@slicedearth/whoisleuth-cli 2.6.0 → 2.8.0

package/docs/cli.md

@@ -1,7 +1,5 @@
 # WHOISleuth CLI guide
 
-`review-evidence` also reviews bounded source-qualified infrastructure snapshots and explicit earlier/later comparison inputs entirely offline. See [infrastructure observations](infrastructure-observations.md) for the exact schemas, outcome semantics and retained-evidence limitations.
-
 The first-party CLI runs on the operator's machine and does not call the hosted
 WHOISleuth deployment. Use this guide for installation, common commands,
 collection boundaries and output. Installed `whoisleuth --help`, focused
@@ -14,6 +12,11 @@ tasks, then offers searchable commands with examples, option explanations and
 defaults. Command-section links can be bookmarked. Its option guidance and
 installed help derive from the same command definitions.
 
+Not sure which interface to use? The [installation-mode comparison](https://www.whoisleuth.com/cli#choose-mode)
+covers the hosted console, filesystem-local application, CLI and capture companion,
+including request origin, storage, offline use and distribution. The optional
+application and capture archives are separate from the public CLI package.
+
 The generated [privacy and data-flow catalogue](https://github.com/slicedearth/whoisleuth/blob/main/docs/privacy-data-flow-catalogue.md)
 lists the network, recipient, retention and export boundary for every command.
 
@@ -77,22 +80,35 @@ private document from the interactive view:
 
 ```bash
 whoisleuth lookup example.test --deep --browse --save-lookup lookup.json
+whoisleuth verify-artifact lookup.json --json
+whoisleuth export lookup.json --output evidence.json
+whoisleuth verify-artifact evidence.json --json
 ```
 
-In Console Lookup, open **Replay exported evidence**, select the file, verify
-its digest and source states, then create or update a browser-local Case. The
-file is not uploaded. Case classification, exact incident links and response
-actions remain deliberate analyst steps. Ordinary Case files also support the
+Keep `lookup.json` as the private CLI original. In Lookup in the console, open **Replay
+exported evidence**, select `evidence.json`, check its digest and source states,
+then create or update a browser-local case. The private CLI document is not a
+browser replay format; the separate evidence export excludes raw registration
+payloads and expanded contacts. Neither file is uploaded. Case classification, exact incident links and response
+actions remain deliberate analyst steps. Ordinary case files also support the
 offline CLI workflow below.
-When several incident Cases share a domain, select the intended Case before
-retaining replay evidence. Case packs preserve each current Case ID separately;
+When several incident cases share a domain, select the intended case before
+retaining replay evidence. Case packs preserve each current case ID separately;
 trusted and public packs exclude analyst-entered incident titles.
 Every audience retains tags, decision summaries and rationale as well as domain
-evidence and Case, pin and decision IDs. Public does not mean anonymous.
+evidence and case, pin and decision IDs. Public does not mean anonymous.
 Browser Lookup evidence can be verified or packaged in the CLI. `brief`,
 `export`, `compare`, `registry-doctor` and `source-report` instead require a
 saved CLI Lookup; they do not reconstruct it from a browser export.
 
