@slicedearth/whoisleuth-cli 2.6.0 → 2.7.0

package/cli/artifact-validation/lookup-evidence.mjs

@@ -1,11 +1,12 @@
 import { isDeepStrictEqual } from 'node:util';
-import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
+import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, lookupEvidenceRegistryInsightsVersion, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
 import { validLookupObservationScope } from "../../packages/evidence/lookup-target.mjs";
 import { externalPasswordFormObservation } from "../../packages/evidence/credential-form-attribution.mjs";
 import { credentialSurfaceContractState } from "../../lib/lookup-child-profile-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../../lib/registrar-standing-contract.mjs";
 import { compareRegistrySources } from "../../lib/registry-comparison.mjs";
 import { buildRegistryInsights } from "../../lib/registry-insights.mjs";
+import { resolveRdapCapabilityCatalogRevision } from "../../lib/rdap-capabilities.mjs";
 import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../packages/analysis/project-metadata.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../../lib/homepage-metadata-contract.mjs";
 import { HEX_DIGEST_RE, SEMANTIC_VERSION_RE, absoluteUrl, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, nullableRecord, optionalText, record, strings, text, } from "./structure-primitives.mjs";
@@ -344,7 +345,7 @@ function validateLookupEvidenceWhois(value, version) {
     optionalText(complete.conflictingHop, 'Lookup evidence WHOIS conflicting hop', 253);
     nullableRecord(complete.parsed, 'Lookup evidence WHOIS parsed data');
     if (version >= PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION
-        && !isDeepStrictEqual(complete.parsed, projectLookupEvidenceWhoisPublication(complete.parsed))) {
+        && !isDeepStrictEqual(complete.parsed, projectLookupEvidenceWhoisPublication(complete.parsed, version))) {
         fail('Lookup evidence WHOIS portable publication');
     }
     array(complete.chain, 'Lookup evidence WHOIS chain', 16).forEach((item, index) => {
@@ -715,6 +716,15 @@ export function validateLookupEvidenceArtifactStructure(value) {
         });
         if (!isDeepStrictEqual(registryComparison, expectedComparison))
             fail('Lookup evidence registry comparison derivation');
+        const capabilities = record(registryInsights.rdapCapabilities, 'Lookup evidence RDAP capabilities');
+        const registryCapabilities = record(capabilities.registry, 'Lookup evidence registry RDAP capabilities');
+        const registrarCapabilities = record(capabilities.registrar, 'Lookup evidence registrar RDAP capabilities');
+        const catalogReviewedAt = registryCapabilities.catalogReviewedAt;
+        if (typeof catalogReviewedAt !== 'string'
+            || resolveRdapCapabilityCatalogRevision(catalogReviewedAt) === null
+            || registrarCapabilities.catalogReviewedAt !== catalogReviewedAt) {
+            fail('Lookup evidence RDAP capability catalogue revision');
+        }
         const rebuiltInsights = buildRegistryInsights({
             rdapParsed,
             rdapStatus: rdapDiagnosticStatus,
@@ -722,6 +732,9 @@ export function validateLookupEvidenceArtifactStructure(value) {
             whoisParsed,
             whoisStatus: whoisDiagnosticStatus,
             whoisQueriedAt: whois.queriedAt,
+        }, {
+            rdapCapabilityCatalogReviewedAt: catalogReviewedAt,
+            version: lookupEvidenceRegistryInsightsVersion(version),
         });
         const expectedInsights = version >= PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION
             ? projectLookupEvidenceRegistryInsights(rebuiltInsights)

