@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/cli/offline-evidence-review.mjs

@@ -1,7 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { CONTEXT_INPUT_SCHEMAS, reviewContextInput } from "../packages/investigation/context-review.mjs";
-import { CONTEXT_REVIEW_KINDS } from "../packages/contracts/context-review.mjs";
+import { CONTEXT_REVIEW_KINDS, DOMAIN_HISTORY_INPUT_SCHEMA, DOMAIN_HISTORY_INPUT_VERSION } from "../packages/contracts/context-review.mjs";
 import { normalizeEncryptedDnsAdapter, planEncryptedDnsQuery, } from "../lib/encrypted-dns-contract.mjs";
 import { validateDnssecEvidence } from "../lib/dnssec-evidence-validation.mjs";
 import { reviewDomainChange } from "../lib/domain-change-review.mjs";
@@ -18,6 +18,10 @@ import { compareTrustStoreEvidence } from "../lib/trust-store-comparison.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { safeTerminalValue } from "./formatters/terminal.mjs";
 import { LOCAL_MMDB_QUERY_SCHEMA, LOCAL_MMDB_QUERY_VERSION, LOCAL_MMDB_REVIEW_SCHEMA, LOCAL_MMDB_REVIEW_VERSION, reviewLocalMmdb } from "./local-mmdb-review.mjs";
+import { INFRASTRUCTURE_OBSERVATION_SCHEMA, MAX_INFRASTRUCTURE_OBSERVATION_BYTES, infrastructureObservationFacts, compareInfrastructureObservations } from "../packages/investigation/infrastructure-observation.mjs";
+import { exact } from "../packages/evidence/artifact-structure.mjs";
+import { INFRASTRUCTURE_COMPARISON_INPUT_SCHEMA, MAX_INFRASTRUCTURE_COMPARISON_INPUT_BYTES } from "../packages/contracts/external-observation-interchange.mjs";
+import { CASE_CONTAINMENT_INPUT_SCHEMA, readCaseContainmentInput, formatCaseContainmentHandoff } from "../packages/cases/case-containment-handoff.mjs";
 const OFFLINE_EVIDENCE_REVIEW_SCHEMA = 'whoisleuth.cli.offline-evidence-review';
 const OFFLINE_EVIDENCE_REVIEW_VERSION = 1;
 const MAX_OFFLINE_EVIDENCE_INPUT_BYTES = 16 * 1024 * 1024;
@@ -46,7 +50,8 @@ function parseInput(value) {
     }
     const document = record(parsed);
     if (typeof document.schema !== 'string' || document.version !== 1
-        && !(document.schema === LOCAL_MMDB_QUERY_SCHEMA && document.version === LOCAL_MMDB_QUERY_VERSION)) {
+        && !(document.schema === LOCAL_MMDB_QUERY_SCHEMA && document.version === LOCAL_MMDB_QUERY_VERSION)
+        && !(document.schema === DOMAIN_HISTORY_INPUT_SCHEMA && document.version === DOMAIN_HISTORY_INPUT_VERSION)) {
         throw new CliUsageError('Offline evidence review requires a supported versioned input schema.');
     }
     return document;
@@ -57,7 +62,27 @@ function buildOfflineEvidenceReview(value, generatedAt = new Date().toISOString(
         throw new CliUsageError('Local MMDB review requires --mmdb <database-file>.');
     let kind;
     let result;
-    if (CONTEXT_INPUT_SCHEMAS.includes(input.schema)) {
+    if (input.schema === CASE_CONTAINMENT_INPUT_SCHEMA) {
+        kind = 'internal_containment';
+        result = readCaseContainmentInput(input, generatedAt);
+    }
+    else if (input.schema === INFRASTRUCTURE_OBSERVATION_SCHEMA) {
+        if (typeof value === 'string' && new TextEncoder().encode(value).byteLength > MAX_INFRASTRUCTURE_OBSERVATION_BYTES)
+            throw new TypeError('Infrastructure snapshot input exceeds its byte bound.');
+        kind = 'infrastructure';
+        const retained = infrastructureObservationFacts(input);
+        result = { ...retained, state: retained.snapshot.coverage.state === 'complete' && !retained.snapshot.coverage.truncated ? 'complete' : 'partial' };
+    }
+    else if (input.schema === INFRASTRUCTURE_COMPARISON_INPUT_SCHEMA) {
+        if (typeof value === 'string' && new TextEncoder().encode(value).byteLength > MAX_INFRASTRUCTURE_COMPARISON_INPUT_BYTES)
+            throw new TypeError('Infrastructure comparison input exceeds its byte bound.');
+        const pair = exact(input, ['schema', 'version', 'earlier', 'later'], 'Infrastructure comparison input');
+        if (new TextEncoder().encode(JSON.stringify(pair)).byteLength > MAX_INFRASTRUCTURE_COMPARISON_INPUT_BYTES)
+            throw new TypeError('Infrastructure comparison input exceeds its byte bound.');
+        kind = 'infrastructure_comparison';
+        result = compareInfrastructureObservations(pair.earlier, pair.later);
+    }
+    else if (CONTEXT_INPUT_SCHEMAS.includes(input.schema)) {
         const review = reviewContextInput(input, generatedAt);
         kind = review.kind;
         result = review;
@@ -173,13 +198,15 @@ async function buildOfflineEvidenceReviewWithLocalResources(value, generatedAt =
         version: OFFLINE_EVIDENCE_REVIEW_VERSION,
         generatedAt,
         kind: 'geoip',
-        result: await reviewLocalMmdb(input, options.mmdbPath, generatedAt),
+        result: await reviewLocalMmdb(input, options.mmdbPath, generatedAt, options.signal ? { signal: options.signal } : {}),
         limitations: Object.freeze([
             'The review is local and uses only the supplied query metadata and analyst-supplied database. It does not transmit the address or refresh the database.',
         ]),
     });
 }
 function formatOfflineEvidenceReview(document) {
+    if (document.kind === 'internal_containment')
+        return formatCaseContainmentHandoff(document.result);
     const result = record(document.result);
     if (document.kind === 'geoip' && result.schema === LOCAL_MMDB_REVIEW_SCHEMA && result.version !== LOCAL_MMDB_REVIEW_VERSION) {
         throw new CliUsageError('Offline evidence review does not support this MMDB result version.');
@@ -204,7 +231,26 @@ function formatOfflineEvidenceReview(document) {
         `Kind   ${document.kind.replaceAll('_', ' ')}`,
         `State  ${state.replaceAll('_', ' ')}`,
     ];
-    if (CONTEXT_REVIEW_KINDS.includes(document.kind)) {
+    if (document.kind === 'infrastructure') {
+        const snapshot = record(result.snapshot), scope = record(snapshot.scope), coverage = record(snapshot.coverage);
+        lines.push(`Snapshot ${safeTerminalValue(snapshot.id, '')} · ${safeTerminalValue(snapshot.target, '')} · ${safeTerminalValue(snapshot.observedAt, '')}`, `Coverage ${safeTerminalValue(coverage.state, 'unknown')} · ${safeTerminalValue(coverage.detail, '')}`, `Selected hosts ${listLength(scope.hostnames)}`);
+        for (const item of Array.isArray(result.facts) ? result.facts : []) {
+            const row = record(item), source = record(row.source);
+            lines.push(`${safeTerminalValue(row.hostname, '')} · ${safeTerminalValue(row.family, '')}: ${safeTerminalValue(row.value, '')} · ${safeTerminalValue(source.name, '')} (${safeTerminalValue(source.evidenceClass, '')}) · ${safeTerminalValue(row.observedAt, '')}`);
+        }
+        lines.push('Wildcard patterns are not enumerated hosts. DNS failure, missing values and history do not establish current absence. No requests or watchlist changes were made.');
+    }
+    else if (document.kind === 'infrastructure_comparison') {
+        for (const item of Array.isArray(result.rows) ? result.rows : []) {
+            const row = record(item), source = record(row.source);
+            // Bound individual identities, not the combined label: a valid DNS query
+            // and owner may each occupy all 253 hostname characters.
+            const cohort = Object.entries(record(row.cohort)).map(([key, value]) => `${safeTerminalValue(key)}=${safeTerminalValue(value, '', 253)}`).join(' · ');
+            const times = (value) => Array.isArray(value) ? value.map(time => safeTerminalValue(time, '')).join(', ') : '';
+            lines.push(`${safeTerminalValue(row.hostname, '')} · ${safeTerminalValue(row.family, '')} · ${safeTerminalValue(source.name, '')} (${safeTerminalValue(source.evidenceClass, '')}) · ${safeTerminalValue(row.state, '')}`, `  Cohort: ${cohort}`, `  Earlier observations: ${times(row.beforeTimes)}; later observations: ${times(row.afterTimes)}`, `  ${safeTerminalValue(JSON.stringify(row.before), '')} → ${safeTerminalValue(JSON.stringify(row.after), '')}`, `  ${safeTerminalValue(row.detail, '')}`);
+        }
+    }
+    else if (CONTEXT_REVIEW_KINDS.includes(document.kind)) {
         lines.push(safeTerminalValue(result.summary, ''));
         for (const item of Array.isArray(result.observations) ? result.observations : []) {
             const row = record(item);