+Registration source states are independent: `unsupported` means no RDAP or
+WHOIS service is published for the target, while `skipped` means no query was
+issued in that mode or under the registry access policy. Neither is a transport
+failure or a domain-absence finding. Standard terminal output explains these
+non-query outcomes; JSON and evidence exports retain their separate states.
+`--strict-exit` does not fail solely because a protocol is unsupported or skipped,
+but continues to report genuine failed or partial sources.
+
 Process selected local input:
 
 ```bash
@@ -146,6 +162,8 @@ For an explicit inherited-policy and direct parent-delegation review, use
 option, posture collection keeps its existing exact-name scope. The extra
 results distinguish recursive policy publication from sampled parent referrals;
 they do not establish name existence, message authentication or DNSSEC validity.
+The machine-readable posture document keeps its existing versioned fields;
+the website's transient structured policy scope is not included in that export.
 
 | Mode | Behaviour |
 | --- | --- |
@@ -160,6 +178,16 @@ their focused help. They do not use the hosted login or hosted usage controls.
 `lookup --plan` lists planned source families and disclosure targets before
 collection. `doctor` is offline unless `--network` is selected.
 
+For troubleshooting that you intend to share, use
+`whoisleuth doctor --summary-json > diagnostics.json`. This summary keeps numeric
+CLI/Node versions, fixed check codes and public format identifiers from the command
+catalogue. Those identifiers describe declared formats, not a compatibility test.
+Targets, URLs, filenames, paths, user names, credentials, headers, timestamps and
+free-form diagnostic details are omitted. Version prerelease/build metadata is
+also omitted. Normal terminal and `--json` diagnostics can include error details;
+inspect them before sharing. The summary does not enable network checks or upload
+anything, and it has the same success/partial exit behaviour as the detailed report.
+
 Deep Lookup reports IPv4 and IPv6 results separately, including empty answers,
 NODATA, resolver-reported missing names and query failures. These outcomes remain
 distinct in evidence exports; none alone establishes domain removal.
@@ -265,6 +293,8 @@ metadata or freshness admission; terminal output identifies that limitation.
 
 ### Contextual reviews
 
+`review-evidence` reviews bounded source-qualified infrastructure snapshots and explicit earlier/later comparisons offline. See [infrastructure observations](infrastructure-observations.md) for supported inputs and how to interpret their outcomes.
+
 `review-evidence` also accepts [contextual review inputs](contextual-reviews.md)
 for source-qualified incident sequences, retained domain history, platform-object continuity, authorised storefront
 comparison and connector provenance. These workflows are offline; partial
@@ -278,11 +308,11 @@ reassessment; they do not establish ownership or discard prior evidence.
 
 `review-evidence containment.json --json --strict-exit` accepts a
 `whoisleuth.internal-containment.input` version-1 document containing a supported
-Case export, selected next-step assertion and linked pin IDs, internal or trusted
+case export, selected next-step assertion and linked pin IDs, internal or trusted
 audience, recipient role and an explicit disclosure-review acknowledgement.
-It exports only that selected handoff, never writes the Case or performs a
+It exports only that selected handoff, never writes the case or performs a
 control. Missing or unselected supporting context stays partial (exit 4 under
-`--strict-exit`), and a resolved Case or provider outcome does not close an open
+`--strict-exit`), and a resolved case or provider outcome does not close an open
 internal follow-up. See [internal containment](offline-intake-context.md#selected-internal-containment-handoff)
 for the complete input and audience limitations.
 
@@ -335,19 +365,19 @@ selected file, including an envelope when supplied. No provider API is contacted
 
 ## Output and automation
 
-### Local Case files
+### Local case files
 
 Manual response scope is explicit and offline. `case incident-link` takes
 `{"url":"https://example.test/reported-page"}`; use its retained ID to bind
 `responseObjects` on `case action`. Each object contains `kind`, `identifier`
-and `incidentTargetId` (null for the Case domain or an associated hostname).
+and `incidentTargetId` (null for the case domain or an associated hostname).
 New URL objects must match that exact retained link. Exact historical identities
 already retained in response records remain selectable after a link edit or
 removal; they are not rebound to its replacement. An action may bind up to 20
 objects; missing historical scope stays unknown.
 
 `case action-event` takes `{"id":"action-id","transition":{...}}`, using
-the same reviewed, authorised and manually submitted workflow as Console.
+the same reviewed, authorised and manually submitted workflow as the console.
 After submission, a typed `objectOutcome` such as `removed`, `restricted`,
 `suspended`, `delisted`, `restored` or `disputed` requires explicit event
 `responseObjects`: a partial receipt never applies to all objects by default.
@@ -372,11 +402,11 @@ Independent removal, restriction, suspension, delisting, transfer and restoratio
 use those same comparison requirements. Disputes and warnings retain procedural
 source attribution separately; provider claims are not independent observations.
 `case close-object` requires one `responseObject` and the usual typed closure
-reason/evidence links. It leaves the Case and other objects unchanged.
+reason/evidence links. It leaves the case and other objects unchanged.
 All these JSON operations require `--input`, `--output`, deliberate file
 replacement and the existing digest/lease checks. No report or request is sent.
 
-Create a working file, inspect its Case IDs, then append a note:
+Create a working file, inspect its case IDs, then append a note:
 
