@slicedearth/whoisleuth-cli 2.6.0 → 2.8.0

package/cli/domain-control-monitor.mjs

@@ -9,6 +9,8 @@ import { requireDomainName, requireIsoTimestamp } from "../lib/bounded-contract-
 import { buildCliLookupDocument } from "./formatters/json.mjs";
 import { buildCliDomainControlReview, DOMAIN_CONTROL_REVIEW_SOURCE_FIELDS, } from "./domain-control-observations.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { lookupStrictExitFindings } from "./strict-exit.mjs";
+import { lookupObservationHostname } from "../packages/evidence/lookup-target.mjs";
 export { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, CLI_DOMAIN_CONTROL_MONITOR_VERSION };
 export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = CONTRACT_MAX_DOMAIN_CONTROL_MONITOR_DOMAINS;
 function parseMonitorJson(input, label) {
@@ -232,6 +234,19 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
     }
     const previous = previousSnapshot(previousInput, startedAt);
     const entries = manifest.entries.slice(0, Math.min(options.limit, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS));
+    const targets = entries.map(entry => {
+        let classified;
+        try {
+            classified = classifyQuery(entry.domain);
+        }
+        catch {
+            throw new CliUsageError('monitor-once requires registrable-domain targets.');
+        }
+        if (classified.type !== 'domain' || classified.isSubdomain) {
+            throw new CliUsageError('monitor-once supports registrable-domain targets only; exact-host monitoring is not supported.');
+        }
+        return classified;
+    });
     const lookups = new Array(entries.length);
     const failuresByIndex = new Array(entries.length);
     let cursor = 0;
@@ -244,13 +259,18 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
             if (!entry)
                 break;
             try {
-                const classified = classifyQuery(entry.domain);
+                const classified = targets[index];
                 const result = await options.executeLookup(classified, { fast: false, compact: false, ...(options.signal ? { signal: options.signal } : {}) });
                 options.signal?.throwIfAborted();
                 const capturedAt = requireIsoTimestamp(options.now(), 'Domain-control capture time');
                 if (Date.parse(capturedAt) < checkedAt)
                     throw new CliUsageError('Domain-control capture time must not precede the run.');
-                lookups[index] = buildCliLookupDocument(entry.domain, classified, result, capturedAt, 'deep');
+                const lookup = buildCliLookupDocument(entry.domain, classified, result, capturedAt, 'deep');
+                const observedHostname = lookupObservationHostname({ domain: entry.domain, ...lookup.availability });
+                if (observedHostname !== null && observedHostname !== entry.domain) {
+                    throw new TypeError('Lookup observation does not match the monitor target.');
+                }
+                lookups[index] = lookup;
             }
             catch {
                 if (options.signal?.aborted) {
@@ -270,6 +290,9 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
     const successful = lookups.filter(Boolean);
     if (!successful.length)
         throw new Error('No domain-control monitor lookup completed successfully.');
+    // Only current Lookup diagnostics contribute; checkpoints retain observations,
+    // not policy metadata or raw diagnostics.
+    options.onSourceFailures?.(successful.reduce((count, lookup) => count + lookupStrictExitFindings(lookup).length, 0));
     const generatedAt = requireIsoTimestamp(options.now(), 'Domain-control completion time');
     if (Date.parse(generatedAt) < checkedAt || successful.some((lookup) => Date.parse(String(lookup.generatedAt)) > Date.parse(generatedAt))) {
         throw new CliUsageError('Domain-control completion time must not precede its captures.');

