@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/packages/cases/case-containment-handoff.mjs

@@ -0,0 +1,195 @@
+import { projectCaseForAudience } from "./case-record-projection.mjs";
+import { readEditableCaseExport } from "./case-export-input.mjs";
+import { array, enumeration, exact, iso, text } from "../evidence/artifact-structure.mjs";
+import { escapeCaseMarkdownInline } from "./case-markdown.mjs";
+import { MAX_CASE_ASSERTIONS, MAX_CASE_EVIDENCE_PINS } from "../contracts/case-portability.mjs";
+import { caseSelectedEvidenceSourceLimitations } from "./case-evidence-links.mjs";
+export const CASE_CONTAINMENT_INPUT_SCHEMA = 'whoisleuth.internal-containment.input';
+export const CASE_CONTAINMENT_HANDOFF_SCHEMA = 'whoisleuth.internal-containment';
+export const CASE_CONTAINMENT_VERSION = 1;
+export const MAX_CONTAINMENT_ASSERTIONS = 20;
+export const MAX_CONTAINMENT_PINS = 40;
+export const MAX_CONTAINMENT_OUTPUT_BYTES = 128 * 1024;
+export const CONTAINMENT_RECIPIENT_ROLES = [
+    'security_operations',
+    'identity_response',
+    'endpoint_response',
+    'network_response',
+];
+const ROLE_GUIDANCE = {
+    security_operations: [
+        'Confirm the responsible internal owner and track the selected requests independently of external removal.',
+        'Separate reported actions, retained observations and unresolved evidence before authorising a control.',
+    ],
+    identity_response: [
+        'Review the selected requests against authorised account, session and application-grant evidence in the identity system.',
+        'Do not treat a reported password entry, sign-in approval or provider resolution as proof of account compromise or recovery.',
+    ],
+    endpoint_response: [
+        'Review the selected requests against authorised device evidence before deciding whether isolation, collection or remediation is needed.',
+        'Do not execute supplied commands or attachments; a reported execution is not a verified device outcome.',
+    ],
+    network_response: [
+        'Review exact scope, collateral effects and an appropriate review/expiry period before applying an approved network control.',
+        'Shared infrastructure and literal indicators do not establish ownership, maliciousness or an appropriate blocking scope.',
+    ],
+};
+function uniqueIds(value, maximum, label) {
+    const ids = array(value, label, maximum).map((id) => text(id, label, 240));
+    if (new Set(ids).size !== ids.length)
+        throw new TypeError(`${label} must be unique.`);
+    return ids;
+}
+export function readContainmentSelection(raw) {
+    const value = exact(raw, ['audience', 'recipientRole', 'assertionIds', 'evidencePinIds'], 'Containment handoff selection');
+    return {
+        audience: enumeration(value.audience, ['internal', 'trusted', 'public'], 'Handoff audience'),
+        recipientRole: enumeration(value.recipientRole, CONTAINMENT_RECIPIENT_ROLES, 'Internal recipient role'),
+        assertionIds: uniqueIds(value.assertionIds, MAX_CONTAINMENT_ASSERTIONS, 'Selected follow-ups'),
+        evidencePinIds: uniqueIds(value.evidencePinIds, MAX_CONTAINMENT_PINS, 'Selected supporting pins'),
+    };
+}
+/** Select retained assertions; never infer completed containment from Case or provider status. */
+export function previewCaseContainmentHandoff(record, raw, generatedAt) {
+    iso(generatedAt, 'Handoff generation time');
+    const selection = readContainmentSelection(raw);
+    array(record.assertions, 'Retained Case assertions', MAX_CASE_ASSERTIONS);
+    array(record.evidencePins, 'Retained Case pins', MAX_CASE_EVIDENCE_PINS);
+    const followUps = record.assertions.filter((item) => item.kind === 'next_step');
+    const original = selection.assertionIds.map((id) => {
+        const matches = followUps.filter((item) => item.id === id);
+        if (matches.length !== 1)
+            throw new TypeError('A selected follow-up is missing or ambiguous; refresh the selection.');
+        return matches[0];
+    });
+    const linkedIds = new Set(original.flatMap((item) => item.evidencePinIds));
+    for (const id of selection.evidencePinIds) {
+        if (!linkedIds.has(id) || record.evidencePins.filter((pin) => pin.id === id).length !== 1)
+            throw new TypeError('Select only uniquely retained pins linked to the selected follow-ups.');
+    }
+    const permitted = selection.audience !== 'public';
+    // Reuse the canonical audience policy before constructing a narrow projection.
