@slicedearth/whoisleuth-cli 2.6.0 → 2.8.0

package/cli/artifact-validation/lookup-evidence.mjs

@@ -1,11 +1,12 @@
 import { isDeepStrictEqual } from 'node:util';
-import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
+import { assertLookupEvidencePrivacySafeTree, assertLookupEvidencePortableTree, LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, lookupEvidenceRegistryInsightsVersion, HOSTNAME_SCOPED_LOOKUP_EVIDENCE_SCHEMA_VERSION, PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION, REGISTRAR_STANDING_LOOKUP_EVIDENCE_SCHEMA_VERSION, V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION, projectLookupEvidenceAvailability, projectLookupEvidenceAvailabilityPublic, projectLookupEvidenceQuery, projectLookupEvidenceRdapPublication, projectLookupEvidenceRegistryInsights, projectLookupEvidenceWhoisPublication, SUPPORTED_LOOKUP_EVIDENCE_SCHEMA_VERSIONS, } from "../../lib/evidence-export.mjs";
 import { validLookupObservationScope } from "../../packages/evidence/lookup-target.mjs";
 import { externalPasswordFormObservation } from "../../packages/evidence/credential-form-attribution.mjs";
 import { credentialSurfaceContractState } from "../../lib/lookup-child-profile-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../../lib/registrar-standing-contract.mjs";
 import { compareRegistrySources } from "../../lib/registry-comparison.mjs";
 import { buildRegistryInsights } from "../../lib/registry-insights.mjs";
+import { resolveRdapCapabilityCatalogRevision } from "../../lib/rdap-capabilities.mjs";
 import { WHOISLEUTH_SOURCE_REPOSITORY_URL } from "../../packages/analysis/project-metadata.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../../lib/homepage-metadata-contract.mjs";
 import { HEX_DIGEST_RE, SEMANTIC_VERSION_RE, absoluteUrl, array, boolean, domain, enumeration, exact, exactOptional, fail, integer, iso, nullableRecord, optionalText, record, strings, text, } from "./structure-primitives.mjs";
@@ -344,7 +345,7 @@ function validateLookupEvidenceWhois(value, version) {
     optionalText(complete.conflictingHop, 'Lookup evidence WHOIS conflicting hop', 253);
     nullableRecord(complete.parsed, 'Lookup evidence WHOIS parsed data');
     if (version >= PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION
-        && !isDeepStrictEqual(complete.parsed, projectLookupEvidenceWhoisPublication(complete.parsed))) {
+        && !isDeepStrictEqual(complete.parsed, projectLookupEvidenceWhoisPublication(complete.parsed, version))) {
         fail('Lookup evidence WHOIS portable publication');
     }
     array(complete.chain, 'Lookup evidence WHOIS chain', 16).forEach((item, index) => {
@@ -715,6 +716,15 @@ export function validateLookupEvidenceArtifactStructure(value) {
         });
         if (!isDeepStrictEqual(registryComparison, expectedComparison))
             fail('Lookup evidence registry comparison derivation');
+        const capabilities = record(registryInsights.rdapCapabilities, 'Lookup evidence RDAP capabilities');
+        const registryCapabilities = record(capabilities.registry, 'Lookup evidence registry RDAP capabilities');
+        const registrarCapabilities = record(capabilities.registrar, 'Lookup evidence registrar RDAP capabilities');
+        const catalogReviewedAt = registryCapabilities.catalogReviewedAt;
+        if (typeof catalogReviewedAt !== 'string'
+            || resolveRdapCapabilityCatalogRevision(catalogReviewedAt) === null
+            || registrarCapabilities.catalogReviewedAt !== catalogReviewedAt) {
+            fail('Lookup evidence RDAP capability catalogue revision');
+        }
         const rebuiltInsights = buildRegistryInsights({
             rdapParsed,
             rdapStatus: rdapDiagnosticStatus,
@@ -722,6 +732,9 @@ export function validateLookupEvidenceArtifactStructure(value) {
             whoisParsed,
             whoisStatus: whoisDiagnosticStatus,
             whoisQueriedAt: whois.queriedAt,
+        }, {
+            rdapCapabilityCatalogReviewedAt: catalogReviewedAt,
+            version: lookupEvidenceRegistryInsightsVersion(version),
         });
         const expectedInsights = version >= PRIVACY_MINIMIZED_LOOKUP_EVIDENCE_SCHEMA_VERSION
             ? projectLookupEvidenceRegistryInsights(rebuiltInsights)