package/cli/review-arguments.mjs

@@ -45,10 +45,10 @@ function parseCaseArguments(parsed) {
     if (operation === 'note' ? text === null && !noteSource : text !== null || noteSource !== null) {
         throw new CliUsageError('Only case note accepts and requires --text or --note-file.');
     }
-    if (['pin', 'link', 'withdraw-link', 'assess', 'recheck'].includes(operation)
+    if (['pin', 'link', 'withdraw-link', 'assess', 'recheck', 'incident-link', 'action', 'action-event', 'recheck-question', 'close-object'].includes(operation)
         ? !inputSource
         : inputSource !== null) {
-        throw new CliUsageError('Only case pin, link, withdraw-link, assess and recheck accept and require --input.');
+        throw new CliUsageError('This Case mutation requires --input; show, open and note do not accept it.');
     }
     if (expectedFileDigest !== null && (!source || !/^sha256:[a-f0-9]{64}$/u.test(expectedFileDigest))) {
         throw new CliUsageError('--expect-file-digest requires a source file and sha256:<64 lowercase hexadecimal characters>.');
@@ -95,6 +95,7 @@ export const REVIEW_ARGUMENT_PARSERS = Object.freeze({
         action: 'intake',
         kind: parsed.positionalValue('kind'),
         reportedActions: parsed.optionValues('--reported-action'),
+        ...(parsed.hasOption('--intake-context') ? { intakeContextSource: parsed.optionValue('--intake-context') } : {}),
         ...(parsed.hasOption('--trusted-auth-header')
             ? { trustedAuthHeaders: parsed.optionValues('--trusted-auth-header') }
             : {}),

