@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/packages/contracts/external-observation-interchange.mjs

@@ -8,6 +8,8 @@ export const MAX_EXTERNAL_FINDINGS_IMPORT_BYTES = 384 * 1024;
 export const MAX_EXTERNAL_FINDINGS = 100;
 export const MAX_EXTERNAL_FINDINGS_PER_DOMAIN = 20;
 export const MAX_EXTERNAL_FINDING_DOMAINS = 25;
+export const MAX_EXTERNAL_FINDING_LIMITATIONS = 8;
+export const MAX_EXTERNAL_FINDING_LIMITATION_LENGTH = 240;
 export const EXTERNAL_FINDING_ROWS_SCHEMA = 'whoisleuth.external-finding-rows';
 export const EXTERNAL_FINDING_ROWS_VERSION = 1;
 export const DOMAIN_OBSERVATION_ROWS_SCHEMA = 'whoisleuth.domain-observation-rows';
@@ -147,7 +149,6 @@ export const EXTERNAL_OBSERVATION_INTERCHANGE_LIFECYCLE_FAMILY = defineSchemaLif
     contracts: EXTERNAL_INTERCHANGE_CONTRACTS,
     fixtures: EXTERNAL_INTERCHANGE_FIXTURES,
     metadata: {
-        metadataVersion: 3,
         enforcement: 'declarative_only',
         shapes: [
             externalShape('external-interchange.findings.v4', EXTERNAL_FINDINGS_SCHEMA, [...SUPPORTED_EXTERNAL_FINDINGS_VERSIONS], ['schema', 'schemaVersion', 'source', 'findings'], 'preserve_document'),

package/packages/contracts/extracted-domain-lifecycle.mjs

@@ -1,10 +1,8 @@
 function formatSlug(id) {
     return id.replaceAll('.', '-');
 }
-function lifecycleShapeId(format, version, v4) {
-    return v4
-        ? `${formatSlug(format.descriptor.id)}.v${version}`
-        : `${formatSlug(format.descriptor.id)}.document`;
+function lifecycleShapeId(format, version) {
+    return `${formatSlug(format.descriptor.id)}.v${version}`;
 }
 function contractState(format, version) {
     const current = version === format.descriptor.currentVersion;
@@ -21,7 +19,7 @@ function contractState(format, version) {
             : null,
     };
 }
-function fixtureRecord(format, fixture, v4) {
+function fixtureRecord(format, fixture) {
     const state = contractState(format, fixture.version);
     const output = format.fixtures.find((candidate) => candidate.version === format.descriptor.currentVersion);
     return {
@@ -38,12 +36,11 @@ function fixtureRecord(format, fixture, v4) {
             ? output?.id ?? null
             : null,
         scope: 'repository',
-        ...(v4 ? { shapeId: lifecycleShapeId(format, fixture.version, true) } : {}),
+        shapeId: lifecycleShapeId(format, fixture.version),
     };
 }
-function buildExtractedLifecycleFamily(options, metadataVersion) {
-    const v4 = metadataVersion === 4;
-    const fixtures = options.formats.flatMap((format) => format.fixtures.map((fixture) => (fixtureRecord(format, fixture, v4))));
+export function buildExtractedLifecycleFamily(options) {
+    const fixtures = options.formats.flatMap((format) => format.fixtures.map((fixture) => (fixtureRecord(format, fixture))));
     const contracts = options.formats.flatMap((format) => format.descriptor.supportedVersions.map((version) => ({
         compatibilityId: format.descriptor.id,
         schema: format.lifecycleSchema,
@@ -58,23 +55,19 @@ function buildExtractedLifecycleFamily(options, metadataVersion) {
             .filter((fixture) => fixture.schema === format.lifecycleSchema && fixture.version === version)
             .map((fixture) => fixture.id),
     })));
-    const shapes = options.formats.flatMap((format) => (v4
-        ? format.descriptor.supportedVersions
-        : [format.descriptor.currentVersion]).map((version) => ({
-        id: lifecycleShapeId(format, version, v4),
+    const shapes = options.formats.flatMap((format) => format.descriptor.supportedVersions.map((version) => ({
+        id: lifecycleShapeId(format, version),
         schema: format.lifecycleSchema,
-        versions: v4 ? [version] : format.descriptor.supportedVersions,
+        versions: [version],
         objects: [{
                 path: '$',
                 requiredKeys: format.requiredKeys,
                 optionalKeys: format.optionalKeys,
-                ...(v4 ? { alternativeRequiredKeys: [] } : {}),
                 unknownKeys: 'reject',
             }],
         fixedArrays: [],
         normalisation: 'preserve_document',
         target: null,
-        ...(v4 ? { discriminator: null } : {}),
     })));
     const boundProfiles = options.formats.map((format) => ({
         id: `${formatSlug(format.descriptor.id)}.bounds`,
@@ -120,9 +113,7 @@ function buildExtractedLifecycleFamily(options, metadataVersion) {
         const outputOnly = format.descriptor.futureVersionBehavior === 'not_applicable';
         const acceptedVersions = outputOnly ? [] : format.descriptor.supportedVersions;
         const edgeVersions = outputOnly ? [format.descriptor.currentVersion] : format.descriptor.supportedVersions;
-        const shapeIds = v4
-            ? edgeVersions.map((version) => lifecycleShapeId(format, version, true))
-            : [lifecycleShapeId(format, format.descriptor.currentVersion, false)];
+        const shapeIds = edgeVersions.map((version) => lifecycleShapeId(format, version));
         const hookId = hookIdFor(format);
         const serialises = index === 0;
         return {
@@ -134,13 +125,11 @@ function buildExtractedLifecycleFamily(options, metadataVersion) {
                         schema: format.lifecycleSchema,
                         versions: acceptedVersions,
                         mode: 'direct',
-                        ...(metadataVersion >= 3 ? { discriminator: null } : {}),
                     }]
                 : [],
             emittedContract: {
                 schema: format.lifecycleSchema,
                 version: format.descriptor.currentVersion,
-                ...(v4 ? { discriminator: null } : {}),
             },
             shapeIds,
             boundProfileIds: [`${formatSlug(format.descriptor.id)}.bounds`],
@@ -155,7 +144,6 @@ function buildExtractedLifecycleFamily(options, metadataVersion) {
         };
     });
     const metadata = {
-        metadataVersion,
         enforcement: 'declarative_only',
         shapes,
         boundProfiles,
@@ -181,7 +169,7 @@ function buildExtractedLifecycleFamily(options, metadataVersion) {
                 projection: options.projection,
                 includedCategories: options.includedCategories,
                 excludedCategories: options.excludedCategories,
-                notePolicy: 'discarded',
+                notePolicy: options.notePolicy ?? 'discarded',
                 retention: options.retention,
                 network: 'none',
                 sharingReview: options.retention === 'operator_controlled_output' ? 'required' : 'not_applicable',
@@ -207,12 +195,3 @@ function buildExtractedLifecycleFamily(options, metadataVersion) {
         metadata,
     };
 }
-export function buildExtractedLifecycleFamilyV2(options) {
-    return buildExtractedLifecycleFamily(options, 2);
-}
-export function buildExtractedLifecycleFamilyV3(options) {
-    return buildExtractedLifecycleFamily(options, 3);
-}
-export function buildExtractedLifecycleFamilyV4(options) {
-    return buildExtractedLifecycleFamily(options, 4);
-}