 ```sh
 whoisleuth case open --domain example.test --title "Review the selected form" --output cases.json
@@ -384,8 +414,8 @@ whoisleuth case show cases.json
 whoisleuth case note cases.json --note-file note.txt --output cases.json --force
 ```
 
-Use `--case-id` when the file contains several Cases. `open` reuses the selected
-Case; `--new-incident --title "Another incident"` creates a distinct ID for the
+Use `--case-id` when the file contains several cases. `open` reuses the selected
+case; `--new-incident --title "Another incident"` creates a distinct ID for the
 same domain. It does not open a browser or collect anything.
 
 `pin`, `link`, `withdraw-link`, `assess` and `recheck` read a selected JSON file with `--input`:
@@ -442,23 +472,23 @@ A recheck input contains `state`, `observedAt`, `completeness`, `source` and
 `comparisonSummary`, with optional limitations and follow-up time. For example,
 use `state: "unavailable"` and `completeness: "partial"` when a supplied capture
 did not complete. `not_reproduced` requires a saved recheck question from the
-Case's console workflow, its exact `recheck` context, the target
+case's console workflow, its exact `recheck` context, the target
 `observationHostname`, a complete later observation where a baseline exists,
 and `conditionsMatch: "comparable"`. It never means global removal or takedown.
 
-Mutations require an explicit output path and write the complete current Case
+Mutations require an explicit output path and write the complete current case
 export. They never prune old evidence to fit. Input formatting may use up to
-16 MiB; the canonical store remains limited to 4 MiB and 500 Cases. `show --json`
-can export a selected subset to a **different** path. Ordinary Case imports also
+16 MiB; the canonical store remains limited to 4 MiB and 500 cases. `show --json`
+can export a selected subset to a **different** path. Ordinary case imports also
 allow 16 MiB for formatting and export metadata; the stored-data limit remains
-4 MiB. Case packs retain their separate 25-Case selection and 4-MiB source-file
+4 MiB. Case packs retain their separate 25-case selection and 4-MiB source-file
 limits, and include generated reports within the bounded import allowance.
 
 `show` reports the exact file digest. Add `--expect-file-digest sha256:<digest>`
 to reject a file changed since that review. Source/output locks and atomic
 replacement also detect changes during execution. After an interrupted process,
 inspect its adjacent `.workflow.lock` before deliberately removing it. Validation
-or conflict failures leave the Case file unchanged and return 2. Filesystem
+or conflict failures leave the case file unchanged and return 2. Filesystem
 publication failures return 3.
 
 Working files contain private analyst content and file references, not attachment
@@ -478,19 +508,19 @@ whoisleuth manifest evidence.json screenshot.png --workflow "Evidence review" \
 whoisleuth verify-artifact --folder ./evidence-project --json --strict-exit
 ```
 
-Packages admit the 128-file, 64-MiB original selection plus one bounded Case
+Packages admit the 128-file, 64-MiB original selection plus one bounded case
 export, with a separate manifest allowance. Original-file limits remain unchanged.
-`verify-artifact` uses the same exact ordinary Case reader as `case show`,
+`verify-artifact` uses the same exact ordinary case reader as `case show`,
 without repairing content. Package verification also reports original-reference
-completeness for each Case file; `--strict-exit` returns 4 when a referenced original is missing.
-An ordinary Case JSON file alone provides structural validity, not a checksum.
+completeness for each case file; `--strict-exit` returns 4 when a referenced original is missing.
+An ordinary case JSON file alone provides structural validity, not a checksum.
 They use generated entry names, not original paths. Ordinary ZIPs and folders
 are private and unencrypted; packaging does not redact selected files. The report distinguishes
 file identity, supported source formats, opaque content, exact capsule/source
 links, declared image derivation and capture-manifest attachment matches.
 Image derivation reports an immediate-parent digest and byte length, editing
 method and operation kinds, not proof of transformation. Parent inclusion matches
-another selected manifest entry by exact byte digest and size; an unselected Case
+another selected manifest entry by exact byte digest and size; an unselected case
 attachment reference does not count. Parent pixels are optional; absent declarations
 leave editing history unknown. Include the capture manifest and
 its screenshot/DOM-digest files together to check their declared bytes; original
@@ -551,6 +581,35 @@ trees and unlisted files. Its package digest and byte count describe the
 canonical stored-ZIP representation, not filesystem metadata. These are
 selected evidence exports, not complete workspace backups.
 