package/cli/review-command-definitions.mjs

@@ -2,12 +2,14 @@ import { CASE_SCHEMA_VERSION, CLI_CASE_PACK_INPUT_CASE_VERSIONS, MAX_CASE_STORE_
 import { MESSAGE_INTAKE_KINDS, MESSAGE_INTAKE_SCHEMA } from "../packages/contracts/message-intake.mjs";
 import { IDENTITY_EVENTS_INPUT_SCHEMA } from "../packages/contracts/identity-events.mjs";
 import { CONTEXT_INPUT_SCHEMAS, CONTEXT_REVIEW_SCHEMA } from "../packages/contracts/context-review.mjs";
+import { CASE_CONTAINMENT_INPUT_SCHEMA, CASE_CONTAINMENT_HANDOFF_SCHEMA } from "../packages/cases/case-containment-handoff.mjs";
+import { INTAKE_CONTEXT_SCHEMA } from "../packages/investigation/intake-context.mjs";
 import { MANAGED_INDICATOR_SET_SCHEMA, MAX_MANAGED_INDICATOR_SET_BYTES, MAX_MANAGED_INDICATOR_PLAN_BYTES } from "../packages/contracts/analyst-interchange.mjs";
 import { CLI_CASE_OPERATIONS, CLI_INDICATOR_OPERATIONS, positional, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed } from "./command-definition.mjs";
 export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     "verify-artifact": commandSeed({
         reference: {
-            description: 'Validate a supported archive, ordinary Case export, claim passport, packet, manifest, saved Lookup or Lookup-evidence export without printing evidence contents. Use --package for an evidence ZIP or encrypted package, with --passphrase-file to unlock it; use --folder ./evidence for an unencrypted evidence folder. Add --bagit with --package or --folder to verify BagIt 1.0.',
+            description: 'Validate a supported archive, ordinary case export, claim passport, packet, manifest, saved Lookup or Lookup-evidence export without printing evidence contents. Use --package for an evidence ZIP or encrypted package, with --passphrase-file to unlock it; use --folder ./evidence for an unencrypted evidence folder. Add --bagit with --package or --folder to verify BagIt 1.0.',
             example: 'whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit',
             boundary: 'Verification is offline and redacted. ZIP and folder entries are reported separately without importing them. Case exports are checked without repairing content; ordinary package review also counts original references with matching bytes. Ordinary folders allow only the declared layout; BagIt allows bounded nested payloads and checks SHA-256/SHA-512 manifests without interpreting payloads. Symbolic links are refused. BagIt fetch.txt is never fetched; missing files, mismatches and unsupported algorithms remain explicit. Package digests describe bytes, not filesystem metadata or authenticity. In scripts, use --strict-exit: incomplete verification returns 4. Unencrypted workspace archives always return 4 under --strict-exit because section digests do not cover mutable root metadata; structure-only formats can pass their narrower contract. Default exit 0 means the report was produced, not that its checks passed.',
         },
@@ -54,9 +56,9 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     "source-report": commandSeed({
         reference: {
-            description: 'Create a target-free reliability summary from a saved lookup.',
+            description: 'Summarise source reliability from saved Lookup or Bulk evidence, or merge source-reliability reports.',
             example: 'whoisleuth source-report lookup.json --json',
-            boundary: 'The report retains source states and timings but excludes targets, queries, endpoints, and raw evidence.',
+            boundary: 'Accepts supported Lookup, Bulk or Bulk-item documents, or an unmixed set of source-reliability reports. Retains source states and timings but excludes targets, queries, endpoints and raw evidence.',
         },
         collection: { scope: 'Reads bounded saved evidence and emits target-free source reliability data.' },
         summary: 'Build a target-free source report',
@@ -154,23 +156,23 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     intake: commandSeed({
         reference: {
-            description: 'Review message identities, document links, QR destinations, HTTP archives or selected identity events locally.',
+            description: 'Review selected messages, indicators, document links, QR destinations, HTTP archives or identity events locally. Plain text offers phone candidates; --intake-context adds explicit selections and source declarations.',
             example: 'whoisleuth intake email message.eml --json',
-            boundary: 'Offline only: no destination, embedded command or QR payload is opened or executed. Output omits original bodies, subjects, address local parts, URL paths, queries and fragments. Authentication headers remain attributed claims. Selected PDF and DOCX review retains part identities and extraction coverage; embedded raster QR support does not imply complete rendered-page review. HAR retains minimised request order and timings, never replay authority, headers, cookies or bodies. Use --strict-exit to return 4 for partial coverage.',
+            boundary: 'Offline only: no destination, embedded command, phone number or QR payload is opened, contacted or executed. Output omits original bodies, subjects, address local parts, URL paths, queries and fragments. Literal IPs and labelled hashes are bounded text observations, not lookup targets or verdicts; headers, URL contents, QR, HAR and identity-event fields are not scanned for them. Plain-text phone discovery writes only counts, source digest, ranges and status to stderr; --quiet suppresses it. Optional --intake-context reads one separate file up to 8 KiB, not stdin. Version 1 carries distribution declarations; version 2 can also bind explicit phone selections and a supplied destination pair to the exact input digest. Selected phone strings and source declarations enter output; unselected candidates and exact private URLs do not. Authentication headers remain attributed claims. Selected PDF and DOCX review retains part identities and extraction coverage; embedded raster QR support does not imply complete rendered-page review. HAR retains minimised request order and timings, never replay authority, headers, cookies or bodies. Use --strict-exit to return 4 for partial coverage.',
         },
-        collection: { scope: 'Reads one selected text, MIME email, calendar, PNG, PDF, DOCX, HAR or identity-event JSON file. No collection or automatic Case write.' },
+        collection: { scope: 'Reads one selected text, MIME email, calendar, PNG, PDF, DOCX, HAR or identity-event JSON file and, only with --intake-context, one bounded declaration/selection file. No collection or automatic case write.' },
         summary: 'Review selected files and identity events offline',
-        options: ['--json', '--reported-action', '--trusted-auth-header', '--strict-exit', '--quiet', '--no-color'],
+        options: ['--json', '--reported-action', '--trusted-auth-header', '--intake-context', '--strict-exit', '--quiet', '--no-color'],
         positionals: Object.freeze([positional('kind', 'enum', 1, 1, MESSAGE_INTAKE_KINDS), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
         constraints: EMPTY_CONSTRAINTS, handlerOwner: 'review', networkEffect: 'offline', common: true,
-        schemaIdentifiers: Object.freeze([MESSAGE_INTAKE_SCHEMA, IDENTITY_EVENTS_INPUT_SCHEMA]), primaryArtefacts: Object.freeze([]),
+        schemaIdentifiers: Object.freeze([MESSAGE_INTAKE_SCHEMA, INTAKE_CONTEXT_SCHEMA, IDENTITY_EVENTS_INPUT_SCHEMA]), primaryArtefacts: Object.freeze([]),
         planSupport: false, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
     }),
     "review-evidence": commandSeed({
         reference: {
-            description: 'Review versioned protocol evidence, incident sequences, domain history, platform objects, storefronts or connector configuration offline.',
+            description: 'Review versioned protocol evidence, source-qualified infrastructure snapshots/comparisons, incident sequences, domain history, platform objects, storefronts, connector configuration or an explicitly selected internal containment handoff offline.',
             example: 'whoisleuth review-evidence domain-change.json --json --strict-exit',
