@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/cli/artifact-validation/lookup-evidence.mjs

@@ -1,9 +1,12 @@
 import { isDeepStrictEqual } from 'node:util';
-import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
+import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, lookupEvidenceRegistryInsightsVersion, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
 import { validLookupObservationScope } from "../../packages/evidence/lookup-target.mjs";
+import { externalPasswordFormObservation } from "../../packages/evidence/credential-form-attribution.mjs";
+import { credentialSurfaceContractState } from "../../lib/lookup-child-profile-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../../lib/registrar-standing-contract.mjs";
 import { compareRegistrySources } from "../../lib/registry-comparison.mjs";
 import { buildRegistryInsights } from "../../lib/registry-insights.mjs";
+import { resolveRdapCapabilityCatalogRevision } from "../../lib/rdap-capabilities.mjs";
 import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../packages/analysis/project-metadata.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../../lib/homepage-metadata-contract.mjs";
 import { HEX_DIGEST_RE, SEMANTIC_VERSION_RE, absoluteUrl, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, nullableRecord, optionalText, record, strings, text, } from "./structure-primitives.mjs";
@@ -24,7 +27,7 @@ const PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS = [
     'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
     'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
     'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
-    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'hasExternalPasswordForm', 'externalAssetHosts',
     'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
     'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
     'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
@@ -42,6 +45,18 @@ const LOOKUP_REGISTRAR_COMPARISON_STATUSES = [
     'registrar_unavailable', 'registry_incomplete', 'registrar_incomplete',
 ];
 function validateLookupEvidenceHomepageMetadata(availability, version) {
+    const credentialProfile = availability.credentialSurfaceProfile === null || availability.credentialSurfaceProfile === undefined
+        ? null : record(availability.credentialSurfaceProfile, 'Lookup evidence credential profile');
+    if (version < 30 && (Object.hasOwn(availability, 'hasExternalPasswordForm') || credentialProfile?.credentialSurfaceVersion === 2)) {
+        fail('Lookup evidence form-attribution epoch');
+    }
+    if (Object.hasOwn(availability, 'hasExternalPasswordForm') && availability.hasExternalPasswordForm !== null)
+        boolean(availability.hasExternalPasswordForm, 'Lookup evidence password-form destination');
+    if (credentialProfile?.credentialSurfaceVersion === 2 && credentialSurfaceContractState(credentialProfile) !== 'supported')
+        fail('Lookup evidence form-attribution profile');
+    if (credentialProfile?.credentialSurfaceVersion === 2 && availability.hasExternalPasswordForm !== undefined
+        && availability.hasExternalPasswordForm !== externalPasswordFormObservation(credentialProfile.formAttribution))
+        fail('Lookup evidence form-attribution consistency');
     const pageIdentity = availability.pageIdentity === null || availability.pageIdentity === undefined
         ? null
         : record(availability.pageIdentity, 'Lookup evidence page identity');
@@ -330,7 +345,7 @@ function validateLookupEvidenceWhois(value, version) {
     optionalText(complete.conflictingHop, 'Lookup evidence WHOIS conflicting hop', 253);
     nullableRecord(complete.parsed, 'Lookup evidence WHOIS parsed data');
     if (version >= PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION
-        && !isDeepStrictEqual(complete.parsed, projectLookupEvidenceWhoisPublication(complete.parsed))) {
+        && !isDeepStrictEqual(complete.parsed, projectLookupEvidenceWhoisPublication(complete.parsed, version))) {
         fail('Lookup evidence WHOIS portable publication');
     }
     array(complete.chain, 'Lookup evidence WHOIS chain', 16).forEach((item, index) => {
@@ -701,6 +716,15 @@ export function validateLookupEvidenceArtifactStructure(value) {
         });
         if (!isDeepStrictEqual(registryComparison, expectedComparison))
             fail('Lookup evidence registry comparison derivation');
+        const capabilities = record(registryInsights.rdapCapabilities, 'Lookup evidence RDAP capabilities');
+        const registryCapabilities = record(capabilities.registry, 'Lookup evidence registry RDAP capabilities');
+        const registrarCapabilities = record(capabilities.registrar, 'Lookup evidence registrar RDAP capabilities');
+        const catalogReviewedAt = registryCapabilities.catalogReviewedAt;
+        if (typeof catalogReviewedAt !== 'string'
+            || resolveRdapCapabilityCatalogRevision(catalogReviewedAt) === null
+            || registrarCapabilities.catalogReviewedAt !== catalogReviewedAt) {
+            fail('Lookup evidence RDAP capability catalogue revision');
+        }
         const rebuiltInsights = buildRegistryInsights({
             rdapParsed,
             rdapStatus: rdapDiagnosticStatus,
@@ -708,6 +732,9 @@ export function validateLookupEvidenceArtifactStructure(value) {
             whoisParsed,
             whoisStatus: whoisDiagnosticStatus,
             whoisQueriedAt: whois.queriedAt,
+        }, {
+            rdapCapabilityCatalogReviewedAt: catalogReviewedAt,
+            version: lookupEvidenceRegistryInsightsVersion(version),
         });
         const expectedInsights = version >= PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION
             ? projectLookupEvidenceRegistryInsights(rebuiltInsights)

