@slicedearth/whoisleuth-cli 2.6.0 → 2.8.0

package/cli/review-command-definitions.mjs

@@ -9,7 +9,7 @@ import { CLI_CASE_OPERATIONS, CLI_INDICATOR_OPERATIONS, positional, OPTIONAL_FIL
 export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     "verify-artifact": commandSeed({
         reference: {
-            description: 'Validate a supported archive, ordinary Case export, claim passport, packet, manifest, saved Lookup or Lookup-evidence export without printing evidence contents. Use --package for an evidence ZIP or encrypted package, with --passphrase-file to unlock it; use --folder ./evidence for an unencrypted evidence folder. Add --bagit with --package or --folder to verify BagIt 1.0.',
+            description: 'Validate a supported archive, ordinary case export, claim passport, packet, manifest, saved Lookup or Lookup-evidence export without printing evidence contents. Use --package for an evidence ZIP or encrypted package, with --passphrase-file to unlock it; use --folder ./evidence for an unencrypted evidence folder. Add --bagit with --package or --folder to verify BagIt 1.0.',
             example: 'whoisleuth verify-artifact report.json --manifest manifest.json --manifest-entry artifact-2 --json --strict-exit',
             boundary: 'Verification is offline and redacted. ZIP and folder entries are reported separately without importing them. Case exports are checked without repairing content; ordinary package review also counts original references with matching bytes. Ordinary folders allow only the declared layout; BagIt allows bounded nested payloads and checks SHA-256/SHA-512 manifests without interpreting payloads. Symbolic links are refused. BagIt fetch.txt is never fetched; missing files, mismatches and unsupported algorithms remain explicit. Package digests describe bytes, not filesystem metadata or authenticity. In scripts, use --strict-exit: incomplete verification returns 4. Unencrypted workspace archives always return 4 under --strict-exit because section digests do not cover mutable root metadata; structure-only formats can pass their narrower contract. Default exit 0 means the report was produced, not that its checks passed.',
         },
@@ -56,9 +56,9 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     "source-report": commandSeed({
         reference: {
-            description: 'Create a target-free reliability summary from a saved lookup.',
+            description: 'Summarise source reliability from saved Lookup or Bulk evidence, or merge source-reliability reports.',
             example: 'whoisleuth source-report lookup.json --json',
-            boundary: 'The report retains source states and timings but excludes targets, queries, endpoints, and raw evidence.',
+            boundary: 'Accepts supported Lookup, Bulk or Bulk-item documents, or an unmixed set of source-reliability reports. Retains source states and timings but excludes targets, queries, endpoints and raw evidence.',
         },
         collection: { scope: 'Reads bounded saved evidence and emits target-free source reliability data.' },
         summary: 'Build a target-free source report',
@@ -160,7 +160,7 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
             example: 'whoisleuth intake email message.eml --json',
             boundary: 'Offline only: no destination, embedded command, phone number or QR payload is opened, contacted or executed. Output omits original bodies, subjects, address local parts, URL paths, queries and fragments. Literal IPs and labelled hashes are bounded text observations, not lookup targets or verdicts; headers, URL contents, QR, HAR and identity-event fields are not scanned for them. Plain-text phone discovery writes only counts, source digest, ranges and status to stderr; --quiet suppresses it. Optional --intake-context reads one separate file up to 8 KiB, not stdin. Version 1 carries distribution declarations; version 2 can also bind explicit phone selections and a supplied destination pair to the exact input digest. Selected phone strings and source declarations enter output; unselected candidates and exact private URLs do not. Authentication headers remain attributed claims. Selected PDF and DOCX review retains part identities and extraction coverage; embedded raster QR support does not imply complete rendered-page review. HAR retains minimised request order and timings, never replay authority, headers, cookies or bodies. Use --strict-exit to return 4 for partial coverage.',
         },
-        collection: { scope: 'Reads one selected text, MIME email, calendar, PNG, PDF, DOCX, HAR or identity-event JSON file and, only with --intake-context, one bounded declaration/selection file. No collection or automatic Case write.' },
+        collection: { scope: 'Reads one selected text, MIME email, calendar, PNG, PDF, DOCX, HAR or identity-event JSON file and, only with --intake-context, one bounded declaration/selection file. No collection or automatic case write.' },
         summary: 'Review selected files and identity events offline',
         options: ['--json', '--reported-action', '--trusted-auth-header', '--intake-context', '--strict-exit', '--quiet', '--no-color'],
         positionals: Object.freeze([positional('kind', 'enum', 1, 1, MESSAGE_INTAKE_KINDS), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),
@@ -226,12 +226,12 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     case: commandSeed({
         reference: {
