@slicedearth/whoisleuth-cli 2.5.1 → 2.6.0

package/packages/cases/case-containment-handoff.mjs

@@ -0,0 +1,195 @@
+import { projectCaseForAudience } from "./case-record-projection.mjs";
+import { readEditableCaseExport } from "./case-export-input.mjs";
+import { array, enumeration, exact, iso, text } from "../evidence/artifact-structure.mjs";
+import { escapeCaseMarkdownInline } from "./case-markdown.mjs";
+import { MAX_CASE_ASSERTIONS, MAX_CASE_EVIDENCE_PINS } from "../contracts/case-portability.mjs";
+import { caseSelectedEvidenceSourceLimitations } from "./case-evidence-links.mjs";
+export const CASE_CONTAINMENT_INPUT_SCHEMA = 'whoisleuth.internal-containment.input';
+export const CASE_CONTAINMENT_HANDOFF_SCHEMA = 'whoisleuth.internal-containment';
+export const CASE_CONTAINMENT_VERSION = 1;
+export const MAX_CONTAINMENT_ASSERTIONS = 20;
+export const MAX_CONTAINMENT_PINS = 40;
+export const MAX_CONTAINMENT_OUTPUT_BYTES = 128 * 1024;
+export const CONTAINMENT_RECIPIENT_ROLES = [
+    'security_operations',
+    'identity_response',
+    'endpoint_response',
+    'network_response',
+];
+const ROLE_GUIDANCE = {
+    security_operations: [
+        'Confirm the responsible internal owner and track the selected requests independently of external removal.',
+        'Separate reported actions, retained observations and unresolved evidence before authorising a control.',
+    ],
+    identity_response: [
+        'Review the selected requests against authorised account, session and application-grant evidence in the identity system.',
+        'Do not treat a reported password entry, sign-in approval or provider resolution as proof of account compromise or recovery.',
+    ],
+    endpoint_response: [
+        'Review the selected requests against authorised device evidence before deciding whether isolation, collection or remediation is needed.',
+        'Do not execute supplied commands or attachments; a reported execution is not a verified device outcome.',
+    ],
+    network_response: [
+        'Review exact scope, collateral effects and an appropriate review/expiry period before applying an approved network control.',
+        'Shared infrastructure and literal indicators do not establish ownership, maliciousness or an appropriate blocking scope.',
+    ],
+};
+function uniqueIds(value, maximum, label) {
+    const ids = array(value, label, maximum).map((id) => text(id, label, 240));
+    if (new Set(ids).size !== ids.length)
+        throw new TypeError(`${label} must be unique.`);
+    return ids;
+}
+export function readContainmentSelection(raw) {
+    const value = exact(raw, ['audience', 'recipientRole', 'assertionIds', 'evidencePinIds'], 'Containment handoff selection');
+    return {
+        audience: enumeration(value.audience, ['internal', 'trusted', 'public'], 'Handoff audience'),
+        recipientRole: enumeration(value.recipientRole, CONTAINMENT_RECIPIENT_ROLES, 'Internal recipient role'),
+        assertionIds: uniqueIds(value.assertionIds, MAX_CONTAINMENT_ASSERTIONS, 'Selected follow-ups'),
+        evidencePinIds: uniqueIds(value.evidencePinIds, MAX_CONTAINMENT_PINS, 'Selected supporting pins'),
+    };
+}
+/** Select retained assertions; never infer completed containment from Case or provider status. */
+export function previewCaseContainmentHandoff(record, raw, generatedAt) {
+    iso(generatedAt, 'Handoff generation time');
+    const selection = readContainmentSelection(raw);
+    array(record.assertions, 'Retained Case assertions', MAX_CASE_ASSERTIONS);
+    array(record.evidencePins, 'Retained Case pins', MAX_CASE_EVIDENCE_PINS);
+    const followUps = record.assertions.filter((item) => item.kind === 'next_step');
+    const original = selection.assertionIds.map((id) => {
+        const matches = followUps.filter((item) => item.id === id);
+        if (matches.length !== 1)
+            throw new TypeError('A selected follow-up is missing or ambiguous; refresh the selection.');
+        return matches[0];
+    });
+    const linkedIds = new Set(original.flatMap((item) => item.evidencePinIds));
+    for (const id of selection.evidencePinIds) {
+        if (!linkedIds.has(id) || record.evidencePins.filter((pin) => pin.id === id).length !== 1)
+            throw new TypeError('Select only uniquely retained pins linked to the selected follow-ups.');
+    }
+    const permitted = selection.audience !== 'public';
+    // Reuse the canonical audience policy before constructing a narrow projection.
