENT_AUDIENCE_EXCLUSIONS = Object.freeze({
+    internal: currentAudienceExclusions('internal'),
+    trusted: currentAudienceExclusions('trusted'),
+    public: currentAudienceExclusions('public'),
+});
+// Schema 12 is an immutable public compatibility contract and deliberately
+// remains independent of the current field-policy projection.
+const PUBLIC_V12_EXCLUSIONS = Object.freeze([
+    'Case notes',
+    'Brand Profile references',
+    'Actions and recipient values',
+    'Analyst assertions',
+    'Investigation branches',
+    'Manual trail targets',
+    'Raw upstream payloads and credentials',
+]);
+export function caseAudienceExclusions(audience, caseVersion) {
+    return audience === 'public' && caseVersion === PUBLIC_CASE_SCHEMA_VERSION
+        ? PUBLIC_V12_EXCLUSIONS
+        : CURRENT_AUDIENCE_EXCLUSIONS[audience];
+}
+export { CASE_FIELD_RULES };

package/packages/cases/case-report.mjs

@@ -182,10 +182,9 @@ export function buildCaseReport(caseRecord, options = {}) {
                 if (!previous)
                     continue;
                 const rawChanges = compareCaseEvidence(previous, snapshot);
-                const allIncomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
-                const hostnameContextChanged = allIncomparableReasons.includes('observation-context');
-                incomparableReasons = allIncomparableReasons.filter((reason) => reason !== 'observation-context');
-                if (rawChanges.length > 0) {
+                incomparableReasons = caseEvidenceIncomparableReasons(previous, snapshot);
+                const hostnameContextChanged = incomparableReasons.includes('observation-context');
+                if (rawChanges.length > 0 && !hostnameContextChanged) {
                     changes = rawChanges.map((change) => ({
                         field: change.field,
                         label: change.label,
@@ -195,8 +194,7 @@ export function buildCaseReport(caseRecord, options = {}) {
                     }));
                 }
                 else if (snapshot.fingerprint !== previous.fingerprint
-                    && incomparableReasons.length === 0
-                    && !hostnameContextChanged) {
+                    && incomparableReasons.length === 0) {
                     incomparableReasons = ['other'];
                 }
                 hasIncomparableChange = incomparableReasons.length > 0;
@@ -452,6 +450,8 @@ function buildMarkdown(report, includeAttribution) {
             }
             if (entry.hasIncomparableChange) {
                 const reasons = Array.isArray(entry.incomparableReasons) ? entry.incomparableReasons : [];
+                if (reasons.includes('observation-context'))
+                    lines.push('> Observation targets differ or are unknown. Field-level additions, removals and beneficial changes are withheld because their scopes cannot be compared reliably. Exact hostnames remain excluded from this report.');
                 if (reasons.includes('risk-model'))
                     lines.push('> Risk scores and factors use different or unversioned models, so their numeric difference is not treated as a domain change.');
                 if (reasons.includes('opportunity-model'))
@@ -544,6 +544,7 @@ function buildMarkdown(report, includeAttribution) {
         for (const decision of response.decisions) {
             lines.push(`- **${escapeMarkdownInline(decision.summary)}** (${escapeMarkdownInline(decision.createdAt)})`);
             lines.push(`  ${escapeMarkdownInline(decision.rationale)}`);
+            lines.push(`  Analyst confidence: ${escapeMarkdownInline(decision.confidence)}${decision.confidenceBasis ? ` — ${escapeMarkdownInline(decision.confidenceBasis)}` : ''}.`);