package/cli/artifact-verify.mjs

@@ -1,5 +1,5 @@
 import { Buffer } from 'node:buffer';
-import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION } from "../packages/contracts/analyst-interchange.mjs";
+import { MANAGED_INDICATOR_SET_SCHEMA, MANAGED_INDICATOR_SET_VERSION, MAX_MANAGED_INDICATOR_SET_BYTES } from "../packages/contracts/analyst-interchange.mjs";
 import { createHash } from 'node:crypto';
 import { readEditableCaseExport } from "../packages/cases/case-export-input.mjs";
 import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "./bounded-json.mjs";
@@ -532,6 +532,34 @@ export async function verifyOfflineArtifact(raw, options = {}) {
         : null;
     return Object.freeze({ ...report, manifestIdentity });
 }
+function offlineArtifactNextSteps(report) {
+    switch (report.artifact.kind) {
+        case 'saved_lookup':
+            return ['Review retained source states without displaying target values:', '  whoisleuth source-report -- ./lookup.json'];
+        case 'case_export':
+            return ['Read the Case records, including private analyst content:', '  whoisleuth case show -- ./cases.json'];
+        case 'workspace_archive':
+            return ['Inspect section metadata without restoring the archive:', '  whoisleuth inspect-archive -- ./workspace.json'];
+        case 'encrypted_workspace_archive':
+            return report.checks.authenticatedEncryption === 'verified'
+                ? ['Inspect decrypted section metadata without restoring the archive:', '  whoisleuth inspect-archive --passphrase-file ./passphrase.txt -- ./workspace.encrypted.json']
+                : ['Check the encrypted contents using a separate passphrase file:', '  whoisleuth verify-artifact --passphrase-file ./passphrase.txt -- ./workspace.encrypted.json'];
+        case 'lookup_evidence':
+            return ['Review which fields this portable format preserves and omits:', '  whoisleuth interchange-report -- ./evidence.json'];
+        case 'cli_case_pack':
+            return ['Review the Case-pack compatibility and field exclusions:', '  whoisleuth interchange-report -- ./case-pack.json'];
+        case 'signed_review_artifact':
+            if (report.artifact.schema === DOMAIN_CONTROL_MANIFEST_SCHEMA || report.artifact.schema === LOOKUP_CLAIM_PASSPORT_SCHEMA) {
+                return ['Review the passport compatibility and retained field groups:', '  whoisleuth interchange-report -- ./passport.json'];
+            }
+            return report.artifact.schema === MANAGED_INDICATOR_SET_SCHEMA
+                && report.summary.inputBytes <= MAX_MANAGED_INDICATOR_SET_BYTES
+                ? ['Read the retained indicator identities and review windows:', '  whoisleuth indicator-set inspect -- ./indicators.json']
+                : [];
+        default:
+            return [];
+    }
+}
 export function formatOfflineArtifactVerification(report) {
     const lines = [
         'WHOISleuth offline artefact verification',
@@ -611,5 +639,8 @@ export function formatOfflineArtifactVerification(report) {
     }
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);
+    const nextSteps = offlineArtifactNextSteps(report);
+    if (nextSteps.length)
+        lines.push('', 'Offline next steps (examples; replace filenames; nothing runs automatically):', ...nextSteps);
     return `${lines.join('\n')}\n`;
 }

package/cli/bulk-command-runner.mjs

@@ -8,7 +8,8 @@ import EXIT_CODES from "./exit-codes.mjs";
 import { buildCliBulkDocument, formatJsonDocument, formatJsonLines } from "./formatters/json.mjs";
 import { formatTerminalBulk } from "./formatters/terminal.mjs";
 import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { evaluateCliFailPolicies, reportCliFailPolicies } from "./fail-policy.mjs";
+import { readCliRiskProfile } from "./risk-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 async function runBulkCommand(args, dependencies, context) {
@@ -39,6 +40,7 @@ async function runBulkCommand(args, dependencies, context) {
         context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
         return EXIT_CODES.SUCCESS;
     }
+    const riskProfile = await readCliRiskProfile(args.brandProfileSource, context.readInput, args.brandProfileId);
     const classify = dependencies.classifyQuery || classifyQuery;
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
     const checkpoint = args.checkpoint
@@ -106,6 +108,7 @@ async function runBulkCommand(args, dependencies, context) {
         collectedTotal: items.length,
         filter: args.filter,
     };
+    const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || [], riskProfile);
     const selectedItems = selectBulkItems(items, args.filter);
     const selectedDocument = buildCliBulkDocument(selectedItems, metadata);
     if (!args.quiet) {
@@ -126,9 +129,7 @@ async function runBulkCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalBulk(selectedItems, metadata), args.color));
     }
-    const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
-    if (policyFindings.length && !eventProgress.enabled)
-        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    reportCliFailPolicies(policyFindings, context.writeStderr, eventProgress);
     const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;

