@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/packages/interchange/managed-indicator-export.mjs

@@ -1,4 +1,5 @@
-import { readManagedIndicatorSet } from "./managed-indicator-set.mjs";
+import { readManagedIndicatorSet, serializeManagedIndicatorSet } from "./managed-indicator-set.mjs";
+import { terminalSafeJson } from "./json-output.mjs";
 import { stixIndicatorObjects, stixIndicatorProducer } from "./stix-indicator-export.mjs";
 import { mispIndicatorAttribute, mispIndicatorEvent } from "./misp-indicator-export.mjs";
 /** Re-exporting a revision is deterministic; revoked object versions never advance. */
@@ -29,7 +30,7 @@ export async function exportManagedIndicators(input, format) {
     }
     else if (format !== 'manifest')
         throw new TypeError('Unsupported managed indicator export format.');
-    return { document, content: `${JSON.stringify(document, null, 2)}\n`,
+    return { document, content: format === 'manifest' ? serializeManagedIndicatorSet(manifest) : `${terminalSafeJson(document, 2)}\n`,
         filename: `whoisleuth-indicators-${manifest.id}-r${manifest.revision}.${format}.json`,
         mimeType: format === 'stix' ? 'application/stix+json;charset=utf-8' : 'application/json;charset=utf-8' };
 }

package/packages/interchange/managed-indicator-set.mjs

@@ -5,6 +5,7 @@ import { parseBoundedJson, boundedJsonLimitsForBytes } from "../analysis/bounded
 import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION, MAX_MANAGED_INDICATOR_SET_BYTES, MAX_MANAGED_INDICATOR_PLAN_BYTES } from "../contracts/analyst-interchange.mjs";
 import { defensiveIndicatorProvenance, prepareDefensiveIndicatorExport, MAX_DEFENSIVE_INDICATOR_INPUTS } from "./defensive-indicator-export.mjs";
 import { MAX_STIX_INDICATORS } from "./stix-indicator-export.mjs";
+import { terminalSafeJson } from "./json-output.mjs";
 export const MAX_MANAGED_INDICATORS = MAX_STIX_INDICATORS;
 export const MAX_INDICATOR_REVIEW_BASIS = 1_000;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
@@ -96,6 +97,17 @@ export function parseManagedIndicatorJson(raw, plan = false) {
     const maximumBytes = plan ? MAX_MANAGED_INDICATOR_PLAN_BYTES : MAX_MANAGED_INDICATOR_SET_BYTES;
     return parseBoundedJson(raw, { maximumBytes, label: 'Managed indicator input', limits: boundedJsonLimitsForBytes(maximumBytes) });
 }
+/** Both writers enforce the reader's budget on final UTF-8 bytes, including escapes. */
+export function serializeManagedIndicatorSet(manifest) {
+    const pretty = `${terminalSafeJson(manifest, 2)}\n`;
+    if (new TextEncoder().encode(pretty).byteLength <= MAX_MANAGED_INDICATOR_SET_BYTES)
+        return pretty;
+    const compact = terminalSafeJson(manifest);
+    if (new TextEncoder().encode(compact).byteLength > MAX_MANAGED_INDICATOR_SET_BYTES) {
+        throw new TypeError('The indicator revision exceeds the file byte limit after safe JSON encoding; no partial file was created.');
+    }
+    return compact;
+}
 export function managedIndicatorState(entry, at) {
     iso(at, 'Review time');
     return entry.withdrawal ? 'withdrawn' : Date.parse(entry.expiresAt) <= Date.parse(at) ? 'expired' : 'active';
@@ -205,6 +217,7 @@ export async function buildManagedIndicatorRevision(input, now = new Date().toIS
         revision: (previous?.revision ?? 0) + 1, createdAt: previous?.createdAt ?? generatedAt, modifiedAt: generatedAt,
         previous: previous ? { revisionId: previous.revisionId, digestSha256: previous.integrity.digestSha256 } : null, entries };
     const manifest = validateManagedIndicatorSet({ ...unsigned, integrity: { algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256: await sha256ArtifactDigestV2(unsigned) } });
+    serializeManagedIndicatorSet(manifest);
     const changes = previous ? compareManagedIndicatorRevisions(previous, manifest) : manifest.entries.map(entry => ({ id: entry.id, domain: entry.domain, kind: 'added' }));
     return { manifest, changes, unchanged: manifest.entries.length - changes.length, exclusions: preflight.exclusions };
 }