+    const projected = projectCaseForAudience(record, selection.audience);
+    const pins = permitted
+        ? projected.evidencePins.filter((pin) => selection.evidencePinIds.includes(pin.id))
+        : [];
+    const assertions = permitted
+        ? original.map((item) => {
+            const selected = projected.assertions.find((assertion) => assertion.id === item.id);
+            return {
+                id: selected.id,
+                kind: 'next_step',
+                statement: selected.statement,
+                rationale: selected.rationale,
+                state: selected.state,
+                createdAt: selected.createdAt,
+                updatedAt: selected.updatedAt,
+                provenance: selected.provenance ?? null,
+                recheck: selected.recheck ?? null,
+                evidence: selected.evidencePinIds.map((id) => ({
+                    evidencePinId: id,
+                    stance: selected.evidenceRelations?.find((relation) => relation.evidencePinId === id)
+                        ?.stance ?? 'not_recorded',
+                    state: pins.some((pin) => pin.id === id)
+                        ? 'included'
+                        : record.evidencePins.some((pin) => pin.id === id)
+                            ? 'not_selected'
+                            : 'unavailable',
+                })),
+            };
+        })
+        : [];
+    const missingContext = assertions.some((item) => !item.evidence.length || item.evidence.some((link) => link.state !== 'included'));
+    const report = {
+        schema: CASE_CONTAINMENT_HANDOFF_SCHEMA,
+        version: CASE_CONTAINMENT_VERSION,
+        generatedAt,
+        audience: selection.audience,
+        recipientRole: selection.recipientRole,
+        case: { id: projected.id, domain: projected.domain, status: projected.status },
+        state: !permitted ||
+            !assertions.length ||
+            missingContext ||
+            pins.some((pin) => pin.completeness !== 'complete' || pin.truncated === true)
+            ? 'partial'
+            : 'reviewed',
+        reviewRequired: true,
+        actionsPerformed: false,
+        assertions,
+        evidencePins: pins,
+        disclosure: {
+            exportAllowed: permitted && assertions.length > 0,
+            included: permitted
+                ? [
+                    'Case identifier, domain and recorded status',
+                    'Only selected next-step statements, rationale, states and recording times',
+                    'Exact selected supporting pins and separately qualified evidence relationships',
+                ]
+                : ['Case identifier, domain and recorded status only'],
+            excluded: [
+                'Unselected assertions and evidence',
+                'Case title, notes, contacts, action recipients and original files',
+                'Raw upstream responses, automatic assignments and control execution',
+                ...(permitted ? [] : ['Internal follow-up statements and their supporting pins']),
+            ],
+            caution: 'Selected statements and pin values can contain sensitive analyst text or exact scope. Review each included value for the intended recipient; minimisation is not automatic anonymisation.',
+        },
+        nextSteps: [...ROLE_GUIDANCE[selection.recipientRole]],
+        limitations: [
+            'These are retained analyst requests, not verified assignments, executed controls or independent recovery results.',
+            'Open and resolved assertion states are preserved as recorded. External provider resolution, object closure and Case status do not resolve open internal requests.',
+            'Unselected or missing supporting pins remain explicit. A linked pin may support, contradict or leave a request unresolved; linkage does not establish truth.',
+            'This local handoff sends no message, changes no Case state and includes no original attachment bytes.',
+            ...caseSelectedEvidenceSourceLimitations(pins, record.evidenceLinks, pins.map(pin => pin.id)),
+        ],
+    };
+    if (new TextEncoder().encode(JSON.stringify(report)).byteLength > MAX_CONTAINMENT_OUTPUT_BYTES)
+        throw new TypeError('The selected handoff exceeds 128 KiB. Choose fewer follow-ups or pins; nothing was silently omitted.');
+    return report;
+}
+export function buildCaseContainmentHandoff(record, selection, generatedAt, disclosureReviewed) {
+    const report = previewCaseContainmentHandoff(record, selection, generatedAt);
+    if (!disclosureReviewed || !report.disclosure.exportAllowed)
+        throw new TypeError('Review the audience disclosure and select at least one retained follow-up for an internal or trusted handoff.');
+    return report;
+}
+export function readCaseContainmentInput(raw, generatedAt) {
+    const input = exact(raw, ['schema', 'version', 'caseExport', 'caseId', 'selection', 'disclosureReviewed'], 'Containment handoff input');
+    if (input.schema !== CASE_CONTAINMENT_INPUT_SCHEMA || input.version !== CASE_CONTAINMENT_VERSION)
+        throw new TypeError('Unsupported containment handoff input version.');
+    const caseId = text(input.caseId, 'Selected Case ID', 240);
+    const selected = readEditableCaseExport(JSON.stringify(input.caseExport)).filter((record) => record.id === caseId);
+    if (selected.length !== 1)
+        throw new TypeError('Select one unambiguous Case from the supported export.');