package/cli/artifact-verify.mjs

@@ -1,5 +1,5 @@
 import { Buffer } from 'node:buffer';
-import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION } from "../packages/contracts/analyst-interchange.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
 import { createHash } from 'node:crypto';
 import { readEditableCaseExport } from "../packages/cases/case-export-input.mjs";
 import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "./bounded-json.mjs";
@@ -532,6 +532,34 @@ export async function verifyOfflineArtifact(raw, options = {}) {
         : null;
     return Object.freeze({ ...report, manifestIdentity });
 }
+function offlineArtifactNextSteps(report) {
+    switch (report.artifact.kind) {
+        case 'saved_lookup':
+            return ['Review retained source states without displaying target values:', '  whoisleuth source-report -- ./lookup.json'];
+        case 'case_export':
+            return ['Read the Case records, including private analyst content:', '  whoisleuth case show -- ./cases.json'];
+        case 'workspace_archive':
+            return ['Inspect section metadata without restoring the archive:', '  whoisleuth inspect-archive -- ./workspace.json'];
+        case 'encrypted_workspace_archive':
+            return report.checks.authenticatedEncryption === 'verified'
+                ? ['Inspect decrypted section metadata without restoring the archive:', '  whoisleuth inspect-archive --passphrase-file ./passphrase.txt -- ./workspace.encrypted.json']
+                : ['Check the encrypted contents using a separate passphrase file:', '  whoisleuth verify-artifact --passphrase-file ./passphrase.txt -- ./workspace.encrypted.json'];
+        case 'lookup_evidence':
+            return ['Review which fields this portable format preserves and omits:', '  whoisleuth interchange-report -- ./evidence.json'];
+        case 'cli_case_pack':
+            return ['Review the Case-pack compatibility and field exclusions:', '  whoisleuth interchange-report -- ./case-pack.json'];
+        case 'signed_review_artifact':
+            if (report.artifact.schema === DOMAIN_CONTROL_MANIFEST_SCHEMA || report.artifact.schema === LOOKUP_CLAIM_PASSPORT_SCHEMA) {
+                return ['Review the passport compatibility and retained field groups:', '  whoisleuth interchange-report -- ./passport.json'];
+            }
+            return report.artifact.schema === MANAGED_INDICATOR_SET_SCHEMA
+                && report.summary.inputBytes <= MAX_MANAGED_INDICATOR_SET_BYTES
+                ? ['Read the retained indicator identities and review windows:', '  whoisleuth indicator-set inspect -- ./indicators.json']
+                : [];
+        default:
+            return [];
+    }
+}
 export function formatOfflineArtifactVerification(report) {
     const lines = [
         'WHOISleuth offline artefact verification',
@@ -611,5 +639,8 @@ export function formatOfflineArtifactVerification(report) {
     }
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);
+    const nextSteps = offlineArtifactNextSteps(report);
+    if (nextSteps.length)
+        lines.push('', 'Offline next steps (examples; replace filenames; nothing runs automatically):', ...nextSteps);
     return `${lines.join('\n')}\n`;
 }

