@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/docs/cli.md

@@ -1,5 +1,7 @@
 # WHOISleuth CLI guide
 
+`review-evidence` also reviews bounded source-qualified infrastructure snapshots and explicit earlier/later comparison inputs entirely offline. See [infrastructure observations](infrastructure-observations.md) for the exact schemas, outcome semantics and retained-evidence limitations.
+
 The first-party CLI runs on the operator's machine and does not call the hosted
 WHOISleuth deployment. Use this guide for installation, common commands,
 collection boundaries and output. Installed `whoisleuth --help`, focused
@@ -7,6 +9,11 @@ collection boundaries and output. Installed `whoisleuth --help`, focused
 version. The [CLI reference](cli-reference.md) covers durable command and
 artefact contracts.
 
+The [website command reference](https://www.whoisleuth.com/cli) starts with common
+tasks, then offers searchable commands with examples, option explanations and
+defaults. Command-section links can be bookmarked. Its option guidance and
+installed help derive from the same command definitions.
+
 The generated [privacy and data-flow catalogue](https://github.com/slicedearth/whoisleuth/blob/main/docs/privacy-data-flow-catalogue.md)
 lists the network, recipient, retention and export boundary for every command.
 
@@ -80,6 +87,11 @@ offline CLI workflow below.
 When several incident Cases share a domain, select the intended Case before
 retaining replay evidence. Case packs preserve each current Case ID separately;
 trusted and public packs exclude analyst-entered incident titles.
+Every audience retains tags, decision summaries and rationale as well as domain
+evidence and Case, pin and decision IDs. Public does not mean anonymous.
+Browser Lookup evidence can be verified or packaged in the CLI. `brief`,
+`export`, `compare`, `registry-doctor` and `source-report` instead require a
+saved CLI Lookup; they do not reconstruct it from a browser export.
 
 Process selected local input:
 
@@ -96,6 +108,18 @@ One strict domain, IP address or ASN can occupy command position as Lookup
 shorthand. URL-like or ambiguous input requires the explicit `lookup` command.
 Only `bulk` accepts multiple targets.
 
+For a downloaded plain-domain feed, use
+`whoisleuth domain-feed review nrd7 feed.txt --select term:example --json`.
+Repeat `--select exclude:literal` to veto a literal substring before the result
+bound, including for exact-host selections. At most 20 positive and 20 negative
+terms of 3–80 characters are supported; at least one positive term or exact host
+is required. Matching uses canonical ASCII/punycode text without token, typo,
+confusable or regular-expression expansion. These offline selectors do not infer
+saved browser campaign identity or default priority.
+This is an offline literal match, not a feed download or target Lookup. The
+[candidate-review guide](https://github.com/slicedearth/whoisleuth/blob/main/docs/brand-candidate-review.md#review-a-domain-feed) covers
+source attribution and the separate Watchlist handoff.
+
 `discover` accepts a brand label or registrable domain and supports multi-part
 public suffixes in `--tlds` (for example, `co.uk,com.au`). It preserves the full
 suffix and does not collect candidate evidence; use `discover-scan` only after
@@ -136,6 +160,132 @@ their focused help. They do not use the hosted login or hosted usage controls.
 `lookup --plan` lists planned source families and disclosure targets before
 collection. `doctor` is offline unless `--network` is selected.
 