+    if (input.disclosureReviewed !== true)
+        throw new TypeError('The selected handoff requires an explicit audience-disclosure review.');
+    return buildCaseContainmentHandoff(selected[0], readContainmentSelection(input.selection), generatedAt, true);
+}
+export function formatCaseContainmentHandoff(report) {
+    const escape = escapeCaseMarkdownInline;
+    const lines = [
+        `# Internal containment handoff`,
+        '',
+        `Audience: ${report.audience} · ${report.recipientRole.replaceAll('_', ' ')}`,
+        `Case: ${escape(report.case.domain)} · ${escape(report.case.id)} · recorded status ${escape(report.case.status)}`,
+        `Generated: ${report.generatedAt} · coverage ${report.state} · no actions performed`,
+        '',
+        '## Selected retained requests',
+        '',
+    ];
+    for (const item of report.assertions) {
+        lines.push(`- ${escape(item.statement)} — ${item.state} (${escape(item.id)})`);
+        if (item.rationale)
+            lines.push(`  Rationale: ${escape(item.rationale)}`);
+        lines.push(`  Recorded ${escape(item.createdAt)}; updated ${escape(item.updatedAt)}.`);
+        for (const link of item.evidence)
+            lines.push(`  Evidence ${escape(link.evidencePinId)}: ${link.stance}; ${link.state.replaceAll('_', ' ')}.`);
+        if (!item.evidence.length)
+            lines.push('  No supporting context was linked.');
+    }
+    lines.push('', '## Selected supporting evidence', '');
+    for (const pin of report.evidencePins)
+        lines.push(`- ${escape(pin.label)} (${escape(pin.id)}): ${escape(pin.value)}`, `  Source: ${escape(pin.source)}; observed ${escape(pin.observedAt ?? 'unknown')}; ${pin.completeness}${pin.truncated ? '; truncated' : ''}.`, ...pin.limitations.map((value) => `  Limitation: ${escape(value)}`));
+    lines.push('', '## Recipient review', '', ...report.nextSteps.map((value) => `- ${value}`), '', '## Boundaries', '', ...report.limitations.map((value) => `- ${value}`));
+    return `${lines.join('\n')}\n`;
+}

package/packages/cases/case-evidence-links.mjs

@@ -0,0 +1,151 @@
+import { array, enumeration, exact, exactOptional, iso, text } from "../evidence/artifact-structure.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { MAX_CASE_EVIDENCE_PINS, MAX_RESPONSE_RATIONALE_LENGTH } from "../contracts/case-portability.mjs";
+import { SAFE_ID_RE, freshId } from "./case-response-values.mjs";
+export const CASE_EVIDENCE_LINK_KINDS = ['derived_from', 'shared_source'];
+/** Enough for both directed relationships between every admitted pin pair. */
+export const MAX_CASE_EVIDENCE_LINKS = MAX_CASE_EVIDENCE_PINS * (MAX_CASE_EVIDENCE_PINS - 1) * CASE_EVIDENCE_LINK_KINDS.length;
+function identifier(value) {
+    const id = text(value, 'Evidence link identity', 64);
+    if (!SAFE_ID_RE.test(id))
+        throw new TypeError('Evidence link identity is invalid.');
+    return id;
+}
+function explanation(value) {
+    const result = text(value, 'Evidence relationship basis', MAX_RESPONSE_RATIONALE_LENGTH).trim();
+    if (!result)
+        throw new TypeError('Explain the evidence relationship.');
+    return result;
+}
+export function readCaseEvidenceLinks(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Evidence relationships');
+    const links = array(value, 'Evidence relationships', MAX_CASE_EVIDENCE_LINKS).map(raw => {
+        const row = exactOptional(raw, ['id', 'fromPinId', 'toPinId', 'kind', 'basis', 'createdAt'], ['withdrawal'], 'Evidence relationship');
+        const fromPinId = identifier(row.fromPinId), toPinId = identifier(row.toPinId);
+        if (fromPinId === toPinId)
+            throw new TypeError('An evidence pin cannot derive from or share a source with itself.');
+        iso(row.createdAt, 'Relationship recording time');
+        let withdrawal;
+        if (row.withdrawal !== undefined) {
+            const item = exact(row.withdrawal, ['at', 'reason'], 'Relationship withdrawal');
+            iso(item.at, 'Withdrawal time');
+            if (Date.parse(item.at) < Date.parse(row.createdAt))
+                throw new TypeError('Withdrawal precedes the relationship.');
+            withdrawal = { at: item.at, reason: explanation(item.reason) };
+        }
+        return { id: identifier(row.id), fromPinId, toPinId,
+            kind: enumeration(row.kind, CASE_EVIDENCE_LINK_KINDS, 'Evidence relationship kind'),
+            basis: explanation(row.basis), createdAt: row.createdAt, ...(withdrawal ? { withdrawal } : {}) };
+    });
+    if (new Set(links.map(link => link.id)).size !== links.length)
+        throw new TypeError('Evidence relationship identities must be unique.');
+    return links;
+}
+function derivationGraph(links) {
+    const graph = new Map();
+    for (const link of links)
+        if (!link.withdrawal && link.kind === 'derived_from') {
+            const neighbours = graph.get(link.fromPinId) ?? [];
+            neighbours.push(link.toPinId);
+            graph.set(link.fromPinId, neighbours);
+        }
+    return graph;
+}
+function reaches(graph, from, to) {
+    const pending = [from], visited = new Set();
+    while (pending.length) {
+        const id = pending.pop();
+        if (id === to)
+            return true;
+        if (visited.has(id))
+            continue;
+        visited.add(id);
+        pending.push(...(graph.get(id) ?? []));
+    }
+    return false;
+}