package/packages/investigation/acquisition-decision-packet.mjs

@@ -1,7 +1,11 @@
 import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../evidence/artifact-integrity.mjs";
 import { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../contracts/investigation-portability.mjs";
 import { isValidAsciiDomainName } from "../contracts/domain-name.mjs";
+import { parseBoundedJsonObject } from "../analysis/bounded-json.mjs";
+import { MAX_INVESTIGATION_PORTABLE_BYTES } from "../contracts/investigation-portability.mjs";
+import { array, boolean, domain, enumeration, exact, fail, iso, sameValues, strings, text as structureText, validateIntegrity } from "../evidence/artifact-structure.mjs";
 export { ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION };
+export { MAX_INVESTIGATION_PORTABLE_BYTES as MAX_ACQUISITION_DECISION_PACKET_BYTES };
 export const ACQUISITION_DECISIONS = [
     'unresolved',
     'continue_manual_review',
@@ -18,6 +22,80 @@ export const ACQUISITION_MANUAL_CHECKS = [
 const DECISION_SET = new Set(ACQUISITION_DECISIONS);
 const CHECK_SET = new Set(ACQUISITION_MANUAL_CHECKS);
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+function validateAcquisitionItem(value, label) {
+    const item = exact(value, ['id', 'label', 'state', 'detail', 'provenance'], label);
+    const id = enumeration(item.id, ['availability', 'contacts', 'lifecycle', 'mail', 'nameservers', 'operations', 'policy_eligibility', 'policy_lifecycle', 'policy_transfer', 'tls', 'transfer', 'web'], label);
+    enumeration(item.state, ['authoritative', 'observed', 'review', 'unavailable'], label);
+    structureText(item.label, label, 200);
+    structureText(item.detail, label, 2_000);
+    structureText(item.provenance, label, 300);
+    return id;
+}
+export function validateAcquisitionDecisionPacketStructure(value) {
+    const root = exact(value, ['schema', 'version', 'generatedAt', 'target', 'synthetic', 'evidenceObservedAt', 'analystReview', 'evidenceReview', 'limitations', 'integrity'], 'Acquisition decision packet');
+    if (root.schema !== ACQUISITION_DECISION_PACKET_SCHEMA)
+        fail('Acquisition decision packet schema');
+    iso(root.generatedAt, 'Acquisition decision packet generatedAt');
+    domain(root.target, 'Acquisition decision packet target');
+    boolean(root.synthetic, 'Acquisition decision packet synthetic');
+    iso(root.evidenceObservedAt, 'Acquisition decision packet evidenceObservedAt', true);
+    const review = exact(root.analystReview, ['decision', 'rationale', 'reviewedChecks', 'outstandingChecks', 'state'], 'Acquisition analyst review');
+    const decision = enumeration(review.decision, ACQUISITION_DECISIONS, 'Acquisition analyst review decision');
+    structureText(review.rationale, 'Acquisition analyst review rationale', 2_000, true);
+    const reviewed = strings(review.reviewedChecks, 'Acquisition reviewed checks', ACQUISITION_MANUAL_CHECKS.length, 40);
+    const outstanding = strings(review.outstandingChecks, 'Acquisition outstanding checks', ACQUISITION_MANUAL_CHECKS.length, 40);
+    const expectedReviewed = ACQUISITION_MANUAL_CHECKS.filter((item) => reviewed.includes(item));
+    const expectedOutstanding = ACQUISITION_MANUAL_CHECKS.filter((item) => !reviewed.includes(item));
+    if (!sameValues(reviewed, expectedReviewed) || !sameValues(outstanding, expectedOutstanding))
+        fail('Acquisition analyst review checks');
+    const expectedState = decision === 'unresolved' || reviewed.length < ACQUISITION_MANUAL_CHECKS.length ? 'draft' : 'reviewed';
+    if (review.state !== expectedState)
+        fail('Acquisition analyst review state');
+    const evidence = exact(root.evidenceReview, ['version', 'label', 'state', 'items', 'transitionDependencies', 'policyChecks', 'nextSteps', 'limitations'], 'Acquisition evidence review');
+    if (evidence.version !== 2)
+        fail('Acquisition evidence review');
+    structureText(evidence.label, 'Acquisition evidence review label', 200);
+    enumeration(evidence.state, ['incomplete', 'registered', 'review_transition', 'sale_signal', 'unregistered_observation'], 'Acquisition evidence review state');
+    const expectedEvidenceIds = {
+        items: ['availability', 'lifecycle', 'transfer', 'operations', 'contacts'],
+        transitionDependencies: ['nameservers', 'web', 'mail', 'tls'],
+        policyChecks: ['policy_eligibility', 'policy_lifecycle', 'policy_transfer'],
+    };
+    for (const key of ['items', 'transitionDependencies', 'policyChecks']) {
+        const expected = expectedEvidenceIds[key];
+        const values = array(evidence[key], `Acquisition evidence review ${key}`, expected.length, expected.length);
+        const ids = values.map((item, index) => validateAcquisitionItem(item, `Acquisition evidence review ${key}[${index}]`));
+        if (!sameValues(ids, expected))
+            fail(`Acquisition evidence review ${key}`);
+    }
+    strings(evidence.nextSteps, 'Acquisition next steps', 6, 600);
+    strings(evidence.limitations, 'Acquisition evidence limitations', 12, 600);
+    strings(root.limitations, 'Acquisition limitations', 8, 600);
+    validateIntegrity(root.integrity, 'Acquisition integrity', root.version, ACQUISITION_DECISION_PACKET_VERSION);
+}
+function freezePacket(value) {
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            freezePacket(item);
+        Object.freeze(value);
+    }
+}
+/** Validate the existing supported format and full canonical digest before preview. */
+export async function readAcquisitionDecisionPacket(raw, expected) {
+    const value = parseBoundedJsonObject(raw, { label: 'Acquisition decision packet', maximumBytes: MAX_INVESTIGATION_PORTABLE_BYTES });
+    if (value.schema !== ACQUISITION_DECISION_PACKET_SCHEMA)
+        fail('Acquisition decision packet schema');
+    validateAcquisitionDecisionPacketStructure(value);
+    const { integrity, ...unsigned } = value;
+    if (await sha256ArtifactDigestV2(unsigned) !== integrity.digestSha256) {
+        throw new TypeError('The acquisition decision packet failed its integrity check.');
+    }
+    if (value.target !== target(expected.target) || value.synthetic !== expected.synthetic) {
+        throw new TypeError('This packet belongs to a different target or demonstration context. The current review is unchanged.');
+    }
+    freezePacket(value);
+    return value;
+}
 function text(value, maximum) {
     return typeof value === 'string'
         ? value.replace(CONTROL_CHARACTERS, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)

package/packages/investigation/bulk-mail-exposure.mjs

@@ -99,8 +99,8 @@ function relation(state, profile, profileSourceState, profileContextComparable,
             ? {
                 baselineRelation: state === 'authenticated_mail' ? 'aligned' : 'review',
                 baselineDetail: state === 'authenticated_mail'
-                    ? 'Receiving mail plus SPF and DMARC matches the configured standard-mail baseline.'
-                    : 'Receiving mail was observed with an authentication gap relative to the configured baseline.',
+                    ? 'Published MX, SPF and DMARC records match the configured standard-mail baseline.'
+                    : 'MX publication was observed with a mail-authentication policy gap relative to the configured baseline.',
             }
             : {
                 baselineRelation: 'review',

