@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/cli/workflow-arguments.mjs

@@ -3,7 +3,19 @@ import { CliUsageError } from "./errors.mjs";
 import {} from "./fail-policy.mjs";
 import { commandDefaultNumber } from "./command-reference.mjs";
 import { WORKFLOW_COMMAND_DEFINITIONS } from "./workflow-command-definitions.mjs";
+import { parseDomainFeedSelectors } from "./domain-feed.mjs";
 import { terminalOptions, jsonOutput, failPolicies, parseOutput, } from "./argument-values.mjs";
+function parseDomainFeedArguments(parsed) {
+    const operation = parsed.positionalValue('operation');
+    const contextSource = parsed.positionalValue('context');
+    if ((operation === 'watch-input') !== Boolean(contextSource))
+        throw new CliUsageError('watch-input requires one existing candidate-watch-input context file; review does not accept a context file.');
+    return { action: 'domain-feed', operation, feedId: parsed.positionalValue('feed'), source: parsed.positionalValue('source'), contextSource,
+        selection: parseDomainFeedSelectors(parsed.optionValues('--select')), output: jsonOutput(parsed), ...terminalOptions(parsed) };
+}
+function parseWatchlistReviewArguments(parsed) {
+    return { action: 'watchlist-review', operation: parsed.positionalValue('operation'), source: parsed.positionalValue('source'), output: jsonOutput(parsed), ...terminalOptions(parsed) };
+}
 function parseMonitorOnceArguments(parsed) {
     const selectedFailPolicies = failPolicies(parsed, 'monitor-once');
     return {
@@ -80,6 +92,8 @@ function parseWorkflowRunArguments(parsed) {
     };
 }
 export const WORKFLOW_ARGUMENT_PARSERS = Object.freeze({
+    'domain-feed': parseDomainFeedArguments,
+    'watchlist-review': parseWatchlistReviewArguments,
     'monitor-once': parseMonitorOnceArguments,
     'workflow-plan': parseWorkflowPlanArguments,
     'workflow-run': parseWorkflowRunArguments,

package/cli/workflow-command-definitions.mjs

@@ -1,6 +1,32 @@
 import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES } from "./investigation-recipes.mjs";
-import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file } from "./command-definition.mjs";
+import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file, optionDefinition } from "./command-definition.mjs";
+import { DOMAIN_FEED_CATALOGUE } from "../packages/monitoring/domain-feed.mjs";
+import { WATCHLIST_SCHEMA_VERSION } from "../packages/contracts/workspace-portability.mjs";
 export const WORKFLOW_COMMAND_DEFINITIONS = Object.freeze({
+    'domain-feed': commandSeed({
+        reference: { description: 'Review exact hosts or literal terms in a selected local plain-domain feed.',
+            example: 'whoisleuth domain-feed review tif-mini feed.txt --select host:candidate.example --json',
+            boundary: 'Always available offline. Reads one explicit local regular file; never downloads a feed, performs a Lookup, changes scores, retains candidates or enables a schedule. Streams at most 256 MiB and 10 million physical rows with 1,024-byte lines and a ten-minute deadline; retains at most 200 matched hosts. Repeat --select host:<hostname>, term:<literal> or exclude:<literal> for at most 200 exact hosts, 20 positive and 20 negative literal terms of 3–80 characters. A negative match vetoes even an exact host before the match bound; at least one positive term or exact host is required. Matching uses canonical ASCII/punycode substrings, never token boundaries, parent equivalence, typo/confusable expansion or regular expressions. Review emits the full raw-byte digest, separate declared file/local clocks, unknown per-host clocks and omissions. watch-input also requires a candidate-watch-input v1 context file with an empty candidates array, and emits that existing format for a separate watchlist-review plan/export. Inclusion is not a maliciousness, activity, ownership or availability verdict.' },
+        collection: { scope: 'Local raw file: 256 MiB, 10 million physical rows, 1,024 bytes per line, ten minutes; 200 retained hosts, 20 positive and 20 negative literal terms, no requests.' },
+        summary: 'Review a selected local plain-domain feed', options: ['--select', '--json', '--quiet', '--no-color'],
+        optionOverrides: { '--select': optionDefinition('text', 'Select host:<exact-hostname>, term:<literal-text> or exclude:<literal-text>; repeat for separate explicit selectors.', { occurrence: 'repeatable', acceptsOptionLikeValue: true }) },
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['review', 'watch-input']),
+            positional('feed', 'enum', 1, 1, DOMAIN_FEED_CATALOGUE.map(feed => feed.id)), positional('source', 'file', 1, 1), positional('context', 'file', 0, 1)]),
+        constraints: Object.freeze([constraint({ kind: 'required', options: ['--select'] })]),
+        handlerOwner: 'workflow', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.candidate-watch-input']), primaryArtefacts: Object.freeze(['Bounded feed inclusion review', 'Explicit candidate watch selection']),
+        planSupport: true, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
+    'watchlist-review': commandSeed({
+        reference: { description: 'Preview or export an explicit candidate selection to a local watchlist.', example: 'whoisleuth watchlist-review plan selection.json --json',
+            boundary: `Reads bounded local JSON only. Plan shows exact domains, duplicates, per-domain outcomes, destination and review priority with zero additional requests. Export emits Watchlist schema ${WATCHLIST_SCHEMA_VERSION} without creating a scan or baseline. Neither mode enables collection or scheduling.` },
+        collection: { scope: 'At most 2,000 selected candidate domains; no target requests.' },
+        summary: 'Review a local candidate watchlist handoff', options: ['--json', '--quiet', '--no-color'],
+        positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['plan', 'export']), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
+        constraints: Object.freeze([]), handlerOwner: 'workflow', networkEffect: 'offline', common: false,
+        schemaIdentifiers: Object.freeze(['whoisleuth.candidate-watch-input', 'whoisleuth.watchlists']), primaryArtefacts: Object.freeze(['Exact candidate handoff plan', 'Local watchlist export']),
+        planSupport: true, additionalOutputFormats: Object.freeze([]), bootstrapProfile: 'allowed',
+    }),
     "monitor-once": commandSeed({
         reference: {
             description: 'Collect one bounded owned-domain review and compare it with an optional prior checkpoint.',

