@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/cli/workflow-arguments.mjs

@@ -3,7 +3,19 @@ import { CliUsageError } from "./errors.mjs";
 import {} from "./fail-policy.mjs";
 import { commandDefaultNumber } from "./command-reference.mjs";
 import { WORKFLOW_COMMAND_DEFINITIONS } from "./workflow-command-definitions.mjs";
+import { parseDomainFeedSelectors } from "./domain-feed.mjs";
 import { terminalOptions, jsonOutput, failPolicies, parseOutput, } from "./argument-values.mjs";
+function parseDomainFeedArguments(parsed) {
+    const operation = parsed.positionalValue('operation');
+    const contextSource = parsed.positionalValue('context');
+    if ((operation === 'watch-input') !== Boolean(contextSource))
+        throw new CliUsageError('watch-input requires one existing candidate-watch-input context file; review does not accept a context file.');
+    return { action: 'domain-feed', operation, feedId: parsed.positionalValue('feed'), source: parsed.positionalValue('source'), contextSource,
+        selection: parseDomainFeedSelectors(parsed.optionValues('--select')), output: jsonOutput(parsed), ...terminalOptions(parsed) };
+}
+function parseWatchlistReviewArguments(parsed) {
+    return { action: 'watchlist-review', operation: parsed.positionalValue('operation'), source: parsed.positionalValue('source'), output: jsonOutput(parsed), ...terminalOptions(parsed) };
+}
 function parseMonitorOnceArguments(parsed) {
     const selectedFailPolicies = failPolicies(parsed, 'monitor-once');
     return {
@@ -80,6 +92,8 @@ function parseWorkflowRunArguments(parsed) {
     };
 }
 export const WORKFLOW_ARGUMENT_PARSERS = Object.freeze({
+    'domain-feed': parseDomainFeedArguments,
+    'watchlist-review': parseWatchlistReviewArguments,
     'monitor-once': parseMonitorOnceArguments,
     'workflow-plan': parseWorkflowPlanArguments,
     'workflow-run': parseWorkflowRunArguments,