-            description: 'Show or open a local Case, append a note or evidence pin, link evidence, record an assessment or offline recheck, retain an incident-link, create an action, append an action-event, save a recheck-question, or close-object. JSON mutations use --input; notes use --text or --note-file. Link input contains fromPinId, toPinId, kind and basis. Action-event input contains id and transition. Explicit responseObjects bind an action; a typed objectOutcome requires an explicit affected subset on its event. Object closure never closes other objects or the Case. Mutations require --output and write the complete current Case export.',
+            description: 'Show or open a local case, append a note or evidence pin, link evidence, record an assessment or offline recheck, retain an incident-link, create an action, append an action-event, save a recheck-question, or close-object. JSON mutations use --input; notes use --text or --note-file. Link input contains fromPinId, toPinId, kind and basis. Action-event input contains id and transition. Explicit responseObjects bind an action; a typed objectOutcome requires an explicit affected subset on its event. Object closure never closes other objects or the case. Mutations require --output and write the complete current case export.',
             example: 'whoisleuth case open --domain example.test --output cases.json\n  whoisleuth case show cases.json\n  whoisleuth case note cases.json --text "Review the retained observation" --output cases.json --force',
-            boundary: 'No database, browser launch, request or external report is created. Select --case-id when a file contains multiple Cases. Existing files require --force; --expect-file-digest sha256:<digest> additionally checks the exact file reviewed earlier. Source and output leases reject concurrent changes. Interrupted .workflow.lock files require deliberate inspection. Recheck records supplied observations; it does not collect them. Not reproduced requires an existing saved question, a complete observation and comparable conditions. Working exports include private analyst content and file references, not attached file bytes.',
+            boundary: 'No database, browser launch, request or external report is created. Select --case-id when a file contains multiple cases. Existing files require --force; --expect-file-digest sha256:<digest> additionally checks the exact file reviewed earlier. Source and output leases reject concurrent changes. Interrupted .workflow.lock files require deliberate inspection. Recheck records supplied observations; it does not collect them. Not reproduced requires an existing saved question, a complete observation and comparable conditions. Working exports include private analyst content and file references, not attached file bytes.',
         },
-        collection: { scope: `Reads exact Case schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')}. Input is bounded to ${MAX_EDITABLE_CASE_INPUT_BYTES / 1024 / 1024} MiB including formatting; the complete canonical Case store must fit ${MAX_CASE_STORE_BYTES / 1024 / 1024} MiB without pruning. Writes current schema ${CASE_SCHEMA_VERSION}.` },
-        summary: 'Review and update ordinary local Case files',
+        collection: { scope: `Reads exact case schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')}. Input is bounded to ${MAX_EDITABLE_CASE_INPUT_BYTES / 1024 / 1024} MiB including formatting; the complete canonical case store must fit ${MAX_CASE_STORE_BYTES / 1024 / 1024} MiB without pruning. Writes current schema ${CASE_SCHEMA_VERSION}.` },
+        summary: 'Review and update ordinary local case files',
         options: ['--case-id', '--domain', '--title', '--new-incident', '--text', '--note-file', '--input', '--expect-file-digest', '--json', '--no-color'],
         positionals: Object.freeze([positional('operation', 'enum', 1, 1, CLI_CASE_OPERATIONS), positional('source', 'file', 0, 1)]),
         constraints: Object.freeze([constraint({ kind: 'mutually_exclusive', options: ['--text', '--note-file'] })]),
@@ -256,11 +256,11 @@ export const REVIEW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     "case-pack": commandSeed({
         reference: {
-            description: `Package browser-created Case records from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} as a reviewed, audience-specific Case-pack v2 with current schema ${CASE_SCHEMA_VERSION}.`,
+            description: `Package browser-created case records from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} as a reviewed, audience-specific Case-pack v2 with current schema ${CASE_SCHEMA_VERSION}.`,
             example: 'whoisleuth case-pack cases.json --audience trusted --reviewed --json',
-            boundary: 'The command creates a separate offline package without changing the source or durable Cases and requires an explicit review acknowledgement. Every audience, including public, retains domain evidence, Case, pin and decision identifiers, tags, decision summaries and rationale. Review that analyst-authored content as well as the exclusions before sharing.',
+            boundary: 'The command creates a separate offline package without changing the source or durable cases and requires an explicit review acknowledgement. Every audience, including public, retains domain evidence, case, pin and decision identifiers, tags, decision summaries and rationale. Review that analyst-authored content as well as the exclusions before sharing.',
         },
-        collection: { scope: `Reads one bounded Case export from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} and writes a separate audience-specific Case-pack v2.` },
+        collection: { scope: `Reads one bounded case export from schemas ${CLI_CASE_PACK_INPUT_CASE_VERSIONS.join(' or ')} and writes a separate audience-specific Case-pack v2.` },
         summary: 'Build a reviewed case package',
         options: ['--audience', '--reviewed', '--json', '--quiet', '--no-color'],
         positionals: OPTIONAL_FILE_POSITIONAL,