+### Exporting a fixed workflow for review
+
+Terminal plans and recipe explanations distinguish networked steps, offline
+steps and declared reuse of earlier outputs. These are step and handoff counts,
+not request totals or confirmation that a saved file is available. The planner
+does not inspect files or caches; collection and evidence selection remain
+deliberate actions. JSON exports keep their existing versioned fields.
+
+Select one installed recipe and save its declared steps for review:
+
+```sh
+whoisleuth workflow-plan --explain domain-triage --json --output recipe.json
+```
+
+The document includes the subject requirement, command and argument examples,
+network modes, required approvals, output artefact families and completion guidance.
+To prepare the same recipe for a specific subject:
+
+```sh
+whoisleuth workflow-plan domain-triage example.test --json --output plan.json
+```
+
+Both commands plan offline. The files contain declarative steps rather than
+shell history or executable scripts. Argument examples and approval fields
+describe requirements; they do not record a completed review or grant approval.
+These are review documents, not `workflow-run` checkpoints or custom recipe
+imports. Run an installed recipe deliberately with its required inputs and
+fresh approvals.
+
 ### Resuming a fixed workflow
 
 Inspect a paused run without executing any step or rewriting its checkpoint:
@@ -583,14 +642,17 @@ whoisleuth workflow-run domain-triage example.test --approve-network \
 ```
 
 Bindings accept Lookup outputs for export, diff, timeline, comparison, source
-reports and briefs; evidence exports for verification; and Case-pack output
+reports and briefs; evidence exports for verification; and case-pack output
 for sharing review. Remaining placeholders use `--select` in order;
 for example, `--select diff=previous.json` keeps the current observation as the
 second input. Supply every input for an uncompleted step to use files instead,
 or override a connection with `--use-artifact <step-id>:<input-number>=<earlier-step-id>`.
 Input numbers start at 1 and refer to the fixed recipe's placeholders.
 `diff` compares saved observations of the same or different domains; `timeline`
-orders observations of one domain. Candidate and domain-control intent inputs
+orders observations of one domain. Web-derived fields require complete collection
+for the relevant page or favicon; failed, partial and historical unknown collection
+keep their values visible without establishing equality or change. Source-health
+changes remain comparable separately. Candidate and domain-control intent inputs
 remain analyst selections. No external file is inferred or extracted automatically.
 `reconcile` lists each observation time and declared observer/vantage, keeping
 disagreement and unavailable evidence separate. Distinct labels do not verify
@@ -698,9 +760,61 @@ and machine output contains no ANSI or transient progress text.
 - `lookup --browse` provides an interactive terminal view; press `?` for keys.
 - `--events` writes versioned lifecycle events to stderr.
 - `--strict-exit` and `--fail-on` expose selected evidence states to automation.
+- `lookup --junit` reports retained diagnostic source states, not version or
+  timing metadata. Nested diagnostic failures remain failures; target-bearing
+  diagnostic paths are not copied into the XML. This is not a truth verdict.
 - `--output` writes a private local file atomically and refuses an existing path
   unless `--force` is also selected.
 
+Lookup, Bulk and Discover scan evaluate `--fail-on` against every collected or
+restored result, before output filters. A fulfilled lookup can still match
+`source-failure` through its diagnostics. Quiet and event output do not change
+the policy exit: matches return **4**, with diagnostics on stderr. Ordinary
+collection/checkpoint failures and Lookup's separate `--strict-exit` still apply.
+
+For `monitor-once`, `source-failure` also checks the current run's constituent
+source diagnostics, even when the Lookup fulfils. `inconclusive` checks incomplete
+requested comparisons independently of the headline: MX drift does not hide
+unavailable nameserver evidence. Skipped or unsupported sources are not failed
+requests; an unsupported requested comparison can still be inconclusive.
+Unconfigured expectations and historical source failures do not match these
+policies. `material-drift` continues to mean unexpected complete observation
+changes in the flight recorder, not a desired-state mismatch or missing evidence.
+Policy matches return **4** in JSON and quiet modes too, without adding diagnostic