package/packages/investigation/context-review.mjs

@@ -1,7 +1,7 @@
 import { parseBoundedJson } from "../analysis/bounded-json.mjs";
 import { exact, text } from "../evidence/artifact-structure.mjs";
 import { readEditableCaseExport } from "../cases/case-export-input.mjs";
-import { MAX_CONTEXT_INPUT_BYTES } from "../contracts/context-review.mjs";
+import { MAX_CONTEXT_INPUT_BYTES, DOMAIN_HISTORY_LEGACY_INPUT_VERSION } from "../contracts/context-review.mjs";
 import { DOMAIN_HISTORY_INPUT_SCHEMA, DOMAIN_HISTORY_INPUT_VERSION, reviewDomainHistory } from "./domain-history-review.mjs";
 import { PLATFORM_CONTINUITY_INPUT_SCHEMA, PLATFORM_CONTINUITY_INPUT_VERSION, reviewPlatformContinuity } from "./platform-continuity-review.mjs";
 import { STOREFRONT_INPUT_SCHEMA, STOREFRONT_INPUT_VERSION, reviewStorefront } from "./storefront-review.mjs";
@@ -11,14 +11,14 @@ export { CONTEXT_INPUT_SCHEMAS } from "../contracts/context-review.mjs";
 /** Adapters share the same explicit dispatch; each domain owns its validation. */
 export function reviewContextInput(raw, reviewedAt) {
     const input = exact(raw, ['schema', 'version', 'evidence'], 'Context review input');
-    if (input.schema === DOMAIN_HISTORY_INPUT_SCHEMA && input.version === DOMAIN_HISTORY_INPUT_VERSION) {
+    if (input.schema === DOMAIN_HISTORY_INPUT_SCHEMA && (input.version === DOMAIN_HISTORY_INPUT_VERSION || input.version === DOMAIN_HISTORY_LEGACY_INPUT_VERSION)) {
         const evidence = exact(input.evidence, ['caseExport', 'caseId', 'declarations'], 'Domain history input');
         const caseId = text(evidence.caseId, 'Selected Case ID', 240);
         const cases = readEditableCaseExport(JSON.stringify(evidence.caseExport));
         const selected = cases.find(record => record.id === caseId);
         if (!selected)
             throw new TypeError('The selected Case is not present in this export.');
-        return reviewDomainHistory(selected, evidence.declarations, reviewedAt);
+        return reviewDomainHistory(selected, evidence.declarations, reviewedAt, input.version);
     }
     if (input.schema === PLATFORM_CONTINUITY_INPUT_SCHEMA && input.version === PLATFORM_CONTINUITY_INPUT_VERSION)
         return reviewPlatformContinuity(input.evidence, reviewedAt);

package/packages/investigation/document-intake.mjs

@@ -1,11 +1,12 @@
 import { createIntakeReport } from "./intake-report.mjs";
 import { createLinkIntake } from "./link-intake.mjs";
+import { createIndicatorIntake } from "./intake-indicators.mjs";
 import { decodeQrPixels } from "./qr-intake.mjs";
 import { sha256ArtifactBytes } from "../evidence/artifact-integrity.mjs";
 import { MAX_DOCUMENT_PARTS, MAX_DOCUMENT_TEXT_BYTES, MAX_DOCUMENT_TOTAL_IMAGE_PIXELS } from "../contracts/document-intake.mjs";
 /** The format adapters provide inert text/pixels; this owner retains provenance and links. */
 export async function createDocumentIntake(bytes, kind, reviewedAt) {
-    const base = await createIntakeReport(bytes, kind, reviewedAt), links = createLinkIntake();
+    const base = await createIntakeReport(bytes, kind, reviewedAt), links = createLinkIntake(), indicators = createIndicatorIntake();
     const parts = [], notes = new Set();
     let textBytes = 0, imagePixels = 0;
     let state = 'reviewed', pageCount = null, reviewedPages = 0;
@@ -38,8 +39,10 @@ export async function createDocumentIntake(bytes, kind, reviewedAt) {
                 return;
             }
             const location = await part({ kind: 'text', page, identity: original ? 'original_part_bytes' : 'extracted_text', state: 'reviewed' }, original ?? encoded);
-            if (location)
+            if (location) {
                 links.addText(value, 'document_text', location);
+                indicators.addText(value, 'document_text', location);
+            }
         },
         async destinations(values, page, original) {
             const encoded = encoder.encode(JSON.stringify(values));
@@ -73,7 +76,10 @@ export async function createDocumentIntake(bytes, kind, reviewedAt) {
                 partial(limitation);
             if (result.bounded)
                 partial('Further extracted links exceed the review bound.');
-            return { targets: result.targets, report: { ...base, links: result.links,
+            const indicatorResult = indicators.result();
+            if (indicatorResult.indicatorCoverage.state === 'partial')
+                partial('Further indicator extraction exceeds the review bound.');
+            return { targets: result.targets, report: { ...base, ...indicatorResult, links: result.links,
                     coverage: { ...base.coverage, state: state === 'reviewed' ? 'reviewed' : 'partial', reviewedParts: parts.length, rejectedLinks: result.rejected },
                     documentReview: { state, pageCount, reviewedPages, parts, notes: [...notes] } } };
         },