-            boundary: 'The command reads only the supplied document and, with --mmdb, one explicitly selected local database up to 512 MiB. MMDB parsing and lookup run in one disposable worker with a ten-second processing deadline and an 8 KiB result limit. Version-2 MMDB queries require a justified age policy; unavailable or partial current reviews return 4 under --strict-exit. Historical version-1 MMDB queries preserve their output without freshness admission. No database is bundled, downloaded, updated or transmitted. It performs no DNS, RDAP, BGP, GeoIP-provider, TLS, HTTP, certificate-authority, or SMTP request.',
+            boundary: 'The command reads only the supplied document and, with --mmdb, one explicitly selected local database up to 512 MiB. MMDB parsing and lookup run in one disposable worker with a ten-second processing deadline and an 8 KiB result limit. Version-2 MMDB queries require a justified age policy; unavailable or partial current reviews return 4 under --strict-exit. Historical version-1 MMDB queries preserve their output without freshness admission. Domain-history v2 accepts explicit source-linked registration boundaries; v1 retains its original semantics. Internal containment selects retained next-step assertions and supporting pins after explicit audience-disclosure review; it does not change their state or execute controls. No database is bundled, downloaded, updated or transmitted. It performs no DNS, RDAP, BGP, GeoIP-provider, TLS, HTTP, certificate-authority, or SMTP request.',
         },
         collection: { scope: 'Reads one bounded versioned evidence or request-planning document and, only with --mmdb, one selected bounded local database. Performs no collection.' },
         summary: 'Review supplied evidence offline',
@@ -182,6 +184,8 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
         common: true,
         schemaIdentifiers: Object.freeze([
             CONTEXT_REVIEW_SCHEMA,
+            CASE_CONTAINMENT_INPUT_SCHEMA,
+            CASE_CONTAINMENT_HANDOFF_SCHEMA,
             ...CONTEXT_INPUT_SCHEMAS,
             'whoisleuth.cli.offline-evidence-review',
             'whoisleuth.rdap-search-input',
@@ -192,6 +196,8 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
             'whoisleuth.local-mmdb-query',
             'whoisleuth.local-mmdb-review',
             'whoisleuth.encrypted-dns-plan-input',
+            'whoisleuth.infrastructure-observation',
+            'whoisleuth.infrastructure-comparison.input',
         ]),
         primaryArtefacts: Object.freeze([]),
         planSupport: false,
@@ -220,12 +226,12 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     case: commandSeed({
         reference: {
-            description: 'Show or open a local Case, append a note or evidence pin, link evidence, withdraw a link, record an assessment, or retain an offline recheck. Use --input for pin, link, withdraw-link, assessment and recheck JSON; --text or --note-file for a note. Link input contains fromPinId, toPinId, kind (derived_from or shared_source), and basis. Withdrawal input contains id and reason. Mutations require --output and always write the complete current Case export.',
+            description: 'Show or open a local case, append a note or evidence pin, link evidence, record an assessment or offline recheck, retain an incident-link, create an action, append an action-event, save a recheck-question, or close-object. JSON mutations use --input; notes use --text or --note-file. Link input contains fromPinId, toPinId, kind and basis. Action-event input contains id and transition. Explicit responseObjects bind an action; a typed objectOutcome requires an explicit affected subset on its event. Object closure never closes other objects or the case. Mutations require --output and write the complete current case export.',
             example: 'whoisleuth case open --domain example.test --output cases.json\n  whoisleuth case show cases.json\n  whoisleuth case note cases.json --text "Review the retained observation" --output cases.json --force',
-            boundary: 'No database, browser launch, request or external report is created. Select --case-id when a file contains multiple Cases. Existing files require --force; --expect-file-digest sha256:<digest> additionally checks the exact file reviewed earlier. Source and output leases reject concurrent changes. Interrupted .workflow.lock files require deliberate inspection. Recheck records supplied observations; it does not collect them. Not reproduced requires an existing saved question, a complete observation and comparable conditions. Working exports include private analyst content and file references, not attached file bytes.',
+            boundary: 'No database, browser launch, request or external report is created. Select --case-id when a file contains multiple cases. Existing files require --force; --expect-file-digest sha256:<digest> additionally checks the exact file reviewed earlier. Source and output leases reject concurrent changes. Interrupted .workflow.lock files require deliberate inspection. Recheck records supplied observations; it does not collect them. Not reproduced requires an existing saved question, a complete observation and comparable conditions. Working exports include private analyst content and file references, not attached file bytes.',
         },
-        collection: { scope: `Reads exact Case schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')}. Input is bounded to ${MAX_EDITABLE_CASE_INPUT_BYTES / 1024 / 1024} MiB including formatting; the complete canonical Case store must fit ${MAX_CASE_STORE_BYTES / 1024 / 1024} MiB without pruning. Writes current schema ${CASE_SCHEMA_VERSION}.` },
-        summary: 'Review and update ordinary local Case files',
+        collection: { scope: `Reads exact case schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')}. Input is bounded to ${MAX_EDITABLE_CASE_INPUT_BYTES / 1024 / 1024} MiB including formatting; the complete canonical case store must fit ${MAX_CASE_STORE_BYTES / 1024 / 1024} MiB without pruning. Writes current schema ${CASE_SCHEMA_VERSION}.` },
+        summary: 'Review and update ordinary local case files',
         options: ['--case-id', '--domain', '--title', '--new-incident', '--text', '--note-file', '--input', '--expect-file-digest', '--json', '--no-color'],
         positionals: Object.freeze([positional('operation', 'enum', 1, 1, CLI_CASE_OPERATIONS), positional('source', 'file', 0, 1)]),
         constraints: Object.freeze([constraint({ kind: 'mutually_exclusive', options: ['--text', '--note-file'] })]),
@@ -250,11 +256,11 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     "case-pack": commandSeed({
         reference: {
-            description: `Package browser-created Case records from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} as a reviewed, audience-specific Case-pack v2 with current schema ${CASE_SCHEMA_VERSION}.`,
+            description: `Package browser-created case records from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} as a reviewed, audience-specific Case-pack v2 with current schema ${CASE_SCHEMA_VERSION}.`,
             example: 'whoisleuth case-pack cases.json --audience trusted --reviewed --json',
-            boundary: 'The command creates a separate offline package without changing the source or durable Cases and requires an explicit review acknowledgement. Every audience, including public, retains domain evidence, Case, pin and decision identifiers, tags, decision summaries and rationale. Review that analyst-authored content as well as the exclusions before sharing.',
+            boundary: 'The command creates a separate offline package without changing the source or durable cases and requires an explicit review acknowledgement. Every audience, including public, retains domain evidence, case, pin and decision identifiers, tags, decision summaries and rationale. Review that analyst-authored content as well as the exclusions before sharing.',
         },
-        collection: { scope: `Reads one bounded Case export from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} and writes a separate audience-specific Case-pack v2.` },
+        collection: { scope: `Reads one bounded case export from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} and writes a separate audience-specific Case-pack v2.` },
         summary: 'Build a reviewed case package',
         options: ['--audience', '--reviewed', '--json', '--quiet', '--no-color'],
         positionals: OPTIONAL_FILE_POSITIONAL,