+    const projected = projectCaseForAudience(record, selection.audience);
+    const pins = permitted
+        ? projected.evidencePins.filter((pin) => selection.evidencePinIds.includes(pin.id))
+        : [];
+    const assertions = permitted
+        ? original.map((item) => {
+            const selected = projected.assertions.find((assertion) => assertion.id === item.id);
+            return {
+                id: selected.id,
+                kind: 'next_step',
+                statement: selected.statement,
+                rationale: selected.rationale,
+                state: selected.state,
+                createdAt: selected.createdAt,
+                updatedAt: selected.updatedAt,
+                provenance: selected.provenance ?? null,
+                recheck: selected.recheck ?? null,
+                evidence: selected.evidencePinIds.map((id) => ({
+                    evidencePinId: id,
+                    stance: selected.evidenceRelations?.find((relation) => relation.evidencePinId === id)
+                        ?.stance ?? 'not_recorded',
+                    state: pins.some((pin) => pin.id === id)
+                        ? 'included'
+                        : record.evidencePins.some((pin) => pin.id === id)
+                            ? 'not_selected'
+                            : 'unavailable',
+                })),
+            };
+        })
+        : [];
+    const missingContext = assertions.some((item) => !item.evidence.length || item.evidence.some((link) => link.state !== 'included'));
+    const report = {
+        schema: CASE_CONTAINMENT_HANDOFF_SCHEMA,
+        version: CASE_CONTAINMENT_VERSION,
+        generatedAt,
+        audience: selection.audience,
+        recipientRole: selection.recipientRole,
+        case: { id: projected.id, domain: projected.domain, status: projected.status },
+        state: !permitted ||
+            !assertions.length ||
+            missingContext ||
+            pins.some((pin) => pin.completeness !== 'complete' || pin.truncated === true)
+            ? 'partial'
+            : 'reviewed',
+        reviewRequired: true,
+        actionsPerformed: false,
+        assertions,
+        evidencePins: pins,
+        disclosure: {
+            exportAllowed: permitted && assertions.length > 0,
+            included: permitted
+                ? [
+                    'Case identifier, domain and recorded status',
+                    'Only selected next-step statements, rationale, states and recording times',
+                    'Exact selected supporting pins and separately qualified evidence relationships',
+                ]
+                : ['Case identifier, domain and recorded status only'],
+            excluded: [
+                'Unselected assertions and evidence',
+                'Case title, notes, contacts, action recipients and original files',
+                'Raw upstream responses, automatic assignments and control execution',
+                ...(permitted ? [] : ['Internal follow-up statements and their supporting pins']),
+            ],
+            caution: 'Selected statements and pin values can contain sensitive analyst text or exact scope. Review each included value for the intended recipient; minimisation is not automatic anonymisation.',
+        },
+        nextSteps: [...ROLE_GUIDANCE[selection.recipientRole]],
+        limitations: [
+            'These are retained analyst requests, not verified assignments, executed controls or independent recovery results.',
+            'Open and resolved assertion states are preserved as recorded. External provider resolution, object closure and Case status do not resolve open internal requests.',
+            'Unselected or missing supporting pins remain explicit. A linked pin may support, contradict or leave a request unresolved; linkage does not establish truth.',
+            'This local handoff sends no message, changes no Case state and includes no original attachment bytes.',
+            ...caseSelectedEvidenceSourceLimitations(pins, record.evidenceLinks, pins.map(pin => pin.id)),
+        ],
+    };
+    if (new TextEncoder().encode(JSON.stringify(report)).byteLength > MAX_CONTAINMENT_OUTPUT_BYTES)
+        throw new TypeError('The selected handoff exceeds 128 KiB. Choose fewer follow-ups or pins; nothing was silently omitted.');
+    return report;
+}
+export function buildCaseContainmentHandoff(record, selection, generatedAt, disclosureReviewed) {
+    const report = previewCaseContainmentHandoff(record, selection, generatedAt);