package/cli/risk-policy.mjs

@@ -0,0 +1,83 @@
+import { analyzeDomainIdn } from "../lib/idn-confusables.mjs";
+import { profileSignals } from "../packages/analysis/brand-profile-signals.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../packages/analysis/bounded-json.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
+import { explainRiskScore } from "../packages/analysis/risk-scoring.mjs";
+import { BRAND_PROFILE_SCHEMA, MAX_PROFILES, MAX_PROFILE_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
+import { CliUsageError } from "./errors.mjs";
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+/** Read one explicitly selected export, not browser storage or configuration. */
+export async function readCliRiskProfile(source, readInput, selectedId) {
+    if (!source)
+        return null;
+    const text = await readInput(source, MAX_PROFILE_IMPORT_BYTES, 'Brand Profile export');
+    try {
+        const raw = parseBoundedJsonObject(text, {
+            maximumBytes: MAX_PROFILE_IMPORT_BYTES, limits: boundedJsonLimitsForBytes(MAX_PROFILE_IMPORT_BYTES), label: 'Brand Profile export',
+        });
+        if (raw.schema !== BRAND_PROFILE_SCHEMA || typeof raw.version !== 'number'
+            || !Array.isArray(raw.profiles) || !raw.profiles.length || raw.profiles.length > MAX_PROFILES)
+            throw new TypeError();
+        const { normalizeBrandProfileId, normalizeBrandProfileStore } = await import("../packages/workspace/brand-profile-model.mjs");
+        if (selectedId !== undefined && normalizeBrandProfileId(selectedId) !== selectedId)
+            throw new TypeError();
+        const selected = selectedId === undefined ? raw.profiles : raw.profiles.filter(value => record(value).id === selectedId);
+        if (selected.length !== 1)
+            throw new TypeError();
+        const profile = normalizeBrandProfileStore({ ...raw, profiles: selected }).profiles[0];
+        if (!profile || !profile.officialDomains.length)
+            throw new TypeError();
+        // Private notes, contacts and other profile fields never enter output or
+        // checkpoints. Keep only the existing comparison inputs for this run.
+        return {
+            officialDomains: profile.officialDomains,
+            approvedPartnerDomains: profile.approvedPartnerDomains,
+            allowlistedDomains: profile.allowlistedDomains,
+            officialFaviconHash: profile.officialFaviconHash,
+            officialFaviconPHash: profile.officialFaviconPHash,
+        };
+    }
+    catch {
+        throw new CliUsageError('Use a supported Brand Profile export with a valid official domain; select one unambiguous profile with --brand-id if the export contains multiple profiles.');
+    }
+}
+/** Adapt collected evidence, never an asserted score, lane or severity label. */
+export function explainCliLookupRisk(document, profile, mode = document.mode) {
+    if (document.type !== undefined && document.type !== 'domain')
+        return null;
+    const availability = record(document.availability);
+    const domain = canonicalRegistrableDomain(document.registrableDomain ?? document.domain ?? availability.domain);
+    if (!domain || canonicalRegistrableDomain(availability.domain) !== domain)
+        return null;
+    const diagnostics = record(document.diagnostics);
+    const sourceCoverage = [
+        ...['rdap', 'whois', 'availability'].map(source => ({ source, state: record(diagnostics[source]).status })),
+        ...['dns', 'http', 'tls', 'pageIdentity'].map(source => ({
+            source: source === 'pageIdentity' ? 'page-identity' : source,
+            state: record(availability[source]).status,
+        })),
+    ].map(item => ({ ...item, state: item.state === 'disabled' ? 'skipped' : item.state }));
+    return explainRiskScore({
+        domain,
+        availability: availability.state,
+        ...profileSignals(domain, availability, profile),
+        hasActiveBrandProfile: Boolean(profile),
+        idnReferenceMatch: profile ? Boolean(analyzeDomainIdn(domain, profile.officialDomains)?.referenceMatches.length) : null,
+        mutationTypes: document.mutationTypes,
+        hasPasswordField: availability.hasPasswordField,
+        hasExternalFormAction: availability.hasExternalFormAction,
+        hasExternalPasswordForm: availability.hasExternalPasswordForm,
+        phishingLanguageMatch: availability.phishingLanguageMatch,
+        activityStatus: availability.activityStatus,
+        hasMx: availability.hasMx,
+        hasSpf: availability.hasSpf,
+        hasDmarc: availability.hasDmarc,
+        domainAgeDays: availability.domainAgeDays,
+        privacyProtected: availability.privacyProtected,
+        scanDepth: mode,
+        observedAt: document.observedAt ?? record(availability.http).observedAt,
+        sourceCoverage,
+    });
+}