package/cli/artifact-validation/signed-review.mjs

@@ -1,4 +1,4 @@
-import { ACQUISITION_DECISIONS, ACQUISITION_MANUAL_CHECKS, ACQUISITION_DECISION_PACKET_SCHEMA, ACQUISITION_DECISION_PACKET_VERSION, } from "../../packages/investigation/acquisition-decision-packet.mjs";
+import { ACQUISITION_DECISION_PACKET_SCHEMA, validateAcquisitionDecisionPacketStructure, } from "../../packages/investigation/acquisition-decision-packet.mjs";
 import { BULK_DOMAIN_COMPARISON_EXPORT_VERSION, BULK_DOMAIN_COMPARISON_SCHEMA, } from "../../packages/investigation/bulk-domain-comparison.mjs";
 import { BULK_MAIL_EXPOSURE_EXPORT_VERSION, BULK_MAIL_EXPOSURE_SCHEMA, MAX_BULK_MAIL_EXPOSURE_ROWS, } from "../../packages/investigation/bulk-mail-exposure.mjs";
 import { BULK_REVIEW_MANIFEST_SCHEMA, BULK_REVIEW_MANIFEST_VERSION, SUPPORTED_BULK_REVIEW_MANIFEST_VERSIONS, } from "../../packages/contracts/investigation-portability.mjs";
@@ -26,55 +26,6 @@ const DOMAIN_COMPARISON_ROW_IDS = [
 ];
 const MAIL_STATES = ['authenticated_mail', 'evidence_incomplete', 'mail_auth_gap', 'mail_auth_incomplete', 'no_explicit_mx', 'null_mx'];
 const DNS_TYPES = ['A', 'AAAA', 'CAA', 'CDNSKEY', 'CDS', 'CNAME', 'CSYNC', 'HTTPS', 'MX', 'NS', 'SRV', 'SVCB', 'TLSA', 'TXT'];
-function validateAcquisitionItem(value, label) {
-    const item = exact(value, ['id', 'label', 'state', 'detail', 'provenance'], label);
-    const id = enumeration(item.id, ['availability', 'contacts', 'lifecycle', 'mail', 'nameservers', 'operations', 'policy_eligibility', 'policy_lifecycle', 'policy_transfer', 'tls', 'transfer', 'web'], label);
-    enumeration(item.state, ['authoritative', 'observed', 'review', 'unavailable'], label);
-    text(item.label, label, 200);
-    text(item.detail, label, 2_000);
-    text(item.provenance, label, 300);
-    return id;
-}
-function validateAcquisition(value) {
-    const root = exact(value, ['schema', 'version', 'generatedAt', 'target', 'synthetic', 'evidenceObservedAt', 'analystReview', 'evidenceReview', 'limitations', 'integrity'], 'Acquisition decision packet');
-    iso(root.generatedAt, 'Acquisition decision packet generatedAt');
-    domain(root.target, 'Acquisition decision packet target');
-    boolean(root.synthetic, 'Acquisition decision packet synthetic');
-    iso(root.evidenceObservedAt, 'Acquisition decision packet evidenceObservedAt', true);
-    const review = exact(root.analystReview, ['decision', 'rationale', 'reviewedChecks', 'outstandingChecks', 'state'], 'Acquisition analyst review');
-    const decision = enumeration(review.decision, ACQUISITION_DECISIONS, 'Acquisition analyst review decision');
-    text(review.rationale, 'Acquisition analyst review rationale', 2_000, true);
-    const reviewed = strings(review.reviewedChecks, 'Acquisition reviewed checks', ACQUISITION_MANUAL_CHECKS.length, 40);
-    const outstanding = strings(review.outstandingChecks, 'Acquisition outstanding checks', ACQUISITION_MANUAL_CHECKS.length, 40);
-    const expectedReviewed = ACQUISITION_MANUAL_CHECKS.filter((item) => reviewed.includes(item));
-    const expectedOutstanding = ACQUISITION_MANUAL_CHECKS.filter((item) => !reviewed.includes(item));
-    if (!sameValues(reviewed, expectedReviewed) || !sameValues(outstanding, expectedOutstanding))
-        fail('Acquisition analyst review checks');
-    const expectedState = decision === 'unresolved' || reviewed.length < ACQUISITION_MANUAL_CHECKS.length ? 'draft' : 'reviewed';
-    if (review.state !== expectedState)
-        fail('Acquisition analyst review state');
-    const evidence = exact(root.evidenceReview, ['version', 'label', 'state', 'items', 'transitionDependencies', 'policyChecks', 'nextSteps', 'limitations'], 'Acquisition evidence review');
-    if (evidence.version !== 2)
-        fail('Acquisition evidence review');
-    text(evidence.label, 'Acquisition evidence review label', 200);
-    enumeration(evidence.state, ['incomplete', 'registered', 'review_transition', 'sale_signal', 'unregistered_observation'], 'Acquisition evidence review state');
-    const expectedEvidenceIds = {
-        items: ['availability', 'lifecycle', 'transfer', 'operations', 'contacts'],
-        transitionDependencies: ['nameservers', 'web', 'mail', 'tls'],
-        policyChecks: ['policy_eligibility', 'policy_lifecycle', 'policy_transfer'],
-    };
-    for (const key of ['items', 'transitionDependencies', 'policyChecks']) {
-        const expected = expectedEvidenceIds[key];
-        const values = array(evidence[key], `Acquisition evidence review ${key}`, expected.length, expected.length);
-        const ids = values.map((item, index) => validateAcquisitionItem(item, `Acquisition evidence review ${key}[${index}]`));
-        if (!sameValues(ids, expected))
-            fail(`Acquisition evidence review ${key}`);
-    }
-    strings(evidence.nextSteps, 'Acquisition next steps', 6, 600);
-    strings(evidence.limitations, 'Acquisition evidence limitations', 12, 600);
-    strings(root.limitations, 'Acquisition limitations', 8, 600);
-    validateIntegrity(root.integrity, 'Acquisition integrity', root.version, ACQUISITION_DECISION_PACKET_VERSION);
-}
 function validateClaimPassportTarget(type, value) {
     const candidate = text(value, 'Claim passport target', 253);
     if (type === 'domain') {
@@ -656,7 +607,7 @@ export function validateSignedDigestArtifactStructure(schema, value) {
     if (value.schema !== schema)
         fail('Signed review artefact');
     if (schema === ACQUISITION_DECISION_PACKET_SCHEMA)
-        validateAcquisition(value);
+        validateAcquisitionDecisionPacketStructure(value);
     else if (schema === MANAGED_INDICATOR_SET_SCHEMA)
         validateManagedIndicatorSet(value);
     else if (schema === LOOKUP_CLAIM_PASSPORT_SCHEMA)