+Deep Lookup reports IPv4 and IPv6 results separately, including empty answers,
+NODATA, resolver-reported missing names and query failures. These outcomes remain
+distinct in evidence exports; none alone establishes domain removal.
+
+Plans are target-specific: Fast IP and ASN plans contain RDAP only; Deep IP
+adds WHOIS and eligible reverse DNS, while Deep ASN adds WHOIS. Domain-only web,
+TLS and selected intelligence do not apply to address or ASN targets.
+Plans do not probe source health or measure remaining quota, cost, result fan-out
+or exact request counts. CLI configuration profiles repeat supported settings;
+optional selections made on the website do not transfer to a CLI command.
+For completed website results, see [Source quality](https://github.com/slicedearth/whoisleuth/blob/main/docs/application-guide.md#lookup).
+
+### Message and link intake
+
+Use `intake email message.eml --json` for MIME email and nested messages,
+`intake calendar invitation.ics`, `intake qr selected.png`, or `intake text`
+with text on standard input. These commands never open a destination or execute
+supplied content. Output compares displayed and actual hosts, retains reported
+header authentication and interprets supplied authorisation parameters without
+retaining URL tokens. The source hash identifies the original bytes.
+Defanged schemes and hosts are accepted, including `hxxps[:]//host[.]example`.
+Path, query and fragment characters keep their supplied meaning; text scanning
+removes unmatched surrounding prose brackets, while explicit links remain exact.
+
+Add a repeatable `--reported-action`, such as `entered_device_code` or
+`granted_consent`, to include account-recovery guidance based on an explicitly
+reported action. The report does not infer a stolen session from domain evidence.
+`--strict-exit` returns 4 for a partial review. QR review supports still PNGs;
+no decoded result is not proof that a symbol is absent.
+Excluded links and unsupported QR payloads make the review partial, with
+category counts rather than private payload text. Bare QR hostnames are not
+automatically treated as URLs.
+
+Current message-intake reports also retain bounded literal IPv4/IPv6 and
+explicitly labelled MD5, SHA-1 and SHA-256 observations from supported body and
+document text. Each observation links to its selected source part and digest;
+it is not a Lookup target, file identification or threat verdict. Complete URLs,
+message headers, QR payloads, HAR and identity-event fields are excluded from
+this text scan. Historical version-1 reports do not acquire new observations.
+
+Use `intake text selected.txt --intake-context context.json --json` to add an
+explicit analyst-supplied distribution declaration. The separate context file
+is limited to 8 KiB and cannot use stdin. Its channel, non-sensitive source
+label and optional declared time, reference, observer and vantage labels are
+included in the output, not verified as delivery or capture conditions. See
+[selected-input indicators and declarations](offline-intake-context.md) for the
+exact schema, privacy exclusions and extraction bounds.
+
+Plain-text phone discovery reports only candidate counts, the source digest and
+UTF-16 selection ranges to standard error; unselected numbers do not enter JSON
+output. Use a version-2 `--intake-context` file to select exact ranges and declare
+their source, basis, role and known time. The same optional file can supply a
+displayed/destination pair for local hostname comparison. See the
+[selection example](offline-intake-context.md#select-phone-observations-in-the-cli).
+`--quiet` suppresses discovery guidance, and `--strict-exit` reports partial
+phone coverage as well as other incomplete intake work.
+
+### Local IP-location database review
+
+`review-evidence query.json --mmdb selected.mmdb --json --strict-exit` reads
+one analyst-selected database locally. It never downloads, updates or transmits
+the database. A current query uses this input:
+
+```json
+{
+  "schema": "whoisleuth.local-mmdb-query",
+  "version": 2,
+  "address": "192.0.2.1",
+  "sourceLabel": "Selected local database",
+  "databaseVersion": "Analyst-declared edition",
+  "license": "Analyst-declared licence",
+  "freshnessPolicy": {
+    "maxAgeDays": 90,
+    "rationale": "Quarterly research review; recheck before operational use"
+  }
+}
+```
+
+Replace the reserved example address with the public IP under review. Reserved
+and private addresses are unavailable in current reviews. Select and justify an
+age limit appropriate to the task; the example is not a default or an accuracy
+guarantee. The policy requires positive whole days and a plain-text rationale
+of at most 240 characters. The command's review time is compared with the
+intrinsic build time; a future build, stale database, unsupported format/type,
+miss or unusable record cannot supply current location context. Malformed
+fields remain unknown, with partial coverage when other useful fields survive.
+
+Current output retains SHA-256 of the exact read bytes, byte length, intrinsic
+database type, build time, binary format and IP version. Analyst source, version
+and licence labels remain separate claims. Only coarse network, country, region,
+city and ASN attribution can be returned; no raw record or local path is included.
+The existing version-1 review envelope contains the self-described
+`whoisleuth.local-mmdb-review` version-1 result. Reject future result versions
+rather than treating them as current evidence.
+
+The file must remain a regular, stable file of at most 512 MiB. After the bounded
+read and digest, one disposable worker limits synchronous parsing and lookup to
+ten seconds, with bounded heap/stack and an 8 KiB result. This is not a ten-second
+whole-command or filesystem deadline. Default exit 0 means a report was produced;
+`--strict-exit` returns 4 for unavailable or partial current reviews. Version-1
+queries retain their historical JSON shape and exit behaviour, without intrinsic
+metadata or freshness admission; terminal output identifies that limitation.
+
+### Contextual reviews
+
+`review-evidence` also accepts [contextual review inputs](contextual-reviews.md)
+for source-qualified incident sequences, retained domain history, platform-object continuity, authorised storefront
+comparison and connector provenance. These workflows are offline; partial
+context reviews return 4 when `--strict-exit` is selected. Browser-generated
+reusable inputs use the same validators.
+
+Domain-history input version 2 adds analyst-declared registration, deletion,
+re-registration, transfer or review boundaries linked to retained snapshot or
+pin IDs. Version 1 remains supported with its original output. Boundaries prompt
+reassessment; they do not establish ownership or discard prior evidence.
+
+`review-evidence containment.json --json --strict-exit` accepts a
+`whoisleuth.internal-containment.input` version-1 document containing a supported
+Case export, selected next-step assertion and linked pin IDs, internal or trusted
+audience, recipient role and an explicit disclosure-review acknowledgement.
+It exports only that selected handoff, never writes the Case or performs a
+control. Missing or unselected supporting context stays partial (exit 4 under
+`--strict-exit`), and a resolved Case or provider outcome does not close an open
+internal follow-up. See [internal containment](offline-intake-context.md#selected-internal-containment-handoff)
+for the complete input and audience limitations.
+
 ### Message-header review
 