+export function appendCaseEvidenceLink(current, input, pins, now) {
+    const row = exact(input, ['fromPinId', 'toPinId', 'kind', 'basis'], 'New evidence relationship');
+    const link = readCaseEvidenceLinks([{ ...row, id: freshId('evidence-link'), createdAt: now }])[0];
+    const ids = new Set(pins.map(pin => pin.id));
+    if (!ids.has(link.fromPinId) || !ids.has(link.toPinId))
+        throw new TypeError('Select two retained evidence pins.');
+    if (current.some(item => !item.withdrawal && item.kind === link.kind
+        && ((item.fromPinId === link.fromPinId && item.toPinId === link.toPinId)
+            || (link.kind === 'shared_source' && item.fromPinId === link.toPinId && item.toPinId === link.fromPinId)))) {
+        throw new TypeError('This evidence relationship is already recorded. Withdraw it before recording a replacement.');
+    }
+    if (link.kind === 'derived_from' && reaches(derivationGraph(current), link.toPinId, link.fromPinId))
+        throw new TypeError('This derivation would create a cycle. Review the existing links first.');
+    return readCaseEvidenceLinks([...current, link]);
+}
+export function withdrawCaseEvidenceLink(current, input, now) {
+    const row = exact(input, ['id', 'reason'], 'Evidence relationship withdrawal');
+    const id = identifier(row.id), existing = current.find(link => link.id === id);
+    if (!existing || existing.withdrawal)
+        throw new TypeError('This relationship is missing or already withdrawn. Refresh before reviewing it.');
+    return readCaseEvidenceLinks(current.map(link => link.id === id ? { ...link, withdrawal: { at: now, reason: explanation(row.reason) } } : link));
+}
+/** Keep unresolved references; an imported pin can have been omitted by its source. */
+export function mergeCaseEvidenceLinks(local, incoming) {
+    if (local === undefined && incoming === undefined)
+        return undefined;
+    const merged = new Map((readCaseEvidenceLinks(local) ?? []).map(link => [link.id, link]));
+    for (const link of readCaseEvidenceLinks(incoming) ?? []) {
+        const existing = merged.get(link.id);
+        if (!existing) {
+            merged.set(link.id, link);
+            continue;
+        }
+        const { withdrawal: left, ...a } = existing, { withdrawal: right, ...b } = link;
+        if (JSON.stringify(a) !== JSON.stringify(b) || (left && right && JSON.stringify(left) !== JSON.stringify(right))) {
+            throw new TypeError('An imported evidence relationship conflicts with retained provenance. No relationship was overwritten.');
+        }
+        merged.set(link.id, { ...a, ...((left ?? right) ? { withdrawal: left ?? right } : {}) });
+    }
+    return readCaseEvidenceLinks([...merged.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
+export function caseEvidenceLinkIssues(links, pins) {
+    const ids = new Set(pins.map(pin => pin.id));
+    const graph = derivationGraph(links);
+    return links.map(link => ({ link,
+        missingPinIds: [link.fromPinId, link.toPinId].filter(id => !ids.has(id)),
+        cyclic: !link.withdrawal && link.kind === 'derived_from' && reaches(graph, link.toPinId, link.fromPinId),
+    }));
+}
+/** Matching context is disclosed, never counted as independent corroboration. */
+export function caseEvidenceSharedContext(pins) {
+    const groups = new Map();
+    function add(kind, identity, label, id) {
+        if (!identity?.trim())
+            return;
+        const key = JSON.stringify([kind, identity]);
+        const group = groups.get(key) ?? { kind, label, pinIds: [] };
+        group.pinIds.push(id);
+        groups.set(key, group);
+    }
+    for (const pin of pins) {
+        add('checkpoint', pin.checkpointId, 'Same collection checkpoint', pin.id);
+        add('import', pin.importContentSha256, 'Same imported content', pin.id);
+        add('source', pin.source, `Same declared source: ${pin.source}`, pin.id);
+    }
+    return [...groups.values()].filter(group => group.pinIds.length > 1);
+}
+export const CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION = 'Selected evidence has retained shared-source or derivation context. Multiple references do not establish independent observations; underlying reporting or collection methods may remain unknown. Relationship details are not included in this output.';
+/** Qualify a narrow disclosure without exposing relationship identities or private basis text. */
+export function caseSelectedEvidenceSourceLimitations(pins, links, selectedPinIds) {
+    array(pins, 'Retained evidence pins', MAX_CASE_EVIDENCE_PINS);
+    array(links ?? [], 'Retained evidence relationships', MAX_CASE_EVIDENCE_LINKS);
+    array(selectedPinIds, 'Selected evidence pins', MAX_CASE_EVIDENCE_PINS);
+    const requested = new Set(selectedPinIds);
+    const selectedPins = pins.filter(pin => requested.has(pin.id));
+    const selected = new Set(selectedPins.map(pin => pin.id));
+    if (!selected.size)
+        return [];
+    const declared = links?.some(link => !link.withdrawal
+        && (selected.has(link.fromPinId) || selected.has(link.toPinId)));
+    return declared || caseEvidenceSharedContext(selectedPins).length
+        ? [CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION] : [];
+}

package/packages/cases/case-evidence-model.mjs

@@ -1,12 +1,13 @@
 // Pure, framework-neutral analyst-case records, evidence histories, bounded
 // record normalization, and analyst updates.