package/cli/artifact-verify.mjs

@@ -1,5 +1,5 @@
 import { Buffer } from 'node:buffer';
-import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION } from "../packages/contracts/analyst-interchange.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
 import { createHash } from 'node:crypto';
 import { readEditableCaseExport } from "../packages/cases/case-export-input.mjs";
 import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "./bounded-json.mjs";
@@ -19,7 +19,7 @@ import { INVESTIGATION_MANIFEST_SCHEMA, SUPPORTED_INVESTIGATION_MANIFEST_VERSION
 import { verifyCliCasePack } from "./case-pack.mjs";
 import { LOOKUP_EVIDENCE_PORTABLE_MAX_BYTES, LOOKUP_EVIDENCE_SCHEMA, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../lib/evidence-export.mjs";
 export const OFFLINE_ARTIFACT_VERIFICATION_SCHEMA = 'whoisleuth.offline-artifact-verification';
-export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 4;
+export const OFFLINE_ARTIFACT_VERIFICATION_VERSION = 5;
 export const MAX_OFFLINE_ARTIFACT_BYTES = Math.max(MAX_DOMAIN_CONTROL_MANIFEST_BYTES, MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES);
 export const MAX_OFFLINE_PASSPHRASE_FILE_BYTES = 1024;
 export class UnsupportedOfflineArtifactError extends TypeError {
@@ -532,6 +532,34 @@ export async function verifyOfflineArtifact(raw, options = {}) {
         : null;
     return Object.freeze({ ...report, manifestIdentity });
 }
+function offlineArtifactNextSteps(report) {
+    switch (report.artifact.kind) {
+        case 'saved_lookup':
+            return ['Review retained source states without displaying target values:', '  whoisleuth source-report -- ./lookup.json'];
+        case 'case_export':
+            return ['Read the Case records, including private analyst content:', '  whoisleuth case show -- ./cases.json'];
+        case 'workspace_archive':
+            return ['Inspect section metadata without restoring the archive:', '  whoisleuth inspect-archive -- ./workspace.json'];
+        case 'encrypted_workspace_archive':
+            return report.checks.authenticatedEncryption === 'verified'
+                ? ['Inspect decrypted section metadata without restoring the archive:', '  whoisleuth inspect-archive --passphrase-file ./passphrase.txt -- ./workspace.encrypted.json']
+                : ['Check the encrypted contents using a separate passphrase file:', '  whoisleuth verify-artifact --passphrase-file ./passphrase.txt -- ./workspace.encrypted.json'];
+        case 'lookup_evidence':
+            return ['Review which fields this portable format preserves and omits:', '  whoisleuth interchange-report -- ./evidence.json'];
+        case 'cli_case_pack':
+            return ['Review the Case-pack compatibility and field exclusions:', '  whoisleuth interchange-report -- ./case-pack.json'];
+        case 'signed_review_artifact':
+            if (report.artifact.schema === DOMAIN_CONTROL_MANIFEST_SCHEMA || report.artifact.schema === LOOKUP_CLAIM_PASSPORT_SCHEMA) {
+                return ['Review the passport compatibility and retained field groups:', '  whoisleuth interchange-report -- ./passport.json'];
+            }
+            return report.artifact.schema === MANAGED_INDICATOR_SET_SCHEMA
+                && report.summary.inputBytes <= MAX_MANAGED_INDICATOR_SET_BYTES
+                ? ['Read the retained indicator identities and review windows:', '  whoisleuth indicator-set inspect -- ./indicators.json']
+                : [];
+        default:
+            return [];
+    }
+}
 export function formatOfflineArtifactVerification(report) {
     const lines = [
         'WHOISleuth offline artefact verification',
@@ -590,8 +618,15 @@ export function formatOfflineArtifactVerification(report) {
     }
     if (report.package) {
         lines.push(`Package bytes: ${report.package.digestSha256}`, 'Storage: unchanged; inspection only', 'Audience: private; review selected file contents before sharing', 'Signature trust: not checked', 'Trusted timestamp: not checked', 'Factual accuracy: not established');
-        for (const entry of report.package.entries)
+        for (const entry of report.package.entries) {
             lines.push(`${entry.id}: ${entry.state} · ${entry.byteLength} bytes · ${entry.mediaType}${entry.issue ? ` · ${entry.issue}` : ''}`);
+            if (entry.imageDerivation) {
+                const declaration = entry.imageDerivation;
+                lines.push(`  Declared image derivation: ${declaration.method}; ${declaration.operations.join(', ')}`, `  Parent: ${declaration.source.digestSha256} · ${declaration.source.byteLength} bytes`);
+            }
+            else if (entry.mediaType.startsWith('image/'))
+                lines.push('  Editing history: not declared');
+        }
         for (const link of report.package.links)
             lines.push(`Source link ${link.capsuleEntryId}: ${link.state}${link.sourceEntryId ? ` (${link.sourceEntryId})` : ''}`);
         for (const capture of report.package.captureManifests) {
@@ -604,5 +639,8 @@ export function formatOfflineArtifactVerification(report) {
     }
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);
+    const nextSteps = offlineArtifactNextSteps(report);
+    if (nextSteps.length)
+        lines.push('', 'Offline next steps (examples; replace filenames; nothing runs automatically):', ...nextSteps);
     return `${lines.join('\n')}\n`;
 }