package/cli/saved-lookup.mjs

@@ -7,7 +7,8 @@ import { CliUsageError } from "./errors.mjs";
 import { validHttpDeliveryMetadata, validPagePublicationMetadata, } from "../lib/homepage-metadata-contract.mjs";
 import { registrarStandingObservedBy, resolveRegistrarIanaId, validRegistrarStanding, } from "../lib/registrar-standing-contract.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-import { CLI_LOOKUP_SCHEMA as SAVED_LOOKUP_SCHEMA, CLI_LOOKUP_VERSION as SAVED_LOOKUP_SCHEMA_VERSION, PUBLIC_CLI_LOOKUP_VERSION as PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION, MAX_CLI_LOOKUP_BYTES as MAX_SAVED_LOOKUP_INPUT_BYTES, MAX_CLI_LOOKUP_JSON_CONTAINER_ITEMS as MAX_BOUNDED_JSON_CONTAINER_ITEMS, MAX_CLI_LOOKUP_JSON_DEPTH as MAX_BOUNDED_JSON_DEPTH, MAX_CLI_LOOKUP_JSON_KEYS as MAX_BOUNDED_JSON_KEYS, MAX_CLI_LOOKUP_JSON_VALUES as MAX_BOUNDED_JSON_VALUES, MAX_CLI_LOOKUP_STRING_LENGTH as MAX_SAVED_LOOKUP_STRING_LENGTH, SUPPORTED_CLI_LOOKUP_VERSIONS as SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, } from "../packages/contracts/cli-lookup.mjs";
+import { parseLookupCollectionReceipt } from "../packages/evidence/lookup-collection-receipt.mjs";
+import { CLI_LOOKUP_SCHEMA as SAVED_LOOKUP_SCHEMA, CLI_LOOKUP_VERSION as SAVED_LOOKUP_SCHEMA_VERSION, PUBLIC_CLI_LOOKUP_VERSION as PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION, HOMEPAGE_CLI_LOOKUP_VERSION, COLLECTION_RECEIPT_CLI_LOOKUP_VERSION, MAX_CLI_LOOKUP_BYTES as MAX_SAVED_LOOKUP_INPUT_BYTES, MAX_CLI_LOOKUP_JSON_CONTAINER_ITEMS as MAX_BOUNDED_JSON_CONTAINER_ITEMS, MAX_CLI_LOOKUP_JSON_DEPTH as MAX_BOUNDED_JSON_DEPTH, MAX_CLI_LOOKUP_JSON_KEYS as MAX_BOUNDED_JSON_KEYS, MAX_CLI_LOOKUP_JSON_VALUES as MAX_BOUNDED_JSON_VALUES, MAX_CLI_LOOKUP_STRING_LENGTH as MAX_SAVED_LOOKUP_STRING_LENGTH, SUPPORTED_CLI_LOOKUP_VERSIONS as SUPPORTED_SAVED_LOOKUP_SCHEMA_VERSIONS, } from "../packages/contracts/cli-lookup.mjs";
 const RDAP_STATUSES = new Set([
     'success', 'complete', 'partial', 'error', 'unsupported', 'not_found', 'skipped', 'disabled',
     'unavailable', 'rate_limited', 'not_applicable', 'stale',
@@ -317,23 +318,31 @@ function assertLookupEnvelope(document, label) {
     const publicationMetadata = pageIdentity?.publicationMetadata;
     const deliveryMetadata = httpResponse?.deliveryMetadata;
     const registrarStanding = document.registrarStanding;
+    if (document.collectionReceipt !== undefined) {
+        if (Number(document.version) < COLLECTION_RECEIPT_CLI_LOOKUP_VERSION)
+            throw new TypeError(`${label} collection receipt requires saved Lookup version ${COLLECTION_RECEIPT_CLI_LOOKUP_VERSION}.`);
+        const receipt = parseLookupCollectionReceipt(document.collectionReceipt);
+        if (receipt.targetClass !== document.type || receipt.requestedDepth !== document.mode) {
+            throw new TypeError(`${label} collection receipt does not match the Lookup.`);
+        }
+    }
     if (document.version === PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION
         && (publicationMetadata !== undefined || deliveryMetadata !== undefined || registrarStanding !== undefined)) {
-        throw new TypeError(`${label} version ${PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION} cannot contain version ${SAVED_LOOKUP_SCHEMA_VERSION} evidence fields.`);
+        throw new TypeError(`${label} version ${PUBLIC_SAVED_LOOKUP_SCHEMA_VERSION} cannot contain version ${HOMEPAGE_CLI_LOOKUP_VERSION} evidence fields.`);
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && (publicationMetadata !== undefined && (!['success', 'partial'].includes(String(pageIdentity?.status))
             || !validPagePublicationMetadata(publicationMetadata))
             || deliveryMetadata !== undefined && (!['success', 'partial'].includes(String(http?.status))
                 || !validHttpDeliveryMetadata(deliveryMetadata)))) {
         throw new TypeError(`${label} contains invalid homepage metadata.`);
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && registrarStanding !== undefined
         && !validRegistrarStanding(registrarStanding)) {
         throw new TypeError(`${label} contains invalid registrar standing.`);
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && registrarStanding !== undefined
         && !registrarStandingObservedBy(registrarStanding, generatedAt)) {
         throw new TypeError(`${label} registrar standing was observed after the saved Lookup time.`);
@@ -346,7 +355,7 @@ function assertLookupEnvelope(document, label) {
     if ((whoisStatus === 'complete' || whoisStatus === 'partial') && !whoisParsed) {
         throw new TypeError('Successful WHOIS input is missing normalised parsed data.');
     }
-    if (document.version === SAVED_LOOKUP_SCHEMA_VERSION
+    if (document.version >= HOMEPAGE_CLI_LOOKUP_VERSION
         && validRegistrarStanding(registrarStanding)
         && registrarStanding.ianaId !== resolveRegistrarIanaId(rdapParsed, whoisParsed)) {
         throw new TypeError(`${label} registrar standing does not match its retained registration sources.`);
@@ -430,7 +439,7 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         throw new TypeError('Lookup document generation time must be valid and include an explicit timezone.');
     }
     const classifiedSnapshot = snapshotKnownDataFields(classified, 'Lookup classification', new Set(['type', 'value', 'inputHostname', 'registrableDomain', 'isSubdomain']));
-    const contextSnapshot = snapshotKnownDataFields(collectionContext, 'Lookup collection context', new Set(['observerLabel', 'vantageLabel']));
+    const contextSnapshot = snapshotKnownDataFields(collectionContext, 'Lookup collection context', new Set(['observerLabel', 'vantageLabel', 'collectionReceipt']));
     const observerLabel = typeof contextSnapshot.observerLabel === 'string'
         ? contextSnapshot.observerLabel
         : null;
@@ -439,6 +448,12 @@ function buildCliLookupDocument(query, classified, result, generatedAt = new Dat
         : null;
     const resultSnapshot = snapshotLookupResultRoot(result);
     delete resultSnapshot.collectionContext;
+    if (Object.hasOwn(contextSnapshot, 'collectionReceipt')) {
+        delete resultSnapshot.collectionReceipt;
+        const receipt = parseLookupCollectionReceipt(contextSnapshot.collectionReceipt);
+        if (receipt)
+            resultSnapshot.collectionReceipt = receipt;
+    }
     const classifiedType = classifiedSnapshot.type;
     if (typeof classifiedType !== 'string' || !QUERY_TYPES.has(classifiedType)) {
         throw new TypeError('Lookup classification has an unsupported query type.');