+    if (!disclosureReviewed || !report.disclosure.exportAllowed)
+        throw new TypeError('Review the audience disclosure and select at least one retained follow-up for an internal or trusted handoff.');
+    return report;
+}
+export function readCaseContainmentInput(raw, generatedAt) {
+    const input = exact(raw, ['schema', 'version', 'caseExport', 'caseId', 'selection', 'disclosureReviewed'], 'Containment handoff input');
+    if (input.schema !== CASE_CONTAINMENT_INPUT_SCHEMA || input.version !== CASE_CONTAINMENT_VERSION)
+        throw new TypeError('Unsupported containment handoff input version.');
+    const caseId = text(input.caseId, 'Selected Case ID', 240);
+    const selected = readEditableCaseExport(JSON.stringify(input.caseExport)).filter((record) => record.id === caseId);
+    if (selected.length !== 1)
+        throw new TypeError('Select one unambiguous Case from the supported export.');
+    if (input.disclosureReviewed !== true)
+        throw new TypeError('The selected handoff requires an explicit audience-disclosure review.');
+    return buildCaseContainmentHandoff(selected[0], readContainmentSelection(input.selection), generatedAt, true);
+}
+export function formatCaseContainmentHandoff(report) {
+    const escape = escapeCaseMarkdownInline;
+    const lines = [
+        `# Internal containment handoff`,
+        '',
+        `Audience: ${report.audience} · ${report.recipientRole.replaceAll('_', ' ')}`,
+        `Case: ${escape(report.case.domain)} · ${escape(report.case.id)} · recorded status ${escape(report.case.status)}`,
+        `Generated: ${report.generatedAt} · coverage ${report.state} · no actions performed`,
+        '',
+        '## Selected retained requests',
+        '',
+    ];
+    for (const item of report.assertions) {
+        lines.push(`- ${escape(item.statement)} — ${item.state} (${escape(item.id)})`);
+        if (item.rationale)
+            lines.push(`  Rationale: ${escape(item.rationale)}`);
+        lines.push(`  Recorded ${escape(item.createdAt)}; updated ${escape(item.updatedAt)}.`);
+        for (const link of item.evidence)
+            lines.push(`  Evidence ${escape(link.evidencePinId)}: ${link.stance}; ${link.state.replaceAll('_', ' ')}.`);
+        if (!item.evidence.length)
+            lines.push('  No supporting context was linked.');
+    }
+    lines.push('', '## Selected supporting evidence', '');
+    for (const pin of report.evidencePins)
+        lines.push(`- ${escape(pin.label)} (${escape(pin.id)}): ${escape(pin.value)}`, `  Source: ${escape(pin.source)}; observed ${escape(pin.observedAt ?? 'unknown')}; ${pin.completeness}${pin.truncated ? '; truncated' : ''}.`, ...pin.limitations.map((value) => `  Limitation: ${escape(value)}`));
+    lines.push('', '## Recipient review', '', ...report.nextSteps.map((value) => `- ${value}`), '', '## Boundaries', '', ...report.limitations.map((value) => `- ${value}`));
+    return `${lines.join('\n')}\n`;
+}

package/packages/cases/case-evidence-links.mjs

@@ -133,3 +133,19 @@ export function caseEvidenceSharedContext(pins) {
     }
     return [...groups.values()].filter(group => group.pinIds.length > 1);
 }
+export const CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION = 'Selected evidence has retained shared-source or derivation context. Multiple references do not establish independent observations; underlying reporting or collection methods may remain unknown. Relationship details are not included in this output.';
+/** Qualify a narrow disclosure without exposing relationship identities or private basis text. */
+export function caseSelectedEvidenceSourceLimitations(pins, links, selectedPinIds) {
+    array(pins, 'Retained evidence pins', MAX_CASE_EVIDENCE_PINS);
+    array(links ?? [], 'Retained evidence relationships', MAX_CASE_EVIDENCE_LINKS);
+    array(selectedPinIds, 'Selected evidence pins', MAX_CASE_EVIDENCE_PINS);
+    const requested = new Set(selectedPinIds);
+    const selectedPins = pins.filter(pin => requested.has(pin.id));
+    const selected = new Set(selectedPins.map(pin => pin.id));
+    if (!selected.size)
+        return [];
+    const declared = links?.some(link => !link.withdrawal
+        && (selected.has(link.fromPinId) || selected.has(link.toPinId)));
+    return declared || caseEvidenceSharedContext(selectedPins).length
+        ? [CASE_SELECTED_EVIDENCE_SOURCE_LIMITATION] : [];
+}

package/packages/cases/case-evidence-model.mjs

@@ -5,7 +5,7 @@ import { normalizeOpportunityModelVersion } from "../analysis/opportunity-scorin