package/packages/contracts/http-url.mjs

@@ -0,0 +1,2 @@
+// Shared admission bound for a single outbound HTTP URL, before any request.
+export const MAX_OUTBOUND_HTTP_URL_CHARACTERS = 4_096;

package/packages/contracts/investigation-package-limits.mjs

@@ -0,0 +1,24 @@
+import { MAX_SELECTED_FILES, MAX_SELECTED_FILE_TOTAL_BYTES, MAX_SELECTED_FILE_BYTES } from "./selected-file-limits.mjs";
+import { MAX_EDITABLE_CASE_OUTPUT_BYTES } from "./case-portability.mjs";
+// A complete Case handoff carries every admitted original plus the Case JSON.
+// File-retention bounds remain independent of this container allowance.
+export const MAX_INVESTIGATION_MANIFEST_ARTIFACTS = MAX_SELECTED_FILES + 1;
+export const MAX_INVESTIGATION_MANIFEST_ARTIFACT_BYTES = MAX_SELECTED_FILE_BYTES;
+export const MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES = MAX_SELECTED_FILE_TOTAL_BYTES + MAX_EDITABLE_CASE_OUTPUT_BYTES;
+export const MAX_INVESTIGATION_MANIFEST_DOCUMENT_BYTES = 512 * 1024;
+export const MAX_INVESTIGATION_PACKAGE_ENTRIES = MAX_INVESTIGATION_MANIFEST_ARTIFACTS + 1;
+// Stored ZIP entries use 76 header bytes and two generated ASCII paths (at
+// most 21 bytes each). 128 bytes per entry plus the 22-byte end record cover
+// this writer's overhead without reducing the independently admitted payload.
+export const MAX_INVESTIGATION_PACKAGE_BYTES = MAX_INVESTIGATION_MANIFEST_TOTAL_BYTES
+    + MAX_INVESTIGATION_MANIFEST_DOCUMENT_BYTES + MAX_INVESTIGATION_PACKAGE_ENTRIES * 128 + 22;
+export const ENCRYPTED_INVESTIGATION_PACKAGE_MAGIC = 'WHOISLEUTH-ENCRYPTED\0';
+export const ENCRYPTED_INVESTIGATION_PACKAGE_VERSION = 1;
+// Magic, version byte, iteration count, salt, IV and plaintext byte count.
+export const ENCRYPTED_INVESTIGATION_PACKAGE_HEADER_BYTES = ENCRYPTED_INVESTIGATION_PACKAGE_MAGIC.length + 1 + 4 + 16 + 12 + 4;
+export const MAX_ENCRYPTED_INVESTIGATION_PACKAGE_BYTES = MAX_INVESTIGATION_PACKAGE_BYTES
+    + ENCRYPTED_INVESTIGATION_PACKAGE_HEADER_BYTES + 16;
+export function hasEncryptedInvestigationPackagePrefix(bytes) {
+    return bytes.byteLength >= ENCRYPTED_INVESTIGATION_PACKAGE_MAGIC.length
+        && [...ENCRYPTED_INVESTIGATION_PACKAGE_MAGIC].every((character, index) => bytes[index] === character.charCodeAt(0));
+}