package/cli/case-command.mjs

@@ -29,12 +29,12 @@ function prose(input, maximum, label) {
 function selection(cases, args, required) {
     const domain = args.domain === null ? null : normalizeDomain(args.domain);
     if (args.domain !== null && !domain)
-        throw new CliUsageError('Select a valid Case domain.');
+        throw new CliUsageError('Select a valid case domain.');
     const selected = cases.filter(record => (!args.caseId || record.id === args.caseId) && (!domain || record.domain === domain));
     if ((args.caseId || domain || required) && selected.length === 0)
-        throw new CliUsageError('The selected Case is not present in this file.');
+        throw new CliUsageError('The selected case is not present in this file.');
     if (required && selected.length !== 1)
-        throw new CliUsageError('Select exactly one Case with --case-id; no arbitrary Case was chosen.');
+        throw new CliUsageError('Select exactly one case with --case-id; no arbitrary case was chosen.');
     return selected;
 }
 function pin(input, now) {
@@ -42,7 +42,7 @@ function pin(input, now) {
         throw new CliUsageError('An evidence pin must be a JSON object.');
     const raw = input;
     if (Object.hasOwn(raw, 'id') || Object.hasOwn(raw, 'createdAt'))
-        throw new CliUsageError('New pin identity and creation time are allocated by the Case operation.');
+        throw new CliUsageError('New pin identity and creation time are allocated by the case operation.');
     const normal = appendCaseEvidencePin([], raw, now)[0];
     // Validate the supplied subset against the domain result, without duplicating
     // its field inventory or accepting silent truncation/default substitution.
@@ -86,7 +86,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
             ? createCaseIncident(cases, { domain: args.domain, title }, now)
             : openOrCreateCase(cases, { domain: args.domain, ...(title ? { title } : {}) }, now, args.caseId ? { caseId: args.caseId } : {});
         if (!result.created && title && title !== result.record.title)
-            throw new CliUsageError('The selected Case already exists with another title. Use --new-incident for a separate investigation.');
+            throw new CliUsageError('The selected case already exists with another title. Use --new-incident for a separate investigation.');
         return result.cases;
     }
     const current = selection(cases, args, true)[0];
@@ -113,7 +113,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         result = updateCase(cases, current.id, { action: input }, now);
         const action = result.record.actions.find(candidate => !current.actions.some(prior => prior.id === candidate.id));
         if (!action)
-            throw new CliUsageError('No new action was retained within the Case bounds; nothing was written.');
+            throw new CliUsageError('No new action was retained within the case bounds; nothing was written.');
         for (const [key, value] of Object.entries(input))
             if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(action[key])) {
                 throw new CliUsageError(`Action field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
@@ -142,7 +142,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         result = updateCase(cases, current.id, { assertion: { ...input, kind: 'next_step' } }, now);
         const question = result.record.assertions.find(candidate => !current.assertions.some(prior => prior.id === candidate.id));
         if (!question)
-            throw new CliUsageError('No new question was retained within the Case bounds; nothing was written.');
+            throw new CliUsageError('No new question was retained within the case bounds; nothing was written.');
         for (const [key, value] of Object.entries(input))
             if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(question[key])) {
                 throw new CliUsageError(`Question field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
@@ -150,12 +150,12 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
     }
     else if (args.operation === 'close-object') {
         if (!input?.responseObject)
-            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole Case.');
+            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole case.');
         fields(input, ['responseObject', 'reason', 'summary', 'observedEffectReviewId', 'actionId', 'limitations'], 'Object closure');
         result = updateCase(cases, current.id, { closure: input }, now);
         const closure = result.record.closures.records.find(candidate => !current.closures.records.some(prior => prior.id === candidate.id));
         if (!closure)
-            throw new CliUsageError('No new closure was retained within the Case bounds; nothing was written.');
+            throw new CliUsageError('No new closure was retained within the case bounds; nothing was written.');
         for (const [key, value] of Object.entries(input))
             if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(closure[key])) {
                 throw new CliUsageError(`Closure field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
@@ -191,7 +191,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname', 'responseObject', 'objectOutcome'], 'Recheck');
         const recheck = readCaseRecheckAnswerContext(input.recheck);
         if (input.state === 'not_reproduced' && !recheck) {
-            throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned Case or record unavailable for a limited observation.');
+            throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned case or record unavailable for a limited observation.');
         }
         const summary = prose(input.comparisonSummary, MAX_RESPONSE_VALUE_LENGTH, 'Comparison summary');
         result = recordCaseRecheckOutcome(cases, current.id, {
@@ -214,12 +214,12 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         }
     }
     else
-        throw new CliUsageError('Select a supported Case mutation.');
+        throw new CliUsageError('Select a supported case mutation.');
     retainExistingEntries(current, result.record);
     return result.cases;
 }
 function formatCases(cases, digest) {
-    const lines = ['Local Case review', `File digest  ${digest}`, `Cases        ${cases.length}`, ''];
+    const lines = ['Local case review', `File digest  ${digest}`, `Cases        ${cases.length}`, ''];
     for (const record of cases) {
         lines.push(`Case ${safeTerminalValue(record.id)} · ${safeTerminalValue(record.title || record.domain)}`, `Domain       ${safeTerminalValue(record.domain)}`, `Status       ${statusLabel(record.status)}`, `Disposition  ${dispositionLabel(record.disposition)} (analyst assessment)`, `Updated      ${record.updatedAt}`);
         for (const note of record.notes)
@@ -246,16 +246,16 @@ function formatCases(cases, digest) {
             lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`, `  Object: ${review.responseObject ? `${review.responseObject.kind}: ${safeTerminalValue(review.responseObject.identifier)}` : 'unknown binding'}${review.objectOutcome ? ` · observed ${review.objectOutcome}` : ''}`);
         lines.push(`Other retained records: ${record.evidenceHistory.length} snapshots, ${record.actions.length} actions, ${record.assertions.length} assertions, ${record.attachments?.length ?? 0} file references.`, '');
     }
-    lines.push('Use --json for the full Case export. Attached file bytes remain separate. This command makes no request.', '');
+    lines.push('Use --json for the full case export. Attached file bytes remain separate. This command makes no request.', '');
     return lines.join('\n');
 }
 export async function runCaseCommand(args, dependencies, context) {
-    context.setFailureLabel('Local Case operation');
+    context.setFailureLabel('Local case operation');
     try {
         const raw = args.source ? dependencies.caseFileInput ?? await context.readInput(args.source, MAX_EDITABLE_CASE_INPUT_BYTES, 'Case file') : null;
         const digest = raw === null ? null : `sha256:${createHash('sha256').update(raw).digest('hex')}`;
         if (args.expectedFileDigest && args.expectedFileDigest !== digest)
-            throw new CliUsageError('The Case file differs from the reviewed file digest. Nothing was written.');
+            throw new CliUsageError('The case file differs from the reviewed file digest. Nothing was written.');
         const cases = raw === null ? [] : readEditableCaseExport(raw);
         const now = normalizeExplicitIsoTimestamp(context.now());
         if (!now)
@@ -271,7 +271,7 @@ export async function runCaseCommand(args, dependencies, context) {
         const note = args.noteSource ? await context.readInput(args.noteSource, MAX_NOTE_LENGTH * 4 + 4, 'Case note') : args.text;
         const next = applyCliCaseOperation(cases, args, input, note, now);
         if (Buffer.byteLength(serializeCaseStore(next)) > MAX_CASE_STORE_BYTES)
-            throw new CliUsageError('The updated Case store exceeds its byte budget. No evidence was pruned and nothing was written.');
+            throw new CliUsageError('The updated case store exceeds its byte budget. No evidence was pruned and nothing was written.');
         const output = `${JSON.stringify(buildCaseExport(next, now))}\n`;
         // Apply the same strict admission to our output before atomic publication.
         readEditableCaseExport(output);
@@ -283,6 +283,6 @@ export async function runCaseCommand(args, dependencies, context) {
         dependencies.signal?.throwIfAborted();
         if (cause instanceof CliUsageError)
             throw cause;
-        throw new CliUsageError(cause instanceof Error ? cause.message : 'The Case operation could not be completed.');
+        throw new CliUsageError(cause instanceof Error ? cause.message : 'The case operation could not be completed.');
     }
 }