package/cli/review-command-runner.mjs

@@ -192,8 +192,9 @@ async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
         ? await dependencies.readArtifactInput(args.source)
         : await context.readInput(args.source, MAX_OFFLINE_EVIDENCE_INPUT_BYTES, 'Offline evidence input'), 'offline evidence input', 'review-evidence requires one JSON file or a document on stdin.');
     const document = args.mmdbSource
-        ? await buildOfflineEvidenceReviewWithLocalResources(input, context.now(), { mmdbPath: args.mmdbSource })
+        ? await buildOfflineEvidenceReviewWithLocalResources(input, context.now(), { mmdbPath: args.mmdbSource, ...(dependencies.signal ? { signal: dependencies.signal } : {}) })
         : buildOfflineEvidenceReview(input, context.now());
+    dependencies.signal?.throwIfAborted();
     writeReviewReport(context, args, document, formatOfflineEvidenceReview);
     if (args.strictExit) {
         const result = document.result && typeof document.result === 'object' && !Array.isArray(document.result)
@@ -205,9 +206,11 @@ async function runOfflineEvidenceReviewCommand(args, dependencies, context) {
         const zoneMismatch = document.kind === 'zone_intent' && (result.complete !== true
             || (result.counts && typeof result.counts === 'object' && !Array.isArray(result.counts)
                 && ['different', 'missing', 'unexpected', 'incomplete'].some((key) => Number(result.counts[key]) > 0)));
-        const contextPartial = CONTEXT_REVIEW_KINDS.includes(document.kind) && result.state === 'partial';
+        const contextPartial = (CONTEXT_REVIEW_KINDS.includes(document.kind) || document.kind === 'internal_containment') && result.state === 'partial';
         const mmdbIncomplete = result.schema === LOCAL_MMDB_REVIEW_SCHEMA && result.version === LOCAL_MMDB_REVIEW_VERSION && result.completeness !== 'complete';
-        if (gate?.pass === false || zoneMismatch || contextPartial || mmdbIncomplete)
+        const infrastructureIncomplete = document.kind === 'infrastructure' ? result.state !== 'complete'
+            : document.kind === 'infrastructure_comparison' && result.state !== 'compared';
+        if (gate?.pass === false || zoneMismatch || contextPartial || mmdbIncomplete || infrastructureIncomplete)
             return EXIT_CODES.PARTIAL_FAILURE;
     }
     return EXIT_CODES.SUCCESS;

package/cli/risk-calibration.mjs

@@ -5,7 +5,7 @@ import { scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
 import { ANALYST_REVIEW_REASON_VALUES, analystInteroperabilityTags } from "../packages/analysis/analyst-taxonomy.mjs";
 import { buildRiskCalibrationSummaryReport, parseRiskCalibrationSummaryReport, RISK_CALIBRATION_SUMMARY_INTERPRETATION, RISK_CALIBRATION_SUMMARY_THRESHOLDS, } from "../packages/analysis/risk-calibration-summary.mjs";
-import { MAX_RISK_CALIBRATION_ACTIVITY_LENGTH, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH, MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, MAX_RISK_CALIBRATION_DOMAIN_AGE_DAYS, MAX_RISK_CALIBRATION_DOMAIN_LENGTH, MAX_RISK_CALIBRATION_FINDING_CATEGORY_LENGTH, MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER, MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS, MAX_RISK_CALIBRATION_JSON_DEPTH, MAX_RISK_CALIBRATION_JSON_KEYS, MAX_RISK_CALIBRATION_JSON_VALUES, MAX_RISK_CALIBRATION_MUTATIONS, MAX_RISK_CALIBRATION_PROVIDER_ID_LENGTH, MAX_RISK_CALIBRATION_PROVIDER_STATE_LENGTH, MAX_RISK_CALIBRATION_PROVIDERS, MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, MAX_RISK_CALIBRATION_SCAN_DEPTH_LENGTH, MAX_RISK_CALIBRATION_STRING_LENGTH, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_DATASET_VERSION, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, RISK_CALIBRATION_DISPOSITIONS, serializeRiskCalibrationSnapshot, snapshotRiskCalibrationReportForSerialization, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
+import { MAX_RISK_CALIBRATION_ACTIVITY_LENGTH, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH, MAX_RISK_CALIBRATION_DISPOSITION_LENGTH, MAX_RISK_CALIBRATION_DOMAIN_AGE_DAYS, MAX_RISK_CALIBRATION_DOMAIN_LENGTH, MAX_RISK_CALIBRATION_FINDING_CATEGORY_LENGTH, MAX_RISK_CALIBRATION_FINDINGS_PER_PROVIDER, MAX_RISK_CALIBRATION_INPUT_BYTES, MAX_RISK_CALIBRATION_JSON_CONTAINER_ITEMS, MAX_RISK_CALIBRATION_JSON_DEPTH, MAX_RISK_CALIBRATION_JSON_KEYS, MAX_RISK_CALIBRATION_JSON_VALUES, MAX_RISK_CALIBRATION_MUTATIONS, MAX_RISK_CALIBRATION_PROVIDER_ID_LENGTH, MAX_RISK_CALIBRATION_PROVIDER_STATE_LENGTH, MAX_RISK_CALIBRATION_PROVIDERS, MAX_RISK_CALIBRATION_RECORD_ID_LENGTH, MAX_RISK_CALIBRATION_RECORDS, MAX_RISK_CALIBRATION_REVIEW_REASON_LENGTH, MAX_RISK_CALIBRATION_SCAN_DEPTH_LENGTH, MAX_RISK_CALIBRATION_STRING_LENGTH, MAX_RISK_CALIBRATION_TIMESTAMP_LENGTH, RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA, RISK_CALIBRATION_REPORT_VERSION, RISK_CALIBRATION_DISPOSITIONS, serializeRiskCalibrationSnapshot, snapshotRiskCalibrationReportForSerialization, SUPPORTED_RISK_CALIBRATION_DATASET_VERSIONS, } from "../packages/contracts/risk-calibration.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { RISK_MUTATION_TYPES } from "../packages/analysis/risk-scoring.mjs";
 import { THREAT_INTELLIGENCE_CONTRACT_VERSION, THREAT_INTELLIGENCE_ENVELOPE_VERSION, THREAT_INTELLIGENCE_SCHEMA, } from "../packages/analysis/threat-intelligence-types.mjs";
@@ -17,7 +17,7 @@ const AVAILABILITY_STATES = new Set(['registered', 'for_sale', 'expiring', 'avai
 const ACTIVITY_STATES = new Set(['active', 'parked', 'unreachable', 'no_site']);
 const BOOLEAN_FIELDS = [
     'faviconMatch', 'faviconNearMatch', 'reusesOfficialAssets', 'hasPasswordField',
-    'hasMx', 'hasSpf', 'hasDmarc', 'privacyProtected', 'hasExternalFormAction',
+    'hasMx', 'hasSpf', 'hasDmarc', 'privacyProtected', 'hasExternalFormAction', 'hasExternalPasswordForm',
     'idnReferenceMatch', 'pageBaselineMatch', 'hasActiveBrandProfile',
 ];
 const REVIEW_REASON_CODES = ANALYST_REVIEW_REASON_VALUES;
@@ -95,8 +95,10 @@ function projectThreatIntelligence(value, field) {
         }),
     };
 }
-function projectEvidence(value, field) {
+function projectEvidence(value, field, version) {
     const source = object(value, field);
+    if (version < 3 && Object.hasOwn(source, 'hasExternalPasswordForm'))
+        throw new CliUsageError(`${field}.hasExternalPasswordForm requires dataset version 3; historical inputs were not reinterpreted.`);
     const availability = boundedString(source.availability ?? source.state, `${field}.availability`, MAX_RISK_CALIBRATION_AVAILABILITY_LENGTH);
     if (!AVAILABILITY_STATES.has(availability))
         throw new CliUsageError(`${field}.availability is unsupported.`);
@@ -234,7 +236,7 @@ export function parseRiskCalibrationDataset(text) {
             domain,
             analystDisposition,
             ...(reviewReasonCode ? { reviewReasonCode } : {}),
-            evidence: projectEvidence(record.evidence, `${prefix}.evidence`),
+            evidence: projectEvidence(record.evidence, `${prefix}.evidence`, documentVersion),
         };
     });
     return {