package/cli/source-reliability.mjs

@@ -730,6 +730,8 @@ export function buildSourceReliabilityReport(raw, generatedAt = new Date().toISO
     });
 }
 export function formatSourceReliabilityReport(report) {
+    const duration = (value) => value
+        ? `median ${value.median} ms / p95 ${value.p95} ms (range ${value.minimum}-${value.maximum} ms)` : 'unmeasured';
     const lines = [
         'WHOISleuth source reliability report',
         `Documents: ${report.documentsReviewed}`,
@@ -741,16 +743,16 @@ export function formatSourceReliabilityReport(report) {
         `Exceptions: ${report.totals.truncations} truncated · ${report.totals.rateLimits} rate-limited`,
     ];
     for (const source of report.sources) {
-        const states = Object.entries(source.states).map(([state, count]) => `${state} ${count}`).join(', ') || 'none';
-        const timing = source.durationMs.lookupTiming;
-        const timingTrend = source.durationTrend.reportTimingMedian;
-        lines.push(`${source.source}: ${states}; truncated ${source.truncationCount}; rate-limited ${source.rateLimitedCount}`
-            + `; failure rate ${source.rates.failure ?? 'unmeasured'}; partial rate ${source.rates.partial ?? 'unmeasured'}`
-            + (timing ? `; timing median ${timing.median} ms / p95 ${timing.p95} ms` : '')
-            + (timingTrend ? `; report-median distribution ${timingTrend.minimum}-${timingTrend.maximum} ms` : '')
-            + (source.durationTimeline.length ? `; timeline points ${source.durationTimeline.length}` : ''));
-    }
-    lines.push('Privacy: targets 0 · queries 0 · raw evidence 0');
+        const states = Object.entries(source.states).map(([state, count]) => `${state} ${count}`).join(', ') || 'no states retained';
+        lines.push('', source.source, `  Collection states: ${states}`, `  Samples: states ${source.samples.states} · observations ${source.samples.observations} · Lookup timings ${source.samples.timing}`, `  Exceptions: ${source.truncationCount} truncated · ${source.rateLimitedCount} rate-limited`, `  Rates (0–1): failure ${source.rates.failure ?? 'unmeasured'} · partial ${source.rates.partial ?? 'unmeasured'}`, `  Observation duration: ${duration(source.durationMs.observation)}`, `  Lookup timing: ${duration(source.durationMs.lookupTiming)}`);
+        if (source.durationTrend.reportObservationMedian)
+            lines.push(`  Merged observation-median distribution: ${duration(source.durationTrend.reportObservationMedian)}`);
+        if (source.durationTrend.reportTimingMedian)
+            lines.push(`  Merged Lookup-median distribution: ${duration(source.durationTrend.reportTimingMedian)}`);
+        if (source.durationTimeline.length)
+            lines.push(`  Retained report timeline: ${source.durationTimeline.length} points`);
+    }
+    lines.push('', 'Privacy: targets 0 · queries 0 · raw evidence 0');
     for (const limitation of report.limitations)
         lines.push(`Limitation: ${limitation}`);
     return `${lines.join('\n')}\n`;