package/cli/case-command.mjs

@@ -29,12 +29,12 @@ function prose(input, maximum, label) {
 function selection(cases, args, required) {
     const domain = args.domain === null ? null : normalizeDomain(args.domain);
     if (args.domain !== null && !domain)
-        throw new CliUsageError('Select a valid Case domain.');
+        throw new CliUsageError('Select a valid case domain.');
     const selected = cases.filter(record => (!args.caseId || record.id === args.caseId) && (!domain || record.domain === domain));
     if ((args.caseId || domain || required) && selected.length === 0)
-        throw new CliUsageError('The selected Case is not present in this file.');
+        throw new CliUsageError('The selected case is not present in this file.');
     if (required && selected.length !== 1)
-        throw new CliUsageError('Select exactly one Case with --case-id; no arbitrary Case was chosen.');
+        throw new CliUsageError('Select exactly one case with --case-id; no arbitrary case was chosen.');
     return selected;
 }
 function pin(input, now) {
@@ -42,7 +42,7 @@ function pin(input, now) {
         throw new CliUsageError('An evidence pin must be a JSON object.');
     const raw = input;
     if (Object.hasOwn(raw, 'id') || Object.hasOwn(raw, 'createdAt'))
-        throw new CliUsageError('New pin identity and creation time are allocated by the Case operation.');
+        throw new CliUsageError('New pin identity and creation time are allocated by the case operation.');
     const normal = appendCaseEvidencePin([], raw, now)[0];
     // Validate the supplied subset against the domain result, without duplicating
     // its field inventory or accepting silent truncation/default substitution.
@@ -86,7 +86,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
             ? createCaseIncident(cases, { domain: args.domain, title }, now)
             : openOrCreateCase(cases, { domain: args.domain, ...(title ? { title } : {}) }, now, args.caseId ? { caseId: args.caseId } : {});
         if (!result.created && title && title !== result.record.title)
-            throw new CliUsageError('The selected Case already exists with another title. Use --new-incident for a separate investigation.');
+            throw new CliUsageError('The selected case already exists with another title. Use --new-incident for a separate investigation.');
         return result.cases;
     }
     const current = selection(cases, args, true)[0];
@@ -113,7 +113,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         result = updateCase(cases, current.id, { action: input }, now);
         const action = result.record.actions.find(candidate => !current.actions.some(prior => prior.id === candidate.id));
         if (!action)
-            throw new CliUsageError('No new action was retained within the Case bounds; nothing was written.');
+            throw new CliUsageError('No new action was retained within the case bounds; nothing was written.');
         for (const [key, value] of Object.entries(input))
             if (canonicalArtifactJsonV2(key === 'responseObjects' ? readCaseResponseObjects(value) : value) !== canonicalArtifactJsonV2(action[key])) {
                 throw new CliUsageError(`Action field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
@@ -142,7 +142,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         result = updateCase(cases, current.id, { assertion: { ...input, kind: 'next_step' } }, now);
         const question = result.record.assertions.find(candidate => !current.assertions.some(prior => prior.id === candidate.id));
         if (!question)
-            throw new CliUsageError('No new question was retained within the Case bounds; nothing was written.');
+            throw new CliUsageError('No new question was retained within the case bounds; nothing was written.');
         for (const [key, value] of Object.entries(input))
             if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(question[key])) {
                 throw new CliUsageError(`Question field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
@@ -150,12 +150,12 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
     }
     else if (args.operation === 'close-object') {
         if (!input?.responseObject)
-            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole Case.');
+            throw new CliUsageError('Object closure requires one explicit responseObject; it cannot close the whole case.');
         fields(input, ['responseObject', 'reason', 'summary', 'observedEffectReviewId', 'actionId', 'limitations'], 'Object closure');
         result = updateCase(cases, current.id, { closure: input }, now);
         const closure = result.record.closures.records.find(candidate => !current.closures.records.some(prior => prior.id === candidate.id));
         if (!closure)
-            throw new CliUsageError('No new closure was retained within the Case bounds; nothing was written.');
+            throw new CliUsageError('No new closure was retained within the case bounds; nothing was written.');
         for (const [key, value] of Object.entries(input))
             if (canonicalArtifactJsonV2(value) !== canonicalArtifactJsonV2(closure[key])) {
                 throw new CliUsageError(`Closure field ${safeTerminalValue(key)} is not canonical; nothing was written.`);
@@ -191,7 +191,7 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         fields(input, ['state', 'observedAt', 'completeness', 'comparisonSummary', 'source', 'followUpAt', 'limitations', 'collectionDepth', 'recheck', 'observationHostname', 'responseObject', 'objectOutcome'], 'Recheck');
         const recheck = readCaseRecheckAnswerContext(input.recheck);
         if (input.state === 'not_reproduced' && !recheck) {
-            throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned Case or record unavailable for a limited observation.');
+            throw new CliUsageError('Not reproduced requires a saved recheck question and confirmed comparable conditions. Import the planned case or record unavailable for a limited observation.');
         }
         const summary = prose(input.comparisonSummary, MAX_RESPONSE_VALUE_LENGTH, 'Comparison summary');
         result = recordCaseRecheckOutcome(cases, current.id, {
@@ -214,12 +214,12 @@ export function applyCliCaseOperation(cases, args, input, note, now) {
         }
     }
     else
-        throw new CliUsageError('Select a supported Case mutation.');
+        throw new CliUsageError('Select a supported case mutation.');
     retainExistingEntries(current, result.record);
     return result.cases;
 }
 function formatCases(cases, digest) {
-    const lines = ['Local Case review', `File digest  ${digest}`, `Cases        ${cases.length}`, ''];
+    const lines = ['Local case review', `File digest  ${digest}`, `Cases        ${cases.length}`, ''];
     for (const record of cases) {
         lines.push(`Case ${safeTerminalValue(record.id)} · ${safeTerminalValue(record.title || record.domain)}`, `Domain       ${safeTerminalValue(record.domain)}`, `Status       ${statusLabel(record.status)}`, `Disposition  ${dispositionLabel(record.disposition)} (analyst assessment)`, `Updated      ${record.updatedAt}`);
         for (const note of record.notes)
@@ -246,16 +246,16 @@ function formatCases(cases, digest) {
             lines.push(`Recheck ${safeTerminalValue(review.observedAt, 'time unavailable')} · ${review.state} · ${review.completeness} · ${safeTerminalValue(review.source)}`, `  Object: ${review.responseObject ? `${review.responseObject.kind}: ${safeTerminalValue(review.responseObject.identifier)}` : 'unknown binding'}${review.objectOutcome ? ` · observed ${review.objectOutcome}` : ''}`);
         lines.push(`Other retained records: ${record.evidenceHistory.length} snapshots, ${record.actions.length} actions, ${record.assertions.length} assertions, ${record.attachments?.length ?? 0} file references.`, '');
     }
-    lines.push('Use --json for the full Case export. Attached file bytes remain separate. This command makes no request.', '');
+    lines.push('Use --json for the full case export. Attached file bytes remain separate. This command makes no request.', '');
     return lines.join('\n');
 }
 export async function runCaseCommand(args, dependencies, context) {
-    context.setFailureLabel('Local Case operation');
+    context.setFailureLabel('Local case operation');
     try {
         const raw = args.source ? dependencies.caseFileInput ?? await context.readInput(args.source, MAX_EDITABLE_CASE_INPUT_BYTES, 'Case file') : null;
         const digest = raw === null ? null : `sha256:${createHash('sha256').update(raw).digest('hex')}`;
         if (args.expectedFileDigest && args.expectedFileDigest !== digest)
-            throw new CliUsageError('The Case file differs from the reviewed file digest. Nothing was written.');
+            throw new CliUsageError('The case file differs from the reviewed file digest. Nothing was written.');
         const cases = raw === null ? [] : readEditableCaseExport(raw);
         const now = normalizeExplicitIsoTimestamp(context.now());
         if (!now)
@@ -271,7 +271,7 @@ export async function runCaseCommand(args, dependencies, context) {
         const note = args.noteSource ? await context.readInput(args.noteSource, MAX_NOTE_LENGTH * 4 + 4, 'Case note') : args.text;
         const next = applyCliCaseOperation(cases, args, input, note, now);
         if (Buffer.byteLength(serializeCaseStore(next)) > MAX_CASE_STORE_BYTES)
-            throw new CliUsageError('The updated Case store exceeds its byte budget. No evidence was pruned and nothing was written.');
+            throw new CliUsageError('The updated case store exceeds its byte budget. No evidence was pruned and nothing was written.');
         const output = `${JSON.stringify(buildCaseExport(next, now))}\n`;
         // Apply the same strict admission to our output before atomic publication.
         readEditableCaseExport(output);
@@ -283,6 +283,6 @@ export async function runCaseCommand(args, dependencies, context) {
         dependencies.signal?.throwIfAborted();
         if (cause instanceof CliUsageError)
             throw cause;
-        throw new CliUsageError(cause instanceof Error ? cause.message : 'The Case operation could not be completed.');
+        throw new CliUsageError(cause instanceof Error ? cause.message : 'The case operation could not be completed.');
     }
 }