package/packages/contracts/investigation-portability.mjs

@@ -22,27 +22,44 @@ export const BULK_MAIL_EXPOSURE_EXPORT_VERSION = 2;
 export const SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS = Object.freeze([BULK_MAIL_EXPOSURE_EXPORT_VERSION]);
 export const MAX_BULK_MAIL_EXPOSURE_ROWS = 2_000;
 export const BULK_REVIEW_MANIFEST_SCHEMA = 'whoisleuth.bulk-review-manifest';
-export const BULK_REVIEW_MANIFEST_VERSION = 2;
-export const SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS = Object.freeze([BULK_REVIEW_MANIFEST_VERSION]);
+export const BULK_REVIEW_MANIFEST_VERSION = 3;
+export const SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS = Object.freeze([2, BULK_REVIEW_MANIFEST_VERSION]);
 export const INVESTIGATION_CAPSULE_SCHEMA = 'whoisleuth.investigation-capsule';
-export const INVESTIGATION_CAPSULE_VERSION = 3;
+export const INVESTIGATION_CAPSULE_VERSION = 4;
 export const PUBLIC_INVESTIGATION_CAPSULE_VERSION = 2;
 export const SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS = Object.freeze([
     PUBLIC_INVESTIGATION_CAPSULE_VERSION,
+    3,
     INVESTIGATION_CAPSULE_VERSION,
 ]);
 export const INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA = 'whoisleuth.case-analyst-records';
 export const INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION = 1;
 export const LOOKUP_INVESTIGATION_BRIEF_SCHEMA = 'whoisleuth.investigation-brief';
-export const LOOKUP_INVESTIGATION_BRIEF_VERSION = 2;
+export const LOOKUP_INVESTIGATION_BRIEF_VERSION = 3;
 export const PUBLIC_LOOKUP_INVESTIGATION_BRIEF_VERSION = 1;
 export const SUPPORTED_LOOKUP_INVESTIGATION_BRIEF_VERSIONS = Object.freeze([
     PUBLIC_LOOKUP_INVESTIGATION_BRIEF_VERSION,
+    2,
     LOOKUP_INVESTIGATION_BRIEF_VERSION,
 ]);
 export const MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES = 128 * 1024;
 export const LOOKUP_ASSET_GRAPH_SCHEMA = 'whoisleuth.lookup-asset-graph';
-export const LOOKUP_ASSET_GRAPH_VERSION = 2;
+export const LOOKUP_ASSET_GRAPH_VERSION = 3;
+export const SUPPORTED_LOOKUP_ASSET_GRAPH_VERSIONS = Object.freeze([2, LOOKUP_ASSET_GRAPH_VERSION]);
+// Offline-parser emergency bounds exceed every relationship that the bounded
+// graph inputs can produce. The writer does not truncate nodes or edges.
+export const MAX_LOOKUP_ASSET_NODES = 8_192;
+export const MAX_LOOKUP_ASSET_EDGES = 8_192;
+export const MAX_LOOKUP_ASSET_LIMITATIONS = 16;
+export const MAX_LOOKUP_ASSET_INPUT_ROWS = 160;
+export function investigationCapsuleContracts(version) {
+    switch (version) {
+        case 2: return { brief: 1, graph: 2 };
+        case 3: return { brief: 2, graph: 2 };
+        case INVESTIGATION_CAPSULE_VERSION: return { brief: LOOKUP_INVESTIGATION_BRIEF_VERSION, graph: LOOKUP_ASSET_GRAPH_VERSION };
+        default: return null;
+    }
+}
 export const INVESTIGATION_DOMAIN_COMPATIBILITY_FACADES = Object.freeze([
     ['frontend/src/lib/analysis/acquisition-decision-packet.ts', 'packages/investigation/acquisition-decision-packet.mts'],
     ['frontend/src/lib/analysis/acquisition-due-diligence.ts', 'packages/investigation/acquisition-due-diligence.mts'],
@@ -89,20 +106,20 @@ export const BULK_REVIEW_MANIFEST_COMPATIBILITY = defineSchemaCompatibility({
     currentVersion: BULK_REVIEW_MANIFEST_VERSION, supportedVersions: SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS,
     acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only', writeSemantics: 'read_only',
     byteBudget: MAX_INVESTIGATION_PORTABLE_BYTES, owner: INVESTIGATION_PORTABILITY_CONTRACT_OWNER,
-    note: 'Version 2 uses deterministic sorted-json-v2 integrity for one bounded Bulk review selection while excluding raw payloads, contacts, notes, and transient request state.',
+    note: 'Version 3 retains nullable batch, row and source observation times in one selected Bulk review with deterministic sorted-json-v2 integrity. Published version 2 remains readable without inventing absent source times. Raw payloads, contacts, notes and transient request state are excluded.',
 });
 export const INVESTIGATION_CAPSULE_COMPATIBILITY = defineSchemaCompatibility({
     id: 'export.investigation-capsule', kind: 'export', schema: INVESTIGATION_CAPSULE_SCHEMA,
     currentVersion: INVESTIGATION_CAPSULE_VERSION, supportedVersions: SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS,
     acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only', writeSemantics: 'read_only',
     byteBudget: MAX_INVESTIGATION_PORTABLE_BYTES, owner: INVESTIGATION_PORTABILITY_CONTRACT_OWNER,
-    note: 'Version 3 embeds investigation brief v2 with canonical Decision Facts; the v1.47.4 version 2 and v2 version 3 retain whole-capsule sorted-json-v2 integrity.',
+    note: 'Version 4 embeds brief v3 and graph v3 with projection coverage. Versions 2 and 3 remain readable with their exact embedded contracts and whole-capsule sorted-json-v2 integrity.',
 });
 export const LOOKUP_ASSET_GRAPH_COMPATIBILITY = defineSchemaCompatibility({
     id: 'derived.lookup-asset-graph', kind: 'derived', schema: LOOKUP_ASSET_GRAPH_SCHEMA,
     tier: 'durable_interchange',
-    currentVersion: LOOKUP_ASSET_GRAPH_VERSION, supportedVersions: [LOOKUP_ASSET_GRAPH_VERSION],
-    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only', writeSemantics: 'read_only',
+    currentVersion: LOOKUP_ASSET_GRAPH_VERSION, supportedVersions: SUPPORTED_LOOKUP_ASSET_GRAPH_VERSIONS,
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only', writeSemantics: 'read_only',
     byteBudget: null, owner: INVESTIGATION_PORTABILITY_CONTRACT_OWNER,
     note: 'Bounded relationship projection embedded in investigation capsules; source attribution and incomplete evidence remain explicit.',
 });
@@ -120,7 +137,7 @@ export const LOOKUP_INVESTIGATION_BRIEF_COMPATIBILITY = defineSchemaCompatibilit
     currentVersion: LOOKUP_INVESTIGATION_BRIEF_VERSION, supportedVersions: SUPPORTED_LOOKUP_INVESTIGATION_BRIEF_VERSIONS,
     acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only', writeSemantics: 'none',
     byteBudget: MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES, owner: INVESTIGATION_PORTABILITY_CONTRACT_OWNER,
-    note: 'Version 2 replaces the public version-1 summary and decision-entry arrays with one bounded canonical Decision Fact projection; public version 1 remains structurally verified when embedded in supported capsule versions.',