package/cli/workflow-command-runner.mjs

@@ -16,7 +16,37 @@ import { MAX_SHARING_REVIEW_BYTES } from "./sharing-review.mjs";
 import { createBufferedOutput } from "./output-file.mjs";
 import { boundedInteractiveAnswer, canReadInteractiveLine, readBoundedInteractiveLine } from "./terminal-input.mjs";
 import { WORKFLOW_INLINE_COMMANDS } from "./inline-command-families.mjs";
+import { reviewCandidateWatchInput, parseCandidateWatchInput } from "./watchlist-review.mjs";
+import { readDomainFeedFile } from "./domain-feed.mjs";
+import { scanDomainFeed, buildDomainFeedWatchInput, normalizeDomainFeedSelection } from "../packages/monitoring/domain-feed.mjs";
+import { MAX_WATCHLIST_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
 import { runDiscriminatedCommandHandler } from "./discriminated-command-handlers.mjs";
+async function runWatchlistReviewCommand(args, dependencies, context) {
+    const raw = dependencies.readArtifactInput ? await dependencies.readArtifactInput(args.source) : await context.readInput(args.source, MAX_WATCHLIST_IMPORT_BYTES, 'Candidate watch selection');
+    const document = reviewCandidateWatchInput(raw, args.operation, context.now());
+    if (!args.quiet)
+        context.writeStdout(formatJsonDocument(document));
+    return EXIT_CODES.SUCCESS;
+}
+async function runDomainFeedCommand(args, dependencies, context) {
+    context.setFailureLabel('Offline domain-feed review');
+    const handoff = args.contextSource ? parseCandidateWatchInput(dependencies.readArtifactInput
+        ? await dependencies.readArtifactInput(args.contextSource)
+        : await context.readInput(args.contextSource, MAX_WATCHLIST_IMPORT_BYTES, 'Candidate watch context')) : null;
+    const watchSelection = handoff?.selection;
+    if (watchSelection && watchSelection.candidates.length)
+        throw new CliUsageError('The watch-input context must have an empty candidates array; only reviewed feed matches may be nominated.');
+    const selection = normalizeDomainFeedSelection({ ...args.selection, brandProfileId: watchSelection?.brandProfileId ?? null });
+    const review = await scanDomainFeed((dependencies.readDomainFeedInput ?? readDomainFeedFile)(args.source, dependencies.signal), {
+        feedId: args.feedId, selection, importedAt: context.now(), ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+    });
+    const document = watchSelection && handoff
+        ? buildDomainFeedWatchInput(review, review.matches.map(match => match.domain), watchSelection, handoff.watchlists)
+        : review;
+    if (!args.quiet)
+        context.writeStdout(formatJsonDocument(document));
+    return EXIT_CODES.SUCCESS;
+}
 function boundWorkflowInputs(command, inputs, dependencies, context) {
     if (!inputs.size)
         return {};
@@ -181,6 +211,8 @@ async function runWorkflowRecipeCommand(args, dependencies, context) {
     return investigationRunExitCode(document);
 }
 const WORKFLOW_COMMAND_HANDLERS = Object.freeze({
+    'domain-feed': runDomainFeedCommand,
+    'watchlist-review': runWatchlistReviewCommand,
     'monitor-once': runMonitorOnceCommand,
     'workflow-plan': runWorkflowPlanCommand,
     'workflow-run': runWorkflowRecipeCommand,