-import { normalizeHttpSummary } from "./http-summary.mjs";
-import { normalizeOpportunityModelVersion } from "../../lib/opportunity-scoring.mjs";
-import { normalizeRiskModelVersion } from "../../lib/risk-scoring.mjs";
+import { httpSummaryFieldIsObserved, normalizeHttpSummary } from "./http-summary.mjs";
+import { normalizeOpportunityModelVersion } from "../analysis/opportunity-scoring.mjs";
+import { normalizeRiskModelVersion } from "../analysis/risk-scoring.mjs";
 import { latestObservationCohort } from "../evidence/latest-observations.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, OBJECT_RESPONSE_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
 import { validWebObservationMode } from "../evidence/lookup-target.mjs";
+import { normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
 import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.mjs";
 import { CONCLUSIVE_AVAILABILITY, DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_RANK, EVIDENCE_SOURCE_SET, REGISTERED_LIKE, caseTimestampOrNull, hashString, isoOrNull, normalizeEvidenceHostnameForCase, objectRecord, safeId, } from "./case-record-core.mjs";
 function evidenceString(value, max = MAX_EVIDENCE_STRING_LENGTH) {
@@ -112,6 +113,7 @@ const DEEP_SIGNAL_FIELDS = [
     'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
     'pageBaselineMatch',
+    'hasExternalPasswordForm',
 ];
 // Ordered list of the fields that make up a snapshot's *material* identity -
 // everything except capture timestamps, snapshot id and source. `scanDepth` is
@@ -122,6 +124,7 @@ const MATERIAL_FIELD_ORDER = [
     'observationHostname',
     'webObservationMode',
     'scanDepth',
+    'webCollectionQuality',
     'availability', 'confidence', 'riskModelVersion', 'riskScore', 'opportunityModelVersion', 'opportunityScore',
     'riskFactors', 'opportunityFactors',
     'registrar', 'createdDate', 'expiryDate', 'nameservers',
@@ -133,6 +136,7 @@ const MATERIAL_FIELD_ORDER = [
     'privacyProtected', 'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
     'profileContextState', 'profileContextLimitation',
     'mutationTypes',
+    'hasExternalPasswordForm',
 ];
 // The canonical, comparison-safe value of a material field. Registrar casing,
 // nameserver order, and sub-day timestamps are collapsed so they can never
@@ -174,7 +178,7 @@ function isEmptyMaterial(value) {
 }
 // Fields that describe the capture rather than assert evidence, so they never
 // on their own keep an otherwise-empty snapshot alive.
-const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'observationHostname', 'webObservationMode', 'scanDepth', 'confidence']);
+const NON_EVIDENCE_MATERIAL = new Set(['inputHostname', 'observationHostname', 'webObservationMode', 'scanDepth', 'webCollectionQuality', 'confidence']);
 // A snapshot with no material evidence (only timestamps/source/depth, or only a
 // bare confidence/unknown-availability) is dropped rather than added to a
 // timeline.
@@ -194,7 +198,7 @@ function canonicalMaterialString(snapshot, legacyOrder = false) {
         const value = materialValue(field, snapshot, legacyOrder);
         // Optional collection context does not alter historical fingerprints when
         // absent; recorded context separates otherwise-identical captures.