package/cli/domain-control-observations.mjs

@@ -3,10 +3,11 @@ import { latestObservationCohort } from "../packages/evidence/latest-observation
 import { canonicalCaaRecord, canonicalDsRecord, canonicalMxRecord, canonicalDomainControlRecords, canonicalPostureRecords } from "../packages/evidence/domain-control-runtime.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { postureTransferRestriction } from "../packages/evidence/domain-posture-context.mjs";
+import { lookupObservationHostname } from "../packages/evidence/lookup-target.mjs";
 import { MAX_DOMAIN_CONTROL_INPUT_RECORDS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION } from "../packages/contracts/domain-control-manifest.mjs";
 import { scanBoundedJson, } from "../packages/analysis/bounded-json.mjs";
 import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION, SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS, } from "../packages/contracts/domain-control-review.mjs";
-import { MAX_FLIGHT_RECORDER_VALUES, mergeConcurrentDomainControlFields, } from "../lib/domain-control-flight-recorder.mjs";
+import { MAX_FLIGHT_RECORDER_VALUES, DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, mergeConcurrentDomainControlFields, } from "../lib/domain-control-flight-recorder.mjs";
 import { DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, reviewDomainControlManifest, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
@@ -113,12 +114,21 @@ function pageIdentityValue(availability) {
     ].filter((item) => Boolean(item));
     return components.length ? [components.join(' | ')] : [];
 }
-export function domainControlObservationFromSavedLookup(document) {
+function serviceHostname(document) {
+    // Historical saved Lookups collected supporting evidence at the registration
+    // domain unless availability retained a more specific scope. Never use query.
+    return lookupObservationHostname({ domain: document.registrableDomain, ...record(document.availability) });
+}
+export function domainControlObservationFromSavedLookup(document, domain = document.registrableDomain) {
     const availability = record(document.availability);
+    const observedHostname = serviceHostname(document);
     const dns = record(availability.dns);
     const dnsRecords = record(dns.records);
     const dnsAt = sourceClock(dns.observedAt, dns.checkedAt);
     const delegation = record(dns.delegation);
+    const delegationHostname = delegation.domain === undefined
+        ? observedHostname === document.registrableDomain ? observedHostname : null
+        : lookupObservationHostname({ domain: delegation.domain });
     const delegationRecords = record(delegation.records);
     const tls = record(availability.tls);
     const tlsState = sourceState(tls);
@@ -134,14 +144,15 @@ export function domainControlObservationFromSavedLookup(document) {
     const hostname = (value) => canonicalDomainControlRecords([value], 'nameservers')[0] ?? '';
     const identity = record(availability.pageIdentity);
     const identityValues = pageIdentityValue(availability);
-    const fields = [
+    const registrationFields = [
         scalar('registrar', registry.source, registry.sourceState, record(registry.parsed.registrar).name ?? registry.parsed.registrar, registry.observedAt, 300),
         scalar('registrar_lock', registry.source, registry.sourceState, lockValue(registry.parsed), registry.observedAt, 20),
         scalar('registry_dnssec', 'Registry RDAP', rdapState, rdapParsed.dnssec, rdapAt, 80),
         recordField('registry_nameservers', 'Registry RDAP', rdapState, rdapParsed.nameservers, hostname, rdapAt),
         recordField('whois_nameservers', 'WHOIS', diagnostic(document, 'whois'), record(record(document.whois).parsed).nameservers, hostname, registryClock(document, 'whois')),
+    ];
+    const serviceFields = [
         recordField('delegated_nameservers', 'DNS NS', dnsRecordState(dns, 'ns'), dnsRecords.ns, hostname, dnsAt),
-        recordField('delegation_ds', 'DNS delegation', Object.hasOwn(delegationRecords, 'ds') ? sourceState(delegation) : 'unsupported', delegationRecords.ds, canonicalDsRecord, sourceClock(delegation.observedAt)),
         recordField('mail_exchangers', 'DNS MX', dnsRecordState(dns, 'mx'), dnsRecords.mx, canonicalMxRecord, dnsAt),
         recordField('caa_policy', 'DNS CAA', dnsRecordState(dns, 'caa'), dnsRecords.caa, canonicalCaaRecord, dnsAt),
         scalar('tls_certificate', 'TLS', tlsState, certificate.fingerprintSha256 ?? tls.fingerprintSha256, tlsAt, 128),
@@ -149,8 +160,13 @@ export function domainControlObservationFromSavedLookup(document) {
         scalar('http_origin', 'HTTP', sourceState(http), http.finalOrigin, sourceClock(http.observedAt, http.checkedAt)),
         field('page_identity', 'Static page identity', sourceState(identity) === 'observed' && !identityValues.length ? 'partial' : sourceState(identity), identityValues, sourceClock(identity.observedAt)),
     ];
+    const fields = mergeConcurrentDomainControlFields([