package/docs/cli-reference.md

@@ -71,11 +71,11 @@ candidate, form destination and deliberately observed navigation separately
 attributed. A similar page without a logo or brand name can still merit manual
 evidence review; correspondence does not establish authorship, rights authority
 or maliciousness. Missing optional capture or comparison evidence does not
-prevent ordinary Case pins and conclusions. Installed command help remains the
+prevent ordinary case pins and conclusions. Installed command help remains the
 authority for offline file inputs and explicit collection plans.
 
 The [reporting guide](https://www.whoisleuth.com/resources/reporting-and-takedown-guidance)
-uses the same reviewed official-route catalogue as the Console for social
+uses the same reviewed official-route catalogue as the console for social
 content, storefronts, app listings, hosted files/forms and advertising. Verify
 the exact object, current route, reporter authority and disclosure before any
 manual submission. Fraud, order complaints and rights notices are different
@@ -96,8 +96,10 @@ PKIX, STARTTLS and SMTP transport remain separate evidence states.
 STARTTLS detection uses the full bounded reply. If the retained capability
 inventory is shortened, the report remains partial and names the omission.
 
-The repository-only rendered-capture package is outside hosted and distributable
-collection. It executes remote page JavaScript only for an explicitly
+The separate optional rendered-capture companion is distributed as a locally
+assembled archive, not as part of the hosted application or main CLI, and is
+not published to a package registry. Its sandboxed, bounded browser executes
+remote page JavaScript only for an explicitly
 authorised route set, and each admitted resource operator receives the exact
 requested URL. Captures and screenshots remain local until the operator deletes
 them.
@@ -143,18 +145,46 @@ Readers accept only their declared public and current versions. Unknown,
 unreleased historical and future schemas fail before partial interpretation;
 an invalid import is not treated as an empty document.
 
-`inspect-archive` reads current workspace archive v9 and exact versions 5–8. It
+`inspect-archive` reads current workspace archive v10 and exact versions 5–9. It
 reports section metadata and digest-only search results unless `--reveal` is
 explicitly selected. It never searches notes, contacts or arbitrary raw fields.
 
-`export` reads supported saved Lookup v1 or v2 and writes current Lookup
-evidence schema 29. Published v2 schemas 27 and 28 and exact v1 schema 26 remain
-readable. Versions 27–29 exclude raw registration payloads, expanded
+`export` reads supported saved Lookup versions 1–3 and writes current Lookup
+evidence schema 31. Supported schemas 27–30 and exact v1 schema 26 remain
+readable. Versions 27–31 exclude raw registration payloads, expanded
 contacts, credentials, complete query-bearing URLs and provider payloads;
-schemas 28 and 29 also retain the bounded registrar-standing projection.
+Schemas 28 and later also retain the bounded registrar-standing projection.
 Schema 29 identifies the hostname used for DNS, TLS and web observations,
 separately from the registrable domain used by registration sources. Older
 evidence retains its original collection scope.
+Schema 31 retains WHOIS registration classification separately from collection
+completion. Lifecycle interpretation requires positive registration evidence;
+a completed negative or inconclusive WHOIS reply does not establish registration
+or absence of locks. Earlier exports retain their exact original interpretation
+for historical verification and are not silently relabelled.
+
+New WHOIS collection distinguishes confirmed no-service discovery from an
+incomplete discovery response. Empty, refused or unrecognised bootstrap
+responses remain partial; they do not establish that WHOIS is unsupported.
+`--strict-exit` treats that incomplete attempt as a source failure. Explicit
+no-request access-policy restrictions remain distinct from transport failures.
+
+Saved Lookup version 3 can retain a bounded collection receipt: original
+optional selections, admitted source families, collector starts, outcomes and
+explicitly known completeness. `lookup --verbose` and `lookup --browse`
+show this account with source-specific explanations and qualified retry guidance.
+Earlier files have no inferred receipt. The receipt contains
+no target values, URLs, contacts or raw errors and does not prove network
+delivery. It stays in full private Lookup JSON; the minimised `export` report
+does not include it. `--plan` remains offline and produces no completed receipt.
+
+Case schema 20 also retains this context when an analyst saves a completed Lookup
+assessment or selected checkpoint facts. A selected checkpoint saves only its
+selected pins and one payload-free receipt, not every Lookup result. Ordinary
+backups and internal case packs preserve it. Trusted/public case packs, case
+reports and response packets omit receipts; shared assessment identities are
+recomputed without them. Historical case formats remain readable without
+inventing missing collection choices.
 