+    note: 'Version 3 summarises the complete retained graph with canonical Decision Facts. Versions 1 and 2 retain their exact historical relationship bounds within supported capsules.',
 });
 export const INVESTIGATION_PORTABILITY_COMPATIBILITY = Object.freeze([
     ACQUISITION_DECISION_PACKET_COMPATIBILITY,
@@ -134,17 +151,24 @@ export const INVESTIGATION_PORTABILITY_COMPATIBILITY = Object.freeze([
     LOOKUP_INVESTIGATION_BRIEF_COMPATIBILITY,
 ]);
 const INVESTIGATION_FIXTURES = Object.freeze([
+    { id: 'investigation-capsule-v4', path: 'test/fixtures/investigation-portability/investigation-capsule-v4.json', bytes: 9005, sha256: 'a1c193ab16fe79cbd39182b4a554e09ce785f71c19aa8185f442a3cc06d54830', schema: INVESTIGATION_CAPSULE_SCHEMA, version: 4, role: 'current' },
+    { id: 'lookup-asset-graph-v3', path: 'test/fixtures/investigation-portability/lookup-asset-graph-v3.json', bytes: 8821, sha256: 'b37ce0d3cc18af95e09dc0e34b6a610a7e0fcbb9ab095b5da6a0d72c54d63c30', schema: LOOKUP_ASSET_GRAPH_SCHEMA, version: 3, role: 'current' },
+    { id: 'lookup-investigation-brief-v3', path: 'test/fixtures/investigation-portability/lookup-investigation-brief-v3.json', bytes: 1779, sha256: '49b78aa7b7c620ac521c329a30af990b33114e4122028e277e1419b352944e8b', schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version: 3, role: 'current' },
     { id: 'acquisition-decision-v2', path: 'test/fixtures/investigation-portability/acquisition-decision-v2.json', bytes: 6_278, sha256: '1c1b5c2fcea2886dae5661085f605d95317b89bb6d9774cb8967a754ef8165bf', schema: ACQUISITION_DECISION_PACKET_SCHEMA, version: 2, role: 'current' },
     { id: 'lookup-claim-passport-v1', path: 'test/fixtures/investigation-portability/lookup-claim-passport-v1.json', bytes: 2_011, sha256: 'dbf1c3975282e340b6639162a0555aeaed42c06abe92ed3b354409ce73c284a4', schema: LOOKUP_CLAIM_PASSPORT_SCHEMA, version: 1, role: 'current' },
     { id: 'bulk-domain-comparison-v4', path: 'test/fixtures/investigation-portability/bulk-domain-comparison-v4.json', bytes: 17_079, sha256: 'b718af34c8f5f1ba4427807cd149561bc1b7e605a6e74206a694beaee078cc2d', schema: BULK_DOMAIN_COMPARISON_SCHEMA, version: 4, role: 'current' },
     { id: 'bulk-mail-exposure-v2', path: 'test/fixtures/investigation-portability/bulk-mail-exposure-v2.json', bytes: 2_582, sha256: '9ff6c4c9f2dda4c5451daf8fb11e36a3ee15b513a09ad3c93515cc37df5d6660', schema: BULK_MAIL_EXPOSURE_SCHEMA, version: 2, role: 'current' },
-    { id: 'bulk-review-manifest-v2', path: 'test/fixtures/investigation-portability/bulk-review-manifest-v2.json', bytes: 1_657, sha256: '1c90f4d0661357fc277360cc924f2464e463f9c8bd815a6b45408e95e1caf7d3', schema: BULK_REVIEW_MANIFEST_SCHEMA, version: 2, role: 'current' },
+    { id: 'bulk-review-manifest-v2', path: 'test/fixtures/investigation-portability/bulk-review-manifest-v2-current.json', bytes: 2_118, sha256: 'b4e209df9bc0e1c8be8a34d4f4aac486df9d0a4e1a1f750b9a21ab6e0d35b7b6', schema: BULK_REVIEW_MANIFEST_SCHEMA, version: 2, role: 'historical' },
+    { id: 'bulk-review-manifest-v3', path: 'test/fixtures/investigation-portability/bulk-review-manifest-v3.json', bytes: 2_422, sha256: '0ee1022140b8d19a92100806f0091c197be0ffec0faae808721c47d7cb96d9ad', schema: BULK_REVIEW_MANIFEST_SCHEMA, version: 3, role: 'current' },
+    // Synthetic integrity examples deliberately combine independently versioned
+    // contracts. Their application labels are not captured-release provenance;
+    // historical/current here describes the supported capsule schema only.
     { id: 'investigation-capsule-v2', path: 'test/fixtures/investigation-capsule-v2.json', bytes: 3_286, sha256: 'fb71cb243020d401e3653bb714f9de07a71b81622fcf83c0027599b763dda070', schema: INVESTIGATION_CAPSULE_SCHEMA, version: 2, role: 'historical' },
-    { id: 'investigation-capsule-v3', path: 'test/fixtures/investigation-portability/investigation-capsule-v3.json', bytes: 6_132, sha256: '685123c8bd152ee1a8074441bcd56bbde9fb0304aa4a320ee9b37d02061ed82a', schema: INVESTIGATION_CAPSULE_SCHEMA, version: 3, role: 'current' },
-    { id: 'lookup-asset-graph-v2', path: 'test/fixtures/investigation-portability/lookup-asset-graph-v2.json', bytes: 1_157, sha256: '455397a2b2987180d54657199e76c4dc175e01aed0fa83d945a6f3ec30bdcd49', schema: LOOKUP_ASSET_GRAPH_SCHEMA, version: 2, role: 'current' },
+    { id: 'investigation-capsule-v3', path: 'test/fixtures/investigation-portability/investigation-capsule-v3.json', bytes: 6_132, sha256: '685123c8bd152ee1a8074441bcd56bbde9fb0304aa4a320ee9b37d02061ed82a', schema: INVESTIGATION_CAPSULE_SCHEMA, version: 3, role: 'historical' },
+    { id: 'lookup-asset-graph-v2', path: 'test/fixtures/investigation-portability/lookup-asset-graph-v2.json', bytes: 1_157, sha256: '455397a2b2987180d54657199e76c4dc175e01aed0fa83d945a6f3ec30bdcd49', schema: LOOKUP_ASSET_GRAPH_SCHEMA, version: 2, role: 'historical' },
     { id: 'investigation-analyst-records-v1', path: 'test/fixtures/investigation-portability/investigation-analyst-records-v1.json', bytes: 624, sha256: '0730116afef29e52b448e150f6755e89ec1189c2fbc6ec4ef8cfc4b41f677456', schema: INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, version: 1, role: 'current' },
     { id: 'lookup-investigation-brief-v1', path: 'test/fixtures/investigation-portability/lookup-investigation-brief-v1.json', bytes: 1_651, sha256: 'bc21c886671370659149c3e494c7e6061302569308823c69ef96f0c601dadbab', schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version: 1, role: 'historical' },
-    { id: 'lookup-investigation-brief-v2', path: 'test/fixtures/investigation-portability/lookup-investigation-brief-v2.json', bytes: 1_724, sha256: '25d0133318df8daa00848e6a2c03913478beb30818a4959298ec1500b6aaa0fd', schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version: 2, role: 'current' },
+    { id: 'lookup-investigation-brief-v2', path: 'test/fixtures/investigation-portability/lookup-investigation-brief-v2.json', bytes: 1_724, sha256: '25d0133318df8daa00848e6a2c03913478beb30818a4959298ec1500b6aaa0fd', schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version: 2, role: 'historical' },
 ].map((fixture) => Object.freeze({
     ...fixture,
     contentDigestSha256: null,
@@ -182,7 +206,7 @@ const INVESTIGATION_CONTRACTS = Object.freeze([
     ...SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS.map((version) => investigationContract({ compatibilityId: BULK_MAIL_EXPOSURE_COMPATIBILITY.id, schema: BULK_MAIL_EXPOSURE_SCHEMA, version, currentVersion: BULK_MAIL_EXPOSURE_EXPORT_VERSION, canonicalisation: 'sorted-json-v2', byteBudget: MAX_INVESTIGATION_PORTABLE_BYTES })),