+        domain === document.registrableDomain ? registrationFields : [],
+        domain === observedHostname ? serviceFields : [],
+        domain === delegationHostname ? [recordField('delegation_ds', 'DNS delegation', Object.hasOwn(delegationRecords, 'ds') ? sourceState(delegation) : 'unsupported', delegationRecords.ds, canonicalDsRecord, sourceClock(delegation.observedAt))] : [],
+    ]);
     return Object.freeze({
-        domain: document.registrableDomain, capturedAt: document.generatedAt, collectionDepth: document.mode,
+        domain, capturedAt: document.generatedAt, collectionDepth: document.mode,
         fields: Object.freeze(fields.map((item) => item.state === 'observed' && item.observedAt !== null
             && Date.parse(item.observedAt) > Date.parse(document.generatedAt) ? Object.freeze({ ...item, state: 'partial' }) : item)),
     });
@@ -219,19 +235,40 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     const lookups = input.lookups.map((item, index) => parseSavedLookupDocument(JSON.stringify(item), { label: `Lookup ${index + 1}` }));
     const byDomain = new Map();
     for (const lookup of lookups) {
-        const group = byDomain.get(lookup.registrableDomain) ?? [];
-        group.push(lookup);
-        byDomain.set(lookup.registrableDomain, group);
+        const domains = new Set([lookup.registrableDomain, serviceHostname(lookup)]);
+        for (const domain of domains) {
+            if (domain === null)
+                continue;
+            const group = byDomain.get(domain) ?? [];
+            group.push(lookup);
+            byDomain.set(domain, group);
+        }
     }
-    let ignoredHistoricalLookups = 0;
+    const retainedLookups = new Set();
     const selected = [...byDomain.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([domain, documents]) => {
-        const cohort = latestObservationCohort(documents, (document) => document.generatedAt);
-        ignoredHistoricalLookups += cohort.superseded;
-        const captures = cohort.latest.map((document) => ({ document, observation: domainControlObservationFromSavedLookup(document) }));
+        const candidates = documents.map((document) => {
+            const observation = domainControlObservationFromSavedLookup(document, domain);
+            return { document, observation, reviewFields: reviewFields(document, observation) };
+        });
+        const currentCaptures = new Set();
+        const currentFields = [];
+        const currentReviewFields = [];
+        for (const id of DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS) {
+            const eligible = candidates.filter(candidate => candidate.observation.fields.some(item => item.id === id));
+            const latest = latestObservationCohort(eligible, candidate => candidate.document.generatedAt);
+            for (const capture of latest.latest) {
+                currentCaptures.add(capture);
+                retainedLookups.add(capture.document);
+                currentFields.push(capture.observation.fields.filter(item => item.id === id));
+                currentReviewFields.push(capture.reviewFields.filter(item => item.id === id));
+            }
+        }
+        const captures = [...currentCaptures];
+        const cohort = latestObservationCohort(captures, capture => capture.document.generatedAt);
         const first = captures[0];
         if (!first || !cohort.observedAt || cohort.undated.length)
             throw new CliUsageError('Saved Lookup observation times could not be ordered.');
-        const mergedFields = mergeConcurrentDomainControlFields(captures.map((capture) => capture.observation.fields));
+        const mergedFields = mergeConcurrentDomainControlFields(currentFields);
         const futureCapture = Date.parse(cohort.observedAt) > Date.parse(generatedAt);
         const observation = Object.freeze({
             domain,
@@ -240,7 +277,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
                 ? first.observation.collectionDepth : 'unknown',
             fields: futureCapture ? mergedFields.map((field) => ({ ...field, state: 'partial' })) : mergedFields,
         });
-        const fields = mergeConcurrentDomainControlFields(captures.map((capture) => reviewFields(capture.document, capture.observation)));
+        const fields = mergeConcurrentDomainControlFields(currentReviewFields);
         return { observation, reviewFields: futureCapture || observation.collectionDepth === 'unknown'
                 ? fields.map((field) => ({ ...field, state: 'partial' })) : fields };
     });
@@ -268,7 +305,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
         input: Object.freeze({
             lookupsReceived: lookups.length,
             latestDomainObservations: observations.length,
-            ignoredHistoricalLookups,
+            ignoredHistoricalLookups: lookups.length - retainedLookups.size,
         }),
         limitations: CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS,
     });