-        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode') && value === null)
+        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode' || field === 'webCollectionQuality' || field === 'hasExternalPasswordForm') && value === null)
             continue;
         canonical[field] = value;
     }
@@ -221,6 +225,8 @@ function buildSnapshot(raw, options) {
     if (!raw || typeof raw !== 'object')
         return null;
     const record = objectRecord(raw);
+    if (record.hasExternalPasswordForm !== undefined && options.sourceVersion != null && options.sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Password-form attribution requires Case schema 18 or later; historical evidence was not reinterpreted.');
     if (record.factorOrder !== undefined && record.factorOrder !== 'code-unit-v1')
         return null;
     const historicalSchema = options.sourceVersion !== undefined && Number(options.sourceVersion) <= PUBLISHED_V2_3_CASE_SCHEMA_VERSION;
@@ -231,6 +237,10 @@ function buildSnapshot(raw, options) {
     const legacyOrder = historicalSchema || (record.factorOrder === undefined && typeof record.fingerprint === 'string');
     const scanDepth = normalizeScanDepth(record.scanDepth);
     const httpSummary = normalizeHttpSummary(record);
+    const webCollectionQuality = normalizeWebCollectionQuality(record.webCollectionQuality, scanDepth);
+    if (webCollectionQuality && options.sourceVersion != null && options.sourceVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION) {
+        throw new TypeError('Web collection quality requires Case schema 17 or later; historical evidence was not reinterpreted.');
+    }
     const acceptsProfileContext = options.sourceVersion === undefined || Number(options.sourceVersion) >= 12;
     const acceptsInputHostname = options.sourceVersion === undefined || Number(options.sourceVersion) >= 13;
     const acceptsObservationHostname = options.sourceVersion === undefined || Number(options.sourceVersion) > PUBLISHED_V2_3_CASE_SCHEMA_VERSION;
@@ -248,6 +258,7 @@ function buildSnapshot(raw, options) {
         ...(observationHostname ? { observationHostname } : {}),
         ...(acceptsObservationHostname && scanDepth !== 'fast' && record.webObservationMode === 'selected_url' ? { webObservationMode: record.webObservationMode } : {}),
         scanDepth,
+        ...(webCollectionQuality ? { webCollectionQuality } : {}),
         availability: evidenceString(record.availability),
         confidence: evidenceString(record.confidence),
         riskModelVersion: normalizeRiskModelVersion(record.riskModelVersion),
@@ -281,6 +292,7 @@ function buildSnapshot(raw, options) {
         reusesOfficialAssets: boolOrNull(record.reusesOfficialAssets),
         hasPasswordField: boolOrNull(record.hasPasswordField),
         hasExternalFormAction: boolOrNull(record.hasExternalFormAction),
+        ...(record.hasExternalPasswordForm === undefined ? {} : { hasExternalPasswordForm: boolOrNull(record.hasExternalPasswordForm) }),
         phishingLanguageMatch: evidenceString(record.phishingLanguageMatch),
         privacyProtected: boolOrNull(record.privacyProtected),
         idnReferenceMatch: boolOrNull(record.idnReferenceMatch),
@@ -300,6 +312,12 @@ function buildSnapshot(raw, options) {
         fields.riskModelVersion = null;
     if (fields.opportunityScore === null && fields.opportunityFactors.length === 0)
         fields.opportunityModelVersion = null;
+    if (webCollectionQuality) {
+        for (const field of ['hasPasswordField', 'hasExternalFormAction', 'hasExternalPasswordForm', 'pageBaselineMatch', 'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets']) {
+            if (fields[field] === false && !webCollectionAllowsComparison(field, webCollectionQuality, scanDepth))
+                fields[field] = null;
+        }
+    }
     // A fast capture never evaluates the deep signals, so any value supplied for
     // them (e.g. a profile's default `false`) is discarded as unevaluated.
     if (scanDepth === 'fast') {
@@ -325,6 +343,7 @@ function buildSnapshot(raw, options) {
             reusesOfficialAssets: null,
             hasPasswordField: null,
             hasExternalFormAction: null,
+            ...(record.hasExternalPasswordForm === undefined ? {} : { hasExternalPasswordForm: null }),
             phishingLanguageMatch: null,
             pageBaselineMatch: null,
         });
@@ -404,6 +423,11 @@ function compareSnapshotChrono(a, b) {
  * @returns {CaseEvidenceSnapshot[]}
  */
 export function normalizeEvidenceHistory(rawList, options = {}) {
+    const ordered = [...evidenceByMaterial(rawList, options).values()].sort(compareSnapshotChrono);
+    const kept = ordered.slice(Math.max(0, ordered.length - MAX_EVIDENCE_SNAPSHOTS_PER_CASE));
+    return assignUniqueSnapshotIds(kept);
+}
+function evidenceByMaterial(rawList, options) {
     const list = Array.isArray(rawList) ? rawList : [];
     const byMaterial = new Map();
     for (const raw of list) {
@@ -415,9 +439,24 @@ export function normalizeEvidenceHistory(rawList, options = {}) {
         // collision can never merge two genuinely different snapshots.