package/cli/case-pack.mjs

@@ -5,7 +5,7 @@ import { buildCaseReport, buildCaseReportVerificationProjection } from "../packa
 import { WHOISLEUTH_APPLICATION_VERSION } from "../lib/application-version.mjs";
 import { assertBoundedJsonStructure, scanBoundedJson } from "../packages/analysis/bounded-json.mjs";
 import { assertCaseBrandProfileIds } from "../packages/cases/case-brand-profile-references.mjs";
-import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, } from "../packages/cases/case-record-projection.mjs";
+import { CASE_AUDIENCE_SENSITIVE_FIELD_NAMES, caseAudienceExclusions, projectCaseForAudience, assertCaseCollectionReceiptAudience, } from "../packages/cases/case-record-projection.mjs";
 import { normalizeDomain } from "../packages/evidence/domain-name.mjs";
 import { normalizeCaseStore } from "../packages/cases/case-migration-model.mjs";
 import { safeId } from "../packages/cases/case-record-core.mjs";
@@ -83,6 +83,11 @@ function allowedSensitiveFieldPath(key, path) {
         return listItemPath(path, 'actions');
     if (key === 'packetReceipt')
         return typeof path.at(-1) === 'number' && path.at(-2) === 'history' && listItemPath(path.slice(0, -2), 'actions');
+    if (key === 'checkpointCollectionReceipts')
+        return topCasePath(path);
+    if (key === 'collectionReceipt')
+        return path.length === 4 && path[0] === 'cases' && typeof path[1] === 'number'
+            && (path[2] === 'evidenceHistory' || path[2] === 'checkpointCollectionReceipts') && typeof path[3] === 'number';
     return true;
 }
 /** Rejects hidden audience-sensitive copies with a budget proven by the serialized byte bound. */
@@ -390,6 +395,7 @@ export function verifyCliCasePack(input) {
     assertClosedEnvelopes(root, packet, integrity, redactionManifest, packet.reports, root.version);
     assertSensitiveFieldPlacement(root, serialized.length);
     const audience = packet.audience;
+    assertCaseCollectionReceiptAudience(root, audience);
     if (!Number.isSafeInteger(redactionManifest.sourceCaseCount)
         || redactionManifest.sourceCaseCount !== root.cases.length
         || !stringListsMatch(redactionManifest.excluded, caseAudienceExclusions(audience, root.version))) {