 `mail-headers` parses only the bounded header block from a selected message file
@@ -145,11 +295,87 @@ reported order. It makes no request and does not retain address local parts,
 display names, subject, body, attachments, or raw header values in its output.
 Authentication states are header claims, not an independent DNS or
 cryptographic validation, and alignment differences can be legitimate.
+Both `mail-headers` and `intake email` preserve individual authentication header
+positions and service identifiers. Evaluate the receiver boundary yourself; to
+record trust in one exact header, add `--trusted-auth-header 1:3` (message part 1,
+header 3). Repeat for separate headers. This annotates the supplied claim without
+validating it or extending trust to matching service names or nested messages.
+
+`intake pdf selected.pdf`, `intake docx selected.docx` and `intake har selected.har`
+use the same offline review as the browser. Document results include part hashes,
+page references and extraction coverage. Encrypted documents require a separately
+decrypted copy; no password is requested. HAR results preserve file order and
+reported timings, with unavailable values distinct from zero. Neither document
+resources nor recorded requests are fetched. Add `--strict-exit` for exit 4 when
+coverage is partial, and `--json` for the minimised report.
+
+`intake identity events.json --json` reads an Entra sign-in `value` array or an
+Okta System Log array. To record a scoped comparison, wrap the selected provider
+records in this input (timestamps require an explicit timezone):
+
+```json
+{
+  "schema": "whoisleuth.identity-events.input",
+  "version": 1,
+  "provider": "entra",
+  "events": [],
+  "match": {
+    "applicationId": "11111111-1111-4111-8111-111111111111",
+    "tenantId": null,
+    "actorLabel": null,
+    "startedAt": "2026-01-01T00:00:00Z",
+    "endedAt": "2026-01-01T01:00:00Z"
+  }
+}
+```
+
+Replace `events` with the selected records. Actor labels apply only within that
+file; missing fields stay unavailable. The source hash identifies the complete
+selected file, including an envelope when supplied. No provider API is contacted.
 