     ...SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS.map((version) => investigationContract({ compatibilityId: BULK_REVIEW_MANIFEST_COMPATIBILITY.id, schema: BULK_REVIEW_MANIFEST_SCHEMA, version, currentVersion: BULK_REVIEW_MANIFEST_VERSION, canonicalisation: 'sorted-json-v2', byteBudget: MAX_INVESTIGATION_PORTABLE_BYTES })),
     ...SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS.map((version) => investigationContract({ compatibilityId: INVESTIGATION_CAPSULE_COMPATIBILITY.id, schema: INVESTIGATION_CAPSULE_SCHEMA, version, currentVersion: INVESTIGATION_CAPSULE_VERSION, canonicalisation: 'sorted-json-v2', byteBudget: MAX_INVESTIGATION_PORTABLE_BYTES })),
-    investigationContract({ compatibilityId: LOOKUP_ASSET_GRAPH_COMPATIBILITY.id, schema: LOOKUP_ASSET_GRAPH_SCHEMA, version: LOOKUP_ASSET_GRAPH_VERSION, currentVersion: LOOKUP_ASSET_GRAPH_VERSION, canonicalisation: null, byteBudget: null }),
+    ...SUPPORTED_LOOKUP_ASSET_GRAPH_VERSIONS.map((version) => investigationContract({ compatibilityId: LOOKUP_ASSET_GRAPH_COMPATIBILITY.id, schema: LOOKUP_ASSET_GRAPH_SCHEMA, version, currentVersion: LOOKUP_ASSET_GRAPH_VERSION, canonicalisation: null, byteBudget: null })),
     investigationContract({ compatibilityId: INVESTIGATION_CAPSULE_ANALYST_RECORDS_COMPATIBILITY.id, schema: INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, version: INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, currentVersion: INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, canonicalisation: null, byteBudget: null }),
     ...SUPPORTED_LOOKUP_INVESTIGATION_BRIEF_VERSIONS.map((version) => investigationContract({ compatibilityId: LOOKUP_INVESTIGATION_BRIEF_COMPATIBILITY.id, schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, version, currentVersion: LOOKUP_INVESTIGATION_BRIEF_VERSION, canonicalisation: null, byteBudget: MAX_LOOKUP_INVESTIGATION_BRIEF_BYTES })),
 ]);
@@ -203,11 +227,12 @@ const INVESTIGATION_SHAPES = Object.freeze([
     investigationShape('investigation.domain-comparison.v4', BULK_DOMAIN_COMPARISON_SCHEMA, [...SUPPORTED_BULK_DOMAIN_COMPARISON_EXPORT_VERSIONS], ['schema', 'version', 'generatedAt', 'comparison', 'integrity'], 'preserve_signed_document'),
     investigationShape('investigation.mail-exposure.v2', BULK_MAIL_EXPOSURE_SCHEMA, [...SUPPORTED_BULK_MAIL_EXPOSURE_EXPORT_VERSIONS], ['schema', 'version', 'report', 'integrity'], 'preserve_signed_document'),
     investigationShape('investigation.bulk-review.v2', BULK_REVIEW_MANIFEST_SCHEMA, [...SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS], ['schema', 'version', 'generatedAt', 'observedAt', 'lookupProfile', 'selection', 'view', 'rows', 'limitations', 'integrity'], 'preserve_signed_document'),
-    investigationShape('investigation.capsule.v2-v3', INVESTIGATION_CAPSULE_SCHEMA, [...SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS], ['schema', 'schemaVersion', 'generatedAt', 'application', 'target', 'sourceContracts', 'investigationBrief', 'graphSnapshot', 'analystRecords', 'limitations', 'integrity'], 'preserve_signed_document'),
-    investigationShape('investigation.asset-graph.v2', LOOKUP_ASSET_GRAPH_SCHEMA, [LOOKUP_ASSET_GRAPH_VERSION], ['version', 'targetId', 'nodes', 'edges', 'sources', 'truncated', 'limitations'], 'preserve_document'),
+    investigationShape('investigation.capsule.v2-v4', INVESTIGATION_CAPSULE_SCHEMA, [...SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS], ['schema', 'schemaVersion', 'generatedAt', 'application', 'target', 'sourceContracts', 'investigationBrief', 'graphSnapshot', 'analystRecords', 'limitations', 'integrity'], 'preserve_signed_document'),
+    investigationShape('investigation.asset-graph.v2', LOOKUP_ASSET_GRAPH_SCHEMA, [2], ['version', 'targetId', 'nodes', 'edges', 'sources', 'truncated', 'limitations'], 'preserve_document'),
+    investigationShape('investigation.asset-graph.v3', LOOKUP_ASSET_GRAPH_SCHEMA, [LOOKUP_ASSET_GRAPH_VERSION], ['version', 'targetId', 'nodes', 'edges', 'sources', 'coverage', 'truncated', 'limitations'], 'preserve_document'),
     investigationShape('investigation.analyst-records.v1', INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, [INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION], ['caseId', 'status', 'disposition', 'decisions', 'assertions'], 'preserve_document'),
     investigationShape('investigation.brief.v1', LOOKUP_INVESTIGATION_BRIEF_SCHEMA, [PUBLIC_LOOKUP_INVESTIGATION_BRIEF_VERSION], ['schema', 'schemaVersion', 'generatedAt', 'target', 'targetType', 'task', 'taskLabel', 'question', 'summary', 'observation', 'verifiedFacts', 'contradictions', 'unknowns', 'nextActions', 'relationships', 'limitations'], 'preserve_document'),
-    investigationShape('investigation.brief.v2', LOOKUP_INVESTIGATION_BRIEF_SCHEMA, [LOOKUP_INVESTIGATION_BRIEF_VERSION], ['schema', 'schemaVersion', 'generatedAt', 'target', 'targetType', 'task', 'taskLabel', 'question', 'summary', 'observation', 'decisionFacts', 'relationships', 'limitations'], 'preserve_document'),
+    investigationShape('investigation.brief.v2-v3', LOOKUP_INVESTIGATION_BRIEF_SCHEMA, [2, LOOKUP_INVESTIGATION_BRIEF_VERSION], ['schema', 'schemaVersion', 'generatedAt', 'target', 'targetType', 'task', 'taskLabel', 'question', 'summary', 'observation', 'decisionFacts', 'relationships', 'limitations'], 'preserve_document'),
 ]);
 const investigationConsumerCommon = Object.freeze({
     expiryPolicyId: 'investigation.expiry.not-applicable',
@@ -223,7 +248,6 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
     contracts: INVESTIGATION_CONTRACTS,
     fixtures: INVESTIGATION_FIXTURES,
     metadata: {
-        metadataVersion: 3,
         enforcement: 'declarative_only',
         shapes: INVESTIGATION_SHAPES,
         boundProfiles: [
@@ -242,6 +266,11 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
             { id: 'investigation.derived.bounds', bounds: [
                     { id: 'projection-items', path: '$', phase: 'normalised', unit: 'items', minimum: 0, maximum: 2_000, handling: 'truncate' },
                 ] },
+            { id: 'investigation.graph.bounds', bounds: [
+                    { id: 'nodes', path: 'nodes', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_LOOKUP_ASSET_NODES, handling: 'reject' },