package/cli/saved-lookup.mjs

@@ -7,7 +7,8 @@ import { CliUsageError } from "./errors.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../lib/homepage-metadata-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../lib/registrar-standing-contract.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-import { CLI_LOOKUP_SCHEMA as SAVED_LOOKUP_SCHEMA, CLI_LOOKUP_VERSION as SAVED_LOOKUP_SCHEMA_VERSION, PUBLIC_CLI_LOOKUP_VERSION as PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION, MAX_CLI_LOOKUP_BYTES as MAX_SAVED_LOOKUP_INPUT_BYTES, MAX_CLI_LOOKUP_JSON_CONTAINER_ITEMS as MAX_BOUNDED_JSON_CONTAINER_ITEMS, MAX_CLI_LOOKUP_JSON_DEPTH as MAX_BOUNDED_JSON_DEPTH, MAX_CLI_LOOKUP_JSON_KEYS as MAX_BOUNDED_JSON_KEYS, MAX_CLI_LOOKUP_JSON_VALUES as MAX_BOUNDED_JSON_VALUES, MAX_CLI_LOOKUP_STRING_LENGTH as MAX_SAVED_LOOKUP_STRING_LENGTH, SUPPORTED_CLI_LOOKUP_VERSIONS as SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, } from "../packages/contracts/cli-lookup.mjs";
+import { parseLookupCollectionReceipt } from "../packages/evidence/lookup-collection-receipt.mjs";
+import { CLI_LOOKUP_SCHEMA as SAVED_LOOKUP_SCHEMA, CLI_LOOKUP_VERSION as SAVED_LOOKUP_SCHEMA_VERSION, PUBLIC_CLI_LOOKUP_VERSION as PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION, HOMEPAGE_CLI_LOOKUP_VERSION, COLLECTION_RECEIPT_CLI_LOOKUP_VERSION, MAX_CLI_LOOKUP_BYTES as MAX_SAVED_LOOKUP_INPUT_BYTES, MAX_CLI_LOOKUP_JSON_CONTAINER_ITEMS as MAX_BOUNDED_JSON_CONTAINER_ITEMS, MAX_CLI_LOOKUP_JSON_DEPTH as MAX_BOUNDED_JSON_DEPTH, MAX_CLI_LOOKUP_JSON_KEYS as MAX_BOUNDED_JSON_KEYS, MAX_CLI_LOOKUP_JSON_VALUES as MAX_BOUNDED_JSON_VALUES, MAX_CLI_LOOKUP_STRING_LENGTH as MAX_SAVED_LOOKUP_STRING_LENGTH, SUPPORTED_CLI_LOOKUP_VERSIONS as SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, } from "../packages/contracts/cli-lookup.mjs";
 const RDAP_STATUSES = new Set([
     'success', 'complete', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
     'unavailable', 'rate_limited', 'not_applicable', 'stale',
@@ -317,23 +318,31 @@ function assertLookupEnvelope(document, label) {
     const publicationMetadata = pageIdentity?.publicationMetadata;
     const deliveryMetadata = httpResponse?.deliveryMetadata;
     const registrarStanding = document.registrarStanding;
+    if (document.collectionReceipt !== undefined) {
+        if (Number(document.version) < COLLECTION_RECEIPT_CLI_LOOKUP_VERSION)
+            throw new TypeError(`${label} collection receipt requires saved Lookup version ${COLLECTION_RECEIPT_CLI_LOOKUP_VERSION}.`);
+        const receipt = parseLookupCollectionReceipt(document.collectionReceipt);
+        if (receipt.targetClass !== document.type || receipt.requestedDepth !== document.mode) {
+            throw new TypeError(`${label} collection receipt does not match the Lookup.`);
+        }
+    }
     if (document.version === PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION
         && (publicationMetadata !== undefined || deliveryMetadata !== undefined || registrarStanding !== undefined)) {
-        throw new TypeError(`${label} version ${PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION} cannot contain version ${SAVED_LOOKUP_SCHEMA_VERSION} evidence fields.`);
+        throw new TypeError(`${label} version ${PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION} cannot contain version ${HOMEPAGE_CLI_LOOKUP_VERSION} evidence fields.`);
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && (publicationMetadata !== undefined && (!['success', 'partial'].includes(String(pageIdentity?.status))
             || !validPagePublicationMetadata(publicationMetadata))
             || deliveryMetadata !== undefined && (!['success', 'partial'].includes(String(http?.status))
                 || !validHttpDeliveryMetadata(deliveryMetadata)))) {
         throw new TypeError(`${label} contains invalid homepage metadata.`);
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && registrarStanding !== undefined
         && !validRegistrarStanding(registrarStanding)) {
         throw new TypeError(`${label} contains invalid registrar standing.`);
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && registrarStanding !== undefined
         && !registrarStandingObservedBy(registrarStanding, generatedAt)) {
         throw new TypeError(`${label} registrar standing was observed after the saved Lookup time.`);
@@ -346,7 +355,7 @@ function assertLookupEnvelope(document, label) {
     if ((whoisStatus === 'complete' || whoisStatus === 'partial') && !whoisParsed) {
         throw new TypeError('Successful WHOIS input is missing normalised parsed data.');
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && validRegistrarStanding(registrarStanding)
         && registrarStanding.ianaId !== resolveRegistrarIanaId(rdapParsed, whoisParsed)) {
         throw new TypeError(`${label} registrar standing does not match its retained registration sources.`);
@@ -430,7 +439,7 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         throw new TypeError('Lookup document generation time must be valid and include an explicit timezone.');
     }
     const classifiedSnapshot = snapshotKnownDataFields(classified, 'Lookup classification', new Set(['type', 'value', 'inputHostname', 'registrableDomain', 'isSubdomain']));
-    const contextSnapshot = snapshotKnownDataFields(collectionContext, 'Lookup collection context', new Set(['observerLabel', 'vantageLabel']));
+    const contextSnapshot = snapshotKnownDataFields(collectionContext, 'Lookup collection context', new Set(['observerLabel', 'vantageLabel', 'collectionReceipt']));
     const observerLabel = typeof contextSnapshot.observerLabel === 'string'
         ? contextSnapshot.observerLabel
         : null;
@@ -439,6 +448,12 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         : null;
     const resultSnapshot = snapshotLookupResultRoot(result);
     delete resultSnapshot.collectionContext;
+    if (Object.hasOwn(contextSnapshot, 'collectionReceipt')) {
+        delete resultSnapshot.collectionReceipt;
+        const receipt = parseLookupCollectionReceipt(contextSnapshot.collectionReceipt);
+        if (receipt)
+            resultSnapshot.collectionReceipt = receipt;
+    }
     const classifiedType = classifiedSnapshot.type;
     if (typeof classifiedType !== 'string' || !QUERY_TYPES.has(classifiedType)) {
         throw new TypeError('Lookup classification has an unsupported query type.');