package/cli/support-arguments.mjs

@@ -9,7 +9,7 @@ export const SUPPORT_ARGUMENT_PARSERS = Object.freeze({
     doctor: (parsed) => ({
         action: 'doctor',
         network: parsed.hasOption('--network'),
-        output: jsonOutput(parsed),
+        output: parsed.hasOption('--summary-json') ? 'summary_json' : jsonOutput(parsed),
         ...terminalOptions(parsed),
     }),
     commands: (parsed) => ({

package/cli/support-command-definitions.mjs

@@ -1,4 +1,5 @@
 import { RISK_CALIBRATION_DATASET_SCHEMA, RISK_CALIBRATION_REPORT_SCHEMA } from "../packages/contracts/risk-calibration.mjs";
+import { DOCTOR_SCHEMA, DOCTOR_SUMMARY_SCHEMA } from "../packages/contracts/cli-doctor.mjs";
 import { positional, NO_POSITIONALS, OPTIONAL_FILE_POSITIONAL, constraint, EMPTY_CONSTRAINTS, commandSeed, text } from "./command-definition.mjs";
 export const SUPPORT_COMMAND_DEFINITIONS = Object.freeze({
     completion: commandSeed({
@@ -25,17 +26,17 @@ export const SUPPORT_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Check the supported runtime and local terminal capabilities.',
             example: 'whoisleuth doctor --json',
-            boundary: 'The default check is offline. Public DNS and port 43 checks run only when --network is explicitly supplied.',
+            boundary: 'The default check is offline. Public DNS, HTTPS and port 43 checks run only with --network. --summary-json omits private context and free-form diagnostic details.',
         },
         collection: { scope: 'Network access is opt-in with --network and is limited to fixed public DNS, HTTPS, and WHOIS diagnostics.' },
         summary: 'Check the local CLI runtime',
-        options: ['--network', '--json', '--quiet', '--no-color'],
+        options: ['--network', '--json', '--summary-json', '--quiet', '--no-color'],
         positionals: NO_POSITIONALS,
-        constraints: EMPTY_CONSTRAINTS,
+        constraints: Object.freeze([constraint({ kind: 'mutually_exclusive', options: ['--json', '--summary-json'] })]),
         handlerOwner: 'support',
         networkEffect: 'conditional_network',
         common: true,
-        schemaIdentifiers: Object.freeze(['whoisleuth.cli.doctor']),
+        schemaIdentifiers: Object.freeze([DOCTOR_SCHEMA, DOCTOR_SUMMARY_SCHEMA]),
         primaryArtefacts: Object.freeze([]),
         planSupport: false,
         additionalOutputFormats: Object.freeze([]),

package/cli/support-command-runner.mjs

@@ -4,7 +4,7 @@ import { explainRiskScore, explainRiskScoreV8, RISK_MODEL_VERSION, RISK_REVIEW_T
 import { buildCliCommandCatalogue, formatCliCommandCatalogue, selectCliCommands } from "./command-catalogue.mjs";
 import { CLI_COMMAND_REGISTRY, CLI_COMMANDS, COMMAND_COLLECTION, COMMAND_DETAILS, COMMAND_USAGE, } from "./command-reference.mjs";
 import { buildShellCompletion } from "./completion.mjs";
-import { buildDoctorReport, formatDoctorReport } from "./doctor.mjs";
+import { buildDoctorReport, buildDoctorSummary, formatDoctorReport } from "./doctor.mjs";
 import { boundedCliErrorMessage, CliUsageError } from "./errors.mjs";
 import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
@@ -68,9 +68,11 @@ async function runDoctorCommand(args, dependencies, context) {
         ? await context.withProgress('Checking public DNS, HTTPS, and WHOIS connectivity', buildReport)
         : await buildReport();
     if (!args.quiet) {
-        context.writeStdout(args.output === 'json'
-            ? formatJsonDocument(report)
-            : context.terminal(formatDoctorReport(report), args.color));
+        context.writeStdout(args.output === 'summary_json'
+            ? formatJsonDocument(buildDoctorSummary(report))
+            : args.output === 'json'
+                ? formatJsonDocument(report)
+                : context.terminal(formatDoctorReport(report), args.color));
     }
     return report.state === 'partial' ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
 }