 ## Output and automation
 
 ### Local Case files
 
+Manual response scope is explicit and offline. `case incident-link` takes
+`{"url":"https://example.test/reported-page"}`; use its retained ID to bind
+`responseObjects` on `case action`. Each object contains `kind`, `identifier`
+and `incidentTargetId` (null for the Case domain or an associated hostname).
+New URL objects must match that exact retained link. Exact historical identities
+already retained in response records remain selectable after a link edit or
+removal; they are not rebound to its replacement. An action may bind up to 20
+objects; missing historical scope stays unknown.
+
+`case action-event` takes `{"id":"action-id","transition":{...}}`, using
+the same reviewed, authorised and manually submitted workflow as Console.
+After submission, a typed `objectOutcome` such as `removed`, `restricted`,
+`suspended`, `delisted`, `restored` or `disputed` requires explicit event
+`responseObjects`: a partial receipt never applies to all objects by default.
+Acknowledgement is a workflow event, not independently observed remediation.
+
+A self-initiated correction uses a new `case action`, with `originActionId`
+identifying the original action and `responseObjects` selecting a subset of that
+delivery's exact objects. Its `correction` block identifies one delivery event,
+packet digest/version and profile, plus the purpose (`correction` or
+`retraction_request`), reason, previous and corrected statements, and retained
+evidence-pin IDs. This is separate from `amendment`, which still requires an
+actual provider-request event. The correction must match a retained typed packet
+receipt on the selected delivery; a historical free-text digest alone is
+insufficient. The usual recipient, authority and disclosure review then applies
+to the new draft. The original packet and delivery remain unchanged.
+
+`case recheck-question` saves `statement` and `recheck` comparison conditions.
+Pins, questions and recheck input can retain one `responseObject`; exact-object
+non-reproduction requires matching complete baseline/current evidence, a later
+observation and comparable conditions. Hostname similarity is insufficient.
+Independent removal, restriction, suspension, delisting, transfer and restoration
+use those same comparison requirements. Disputes and warnings retain procedural
+source attribution separately; provider claims are not independent observations.
+`case close-object` requires one `responseObject` and the usual typed closure
+reason/evidence links. It leaves the Case and other objects unchanged.
+All these JSON operations require `--input`, `--output`, deliberate file
+replacement and the existing digest/lease checks. No report or request is sent.
+
 Create a working file, inspect its Case IDs, then append a note:
 
 ```sh
@@ -162,14 +388,20 @@ Use `--case-id` when the file contains several Cases. `open` reuses the selected
 Case; `--new-incident --title "Another incident"` creates a distinct ID for the
 same domain. It does not open a browser or collect anything.
 
-`pin`, `assess` and `recheck` read a selected JSON file with `--input`:
+`pin`, `link`, `withdraw-link`, `assess` and `recheck` read a selected JSON file with `--input`:
 
 ```sh
 whoisleuth case pin cases.json --input pin.json --output cases.json --force
+whoisleuth case link cases.json --input relationship.json --output cases.json --force
 whoisleuth case assess cases.json --input assessment.json --output cases.json --force
 whoisleuth case recheck cases.json --input recheck.json --output cases.json --force
 ```
 
+For `link`, use `fromPinId`, `toPinId`, `kind` (`derived_from` or
+`shared_source`) and `basis`. `withdraw-link` takes the relationship `id` and
+`reason`; its original declaration remains in the file. `case show` lists the
+identities and `--json` includes the full history.
+
 A pin describes the supplied observation, not a new collection. For example:
 
 ```json
@@ -255,12 +487,17 @@ An ordinary Case JSON file alone provides structural validity, not a checksum.
 They use generated entry names, not original paths. Ordinary ZIPs and folders
 are private and unencrypted; packaging does not redact selected files. The report distinguishes
 file identity, supported source formats, opaque content, exact capsule/source
-links and capture-manifest attachment matches. Include the capture manifest and
+links, declared image derivation and capture-manifest attachment matches.
+Image derivation reports an immediate-parent digest and byte length, editing
+method and operation kinds, not proof of transformation. Parent inclusion matches
+another selected manifest entry by exact byte digest and size; an unselected Case
+attachment reference does not count. Parent pixels are optional; absent declarations
+leave editing history unknown. Include the capture manifest and
 its screenshot/DOM-digest files together to check their declared bytes; original
 filenames are not needed to establish a match. It does not import files or establish source truth, signature trust or a
 trusted timestamp. Unsupported or rejected entries produce a partial report;
 `--strict-exit` returns 4. Without `--package` or `--folder`, `manifest` produces a
-standalone JSON manifest; exact public version-2 manifests remain readable.
+standalone JSON manifest; exact version-2 and version-3 manifests remain readable.
 
 For [BagIt 1.0](https://www.rfc-editor.org/rfc/rfc8493.html) interchange, use
 `--bagit` with `--package` or `--folder` on both commands:
@@ -316,6 +553,17 @@ selected evidence exports, not complete workspace backups.
 
 ### Resuming a fixed workflow
 
+Inspect a paused run without executing any step or rewriting its checkpoint:
+
+```sh
+whoisleuth workflow-run domain-triage example.test --resume run.json --preview --json
+```
+
+The preview separates validated complete and partial outputs, failed steps that
+can be retried, unresolved inputs, pending upstream outputs and fresh approval
+requirements. It does not open selected input files. Preview output goes to
+stdout; approval, interactive and output-file flags cannot be combined with it.
+
 All recipes listed by `workflow-plan --list` can run through `workflow-run`.
 Planning remains offline. Execution emits a checkpoint; terminal output shows
 retained steps, output identities, missing inputs and the next required action.
@@ -348,6 +596,12 @@ remain analyst selections. No external file is inferred or extracted automatical
 disagreement and unavailable evidence separate. Distinct labels do not verify
 independent collection; timing and shared caches can affect the comparison.
 