package/cli/case-pack.mjs

@@ -5,7 +5,7 @@ import { buildCaseReport, buildCaseReportVerificationProjection } from "../packa
 import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
 import { assertBoundedJsonStructure, scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { assertCaseBrandProfileIds } from "../packages/cases/case-brand-profile-references.mjs";
-import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, } from "../packages/cases/case-record-projection.mjs";
+import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, assertCaseCollectionReceiptAudience, } from "../packages/cases/case-record-projection.mjs";
 import { normalizeDomain } from "../packages/evidence/domain-name.mjs";
 import { normalizeCaseStore } from "../packages/cases/case-migration-model.mjs";
 import { safeId } from "../packages/cases/case-record-core.mjs";
@@ -83,6 +83,11 @@ function allowedSensitiveFieldPath(key, path) {
         return listItemPath(path, 'actions');
     if (key === 'packetReceipt')
         return typeof path.at(-1) === 'number' && path.at(-2) === 'history' && listItemPath(path.slice(0, -2), 'actions');
+    if (key === 'checkpointCollectionReceipts')
+        return topCasePath(path);
+    if (key === 'collectionReceipt')
+        return path.length === 4 && path[0] === 'cases' && typeof path[1] === 'number'
+            && (path[2] === 'evidenceHistory' || path[2] === 'checkpointCollectionReceipts') && typeof path[3] === 'number';
     return true;
 }
 /** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */
@@ -390,6 +395,7 @@ export function verifyCliCasePack(input) {
     assertClosedEnvelopes(root, packet, integrity, redactionManifest, packet.reports, root.version);
     assertSensitiveFieldPlacement(root, serialized.length);
     const audience = packet.audience;
+    assertCaseCollectionReceiptAudience(root, audience);
     if (!Number.isSafeInteger(redactionManifest.sourceCaseCount)
         || redactionManifest.sourceCaseCount !== root.cases.length
         || !stringListsMatch(redactionManifest.excluded, caseAudienceExclusions(audience, root.version))) {

package/cli/ci-report.mjs

@@ -1,5 +1,7 @@
 import { WHOISLEUTH_REQUEST_POLICY_URL } from "../packages/analysis/project-metadata.mjs";
 import { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA } from "../packages/contracts/domain-control-monitor.mjs";
+import { lookupDiagnosticEntries } from "../lib/lookup-progress.mjs";
+import { lookupStrictExitFindings } from "./strict-exit.mjs";
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -9,13 +11,23 @@ function xml(value) {
 function junitCases(document) {
     const schema = String(document.schema || '');
     if (schema === 'whoisleuth.cli.lookup') {
-        const diagnostics = record(document.diagnostics);
-        const cases = Object.entries(diagnostics).slice(0, 64).map(([source, value]) => {
-            const state = String(record(value).status ?? record(value).state ?? 'unavailable').toLowerCase();
-            return ['error', 'failed', 'partial', 'rate_limited', 'timeout', 'unavailable'].includes(state)
-                ? { name: `source ${source}`, failure: `Source state: ${state}` }
+        const sources = lookupDiagnosticEntries(document.diagnostics).filter(source => source.present);
+        const findings = lookupStrictExitFindings(document);
+        const cases = sources.map(({ source, path, state }) => {
+            const failure = findings.find(finding => finding.path === path);
+            return failure || state === null
+                ? { name: `source ${source}`, failure: `Source state: ${failure?.state ?? 'unavailable'}` }
                 : { name: `source ${source}` };
         });
+        // Retain nested and historical failure coverage without echoing imported
+        // object keys, endpoints or evidence into CI names or messages.
+        const namedPaths = new Set(sources.map(source => source.path));
+        const additional = findings.filter(finding => !namedPaths.has(finding.path));
+        if (additional.length)
+            cases.push({
+                name: 'additional source diagnostics',
+                failure: `Source states: ${[...new Set(additional.map(finding => finding.state))].sort().join(', ')}`,
+            });
         return cases.length ? cases : [{ name: 'lookup diagnostics', failure: 'No source diagnostics were available.' }];
     }
     if (schema === 'whoisleuth.cli.bulk') {