package/cli/selected-input-worker.mjs

@@ -3,6 +3,8 @@ import { reviewSelectedInput } from "../packages/investigation/selected-input-re
 import { assertMessageBytes } from "../packages/investigation/intake-report.mjs";
 import { DOCUMENT_REVIEW_DEADLINE_MS } from "../packages/contracts/document-intake.mjs";
 import { MESSAGE_INTAKE_SCHEMA, MESSAGE_INTAKE_VERSION } from "../packages/contracts/message-intake.mjs";
+import { validateIntakeExtensions } from "../packages/investigation/intake-context.mjs";
+import { validatePhoneReview } from "../packages/investigation/intake-phones.mjs";
 if (!isMainThread && parentPort) {
     const port = parentPort, request = workerData;
     try {
@@ -45,8 +47,16 @@ export async function reviewSelectedInputInWorker(bytes, kind, reviewedAt, signa
             const abort = () => finish(undefined, new Error('Selected input review was cancelled. Nothing was saved.'));
             const timer = setTimeout(() => finish(undefined, new Error('Selected input review exceeded its processing deadline. Nothing was saved.')), DOCUMENT_REVIEW_DEADLINE_MS);
             worker.once('message', (reply) => {
-                if (reply && typeof reply === 'object' && 'result' in reply && reply.result?.report.schema === MESSAGE_INTAKE_SCHEMA && reply.result.report.schemaVersion === MESSAGE_INTAKE_VERSION)
-                    finish(reply.result);
+                if (reply && typeof reply === 'object' && 'result' in reply && reply.result?.report.schema === MESSAGE_INTAKE_SCHEMA && reply.result.report.schemaVersion === MESSAGE_INTAKE_VERSION) {
+                    try {
+                        validateIntakeExtensions(reply.result.report);
+                        validatePhoneReview(reply.result);
+                        finish(reply.result);
+                    }
+                    catch {
+                        finish(undefined, new Error('Selected input returned an unsupported review. Nothing was retained.'));
+                    }
+                }
                 else
                     finish();
             });

package/cli/source-reliability.mjs

@@ -730,6 +730,8 @@ export function buildSourceReliabilityReport(raw, generatedAt = new Date().toISO
     });
 }
 export function formatSourceReliabilityReport(report) {
+    const duration = (value) => value
+        ? `median ${value.median} ms / p95 ${value.p95} ms (range ${value.minimum}-${value.maximum} ms)` : 'unmeasured';
     const lines = [
         'WHOISleuth source reliability report',
         `Documents: ${report.documentsReviewed}`,
@@ -741,16 +743,16 @@ export function formatSourceReliabilityReport(report) {
         `Exceptions: ${report.totals.truncations} truncated · ${report.totals.rateLimits} rate-limited`,
     ];
     for (const source of report.sources) {
-        const states = Object.entries(source.states).map(([state, count]) => `${state} ${count}`).join(', ') || 'none';
-        const timing = source.durationMs.lookupTiming;
-        const timingTrend = source.durationTrend.reportTimingMedian;
-        lines.push(`${source.source}: ${states}; truncated ${source.truncationCount}; rate-limited ${source.rateLimitedCount}`
-            + `; failure rate ${source.rates.failure ?? 'unmeasured'}; partial rate ${source.rates.partial ?? 'unmeasured'}`
-            + (timing ? `; timing median ${timing.median} ms / p95 ${timing.p95} ms` : '')
-            + (timingTrend ? `; report-median distribution ${timingTrend.minimum}-${timingTrend.maximum} ms` : '')
-            + (source.durationTimeline.length ? `; timeline points ${source.durationTimeline.length}` : ''));
-    }
-    lines.push('Privacy: targets 0 · queries 0 · raw evidence 0');
+        const states = Object.entries(source.states).map(([state, count]) => `${state} ${count}`).join(', ') || 'no states retained';
+        lines.push('', source.source, `  Collection states: ${states}`, `  Samples: states ${source.samples.states} · observations ${source.samples.observations} · Lookup timings ${source.samples.timing}`, `  Exceptions: ${source.truncationCount} truncated · ${source.rateLimitedCount} rate-limited`, `  Rates (0–1): failure ${source.rates.failure ?? 'unmeasured'} · partial ${source.rates.partial ?? 'unmeasured'}`, `  Observation duration: ${duration(source.durationMs.observation)}`, `  Lookup timing: ${duration(source.durationMs.lookupTiming)}`);
+        if (source.durationTrend.reportObservationMedian)
+            lines.push(`  Merged observation-median distribution: ${duration(source.durationTrend.reportObservationMedian)}`);
+        if (source.durationTrend.reportTimingMedian)
+            lines.push(`  Merged Lookup-median distribution: ${duration(source.durationTrend.reportTimingMedian)}`);
+        if (source.durationTimeline.length)
+            lines.push(`  Retained report timeline: ${source.durationTimeline.length} points`);
+    }
+    lines.push('', 'Privacy: targets 0 · queries 0 · raw evidence 0');
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);
     return `${lines.join('\n')}\n`;

package/cli/support-arguments.mjs

@@ -9,7 +9,7 @@ export const SUPPORT_ARGUMENT_PARSERS = Object.freeze({
     doctor: (parsed) => ({
         action: 'doctor',
         network: parsed.hasOption('--network'),
-        output: jsonOutput(parsed),
+        output: parsed.hasOption('--summary-json') ? 'summary_json' : jsonOutput(parsed),
         ...terminalOptions(parsed),
     }),
     commands: (parsed) => ({