 `verify-artifact` checks a recognised structure and its applicable integrity
 contract. `interchange-report` describes retained and omitted fields.
@@ -162,6 +192,14 @@ contract. `interchange-report` describes retained and omitted fields.
 validity and signer trust separate. None of these checks establishes that
 evidence is accurate, current, safe to share or attributable to a person.
 
+The text output of `verify-artifact` suggests compatible offline follow-up
+commands for recognised saved Lookups, case exports, workspace archives,
+Lookup-evidence reports, Case-packs and managed indicator revisions. These are
+examples with placeholder filenames, not executed actions or a sharing approval.
+Replace the filenames deliberately; a case or indicator inspection can display
+private contents. Encrypted workspace guidance uses a separate passphrase file,
+never a passphrase in command history. JSON output and `--quiet` are unchanged.
+
 ### Signer trust
 
 Use `verify-signature package.json --trust-store-file trust.json --json` to
@@ -211,9 +249,9 @@ own retention policy. No automatic key discovery, key storage or trust refresh o
   control, activity, intent or maliciousness.
 - Bulk applies one declared collection contract per target. Fast accepts up to
   500 targets and Deep up to 50; each target remains a separate request.
-- Respond commands package browser-created Cases and prepare local packets,
+- Respond commands package browser-created cases and prepare local packets,
   reports and sharing reviews. The offline [`case` workflow](cli.md#local-case-files)
-  also creates and updates ordinary local Case files through explicit, conflict-checked
+  also creates and updates ordinary local case files through explicit, conflict-checked
   output. Neither workflow submits, publishes, notifies or grants recipient authorisation.
 - Assurance, comparison and calibration commands describe supplied or retained
   evidence. They do not tune the running model, change infrastructure or turn an

package/docs/cli.md

@@ -12,6 +12,11 @@ tasks, then offers searchable commands with examples, option explanations and
 defaults. Command-section links can be bookmarked. Its option guidance and
 installed help derive from the same command definitions.
 
+Not sure which interface to use? The [installation-mode comparison](https://www.whoisleuth.com/cli#choose-mode)
+covers the hosted console, filesystem-local application, CLI and capture companion,
+including request origin, storage, offline use and distribution. The optional
+application and capture archives are separate from the public CLI package.
+
 The generated [privacy and data-flow catalogue](https://github.com/slicedearth/whoisleuth/blob/main/docs/privacy-data-flow-catalogue.md)
 lists the network, recipient, retention and export boundary for every command.
 
@@ -75,22 +80,35 @@ private document from the interactive view:
 
 ```bash
 whoisleuth lookup example.test --deep --browse --save-lookup lookup.json
+whoisleuth verify-artifact lookup.json --json
+whoisleuth export lookup.json --output evidence.json
+whoisleuth verify-artifact evidence.json --json
 ```
 
-In Console Lookup, open **Replay exported evidence**, select the file, verify
-its digest and source states, then create or update a browser-local Case. The
-file is not uploaded. Case classification, exact incident links and response
-actions remain deliberate analyst steps. Ordinary Case files also support the
+Keep `lookup.json` as the private CLI original. In Lookup in the console, open **Replay
+exported evidence**, select `evidence.json`, check its digest and source states,
+then create or update a browser-local case. The private CLI document is not a
+browser replay format; the separate evidence export excludes raw registration
+payloads and expanded contacts. Neither file is uploaded. Case classification, exact incident links and response
+actions remain deliberate analyst steps. Ordinary case files also support the
 offline CLI workflow below.
-When several incident Cases share a domain, select the intended Case before
-retaining replay evidence. Case packs preserve each current Case ID separately;
+When several incident cases share a domain, select the intended case before
+retaining replay evidence. Case packs preserve each current case ID separately;
 trusted and public packs exclude analyst-entered incident titles.
 Every audience retains tags, decision summaries and rationale as well as domain
-evidence and Case, pin and decision IDs. Public does not mean anonymous.
+evidence and case, pin and decision IDs. Public does not mean anonymous.
 Browser Lookup evidence can be verified or packaged in the CLI. `brief`,
 `export`, `compare`, `registry-doctor` and `source-report` instead require a
 saved CLI Lookup; they do not reconstruct it from a browser export.
 