package/cli/workflow-command-definitions.mjs

@@ -1,6 +1,31 @@
 import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES } from "./investigation-recipes.mjs";
-import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file } from "./command-definition.mjs";
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file, optionDefinition } from "./command-definition.mjs";
+import { DOMAIN_FEED_CATALOGUE } from "../packages/monitoring/domain-feed.mjs";
 export const WORKFLOW_COMMAND_DEFINITIONS = Object.freeze({
+    'domain-feed': commandSeed({
+        reference: { description: 'Review exact hosts or literal terms in a selected local plain-domain feed.',
+            example: 'whoisleuth domain-feed review tif-mini feed.txt --select host:candidate.example --json',
+            boundary: 'Always available offline. Reads one explicit local regular file; never downloads a feed, performs a Lookup, changes scores, retains candidates or enables a schedule. Streams at most 256 MiB and 10 million physical rows with 1,024-byte lines and a ten-minute deadline; retains at most 200 matched hosts. Repeat --select host:<hostname>, term:<literal> or exclude:<literal> for at most 200 exact hosts, 20 positive and 20 negative literal terms of 3–80 characters. A negative match vetoes even an exact host before the match bound; at least one positive term or exact host is required. Matching uses canonical ASCII/punycode substrings, never token boundaries, parent equivalence, typo/confusable expansion or regular expressions. Review emits the full raw-byte digest, separate declared file/local clocks, unknown per-host clocks and omissions. watch-input also requires a candidate-watch-input v1 context file with an empty candidates array, and emits that existing format for a separate watchlist-review plan/export. Inclusion is not a maliciousness, activity, ownership or availability verdict.' },
+        collection: { scope: 'Local raw file: 256 MiB, 10 million physical rows, 1,024 bytes per line, ten minutes; 200 retained hosts, 20 positive and 20 negative literal terms, no requests.' },
+        summary: 'Review a selected local plain-domain feed', options: ['--select', '--json', '--quiet', '--no-color'],
+        optionOverrides: { '--select': optionDefinition('text', 'Select host:<exact-hostname>, term:<literal-text> or exclude:<literal-text>; repeat for separate explicit selectors.', { occurrence: 'repeatable', acceptsOptionLikeValue: true }) },
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['review', 'watch-input']),
+            positional('feed', 'enum', 1, 1, DOMAIN_FEED_CATALOGUE.map(feed => feed.id)), positional('source', 'file', 1, 1), positional('context', 'file', 0, 1)]),
+        constraints: Object.freeze([constraint({ kind: 'required', options: ['--select'] })]),
+        handlerOwner: 'workflow', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.candidate-watch-input']), primaryArtefacts: Object.freeze(['Bounded feed inclusion review', 'Explicit candidate watch selection']),
+        planSupport: true, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    'watchlist-review': commandSeed({
+        reference: { description: 'Preview or export an explicit candidate selection to a local watchlist.', example: 'whoisleuth watchlist-review plan selection.json --json',
+            boundary: 'Reads bounded local JSON only. Plan shows exact domains, duplicates, per-domain outcomes, destination and review priority with zero additional requests. Export emits Watchlist schema 5 without creating a scan or baseline. Neither mode enables collection or scheduling.' },
+        collection: { scope: 'At most 2,000 selected candidate domains; no target requests.' },
+        summary: 'Review a local candidate watchlist handoff', options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['plan', 'export']), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
+        constraints: Object.freeze([]), handlerOwner: 'workflow', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.candidate-watch-input', 'whoisleuth.watchlists']), primaryArtefacts: Object.freeze(['Exact candidate handoff plan', 'Local watchlist export']),
+        planSupport: true, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
     "monitor-once": commandSeed({
         reference: {
             description: 'Collect one bounded owned-domain review and compare it with an optional prior checkpoint.',

package/cli/workflow-command-runner.mjs

@@ -16,7 +16,37 @@ import { MAX_SHARING_REVIEW_BYTES } from "./sharing-review.mjs";
 import { createBufferedOutput } from "./output-file.mjs";
 import { boundedInteractiveAnswer, canReadInteractiveLine, readBoundedInteractiveLine } from "./terminal-input.mjs";
 import { WORKFLOW_INLINE_COMMANDS } from "./inline-command-families.mjs";
+import { reviewCandidateWatchInput, parseCandidateWatchInput } from "./watchlist-review.mjs";
+import { readDomainFeedFile } from "./domain-feed.mjs";
+import { scanDomainFeed, buildDomainFeedWatchInput, normalizeDomainFeedSelection } from "../packages/monitoring/domain-feed.mjs";
+import { MAX_WATCHLIST_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
+async function runWatchlistReviewCommand(args, dependencies, context) {
+    const raw = dependencies.readArtifactInput ? await dependencies.readArtifactInput(args.source) : await context.readInput(args.source, MAX_WATCHLIST_IMPORT_BYTES, 'Candidate watch selection');
+    const document = reviewCandidateWatchInput(raw, args.operation, context.now());
+    if (!args.quiet)
+        context.writeStdout(formatJsonDocument(document));
+    return EXIT_CODES.SUCCESS;
+}
+async function runDomainFeedCommand(args, dependencies, context) {
+    context.setFailureLabel('Offline domain-feed review');
+    const handoff = args.contextSource ? parseCandidateWatchInput(dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.contextSource)
+        : await context.readInput(args.contextSource, MAX_WATCHLIST_IMPORT_BYTES, 'Candidate watch context')) : null;
+    const watchSelection = handoff?.selection;
+    if (watchSelection && watchSelection.candidates.length)
+        throw new CliUsageError('The watch-input context must have an empty candidates array; only reviewed feed matches may be nominated.');
+    const selection = normalizeDomainFeedSelection({ ...args.selection, brandProfileId: watchSelection?.brandProfileId ?? null });
+    const review = await scanDomainFeed((dependencies.readDomainFeedInput ?? readDomainFeedFile)(args.source, dependencies.signal), {
+        feedId: args.feedId, selection, importedAt: context.now(), ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+    });
+    const document = watchSelection && handoff
+        ? buildDomainFeedWatchInput(review, review.matches.map(match => match.domain), watchSelection, handoff.watchlists)
+        : review;
+    if (!args.quiet)
+        context.writeStdout(formatJsonDocument(document));
+    return EXIT_CODES.SUCCESS;
+}
 function boundWorkflowInputs(command, inputs, dependencies, context) {
     if (!inputs.size)
         return {};
@@ -181,6 +211,8 @@ async function runWorkflowRecipeCommand(args, dependencies, context) {
     return investigationRunExitCode(document);
 }
 const WORKFLOW_COMMAND_HANDLERS = Object.freeze({
+    'domain-feed': runDomainFeedCommand,
+    'watchlist-review': runWatchlistReviewCommand,
     'monitor-once': runMonitorOnceCommand,
     'workflow-plan': runWorkflowPlanCommand,
     'workflow-run': runWorkflowRecipeCommand,