package/packages/investigation/domain-history-review.mjs

@@ -1,12 +1,21 @@
-import { caseEvidenceIncomparableReasons, compareCaseEvidence } from "../cases/case-evidence-model.mjs";
+import { caseEvidenceFieldScope, caseEvidenceIncomparableReasons, compareCaseEvidence } from "../cases/case-evidence-model.mjs";
 import { domainTransitionReview } from "./domain-transition-review.mjs";
 import { MAX_CASE_EVIDENCE_PINS, MAX_EVIDENCE_SNAPSHOTS_PER_CASE } from "../contracts/case-portability.mjs";
 import { array, domain, enumeration, exact, iso, text } from "../evidence/artifact-structure.mjs";
 import { CONTEXT_REVIEW_SCHEMA, CONTEXT_REVIEW_VERSION, MAX_CONTEXT_RECORDS } from "../contracts/context-review.mjs";
 export { DOMAIN_HISTORY_INPUT_SCHEMA, DOMAIN_HISTORY_INPUT_VERSION } from "../contracts/context-review.mjs";
 export const DOMAIN_CHANGE_FAMILIES = ['registration', 'dns', 'mail', 'certificate', 'web'];
-export function readDomainHistoryDeclarations(raw) {
-    const input = exact(raw, ['expectedChanges', 'retiredDependencies'], 'Domain history declarations');
+export const RETIRED_DEPENDENCY_REVIEW_STEPS = Object.freeze([
+    'DNS aliases: review owned CNAME records and delegated nameservers for references to the retired hostname. Record the configuration source and a deliberate cleanup plan; a remaining reference alone does not establish takeover availability.',
+    'Recovery email: review account-recovery and administrator-contact dependencies on the retired mail domain. Confirm a replacement through the account owner before removing access; record a source label, not email addresses or recovery secrets.',
+    'Integration references: review retained application, sign-in, webhook and third-party service configuration for the retired hostname. Record the responsible service and change reference without credentials or complete URLs; retained configuration does not prove a reference is still active.',
+]);
+export const REGISTRATION_BOUNDARY_KINDS = ['registration_reported', 'deletion_reported', 'reregistration_reported', 'transfer_reported', 'review_boundary'];
+export const MAX_REGISTRATION_BOUNDARIES = 40;
+export function readDomainHistoryDeclarations(raw, version = 1) {
+    if (version !== 1 && version !== 2)
+        throw new TypeError('Unsupported domain-history declaration version.');
+    const input = exact(raw, ['expectedChanges', 'retiredDependencies', ...(version === 2 ? ['registrationBoundaries'] : [])], 'Domain history declarations');
     const expectedChanges = array(input.expectedChanges, 'Expected changes', MAX_CONTEXT_RECORDS).map(value => {
         const item = exact(value, ['family', 'start', 'end', 'reason'], 'Expected change');
         iso(item.start, 'Expected window start');
@@ -22,7 +31,22 @@ export function readDomainHistoryDeclarations(raw) {
         iso(item.retiredAt, 'Retirement time');
         return { asset: item.asset, dependency: item.dependency, family: enumeration(item.family, DOMAIN_CHANGE_FAMILIES, 'Dependency family'), retiredAt: item.retiredAt, source: text(item.source, 'Retirement source', 500) };
     });
-    return { expectedChanges, retiredDependencies };
+    const registrationBoundaries = version === 1 ? [] : array(input.registrationBoundaries, 'Registration boundaries', MAX_REGISTRATION_BOUNDARIES).map(value => {
+        const item = exact(value, ['kind', 'occurredAt', 'source', 'rationale', 'snapshotIds', 'evidencePinIds'], 'Registration boundary');
+        iso(item.occurredAt, 'Declared boundary time');
+        const references = (raw, label) => {
+            const values = array(raw, label, 20).map(id => text(id, label, 240));
+            if (new Set(values).size !== values.length)
+                throw new TypeError('Registration boundary references must be unique.');
+            return values;
+        };
+        const snapshotIds = references(item.snapshotIds, 'Snapshot references'), evidencePinIds = references(item.evidencePinIds, 'Evidence pin references');
+        if (!snapshotIds.length && !evidencePinIds.length)
+            throw new TypeError('Link a retained snapshot or evidence pin to the declared boundary.');
+        return { kind: enumeration(item.kind, REGISTRATION_BOUNDARY_KINDS, 'Registration boundary kind'), occurredAt: item.occurredAt,
+            source: text(item.source, 'Boundary source', 160), rationale: text(item.rationale, 'Boundary rationale', 500), snapshotIds, evidencePinIds };
+    });
+    return { expectedChanges, retiredDependencies, registrationBoundaries };
 }
 function family(field) {
     if (['registrar', 'createdDate', 'expiryDate', 'availability'].includes(field))
@@ -32,19 +56,21 @@ function family(field) {
     if (['hasMx', 'hasSpf', 'hasDmarc'].includes(field))
         return 'mail';
     if (field.startsWith('http') || ['activityStatus', 'pageTitle', 'websiteProbeDetail', 'faviconMatch', 'faviconNearMatch',
-        'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'pageBaselineMatch'].includes(field))
+        'reusesOfficialAssets', 'hasPasswordField', 'hasExternalFormAction', 'hasExternalPasswordForm', 'pageBaselineMatch'].includes(field))
         return 'web';
     return null;
 }
 /** Input is a canonical Case from storage or the existing exact Case-export reader. */
-export function reviewDomainHistory(record, declarations, reviewedAt) {
+export function reviewDomainHistory(record, declarations, reviewedAt, declarationVersion = 1) {
     iso(reviewedAt, 'Review time');
-    const declared = readDomainHistoryDeclarations(declarations);
+    const declared = readDomainHistoryDeclarations(declarations, declarationVersion);
     const related = (hostname) => hostname === record.domain || hostname.endsWith(`.${record.domain}`);
     if (declared.retiredDependencies.some(row => !related(row.asset) && !related(row.dependency)))
         throw new TypeError('A retired dependency must involve this Case domain or one of its hostnames.');
     array(record.evidenceHistory, 'Case evidence history', MAX_EVIDENCE_SNAPSHOTS_PER_CASE);
     array(record.evidencePins, 'Case evidence pins', MAX_CASE_EVIDENCE_PINS);
+    if (declared.registrationBoundaries.some(row => row.snapshotIds.some(id => record.evidenceHistory.filter(item => item.id === id).length !== 1) || row.evidencePinIds.some(id => record.evidencePins.filter(item => item.id === id).length !== 1)))