         byMaterial.set(built.material, existing ? mergeDuplicateSnapshots(existing, built.snapshot) : built.snapshot);
     }
-    const ordered = [...byMaterial.values()].sort(compareSnapshotChrono);
-    const kept = ordered.slice(Math.max(0, ordered.length - MAX_EVIDENCE_SNAPSHOTS_PER_CASE));
-    return assignUniqueSnapshotIds(kept);
+    return byMaterial;
+}
+/** Imports add observations without evicting existing local material. Ordinary
+ * collection still uses the newest-history policy in normalizeEvidenceHistory. */
+export function mergeImportedEvidenceHistory(local, imported, caseDomain) {
+    const options = { source: 'import', fallback: null, caseDomain };
+    const retained = evidenceByMaterial(normalizeEvidenceHistory(local, options), options);
+    let omitted = 0;
+    for (const [material, incoming] of evidenceByMaterial(imported, options)) {
+        const existing = retained.get(material);
+        if (existing)
+            retained.set(material, mergeDuplicateSnapshots(existing, incoming));
+        else if (retained.size < MAX_EVIDENCE_SNAPSHOTS_PER_CASE)
+            retained.set(material, incoming);
+        else
+            omitted += 1;
+    }
+    return { records: assignUniqueSnapshotIds([...retained.values()].sort(compareSnapshotChrono)), omitted };
 }
 function assignUniqueSnapshotIds(snapshots) {
     const used = new Set();
@@ -455,6 +494,13 @@ export function latestCaseEvidence(record) {
 }
 /** Chronological presentation and comparison admission shared by the browser and Case report. */
 export function caseEvidenceTimeline(history) {
+    return buildEvidenceTimeline(history, true);
+}
+/** Reproduce published report fields only; not current analyst comparisons. */
+export function publishedCaseEvidenceTimelineForVerification(history) {
+    return buildEvidenceTimeline(history, false);
+}
+function buildEvidenceTimeline(history, enforceCollectionQuality) {
     const dated = (history ?? []).map((snapshot) => ({
         snapshot,
         at: normalizeExplicitIsoTimestamp(snapshot.capturedAt),
@@ -475,10 +521,10 @@ export function caseEvidenceTimeline(history) {
                 ? 'Equal-time snapshots have no unique before-and-after order; no temporal change is inferred.'
                 : null;
         const comparable = previous && !orderingLimitation;
-        const changes = comparable ? compareCaseEvidence(previous.snapshot, snapshot) : [];
+        const changes = comparable ? compareEvidence(previous.snapshot, snapshot, enforceCollectionQuality) : [];
         const incomparableReasons = orderingLimitation
             ? ['other']
-            : comparable ? caseEvidenceIncomparableReasons(previous.snapshot, snapshot) : [];
+            : comparable ? incomparableReasonsForEvidence(previous.snapshot, snapshot, enforceCollectionQuality) : [];
         if (comparable && !changes.length && !incomparableReasons.length
             && canonicalMaterialString(previous.snapshot) !== canonicalMaterialString(snapshot))
             incomparableReasons.push('other');
@@ -543,6 +589,7 @@ const COMPARE_FIELDS = [
     { field: 'reusesOfficialAssets', scope: 'web', label: 'Official asset reuse', type: 'signal', depthGate: 'both-deep' },
     { field: 'hasPasswordField', scope: 'web', label: 'Password form', type: 'signal', depthGate: 'both-deep' },
     { field: 'hasExternalFormAction', scope: 'web', label: 'External form action', type: 'signal', depthGate: 'both-deep' },
+    { field: 'hasExternalPasswordForm', scope: 'web', label: 'Password form with declared external destination', type: 'signal', depthGate: 'both-deep' },
     { field: 'phishingLanguageMatch', scope: 'web', label: 'Phishing language', type: 'phishing', depthGate: 'both-deep' },
     { field: 'mutationTypes', scope: 'hostname', label: 'Mutation types', type: 'set' },
 ];
@@ -562,6 +609,13 @@ function opportunityModelComparable(previous, current) {
 function valuesMateriallyEqual(field, previous, current) {
     return JSON.stringify(materialValue(field, previous)) === JSON.stringify(materialValue(field, current));
 }
+function collectionFieldComparable(field, snapshot) {
+    if (field === 'registrar' || field === 'createdDate' || field === 'expiryDate')
+        return isPresent(snapshot[field]);
+    return field.startsWith('http')
+        ? httpSummaryFieldIsObserved(field, snapshot)
+        : webCollectionAllowsComparison(field, snapshot.webCollectionQuality, snapshot.scanDepth);
+}
 /**
  * Explains material fields that comparison gates deliberately suppress. The
  * reasons are stable machine values for UI/report wording; they are not risk
@@ -569,14 +623,27 @@ function valuesMateriallyEqual(field, previous, current) {
  * in the same observation produced an ordinary material change.