package/cli/command-definition.mjs

@@ -126,7 +126,7 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--config': file('Load explicit versioned CLI configuration from this file.'),
     '--profile': text('Select a named profile from the supplied configuration.', true),
     '--palette': enumeration('Choose the terminal colour palette; redirected output and no-colour settings still take precedence.', ['auto', 'light', 'dark']),
-    '--network': flag('Include the optional public DNS and port 43 runtime checks.'),
+    '--network': flag('Include the optional public DNS, HTTPS and WHOIS (port 43) runtime checks.'),
     '--json': flag('Write structured JSON to stdout or the selected output file.'),
     '--reported-action': optionDefinition('enum', 'Record an analyst-reported identity action; repeat for separate actions.', { values: IDENTITY_ACTIONS.map(action => action.id), occurrence: 'repeatable' }),
     '--trusted-auth-header': optionDefinition('text', 'Select a recognised receiver header by part:header-index. This records analyst trust, not independent authentication; repeat for separate headers.', { occurrence: 'repeatable' }),
@@ -235,10 +235,10 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--left-session': text('Select the left-hand retained capture session.', true),
     '--right-session': text('Select the right-hand retained capture session.', true),
     '--compact': flag('Write a compact report presentation.'),
-    '--case-id': text('Select the retained Case identifier.'),
-    '--domain': text('Supply the Case domain.'),
-    '--title': text('Supply the Case title.'),
-    '--new-incident': flag('Create a separate incident instead of updating a matching Case.'),
+    '--case-id': text('Select the retained case identifier.'),
+    '--domain': text('Supply the case domain.'),
+    '--title': text('Supply the case title.'),
+    '--new-incident': flag('Create a separate incident instead of updating a matching case.'),
     '--text': text('Supply the note text directly.'),
     '--note-file': file('Read note text from a selected local file.'),
     '--input': file('Read the selected local input file.'),

package/cli/doctor.mjs

@@ -1,12 +1,14 @@
 import { withTimeout } from "../lib/abort.mjs";
-export const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
-export const DOCTOR_VERSION = 1;
+import { CLI_COMMAND_REGISTRY } from "./command-reference.mjs";
+import { DOCTOR_SCHEMA, DOCTOR_VERSION, DOCTOR_SUMMARY_SCHEMA, DOCTOR_SUMMARY_VERSION } from "../packages/contracts/cli-doctor.mjs";
+export { DOCTOR_SCHEMA, DOCTOR_VERSION, DOCTOR_SUMMARY_SCHEMA, DOCTOR_SUMMARY_VERSION };
 const MINIMUM_NODE_MAJOR = 24;
 const NETWORK_HOST = 'whois.iana.org';
 const NETWORK_QUERY = 'example.com';
 const NETWORK_HTTPS_URL = 'https://data.iana.org/rdap/dns.json';
 const NETWORK_TIMEOUT_MS = 6_000;
 const MAX_DOCTOR_DETAIL_LENGTH = 180;
+const DOCTOR_CHECK_IDS = ['runtime', 'platform', 'terminal', 'offline_features', 'network', 'public_dns', 'https_transport', 'whois_transport'];
 function boundedDetail(value, fallback) {
     return String(value || fallback)
         .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
@@ -162,6 +164,38 @@ async function buildDoctorReport(options) {
         checks: Object.freeze(checks),
     });
 }
+function diagnosticVersion(value) {
+    return /^(\d{1,6}\.\d{1,6}\.\d{1,6})(?:[-+].*)?$/u.exec(value)?.[1] ?? null;
+}
+function buildDoctorSummary(report, nodeVersion = process.versions.node) {
+    const checkCodes = DOCTOR_CHECK_IDS.flatMap(id => {
+        const check = report.checks.find(item => item.id === id);
+        if (!check)
+            return [];
+        const state = check.state === 'pass' || check.state === 'partial' || check.state === 'skipped' ? check.state : 'unknown';
+        return [`${id}_${state}`];
+    });
+    const omittedCheckCount = report.checks.length - checkCodes.length;
+    return Object.freeze({
+        schema: DOCTOR_SUMMARY_SCHEMA,
+        version: DOCTOR_SUMMARY_VERSION,
+        cliVersion: diagnosticVersion(report.cliVersion),
+        nodeVersion: diagnosticVersion(nodeVersion),
+        state: report.state === 'pass' && omittedCheckCount === 0 ? 'pass' : 'partial',
+        networkRequested: report.networkRequested === true,
+        checkCodes: Object.freeze(checkCodes),
+        omittedCheckCount,
+        declaredFormatIdentifiers: Object.freeze([...new Set(CLI_COMMAND_REGISTRY.flatMap(command => command.documentation.supportedSchemaIdentifiers))].sort()),
+        formatScope: 'Public command declarations only; not an installed-package or input-compatibility test.',
+        omissions: Object.freeze([
+            'Targets, URLs, queries and fragments',
+            'File paths, folder names and user names',
+            'Launch tokens, cookies, credentials and headers',
+            'Input files, response content and free-form diagnostic details',
+            'Timestamps, platform details and version prerelease/build metadata',
+        ]),
+    });
+}
 function formatDoctorReport(report) {
     const lines = [
         'Runtime:',
@@ -175,4 +209,4 @@ function formatDoctorReport(report) {
     }
     return `${lines.join('\n')}\n`;
 }
-export { buildDoctorReport, formatDoctorReport, };
+export { buildDoctorReport, buildDoctorSummary, formatDoctorReport, };