+`domain-control-flight-recorder` retains the last comparable complete observation
+across failed or partial collections. A changed recovery records the interval
+between complete source observations; it does not assign the change to the
+recovery time. An approved window must contain that entire interval. Historical
+report versions remain readable without acquiring this newer qualification.
+
 For example, registry review can reuse its collection without extracting files:
 
 ```sh
@@ -385,6 +639,52 @@ an interrupted process, confirm that its owner has stopped before removing its
 abandoned lock. Locks have no automatic expiry. Shell redirection and external
 editors do not participate in this cooperative file-ownership protocol.
 
+### Managed indicator revisions
+
+`indicator-set` uses the same file-backed revision model as Bulk. It performs
+no collection or submission. A plan names the set, gives a review `basis` and
+UTC `expiresAt`, and supplies `rows` plus an explicit `selectedDomains` list.
+Rows use the normal Bulk eligibility rules, including available profile
+context, a Suspicious or Confirmed abuse disposition and retained risk evidence.
+Supply `officialDomains`, `allowlistedDomains` and `commonInfrastructureDomains`
+where applicable; excluded candidates never become additions.
+
+Example plan shape (fictional input; replace the evidence and expiry):
+
+```json
+{
+  "name": "Reviewed candidates",
+  "basis": "Reviewed the selected page observation",
+  "expiresAt": "2026-10-23T00:00:00.000Z",
+  "selectedDomains": ["candidate.example.test"],
+  "rows": [{
+    "domain": "candidate.example.test", "availability": "registered",
+    "analystDisposition": "suspicious", "risk": 80,
+    "profileContext": { "sourceState": "ready" }
+  }]
+}
+```
+
+```sh
+whoisleuth indicator-set revise indicator-plan.json --json --output indicators-r1.json
+whoisleuth indicator-set inspect indicators-r1.json
+whoisleuth verify-artifact indicators-r1.json --strict-exit
+whoisleuth indicator-set stix indicators-r1.json --output indicators-r1.stix.json
+whoisleuth indicator-set misp indicators-r1.json --output indicators-r1.misp.json
+```
+
+Later plans embed the last manifest as `previous` and explicitly list `renewIds`
+or `withdrawIds`. New domains still require reviewed rows and selection.
+`reintroduceDomains` permits a previously withdrawn domain to receive a new
+identity; it never revives the old one. Missing domains stay unchanged.
+Renewal updates the review window and note, not the original observation.
+
+Keep previous manifests and use separate output paths. File ownership checks
+reject concurrent source/destination changes and refuse replacing the input,
+even with `--force`. STIX and MISP operations always emit JSON. MISP expiry is
+a review deadline, not automatic deletion; exports require separate recipient
+review. Digests verify content, not authorship or an unavailable earlier chain.
+
 ### Formats and exit behaviour
 
 Terminal text is the default. Commands expose JSON, JSONL, CSV, Markdown, HTML
@@ -414,7 +714,20 @@ diagnostics, and missing health metadata remains unmeasured.
 collection times visible. Source-output and review-generation times do not
 stand in for missing observation times. `domain-change` and
 `domain-change-packet` retain authority, resolver and certificate observation
-times; previously published version-2 packets remain verifiable.
+times; previously published version-2 and version-3 packets remain verifiable.
+Current DNS convergence and domain-change inputs use version 2. Each snapshot
+declares `queries`, for example
+`[{"owner":"example.test","type":"MX","state":"observed"}]`.
+An `observed` query with no matching records means an empty answer; `partial`
+and `unavailable` queries do not. Omitted queries are not queried. Version-1
+inputs remain readable but establish query scope only for supplied records.
+An expected empty set alone cannot establish an observed empty answer.
+
+Domain-control review version 3 keeps renewal reminders separate from observed
+configuration: `due` and `not_due` describe the chosen review date, not DNS or
+registration changes. Incomplete evidence remains `partial` even when a reminder
+is due. Terminal and JUnit summaries report due reminders separately. Previous
+review and monitor checkpoints retain their original versioned interpretation.
 
 ## Exit codes
 
@@ -426,6 +739,11 @@ For scripts, use `whoisleuth verify-artifact evidence.json --json --strict-exit`
 An incomplete verification returns **4** with that option. Without it, **0**
 means a report was produced, not that the artefact passed verification; inspect
 the report's state and checks.
+Unencrypted workspace archives retain mutable root metadata outside their