package/docs/cli.md

@@ -1,5 +1,7 @@
 # WHOISleuth CLI guide
 
+`review-evidence` also reviews bounded source-qualified infrastructure snapshots and explicit earlier/later comparison inputs entirely offline. See [infrastructure observations](infrastructure-observations.md) for the exact schemas, outcome semantics and retained-evidence limitations.
+
 The first-party CLI runs on the operator's machine and does not call the hosted
 WHOISleuth deployment. Use this guide for installation, common commands,
 collection boundaries and output. Installed `whoisleuth --help`, focused
@@ -106,6 +108,18 @@ One strict domain, IP address or ASN can occupy command position as Lookup
 shorthand. URL-like or ambiguous input requires the explicit `lookup` command.
 Only `bulk` accepts multiple targets.
 
+For a downloaded plain-domain feed, use
+`whoisleuth domain-feed review nrd7 feed.txt --select term:example --json`.
+Repeat `--select exclude:literal` to veto a literal substring before the result
+bound, including for exact-host selections. At most 20 positive and 20 negative
+terms of 3–80 characters are supported; at least one positive term or exact host
+is required. Matching uses canonical ASCII/punycode text without token, typo,
+confusable or regular-expression expansion. These offline selectors do not infer
+saved browser campaign identity or default priority.
+This is an offline literal match, not a feed download or target Lookup. The
+[candidate-review guide](https://github.com/slicedearth/whoisleuth/blob/main/docs/brand-candidate-review.md#review-a-domain-feed) covers
+source attribution and the separate Watchlist handoff.
+
 `discover` accepts a brand label or registrable domain and supports multi-part
 public suffixes in `--tlds` (for example, `co.uk,com.au`). It preserves the full
 suffix and does not collect candidate evidence; use `discover-scan` only after
@@ -179,6 +193,30 @@ Excluded links and unsupported QR payloads make the review partial, with
 category counts rather than private payload text. Bare QR hostnames are not
 automatically treated as URLs.
 
+Current message-intake reports also retain bounded literal IPv4/IPv6 and
+explicitly labelled MD5, SHA-1 and SHA-256 observations from supported body and
+document text. Each observation links to its selected source part and digest;
+it is not a Lookup target, file identification or threat verdict. Complete URLs,
+message headers, QR payloads, HAR and identity-event fields are excluded from
+this text scan. Historical version-1 reports do not acquire new observations.
+
+Use `intake text selected.txt --intake-context context.json --json` to add an
+explicit analyst-supplied distribution declaration. The separate context file
+is limited to 8 KiB and cannot use stdin. Its channel, non-sensitive source
+label and optional declared time, reference, observer and vantage labels are
+included in the output, not verified as delivery or capture conditions. See
+[selected-input indicators and declarations](offline-intake-context.md) for the
+exact schema, privacy exclusions and extraction bounds.
+
+Plain-text phone discovery reports only candidate counts, the source digest and
+UTF-16 selection ranges to standard error; unselected numbers do not enter JSON
+output. Use a version-2 `--intake-context` file to select exact ranges and declare
+their source, basis, role and known time. The same optional file can supply a
+displayed/destination pair for local hostname comparison. See the
+[selection example](offline-intake-context.md#select-phone-observations-in-the-cli).
+`--quiet` suppresses discovery guidance, and `--strict-exit` reports partial
+phone coverage as well as other incomplete intake work.
+
 ### Local IP-location database review
 