+Registration source states are independent: `unsupported` means no RDAP or
+WHOIS service is published for the target, while `skipped` means no query was
+issued in that mode or under the registry access policy. Neither is a transport
+failure or a domain-absence finding. Standard terminal output explains these
+non-query outcomes; JSON and evidence exports retain their separate states.
+`--strict-exit` does not fail solely because a protocol is unsupported or skipped,
+but continues to report genuine failed or partial sources.
+
 Process selected local input:
 
 ```bash
@@ -106,6 +124,18 @@ One strict domain, IP address or ASN can occupy command position as Lookup
 shorthand. URL-like or ambiguous input requires the explicit `lookup` command.
 Only `bulk` accepts multiple targets.
 
+For a downloaded plain-domain feed, use
+`whoisleuth domain-feed review nrd7 feed.txt --select term:example --json`.
+Repeat `--select exclude:literal` to veto a literal substring before the result
+bound, including for exact-host selections. At most 20 positive and 20 negative
+terms of 3–80 characters are supported; at least one positive term or exact host
+is required. Matching uses canonical ASCII/punycode text without token, typo,
+confusable or regular-expression expansion. These offline selectors do not infer
+saved browser campaign identity or default priority.
+This is an offline literal match, not a feed download or target Lookup. The
+[candidate-review guide](https://github.com/slicedearth/whoisleuth/blob/main/docs/brand-candidate-review.md#review-a-domain-feed) covers
+source attribution and the separate Watchlist handoff.
+
 `discover` accepts a brand label or registrable domain and supports multi-part
 public suffixes in `--tlds` (for example, `co.uk,com.au`). It preserves the full
 suffix and does not collect candidate evidence; use `discover-scan` only after
@@ -132,6 +162,8 @@ For an explicit inherited-policy and direct parent-delegation review, use
 option, posture collection keeps its existing exact-name scope. The extra
 results distinguish recursive policy publication from sampled parent referrals;
 they do not establish name existence, message authentication or DNSSEC validity.
+The machine-readable posture document keeps its existing versioned fields;
+the website's transient structured policy scope is not included in that export.
 
 | Mode | Behaviour |
 | --- | --- |
@@ -146,6 +178,16 @@ their focused help. They do not use the hosted login or hosted usage controls.
 `lookup --plan` lists planned source families and disclosure targets before
 collection. `doctor` is offline unless `--network` is selected.
 
+For troubleshooting that you intend to share, use
+`whoisleuth doctor --summary-json > diagnostics.json`. This summary keeps numeric
+CLI/Node versions, fixed check codes and public format identifiers from the command
+catalogue. Those identifiers describe declared formats, not a compatibility test.
+Targets, URLs, filenames, paths, user names, credentials, headers, timestamps and
+free-form diagnostic details are omitted. Version prerelease/build metadata is
+also omitted. Normal terminal and `--json` diagnostics can include error details;
+inspect them before sharing. The summary does not enable network checks or upload
+anything, and it has the same success/partial exit behaviour as the detailed report.
+
 Deep Lookup reports IPv4 and IPv6 results separately, including empty answers,
 NODATA, resolver-reported missing names and query failures. These outcomes remain
 distinct in evidence exports; none alone establishes domain removal.
@@ -179,6 +221,30 @@ Excluded links and unsupported QR payloads make the review partial, with
 category counts rather than private payload text. Bare QR hostnames are not
 automatically treated as URLs.
 
+Current message-intake reports also retain bounded literal IPv4/IPv6 and
+explicitly labelled MD5, SHA-1 and SHA-256 observations from supported body and
+document text. Each observation links to its selected source part and digest;
+it is not a Lookup target, file identification or threat verdict. Complete URLs,
+message headers, QR payloads, HAR and identity-event fields are excluded from
+this text scan. Historical version-1 reports do not acquire new observations.
+
+Use `intake text selected.txt --intake-context context.json --json` to add an
+explicit analyst-supplied distribution declaration. The separate context file
+is limited to 8 KiB and cannot use stdin. Its channel, non-sensitive source
+label and optional declared time, reference, observer and vantage labels are
+included in the output, not verified as delivery or capture conditions. See
+[selected-input indicators and declarations](offline-intake-context.md) for the
+exact schema, privacy exclusions and extraction bounds.
+
+Plain-text phone discovery reports only candidate counts, the source digest and
+UTF-16 selection ranges to standard error; unselected numbers do not enter JSON
+output. Use a version-2 `--intake-context` file to select exact ranges and declare
+their source, basis, role and known time. The same optional file can supply a
+displayed/destination pair for local hostname comparison. See the
+[selection example](offline-intake-context.md#select-phone-observations-in-the-cli).
+`--quiet` suppresses discovery guidance, and `--strict-exit` reports partial
+phone coverage as well as other incomplete intake work.
+
 ### Local IP-location database review
 
 `review-evidence query.json --mmdb selected.mmdb --json --strict-exit` reads
@@ -227,12 +293,29 @@ metadata or freshness admission; terminal output identifies that limitation.
 
 ### Contextual reviews
 
+`review-evidence` reviews bounded source-qualified infrastructure snapshots and explicit earlier/later comparisons offline. See [infrastructure observations](infrastructure-observations.md) for supported inputs and how to interpret their outcomes.
+
 `review-evidence` also accepts [contextual review inputs](contextual-reviews.md)
 for source-qualified incident sequences, retained domain history, platform-object continuity, authorised storefront
 comparison and connector provenance. These workflows are offline; partial
 context reviews return 4 when `--strict-exit` is selected. Browser-generated
 reusable inputs use the same validators.
 
+Domain-history input version 2 adds analyst-declared registration, deletion,
+re-registration, transfer or review boundaries linked to retained snapshot or
+pin IDs. Version 1 remains supported with its original output. Boundaries prompt
+reassessment; they do not establish ownership or discard prior evidence.
+
+`review-evidence containment.json --json --strict-exit` accepts a
+`whoisleuth.internal-containment.input` version-1 document containing a supported
+case export, selected next-step assertion and linked pin IDs, internal or trusted
+audience, recipient role and an explicit disclosure-review acknowledgement.
+It exports only that selected handoff, never writes the case or performs a
+control. Missing or unselected supporting context stays partial (exit 4 under
+`--strict-exit`), and a resolved case or provider outcome does not close an open
+internal follow-up. See [internal containment](offline-intake-context.md#selected-internal-containment-handoff)
+for the complete input and audience limitations.
+
 ### Message-header review
 
 `mail-headers` parses only the bounded header block from a selected message file
@@ -282,9 +365,48 @@ selected file, including an envelope when supplied. No provider API is contacted
 
 ## Output and automation
 
-### Local Case files
-
-Create a working file, inspect its Case IDs, then append a note:
+### Local case files
+
+Manual response scope is explicit and offline. `case incident-link` takes
+`{"url":"https://example.test/reported-page"}`; use its retained ID to bind
+`responseObjects` on `case action`. Each object contains `kind`, `identifier`
+and `incidentTargetId` (null for the case domain or an associated hostname).
+New URL objects must match that exact retained link. Exact historical identities
+already retained in response records remain selectable after a link edit or
+removal; they are not rebound to its replacement. An action may bind up to 20
+objects; missing historical scope stays unknown.
+
+`case action-event` takes `{"id":"action-id","transition":{...}}`, using
+the same reviewed, authorised and manually submitted workflow as the console.
+After submission, a typed `objectOutcome` such as `removed`, `restricted`,
+`suspended`, `delisted`, `restored` or `disputed` requires explicit event
+`responseObjects`: a partial receipt never applies to all objects by default.
+Acknowledgement is a workflow event, not independently observed remediation.
+
+A self-initiated correction uses a new `case action`, with `originActionId`
+identifying the original action and `responseObjects` selecting a subset of that
+delivery's exact objects. Its `correction` block identifies one delivery event,
+packet digest/version and profile, plus the purpose (`correction` or
+`retraction_request`), reason, previous and corrected statements, and retained
+evidence-pin IDs. This is separate from `amendment`, which still requires an
+actual provider-request event. The correction must match a retained typed packet
+receipt on the selected delivery; a historical free-text digest alone is
+insufficient. The usual recipient, authority and disclosure review then applies
+to the new draft. The original packet and delivery remain unchanged.
+
+`case recheck-question` saves `statement` and `recheck` comparison conditions.
+Pins, questions and recheck input can retain one `responseObject`; exact-object
+non-reproduction requires matching complete baseline/current evidence, a later
+observation and comparable conditions. Hostname similarity is insufficient.
+Independent removal, restriction, suspension, delisting, transfer and restoration
+use those same comparison requirements. Disputes and warnings retain procedural
+source attribution separately; provider claims are not independent observations.
+`case close-object` requires one `responseObject` and the usual typed closure
+reason/evidence links. It leaves the case and other objects unchanged.
+All these JSON operations require `--input`, `--output`, deliberate file
+replacement and the existing digest/lease checks. No report or request is sent.
+
+Create a working file, inspect its case IDs, then append a note:
 