+fields to monitor reports or checkpoints. Without a policy, rejected Lookups
+retain their existing failure exit; constituent-source states alone do not.
+
+Domain-control review keeps registration evidence at the registrable domain and
+DNS, TLS and web evidence at the observed hostname. It selects the newest eligible
+evidence within each scope; a newer child-host capture cannot replace an apex or
+sibling's service evidence. Separately declared delegation scope is retained.
+Historical Lookups use their retained availability domain, or their original
+registration scope when no hostname was retained, never the submitted query.
+`monitor-once` accepts only registrable-domain targets and rejects an admitted
+child target before any collection starts. A wrong-host collector response is a
+failed Lookup, not an extra successful observation or a retargeted check.
+
+For `danger`, export your Brand Profiles from Brands and explicitly select Deep
+collection. The same Risk model and Brand comparisons used by the console
+evaluate the collected evidence without extra requests:
+
+```bash
+whoisleuth lookup candidate.example --deep --brand-profile brand.json --fail-on danger --json
+whoisleuth bulk domains.txt --deep --brand-profile brand.json --fail-on danger --errors-only --json
+```
+
+The selected file uses the existing versioned Brand Profile export format,
+must provide one unambiguous valid profile with an official domain, and is bounded
+by the existing Brand Profile import byte limit. If the export contains multiple
+profiles, add `--brand-id <exact-profile-id>` from the selected profile's `id`
+field; no first-profile default is chosen. Its private fields are not copied into
+results or checkpoints or sent to sources. Restore it explicitly when resuming.
+Danger matches report the scoring-model version and evidence quality. The
+threshold prioritises review, not confirmed maliciousness. Fast collection,
+missing Brand context or ineligible registration evidence cannot establish a
+match; exit **0** does not establish low risk, complete coverage or safety.
+`inconclusive` and `source-failure` remain independently selected policies.
+
 Local configuration profiles can set presentation, Fast collection, bounded
 concurrency and observer labels. They cannot add targets, enable Deep
 collection, choose output paths or approve network work. Explicit command
@@ -708,7 +822,22 @@ options override profile defaults.
 
 `source-report` summarises collector-owned health envelopes in saved Lookup
 and Bulk output. Raw publications and extension fields are not interpreted as
-diagnostics, and missing health metadata remains unmeasured.
+diagnostics, and missing health metadata remains unmeasured. Its text view groups
+collection states, sample counts and durations under each source. Observation
+durations and Lookup timings stay separate; merged-report distributions describe
+retained report statistics, not a new measurement of individual requests.
+
+After verifying a domain-control or Lookup-claim passport, `verify-artifact`
+suggests the compatible offline `interchange-report` command. Suggestions use
+example filenames and never run automatically. Other artefact families receive
+guidance only when the suggested reader supports that format.
+
+The text output of `brief` groups selected facts in an indented source tree.
+Each source keeps its collection state and observation time, including sources
+with no fact selected for the brief; that does not mean the source was empty.
+Conflicting values remain separate and include both the value state and source
+state. The brief uses retained evidence only. Use `--json` for the
+structured report, including its facts, source health, unknowns and action plan.
 
 `mail-review` keeps failed input targets, incomplete DNS coverage and original
 collection times visible. Source-output and review-generation times do not

package/docs/contextual-reviews.md

@@ -71,6 +71,16 @@ to the retained concern. Incomplete comparisons remain visible. A changed creati
 date asks for reassessment of earlier decisions without asserting a new owner,
 resetting a baseline or discarding history; expiry alone never establishes deletion.
 
+Open **Retirement review checklist** for DNS-alias, recovery-email and retained
+integration-reference prompts. Review the configuration you control, then use
+the existing declaration form to record the affected hostnames, evidence family,
+retirement time and source. The draft shows these details before you prepare a
+review. Prefer a configuration or change-reference label; do not enter recovery