 import { normalizeRiskModelVersion } from "../analysis/risk-scoring.mjs";
 import { latestObservationCohort } from "../evidence/latest-observations.mjs";
 import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
-import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
+import { EVIDENCE_FOLLOW_UP_CASE_SCHEMA_VERSION, OBJECT_RESPONSE_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION } from "../contracts/case-portability.mjs";
 import { validWebObservationMode } from "../evidence/lookup-target.mjs";
 import { normalizeWebCollectionQuality, webCollectionAllowsComparison } from "../evidence/collection-quality.mjs";
 import { MAX_EVIDENCE_CHANGES, MAX_EVIDENCE_DETAIL_LENGTH, MAX_EVIDENCE_FACTORS, MAX_EVIDENCE_MUTATIONS, MAX_EVIDENCE_NAMESERVERS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE, MAX_EVIDENCE_STRING_LENGTH, MAX_EVIDENCE_TITLE_LENGTH, } from "./case-record-contracts.mjs";
@@ -113,6 +113,7 @@ const DEEP_SIGNAL_FIELDS = [
     'httpCrossOriginRedirect', 'httpHttpsDowngrade', 'httpContentType', 'httpSecurityHeaders',
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'phishingLanguageMatch',
     'pageBaselineMatch',
+    'hasExternalPasswordForm',
 ];
 // Ordered list of the fields that make up a snapshot's *material* identity -
 // everything except capture timestamps, snapshot id and source. `scanDepth` is
@@ -135,6 +136,7 @@ const MATERIAL_FIELD_ORDER = [
     'privacyProtected', 'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
     'profileContextState', 'profileContextLimitation',
     'mutationTypes',
+    'hasExternalPasswordForm',
 ];
 // The canonical, comparison-safe value of a material field. Registrar casing,
 // nameserver order, and sub-day timestamps are collapsed so they can never
@@ -196,7 +198,7 @@ function canonicalMaterialString(snapshot, legacyOrder = false) {
         const value = materialValue(field, snapshot, legacyOrder);
         // Optional collection context does not alter historical fingerprints when
         // absent; recorded context separates otherwise-identical captures.
-        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode' || field === 'webCollectionQuality') && value === null)
+        if ((field === 'inputHostname' || field === 'observationHostname' || field === 'webObservationMode' || field === 'webCollectionQuality' || field === 'hasExternalPasswordForm') && value === null)
             continue;
         canonical[field] = value;
     }
@@ -223,6 +225,8 @@ function buildSnapshot(raw, options) {
     if (!raw || typeof raw !== 'object')
         return null;
     const record = objectRecord(raw);
+    if (record.hasExternalPasswordForm !== undefined && options.sourceVersion != null && options.sourceVersion < OBJECT_RESPONSE_CASE_SCHEMA_VERSION)
+        throw new TypeError('Password-form attribution requires Case schema 18 or later; historical evidence was not reinterpreted.');
     if (record.factorOrder !== undefined && record.factorOrder !== 'code-unit-v1')
         return null;
     const historicalSchema = options.sourceVersion !== undefined && Number(options.sourceVersion) <= PUBLISHED_V2_3_CASE_SCHEMA_VERSION;
@@ -288,6 +292,7 @@ function buildSnapshot(raw, options) {
         reusesOfficialAssets: boolOrNull(record.reusesOfficialAssets),
         hasPasswordField: boolOrNull(record.hasPasswordField),
         hasExternalFormAction: boolOrNull(record.hasExternalFormAction),
+        ...(record.hasExternalPasswordForm === undefined ? {} : { hasExternalPasswordForm: boolOrNull(record.hasExternalPasswordForm) }),
         phishingLanguageMatch: evidenceString(record.phishingLanguageMatch),
         privacyProtected: boolOrNull(record.privacyProtected),
         idnReferenceMatch: boolOrNull(record.idnReferenceMatch),
@@ -308,7 +313,7 @@ function buildSnapshot(raw, options) {
     if (fields.opportunityScore === null && fields.opportunityFactors.length === 0)
         fields.opportunityModelVersion = null;
     if (webCollectionQuality) {
-        for (const field of ['hasPasswordField', 'hasExternalFormAction', 'pageBaselineMatch', 'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets']) {
+        for (const field of ['hasPasswordField', 'hasExternalFormAction', 'hasExternalPasswordForm', 'pageBaselineMatch', 'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets']) {
             if (fields[field] === false && !webCollectionAllowsComparison(field, webCollectionQuality, scanDepth))
                 fields[field] = null;
         }
@@ -338,6 +343,7 @@ function buildSnapshot(raw, options) {
             reusesOfficialAssets: null,