+        throw new TypeError('A declared registration boundary refers to evidence not uniquely retained in this Case.');
     const snapshots = [...record.evidenceHistory].sort((a, b) => Date.parse(a.capturedAt) - Date.parse(b.capturedAt) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
     const observations = [];
     let orderedPairs = 0;
@@ -81,20 +107,32 @@ export function reviewDomainHistory(record, declarations, reviewedAt) {
             const windows = declared.expectedChanges.filter(row => row.family === category && Date.parse(row.start) <= Date.parse(after.capturedAt) && Date.parse(row.end) >= Date.parse(before.capturedAt));
             observations.push({ label: `${category} · ${change.label}`, state: 'changed',
                 detail: `${JSON.stringify(change.before)} → ${JSON.stringify(change.after)}${windows.length ? ` · Overlaps ${windows.length} analyst-declared expected-change window(s); not automatically approved.` : ''}`,
-                source: `${before.source} ${before.id} → ${after.source} ${after.id}`, observedAt: after.capturedAt, hostname: after.observationHostname ?? record.domain });
+                source: `${before.source} ${before.id} → ${after.source} ${after.id}`, observedAt: after.capturedAt,
+                hostname: caseEvidenceFieldScope(change.field) === 'registration' ? record.domain : after.observationHostname ?? null });
         }
     }
     for (const pin of record.evidencePins.filter(pin => pin.certificateObservation)) {
         observations.push({ label: `Retained certificate · ${pin.label}`, state: pin.completeness === 'complete' && pin.truncated !== true ? 'observed' : 'partial', detail: pin.value,
-            source: `${pin.source} · pin ${pin.id}`, observedAt: pin.observedAt, hostname: record.domain });
+            source: `${pin.source} · pin ${pin.id}`, observedAt: pin.observedAt, hostname: pin.observationHostname ?? null });
     }
     for (const row of declared.expectedChanges)
         observations.push({ label: `Expected ${row.family} change`, state: 'reported', detail: `${row.start} – ${row.end} · ${row.reason}`, source: 'Analyst declaration', observedAt: null, hostname: record.domain });
     for (const row of declared.retiredDependencies)
         observations.push({ label: `Declared retired ${row.family} dependency`, state: 'reported', detail: `${row.asset} depended on ${row.dependency}. Check whether owned configuration still references it.`, source: row.source, observedAt: row.retiredAt, hostname: row.dependency });
+    for (const row of declared.registrationBoundaries) {
+        const earlier = snapshots.filter(snapshot => Date.parse(snapshot.capturedAt) < Date.parse(row.occurredAt)).length;
+        const later = snapshots.filter(snapshot => Date.parse(snapshot.capturedAt) >= Date.parse(row.occurredAt)).length;
+        observations.push({ label: `Declared registration boundary · ${row.kind.replaceAll('_', ' ')}`, state: 'reported',
+            detail: `${row.rationale} Retained snapshots before this declared boundary: ${earlier}; at or after: ${later}. This partitions observation times for review, not verified ownership or registration epochs.`,
+            source: `${row.source} · snapshots: ${row.snapshotIds.join(', ') || 'none'} · evidence pins: ${row.evidencePinIds.join(', ') || 'none'}`, observedAt: row.occurredAt, hostname: record.domain });
+    }
+    if (declared.registrationBoundaries.length)
+        prompts.add('Review earlier assertions, exceptions and response baselines against each declared registration boundary. Earlier evidence and open follow-ups remain unchanged; only a deliberate analyst update can revise a decision.');
     const certificateCount = observations.filter(row => row.label.startsWith('Retained certificate')).length;
     return { schema: CONTEXT_REVIEW_SCHEMA, version: CONTEXT_REVIEW_VERSION, kind: 'domain_history', reviewedAt, title: 'Domain history and retired dependencies', state: orderedPairs < 1 || limitedPairs > 0 ? 'partial' : 'reviewed',
-        summary: `Retained snapshots: ${snapshots.length}; time-ordered pairs: ${orderedPairs}; limited pairs: ${limitedPairs}; certificate pins: ${certificateCount}; declared retired dependencies: ${declared.retiredDependencies.length}.`, observations,
-        nextSteps: [...prompts, 'Review changed registration, DNS, mail and web evidence against declared maintenance windows.', 'Recheck owned references to retired dependencies before changing configuration; preserve evidence of legitimate transfers or rebrands.'],
-        limitations: ['This review uses retained Case evidence, not fresh collection. Missing or incompatible fields are not compared.', 'Certificate pins retain their own source and completeness; they are not equivalent to live TLS observations.', 'Changes and retired dependencies do not establish ownership transfer, malicious repurposing or takeover availability.'] };
+        summary: `Retained snapshots: ${snapshots.length}; time-ordered pairs: ${orderedPairs}; limited pairs: ${limitedPairs}; certificate pins: ${certificateCount}; declared retired dependencies: ${declared.retiredDependencies.length}.${declarationVersion === 2 ? ` Analyst-declared registration boundaries: ${declared.registrationBoundaries.length}.` : ''}`, observations,
+        nextSteps: [...prompts, 'Review changed registration, DNS, mail and web evidence against declared maintenance windows.', 'Recheck owned references to retired dependencies before changing configuration; preserve evidence of legitimate transfers or rebrands.',
+            ...(declared.retiredDependencies.length ? RETIRED_DEPENDENCY_REVIEW_STEPS : [])],
+        limitations: ['This review uses retained Case evidence, not fresh collection. Missing or incompatible fields are not compared.', 'Certificate pins retain their own source and completeness; they are not equivalent to live TLS observations.', 'Changes and retired dependencies do not establish ownership transfer, malicious repurposing or takeover availability.',
+            ...(declarationVersion === 2 ? ['Registration boundaries are analyst declarations linked to retained records, not independently verified deletion, re-registration or ownership events. Expiry and registrar changes do not establish those events.'] : [])] };
 }