package/cli/fail-policy.mjs

@@ -1,5 +1,8 @@
 import { lookupStrictExitFindings } from "./strict-exit.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
+import { explainCliLookupRisk } from "./risk-policy.mjs";
+import { DOMAIN_CONTROL_REVIEW_SCHEMA } from "../packages/contracts/domain-control-review.mjs";
 export const CLI_FAIL_POLICIES = ['source-failure', 'inconclusive', 'danger', 'material-drift'];
 export const CLI_FAIL_POLICIES_BY_COMMAND = Object.freeze({
     lookup: Object.freeze(['source-failure', 'inconclusive', 'danger']),
@@ -31,14 +34,7 @@ function availabilityStates(document) {
     });
     return [direct, review, ...resultStates].filter(Boolean);
 }
-function riskScore(value) {
-    const raw = record(value.risk).score ?? value.riskScore;
-    if (raw === null || raw === undefined || raw === '')
-        return null;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) ? parsed : null;
-}
-export function evaluateCliFailPolicies(document, policies) {
+export function evaluateCliFailPolicies(document, policies, profile = null, currentSourceFailureCount = 0) {
     const root = record(document);
     const findings = [];
     for (const policy of policies) {
@@ -50,28 +46,31 @@ export function evaluateCliFailPolicies(document, policies) {
             const collection = record(root.collection);
             const summary = record(root.summary);
             const failed = Number(collection.failed ?? summary.failed ?? 0);
-            if (sourceFindings.length || failed > 0)
-                findings.push({ policy, reason: `${sourceFindings.length + failed} failed or incomplete collection state(s)` });
+            const failures = sourceFindings.length + failed + currentSourceFailureCount;
+            if (failures > 0)
+                findings.push({ policy, reason: `${failures} failed or incomplete collection state(s)` });
         }
         else if (policy === 'inconclusive') {
-            const count = availabilityStates(root).filter((state) => ['unknown', 'inconclusive', 'partial', 'unavailable'].includes(state)).length;
+            const review = record(root.review);
+            const comparisons = review.schema === DOMAIN_CONTROL_REVIEW_SCHEMA;
+            const counts = record(review.counts);
+            const count = comparisons
+                ? Number(counts.partial ?? 0) + Number(counts.unavailable ?? 0) + Number(counts.unsupported ?? 0)
+                : availabilityStates(root).filter((state) => ['unknown', 'inconclusive', 'partial', 'unavailable'].includes(state)).length;
             if (count)
-                findings.push({ policy, reason: `${count} authority or availability state(s) remained inconclusive` });
+                findings.push({ policy, reason: `${count} ${comparisons ? 'requested comparison(s)' : 'authority or availability state(s)'} remained inconclusive` });
         }
         else if (policy === 'danger') {
             const documents = [root, ...(Array.isArray(root.results) ? root.results.map(record) : [])];
-            const risks = documents.map(riskScore).filter((score) => score !== null);
-            const severities = documents
-                .flatMap((item) => [item.severity, record(item.review).severity])
-                .map((severity) => String(severity || '').toLowerCase())
-                .filter((severity) => severity === 'danger' || severity === 'critical');
-            const highestRisk = risks.length ? Math.max(...risks) : null;
-            if ((highestRisk !== null && highestRisk >= 70) || severities.length) {
+            const risks = documents.flatMap(item => {
+                const risk = explainCliLookupRisk(item, profile, item.mode ?? root.mode);
+                return risk ? [risk] : [];
+            });
+            const highestRisk = risks.reduce((highest, risk) => (!highest || risk.score > highest.score ? risk : highest), null);
+            if (highestRisk && highestRisk.score >= RISK_REVIEW_THRESHOLD) {
                 findings.push({
                     policy,
-                    reason: highestRisk !== null && highestRisk >= 70
-                        ? `risk score ${highestRisk} met the 70 review threshold`
-                        : `explicit ${severities[0]} severity was present`,
+                    reason: `risk score ${highestRisk.score} met the ${RISK_REVIEW_THRESHOLD} review threshold; model v${highestRisk.modelVersion}; evidence ${highestRisk.evidenceQuality.state} (heuristic, not a verdict)`,
                 });
             }
         }
@@ -87,3 +86,13 @@ export function evaluateCliFailPolicies(document, policies) {
 export function formatFailPolicyNotice(findings) {
     return `Failure policy matched: ${findings.map((item) => `${item.policy} (${item.reason})`).join('; ')}.\n`;
 }
+export function reportCliFailPolicies(findings, writeStderr, progress) {
+    if (!findings.length)
+        return;
+    if (!progress.enabled)
+        writeStderr(formatFailPolicyNotice(findings));
+    else
+        for (const finding of findings) {
+            progress.emit({ event: 'warning', state: 'failure_policy_matched', source: finding.policy, reason: finding.reason });
+        }
+}