+                    { id: 'edges', path: 'edges', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_LOOKUP_ASSET_EDGES, handling: 'reject' },
+                    { id: 'input-coverage', path: 'coverage.inputs', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_LOOKUP_ASSET_INPUT_ROWS, handling: 'reject' },
+                ] },
         ],
         hooks: [
             { id: 'investigation.offline.structure', role: 'structure_validator', runtime: 'cli', module: 'cli/offline-artifact-validation.mts', exportName: 'validateOfflineArtifactStructure' },
@@ -258,7 +287,7 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
             { id: 'investigation.brief.build', role: 'builder', runtime: 'shared', module: 'packages/investigation/lookup-investigation-brief.mts', exportName: 'buildLookupInvestigationBrief' },
         ],
         serialisationProfiles: [{
-                id: 'investigation.capsule.json.v2-v3',
+                id: 'investigation.capsule.json.v2-v4',
                 schema: INVESTIGATION_CAPSULE_SCHEMA,
                 versions: [...SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS],
                 mediaType: 'application/json',
@@ -289,7 +318,7 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
                     { schema: INVESTIGATION_CAPSULE_SCHEMA, versions: [...SUPPORTED_INVESTIGATION_CAPSULE_VERSIONS], mode: 'direct' },
                 ],
                 emittedContract: null,
-                shapeIds: ['investigation.acquisition.v2', 'investigation.claim-passport.v1', 'investigation.domain-comparison.v4', 'investigation.mail-exposure.v2', 'investigation.bulk-review.v2', 'investigation.capsule.v2-v3'],
+                shapeIds: ['investigation.acquisition.v2', 'investigation.claim-passport.v1', 'investigation.domain-comparison.v4', 'investigation.mail-exposure.v2', 'investigation.bulk-review.v2', 'investigation.capsule.v2-v4'],
                 boundProfileIds: ['investigation.portable.bounds', 'investigation.passport.bounds'],
                 hookIds: ['investigation.offline.structure', 'investigation.offline.verify'],
                 serialisationProfileId: null,
@@ -298,15 +327,15 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
             {
                 id: 'investigation.consumer.capsule-compose', plane: 'shared', operation: 'compose-and-verify-capsule',
                 acceptedContracts: [
-                    { schema: LOOKUP_ASSET_GRAPH_SCHEMA, versions: [LOOKUP_ASSET_GRAPH_VERSION], mode: 'embedded' },
+                    { schema: LOOKUP_ASSET_GRAPH_SCHEMA, versions: [...SUPPORTED_LOOKUP_ASSET_GRAPH_VERSIONS], mode: 'embedded' },
                     { schema: INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, versions: [INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION], mode: 'embedded' },
                     { schema: LOOKUP_INVESTIGATION_BRIEF_SCHEMA, versions: [...SUPPORTED_LOOKUP_INVESTIGATION_BRIEF_VERSIONS], mode: 'embedded' },
                 ],
                 emittedContract: { schema: INVESTIGATION_CAPSULE_SCHEMA, version: INVESTIGATION_CAPSULE_VERSION },
-                shapeIds: ['investigation.asset-graph.v2', 'investigation.analyst-records.v1', 'investigation.brief.v1', 'investigation.brief.v2', 'investigation.capsule.v2-v3'],
-                boundProfileIds: ['investigation.portable.bounds', 'investigation.brief.bounds', 'investigation.derived.bounds'],
+                shapeIds: ['investigation.asset-graph.v2', 'investigation.asset-graph.v3', 'investigation.analyst-records.v1', 'investigation.brief.v1', 'investigation.brief.v2-v3', 'investigation.capsule.v2-v4'],
+                boundProfileIds: ['investigation.portable.bounds', 'investigation.brief.bounds', 'investigation.derived.bounds', 'investigation.graph.bounds'],
                 hookIds: ['investigation.capsule.build', 'investigation.capsule.verify', 'investigation.capsule.serialise'],
-                serialisationProfileId: 'investigation.capsule.json.v2-v3',
+                serialisationProfileId: 'investigation.capsule.json.v2-v4',
                 privacyProfileId: 'investigation.privacy.output', retentionEffect: 'operator_controlled_output', ...investigationConsumerCommon,
             },
             ...[
@@ -315,9 +344,9 @@ export const INVESTIGATION_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleF
                 ['investigation.consumer.domain-comparison-build', BULK_DOMAIN_COMPARISON_SCHEMA, BULK_DOMAIN_COMPARISON_EXPORT_VERSION, 'investigation.domain-comparison.v4', 'investigation.domain-comparison.build', 'investigation.portable.bounds'],
                 ['investigation.consumer.mail-exposure-build', BULK_MAIL_EXPOSURE_SCHEMA, BULK_MAIL_EXPOSURE_EXPORT_VERSION, 'investigation.mail-exposure.v2', 'investigation.mail-exposure.build', 'investigation.portable.bounds'],
                 ['investigation.consumer.bulk-review-build', BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, 'investigation.bulk-review.v2', 'investigation.bulk-review.build', 'investigation.portable.bounds'],
-                ['investigation.consumer.graph-build', LOOKUP_ASSET_GRAPH_SCHEMA, LOOKUP_ASSET_GRAPH_VERSION, 'investigation.asset-graph.v2', 'investigation.graph.build', 'investigation.derived.bounds'],
+                ['investigation.consumer.graph-build', LOOKUP_ASSET_GRAPH_SCHEMA, LOOKUP_ASSET_GRAPH_VERSION, 'investigation.asset-graph.v3', 'investigation.graph.build', 'investigation.graph.bounds'],
                 ['investigation.consumer.analyst-records-project', INVESTIGATION_CAPSULE_ANALYST_RECORDS_SCHEMA, INVESTIGATION_CAPSULE_ANALYST_RECORDS_VERSION, 'investigation.analyst-records.v1', 'investigation.capsule.build', 'investigation.derived.bounds'],
-                ['investigation.consumer.brief-build', LOOKUP_INVESTIGATION_BRIEF_SCHEMA, LOOKUP_INVESTIGATION_BRIEF_VERSION, 'investigation.brief.v2', 'investigation.brief.build', 'investigation.brief.bounds'],
+                ['investigation.consumer.brief-build', LOOKUP_INVESTIGATION_BRIEF_SCHEMA, LOOKUP_INVESTIGATION_BRIEF_VERSION, 'investigation.brief.v2-v3', 'investigation.brief.build', 'investigation.brief.bounds'],
             ].map(([id, schema, version, shapeId, hookId, boundProfileId]) => ({
                 id, plane: 'shared', operation: 'build-current-projection', acceptedContracts: [],
                 emittedContract: { schema, version }, shapeIds: [shapeId], boundProfileIds: [boundProfileId],