package/cli/workflow-command-definitions.mjs

@@ -1,6 +1,7 @@
 import { INVESTIGATION_PLAN_RECIPES, RUNNABLE_INVESTIGATION_PLAN_RECIPES } from "./investigation-recipes.mjs";
 import { positional, OPTIONAL_FILE_POSITIONAL, constraint, commandSeed, integer, BASE_INTEGER_RANGE, file, optionDefinition } from "./command-definition.mjs";
 import { DOMAIN_FEED_CATALOGUE } from "../packages/monitoring/domain-feed.mjs";
+import { WATCHLIST_SCHEMA_VERSION } from "../packages/contracts/workspace-portability.mjs";
 export const WORKFLOW_COMMAND_DEFINITIONS = Object.freeze({
     'domain-feed': commandSeed({
         reference: { description: 'Review exact hosts or literal terms in a selected local plain-domain feed.',
@@ -18,7 +19,7 @@ export const WORKFLOW_COMMAND_DEFINITIONS = Object.freeze({
     }),
     'watchlist-review': commandSeed({
         reference: { description: 'Preview or export an explicit candidate selection to a local watchlist.', example: 'whoisleuth watchlist-review plan selection.json --json',
-            boundary: 'Reads bounded local JSON only. Plan shows exact domains, duplicates, per-domain outcomes, destination and review priority with zero additional requests. Export emits Watchlist schema 5 without creating a scan or baseline. Neither mode enables collection or scheduling.' },
+            boundary: `Reads bounded local JSON only. Plan shows exact domains, duplicates, per-domain outcomes, destination and review priority with zero additional requests. Export emits Watchlist schema ${WATCHLIST_SCHEMA_VERSION} without creating a scan or baseline. Neither mode enables collection or scheduling.` },
         collection: { scope: 'At most 2,000 selected candidate domains; no target requests.' },
         summary: 'Review a local candidate watchlist handoff', options: ['--json', '--quiet', '--no-color'],
         positionals: Object.freeze([positional('operation', 'enum', 1, 1, ['plan', 'export']), positional('source', 'file', 0, 1, [], 'argv_or_stdin')]),

package/cli/workflow-command-runner.mjs

@@ -88,6 +88,7 @@ async function runMonitorOnceCommand(args, dependencies, context) {
     const executeLookup = dependencies.runUnifiedLookup || (await import("../lib/lookup.mjs")).runUnifiedLookup;
     const progress = context.beginProgress('Collecting bounded domain-control evidence');
     let document;
+    let currentSourceFailureCount = 0;
     try {
         document = await runDomainControlMonitor(manifestInput, previousInput, {
             executeLookup,
@@ -95,6 +96,9 @@ async function runMonitorOnceCommand(args, dependencies, context) {
             limit: args.limit,
             concurrency: args.concurrency,
             ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            ...(args.failOn?.includes('source-failure') ? {
+                onSourceFailures: (count) => { currentSourceFailureCount = count; },
+            } : {}),
             onSettled: (completed, total) => progress.update(`Collected ${completed} of ${total} owned domains`),
         });
     }
@@ -108,7 +112,7 @@ async function runMonitorOnceCommand(args, dependencies, context) {
                 ? formatCliJunit(document)
                 : context.terminal(formatDomainControlMonitor(document), args.color));
     }
-    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || [], null, currentSourceFailureCount);
     if (policyFindings.length)
         context.writeStderr(formatFailPolicyNotice(policyFindings));
     return document.collection.failed || policyFindings.length

package/docs/cli-reference.md

@@ -71,11 +71,11 @@ candidate, form destination and deliberately observed navigation separately
 attributed. A similar page without a logo or brand name can still merit manual
 evidence review; correspondence does not establish authorship, rights authority
 or maliciousness. Missing optional capture or comparison evidence does not
-prevent ordinary Case pins and conclusions. Installed command help remains the
+prevent ordinary case pins and conclusions. Installed command help remains the
 authority for offline file inputs and explicit collection plans.
 
 The [reporting guide](https://www.whoisleuth.com/resources/reporting-and-takedown-guidance)
-uses the same reviewed official-route catalogue as the Console for social
+uses the same reviewed official-route catalogue as the console for social
 content, storefronts, app listings, hosted files/forms and advertising. Verify
 the exact object, current route, reporter authority and disclosure before any
 manual submission. Fraud, order complaints and rights notices are different
@@ -96,8 +96,10 @@ PKIX, STARTTLS and SMTP transport remain separate evidence states.
 STARTTLS detection uses the full bounded reply. If the retained capability
 inventory is shortened, the report remains partial and names the omission.
 
-The repository-only rendered-capture package is outside hosted and distributable
-collection. It executes remote page JavaScript only for an explicitly
+The separate optional rendered-capture companion is distributed as a locally
+assembled archive, not as part of the hosted application or main CLI, and is
+not published to a package registry. Its sandboxed, bounded browser executes
+remote page JavaScript only for an explicitly
 authorised route set, and each admitted resource operator receives the exact
 requested URL. Captures and screenshots remain local until the operator deletes
 them.
@@ -126,6 +128,13 @@ source state is unmeasured, not a negative result. `--csv` keeps the compact col
 `--fail-on` and `--strict-exit` expose selected evidence states to automation
 without changing the result document. Review focused help for the policies a
 command supports.
+Lookup, Bulk and Discover scan evaluate all collected and restored evidence,
+not only the rows retained by a filter. `danger` uses the canonical Risk model;
+select `--deep --brand-profile brand.json` for local reference comparisons, adding
+`--brand-id <exact-profile-id>` for a multi-profile export. A match returns 4 and identifies model and evidence
+quality on stderr. Missing/ineligible evidence is not zero risk and does not
+implicitly select another failure policy. See the
+[automation examples and limits](cli.md#formats-and-exit-behaviour).
 
 | Code | Meaning |
 | ---: | --- |
@@ -143,18 +152,46 @@ Readers accept only their declared public and current versions. Unknown,
 unreleased historical and future schemas fail before partial interpretation;
 an invalid import is not treated as an empty document.
 