package/cli/bulk-command-runner.mjs

@@ -93,6 +93,10 @@ async function runBulkCommand(args, dependencies, context) {
         }
         catch (error) {
             checkpointFailure = error;
+            eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
+            if (!eventProgress.enabled) {
+                context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(error, 'Checkpoint could not be written')}. The latest progress may not be saved.\n`);
+            }
         }
     }
     const metadata = {
@@ -122,12 +126,6 @@ async function runBulkCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalBulk(selectedItems, metadata), args.color));
     }
-    if (checkpointFailure) {
-        eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
-        if (!eventProgress.enabled) {
-            context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
-        }
-    }
     const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
     if (policyFindings.length && !eventProgress.enabled)
         context.writeStderr(formatFailPolicyNotice(policyFindings));

package/cli/case-command.mjs

@@ -8,6 +8,7 @@ import { createCaseIncident, openOrCreateCase, recordCaseConclusion, recordCaseR
 import { buildCaseExport, serializeCaseStore } from "../packages/cases/case-storage-model.mjs";
 import { appendCaseEvidencePin } from "../packages/cases/case-response-model.mjs";
 import { readCaseRecheckAnswerContext } from "../packages/cases/case-recheck-model.mjs";
+import { readCaseResponseObjects } from "../packages/cases/case-response-object.mjs";
 import { caseEvidenceLinkIssues, mergeCaseEvidenceLinks } from "../packages/cases/case-evidence-links.mjs";
 import { dispositionLabel, statusLabel } from "../packages/cases/case-record-decisions.mjs";
 import { normalizeDomain } from "../packages/cases/case-record-core.mjs";
@@ -28,12 +29,12 @@ function prose(input, maximum, label) {
 function selection(cases, args, required) {
     const domain = args.domain === null ? null : normalizeDomain(args.domain);
     if (args.domain !== null && !domain)
-        throw new CliUsageError('Select a valid Case domain.');
+        throw new CliUsageError('Select a valid case domain.');
     const selected = cases.filter(record => (!args.caseId || record.id === args.caseId) && (!domain || record.domain === domain));
     if ((args.caseId || domain || required) && selected.length === 0)
-        throw new CliUsageError('The selected Case is not present in this file.');
+        throw new CliUsageError('The selected case is not present in this file.');
     if (required && selected.length !== 1)
-        throw new CliUsageError('Select exactly one Case with --case-id; no arbitrary Case was chosen.');
+        throw new CliUsageError('Select exactly one case with --case-id; no arbitrary case was chosen.');
     return selected;
 }
 function pin(input, now) {
@@ -41,7 +42,7 @@ function pin(input, now) {
         throw new CliUsageError('An evidence pin must be a JSON object.');
     const raw = input;
     if (Object.hasOwn(raw, 'id') || Object.hasOwn(raw, 'createdAt'))
-        throw new CliUsageError('New pin identity and creation time are allocated by the Case operation.');
+        throw new CliUsageError('New pin identity and creation time are allocated by the case operation.');
     const normal = appendCaseEvidencePin([], raw, now)[0];
     // Validate the supplied subset against the domain result, without duplicating
     // its field inventory or accepting silent truncation/default substitution.
@@ -59,7 +60,7 @@ function retainExistingEntries(before, after) {
     }
     const pairs = [
         [before.notes, after.notes], [before.evidenceHistory, after.evidenceHistory], [before.evidencePins, after.evidencePins],
-        [before.decisions, after.decisions], [before.actions, after.actions], [before.assertions, after.assertions],
+        [before.decisions, after.decisions], [before.assertions, after.assertions],
         [before.manualTrail, after.manualTrail], [before.sightings, after.sightings],
         [before.observedEffects.reviews, after.observedEffects.reviews], [before.closures.records, after.closures.records],
         [before.branches ?? [], after.branches ?? []], [before.attachments ?? [], after.attachments ?? []],
@@ -70,6 +71,13 @@ function retainExistingEntries(before, after) {
             throw new CliUsageError('The operation would remove or alter earlier retained evidence. Export a smaller working set or review it in the console; nothing was written.');
         }
     }
+    for (const action of before.actions) {
+        const next = after.actions.find(candidate => candidate.id === action.id);
+        const events = new Set(next?.history.map(event => canonicalArtifactJsonV2(event)) ?? []);
+        if (!next || action.history.some(event => !events.has(canonicalArtifactJsonV2(event)))) {
+            throw new CliUsageError('The operation would alter retained response events. Nothing was written.');
+        }
+    }
 }
 export function applyCliCaseOperation(cases, args, input, note, now) {
     if (args.operation === 'open') {
@@ -78,7 +86,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
             ? createCaseIncident(cases, { domain: args.domain, title }, now)
             : openOrCreateCase(cases, { domain: args.domain, ...(title ? { title } : {}) }, now, args.caseId ? { caseId: args.caseId } : {});
         if (!result.created && title && title !== result.record.title)
-            throw new CliUsageError('The selected Case already exists with another title. Use --new-incident for a separate investigation.');
+            throw new CliUsageError('The selected case already exists with another title. Use --new-incident for a separate investigation.');