 `review-evidence query.json --mmdb selected.mmdb --json --strict-exit` reads
@@ -233,6 +271,21 @@ comparison and connector provenance. These workflows are offline; partial
 context reviews return 4 when `--strict-exit` is selected. Browser-generated
 reusable inputs use the same validators.
 
+Domain-history input version 2 adds analyst-declared registration, deletion,
+re-registration, transfer or review boundaries linked to retained snapshot or
+pin IDs. Version 1 remains supported with its original output. Boundaries prompt
+reassessment; they do not establish ownership or discard prior evidence.
+
+`review-evidence containment.json --json --strict-exit` accepts a
+`whoisleuth.internal-containment.input` version-1 document containing a supported
+Case export, selected next-step assertion and linked pin IDs, internal or trusted
+audience, recipient role and an explicit disclosure-review acknowledgement.
+It exports only that selected handoff, never writes the Case or performs a
+control. Missing or unselected supporting context stays partial (exit 4 under
+`--strict-exit`), and a resolved Case or provider outcome does not close an open
+internal follow-up. See [internal containment](offline-intake-context.md#selected-internal-containment-handoff)
+for the complete input and audience limitations.
+
 ### Message-header review
 
 `mail-headers` parses only the bounded header block from a selected message file
@@ -284,6 +337,45 @@ selected file, including an envelope when supplied. No provider API is contacted
 