             hasPasswordField: null,
             hasExternalFormAction: null,
+            ...(record.hasExternalPasswordForm === undefined ? {} : { hasExternalPasswordForm: null }),
             phishingLanguageMatch: null,
             pageBaselineMatch: null,
         });
@@ -583,6 +589,7 @@ const COMPARE_FIELDS = [
     { field: 'reusesOfficialAssets', scope: 'web', label: 'Official asset reuse', type: 'signal', depthGate: 'both-deep' },
     { field: 'hasPasswordField', scope: 'web', label: 'Password form', type: 'signal', depthGate: 'both-deep' },
     { field: 'hasExternalFormAction', scope: 'web', label: 'External form action', type: 'signal', depthGate: 'both-deep' },
+    { field: 'hasExternalPasswordForm', scope: 'web', label: 'Password form with declared external destination', type: 'signal', depthGate: 'both-deep' },
     { field: 'phishingLanguageMatch', scope: 'web', label: 'Phishing language', type: 'phishing', depthGate: 'both-deep' },
     { field: 'mutationTypes', scope: 'hostname', label: 'Mutation types', type: 'set' },
 ];
@@ -809,6 +816,10 @@ function compareField(spec, before, after) {
             return null;
     }
 }
+/** Field scope is owned by the same specification that gates comparisons. */
+export function caseEvidenceFieldScope(field) {
+    return COMPARE_FIELDS.find(spec => spec.field === field)?.scope ?? null;
+}
 /**
  * Diffs two normalized snapshots into a bounded, stably-ordered list of
  * material changes. Timestamps, source, id and fingerprint are ignored;

package/packages/cases/case-object-coverage.mjs

@@ -0,0 +1,33 @@
+import { retainedCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
+export function buildCaseIncidentCoverage(record) {
+    const objects = new Map();
+    const explicit = retainedCaseResponseObjects(record);
+    for (const target of record.workflowMetadata?.incidentTargets ?? []) {
+        const matching = explicit.filter(object => object.incidentTargetId === target.id && object.identifier === target.url);
+        for (const object of matching.length ? matching : [{ kind: 'other', identifier: target.url, incidentTargetId: target.id }])
+            objects.set(JSON.stringify(object), { target, object, targetRetained: true });
+    }
+    for (const object of explicit)
+        if (!objects.has(JSON.stringify(object)))
+            objects.set(JSON.stringify(object), {
+                object, targetRetained: false,
+                target: { id: object.incidentTargetId ?? `${object.kind}-${object.identifier}`, url: object.identifier, state: 'open', createdAt: record.createdAt ?? '', updatedAt: record.updatedAt ?? '' },
+            });
+    return [...objects.values()].map(({ target, object, targetRetained }) => {
+        const actions = (record.actions ?? []).filter(action => action.responseObjects?.some(bound => sameCaseResponseObject(bound, object)));
+        const reviews = (record.observedEffects?.reviews ?? []).filter(review => sameCaseResponseObject(review.responseObject, object));
+        const latestAt = Math.max(...reviews.map(review => Date.parse(review.observedAt)));
+        const latest = reviews.filter(review => Date.parse(review.observedAt) === latestAt);
+        return { target, targetRetained, responseObject: object,
+            hostname: object.kind === 'domain' || object.kind === 'hostname' ? object.identifier : new URL(object.identifier).hostname,
+            actionCoverage: actions.length ? 'bound' : 'unknown',
+            actionIds: actions.map(action => action.id),
+            providerEvents: (record.actions ?? []).flatMap(action => action.history.filter(event => event.applied
+                && event.responseObjects?.some(bound => sameCaseResponseObject(bound, object))
+                && (event.providerOutcome || event.objectOutcome || event.nextState === 'acknowledged'))
+                .map(event => ({ actionId: action.id, eventId: event.id, state: event.nextState, outcome: event.objectOutcome ?? event.providerOutcome, occurredAt: event.occurredAt, sourceClass: event.sourceClass }))),
+            observationCoverage: !reviews.length ? 'unknown' : new Set(latest.map(review => `${review.state}\u0000${review.objectOutcome ?? ''}`)).size > 1 ? 'ambiguous' : 'available',
+            reviews,
+            closures: (record.closures?.records ?? []).filter(closure => sameCaseResponseObject(closure.responseObject, object)), };
+    });
+}

package/packages/cases/case-packet-correction.mjs

@@ -0,0 +1,106 @@
+// Local delivery linkage, not authentication, external acceptance or nonrepudiation.