         return result.cases;
     }
     const current = selection(cases, args, true)[0];
@@ -92,6 +100,67 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
     else if (args.operation === 'link' || args.operation === 'withdraw-link') {
         result = updateCase(cases, current.id, args.operation === 'link' ? { evidenceLink: input } : { evidenceLinkWithdrawal: input }, now);
     }
+    else if (args.operation === 'incident-link') {
+        if (!input)
+            throw new CliUsageError('An incident link requires JSON input.');
+        fields(input, ['url'], 'Incident link');
+        result = updateCase(cases, current.id, { incidentTarget: input.url }, now);
+    }
+    else if (args.operation === 'action') {
+        if (!input)
+            throw new CliUsageError('A response action requires JSON input.');
+        fields(input, ['type', 'recipient', 'contactSource', 'routeObservedAt', 'routeReviewAfter', 'contactLimitations', 'dueAt', 'followUpAt', 'responseObjects', 'originActionId', 'amendment', 'correction'], 'Response action');
+        result = updateCase(cases, current.id, { action: input }, now);
+        const action = result.record.actions.find(candidate => !current.actions.some(prior => prior.id === candidate.id));
+        if (!action)
+            throw new CliUsageError('No new action was retained within the case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(action[key])) {
+                throw new CliUsageError(`Action field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'action-event') {
+        if (!input || !input.transition || typeof input.transition !== 'object' || Array.isArray(input.transition))
+            throw new CliUsageError('An action event requires id and transition JSON.');
+        fields(input, ['id', 'transition'], 'Response action event');
+        const transition = input.transition;
+        fields(transition, ['nextState', 'occurredAt', 'sourceClass', 'provenance', 'reference', 'evidencePinId', 'limitations', 'providerOutcome', 'outcomeDetail', 'responseObjects', 'objectOutcome', 'evidenceRequest', 'packetReceipt'], 'Response transition');
+        result = updateCase(cases, current.id, { actionUpdate: input }, now);
+        const previous = current.actions.find(action => action.id === input.id);
+        const event = result.record.actions.find(action => action.id === input.id)?.history.find(candidate => !previous?.history.some(prior => prior.id === candidate.id));
+        if (!event)
+            throw new CliUsageError('The selected action is not retained. Nothing was written.');
+        for (const [key, value] of Object.entries(transition))
+            if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(event[key])) {
+                throw new CliUsageError(`Transition field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'recheck-question') {
+        if (!input)
+            throw new CliUsageError('A recheck question requires JSON input.');
+        fields(input, ['statement', 'rationale', 'recheck', 'evidencePinIds'], 'Recheck question');
+        result = updateCase(cases, current.id, { assertion: { ...input, kind: 'next_step' } }, now);
+        const question = result.record.assertions.find(candidate => !current.assertions.some(prior => prior.id === candidate.id));
+        if (!question)
+            throw new CliUsageError('No new question was retained within the case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(question[key])) {
+                throw new CliUsageError(`Question field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
+    else if (args.operation === 'close-object') {
+        if (!input?.responseObject)
+            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole case.');
+        fields(input, ['responseObject', 'reason', 'summary', 'observedEffectReviewId', 'actionId', 'limitations'], 'Object closure');
+        result = updateCase(cases, current.id, { closure: input }, now);
+        const closure = result.record.closures.records.find(candidate => !current.closures.records.some(prior => prior.id === candidate.id));
+        if (!closure)
+            throw new CliUsageError('No new closure was retained within the case bounds; nothing was written.');
+        for (const [key, value] of Object.entries(input))
+            if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(closure[key])) {
+                throw new CliUsageError(`Closure field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
+            }
+    }
     else if (args.operation === 'assess') {
         if (!input)
             throw new CliUsageError('An assessment requires JSON input.');
@@ -119,10 +188,10 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
     else if (args.operation === 'recheck') {
         if (!input)
             throw new CliUsageError('A recheck requires JSON input.');
-        fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname'], 'Recheck');
+        fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname', 'responseObject', 'objectOutcome'], 'Recheck');
         const recheck = readCaseRecheckAnswerContext(input.recheck);
         if (input.state === 'not_reproduced' && !recheck) {
-            throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned Case or record unavailable for a limited observation.');
+            throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned case or record unavailable for a limited observation.');
         }
         const summary = prose(input.comparisonSummary, MAX_RESPONSE_VALUE_LENGTH, 'Comparison summary');
         result = recordCaseRecheckOutcome(cases, current.id, {