package/packages/contracts/investigation-run.mjs

@@ -0,0 +1,16 @@
+export const CLI_INVESTIGATION_RUN_SCHEMA = 'whoisleuth.cli.investigation-run';
+export const CLI_INVESTIGATION_RUN_VERSION = 3;
+export const SUPPORTED_CLI_INVESTIGATION_RUN_VERSIONS = Object.freeze([1, 2, 3]);
+export const MAX_INVESTIGATION_RUN_BYTES = 24 * 1024 * 1024;
+export const MAX_INVESTIGATION_RUN_SELECTIONS = 16;
+export const MAX_INVESTIGATION_RUN_SELECTION_LENGTH = 1_024;
+// Version 3 retains partial observations and content-bound step inputs. Earlier
+// readers must reject these checkpoints rather than recollect or reinterpret them.
+export const INVESTIGATION_RUN_STATES = Object.freeze([
+    'complete',
+    'partial',
+    'awaiting_network_approval',
+    'awaiting_analyst_selection',
+    'awaiting_review_confirmation',
+    'step_failed',
+]);

package/packages/contracts/ip-address.mjs

@@ -0,0 +1,34 @@
+export function ipv6Groups(value) {
+    const address = addressValue(value);
+    if (address?.family !== 6)
+        return [];
+    return Array.from({ length: 8 }, (_, index) => ((address.value >> BigInt((7 - index) * 16)) & 0xffffn).toString(16).padStart(4, '0'));
+}
+export function addressValue(value) {
+    if (typeof value !== 'string' || value.length > 96)
+        return null;
+    if (/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(value)) {
+        const octets = value.split('.').map(Number);
+        return octets.every(octet => octet >= 0 && octet <= 255)
+            ? { family: 4, value: octets.reduce((total, octet) => (total << 8) + octet, 0) >>> 0 } : null;
+    }
+    if (!value.includes(':') || !/^[0-9a-f:.]+$/iu.test(value))
+        return null;
+    try {
+        const hostname = new URL(`https://[${value}]/`).hostname;
+        if (!hostname.startsWith('[') || !hostname.endsWith(']'))
+            return null;
+        const pieces = hostname.slice(1, -1).split('::');
+        const left = pieces[0] ? pieces[0].split(':') : [];
+        const right = pieces[1] ? pieces[1].split(':') : [];
+        const missing = 8 - left.length - right.length;
+        if (pieces.length > 2 || pieces.length === 1 && missing !== 0 || pieces.length === 2 && missing < 1
+            || [...left, ...right].some(part => !/^[0-9a-f]{1,4}$/iu.test(part)))
+            return null;
+        const parts = [...left, ...Array.from({ length: missing }, () => '0'), ...right];
+        return { family: 6, value: parts.reduce((total, part) => (total << 16n) + BigInt(`0x${part}`), 0n) };
+    }
+    catch {
+        return null;
+    }
+}

package/packages/contracts/lookup-evidence.mjs

@@ -0,0 +1,35 @@
+import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
+export const LOOKUP_EVIDENCE_SCHEMA = 'whoisleuth.lookup-evidence';
+export const V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = 26;
+export const PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION = 27;
+export const REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION = 28;
+export const LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION = REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION;
+export const HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION = 29;
+export const PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION = PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION;
+export const LOOKUP_EVIDENCE_SCHEMA_VERSION = HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION;
+export const SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS = Object.freeze([
+    V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    PUBLISHED_V2_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    LATEST_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    LOOKUP_EVIDENCE_SCHEMA_VERSION,
+]);
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES = 5 * 1024 * 1024;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_ENTRIES = 20_000;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_DEPTH = 24;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS = 10_000;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_KEY_LENGTH = 256;
+export const LOOKUP_EVIDENCE_PORTABLE_MAX_STRING_LENGTH = 1024 * 1024;
+export const LOOKUP_EVIDENCE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.lookup-evidence',
+    kind: 'export',
+    schema: LOOKUP_EVIDENCE_SCHEMA,
+    currentVersion: LOOKUP_EVIDENCE_SCHEMA_VERSION,
+    supportedVersions: SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS,
+    acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'reject',
+    migration: 'read_only',
+    writeSemantics: 'read_only',
+    byteBudget: LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES,
+    owner: 'packages/contracts/lookup-evidence.mts',
+    note: 'Exact published versions 26, 27 and 28 remain replayable with their original collection scope. Version 29 identifies the hostname used for supporting DNS, TLS and web observations; registration authority remains separate.',
+});

package/packages/contracts/offline-comparison.mjs

@@ -10,7 +10,7 @@ export const CLI_COMPARISON_LEDGER_SCHEMA = 'whoisleuth.cli.comparison-ledger';
 export const CLI_COMPARISON_LEDGER_VERSION = 1;
 export const MAX_RETAINED_ARTIFACT_DIFF_BYTES = 8 * 1024 * 1024;
 export const RELATIONSHIP_EVIDENCE_SCHEMA = 'whoisleuth.relationship-evidence';
-export const RELATIONSHIP_EVIDENCE_VERSION = 2;
+export const RELATIONSHIP_EVIDENCE_VERSION = 3;
 export const TLS_RELATIONSHIP_PROFILE_VERSION = 2;
 export const SUPPORTED_TLS_RELATIONSHIP_PROFILE_VERSIONS = Object.freeze([TLS_RELATIONSHIP_PROFILE_VERSION]);
 export const OFFLINE_COMPARISON_COMPATIBILITY_FACADES = Object.freeze([
@@ -114,7 +114,6 @@ export const OFFLINE_COMPARISON_LIFECYCLE_FAMILY = defineSchemaLifecycleFamily({
     contracts: OFFLINE_COMPARISON_CONTRACTS,
     fixtures: OFFLINE_COMPARISON_FIXTURES,
     metadata: {
-        metadataVersion: 4,
         enforcement: 'declarative_only',
         shapes: [
             offlineOutputShape('offline-comparison.page-output.current', CLI_PAGE_COMPARE_SCHEMA, [4], ['schema', 'version', 'generatedAt', 'left', 'right', 'page', 'technology', 'tls', 'limitations']),