+import { array, enumeration, exact, HEX_DIGEST_RE, iso, text } from "../evidence/artifact-structure.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS } from "../contracts/case-portability.mjs";
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { readCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
+import { RESPONSE_PACKET_PROFILE_IDS } from "./case-response-packet-vocabulary.mjs";
+export const CASE_DELIVERY_RECEIPT_LIMITATION = 'This retained local receipt identifies canonical packet JSON and analyst-recorded delivery, not delivered message or PDF bytes, external receipt, factual truth, authorship authentication or provider acceptance.';
+const id = (value, label) => {
+    const result = text(value, label, 64);
+    if (!/^[A-Za-z0-9_-]{1,64}$/u.test(result))
+        throw new TypeError(`${label} is invalid.`);
+    return result;
+};
+const digest = (value) => {
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Select an exact recorded packet digest.');
+    return value;
+};
+const packetVersion = (value) => {
+    if (!SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS.some(version => version === value))
+        throw new TypeError('The recorded packet version is unsupported.');
+    return value;
+};
+const statement = (value, label, required = true) => {
+    const result = text(value, label, MAX_RESPONSE_RATIONALE_LENGTH, !required).trim();
+    if (required && !result)
+        throw new TypeError(`${label} is required.`);
+    return result;
+};
+export function readCaseDeliveryPacketReceipt(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Delivery packet receipt');
+    const row = exact(value, ['version', 'caseId', 'actionId', 'target', 'packetDigestSha256', 'packetVersion', 'packetGeneratedAt', 'recipient', 'profile', 'responseObjects'], 'Delivery packet receipt');
+    if (row.version !== 1)
+        throw new TypeError('The delivery receipt version is unsupported.');
+    const target = text(row.target, 'Receipt target', 253);
+    if (!isValidAsciiHostname(target) || target !== target.toLowerCase())
+        throw new TypeError('The delivery receipt target is invalid.');
+    iso(row.packetGeneratedAt, 'Packet generation time');
+    const recipient = text(row.recipient, 'Receipt recipient', MAX_RESPONSE_RECIPIENT_LENGTH).trim();
+    if (!recipient)
+        throw new TypeError('The receipt recipient is required.');
+    const responseObjects = readCaseResponseObjects(row.responseObjects);
+    if (!responseObjects?.length)
+        throw new TypeError('The receipt requires an explicit nonempty delivered object scope.');
+    return Object.freeze({ version: 1, caseId: id(row.caseId, 'Receipt Case'), actionId: id(row.actionId, 'Receipt action'), target,
+        packetDigestSha256: digest(row.packetDigestSha256), packetVersion: packetVersion(row.packetVersion), packetGeneratedAt: row.packetGeneratedAt,
+        recipient, profile: enumeration(row.profile, RESPONSE_PACKET_PROFILE_IDS, 'Receipt audience'), responseObjects });
+}
+export function readCasePacketCorrection(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Packet correction');
+    const row = exact(value, ['version', 'purpose', 'deliveryEventId', 'packetDigestSha256', 'packetVersion', 'reason', 'previousStatement', 'correctedStatement', 'evidencePinIds', 'profile'], 'Packet correction');
+    if (row.version !== 1)
+        throw new TypeError('The correction version is unsupported.');
+    const purpose = enumeration(row.purpose, ['correction', 'retraction_request'], 'Correction purpose');
+    const pins = array(row.evidencePinIds, 'Correction evidence', MAX_DECISION_PIN_REFERENCES).map(value => id(value, 'Correction pin'));
+    if (!pins.length || new Set(pins).size !== pins.length)
+        throw new TypeError('Select distinct retained correction evidence pins.');
+    return Object.freeze({ version: 1, purpose, deliveryEventId: id(row.deliveryEventId, 'Original delivery event'),
+        packetDigestSha256: digest(row.packetDigestSha256), packetVersion: packetVersion(row.packetVersion),
+        reason: statement(row.reason, 'Correction reason'), previousStatement: statement(row.previousStatement, 'Previous statement'),
+        correctedStatement: statement(row.correctedStatement, 'Corrected statement', purpose === 'correction'),
+        evidencePinIds: Object.freeze(pins), profile: enumeration(row.profile, RESPONSE_PACKET_PROFILE_IDS, 'Correction audience') });
+}
+export function assertDeliveryPacketReceipt(receipt, event, actionId) {
+    if (!receipt)
+        return;
+    if (receipt.actionId !== actionId || !['authorised', 'submitted'].includes(event.previousState ?? '') || event.nextState !== 'submitted' || event.sourceClass !== 'analyst'