@@ -135,6 +204,8 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
             comparisonSummary: comparison.value, source: review.source, followUpAt: review.followUpAt,
             limitations: review.limitations, collectionDepth: comparison.collectionDepth,
             ...(review.recheck ? { recheck: review.recheck } : {}),
+            ...(review.responseObject ? { responseObject: review.responseObject } : {}),
+            ...(review.objectOutcome ? { objectOutcome: review.objectOutcome } : {}),
             ...(comparison.observationHostname ? { observationHostname: comparison.observationHostname } : {}),
         };
         for (const [key, value] of Object.entries(input)) {
@@ -143,12 +214,12 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         }
     }
     else
-        throw new CliUsageError('Select a supported Case mutation.');
+        throw new CliUsageError('Select a supported case mutation.');
     retainExistingEntries(current, result.record);
     return result.cases;
 }
 function formatCases(cases, digest) {
-    const lines = ['Local Case review', `File digest  ${digest}`, `Cases        ${cases.length}`, ''];
+    const lines = ['Local case review', `File digest  ${digest}`, `Cases        ${cases.length}`, ''];
     for (const record of cases) {
         lines.push(`Case ${safeTerminalValue(record.id)} · ${safeTerminalValue(record.title || record.domain)}`, `Domain       ${safeTerminalValue(record.domain)}`, `Status       ${statusLabel(record.status)}`, `Disposition  ${dispositionLabel(record.disposition)} (analyst assessment)`, `Updated      ${record.updatedAt}`);
         for (const note of record.notes)
@@ -166,20 +237,25 @@ function formatCases(cases, digest) {
             if (cyclic)
                 lines.push('  Conflicting imported derivation cycle; no order is inferred.');
         }
+        for (const action of record.actions) {
+            lines.push(`Action ${safeTerminalValue(action.id)} · ${action.type} · ${action.state}`, `  Objects: ${action.responseObjects?.map(object => `${object.kind}: ${safeTerminalValue(object.identifier)}`).join('; ') || 'unknown binding'}`);
+            for (const event of action.history)
+                lines.push(`  Event ${event.occurredAt} · ${event.sourceClass} · ${event.nextState}${event.objectOutcome ? ` · reported ${event.objectOutcome}` : ''}`, `    Scope: ${event.responseObjects?.map(object => `${object.kind}: ${safeTerminalValue(object.identifier)}`).join('; ') || 'unknown binding'}`);
+        }
         for (const review of record.observedEffects.reviews)
-            lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`);
+            lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`, `  Object: ${review.responseObject ? `${review.responseObject.kind}: ${safeTerminalValue(review.responseObject.identifier)}` : 'unknown binding'}${review.objectOutcome ? ` · observed ${review.objectOutcome}` : ''}`);
         lines.push(`Other retained records: ${record.evidenceHistory.length} snapshots, ${record.actions.length} actions, ${record.assertions.length} assertions, ${record.attachments?.length ?? 0} file references.`, '');
     }
-    lines.push('Use --json for the full Case export. Attached file bytes remain separate. This command makes no request.', '');
+    lines.push('Use --json for the full case export. Attached file bytes remain separate. This command makes no request.', '');
     return lines.join('\n');
 }
 export async function runCaseCommand(args, dependencies, context) {
-    context.setFailureLabel('Local Case operation');
+    context.setFailureLabel('Local case operation');
     try {
         const raw = args.source ? dependencies.caseFileInput ?? await context.readInput(args.source, MAX_EDITABLE_CASE_INPUT_BYTES, 'Case file') : null;
         const digest = raw === null ? null : `sha256:${createHash('sha256').update(raw).digest('hex')}`;
         if (args.expectedFileDigest && args.expectedFileDigest !== digest)
-            throw new CliUsageError('The Case file differs from the reviewed file digest. Nothing was written.');
+            throw new CliUsageError('The case file differs from the reviewed file digest. Nothing was written.');
         const cases = raw === null ? [] : readEditableCaseExport(raw);
         const now = normalizeExplicitIsoTimestamp(context.now());
         if (!now)
@@ -195,7 +271,7 @@ export async function runCaseCommand(args, dependencies, context) {
         const note = args.noteSource ? await context.readInput(args.noteSource, MAX_NOTE_LENGTH * 4 + 4, 'Case note') : args.text;
         const next = applyCliCaseOperation(cases, args, input, note, now);
         if (Buffer.byteLength(serializeCaseStore(next)) > MAX_CASE_STORE_BYTES)
-            throw new CliUsageError('The updated Case store exceeds its byte budget. No evidence was pruned and nothing was written.');
+            throw new CliUsageError('The updated case store exceeds its byte budget. No evidence was pruned and nothing was written.');
         const output = `${JSON.stringify(buildCaseExport(next, now))}\n`;
         // Apply the same strict admission to our output before atomic publication.
         readEditableCaseExport(output);
@@ -207,6 +283,6 @@ export async function runCaseCommand(args, dependencies, context) {
         dependencies.signal?.throwIfAborted();
         if (cause instanceof CliUsageError)
             throw cause;
-        throw new CliUsageError(cause instanceof Error ? cause.message : 'The Case operation could not be completed.');
+        throw new CliUsageError(cause instanceof Error ? cause.message : 'The case operation could not be completed.');
     }
 }