package/packages/contracts/page-fingerprints.mjs

@@ -0,0 +1,15 @@
+export const PAGE_FINGERPRINT_VERSION = 2;
+export const PAGE_FINGERPRINT_PARSERS = Object.freeze({
+    1: 'static-tag-sequence-v1',
+    [PAGE_FINGERPRINT_VERSION]: 'html-tree-v2',
+});
+export const MAX_STATIC_HTML_TAGS = 8_192;
+export const MAX_STATIC_HTML_NODES = MAX_STATIC_HTML_TAGS * 3;
+export const MAX_STATIC_HTML_DEPTH = 512;
+// Each admitted element emits a start and end event; other nodes emit at most
+// one event. The parser admits three mandatory document elements additionally.
+export const MAX_STATIC_HTML_TREE_EVENTS = MAX_STATIC_HTML_NODES + MAX_STATIC_HTML_TAGS + 3;
+export const PAGE_FINGERPRINT_TOKEN_LIMITS = Object.freeze({
+    1: 4_096,
+    [PAGE_FINGERPRINT_VERSION]: MAX_STATIC_HTML_TREE_EVENTS,
+});

package/packages/contracts/risk-calibration.mjs

@@ -158,6 +158,15 @@ export const RISK_CALIBRATION_REPORT_PRIVACY_KEYS = Object.freeze([
 export const RISK_CALIBRATION_REPORT_INTERPRETATION_KEYS = Object.freeze([
     'authority', 'statement', 'automaticTuning', 'networkRequests', 'persisted',
 ]);
+/** Stable disposition identities admitted by the versioned calibration schema. */
+export const RISK_CALIBRATION_DISPOSITIONS = Object.freeze([
+    'unreviewed',
+    'suspicious',
+    'confirmed_abuse',
+    'false_positive',
+    'expected',
+    'closed_no_action',
+]);
 export const RISK_CALIBRATION_DATASET_COMPATIBILITY = defineSchemaCompatibility({
     id: 'cli.risk-calibration-dataset',
     kind: 'cli_document',
@@ -337,8 +346,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             id: 'risk-calibration-report-v3-detailed',
             path: 'test/fixtures/risk-calibration-report-v3-detailed.json',
-            bytes: 7_026,
-            sha256: '5c0c435e81478e90bc0b64aa7c20fd82d131b5261a57d9550df3f03334bc20e1',
+            bytes: 7_020,
+            sha256: 'a5cba1681c170c79f8891037f47efc93e0ae6ce5d247418ff3f1c9a81a352922',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -351,8 +360,8 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         {
             id: 'risk-calibration-report-v3-summary',
             path: 'test/fixtures/risk-calibration-report-v3-summary.json',
-            bytes: 5_486,
-            sha256: 'b06c312eed14680ce30fd58a84a93908d29ea9e71bfee8174b90df286b730549',
+            bytes: 5_480,
+            sha256: '71b7fe1ee613b2ab32bd1f5646ee765985022c904224e1a08f4577c1d1d06240',
             contentDigestSha256: null,
             schema: RISK_CALIBRATION_REPORT_SCHEMA,
             version: RISK_CALIBRATION_REPORT_VERSION,
@@ -364,7 +373,6 @@ export const RISK_CALIBRATION_SCHEMA_LIFECYCLE = defineSchemaLifecycleFamily({
         },
     ],
     metadata: {
-        metadataVersion: 4,
         enforcement: 'declarative_only',
         shapes: [
             ...[RISK_CALIBRATION_DATASET_VERSION].map((version) => ({
@@ -1110,9 +1118,7 @@ const FACTOR_SPEC = objectOf([
 const REPORT_RECORD_SPEC = objectOf([
     { key: 'id', value: boundedText(MAX_RISK_CALIBRATION_RECORD_ID_LENGTH) },
     { key: 'domain', value: boundedText(MAX_RISK_CALIBRATION_DOMAIN_LENGTH) },
-    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, [
-            'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
-        ]) },
+    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, RISK_CALIBRATION_DISPOSITIONS) },
     { key: 'reviewReasonCode', value: nullable(boundedText(MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH)) },
     { key: 'interoperabilityTags', value: arrayOf(boundedText(MAX_RISK_CALIBRATION_STRING_LENGTH), 0, 32) },
     { key: 'metricClass', value: boundedText(16, ['positive', 'negative', 'excluded']) },
@@ -1179,9 +1185,7 @@ const DATASET_EVIDENCE_SPEC = objectOf([
 const DATASET_RECORD_SPEC = objectOf([
     { key: 'id', value: boundedText(MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, null, 1, canonicalRiskCalibrationIdentifier) },
     { key: 'domain', value: boundedText(MAX_RISK_CALIBRATION_DOMAIN_LENGTH, null, 1, validRiskCalibrationDomain) },
-    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, [
-            'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action',
-        ]) },
+    { key: 'analystDisposition', value: boundedText(MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, RISK_CALIBRATION_DISPOSITIONS) },
     { key: 'reviewReasonCode', value: boundedText(MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, RISK_CALIBRATION_REVIEW_REASON_VALUES), optional: true },
     { key: 'evidence', value: DATASET_EVIDENCE_SPEC },
 ]);

package/packages/contracts/schema-compatibility.mjs

@@ -1,7 +1,7 @@
 const LOCAL_SCHEMA_IDENTIFIER_SOURCE = String.raw `whoisleuth\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*`;
 const LOCAL_SCHEMA_IDENTIFIER_PATTERN = new RegExp(`^${LOCAL_SCHEMA_IDENTIFIER_SOURCE}$`, 'u');
 const COMPATIBILITY_SCHEMA_IDENTIFIER_PATTERN = /^[-a-z0-9.]+$/u;
-const CONTRACT_KINDS = new Set(['browser_store', 'tab_store', 'hosted_store', 'export', 'cli_document', 'derived']);
+const CONTRACT_KINDS = new Set(['browser_store', 'tab_store', 'hosted_store', 'filesystem_store', 'export', 'cli_document', 'derived']);
 const COMPATIBILITY_TIERS = new Set(['durable_interchange', 'published_output', 'internal']);
 const FUTURE_VERSION_BEHAVIORS = new Set(['reject', 'preserve_without_write', 'discard', 'not_applicable']);
 const MIGRATION_BEHAVIORS = new Set(['normalize_to_current', 'exact_current_only', 'read_only', 'none']);