 ```sh
 whoisleuth case open --domain example.test --title "Review the selected form" --output cases.json
@@ -292,8 +414,8 @@ whoisleuth case show cases.json
 whoisleuth case note cases.json --note-file note.txt --output cases.json --force
 ```
 
-Use `--case-id` when the file contains several Cases. `open` reuses the selected
-Case; `--new-incident --title "Another incident"` creates a distinct ID for the
+Use `--case-id` when the file contains several cases. `open` reuses the selected
+case; `--new-incident --title "Another incident"` creates a distinct ID for the
 same domain. It does not open a browser or collect anything.
 
 `pin`, `link`, `withdraw-link`, `assess` and `recheck` read a selected JSON file with `--input`:
@@ -350,23 +472,23 @@ A recheck input contains `state`, `observedAt`, `completeness`, `source` and
 `comparisonSummary`, with optional limitations and follow-up time. For example,
 use `state: "unavailable"` and `completeness: "partial"` when a supplied capture
 did not complete. `not_reproduced` requires a saved recheck question from the
-Case's console workflow, its exact `recheck` context, the target
+case's console workflow, its exact `recheck` context, the target
 `observationHostname`, a complete later observation where a baseline exists,
 and `conditionsMatch: "comparable"`. It never means global removal or takedown.
 
-Mutations require an explicit output path and write the complete current Case
+Mutations require an explicit output path and write the complete current case
 export. They never prune old evidence to fit. Input formatting may use up to
-16 MiB; the canonical store remains limited to 4 MiB and 500 Cases. `show --json`
-can export a selected subset to a **different** path. Ordinary Case imports also
+16 MiB; the canonical store remains limited to 4 MiB and 500 cases. `show --json`
+can export a selected subset to a **different** path. Ordinary case imports also
 allow 16 MiB for formatting and export metadata; the stored-data limit remains
-4 MiB. Case packs retain their separate 25-Case selection and 4-MiB source-file
+4 MiB. Case packs retain their separate 25-case selection and 4-MiB source-file
 limits, and include generated reports within the bounded import allowance.
 
 `show` reports the exact file digest. Add `--expect-file-digest sha256:<digest>`
 to reject a file changed since that review. Source/output locks and atomic
 replacement also detect changes during execution. After an interrupted process,
 inspect its adjacent `.workflow.lock` before deliberately removing it. Validation
-or conflict failures leave the Case file unchanged and return 2. Filesystem
+or conflict failures leave the case file unchanged and return 2. Filesystem
 publication failures return 3.
 
 Working files contain private analyst content and file references, not attachment
@@ -386,21 +508,26 @@ whoisleuth manifest evidence.json screenshot.png --workflow "Evidence review" \
 whoisleuth verify-artifact --folder ./evidence-project --json --strict-exit
 ```
 