package/cli/ci-report.mjs

@@ -1,5 +1,7 @@
 import { WHOISLEUTH_REQUEST_POLICY_URL } from "../packages/analysis/project-metadata.mjs";
 import { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA } from "../packages/contracts/domain-control-monitor.mjs";
+import { lookupDiagnosticEntries } from "../lib/lookup-progress.mjs";
+import { lookupStrictExitFindings } from "./strict-exit.mjs";
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -9,13 +11,23 @@ function xml(value) {
 function junitCases(document) {
     const schema = String(document.schema || '');
     if (schema === 'whoisleuth.cli.lookup') {
-        const diagnostics = record(document.diagnostics);
-        const cases = Object.entries(diagnostics).slice(0, 64).map(([source, value]) => {
-            const state = String(record(value).status ?? record(value).state ?? 'unavailable').toLowerCase();
-            return ['error', 'failed', 'partial', 'rate_limited', 'timeout', 'unavailable'].includes(state)
-                ? { name: `source ${source}`, failure: `Source state: ${state}` }
+        const sources = lookupDiagnosticEntries(document.diagnostics).filter(source => source.present);
+        const findings = lookupStrictExitFindings(document);
+        const cases = sources.map(({ source, path, state }) => {
+            const failure = findings.find(finding => finding.path === path);
+            return failure || state === null
+                ? { name: `source ${source}`, failure: `Source state: ${failure?.state ?? 'unavailable'}` }
                 : { name: `source ${source}` };
         });
+        // Retain nested and historical failure coverage without echoing imported
+        // object keys, endpoints or evidence into CI names or messages.
+        const namedPaths = new Set(sources.map(source => source.path));
+        const additional = findings.filter(finding => !namedPaths.has(finding.path));
+        if (additional.length)
+            cases.push({
+                name: 'additional source diagnostics',
+                failure: `Source states: ${[...new Set(additional.map(finding => finding.state))].sort().join(', ')}`,
+            });
         return cases.length ? cases : [{ name: 'lookup diagnostics', failure: 'No source diagnostics were available.' }];
     }
     if (schema === 'whoisleuth.cli.bulk') {

package/cli/collection-arguments.mjs

@@ -29,6 +29,8 @@ function parseLookupArguments(parsed) {
             ? { saveLookup: parsed.optionValue('--save-lookup') }
             : {}),
         ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+        ...(parsed.optionValue('--brand-profile') ? { brandProfileSource: parsed.optionValue('--brand-profile') } : {}),
+        ...(parsed.optionValue('--brand-id') ? { brandProfileId: parsed.optionValue('--brand-id') } : {}),
     };
 }
 function parseBulkArguments(parsed) {
@@ -55,6 +57,8 @@ function parseBulkArguments(parsed) {
         filter,
         ...terminalOptions(parsed),
         ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+        ...(parsed.optionValue('--brand-profile') ? { brandProfileSource: parsed.optionValue('--brand-profile') } : {}),
+        ...(parsed.optionValue('--brand-id') ? { brandProfileId: parsed.optionValue('--brand-id') } : {}),
     };
 }
 function parseDiscoverArguments(parsed) {
@@ -113,6 +117,8 @@ function parseDiscoverScanArguments(parsed) {
         plan: parsed.hasOption('--plan'),
         ...terminalOptions(parsed),
         ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+        ...(parsed.optionValue('--brand-profile') ? { brandProfileSource: parsed.optionValue('--brand-profile') } : {}),
+        ...(parsed.optionValue('--brand-id') ? { brandProfileId: parsed.optionValue('--brand-id') } : {}),
     };
 }
 export const COLLECTION_ARGUMENT_PARSERS = Object.freeze({