             if (decision.evidencePinIds.length)
                 lines.push(`  Evidence pins: ${escapeMarkdownInline(decision.evidencePinIds.join(', '))}`);
         }
@@ -555,6 +556,10 @@ function buildMarkdown(report, includeAttribution) {
         for (const action of response.actions) {
             lines.push(`- **${escapeMarkdownInline(action.type.replaceAll('_', ' '))}:** ${escapeMarkdownInline(action.recipient)} (${escapeMarkdownInline(action.state)})`);
             lines.push(`  Contact source: ${escapeMarkdownInline(action.contactSource)}; updated ${escapeMarkdownInline(action.updatedAt)}.`);
+            if (action.routeObservedAt)
+                lines.push(`  Route reviewed: ${escapeMarkdownInline(action.routeObservedAt)}`);
+            if (action.routeReviewAfter)
+                lines.push(`  Route review due: ${escapeMarkdownInline(action.routeReviewAfter)}`);
             if (action.originActionId)
                 lines.push(`  Originating action: ${escapeMarkdownInline(action.originActionId)}`);
             if (action.dueAt)

package/packages/cases/case-response-model.mjs

@@ -13,9 +13,11 @@ export const CASE_ACTION_TYPES = [
     'registry_report',
     'network_hosting_report',
     'security_contact_report',
+    'platform_report',
     'defensive_control',
     'internal_review',
 ];
+export const CASE_DECISION_CONFIDENCE_LEVELS = ['unknown', 'low', 'moderate', 'high'];
 export const CASE_ACTION_STATES = [
     'drafting',
     'ready_for_review',
@@ -101,6 +103,7 @@ const CONTROL_REPLACE_RE = /[\u0000-\u001f\u007f]+/gu;
 const COMPLETENESS = new Set(CASE_PIN_COMPLETENESS);
 const TRANSITION_EXPECTATIONS = new Set(CASE_TRANSITION_EXPECTATIONS);
 const ACTION_TYPES = new Set(CASE_ACTION_TYPES);
+const DECISION_CONFIDENCE_LEVELS = new Set(CASE_DECISION_CONFIDENCE_LEVELS);
 const ACTION_STATES = new Set(CASE_ACTION_STATES);
 const PROVIDER_OUTCOMES = new Set(CASE_PROVIDER_OUTCOMES);
 const ACTION_EVENT_SOURCE_CLASSES = new Set(CASE_ACTION_EVENT_SOURCE_CLASSES);
@@ -337,6 +340,9 @@ export function normalizeCaseEvidencePins(raw, fallback, options = {}) {
         .slice(-MAX_CASE_EVIDENCE_PINS);
 }
 export function appendCaseEvidencePin(current, raw, now) {
+    if (current.length >= MAX_CASE_EVIDENCE_PINS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_EVIDENCE_PINS} evidence pins. No existing evidence was removed.`);
+    }
     const item = record(raw);
     const created = normalizePin({ ...item, id: freshId('pin'), createdAt: now }, now);
     if (!created)
@@ -363,10 +369,17 @@ function normalizeDecision(raw, fallback, validPinIds, options = {}) {
     if (!summary || !rationale)
         return null;
     const createdAt = iso(item.createdAt, fallback, options);
+    const currentConfidence = typeof item.confidence === 'string' && DECISION_CONFIDENCE_LEVELS.has(item.confidence)
+        ? item.confidence
+        : 'unknown';
     return {
         id: safeId(item.id, 'decision', { summary, rationale, createdAt }),
         summary,
         rationale,
+        confidence: options.sourceVersion != null && options.sourceVersion < 15 ? 'unknown' : currentConfidence,
+        confidenceBasis: options.sourceVersion != null && options.sourceVersion < 15
+            ? ''
+            : text(item.confidenceBasis, MAX_RESPONSE_RATIONALE_LENGTH),
         evidencePinIds: uniqueIds(item.evidencePinIds, validPinIds),
         createdAt,
     };
@@ -385,6 +398,9 @@ export function normalizeCaseDecisions(raw, fallback, validPinIds, options = {})
         .slice(-MAX_CASE_DECISIONS);
 }
 export function appendCaseDecision(current, raw, now, validPinIds) {
+    if (current.length >= MAX_CASE_DECISIONS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_DECISIONS} decisions. No existing decision was removed.`);