-Packages admit the 128-file, 64-MiB original selection plus one bounded Case
+Packages admit the 128-file, 64-MiB original selection plus one bounded case
 export, with a separate manifest allowance. Original-file limits remain unchanged.
-`verify-artifact` uses the same exact ordinary Case reader as `case show`,
+`verify-artifact` uses the same exact ordinary case reader as `case show`,
 without repairing content. Package verification also reports original-reference
-completeness for each Case file; `--strict-exit` returns 4 when a referenced original is missing.
-An ordinary Case JSON file alone provides structural validity, not a checksum.
+completeness for each case file; `--strict-exit` returns 4 when a referenced original is missing.
+An ordinary case JSON file alone provides structural validity, not a checksum.
 They use generated entry names, not original paths. Ordinary ZIPs and folders
 are private and unencrypted; packaging does not redact selected files. The report distinguishes
 file identity, supported source formats, opaque content, exact capsule/source
-links and capture-manifest attachment matches. Include the capture manifest and
+links, declared image derivation and capture-manifest attachment matches.
+Image derivation reports an immediate-parent digest and byte length, editing
+method and operation kinds, not proof of transformation. Parent inclusion matches
+another selected manifest entry by exact byte digest and size; an unselected case
+attachment reference does not count. Parent pixels are optional; absent declarations
+leave editing history unknown. Include the capture manifest and
 its screenshot/DOM-digest files together to check their declared bytes; original
 filenames are not needed to establish a match. It does not import files or establish source truth, signature trust or a
 trusted timestamp. Unsupported or rejected entries produce a partial report;
 `--strict-exit` returns 4. Without `--package` or `--folder`, `manifest` produces a
-standalone JSON manifest; exact public version-2 manifests remain readable.
+standalone JSON manifest; exact version-2 and version-3 manifests remain readable.
 