package/packages/investigation/domain-transition-review.mjs

@@ -27,6 +27,8 @@ export function domainTransitionReview(field, before, after) {
                 : 'Review the current page evidence before changing the assessment; removal of one form does not establish that the incident is resolved.';
         case 'hasExternalFormAction':
             return 'Check the observed form destination and legitimate service use before updating the assessment. No form was submitted by this review.';
+        case 'hasExternalPasswordForm':
+            return 'Review the password form’s declared destination against the recorded concern and expected identity provider. A changed declaration is not an observed submission.';
         case 'faviconMatch':
         case 'faviconNearMatch':
         case 'reusesOfficialAssets':

package/packages/investigation/infrastructure-observation.mjs

@@ -0,0 +1,234 @@
+// Source-qualified, privacy-minimised retained infrastructure evidence. No collector
+// or store lives here; supplied observations never initiate network work.
+import { exact, text, enumeration, array, strings, iso, boolean } from "../evidence/artifact-structure.mjs";
+import { normalizeDomain } from "../evidence/domain-name.mjs";
+import { canonicalIpAddress } from "../contracts/ip-address.mjs";
+import { parseBoundedJson } from "../analysis/bounded-json.mjs";
+import { technologyEvidenceRoles } from "../evidence/technology-evidence-role.mjs";
+import { INFRASTRUCTURE_OBSERVATION_SCHEMA, INFRASTRUCTURE_OBSERVATION_VERSION, MAX_INFRASTRUCTURE_OBSERVATION_BYTES, MAX_INFRASTRUCTURE_HOSTS, MAX_INFRASTRUCTURE_DNS_ROWS, MAX_INFRASTRUCTURE_CERTIFICATES, MAX_INFRASTRUCTURE_ROLES, MAX_INFRASTRUCTURE_SOURCES, MAX_INFRASTRUCTURE_LIMITATIONS, INFRASTRUCTURE_DNS_TYPES, } from "../contracts/external-observation-interchange.mjs";
+export { INFRASTRUCTURE_OBSERVATION_SCHEMA, INFRASTRUCTURE_OBSERVATION_VERSION, MAX_INFRASTRUCTURE_OBSERVATION_BYTES };
+export { MAX_INFRASTRUCTURE_HOSTS, MAX_INFRASTRUCTURE_DNS_ROWS, MAX_INFRASTRUCTURE_CERTIFICATES, MAX_INFRASTRUCTURE_ROLES, INFRASTRUCTURE_DNS_TYPES };
+export const INFRASTRUCTURE_SOURCE_FAMILIES = ['dns', 'certificate_log', 'tls', 'technology', 'ip_registration', 'routing', 'origin_observation', 'analyst'];
+export const INFRASTRUCTURE_PROVIDER_ROLES = ['dns_operator', 'observed_edge', 'application_platform', 'framework_runtime', 'embedded_dependency', 'address_registration', 'routing_origin', 'observed_origin'];
+export function infrastructureCohortLabel(cohort) {
+    switch (cohort.kind) {
+        case 'dns': return `Query ${cohort.queriedName} · owner ${cohort.ownerName} · ${cohort.type} ${cohort.aspect}`;
+        case 'certificate_names': return `Certificate SHA-256 ${cohort.fingerprintSha256}`;
+        case 'provider_role': return `${cohort.subjectType} ${cohort.subject} · ${cohort.role}`;
+    }
+}
+function hostname(raw) {
+    const value = text(raw, 'Infrastructure hostname', 253);
+    if (normalizeDomain(value) !== value)
+        throw new TypeError('Infrastructure hostnames must be exact canonical hostnames.');
+    return value;
+}
+function name(raw) {
+    const value = text(raw, 'Certificate name', 255);
+    hostname(value.startsWith('*.') ? value.slice(2) : value);
+    return value;
+}
+function identifier(raw, label) {
+    const value = text(raw, label, 120);
+    if (!/^[a-zA-Z0-9_-]+$/u.test(value))
+        throw new TypeError(`${label} must use a bounded portable identity.`);
+    return value;
+}
+function unique(values, label, key = value => String(value)) {
+    if (new Set(values.map(key)).size !== values.length)
+        throw new TypeError(`${label} contains duplicate or ambiguous identities.`);
+    return values;
+}
+function at(raw) { iso(raw, 'Infrastructure observation time'); return new Date(raw).toISOString(); }
+function flag(raw) { boolean(raw, 'Infrastructure completeness'); return raw; }
+/** Exact current reader. Old Case pins lacking this field remain unknown, never reconstructed. */
+export function readInfrastructureObservation(raw) {
+    // Bound hostile object traversal before serialisation or parsing work.
+    const root = exact(raw, ['schema', 'version', 'id', 'target', 'observedAt', 'mode', 'scope', 'coverage', 'sources', 'dns', 'certificates', 'roles', 'limitations'], 'Infrastructure snapshot');
+    if (root.schema !== INFRASTRUCTURE_OBSERVATION_SCHEMA || root.version !== INFRASTRUCTURE_OBSERVATION_VERSION)
+        throw new TypeError('Unsupported infrastructure snapshot schema or version.');
+    const scope = exact(root.scope, ['hostnames', 'dnsTypes', 'selection'], 'Infrastructure scope');
+    const selection = enumeration(scope.selection, ['explicit_hosts', 'certificate_names'], 'Selection scope');
+    const hostnames = unique(array(scope.hostnames, 'Selected hostnames', MAX_INFRASTRUCTURE_HOSTS, selection === 'explicit_hosts' ? 1 : 0).map(hostname), 'Selected hostnames');
+    const dnsTypes = unique(array(scope.dnsTypes, 'Selected DNS types', INFRASTRUCTURE_DNS_TYPES.length).map(value => enumeration(value, INFRASTRUCTURE_DNS_TYPES, 'DNS type')), 'Selected DNS types');
+    const coverage = exact(root.coverage, ['state', 'truncated', 'detail'], 'Infrastructure coverage');
+    const sources = unique(array(root.sources, 'Infrastructure sources', MAX_INFRASTRUCTURE_SOURCES, 1).map(rawSource => {
+        const source = exact(rawSource, ['id', 'name', 'family', 'evidenceClass', 'reference'], 'Infrastructure source');
+        const reference = source.reference === null ? null : text(source.reference, 'Source reference', 300);
+        if (reference !== null && /[?#]|\b(?:cookie|password|bearer)\s*[:=]/iu.test(reference))
+            throw new TypeError('Source references must not retain query strings, fragments or credentials.');
+        if (reference?.includes('://')) {
+            let url;
+            try {
+                url = new URL(reference);
+            }
+            catch {
+                throw new TypeError('Source reference URL is invalid.');
+            }
+            if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password)
+                throw new TypeError('Source references cannot retain credentials or unsafe URL schemes.');
+        }
+        return { id: identifier(source.id, 'Source ID'), name: text(source.name, 'Source name', 80), family: enumeration(source.family, INFRASTRUCTURE_SOURCE_FAMILIES, 'Source family'), evidenceClass: enumeration(source.evidenceClass, ['local_observation', 'provider_report'], 'Evidence class'), reference };
+    }), 'Source IDs', value => value.id);
+    const sourceMap = new Map(sources.map(value => [value.id, value]));
+    function sourceId(rawId, families) {
+        const id = identifier(rawId, 'Observation source ID'), source = sourceMap.get(id);
+        if (!source || !families.includes(source.family))
+            throw new TypeError('An observation requires its own matching source family.');
+        return id;
+    }
+    const dns = array(root.dns, 'DNS observations', MAX_INFRASTRUCTURE_DNS_ROWS).map(rawRow => {
+        const row = exact(rawRow, ['sourceId', 'queriedName', 'ownerName', 'type', 'observedAt', 'outcome', 'values', 'complete', 'truncated'], 'DNS observation');
+        const type = enumeration(row.type, INFRASTRUCTURE_DNS_TYPES, 'DNS type');
+        const queriedName = hostname(row.queriedName), ownerName = hostname(row.ownerName);