package/cli/formatters/html.mjs

@@ -40,6 +40,7 @@ function formatLookupEvidenceHtml(document, options = {}) {
   <style>
     :root{color-scheme:dark;--bg:#07110d;--panel:#0d1b15;--panel2:#10241b;--line:#254837;--text:#d8f5e4;--muted:#91b7a0;--accent:#6dff9d;--shadow:rgba(0,0,0,.28)}
     *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font:15px/1.55 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:min(1120px,calc(100% - 32px));margin:0 auto;padding:42px 0 64px}header{border:1px solid var(--line);background:linear-gradient(145deg,var(--panel2),var(--panel));padding:28px;box-shadow:0 18px 50px var(--shadow)}h1,h2,h3{line-height:1.2;margin:0;color:var(--accent)}h1{font-size:clamp(1.5rem,4vw,2.35rem);overflow-wrap:anywhere}h2{font-size:1.22rem;margin-bottom:16px}h3{font-size:1rem;margin-bottom:12px}.eyebrow{margin:0 0 10px;color:var(--muted);letter-spacing:.12em;text-transform:uppercase}.notice{margin:18px 0 0;color:var(--muted);max-width:85ch}.block{margin-top:24px;border:1px solid var(--line);background:var(--panel);padding:22px}.fields{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 24px;margin:0}.fields div{display:grid;grid-template-columns:minmax(130px,.8fr) minmax(0,1.6fr);gap:12px;border-top:1px solid var(--line);padding:9px 0}.fields div:first-child,.fields div:nth-child(2){border-top:0}.fields dt{color:var(--muted)}.fields dd{margin:0;overflow-wrap:anywhere}.card-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,320px),1fr));gap:16px}.card{border:1px solid var(--line);background:var(--panel2);padding:18px}.card .fields{display:block}.card .fields div{grid-template-columns:minmax(120px,.8fr) minmax(0,1.4fr)}.card .fields div:nth-child(2){border-top:1px solid var(--line)}.table-scroll{overflow-x:auto}table{width:100%;border-collapse:collapse;min-width:720px}caption{text-align:left;color:var(--muted);padding:0 0 10px}th,td{border:1px solid var(--line);padding:9px 10px;text-align:left;vertical-align:top;overflow-wrap:anywhere}thead th{background:var(--panel2);color:var(--accent)}tbody th{color:var(--text)}.status{white-space:nowrap;color:var(--accent)}.empty,.omission{color:var(--muted)}ul{margin:0;padding-left:22px}li+li{margin-top:8px}footer{margin-top:24px;color:var(--muted);font-size:.88rem;text-align:center}
+    footer{overflow-wrap:anywhere}
     @media(max-width:700px){main{width:min(100% - 20px,1120px);padding-top:16px}header,.block{padding:17px}.fields{display:block}.fields div,.card .fields div{grid-template-columns:1fr;gap:2px}.fields div:nth-child(2){border-top:1px solid var(--line)}}
     @media print{:root{color-scheme:light;--bg:#fff;--panel:#fff;--panel2:#f5f7f5;--line:#b9c5bd;--text:#17231b;--muted:#46564b;--accent:#155c2f;--shadow:transparent}body{font:10pt/1.42 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}main{width:100%;padding:0}header,.block,.card{box-shadow:none;break-inside:avoid}.block{margin-top:12px}}
   </style>
@@ -55,6 +56,8 @@ function formatLookupEvidenceHtml(document, options = {}) {
   <section class="block"><h2>Query</h2>${renderFields(report.query)}</section>
   <section class="block"><h2>Assessment</h2>${renderFields(report.assessment)}</section>
   <section class="block"><h2>Registry sources</h2>${renderGroups(report.registryGroups)}</section>
+  ${report.registrarStanding.length ? `<section class="block"><h2>Registrar standing</h2>${renderFields(report.registrarStanding)}</section>` : ''}
+  ${report.registryInterpretation.length ? `<section class="block"><h2>Registry interpretation</h2>${renderFields(report.registryInterpretation)}</section>` : ''}
   <section class="block"><h2>Registry-source comparison</h2>${renderFields(report.comparison.health)}${renderComparison(report.comparison)}</section>
   ${report.registrarComparison.fields.length ? `<section class="block"><h2>Registry / registrar RDAP comparison</h2>${renderFields(report.registrarComparison.health)}${renderRegistrarComparison(report.registrarComparison)}</section>` : ''}
   <section class="block"><h2>Network evidence</h2>${renderGroups(report.networkGroups)}</section>

package/cli/formatters/json.mjs

@@ -69,7 +69,14 @@ function versionedResult(result, schema, version, generatedAt, requestedField, r
     return { ...result, schema, version, generatedAt, [requestedField]: requestedValue };
 }
 function buildCliPostureDocument(requestedDomain, report, generatedAt = new Date().toISOString()) {
-    return versionedResult(report, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);
+    const checks = report.checks;
+    const retained = Array.isArray(checks) ? { ...report, checks: checks.map(check => {
+            if (!check || typeof check !== 'object' || Array.isArray(check))
+                return check;
+            const { dmarcPolicyContext: _transient, ...fields } = check;
+            return fields;
+        }) } : report;
+    return versionedResult(retained, CLI_POSTURE_SCHEMA, CLI_POSTURE_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);
 }
 function buildCliHttpDocument(requestedDomain, result, generatedAt = new Date().toISOString()) {
     return versionedResult(result, CLI_HTTP_SCHEMA, CLI_HTTP_SCHEMA_VERSION, generatedAt, 'requestedDomain', requestedDomain);