+        || event.reference !== `response-packet-sha256:${receipt.packetDigestSha256}`
+        || JSON.stringify(event.responseObjects ?? []) !== JSON.stringify(receipt.responseObjects)
+        || (event.occurredAt && Date.parse(event.occurredAt) < Date.parse(receipt.packetGeneratedAt)))
+        throw new TypeError('The packet receipt must match its exact analyst-recorded delivery and object scope.');
+}
+export function correctionDelivery(actions, action, context) {
+    const correction = action.correction;
+    if (!correction)
+        return null;
+    const original = actions.find(item => item.id === action.originActionId);
+    const event = original?.history.find(item => item.id === correction.deliveryEventId);
+    const receipt = event?.packetReceipt;
+    if (!original || !event?.applied || !receipt)
+        throw new TypeError('An exact-linked correction requires the retained receipt of the explicitly selected delivery. Legacy digest-only or omitted receipts cannot authorise it.');
+    assertDeliveryPacketReceipt(receipt, event, original.id);
+    if (receipt.recipient === '[redacted]' || action.recipient === '[redacted]' || receipt.recipient !== action.recipient
+        || original.recipient !== receipt.recipient || correction.profile !== receipt.profile
+        || correction.packetDigestSha256 !== receipt.packetDigestSha256 || correction.packetVersion !== receipt.packetVersion
+        || !action.responseObjects?.length || action.responseObjects.some(object => !receipt.responseObjects.some(previous => sameCaseResponseObject(previous, object))))
+        throw new TypeError('Correction recipient, version, digest, audience and object subset must match the selected delivered packet.');
+    if (context && (receipt.caseId !== context.caseId || receipt.target !== context.target || (context.profile && context.profile !== correction.profile)
+        || (context.selectedPinIds && correction.evidencePinIds.some(pin => !context.selectedPinIds.has(pin)))))
+        throw new TypeError('Review the current Case target, audience and every retained correction pin before preparation.');
+    return { original, event, receipt };
+}
+/** Called only with the exact completed packet; never uses a later editable draft. */
+export function deliveryReceiptForPacket(packet) {
+    const action = packet.escalationHistory.find(action => action.actionId === packet.actionBinding.selectedActionId);
+    if (!action || !packet.recipientRoute || packet.authorisation.status !== 'authorised' || !action.responseObjects?.length)
+        throw new TypeError('A retained exact receipt requires an authorised action-bound packet with explicit object scope.');
+    return readCaseDeliveryPacketReceipt({ version: 1, caseId: packet.case.id, actionId: action.actionId, target: packet.case.domain,
+        packetDigestSha256: packet.integrity.digestSha256, packetVersion: packet.schemaVersion, packetGeneratedAt: packet.generatedAt,
+        recipient: packet.recipientRoute.contact, profile: packet.profile.id, responseObjects: action.responseObjects });
+}

package/packages/cases/case-recheck-model.mjs

@@ -1,6 +1,7 @@
 import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
 import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
-import { enumeration, exact, text } from "../evidence/artifact-structure.mjs";
+import { enumeration, exactOptional, text } from "../evidence/artifact-structure.mjs";
+import { readCaseResponseObject, sameCaseResponseObject } from "./case-response-object.mjs";
 import { casePinHasCompleteObservation } from "./case-evidence-quality.mjs";
 export const CASE_RECHECK_CONDITIONS = Object.freeze({
     unknown: 'Not established',
@@ -13,7 +14,7 @@ function reference(value, label) {
         throw new TypeError(`${label} is invalid.`);
     return id;
 }
-function contextFields(item) {
+function contextFields(item, sourceVersion) {
     const targetHostname = text(item.targetHostname, 'Recheck target hostname', 253);
     if (targetHostname !== targetHostname.toLowerCase() || !isValidAsciiHostname(targetHostname)) {
         throw new TypeError('Use one normalised hostname for the recheck target, without a path or query.');
@@ -21,10 +22,16 @@ function contextFields(item) {
     const conditions = text(item.conditions, 'Recheck comparison conditions', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!conditions.trim())
         throw new TypeError('Describe the conditions needed to compare the observations.');
+    const responseObject = readCaseResponseObject(item.responseObject, sourceVersion);
+    if (responseObject && (responseObject.kind === 'domain' || responseObject.kind === 'hostname'
+        ? responseObject.identifier : new URL(responseObject.identifier).hostname) !== targetHostname) {