package/cli/collection-command-definitions.mjs

@@ -2,12 +2,13 @@ import { positional, OPTIONAL_FILE_POSITIONAL, OPTIONAL_TEXT_POSITIONAL, constra
 import { bulkQueryLimit, bulkConcurrencyLimit } from "../lib/bulk-limits.mjs";
 const COLLECTION_CEILINGS = `${bulkQueryLimit('fast')} fast or ${bulkQueryLimit('deep')} deep`;
 const CONCURRENCY_CEILINGS = `${bulkConcurrencyLimit('fast')} fast or ${bulkConcurrencyLimit('deep')} deep`;
+const FAILURE_POLICY_BOUNDARY = 'Failure policies evaluate all collected and restored results before output filtering. For danger review, explicitly select --deep and --brand-profile; use --brand-id to select one profile from a multi-profile export. The current canonical Risk model compares collected evidence with that local reference; Fast, missing or ineligible evidence cannot establish a threshold match. The heuristic review threshold is not a maliciousness or safety verdict. The profile is not sent to collectors, retained in checkpoints or copied into output.';
 export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
     lookup: commandSeed({
         reference: {
             description: 'Collect registration evidence for one domain, IP, or ASN.',
             example: 'whoisleuth lookup example.test --deep --browse',
-            boundary: 'Fast is the default. An ICANN-recognised public domain, reserved documentation domain, IP, or ASN may occupy command position as shorthand; it delegates to this same parser and URL-like input requires the explicit lookup command. Deep mode adds bounded WHOIS, DNS, HTTP, TLS, technology, posture, and network context where applicable. --deep --exact-url explicitly sends the input URL path and query to the website, without its fragment; ordinary URL input sends only the hostname. --plan remains offline and omits the selected URL. Retained paths and page-derived text require review before sharing. A full Deep homepage observation can derive fixed publication and delivery/cache summaries from the same response without retaining raw metadata values or making another request. --browse opens before collection, shows aggregate Fast progress or independently settled planned Deep sources, and then navigates allowlisted retained fields in the completed document. Press ? for help and / to search rendered panel text only. Closing during collection cancels without a partial document. --save-lookup writes the exact completed private JSON only after a normal browser close; it can contain normalised evidence omitted from panels and refuses an existing path.',
+            boundary: 'Fast is the default. An ICANN-recognised public domain, reserved documentation domain, IP, or ASN may occupy command position as shorthand; it delegates to this same parser and URL-like input requires the explicit lookup command. Deep mode adds bounded WHOIS, DNS, HTTP, TLS, technology, posture, and network context where applicable. --deep --exact-url explicitly sends the input URL path and query to the website, without its fragment; ordinary URL input sends only the hostname. --plan remains offline and omits the selected URL. Retained paths and page-derived text require review before sharing. A full Deep homepage observation can derive fixed publication and delivery/cache summaries from the same response without retaining raw metadata values or making another request. --browse opens before collection, shows aggregate Fast progress or independently settled planned Deep sources, and then navigates allowlisted retained fields in the completed document. Press ? for help and / to search rendered panel text only. Closing during collection cancels without a partial document. --save-lookup writes the exact completed private JSON only after a normal browser close; it can contain normalised evidence omitted from panels and refuses an existing path. ' + FAILURE_POLICY_BOUNDARY,
         },
         collection: {
             scope: 'Accepts one target. Fast is the default; deep collection must be selected explicitly.',
@@ -31,6 +32,8 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             '--save-lookup',
             '--strict-exit',
             '--fail-on',
+            '--brand-profile',
+            '--brand-id',
             '--events',
             '--quiet',
             '--no-color',
@@ -39,6 +42,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             positional('target', 'text', 0, 1, [], 'argv_or_stdin', ['--browse']),
         ]),
         constraints: Object.freeze([
+            constraint({ kind: 'requires_all', option: '--brand-id', requiredOptions: ['--brand-profile'] }),
             constraint({
                 kind: 'mutually_exclusive',
                 options: ['--json', '--junit', '--markdown', '--html'],
@@ -106,7 +110,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Triage newline-delimited domains, IPs, or ASNs with bounded concurrency.',
             example: 'cat domains.txt | whoisleuth bulk --jsonl',
-            boundary: 'Fast and deep jobs use separate concurrency ceilings. Filters affect output only; collection failures and inconclusive authority states remain explicit in JSON, JSONL, and CSV. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns.',
+            boundary: 'Fast and deep jobs use separate concurrency ceilings. Filters affect output only; collection failures and inconclusive authority states remain explicit in JSON, JSONL, and CSV. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns. ' + FAILURE_POLICY_BOUNDARY,
         },
         collection: {
             scope: `Accepts at most ${COLLECTION_CEILINGS} targets, with concurrency capped at ${CONCURRENCY_CEILINGS}.`,
@@ -131,11 +135,14 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             '--events',
             '--plan',
             '--fail-on',
+            '--brand-profile',
+            '--brand-id',
             '--quiet',
             '--no-color',
         ],
         positionals: OPTIONAL_FILE_POSITIONAL,
         constraints: Object.freeze([
+            constraint({ kind: 'requires_all', option: '--brand-id', requiredOptions: ['--brand-profile'] }),
             constraint({
                 kind: 'mutually_exclusive',
                 options: [
@@ -236,7 +243,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Generate a bounded candidate set, collect a selected subset, and produce a supervised review queue.',
             example: 'whoisleuth discover-scan example.test --scan-limit 50 --checkpoint scan.json --json',
-            boundary: `This command performs network collection. Fast compact lookup is the default; deep mode is capped at ${bulkQueryLimit('deep')} candidates. Allowlisting changes review priority only and shared infrastructure remains a lead, not attribution. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns.`,
+            boundary: `This command performs network collection. Fast compact lookup is the default; deep mode is capped at ${bulkQueryLimit('deep')} candidates. Allowlisting changes review priority only and shared infrastructure remains a lead, not attribution. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns. ${FAILURE_POLICY_BOUNDARY}`,
         },
         collection: {
             scope: `Scans at most ${COLLECTION_CEILINGS} candidates, with concurrency capped at ${CONCURRENCY_CEILINGS}.`,
@@ -265,6 +272,8 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             '--events',
             '--plan',
             '--fail-on',
+            '--brand-profile',
+            '--brand-id',
             '--json',
             '--jsonl',
             '--csv',
@@ -275,6 +284,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
         ],
         positionals: OPTIONAL_TEXT_POSITIONAL,
         constraints: Object.freeze([
+            constraint({ kind: 'requires_all', option: '--brand-id', requiredOptions: ['--brand-profile'] }),
             constraint({
                 kind: 'mutually_exclusive',
                 options: ['--json', '--jsonl', '--csv', '--csv-with-metadata', '--domains'],