package/cli/formatters/terminal-lookup.mjs

@@ -1,5 +1,7 @@
 import { registryAccessProfileLabel } from "../registry-access.mjs";
+import { isSupportedRegistryInsightsVersion } from "../../packages/contracts/registry-insights.mjs";
 import { dnsAddressFamilyEvidence } from "../../packages/evidence/dns-query-outcome.mjs";
+import { lookupCollectionReceiptReview } from "../../packages/evidence/lookup-collection-review.mjs";
 import { appendTechnologyLines } from "./terminal-technology.mjs";
 import { appendDeliveryMetadataLines, appendPublicationMetadataLines } from "./terminal-metadata.mjs";
 import { securityPostureReview, summarizeSecurityPostureReview } from "../../lib/website-security-posture.mjs";
@@ -252,6 +254,14 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         `RDAP           ${titleCase(rdapDiagnostics.status)}`,
         `WHOIS          ${titleCase(whoisDiagnostics.status)}`,
     ];
+    if (detail !== 'summary') {
+        for (const [source, status] of [['rdap', rdapDiagnostics.status], ['whois', whoisDiagnostics.status]]) {
+            const sourceDetail = terminalRecord(document[source]).detail;
+            if (['unsupported', 'skipped', 'disabled'].includes(String(status)) && typeof sourceDetail === 'string' && sourceDetail) {
+                registrationLines.push(`${source.toUpperCase()} detail    ${boundedTerminalComponent(sourceDetail, 300)}`);
+            }
+        }
+    }
     if (detail !== 'summary' && rdapDiagnostics.endpoint) {
         registrationLines.splice(1, 0, `RDAP source    ${safeTerminalValue(rdapDiagnostics.endpoint)}`);
     }
@@ -267,7 +277,7 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
         appendNetworkRegistrationLines(registrationLines, terminalRecord(rdap.parsed), document.type, detail);
     }
     const registryInsights = terminalRecord(document.registryInsights);
-    if (detail !== 'summary' && registryInsights.version === 1) {
+    if (detail !== 'summary' && isSupportedRegistryInsightsVersion(registryInsights.version)) {
         const lifecycle = terminalRecord(registryInsights.lifecycle);
         const disclosure = terminalRecord(registryInsights.contactDisclosure);
         const registryDisclosure = terminalRecord(disclosure.registryRdap);
@@ -712,6 +722,19 @@ function formatTerminalLookup(document, { detail = 'standard' } = {}) {
     const collectionLines = [];
     if (detail === 'verbose') {
         collectionLines.push(`Generated      ${safeTerminalValue(document.generatedAt, 'unknown')}`);
+        const receipt = lookupCollectionReceiptReview(document.collectionReceipt);
+        if (receipt) {
+            collectionLines.push(`Original plan  ${receipt.selection}`);
+            for (const choice of receipt.choices)
+                collectionLines.push(`${choice.label}: ${choice.selected ? 'selected' : 'not selected'}`);
+            for (const source of receipt.sources) {
+                collectionLines.push(`${source.label}: ${source.summary}; ${source.outcome}`);
+                collectionLines.push(`  ${source.explanation}`);
+            }
+            collectionLines.push('Collector start is local execution provenance, not proof of network delivery or complete evidence.');
+        }
+        else
+            collectionLines.push('Original plan  Not retained; original optional choices and collector starts are unknown.');
         const timing = terminalRecord(document.timing);
         if (Number(timing.totalMs) >= 0)
             collectionLines.push(`Total time     ${safeTerminalValue(timing.totalMs)} ms`);

package/cli/history-command-definitions.mjs

@@ -65,7 +65,7 @@ export const HISTORY_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Convert one saved lookup into a versioned evidence report.',
             example: 'whoisleuth export lookup.json --markdown',
-            boundary: `Saved Lookup versions 1 and 2 are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
+            boundary: `Supported saved Lookups are capped at 8 MiB and scanned for duplicate keys, the prototype-sensitive __proto__ key, and bounded nesting, key, value, and per-container counts before parsing. Current schema-${LOOKUP_EVIDENCE_SCHEMA_VERSION} exports preserve evidence-source attribution and limitations; published v2 schemas ${PUBLISHED_V2_LOOKUP_EVIDENCE_VERSIONS} and exact v1 schema ${V1_PUBLIC_LOOKUP_EVIDENCE_SCHEMA_VERSION} remain readable, while other historical and unreleased shapes are unsupported. Markdown and HTML include a presentation-only generator footer unless --no-attribution is selected; JSON retains bounded generator provenance. Compact output intentionally omits raw registry payloads.`,
         },
         collection: { scope: 'Reads one saved Lookup and writes one bounded report.' },
         summary: 'Convert a lookup to an evidence report',