 ### Local Case files
 
+Manual response scope is explicit and offline. `case incident-link` takes
+`{"url":"https://example.test/reported-page"}`; use its retained ID to bind
+`responseObjects` on `case action`. Each object contains `kind`, `identifier`
+and `incidentTargetId` (null for the Case domain or an associated hostname).
+New URL objects must match that exact retained link. Exact historical identities
+already retained in response records remain selectable after a link edit or
+removal; they are not rebound to its replacement. An action may bind up to 20
+objects; missing historical scope stays unknown.
+
+`case action-event` takes `{"id":"action-id","transition":{...}}`, using
+the same reviewed, authorised and manually submitted workflow as Console.
+After submission, a typed `objectOutcome` such as `removed`, `restricted`,
+`suspended`, `delisted`, `restored` or `disputed` requires explicit event
+`responseObjects`: a partial receipt never applies to all objects by default.
+Acknowledgement is a workflow event, not independently observed remediation.
+
+A self-initiated correction uses a new `case action`, with `originActionId`
+identifying the original action and `responseObjects` selecting a subset of that
+delivery's exact objects. Its `correction` block identifies one delivery event,
+packet digest/version and profile, plus the purpose (`correction` or
+`retraction_request`), reason, previous and corrected statements, and retained
+evidence-pin IDs. This is separate from `amendment`, which still requires an
+actual provider-request event. The correction must match a retained typed packet
+receipt on the selected delivery; a historical free-text digest alone is
+insufficient. The usual recipient, authority and disclosure review then applies
+to the new draft. The original packet and delivery remain unchanged.
+
+`case recheck-question` saves `statement` and `recheck` comparison conditions.
+Pins, questions and recheck input can retain one `responseObject`; exact-object
+non-reproduction requires matching complete baseline/current evidence, a later
+observation and comparable conditions. Hostname similarity is insufficient.
+Independent removal, restriction, suspension, delisting, transfer and restoration
+use those same comparison requirements. Disputes and warnings retain procedural
+source attribution separately; provider claims are not independent observations.
+`case close-object` requires one `responseObject` and the usual typed closure
+reason/evidence links. It leaves the Case and other objects unchanged.
+All these JSON operations require `--input`, `--output`, deliberate file
+replacement and the existing digest/lease checks. No report or request is sent.
+
 Create a working file, inspect its Case IDs, then append a note:
 
 ```sh
@@ -395,12 +487,17 @@ An ordinary Case JSON file alone provides structural validity, not a checksum.
 They use generated entry names, not original paths. Ordinary ZIPs and folders
 are private and unencrypted; packaging does not redact selected files. The report distinguishes
 file identity, supported source formats, opaque content, exact capsule/source
-links and capture-manifest attachment matches. Include the capture manifest and
+links, declared image derivation and capture-manifest attachment matches.
+Image derivation reports an immediate-parent digest and byte length, editing
+method and operation kinds, not proof of transformation. Parent inclusion matches
+another selected manifest entry by exact byte digest and size; an unselected Case
+attachment reference does not count. Parent pixels are optional; absent declarations
+leave editing history unknown. Include the capture manifest and
 its screenshot/DOM-digest files together to check their declared bytes; original
 filenames are not needed to establish a match. It does not import files or establish source truth, signature trust or a
 trusted timestamp. Unsupported or rejected entries produce a partial report;
 `--strict-exit` returns 4. Without `--package` or `--folder`, `manifest` produces a
-standalone JSON manifest; exact public version-2 manifests remain readable.
+standalone JSON manifest; exact version-2 and version-3 manifests remain readable.
 
 For [BagIt 1.0](https://www.rfc-editor.org/rfc/rfc8493.html) interchange, use
 `--bagit` with `--package` or `--folder` on both commands:

package/docs/contextual-reviews.md

@@ -17,8 +17,9 @@ The CLI uses the same models:
 whoisleuth review-evidence selected-input.json --json --strict-exit
 ```
 
-Each input has `schema`, `version: 1` and `evidence`. Unknown versions and fields
-are rejected. Inputs are bounded to 16 MiB; each supplied context list permits
+Each input has `schema`, a supported `version` and `evidence`. Most inputs use
+version 1; domain history also supports version 2 as described below. Unknown
+versions and fields are rejected. Inputs are bounded to 16 MiB; each supplied context list permits
 200 records. `--strict-exit` returns 4 for a partial contextual review. Neither
 adapter contacts a destination or executes selected software.
 
@@ -57,8 +58,12 @@ later. These stages never execute a command, submit a form or open a destination
 
 The Case view compares retained snapshots using the existing source, hostname,
 scan-depth and model-version rules. Registration, DNS, mail and web changes are
-shown alongside source-qualified certificate pins. Equal-time observations are
-not ordered into a change sequence. Retired dependencies must involve the Case
+shown alongside source-qualified certificate pins.
+Registration and nameserver changes target the Case registration domain; mail
+and web changes target the explicit observation hostname. Certificate pins keep
+their own hostname, or an unknown target when none was retained. These targets
+are preserved in review downloads, retained reports and print previews.
+Equal-time observations are not ordered into a change sequence. Retired dependencies must involve the Case
 domain or one of its hostnames. An expected window qualifies the review; it does
 not approve a change automatically or establish transfer or takeover.
 Review prompts connect comparable page, mail, delegation and registration changes
@@ -71,7 +76,8 @@ Schema: `whoisleuth.domain-history.input`. Its `evidence` contains:
 - `caseExport`: an ordinary supported editable Case export, with `version` and
   `cases`; the exact existing Case reader rejects data loss or silent repair.
 - `caseId`: the Case selected from that export.
-- `declarations`: `expectedChanges` and `retiredDependencies` arrays.
+- `declarations`: `expectedChanges` and `retiredDependencies` arrays; version 2
+  also requires `registrationBoundaries`. Version 1 remains readable unchanged.
 