 For [BagIt 1.0](https://www.rfc-editor.org/rfc/rfc8493.html) interchange, use
 `--bagit` with `--package` or `--folder` on both commands:
@@ -454,6 +581,35 @@ trees and unlisted files. Its package digest and byte count describe the
 canonical stored-ZIP representation, not filesystem metadata. These are
 selected evidence exports, not complete workspace backups.
 
+### Exporting a fixed workflow for review
+
+Terminal plans and recipe explanations distinguish networked steps, offline
+steps and declared reuse of earlier outputs. These are step and handoff counts,
+not request totals or confirmation that a saved file is available. The planner
+does not inspect files or caches; collection and evidence selection remain
+deliberate actions. JSON exports keep their existing versioned fields.
+
+Select one installed recipe and save its declared steps for review:
+
+```sh
+whoisleuth workflow-plan --explain domain-triage --json --output recipe.json
+```
+
+The document includes the subject requirement, command and argument examples,
+network modes, required approvals, output artefact families and completion guidance.
+To prepare the same recipe for a specific subject:
+
+```sh
+whoisleuth workflow-plan domain-triage example.test --json --output plan.json
+```
+
+Both commands plan offline. The files contain declarative steps rather than
+shell history or executable scripts. Argument examples and approval fields
+describe requirements; they do not record a completed review or grant approval.
+These are review documents, not `workflow-run` checkpoints or custom recipe
+imports. Run an installed recipe deliberately with its required inputs and
+fresh approvals.
+
 ### Resuming a fixed workflow
 
 Inspect a paused run without executing any step or rewriting its checkpoint:
@@ -486,7 +642,7 @@ whoisleuth workflow-run domain-triage example.test --approve-network \
 ```
 
 Bindings accept Lookup outputs for export, diff, timeline, comparison, source
-reports and briefs; evidence exports for verification; and Case-pack output
+reports and briefs; evidence exports for verification; and case-pack output
 for sharing review. Remaining placeholders use `--select` in order;
 for example, `--select diff=previous.json` keeps the current observation as the
 second input. Supply every input for an uncompleted step to use files instead,
@@ -601,6 +757,9 @@ and machine output contains no ANSI or transient progress text.
 - `lookup --browse` provides an interactive terminal view; press `?` for keys.
 - `--events` writes versioned lifecycle events to stderr.
 - `--strict-exit` and `--fail-on` expose selected evidence states to automation.
+- `lookup --junit` reports retained diagnostic source states, not version or
+  timing metadata. Nested diagnostic failures remain failures; target-bearing
+  diagnostic paths are not copied into the XML. This is not a truth verdict.
 - `--output` writes a private local file atomically and refuses an existing path
   unless `--force` is also selected.
 
@@ -611,7 +770,22 @@ options override profile defaults.
 
 `source-report` summarises collector-owned health envelopes in saved Lookup
 and Bulk output. Raw publications and extension fields are not interpreted as
-diagnostics, and missing health metadata remains unmeasured.
+diagnostics, and missing health metadata remains unmeasured. Its text view groups
+collection states, sample counts and durations under each source. Observation
+durations and Lookup timings stay separate; merged-report distributions describe
+retained report statistics, not a new measurement of individual requests.
+
+After verifying a domain-control or Lookup-claim passport, `verify-artifact`
+suggests the compatible offline `interchange-report` command. Suggestions use
+example filenames and never run automatically. Other artefact families receive
+guidance only when the suggested reader supports that format.
+
+The text output of `brief` groups selected facts in an indented source tree.
+Each source keeps its collection state and observation time, including sources
+with no fact selected for the brief; that does not mean the source was empty.
+Conflicting values remain separate and include both the value state and source
+state. The brief uses retained evidence only. Use `--json` for the
+structured report, including its facts, source health, unknowns and action plan.
 
 `mail-review` keeps failed input targets, incomplete DNS coverage and original
 collection times visible. Source-output and review-generation times do not