package/cli/investigation-plan.mjs

@@ -75,6 +75,7 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
             `${recipe.id} — ${recipe.label}`,
             `  Subject: ${recipe.subjectRequirement.replaceAll('_', ' ')}`,
             `  Workflow run: ${recipe.runnableByWorkflowRun ? 'supported' : 'plan and explanation only'}`,
+            ...formatWorkflowEffort(recipe.id, recipe.steps).map((line) => `  ${line}`),
             `  ${recipe.objective}`,
             ...recipe.steps.map((item, index) => `  ${index + 1}. ${item.label} [${item.mode}; ${item.approval.replaceAll('_', ' ')}]`),
             ...recipe.limitations.map((item) => `  Limitation: ${item}`),
@@ -84,6 +85,19 @@ export function formatWorkflowRecipeCatalogue(catalogue) {
         '',
     ].join('\n');
 }
+function formatWorkflowEffort(recipeId, steps) {
+    const counts = { network: 0, offline: 0 };
+    for (const step of steps)
+        counts[step.mode] += 1;
+    const reuse = workflowStandardInputs(recipeId).length;
+    return [
+        `Work planned: ${counts.network} networked step${counts.network === 1 ? '' : 's'}; ${counts.offline} offline step${counts.offline === 1 ? '' : 's'}.`,
+        reuse
+            ? `Evidence reuse: ${reuse} link${reuse === 1 ? '' : 's'} from earlier outputs to later steps.`
+            : 'Evidence reuse: no earlier-output links are declared.',
+        'Counts describe steps and reuse links, not requests. Saved files and cache state are not checked.',
+    ];
+}
 function validatedSteps(steps) {
     for (const step of steps) {
         const invocationEffect = cliInvocationNetworkEffect(step.command, step.arguments);
@@ -147,6 +161,7 @@ export function formatInvestigationPlan(plan) {
         `Investigation plan: ${plan.recipe.label}`,
         `Subject  ${plan.subject}`,
         `Mode     ${plan.execution}`,
+        ...formatWorkflowEffort(plan.recipe.id, plan.steps),
         '',
         ...plan.steps.flatMap((item, index) => [
             `${index + 1}. ${item.label}`,

package/cli/lookup-brief.mjs

@@ -214,23 +214,29 @@ export function buildCliLookupBrief(input, generatedAt = new Date().toISOString(
     });
 }
 export function formatCliLookupBrief(document) {
+    const sourceFacts = document.sourceHealth.flatMap((source) => {
+        const facts = document.facts.filter((item) => item.source.id === source.id);
+        return [
+            `  ${safeTerminalValue(source.label)} [${safeTerminalValue(source.state)}; ${source.observedAt ? `observed ${safeTerminalValue(source.observedAt)}` : 'source time not recorded'}]`,
+            ...(facts.length
+                ? facts.map((item) => `    ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)}`)
+                : ['    No fact selected for this brief.']),
+        ];
+    });
     return [
         `Lookup brief: ${safeTerminalValue(document.target)}`,
         `Observed  ${safeTerminalValue(document.observedAt)}`,
         `Mode      ${safeTerminalValue(document.mode)}`,
         '',
         'Source-attributed facts',
-        ...(document.facts.length ? document.facts.map((item) => `  ${safeTerminalValue(item.label)}: ${safeTerminalValue(item.value)} (${safeTerminalValue(item.source.label)}; ${safeTerminalValue(item.source.state)}; ${item.source.observedAt ? `observed ${safeTerminalValue(item.source.observedAt)}` : 'source time not recorded'})`) : ['  No bounded fact was available.']),
+        ...sourceFacts,
         '',
         'Contradictions',
         ...(document.contradictions.length ? document.contradictions.flatMap((item) => [
             `  ${safeTerminalValue(item.field)}: ${safeTerminalValue(item.detail)}`,
-            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (${safeTerminalValue(observation.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
+            ...item.observations.map((observation) => `    ${safeTerminalValue(observation.source.label)}: ${safeTerminalValue(observation.value)} (value state: ${safeTerminalValue(observation.state)}; source state: ${safeTerminalValue(observation.source.state)}; ${observation.source.observedAt ? `observed ${safeTerminalValue(observation.source.observedAt)}` : 'source time not recorded'})`),
         ]) : ['  No conflicting publication field was retained.']),
         '',
-        'Unknown or incomplete',
-        ...(document.unknowns.length ? document.unknowns.map((item) => `  ${safeTerminalValue(item)}`) : ['  No incomplete source state was identified.']),
-        '',
         'Recommended manual actions',
         ...document.actionPlan.flatMap((item, index) => [
             `  ${index + 1}. ${safeTerminalValue(item.action)}`,