+section digests, so they return 4 under `--strict-exit` even when all supported
+section checks pass. Structure-only exports can pass their narrower contract;
+strict exit is not a ranking of cryptographic assurance. `interchange-report`
+separately describes import/export support and is not the full verifier inventory.
 
 ## Command details
 

package/docs/contextual-reviews.md

@@ -0,0 +1,178 @@
+# Contextual evidence reviews
+
+Cases → Evidence → **Specialist evidence reviews** offers incident-sequence, domain-history,
+platform-object, storefront and connector reviews. Inputs stay in page memory until you
+save or download. Saved reports use the existing Case attachment and evidence
+summary controls; select the report file explicitly when preparing a response
+packet. Switching tasks or Case sections preserves opened drafts; leaving the Case
+discards them. Save the review in the Case, download its JSON, or print a summary.
+Reusable inputs are a separate download. Storefront columns keep unreviewed fields
+distinct from reviewed fields with no values; platform histories separate report
+status, provider response and independent recheck. Sources and interpretation are
+available beneath each review, with exact observation times and citation copying.
+
+The CLI uses the same models:
+
+```sh
+whoisleuth review-evidence selected-input.json --json --strict-exit
+```
+
+Each input has `schema`, a supported `version` and `evidence`. Most inputs use
+version 1; domain history also supports version 2 as described below. Unknown
+versions and fields are rejected. Inputs are bounded to 16 MiB; each supplied context list permits
+200 records. `--strict-exit` returns 4 for a partial contextual review. Neither
+adapter contacts a destination or executes selected software.
+
+## Incident sequence
+
+Build an analyst-ordered sequence from retained Case pins, imported records and
+reported actions. A retained pin supplies its own source, time, completeness and
+limitations; unknown times stay unknown. Reordering is deliberate, and reversed
+timestamps are flagged without rewriting the sequence. A displayed instruction
+is not recorded as a person having followed it.
+
+Schema: `whoisleuth.incident-sequence.input`. `evidence` is an array:
+
+```json
+{
+  "schema": "whoisleuth.incident-sequence.input", "version": 1,
+  "evidence": [{
+    "id": "stage-1", "kind": "credential_entry", "basis": "reported_action",
+    "description": "The reporter entered a password into the displayed form.",
+    "occurredAt": null, "hostname": "example.test",
+    "source": "Reporter interview", "reference": "interview-17",
+    "referenceSha256": null, "completeness": "unknown",
+    "limitations": ["Event time not supplied."]
+  }]
+}
+```
+
+Kinds cover messages, navigation, identity prompts, credential entry, consent,
+browser instructions, clipboard events, local execution, payment, recovery and
+other events. Basis is `retained_observation`, `imported_record` or
+`reported_action`. Reference hashes identify the supplied record; they do not
+authenticate its source. Save the reusable input with the review to continue
+later. These stages never execute a command, submit a form or open a destination.
+
+## Domain history and retirement
+
+The Case view compares retained snapshots using the existing source, hostname,
+scan-depth and model-version rules. Registration, DNS, mail and web changes are
+shown alongside source-qualified certificate pins.
+Registration and nameserver changes target the Case registration domain; mail
+and web changes target the explicit observation hostname. Certificate pins keep
+their own hostname, or an unknown target when none was retained. These targets
+are preserved in review downloads, retained reports and print previews.
+Equal-time observations are not ordered into a change sequence. Retired dependencies must involve the Case
+domain or one of its hostnames. An expected window qualifies the review; it does
+not approve a change automatically or establish transfer or takeover.
+Review prompts connect comparable page, mail, delegation and registration changes
+to the retained concern. Incomplete comparisons remain visible. A changed creation
+date asks for reassessment of earlier decisions without asserting a new owner,
+resetting a baseline or discarding history; expiry alone never establishes deletion.
+
+Schema: `whoisleuth.domain-history.input`. Its `evidence` contains:
+
+- `caseExport`: an ordinary supported editable Case export, with `version` and
+  `cases`; the exact existing Case reader rejects data loss or silent repair.
+- `caseId`: the Case selected from that export.
+- `declarations`: `expectedChanges` and `retiredDependencies` arrays; version 2