package/cli/case-pack.mjs

@@ -5,7 +5,7 @@ import { buildCaseReport, buildCaseReportVerificationProjection } from "../packa
 import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
 import { assertBoundedJsonStructure, scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { assertCaseBrandProfileIds } from "../packages/cases/case-brand-profile-references.mjs";
-import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, } from "../packages/cases/case-record-projection.mjs";
+import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, assertCaseCollectionReceiptAudience, } from "../packages/cases/case-record-projection.mjs";
 import { normalizeDomain } from "../packages/evidence/domain-name.mjs";
 import { normalizeCaseStore } from "../packages/cases/case-migration-model.mjs";
 import { safeId } from "../packages/cases/case-record-core.mjs";
@@ -62,6 +62,7 @@ function listItemPath(path, list) {
             && path[3] === 'analystResponse' && path[4] === list && typeof path[5] === 'number');
 }
 function allowedSensitiveFieldPath(key, path) {
+    const deliveryReceipt = path.at(-1) === 'packetReceipt' && typeof path.at(-2) === 'number' && path.at(-3) === 'history' && listItemPath(path.slice(0, -3), 'actions');
     if (key === 'brandProfileIds')
         return topCasePath(path) || reportCasePath(path);
     if (key === 'notes')
@@ -75,9 +76,18 @@ function allowedSensitiveFieldPath(key, path) {
         return topCasePath(path) || analystResponsePath(path);
     }
     if (key === 'recipient')
-        return listItemPath(path, 'actions');
+        return listItemPath(path, 'actions') || deliveryReceipt;
     if (key === 'target')
-        return listItemPath(path, 'manualTrail');
+        return listItemPath(path, 'manualTrail') || deliveryReceipt;
+    if (key === 'correction')
+        return listItemPath(path, 'actions');
+    if (key === 'packetReceipt')
+        return typeof path.at(-1) === 'number' && path.at(-2) === 'history' && listItemPath(path.slice(0, -2), 'actions');
+    if (key === 'checkpointCollectionReceipts')
+        return topCasePath(path);
+    if (key === 'collectionReceipt')
+        return path.length === 4 && path[0] === 'cases' && typeof path[1] === 'number'
+            && (path[2] === 'evidenceHistory' || path[2] === 'checkpointCollectionReceipts') && typeof path[3] === 'number';
     return true;
 }
 /** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */
@@ -385,6 +395,7 @@ export function verifyCliCasePack(input) {
     assertClosedEnvelopes(root, packet, integrity, redactionManifest, packet.reports, root.version);
     assertSensitiveFieldPlacement(root, serialized.length);
     const audience = packet.audience;
+    assertCaseCollectionReceiptAudience(root, audience);
     if (!Number.isSafeInteger(redactionManifest.sourceCaseCount)
         || redactionManifest.sourceCaseCount !== root.cases.length
         || !stringListsMatch(redactionManifest.excluded, caseAudienceExclusions(audience, root.version))) {

package/cli/ci-report.mjs

@@ -1,5 +1,7 @@
 import { WHOISLEUTH_REQUEST_POLICY_URL } from "../packages/analysis/project-metadata.mjs";
 import { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA } from "../packages/contracts/domain-control-monitor.mjs";
+import { lookupDiagnosticEntries } from "../lib/lookup-progress.mjs";
+import { lookupStrictExitFindings } from "./strict-exit.mjs";
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -9,13 +11,23 @@ function xml(value) {
 function junitCases(document) {
     const schema = String(document.schema || '');
     if (schema === 'whoisleuth.cli.lookup') {
-        const diagnostics = record(document.diagnostics);
-        const cases = Object.entries(diagnostics).slice(0, 64).map(([source, value]) => {
-            const state = String(record(value).status ?? record(value).state ?? 'unavailable').toLowerCase();
-            return ['error', 'failed', 'partial', 'rate_limited', 'timeout', 'unavailable'].includes(state)
-                ? { name: `source ${source}`, failure: `Source state: ${state}` }
+        const sources = lookupDiagnosticEntries(document.diagnostics).filter(source => source.present);
+        const findings = lookupStrictExitFindings(document);
+        const cases = sources.map(({ source, path, state }) => {
+            const failure = findings.find(finding => finding.path === path);
+            return failure || state === null
+                ? { name: `source ${source}`, failure: `Source state: ${failure?.state ?? 'unavailable'}` }
                 : { name: `source ${source}` };
         });
+        // Retain nested and historical failure coverage without echoing imported
+        // object keys, endpoints or evidence into CI names or messages.
+        const namedPaths = new Set(sources.map(source => source.path));
+        const additional = findings.filter(finding => !namedPaths.has(finding.path));
+        if (additional.length)
+            cases.push({
+                name: 'additional source diagnostics',
+                failure: `Source states: ${[...new Set(additional.map(finding => finding.state))].sort().join(', ')}`,
+            });
         return cases.length ? cases : [{ name: 'lookup diagnostics', failure: 'No source diagnostics were available.' }];
     }
     if (schema === 'whoisleuth.cli.bulk') {