package/cli/lookup-command-runner.mjs

@@ -13,7 +13,8 @@ import { buildCliLookupPlan, formatCliLookupPlan } from "./lookup-plan.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { serializeCliLookupDocument } from "./saved-lookup.mjs";
 import { lookupStrictExitFindings } from "./strict-exit.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { evaluateCliFailPolicies, reportCliFailPolicies } from "./fail-policy.mjs";
+import { readCliRiskProfile } from "./risk-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
 import { browseLookupOperation, canBrowseLookup } from "./lookup-browser.mjs";
 import { writePrivateFile } from "./output-file.mjs";
@@ -66,26 +67,34 @@ async function runLookupCommand(args, dependencies, context) {
             : context.terminal(formatCliLookupPlan(plan), args.color));
         return EXIT_CODES.SUCCESS;
     }
+    const riskProfile = await readCliRiskProfile(args.brandProfileSource, context.readInput, args.brandProfileId);
     let documentGeneratedAt = '';
-    const buildDocument = (result) => {
+    const buildDocument = ({ result, collectionReceipt }) => {
         documentGeneratedAt = context.now();
         return buildCliLookupDocument(query, classified, result, documentGeneratedAt, args.deep ? 'deep' : 'fast', {
+            collectionReceipt,
             ...(args.observerLabel ? { observerLabel: args.observerLabel } : {}),
             ...(args.vantageLabel ? { vantageLabel: args.vantageLabel } : {}),
         });
     };
-    const collect = (signal, onSourceSettled) => abortable(() => executeLookup(classified, {
-        fast: !args.deep,
-        compact: false,
-        ...(signal ? { signal } : {}),
-        ...(args.deep ? {
-            ...(selectedUrl ? { selectedUrl } : {}),
-            onSourceSettled: settlement => {
-                onSourceSettled(settlement);
-                eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
-            },
-        } : {}),
-    }), signal);
+    const collect = (signal, onSourceSettled) => abortable(async () => {
+        let collectionReceipt;
+        const result = await executeLookup(classified, {
+            fast: !args.deep,
+            compact: false,
+            onCollectionReceipt: value => { collectionReceipt = value; },
+            ...(signal ? { signal } : {}),
+            ...(args.deep ? {
+                ...(selectedUrl ? { selectedUrl } : {}),
+                onSourceSettled: settlement => {
+                    onSourceSettled(settlement);
+                    eventProgress.emit({ event: 'source_settled', source: settlement.source, state: settlement.state });
+                },
+            } : {}),
+        });
+        signal?.throwIfAborted();
+        return { result, collectionReceipt };
+    }, signal);
     let document;
     if (args.browse === true) {
         const browse = dependencies.browseLookupOperation || browseLookupOperation;
@@ -132,6 +141,8 @@ async function runLookupCommand(args, dependencies, context) {
         }
         document = buildDocument(result);
     }
+    const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || [], riskProfile);
     if (!args.quiet) {
         if (args.output === 'json')
             context.writeStdout(serializeCliLookupDocument(document));
@@ -149,14 +160,11 @@ async function runLookupCommand(args, dependencies, context) {
             context.writeStdout(context.terminal(formatTerminalLookup(document, { detail: args.detail }), args.color));
         }
     }
-    const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
-    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
     const exitCode = strictFindings.length || policyFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     if (strictFindings.length && !args.events) {
         context.writeStderr(`Strict exit: ${strictFindings.length} requested source state${strictFindings.length === 1 ? '' : 's'} were incomplete.\n`);
     }
-    if (policyFindings.length && !args.events)
-        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    reportCliFailPolicies(policyFindings, context.writeStderr, eventProgress);
     eventProgress.emit({ event: 'completed', exitCode });
     return exitCode;
 }

package/cli/lookup-diff.mjs

@@ -83,6 +83,7 @@ function lookupComparisonInput(document) {
         trusted: null,
         error: '',
         scanDepth: document.mode,
+        webCollectionQuality: availability.webCollectionQuality,
         createdDate: lifecycleValue(preferredRegistry, 'createdDate'),
         expiryDate: lifecycleValue(preferredRegistry, 'expiryDate'),
         nameservers: relationship.nameservers.length ? relationship.nameservers : stringList(preferredRegistry.nameservers, 20),