package/cli/formatters/html.mjs

@@ -40,6 +40,7 @@ function formatLookupEvidenceHtml(document, options = {}) {
   <style>
     :root{color-scheme:dark;--bg:#07110d;--panel:#0d1b15;--panel2:#10241b;--line:#254837;--text:#d8f5e4;--muted:#91b7a0;--accent:#6dff9d;--shadow:rgba(0,0,0,.28)}
     *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font:15px/1.55 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:min(1120px,calc(100% - 32px));margin:0 auto;padding:42px 0 64px}header{border:1px solid var(--line);background:linear-gradient(145deg,var(--panel2),var(--panel));padding:28px;box-shadow:0 18px 50px var(--shadow)}h1,h2,h3{line-height:1.2;margin:0;color:var(--accent)}h1{font-size:clamp(1.5rem,4vw,2.35rem);overflow-wrap:anywhere}h2{font-size:1.22rem;margin-bottom:16px}h3{font-size:1rem;margin-bottom:12px}.eyebrow{margin:0 0 10px;color:var(--muted);letter-spacing:.12em;text-transform:uppercase}.notice{margin:18px 0 0;color:var(--muted);max-width:85ch}.block{margin-top:24px;border:1px solid var(--line);background:var(--panel);padding:22px}.fields{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 24px;margin:0}.fields div{display:grid;grid-template-columns:minmax(130px,.8fr) minmax(0,1.6fr);gap:12px;border-top:1px solid var(--line);padding:9px 0}.fields div:first-child,.fields div:nth-child(2){border-top:0}.fields dt{color:var(--muted)}.fields dd{margin:0;overflow-wrap:anywhere}.card-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,320px),1fr));gap:16px}.card{border:1px solid var(--line);background:var(--panel2);padding:18px}.card .fields{display:block}.card .fields div{grid-template-columns:minmax(120px,.8fr) minmax(0,1.4fr)}.card .fields div:nth-child(2){border-top:1px solid var(--line)}.table-scroll{overflow-x:auto}table{width:100%;border-collapse:collapse;min-width:720px}caption{text-align:left;color:var(--muted);padding:0 0 10px}th,td{border:1px solid var(--line);padding:9px 10px;text-align:left;vertical-align:top;overflow-wrap:anywhere}thead th{background:var(--panel2);color:var(--accent)}tbody th{color:var(--text)}.status{white-space:nowrap;color:var(--accent)}.empty,.omission{color:var(--muted)}ul{margin:0;padding-left:22px}li+li{margin-top:8px}footer{margin-top:24px;color:var(--muted);font-size:.88rem;text-align:center}
+    footer{overflow-wrap:anywhere}
     @media(max-width:700px){main{width:min(100% - 20px,1120px);padding-top:16px}header,.block{padding:17px}.fields{display:block}.fields div,.card .fields div{grid-template-columns:1fr;gap:2px}.fields div:nth-child(2){border-top:1px solid var(--line)}}
     @media print{:root{color-scheme:light;--bg:#fff;--panel:#fff;--panel2:#f5f7f5;--line:#b9c5bd;--text:#17231b;--muted:#46564b;--accent:#155c2f;--shadow:transparent}body{font:10pt/1.42 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:100%;padding:0}header,.block,.card{box-shadow:none;break-inside:avoid}.block{margin-top:12px}}
   </style>
@@ -55,6 +56,8 @@ function formatLookupEvidenceHtml(document, options = {}) {
   <section class="block"><h2>Query</h2>${renderFields(report.query)}</section>
   <section class="block"><h2>Assessment</h2>${renderFields(report.assessment)}</section>
   <section class="block"><h2>Registry sources</h2>${renderGroups(report.registryGroups)}</section>
+  ${report.registrarStanding.length ? `<section class="block"><h2>Registrar standing</h2>${renderFields(report.registrarStanding)}</section>` : ''}
+  ${report.registryInterpretation.length ? `<section class="block"><h2>Registry interpretation</h2>${renderFields(report.registryInterpretation)}</section>` : ''}
   <section class="block"><h2>Registry-source comparison</h2>${renderFields(report.comparison.health)}${renderComparison(report.comparison)}</section>
   ${report.registrarComparison.fields.length ? `<section class="block"><h2>Registry / registrar RDAP comparison</h2>${renderFields(report.registrarComparison.health)}${renderRegistrarComparison(report.registrarComparison)}</section>` : ''}
   <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>

package/cli/formatters/json.mjs

@@ -69,7 +69,14 @@ function versionedResult(result, schema, version, generatedAt, requestedField, r
     return { ...result, schema, version, generatedAt, [requestedField]: requestedValue };
 }
 function buildCliPostureDocument(requestedDomain, report, generatedAt = new Date().toISOString()) {
-    return versionedResult(report, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);
+    const checks = report.checks;
+    const retained = Array.isArray(checks) ? { ...report, checks: checks.map(check => {
+            if (!check || typeof check !== 'object' || Array.isArray(check))
+                return check;
+            const { dmarcPolicyContext: _transient, ...fields } = check;
+            return fields;
+        }) } : report;
+    return versionedResult(retained, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);
 }
 function buildCliHttpDocument(requestedDomain, result, generatedAt = new Date().toISOString()) {
     return versionedResult(result, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);