package/cli/command-definition.mjs

@@ -126,7 +126,7 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--config': file('Load explicit versioned CLI configuration from this file.'),
     '--profile': text('Select a named profile from the supplied configuration.', true),
     '--palette': enumeration('Choose the terminal colour palette; redirected output and no-colour settings still take precedence.', ['auto', 'light', 'dark']),
-    '--network': flag('Include the optional public DNS and port 43 runtime checks.'),
+    '--network': flag('Include the optional public DNS, HTTPS and WHOIS (port 43) runtime checks.'),
     '--json': flag('Write structured JSON to stdout or the selected output file.'),
     '--reported-action': optionDefinition('enum', 'Record an analyst-reported identity action; repeat for separate actions.', { values: IDENTITY_ACTIONS.map(action => action.id), occurrence: 'repeatable' }),
     '--trusted-auth-header': optionDefinition('text', 'Select a recognised receiver header by part:header-index. This records analyst trust, not independent authentication; repeat for separate headers.', { occurrence: 'repeatable' }),
@@ -156,6 +156,8 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--interactive': flag('Prompt for missing supported inputs on an interactive terminal.'),
     '--save-lookup': file('After a normal evidence-browser close, save the completed private Lookup JSON to a new file.'),
     '--strict-exit': flag('Use the command’s strict outcome policy when deciding the exit status.'),
+    '--brand-profile': file('Read a local Brand Profile export for danger-policy comparisons; no additional requests or profile retention.'),
+    '--brand-id': text('Select an exact profile ID when --brand-profile contains multiple profiles.'),
     '--fail-on': optionDefinition('policy_list', 'Return a failure-policy exit status for the selected comma-separated outcomes.', {
         values: (command) => CLI_FAIL_POLICIES_BY_COMMAND[command] ?? [],
     }),
@@ -235,10 +237,10 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--left-session': text('Select the left-hand retained capture session.', true),
     '--right-session': text('Select the right-hand retained capture session.', true),
     '--compact': flag('Write a compact report presentation.'),
-    '--case-id': text('Select the retained Case identifier.'),
-    '--domain': text('Supply the Case domain.'),
-    '--title': text('Supply the Case title.'),
-    '--new-incident': flag('Create a separate incident instead of updating a matching Case.'),
+    '--case-id': text('Select the retained case identifier.'),
+    '--domain': text('Supply the case domain.'),
+    '--title': text('Supply the case title.'),
+    '--new-incident': flag('Create a separate incident instead of updating a matching case.'),
     '--text': text('Supply the note text directly.'),
     '--note-file': file('Read note text from a selected local file.'),
     '--input': file('Read the selected local input file.'),