package/cli/support-command-definitions.mjs

@@ -1,4 +1,5 @@
 import { RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA } from "../packages/contracts/risk-calibration.mjs";
+import { DOCTOR_SCHEMA, DOCTOR_SUMMARY_SCHEMA } from "../packages/contracts/cli-doctor.mjs";
 import { positional, NO_POSITIONALS, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed, text } from "./command-definition.mjs";
 export const SUPPORT_COMMAND_DEFINITIONS = Object.freeze({
     completion: commandSeed({
@@ -25,17 +26,17 @@ export const SUPPORT_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Check the supported runtime and local terminal capabilities.',
             example: 'whoisleuth doctor --json',
-            boundary: 'The default check is offline. Public DNS and port 43 checks run only when --network is explicitly supplied.',
+            boundary: 'The default check is offline. Public DNS, HTTPS and port 43 checks run only with --network. --summary-json omits private context and free-form diagnostic details.',
         },
         collection: { scope: 'Network access is opt-in with --network and is limited to fixed public DNS, HTTPS, and WHOIS diagnostics.' },
         summary: 'Check the local CLI runtime',
-        options: ['--network', '--json', '--quiet', '--no-color'],
+        options: ['--network', '--json', '--summary-json', '--quiet', '--no-color'],
         positionals: NO_POSITIONALS,
-        constraints: EMPTY_CONSTRAINTS,
+        constraints: Object.freeze([constraint({ kind: 'mutually_exclusive', options: ['--json', '--summary-json'] })]),
         handlerOwner: 'support',
         networkEffect: 'conditional_network',
         common: true,
-        schemaIdentifiers: Object.freeze(['whoisleuth.cli.doctor']),
+        schemaIdentifiers: Object.freeze([DOCTOR_SCHEMA, DOCTOR_SUMMARY_SCHEMA]),
         primaryArtefacts: Object.freeze([]),
         planSupport: false,
         additionalOutputFormats: Object.freeze([]),

package/cli/support-command-runner.mjs

@@ -1,10 +1,10 @@
 import { REGISTRY_CAPABILITIES_VERSION, registryCapabilityFor } from "../lib/registry-capabilities.mjs";
 import { buildRiskCalibrationSummaryReport } from "../packages/analysis/risk-calibration-summary.mjs";
-import { explainRiskScore, explainRiskScoreV7, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
+import { explainRiskScore, explainRiskScoreV8, RISK_MODEL_VERSION, RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
 import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
 import { CLI_COMMAND_REGISTRY, CLI_COMMANDS, COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";
-import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
+import { buildDoctorReport, buildDoctorSummary, formatDoctorReport } from "./doctor.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
@@ -68,9 +68,11 @@ async function runDoctorCommand(args, dependencies, context) {
         ? await context.withProgress('Checking public DNS, HTTPS, and WHOIS connectivity', buildReport)
         : await buildReport();
     if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatDoctorReport(report), args.color));
+        context.writeStdout(args.output === 'summary_json'
+            ? formatJsonDocument(buildDoctorSummary(report))
+            : args.output === 'json'
+                ? formatJsonDocument(report)
+                : context.terminal(formatDoctorReport(report), args.color));
     }
     return report.state === 'partial' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
 }
@@ -169,8 +171,8 @@ async function runRiskCalibrationCommand(args, dependencies, context) {
         modelVersion: dependencies.riskModelVersion || RISK_MODEL_VERSION,
         reviewThreshold: dependencies.riskReviewThreshold || RISK_REVIEW_THRESHOLD,
         ...(!dependencies.explainRiskScore ? {
-            previousModelVersion: 7,
-            explainPreviousRiskScore: explainRiskScoreV7,
+            previousModelVersion: 8,
+            explainPreviousRiskScore: explainRiskScoreV8,
         } : {}),
     });
     if (!args.quiet) {

package/cli/watchlist-review.mjs

@@ -0,0 +1,43 @@
+import { parseBoundedJson } from "../packages/analysis/bounded-json.mjs";
+import { applyCandidateWatchHandoff, planCandidateWatchHandoff, } from "../packages/workspace/candidate-watch-handoff.mjs";
+import { buildWatchlistExport, mergeWatchlistStores, } from "../packages/workspace/watchlist-store.mjs";
+import { MAX_WATCHLIST_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
+import { ordinaryWorkspaceRecord } from "../packages/workspace/hostile-input.mjs";
+import { CANDIDATE_WATCH_INPUT_SCHEMA, CANDIDATE_WATCH_INPUT_VERSION, } from "../packages/contracts/candidate-watch-review.mjs";
+export function parseCandidateWatchInput(input) {
+    const value = typeof input === 'string'
+        ? parseBoundedJson(input, {
+            maximumBytes: MAX_WATCHLIST_IMPORT_BYTES,
+            label: 'Candidate watch selection',
+        })
+        : input;
+    const raw = ordinaryWorkspaceRecord(value, 'Candidate watch selection');
+    if (!raw ||
+        raw.schema !== CANDIDATE_WATCH_INPUT_SCHEMA ||
+        raw.version !== CANDIDATE_WATCH_INPUT_VERSION ||
+        Object.keys(raw).some((key) => !['schema', 'version', 'watchlists', 'selection'].includes(key)))
+        throw new TypeError('Use candidate-watch-input schema 1 with watchlists and an explicit selection.');
+    const selection = ordinaryWorkspaceRecord(raw.selection, 'Candidate watch selection');
+    if (!selection ||
+        Object.keys(selection).some((key) => ![
+            'name',
+            'candidates',
+            'brandProfileId',
+            'priority',
+            'reason',
+            'reviewDueAt',
+            'replaceExistingContext',
+        ].includes(key)))
+        throw new TypeError('The candidate selection contains undeclared fields.');
+    const local = raw.watchlists === null ? {} : mergeWatchlistStores({}, raw.watchlists).watchlists;
+    planCandidateWatchHandoff(local, selection);
+    return raw;
+}
+export function reviewCandidateWatchInput(input, operation, now) {
+    const raw = parseCandidateWatchInput(input), selection = raw.selection;
+    const local = raw.watchlists === null ? {} : mergeWatchlistStores({}, raw.watchlists).watchlists;
+    if (operation === 'plan')
+        return planCandidateWatchHandoff(local, selection);
+    const result = applyCandidateWatchHandoff(local, selection, now);
+    return buildWatchlistExport(result.watchlists, now);
+}