package/cli/formatters/terminal-lookup.mjs

@@ -1,5 +1,7 @@
 import { registryAccessProfileLabel } from "../registry-access.mjs";
+import { isSupportedRegistryInsightsVersion } from "../../packages/contracts/registry-insights.mjs";
 import { dnsAddressFamilyEvidence } from "../../packages/evidence/dns-query-outcome.mjs";
+import { lookupCollectionReceiptReview } from "../../packages/evidence/lookup-collection-review.mjs";
 import { appendTechnologyLines } from "./terminal-technology.mjs";
 import { appendDeliveryMetadataLines, appendPublicationMetadataLines } from "./terminal-metadata.mjs";
 import { securityPostureReview, summarizeSecurityPostureReview } from "../../lib/website-security-posture.mjs";
@@ -252,6 +254,14 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         `RDAP           ${titleCase(rdapDiagnostics.status)}`,
         `WHOIS          ${titleCase(whoisDiagnostics.status)}`,
     ];
+    if (detail !== 'summary') {
+        for (const [source, status] of [['rdap', rdapDiagnostics.status], ['whois', whoisDiagnostics.status]]) {
+            const sourceDetail = terminalRecord(document[source]).detail;
+            if (['unsupported', 'skipped', 'disabled'].includes(String(status)) && typeof sourceDetail === 'string' && sourceDetail) {
+                registrationLines.push(`${source.toUpperCase()} detail    ${boundedTerminalComponent(sourceDetail, 300)}`);
+            }
+        }
+    }
     if (detail !== 'summary' && rdapDiagnostics.endpoint) {
         registrationLines.splice(1, 0, `RDAP source    ${safeTerminalValue(rdapDiagnostics.endpoint)}`);
     }
@@ -267,7 +277,7 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         appendNetworkRegistrationLines(registrationLines, terminalRecord(rdap.parsed), document.type, detail);
     }
     const registryInsights = terminalRecord(document.registryInsights);
-    if (detail !== 'summary' && registryInsights.version === 1) {
+    if (detail !== 'summary' && isSupportedRegistryInsightsVersion(registryInsights.version)) {
         const lifecycle = terminalRecord(registryInsights.lifecycle);
         const disclosure = terminalRecord(registryInsights.contactDisclosure);
         const registryDisclosure = terminalRecord(disclosure.registryRdap);
@@ -712,6 +722,19 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
     const collectionLines = [];
     if (detail === 'verbose') {
         collectionLines.push(`Generated      ${safeTerminalValue(document.generatedAt, 'unknown')}`);
+        const receipt = lookupCollectionReceiptReview(document.collectionReceipt);
+        if (receipt) {
+            collectionLines.push(`Original plan  ${receipt.selection}`);
+            for (const choice of receipt.choices)
+                collectionLines.push(`${choice.label}: ${choice.selected ? 'selected' : 'not selected'}`);
+            for (const source of receipt.sources) {
+                collectionLines.push(`${source.label}: ${source.summary}; ${source.outcome}`);
+                collectionLines.push(`  ${source.explanation}`);
+            }
+            collectionLines.push('Collector start is local execution provenance, not proof of network delivery or complete evidence.');
+        }
+        else
+            collectionLines.push('Original plan  Not retained; original optional choices and collector starts are unknown.');
         const timing = terminalRecord(document.timing);
         if (Number(timing.totalMs) >= 0)
             collectionLines.push(`Total time     ${safeTerminalValue(timing.totalMs)} ms`);

package/cli/history-command-definitions.mjs

@@ -65,7 +65,7 @@ export const HISTORY_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Convert one saved lookup into a versioned evidence report.',
             example: 'whoisleuth export lookup.json --markdown',
-            boundary: `Saved Lookup versions 1 and 2 are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
+            boundary: `Supported saved Lookups are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
         },
         collection: { scope: 'Reads one saved Lookup and writes one bounded report.' },
         summary: 'Convert a lookup to an evidence report',

package/cli/investigation-plan.mjs

@@ -75,6 +75,7 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
             `${recipe.id} — ${recipe.label}`,
             `  Subject: ${recipe.subjectRequirement.replaceAll('_', ' ')}`,
             `  Workflow run: ${recipe.runnableByWorkflowRun ? 'supported' : 'plan and explanation only'}`,
+            ...formatWorkflowEffort(recipe.id, recipe.steps).map((line) => `  ${line}`),
             `  ${recipe.objective}`,
             ...recipe.steps.map((item, index) => `  ${index + 1}. ${item.label} [${item.mode}; ${item.approval.replaceAll('_', ' ')}]`),
             ...recipe.limitations.map((item) => `  Limitation: ${item}`),
@@ -84,6 +85,19 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
         '',
     ].join('\n');
 }
+function formatWorkflowEffort(recipeId, steps) {
+    const counts = { network: 0, offline: 0 };
+    for (const step of steps)
+        counts[step.mode] += 1;
+    const reuse = workflowStandardInputs(recipeId).length;
+    return [
+        `Work planned: ${counts.network} networked step${counts.network === 1 ? '' : 's'}; ${counts.offline} offline step${counts.offline === 1 ? '' : 's'}.`,
+        reuse
+            ? `Evidence reuse: ${reuse} link${reuse === 1 ? '' : 's'} from earlier outputs to later steps.`
+            : 'Evidence reuse: no earlier-output links are declared.',
+        'Counts describe steps and reuse links, not requests. Saved files and cache state are not checked.',
+    ];
+}
 function validatedSteps(steps) {
     for (const step of steps) {
         const invocationEffect = cliInvocationNetworkEffect(step.command, step.arguments);
@@ -147,6 +161,7 @@ export function formatInvestigationPlan(plan) {
         `Investigation plan: ${plan.recipe.label}`,
         `Subject  ${plan.subject}`,
         `Mode     ${plan.execution}`,
+        ...formatWorkflowEffort(plan.recipe.id, plan.steps),
         '',
         ...plan.steps.flatMap((item, index) => [
             `${index + 1}. ${item.label}`,