+    }
     const item = record(raw);
     const created = normalizeDecision({ ...item, id: freshId('decision'), createdAt: now }, now, validPinIds);
     if (!created)
@@ -661,16 +677,28 @@ function normalizeAction(raw, fallback, options = {}) {
     const latestEventAt = applied.at(-1)?.occurredAt ?? createdAt;
     const metadataUpdatedAt = iso(item.metadataUpdatedAt ?? item.updatedAt, createdAt, options);
     const updatedAt = Date.parse(latestEventAt) > Date.parse(metadataUpdatedAt) ? latestEventAt : metadataUpdatedAt;
+    const contactSource = text(item.contactSource, MAX_RESPONSE_LABEL_LENGTH) || 'analyst_supplied';
+    const legacyPlatformReview = options.sourceVersion != null && options.sourceVersion < 15
+        && item.type === 'security_contact_report'
+        ? /^Official .+, reviewed (\d{4}-\d{2}-\d{2})$/u.exec(contactSource)
+        : null;
     return {
         id: actionId,
-        type: typeof item.type === 'string' && ACTION_TYPES.has(item.type)
-            ? item.type
-            : 'internal_review',
+        type: legacyPlatformReview
+            ? 'platform_report'
+            : typeof item.type === 'string' && ACTION_TYPES.has(item.type)
+                ? item.type
+                : 'internal_review',
         recipient,
-        contactSource: text(item.contactSource, MAX_RESPONSE_LABEL_LENGTH) || 'analyst_supplied',
-        routeObservedAt: options.sourceVersion != null && options.sourceVersion < 14
+        contactSource,
+        routeObservedAt: legacyPlatformReview
+            ? normalizeExplicitIsoTimestamp(`${legacyPlatformReview[1]}T00:00:00.000Z`)
+            : options.sourceVersion != null && options.sourceVersion < 14
+                ? null
+                : optionalIso(item.routeObservedAt, options),
+        routeReviewAfter: options.sourceVersion != null && options.sourceVersion < 15
             ? null
-            : optionalIso(item.routeObservedAt, options),
+            : optionalIso(item.routeReviewAfter, options),
         contactLimitations: limitations(item.contactLimitations),
         dueAt: optionalIso(item.dueAt, options),
         state: history.state,
@@ -1112,6 +1140,9 @@ export function normalizeCaseAssertions(raw, fallback, validPinIds, options = {}
         .slice(-MAX_CASE_ASSERTIONS);
 }
 export function appendCaseAssertion(current, raw, now, validPinIds) {
+    if (current.length >= MAX_CASE_ASSERTIONS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_ASSERTIONS} assertions. No existing assertion was removed.`);
+    }
     const item = record(raw);
     const created = normalizeAssertion({
         ...item,
@@ -1170,6 +1201,9 @@ export function normalizeCaseManualTrail(raw, fallback, options = {}) {
         .slice(-MAX_CASE_MANUAL_TRAIL_EVENTS);
 }
 export function appendCaseManualTrailEvent(current, raw, now) {
+    if (current.length >= MAX_CASE_MANUAL_TRAIL_EVENTS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_MANUAL_TRAIL_EVENTS} investigation-trail entries. No existing entry was removed.`);
+    }
     const item = record(raw);
     const created = normalizeManualTrailEvent({ ...item, id: freshId('trail'), createdAt: now }, now);
     if (!created)
@@ -1234,6 +1268,9 @@ export function normalizeCaseSightings(raw, fallback, validPinIds, options = {})
         .slice(-MAX_CASE_SIGHTINGS);
 }
 export function appendCaseSighting(current, raw, now, validPinIds) {
+    if (current.length >= MAX_CASE_SIGHTINGS) {
+        throw new Error(`A Case can retain at most ${MAX_CASE_SIGHTINGS} sightings. No existing sighting was removed.`);
+    }
     const item = record(raw);
     const created = normalizeCaseSighting({
         ...item,