+        if (!hostnames.includes(queriedName) || !dnsTypes.includes(type))
+            throw new TypeError('DNS observation falls outside its explicit selected scope.');
+        const outcome = enumeration(row.outcome, ['answered', 'no_data', 'nxdomain', 'failed', 'not_checked'], 'DNS outcome');
+        const values = unique(array(row.values, 'DNS record values', 32).map(rawValue => {
+            const value = text(rawValue, 'DNS value', 300);
+            if (type === 'A' || type === 'AAAA') {
+                const address = canonicalIpAddress(value);
+                if (address !== value || (type === 'A') !== !value.includes(':'))
+                    throw new TypeError('DNS address value does not match its type.');
+            }
+            else if (type === 'MX') {
+                const match = /^(\d{1,5}) ([a-z0-9.-]+)$/u.exec(value);
+                if (!match || Number(match[1]) > 65535)
+                    throw new TypeError('MX records require an explicit preference and target.');
+                hostname(match[2]);
+            }
+            else
+                hostname(value);
+            return value;
+        }), 'DNS values');
+        if ((outcome === 'answered') !== (values.length > 0))
+            throw new TypeError('Answered DNS observations require values; other outcomes cannot retain answers.');
+        if (type === 'CNAME' && values.length > 1)
+            throw new TypeError('One CNAME owner cannot have competing alias targets.');
+        return { sourceId: sourceId(row.sourceId, ['dns']), queriedName, ownerName, type, observedAt: at(row.observedAt), outcome, values, complete: flag(row.complete), truncated: flag(row.truncated) };
+    });
+    unique(dns, 'DNS observation identities', row => JSON.stringify([row.sourceId, row.queriedName, row.ownerName, row.type, row.observedAt]));
+    const certificates = array(root.certificates, 'Certificate observations', MAX_INFRASTRUCTURE_CERTIFICATES).map(rawRow => {
+        const row = exact(rawRow, ['sourceId', 'fingerprintSha256', 'observedAt', 'names', 'namesComplete'], 'Certificate observation');
+        const fingerprintSha256 = text(row.fingerprintSha256, 'Certificate digest', 64);
+        if (!/^[a-f0-9]{64}$/u.test(fingerprintSha256))
+            throw new TypeError('Certificate identity requires an exact SHA-256 digest.');
+        return { sourceId: sourceId(row.sourceId, ['tls', 'certificate_log']), fingerprintSha256, observedAt: at(row.observedAt), names: unique(array(row.names, 'Certificate names', MAX_INFRASTRUCTURE_HOSTS, 1).map(name), 'Certificate names'), namesComplete: flag(row.namesComplete) };
+    });
+    unique(certificates, 'Certificate observation identities', row => JSON.stringify([row.sourceId, row.fingerprintSha256, row.observedAt]));
+    const roleFamilies = {
+        dns_operator: ['dns'], observed_edge: ['technology'], application_platform: ['technology'], framework_runtime: ['technology'], embedded_dependency: ['technology'], address_registration: ['ip_registration'], routing_origin: ['routing'], observed_origin: ['origin_observation'],
+    };
+    const roles = array(root.roles, 'Provider role observations', MAX_INFRASTRUCTURE_ROLES).map(rawRow => {
+        const row = exact(rawRow, ['sourceId', 'subject', 'subjectType', 'role', 'providerId', 'providerLabel', 'value', 'observedAt', 'complete'], 'Provider role observation');
+        const subjectType = enumeration(row.subjectType, ['hostname', 'address'], 'Provider subject type');
+        const subject = subjectType === 'hostname' ? hostname(row.subject) : text(row.subject, 'Provider address', 45);
+        if (subjectType === 'address' && canonicalIpAddress(subject) !== subject)
+            throw new TypeError('Provider role address is invalid.');
+        if (subjectType === 'hostname' && !hostnames.includes(subject))
+            throw new TypeError('Provider-role hostname falls outside the selected scope.');
+        const role = enumeration(row.role, INFRASTRUCTURE_PROVIDER_ROLES, 'Provider role');
+        const value = text(row.value, 'Provider role value', 300);
+        if (role === 'routing_origin') {
+            if (subjectType !== 'address' || !/^AS(?:[1-9]\d{0,9})$/u.test(value) || Number(value.slice(2)) > 4_294_967_295)
+                throw new TypeError('Routing evidence requires an address and independently sourced ASN.');
+        }
+        if (role === 'observed_origin' && normalizeDomain(value) !== value && canonicalIpAddress(value) !== value)
+            throw new TypeError('Independently observed origin must retain an exact hostname or address.');
+        return { sourceId: sourceId(row.sourceId, roleFamilies[role]), subject, subjectType, role, providerId: identifier(row.providerId, 'Provider ID'), providerLabel: text(row.providerLabel, 'Provider label', 100), value, observedAt: at(row.observedAt), complete: flag(row.complete) };
+    });
+    unique(roles, 'Provider-role observation identities', row => JSON.stringify([row.sourceId, row.subjectType, row.subject, row.role, row.providerId, row.observedAt]));
+    if (roles.some(row => row.subjectType === 'address' && !dns.some(answer => answer.values.includes(row.subject))))
+        throw new TypeError('Provider-role addresses must have explicit supporting DNS address observations within the snapshot.');
+    const result = { schema: INFRASTRUCTURE_OBSERVATION_SCHEMA, version: INFRASTRUCTURE_OBSERVATION_VERSION, id: identifier(root.id, 'Snapshot ID'), target: hostname(root.target), observedAt: at(root.observedAt), mode: enumeration(root.mode, ['supplied', 'selected_lookup', 'certificate_log'], 'Collection mode'), scope: { hostnames, dnsTypes, selection: enumeration(scope.selection, ['explicit_hosts', 'certificate_names'], 'Selection scope') }, coverage: { state: enumeration(coverage.state, ['complete', 'partial', 'failed'], 'Coverage state'), truncated: flag(coverage.truncated), detail: text(coverage.detail, 'Coverage detail', 500) }, sources, dns, certificates, roles, limitations: unique(strings(root.limitations, 'Infrastructure limitations', MAX_INFRASTRUCTURE_LIMITATIONS, 300), 'Infrastructure limitations') };
+    if ([...dns, ...certificates, ...roles].some(row => row.observedAt > result.observedAt))
+        throw new TypeError('Snapshot time cannot precede one of its retained observations.');
+    if (result.coverage.state === 'complete' && (result.coverage.truncated || dns.some(row => !row.complete || row.truncated || ['failed', 'not_checked'].includes(row.outcome)) || certificates.some(row => !row.namesComplete) || roles.some(row => !row.complete)))
+        throw new TypeError('Complete snapshot coverage cannot contain incomplete observations.');
+    if (result.coverage.state === 'complete' && hostnames.some(host => dnsTypes.some(type => !dns.some(row => row.queriedName === host && row.type === type))))
+        throw new TypeError('Complete DNS coverage requires every explicitly selected host/type pair.');
+    if (new TextEncoder().encode(`${JSON.stringify(result)}\n`).byteLength > MAX_INFRASTRUCTURE_OBSERVATION_BYTES)
+        throw new TypeError('Infrastructure snapshot exceeds its retained byte bound.');
+    return result;
+}
+export function normalizeInfrastructureObservation(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    return readInfrastructureObservation(raw);
+}