package/cli/lookup-brief.mjs

@@ -214,23 +214,29 @@ export function buildCliLookupBrief(input, generatedAt = new Date().toISOString(
     });
 }
 export function formatCliLookupBrief(document) {
+    const sourceFacts = document.sourceHealth.flatMap((source) => {
+        const facts = document.facts.filter((item) => item.source.id === source.id);
+        return [
+            `  ${safeTerminalValue(source.label)} [${safeTerminalValue(source.state)}; ${source.observedAt ? `observed ${safeTerminalValue(source.observedAt)}` : 'source time not recorded'}]`,
+            ...(facts.length
+                ? facts.map((item) => `    ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)}`)
+                : ['    No fact selected for this brief.']),
+        ];
+    });
     return [
         `Lookup brief: ${safeTerminalValue(document.target)}`,
         `Observed  ${safeTerminalValue(document.observedAt)}`,
         `Mode      ${safeTerminalValue(document.mode)}`,
         '',
         'Source-attributed facts',
-        ...(document.facts.length ? document.facts.map((item) => `  ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)} (${safeTerminalValue(item.source.label)}; ${safeTerminalValue(item.source.state)}; ${item.source.observedAt ? `observed ${safeTerminalValue(item.source.observedAt)}` : 'source time not recorded'})`) : ['  No bounded fact was available.']),
+        ...sourceFacts,
         '',
         'Contradictions',
         ...(document.contradictions.length ? document.contradictions.flatMap((item) => [
             `  ${safeTerminalValue(item.field)}: ${safeTerminalValue(item.detail)}`,
-            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (${safeTerminalValue(observation.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
+            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (value state: ${safeTerminalValue(observation.state)}; source state: ${safeTerminalValue(observation.source.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
         ]) : ['  No conflicting publication field was retained.']),
         '',
-        'Unknown or incomplete',
-        ...(document.unknowns.length ? document.unknowns.map((item) => `  ${safeTerminalValue(item)}`) : ['  No incomplete source state was identified.']),
-        '',
         'Recommended manual actions',
         ...document.actionPlan.flatMap((item, index) => [
             `  ${index + 1}. ${safeTerminalValue(item.action)}`,

package/cli/lookup-command-runner.mjs

@@ -67,25 +67,32 @@ async function runLookupCommand(args, dependencies, context) {
         return EXIT_CODES.SUCCESS;
     }
     let documentGeneratedAt = '';
-    const buildDocument = (result) => {
+    const buildDocument = ({ result, collectionReceipt }) => {
         documentGeneratedAt = context.now();
         return buildCliLookupDocument(query, classified, result, documentGeneratedAt, args.deep ? 'deep' : 'fast', {
+            collectionReceipt,
             ...(args.observerLabel ? { observerLabel: args.observerLabel } : {}),
             ...(args.vantageLabel ? { vantageLabel: args.vantageLabel } : {}),
         });
     };
-    const collect = (signal, onSourceSettled) => abortable(() => executeLookup(classified, {
-        fast: !args.deep,
-        compact: false,
-        ...(signal ? { signal } : {}),
-        ...(args.deep ? {
-            ...(selectedUrl ? { selectedUrl } : {}),
-            onSourceSettled: settlement => {
-                onSourceSettled(settlement);
-                eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
-            },
-        } : {}),
-    }), signal);
+    const collect = (signal, onSourceSettled) => abortable(async () => {
+        let collectionReceipt;
+        const result = await executeLookup(classified, {
+            fast: !args.deep,
+            compact: false,
+            onCollectionReceipt: value => { collectionReceipt = value; },
+            ...(signal ? { signal } : {}),
+            ...(args.deep ? {
+                ...(selectedUrl ? { selectedUrl } : {}),
+                onSourceSettled: settlement => {
+                    onSourceSettled(settlement);
+                    eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
+                },
+            } : {}),
+        });
+        signal?.throwIfAborted();
+        return { result, collectionReceipt };
+    }, signal);
     let document;
     if (args.browse === true) {
         const browse = dependencies.browseLookupOperation || browseLookupOperation;