  * @param {CaseEvidenceSnapshot | null | undefined} previous
  * @param {CaseEvidenceSnapshot | null | undefined} current
- * @returns {Array<'observation-context' | 'opportunity-model' | 'scan-depth' | 'risk-model'>}
+ * @returns {Array<'observation-context' | 'opportunity-model' | 'scan-depth' | 'risk-model' | 'collection-quality'>}
  */
 export function caseEvidenceIncomparableReasons(previous, current) {
+    return incomparableReasonsForEvidence(previous, current, true);
+}
+function incomparableReasonsForEvidence(previous, current, enforceCollectionQuality) {
     if (!previous || !current || previous.fingerprint === current.fingerprint)
         return [];
     const reasons = [];
     if (!sameObservationContext(previous, current))
         reasons.push('observation-context');
+    const missingRegistrationValue = ['registrar', 'createdDate', 'expiryDate'].some(field => !valuesMateriallyEqual(field, previous, current) && (!isPresent(previous[field]) || !isPresent(current[field])));
+    const incompleteWebFields = previous.scanDepth === 'deep' && current.scanDepth === 'deep'
+        && (JSON.stringify(previous.webCollectionQuality) !== JSON.stringify(current.webCollectionQuality)
+            || COMPARE_FIELDS.some(spec => (spec.modelGate !== 'risk' || riskModelComparable(previous, current))
+                && (spec.modelGate !== 'opportunity' || opportunityModelComparable(previous, current))
+                && !valuesMateriallyEqual(spec.field, previous, current)
+                && (!collectionFieldComparable(spec.field, previous)
+                    || !collectionFieldComparable(spec.field, current))));
+    if (enforceCollectionQuality && (missingRegistrationValue || incompleteWebFields))
+        reasons.push('collection-quality');
     const hasRiskEvidence = previous.riskScore !== null || current.riskScore !== null
         || previous.riskFactors.length > 0 || current.riskFactors.length > 0;
     if (hasRiskEvidence && !riskModelComparable(previous, current))
@@ -749,6 +816,10 @@ function compareField(spec, before, after) {
             return null;
     }
 }
+/** Field scope is owned by the same specification that gates comparisons. */
+export function caseEvidenceFieldScope(field) {
+    return COMPARE_FIELDS.find(spec => spec.field === field)?.scope ?? null;
+}
 /**
  * Diffs two normalized snapshots into a bounded, stably-ordered list of
  * material changes. Timestamps, source, id and fingerprint are ignored;
@@ -763,6 +834,9 @@ function compareField(spec, before, after) {
  * @returns {Array<{ field: string, label: string, before: unknown, after: unknown, tone: string }>}
  */
 export function compareCaseEvidence(previous, current) {
+    return compareEvidence(previous, current, true);
+}
+function compareEvidence(previous, current, enforceCollectionQuality) {
     if (!previous || !current)
         return [];
     const bothDeep = previous.scanDepth === 'deep' && current.scanDepth === 'deep';
@@ -785,6 +859,9 @@ export function compareCaseEvidence(previous, current) {
             continue;
         if (spec.modelGate === 'opportunity' && !comparableOpportunityModel)
             continue;
+        if (enforceCollectionQuality && (!collectionFieldComparable(spec.field, previous)
+            || !collectionFieldComparable(spec.field, current)))
+            continue;
         const result = compareField(spec, previous[spec.field], current[spec.field]);
         if (result) {
             changes.push({ field: spec.field, label: spec.label, before: result.before, after: result.after, tone: result.tone });

package/packages/cases/case-evidence-quality.mjs

@@ -0,0 +1,5 @@
+/** Collection completeness does not establish a usable date, comparison or conclusion. */
+export function casePinHasCompleteObservation(pin) {
+    return pin.completeness === 'complete' && !pin.truncated
+        && ['complete', 'success', 'reviewed', 'not_found'].includes(pin.sourceState ?? '');
+}

package/packages/cases/case-export-input.mjs

@@ -1,14 +1,16 @@
-import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../../lib/bounded-json.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../analysis/bounded-json.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { CASE_SCHEMA_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, MAX_CASE_STORE_BYTES, MAX_EDITABLE_CASE_INPUT_BYTES, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { CASE_SCHEMA_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, MAX_CASE_STORE_BYTES, MAX_EDITABLE_CASE_INPUT_BYTES, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
 import { normalizeCaseStore } from "./case-migration-model.mjs";
 import { serializeCaseStore } from "./case-storage-model.mjs";
 /** Historical wire shape remains independent of current in-memory defaults. */
 export function canonicalCaseExportProjection(cases, caseVersion) {
-    if (caseVersion !== PUBLISHED_V2_3_CASE_SCHEMA_VERSION)
-        return [...cases];
-    return cases.map((value) => {
+    return cases.map((record) => {
+        const { workflowMetadata: _workflow, ...historical } = record;
+        const value = caseVersion < EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION ? historical : record;
+        if (caseVersion !== PUBLISHED_V2_3_CASE_SCHEMA_VERSION)
+            return value;
         if ([...value.evidencePins, ...value.sightings].some((item) => item.observedAt === null)) {
             throw new TypeError('The published Case 15 format requires a known observation time on each retained pin and sighting.');
         }