+        throw new TypeError('The recheck target hostname must match the exact object snapshot.');
+    }
     return Object.freeze({
         targetHostname,
         conditions,
         baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin'),
+        ...(responseObject ? { responseObject } : {}),
     });
 }
 /** Optional current-format context; historical records have no invented question. */
@@ -33,19 +40,19 @@ export function readCaseRecheckContext(value, sourceVersion) {
         return undefined;
     if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
         throw new TypeError('This Case format cannot contain structured recheck questions.');
-    return contextFields(exact(value, ['targetHostname', 'baselinePinId', 'conditions'], 'Recheck question context'));
+    return contextFields(exactOptional(value, ['targetHostname', 'baselinePinId', 'conditions'], ['responseObject'], 'Recheck question context'), sourceVersion);
 }
 export function readCaseRecheckAnswerContext(value, sourceVersion) {
     if (value === undefined)
         return undefined;
     if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
         throw new TypeError('This Case format cannot contain structured recheck answers.');
-    const item = exact(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], 'Recheck answer context');
+    const item = exactOptional(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], ['responseObject'], 'Recheck answer context');
     const question = text(item.question, 'Recheck question', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!question.trim())
         throw new TypeError('A recheck answer requires its original question.');
     return Object.freeze({
-        ...contextFields(item),
+        ...contextFields(item, sourceVersion),
         questionId: reference(item.questionId, 'Recheck question ID'),
         question,
         conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison'),
@@ -92,6 +99,10 @@ const RECHECK_COMPARISON_MESSAGES = {
     later_observation_needed: 'A later source observation is needed; reviewing the baseline again is not a recheck.',
     baseline_target_mismatch: 'The baseline concerns a different hostname.',
     different_field_or_source: 'The observations use different fields or sources.',
+    missing_object_baseline: 'An object-specific baseline is required for this exact-object comparison.',
+    baseline_object_mismatch: 'The baseline does not explicitly concern this same object.',
+    current_object_mismatch: 'The current observation does not explicitly concern this same object.',
+    incomplete_object_baseline: 'The exact-object baseline must be a complete source observation.',
 };
 /** Admissibility depends on these reasons, not on presentation warnings. */
 export function caseRecheckComparisonBlockers(context, pins, current) {
@@ -102,6 +113,16 @@ export function caseRecheckComparisonBlockers(context, pins, current) {
             : 'unconfirmed_conditions');
     }
     const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    if (context.responseObject) {
+        if (!baseline)
+            blockers.push('missing_object_baseline');
+        else if (!sameCaseResponseObject(baseline.responseObject, context.responseObject))
+            blockers.push('baseline_object_mismatch');
+        if (baseline && !casePinHasCompleteObservation(baseline))
+            blockers.push('incomplete_object_baseline');
+        if (!current || !sameCaseResponseObject(current.responseObject, context.responseObject))
+            blockers.push('current_object_mismatch');
+    }
     if (context.baselinePinId && !baseline)
         blockers.push('missing_baseline');
     if (current) {
@@ -147,3 +168,12 @@ export function assertRecheckNonReproduction(state, context, completeness, pins,
         throw new Error('Not reproduced requires a complete observation under comparable conditions. Record unavailable or describe the limited observation instead.');
     }
 }
+export const COMPARATIVE_CASE_OBJECT_OUTCOMES = Object.freeze(['removed', 'restricted', 'suspended', 'delisted', 'transferred', 'restored']);
+/** Technical state changes need an exact-object baseline; procedural dispute is distinct. */
+export function assertCaseObjectObservationOutcome(outcome, context, completeness, pins, current, observedAt) {
+    if (!outcome || !COMPARATIVE_CASE_OBJECT_OUTCOMES.includes(outcome))
+        return;
+    if (!context?.responseObject)
+        throw new TypeError('An independent object state change requires a saved exact-object baseline question and comparable evidence.');
+    assertRecheckNonReproduction('not_reproduced', context, completeness, pins, current, observedAt);
+}