-`inspect-archive` reads current workspace archive v9 and exact versions 5–8. It
+`inspect-archive` reads current workspace archive v10 and exact versions 5–9. It
 reports section metadata and digest-only search results unless `--reveal` is
 explicitly selected. It never searches notes, contacts or arbitrary raw fields.
 
-`export` reads supported saved Lookup v1 or v2 and writes current Lookup
-evidence schema 29. Published v2 schemas 27 and 28 and exact v1 schema 26 remain
-readable. Versions 27–29 exclude raw registration payloads, expanded
+`export` reads supported saved Lookup versions 1–3 and writes current Lookup
+evidence schema 31. Supported schemas 27–30 and exact v1 schema 26 remain
+readable. Versions 27–31 exclude raw registration payloads, expanded
 contacts, credentials, complete query-bearing URLs and provider payloads;
-schemas 28 and 29 also retain the bounded registrar-standing projection.
+Schemas 28 and later also retain the bounded registrar-standing projection.
 Schema 29 identifies the hostname used for DNS, TLS and web observations,
 separately from the registrable domain used by registration sources. Older
 evidence retains its original collection scope.
+Schema 31 retains WHOIS registration classification separately from collection
+completion. Lifecycle interpretation requires positive registration evidence;
+a completed negative or inconclusive WHOIS reply does not establish registration
+or absence of locks. Earlier exports retain their exact original interpretation
+for historical verification and are not silently relabelled.
+
+New WHOIS collection distinguishes confirmed no-service discovery from an
+incomplete discovery response. Empty, refused or unrecognised bootstrap
+responses remain partial; they do not establish that WHOIS is unsupported.
+`--strict-exit` treats that incomplete attempt as a source failure. Explicit
+no-request access-policy restrictions remain distinct from transport failures.
+
+Saved Lookup version 3 can retain a bounded collection receipt: original
+optional selections, admitted source families, collector starts, outcomes and
+explicitly known completeness. `lookup --verbose` and `lookup --browse`
+show this account with source-specific explanations and qualified retry guidance.
+Earlier files have no inferred receipt. The receipt contains
+no target values, URLs, contacts or raw errors and does not prove network
+delivery. It stays in full private Lookup JSON; the minimised `export` report
+does not include it. `--plan` remains offline and produces no completed receipt.
+
+Case schema 20 also retains this context when an analyst saves a completed Lookup
+assessment or selected checkpoint facts. A selected checkpoint saves only its
+selected pins and one payload-free receipt, not every Lookup result. Ordinary
+backups and internal case packs preserve it. Trusted/public case packs, case
+reports and response packets omit receipts; shared assessment identities are
+recomputed without them. Historical case formats remain readable without
+inventing missing collection choices.
 
 `verify-artifact` checks a recognised structure and its applicable integrity
 contract. `interchange-report` describes retained and omitted fields.
@@ -162,6 +199,14 @@ contract. `interchange-report` describes retained and omitted fields.
 validity and signer trust separate. None of these checks establishes that
 evidence is accurate, current, safe to share or attributable to a person.
 
+The text output of `verify-artifact` suggests compatible offline follow-up
+commands for recognised saved Lookups, case exports, workspace archives,
+Lookup-evidence reports, Case-packs and managed indicator revisions. These are
+examples with placeholder filenames, not executed actions or a sharing approval.
+Replace the filenames deliberately; a case or indicator inspection can display
+private contents. Encrypted workspace guidance uses a separate passphrase file,
+never a passphrase in command history. JSON output and `--quiet` are unchanged.
+
 ### Signer trust
 
 Use `verify-signature package.json --trust-store-file trust.json --json` to
@@ -211,9 +256,9 @@ own retention policy. No automatic key discovery, key storage or trust refresh o
   control, activity, intent or maliciousness.
 - Bulk applies one declared collection contract per target. Fast accepts up to
   500 targets and Deep up to 50; each target remains a separate request.
-- Respond commands package browser-created Cases and prepare local packets,
+- Respond commands package browser-created cases and prepare local packets,
   reports and sharing reviews. The offline [`case` workflow](cli.md#local-case-files)
-  also creates and updates ordinary local Case files through explicit, conflict-checked
+  also creates and updates ordinary local case files through explicit, conflict-checked
   output. Neither workflow submits, publishes, notifies or grants recipient authorisation.
 - Assurance, comparison and calibration commands describe supplied or retained
   evidence. They do not tune the running model, change infrastructure or turn an