package/cli/discovery-scan-command-runner.mjs

@@ -10,7 +10,8 @@ import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { evaluateCliFailPolicies, reportCliFailPolicies } from "./fail-policy.mjs";
+import { readCliRiskProfile } from "./risk-policy.mjs";
 async function readAllowlist(source, dependencies, context, classify) {
     if (!source)
         return new Set();
@@ -59,6 +60,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
         return EXIT_CODES.SUCCESS;
     }
+    const riskProfile = await readCliRiskProfile(args.brandProfileSource, context.readInput, args.brandProfileId);
     const classify = dependencies.classifyQuery || classifyQuery;
     const allowlist = await readAllowlist(args.allowlistSource, dependencies, context, classify);
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
@@ -144,7 +146,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
     const snapshot = args.observationSnapshot
         ? await updateDiscoveryObservationSnapshot(args.observationSnapshot, candidates, items, { deep: args.deep, resolverServers }, generationMetadata.generatedAt)
         : null;
-    const document = buildDiscoveryScanDocument(candidates, items, {
+    const metadata = {
         generatedAt: generationMetadata.generatedAt,
         seed: generationMetadata.seed,
         preset: generationMetadata.preset,
@@ -157,9 +159,15 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         chunkSize: args.chunkSize,
         concurrency: args.concurrency,
         deep: args.deep,
-        filter: args.filter,
+        filter: 'all',
         resolverServers,
-    }, allowlist, snapshot);
+    };
+    // Policies describe the complete collected run, including restored results,
+    // source diagnostics and candidate context, before presentation selection.
+    const collectedDocument = buildDiscoveryScanDocument(candidates, items, metadata, allowlist, snapshot);
+    const policyFindings = evaluateCliFailPolicies(collectedDocument, args.failOn || [], riskProfile);
+    const document = args.filter === 'all' ? collectedDocument
+        : buildDiscoveryScanDocument(candidates, items, { ...metadata, filter: args.filter }, allowlist, snapshot);
     if (!args.quiet) {
         if (args.output === 'json')
             context.writeStdout(formatJsonDocument(document));
@@ -174,9 +182,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalDiscoveryScan(document), args.color));
     }
-    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
-    if (policyFindings.length && !eventProgress.enabled)
-        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    reportCliFailPolicies(policyFindings, context.writeStderr, eventProgress);
     const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;

package/cli/doctor.mjs

@@ -1,12 +1,14 @@
 import { withTimeout } from "../lib/abort.mjs";
-export const DOCTOR_SCHEMA = 'whoisleuth.cli.doctor';
-export const DOCTOR_VERSION = 1;
+import { CLI_COMMAND_REGISTRY } from "./command-reference.mjs";
+import { DOCTOR_SCHEMA, DOCTOR_VERSION, DOCTOR_SUMMARY_SCHEMA, DOCTOR_SUMMARY_VERSION } from "../packages/contracts/cli-doctor.mjs";
+export { DOCTOR_SCHEMA, DOCTOR_VERSION, DOCTOR_SUMMARY_SCHEMA, DOCTOR_SUMMARY_VERSION };
 const MINIMUM_NODE_MAJOR = 24;
 const NETWORK_HOST = 'whois.iana.org';
 const NETWORK_QUERY = 'example.com';
 const NETWORK_HTTPS_URL = 'https://data.iana.org/rdap/dns.json';
 const NETWORK_TIMEOUT_MS = 6_000;
 const MAX_DOCTOR_DETAIL_LENGTH = 180;
+const DOCTOR_CHECK_IDS = ['runtime', 'platform', 'terminal', 'offline_features', 'network', 'public_dns', 'https_transport', 'whois_transport'];
 function boundedDetail(value, fallback) {
     return String(value || fallback)
         .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
@@ -162,6 +164,38 @@ async function buildDoctorReport(options) {
         checks: Object.freeze(checks),
     });
 }
+function diagnosticVersion(value) {
+    return /^(\d{1,6}\.\d{1,6}\.\d{1,6})(?:[-+].*)?$/u.exec(value)?.[1] ?? null;
+}
+function buildDoctorSummary(report, nodeVersion = process.versions.node) {
+    const checkCodes = DOCTOR_CHECK_IDS.flatMap(id => {
+        const check = report.checks.find(item => item.id === id);
+        if (!check)
+            return [];
+        const state = check.state === 'pass' || check.state === 'partial' || check.state === 'skipped' ? check.state : 'unknown';
+        return [`${id}_${state}`];
+    });
+    const omittedCheckCount = report.checks.length - checkCodes.length;
+    return Object.freeze({
+        schema: DOCTOR_SUMMARY_SCHEMA,
+        version: DOCTOR_SUMMARY_VERSION,
+        cliVersion: diagnosticVersion(report.cliVersion),
+        nodeVersion: diagnosticVersion(nodeVersion),
+        state: report.state === 'pass' && omittedCheckCount === 0 ? 'pass' : 'partial',
+        networkRequested: report.networkRequested === true,
+        checkCodes: Object.freeze(checkCodes),
+        omittedCheckCount,
+        declaredFormatIdentifiers: Object.freeze([...new Set(CLI_COMMAND_REGISTRY.flatMap(command => command.documentation.supportedSchemaIdentifiers))].sort()),
+        formatScope: 'Public command declarations only; not an installed-package or input-compatibility test.',
+        omissions: Object.freeze([
+            'Targets, URLs, queries and fragments',
+            'File paths, folder names and user names',
+            'Launch tokens, cookies, credentials and headers',
+            'Input files, response content and free-form diagnostic details',
+            'Timestamps, platform details and version prerelease/build metadata',
+        ]),
+    });
+}
 function formatDoctorReport(report) {
     const lines = [
         'Runtime:',
@@ -175,4 +209,4 @@ function formatDoctorReport(report) {
     }
     return `${lines.join('\n')}\n`;
 }
-export { buildDoctorReport, formatDoctorReport, };
+export { buildDoctorReport, buildDoctorSummary, formatDoctorReport, };