+  also requires `registrationBoundaries`. Version 1 remains readable unchanged.
+
+An expected change is `{family, start, end, reason}`. A retired dependency is
+`{asset, dependency, family, retiredAt, source}`. Families are `registration`,
+`dns`, `mail`, `certificate` and `web`; times are explicit ISO timestamps. The
+reusable input download includes the selected Case and is not duplicated in
+workspace storage when saving the report.
+
+Version-2 registration boundaries are analyst declarations, not confirmed
+registration epochs. Each has `{kind, occurredAt, source, rationale,
+snapshotIds, evidencePinIds}`. Kinds are `registration_reported`,
+`deletion_reported`, `reregistration_reported`, `transfer_reported` and
+`review_boundary`. Supply an explicit ISO time and at least one exact reference
+to a snapshot or evidence pin retained in the selected Case. References must be
+unique; unavailable references fail rather than selecting a replacement.
+Up to 40 boundaries and 20 references of each type per boundary are accepted.
+
+The Case history form exposes the same declarations. Reports count retained
+observations before and at/after a declared time without assigning ownership or
+asserting that deletion, re-registration or transfer occurred. Earlier evidence,
+decisions, exceptions and open follow-ups are not rewritten. Reports retain the
+declared source and exact evidence references, and can be deliberately saved as
+ordinary Case files. The reusable input remains a separate download containing
+the selected Case, not an additional workspace copy.
+
+## Platform objects
+
+Schema: `whoisleuth.platform-continuity.input`. `evidence` is an array:
+
+```json
+{
+  "schema": "whoisleuth.platform-continuity.input",
+  "version": 1,
+  "evidence": [{
+    "platformOrigin": "https://platform.example.test",
+    "objectType": "extension", "objectId": "extension-17", "version": "1.0.0",
+    "observedAt": "2026-09-22T00:00:00.000Z", "source": "Selected manifest",
+    "report": "acknowledged", "providerOutcome": "provider_reports_resolved",
+    "recheck": "not_checked", "recheckedAt": null
+  }]
+}
+```
+
+Object types include account, tenant, application, extension, package, page,
+channel and post. Identity is scoped to platform origin and object type, not a
+URL alone. Version is nullable. Report status is `not_reported`, `submitted` or
+`acknowledged`. Provider outcomes and independent rechecks use the existing Case
+response vocabulary. A recheck needs its own time; provider resolution does not
+establish removal. Save or download the reusable input to add later observations.
+
+## Storefronts
+
+Schema: `whoisleuth.storefront-review.input`. `evidence` contains `official`,
+`candidate`, `authorisedComparator: true`, `resellerStatus` and `resellerSource`.
+Reseller status is `authorised`, `not_authorised` or `unknown`; a non-unknown
+declaration needs a source. Both observations use this shape:
+
+```json
+{
+  "hostname": "shop.example.test",
+  "observedAt": "2026-09-22T00:00:00.000Z", "source": "Selected capture",
+  "brandNames": ["Example shop"], "contactDomains": ["example.test"],
+  "policyHashes": null, "checkoutOrigins": ["https://checkout.example.test"],
+  "paymentMethods": ["card"], "assetHashes": null
+}
+```
+
+Null means not reviewed; an empty array means no values were recorded. Policy
+and asset hashes are lowercase hexadecimal SHA-256. Checkout values are origins
+only. Exact shared values are displayed without a combined scam score. Check
+reseller, affiliate and regional-store authority before preparing a complaint.
+
+## Connectors
+
+Schema: `whoisleuth.connector-review.input`. `evidence` contains `current` and
+nullable `previous` configuration objects, each with exactly one `mcpServers`
+or `servers` map. Select that section rather than unrelated application settings.
+
+```json
+{
+  "schema": "whoisleuth.connector-review.input", "version": 1,
+  "evidence": {
+    "current": {"mcpServers": {
+      "remote": {"url": "https://connector.example.test/service"},
+      "local": {"command": "npx", "args": ["--yes", "@example/connector@1.0.0"]}
+    }},
+    "previous": null
+  }
+}
+```
+
+The browser accepts the configuration itself. Reports retain names, endpoint
+origins, executable basenames, recognised package identities, declared
+capabilities and metadata counts. They exclude local paths, argument contents,
+environment values, header values, authentication material and URL paths or
+queries. Raw configuration is not saved with the report. Matching retained
+metadata does not mean excluded values are unchanged. No command, connector,
+tool, prompt or model is run; declarations are not negotiated capabilities or a
+safety assessment.