+export function parseInfrastructureObservation(raw) {
+    return readInfrastructureObservation(parseBoundedJson(raw, { label: 'Infrastructure snapshot', maximumBytes: MAX_INFRASTRUCTURE_OBSERVATION_BYTES }));
+}
+export function serialiseInfrastructureObservation(raw) { return `${JSON.stringify(readInfrastructureObservation(raw))}\n`; }
+function dnsFactKey(row) { return JSON.stringify([row.sourceId, row.queriedName, row.ownerName, row.type]); }
+function roleFactKey(row) { return JSON.stringify([row.sourceId, row.subjectType, row.subject, row.role]); }
+/** A negative DNS answer has a clock too; a missing row has none. */
+function observationCohorts(snapshot) {
+    const cohorts = new Map();
+    const add = (key, observedAt, complete) => {
+        const cohort = cohorts.get(key) ?? { times: new Set(), complete: true };
+        cohort.times.add(observedAt);
+        cohort.complete &&= complete;
+        cohorts.set(key, cohort);
+    };
+    for (const row of snapshot.dns) {
+        const complete = row.complete && !row.truncated && !['failed', 'not_checked'].includes(row.outcome);
+        add(dnsFactKey(row), row.observedAt, complete);
+        add(JSON.stringify([row.sourceId, row.queriedName, row.ownerName, row.type, 'outcome']), row.observedAt, complete);
+    }
+    for (const row of snapshot.certificates)
+        add(JSON.stringify([row.sourceId, row.fingerprintSha256, 'certificate_names']), row.observedAt, row.namesComplete);
+    for (const row of snapshot.roles)
+        add(roleFactKey(row), row.observedAt, row.complete);
+    return cohorts;
+}
+export function infrastructureObservationFacts(raw) {
+    const snapshot = readInfrastructureObservation(raw);
+    const sources = new Map(snapshot.sources.map(source => [source.id, source]));
+    const facts = [];
+    const dnsCohort = (row, aspect) => ({ kind: 'dns', sourceId: row.sourceId, queriedName: row.queriedName, ownerName: row.ownerName, type: row.type, aspect });
+    for (const row of snapshot.dns)
+        for (const value of row.values)
+            facts.push({ key: dnsFactKey(row), cohort: dnsCohort(row, 'values'), hostname: row.ownerName, family: row.type, value, observedAt: row.observedAt, source: sources.get(row.sourceId), complete: row.complete && !row.truncated });
+    for (const row of snapshot.dns)
+        facts.push({ key: JSON.stringify([row.sourceId, row.queriedName, row.ownerName, row.type, 'outcome']), cohort: dnsCohort(row, 'outcome'), hostname: row.ownerName, family: `${row.type}_outcome`, value: row.outcome, observedAt: row.observedAt, source: sources.get(row.sourceId), complete: row.complete && !row.truncated && !['failed', 'not_checked'].includes(row.outcome) });
+    for (const row of snapshot.certificates)
+        for (const value of row.names)
+            facts.push({ key: JSON.stringify([row.sourceId, row.fingerprintSha256, 'certificate_names']), cohort: { kind: 'certificate_names', sourceId: row.sourceId, fingerprintSha256: row.fingerprintSha256 }, hostname: value, family: 'certificate_names', value, observedAt: row.observedAt, source: sources.get(row.sourceId), complete: row.namesComplete });
+    for (const row of snapshot.roles)
+        facts.push({ key: roleFactKey(row), cohort: { kind: 'provider_role', sourceId: row.sourceId, subjectType: row.subjectType, subject: row.subject, role: row.role }, hostname: row.subject, family: row.role, value: `${row.providerId}: ${row.value}`, observedAt: row.observedAt, source: sources.get(row.sourceId), complete: row.complete });
+    return { snapshot, facts };
+}
+export function compareInfrastructureObservations(earlierRaw, laterRaw) {
+    const earlier = infrastructureObservationFacts(earlierRaw), later = infrastructureObservationFacts(laterRaw);
+    const scope = (row) => JSON.stringify({ target: row.target, mode: row.mode, selection: row.scope.selection, hostnames: [...row.scope.hostnames].sort(), dnsTypes: [...row.scope.dnsTypes].sort(), sources: [...row.sources].sort((a, b) => a.id.localeCompare(b.id)) });
+    const comparable = scope(earlier.snapshot) === scope(later.snapshot) && earlier.snapshot.observedAt < later.snapshot.observedAt;
+    const complete = comparable && [earlier.snapshot, later.snapshot].every(row => row.coverage.state === 'complete' && !row.coverage.truncated);
+    const beforeCohorts = observationCohorts(earlier.snapshot), afterCohorts = observationCohorts(later.snapshot);
+    const groups = new Map();
+    for (const [side, values] of [['before', earlier.facts], ['after', later.facts]])
+        for (const fact of values) {
+            const group = groups.get(fact.key) ?? { cohort: fact.cohort, hostname: fact.hostname, family: fact.family, source: fact.source, before: [], after: [], complete: true };
+            if (fact.hostname < group.hostname)
+                group.hostname = fact.hostname;
+            group[side].push(fact.value);
+            group.complete &&= fact.complete;
+            groups.set(fact.key, group);
+        }
+    const rows = [...groups.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, row]) => {
+        row.before = [...new Set(row.before)].sort();
+        row.after = [...new Set(row.after)].sort();
+        const before = beforeCohorts.get(key), after = afterCohorts.get(key);
+        const beforeTimes = [...before?.times ?? []].sort(), afterTimes = [...after?.times ?? []].sort();
+        // Multiple historical cohorts are retained, not flattened into a fictitious
+        // single response. A later envelope never advances a source observation.
+        const ordered = beforeTimes.length === 1 && afterTimes.length === 1 && beforeTimes[0] < afterTimes[0];
+        row.complete &&= Boolean(before?.complete && after?.complete);
+        const same = JSON.stringify(row.before) === JSON.stringify(row.after);
+        const state = !comparable ? 'incomparable' : !ordered || !complete || !row.complete ? 'unknown' : same ? 'unchanged' : !row.before.length ? 'newly_observed' : !row.after.length ? 'not_returned' : 'changed';
+        return { ...row, beforeTimes, afterTimes, state, detail: state === 'not_returned' ? 'Not returned by this comparable bounded collection; this does not establish disappearance.' : state === 'newly_observed' ? 'Newly present in retained evidence; not necessarily newly created.' : state === 'unknown' ? !ordered ? 'Source observation times are missing, equal, reversed or span multiple cohorts; envelope time cannot establish a temporal change.' : 'Incomplete evidence cannot establish a removal or change.' : state === 'incomparable' ? 'Source, scope, mode or observation ordering differs; no temporal change is inferred.' : 'Source-qualified retained observation comparison.' };
+    });
+    return { state: comparable ? complete && !rows.some(row => row.state === 'unknown') ? 'compared' : 'partial' : 'incomparable', earlier: earlier.snapshot.id, later: later.snapshot.id, rows, limitations: ['No new collection was made. Retained changes do not establish ownership, safety, control or maliciousness.', 'Provider-reported history remains labelled separately from local observations. Empty, failed, limited and changed-source snapshots cannot replace a stronger baseline.'] };
+}
+/** Technology roles reuse the canonical role owner, not a new signature catalogue. */
+export function infrastructureTechnologyRoles(value) { return technologyEvidenceRoles(value); }