package/cli/command-definition.mjs

@@ -19,7 +19,7 @@ const LEGACY_WORKSPACE_ARCHIVE_SCOPE = LEGACY_WORKSPACE_ARCHIVE_VERSIONS
     .map((version) => `v${version}`)
     .join(' and ');
 const INLINE_COMMAND_FAMILIES = ['support', 'review', 'assurance', 'workflow', 'history'];
-const CLI_CASE_OPERATIONS = ['show', 'open', 'note', 'pin', 'link', 'withdraw-link', 'assess', 'recheck'];
+const CLI_CASE_OPERATIONS = ['show', 'open', 'note', 'pin', 'link', 'withdraw-link', 'assess', 'recheck', 'incident-link', 'action', 'action-event', 'recheck-question', 'close-object'];
 const CLI_INDICATOR_OPERATIONS = ['revise', 'inspect', 'stix', 'misp'];
 const CLI_META_ACTIONS = Object.freeze([
     Object.freeze({
@@ -126,10 +126,11 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--config': file('Load explicit versioned CLI configuration from this file.'),
     '--profile': text('Select a named profile from the supplied configuration.', true),
     '--palette': enumeration('Choose the terminal colour palette; redirected output and no-colour settings still take precedence.', ['auto', 'light', 'dark']),
-    '--network': flag('Include the optional public DNS and port 43 runtime checks.'),
+    '--network': flag('Include the optional public DNS, HTTPS and WHOIS (port 43) runtime checks.'),
     '--json': flag('Write structured JSON to stdout or the selected output file.'),
     '--reported-action': optionDefinition('enum', 'Record an analyst-reported identity action; repeat for separate actions.', { values: IDENTITY_ACTIONS.map(action => action.id), occurrence: 'repeatable' }),
     '--trusted-auth-header': optionDefinition('text', 'Select a recognised receiver header by part:header-index. This records analyst trust, not independent authentication; repeat for separate headers.', { occurrence: 'repeatable' }),
+    '--intake-context': optionDefinition('file', 'Read one selected version-1 distribution declaration or version-2 digest-bound phone/destination selection file. Declarations remain attributed claims.'),
     '--package': flag('Verify a portable evidence ZIP or encrypted package rather than a single report.'),
     '--folder': file('Verify the evidence package within this selected folder.'),
     '--quiet': flag('Suppress ordinary terminal presentation.', 'idempotent'),
@@ -234,10 +235,10 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--left-session': text('Select the left-hand retained capture session.', true),
     '--right-session': text('Select the right-hand retained capture session.', true),
     '--compact': flag('Write a compact report presentation.'),
-    '--case-id': text('Select the retained Case identifier.'),
-    '--domain': text('Supply the Case domain.'),
-    '--title': text('Supply the Case title.'),
-    '--new-incident': flag('Create a separate incident instead of updating a matching Case.'),
+    '--case-id': text('Select the retained case identifier.'),
+    '--domain': text('Supply the case domain.'),
+    '--title': text('Supply the case title.'),
+    '--new-incident': flag('Create a separate incident instead of updating a matching case.'),
     '--text': text('Supply the note text directly.'),
     '--note-file': file('Read note text from a selected local file.'),
     '--input': file('Read the selected local input file.'),

package/cli/discovery-scan-command-runner.mjs

@@ -135,6 +135,10 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         }
         catch (error) {
             checkpointFailure = error;
+            eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
+            if (!eventProgress.enabled) {
+                context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(error, 'Checkpoint could not be written')}. The latest progress may not be saved.\n`);
+            }
         }
     }
     const snapshot = args.observationSnapshot
@@ -170,12 +174,6 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalDiscoveryScan(document), args.color));
     }
-    if (checkpointFailure) {
-        eventProgress.emit({ event: 'warning', state: 'checkpoint_unavailable' });
-        if (!eventProgress.enabled) {
-            context.writeStderr(`Checkpoint warning: ${boundedCliErrorMessage(checkpointFailure, 'Checkpoint could not be written')}. Completed output is still available.\n`);
-        }
-    }
     const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
     if (policyFindings.length && !eventProgress.enabled)
         context.writeStderr(formatFailPolicyNotice(policyFindings));