 An expected change is `{family, start, end, reason}`. A retired dependency is
 `{asset, dependency, family, retiredAt, source}`. Families are `registration`,
@@ -79,6 +85,23 @@ An expected change is `{family, start, end, reason}`. A retired dependency is
 reusable input download includes the selected Case and is not duplicated in
 workspace storage when saving the report.
 
+Version-2 registration boundaries are analyst declarations, not confirmed
+registration epochs. Each has `{kind, occurredAt, source, rationale,
+snapshotIds, evidencePinIds}`. Kinds are `registration_reported`,
+`deletion_reported`, `reregistration_reported`, `transfer_reported` and
+`review_boundary`. Supply an explicit ISO time and at least one exact reference
+to a snapshot or evidence pin retained in the selected Case. References must be
+unique; unavailable references fail rather than selecting a replacement.
+Up to 40 boundaries and 20 references of each type per boundary are accepted.
+
+The Case history form exposes the same declarations. Reports count retained
+observations before and at/after a declared time without assigning ownership or
+asserting that deletion, re-registration or transfer occurred. Earlier evidence,
+decisions, exceptions and open follow-ups are not rewritten. Reports retain the
+declared source and exact evidence references, and can be deliberately saved as
+ordinary Case files. The reusable input remains a separate download containing
+the selected Case, not an additional workspace copy.
+
 ## Platform objects
 
 Schema: `whoisleuth.platform-continuity.input`. `evidence` is an array:

package/docs/infrastructure-observations.md

@@ -0,0 +1,126 @@
+# Source-qualified infrastructure snapshots
+
+The retained infrastructure inventory combines admitted browser-local evidence,
+not all infrastructure belonging to an organisation. It makes no requests on
+import, opening a view, filtering, selecting a host or comparing history.
+
+Import a `whoisleuth.infrastructure-observation` version 1 document through the
+existing external-findings import. The exact bounded snapshot is retained as one
+Case evidence pin. Review the preview before confirming the mutation. The source
+descriptions are supplied provenance, not authenticated source identities.
+Legacy DNS and certificate imports remain readable: an old Case-domain DNS pin
+does not acquire a precise queried hostname or complete collection scope.
+
+The document records an explicit target, selected full hostnames and DNS types,
+collection mode, observation time and coverage. Each DNS response retains its
+queried name, response owner, type, outcome and source. An alias link uses its
+record owner; an address returned after an alias belongs to the returned address
+owner, not automatically to the initial query. Only retained alias links are
+drawn. Links from different dates do not prove one contemporaneous alias chain.
+No-data, NXDOMAIN, failed and not-checked outcomes remain different observations
+and do not decide registration availability.
+
+Certificate-log and TLS observations keep distinct sources and exact SHA-256
+identities. Full names remain visible; `*.example.test` is a wildcard pattern,
+not an enumerated hostname, and cannot be selected for Lookup or Bulk.
+Certificate names alone do not establish current resolution or activity.
+
+DNS operator, observed edge/CDN/proxy, application platform, runtime, embedded
+dependency, address registration, routing origin and independently observed
+origin are distinct source-qualified roles. Routing requires a routing source;
+IP-registration data cannot substitute for it. Edge indicators cannot identify
+a hidden origin. Multiple providers and conflicting observations remain separate.
+The snapshot reader does not derive physical location, responsibility, ownership,
+safety or maliciousness from these roles.
+
+## Review and deliberately act
+
+Open the inventory from saved-work search. Type, source and date filters apply to
+the admitted set before pagination. Inspect one snapshot to review every retained
+DNS outcome, certificate name and provider role, or select two snapshots in
+chronological order to compare. Export preserves the exact snapshot format.
+Topology search applies to the complete admitted one-hop relationship set, not
+the current source page. Its diagram has a 50-relationship budget; the paginated
+source list and exact snapshot review retain access to evidence beyond the diagram.
+
+Lookup links fill the selected target for review without submitting it. Explicitly
+selected hostnames can be prepared in existing Bulk. That handoff does not scan,
+recursively expand targets, change a watchlist or enrol a host in monitoring.
+Use the existing reviewed Lookup/Bulk/Monitor collection plans and explicit
+save actions to collect or retain another observation.
+
+## Historical comparison and CLI
+
+Source, mode and exact selection scope must match, and the later snapshot must
+have a strictly later observation time. Newly observed means newly present in
+retained evidence, not newly created. A value not returned by a complete,
+comparable selected collection is labelled **not returned**, never confirmed
+absence or disappearance. Failed, partial, limited, changed-source and
+incomparable snapshots cannot generate removal findings. Equal-time observations
+have no temporal order. Provider-reported history stays labelled separately from
+supplied local observations.
+
+Comparison rows retain the exact DNS query, response owner and record type, or
+the certificate SHA-256, alongside their source and observation clocks. Labels
+are presentation only: relationship groups and graph exports use canonical
+entity identities, including when long nameserver-set labels look identical.
+
+Derived relationship-group, graph-node and cluster IDs can change when their
+identity calculation changes, including for short labels. They are not durable
+cross-export keys; use the canonical `entityId` where provided. Historical groups
+without it use their complete retained value. Graph fields named `canonical`
+and `value` are bounded display text, not a replacement for that identity. Inspect
+the contributing Case evidence for full nameserver members. Component selections
+and cluster adjustments are transient and are not persisted review history.
+
+In GraphML and GEXF, the display label for `node_canonical` is now
+`Bounded display value` (previously `Canonical value`). The field key, JSON
+property, entity identities and values are unchanged; XML consumers should use
+the field key rather than its display label.
+
+The existing offline command shares the website reader and comparison owner:
+
+```sh
+whoisleuth review-evidence infrastructure-observation.json --json
+whoisleuth review-evidence infrastructure-comparison.json --json
+```
+
+The comparison input is exactly:
+
+```json
+{
+  "schema": "whoisleuth.infrastructure-comparison.input",
+  "version": 1,
+  "earlier": { "...": "complete version-1 snapshot" },
+  "later": { "...": "complete version-1 snapshot" }
+}
+```
+
+The placeholders above are illustrative, not valid evidence. See the reserved
+fixture in `test/fixtures/infrastructure-observations/` for an exact snapshot.
+The CLI performs no DNS, registry, BGP, TLS, HTTP or provider request.
+
+Changed or incomplete latest retained pairs surface as existing local Review
+Items with supporting Case navigation. Complete earlier snapshots remain
+available as stronger baselines; later failures do not rewrite them. There is no
+new history store or scheduling engine.
+
+## Resource and compatibility boundary
+
+One snapshot is limited to 128 KiB, 128 selected hostnames, six DNS types, 16
+source identities, 512 DNS response rows with at most 32 values each, 32
+certificate observations with at most 128 exact names each, 128 role observations
+and 12 bounded limitations. Bounds reject oversized documents rather than
+silently prune accepted snapshot evidence. Existing Case/workspace quotas still
+apply. Projection/diagram budgets may admit a smaller disposable view, with
+incomplete coverage disclosed; exact snapshot review/export remains available.
+
+Version 1 has exact keys and refuses future versions. Existing external-findings
+version 4 and typed version-1 row imports preserve their historical meaning;
+version 5 adds the optional exact infrastructure snapshot. No external discovery
+API, new provider, dependency, collector or automatic request is required.
+Current snapshot and version-5 findings exports use compact UTF-8 JSON with a
+terminal line feed so the emitted representation stays within its parser ceiling.
+An offline comparison input is bounded to two snapshot budgets plus 1 KiB of
+framing. Historical version-4 fixture bytes and reader meaning remain unchanged;
+new typed row conversions emit version 5.