+addresses, credentials or complete URLs. Reports with declared retired dependencies
+include the same suggested next reviews in the browser and CLI. Suggestions do not
+record checks as completed or establish takeover availability. Saving preserves
+the source-qualified declaration, not confirmation that configuration was changed.
+
 Schema: `whoisleuth.domain-history.input`. Its `evidence` contains:
 
 - `caseExport`: an ordinary supported editable Case export, with `version` and

package/docs/infrastructure-observations.md

@@ -43,6 +43,15 @@ Topology search applies to the complete admitted one-hop relationship set, not
 the current source page. Its diagram has a 50-relationship budget; the paginated
 source list and exact snapshot review retain access to evidence beyond the diagram.
 
+Follow a retained domain to an address or certificate, then open its supporting
+Case. **Return to retained infrastructure** restores the exact query, filters,
+page positions and selected identity. **Tab references → Navigation trail** also
+lets you return to earlier successful pivots. This trail lives only in the
+current tab and workspace; it creates no observed relationships. Sources are
+read again rather than copied into navigation state. A removed identity stays
+unavailable, and clearing references or locking the workspace expires the links.
+Certificate identities here are leaf-certificate SHA-256, not SPKI digests.
+
 Lookup links fill the selected target for review without submitting it. Explicitly
 selected hostnames can be prepared in existing Bulk. That handoff does not scan,
 recursively expand targets, change a watchlist or enrol a host in monitoring.

package/lib/dmarc-discovery.mjs

@@ -1,6 +1,7 @@
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { parseDmarcRecords } from "./domain-posture-parsers.mjs";
+import { MAX_DMARC_DISCOVERY_OWNERS } from "../packages/evidence/dmarc-policy-context.mjs";
 export function requireDmarcDomain(domain) {
     if (typeof domain !== 'string' || domain.length > 253 || !isValidAsciiHostname(domain) || domain !== domain.toLowerCase()) {
         throw new TypeError('The additional DNS review requires a normalised domain.');
@@ -29,7 +30,8 @@ export function dmarcPolicyObservation(owner, observation) {
         : state;
     const time = typeof observation.observedAt === 'string' && observation.observedAt.length <= 64
         ? normalizeExplicitIsoTimestamp(observation.observedAt) : null;
-    return { owner, parsed, psd, valid, unavailable, incomplete,
+    return { owner, parsed, psd, valid, unavailable, incomplete, observedAt: time,
+        state: unavailable ? 'unavailable' : valid ? 'observed' : parsed.records.length ? 'invalid' : 'not_found',
         record: `Recursive DNS TXT _dmarc.${owner} · ${time ?? 'time unavailable'} · ${description}` };
 }
 /** RFC 9989 sections 4.10–4.10.2: at most eight owners, never PSL inference. */
@@ -38,7 +40,7 @@ export async function walkDmarcTree(domain, exact, resolve, purpose) {
     const rows = [dmarcPolicyObservation(domain, exact)];
     const first = rows[0];
     const labels = domain.split('.');
-    let next = labels.length >= 8 ? labels.slice(-7) : labels.slice(1);
+    let next = labels.length >= MAX_DMARC_DISCOVERY_OWNERS ? labels.slice(-(MAX_DMARC_DISCOVERY_OWNERS - 1)) : labels.slice(1);
     const policyOnly = purpose === 'policy' && first.valid;
     if (!policyOnly && !first.unavailable && !(first.valid && ['n', 'y'].includes(first.psd))) {
         while (next.length) {

package/lib/dns-inheritance-review.mjs

@@ -5,6 +5,7 @@ import { requireDmarcDomain, walkDmarcTree } from "./dmarc-discovery.mjs";
 import { buildDnssecQuery, DNS_TYPE_NS, normalizeResolverEndpoint, parseDnssecResponse } from "./dnssec-chain-validation.mjs";
 import { defaultTcpExchange } from "./service-binding-dns.mjs";
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
+import { normalizeDmarcPolicyContext } from "../packages/evidence/dmarc-policy-context.mjs";
 const MAX_PARENT_SERVERS = 2;
 const MAX_NS = 16;
 const QUERY_TIMEOUT_MS = 2200;
@@ -35,7 +36,19 @@ export async function reviewInheritedDmarc(domain, exact, resolve) {
             ? `Published policy: ${selected.parsed.policy}. Test mode: ${selected.parsed.testMode ? 'yes' : 'no'}.`
             : `For an existing name: ${selected.parsed.subdomainPolicy}. For a nonexistent name: ${selected.parsed.nonexistentSubdomainPolicy}. Test mode: ${selected.parsed.testMode ? 'yes' : 'no'}. Name existence is not inferred from this review.`
         : 'Invalid or unavailable records do not establish absence or a usable inherited policy.';
-    return check('dmarc_inheritance', 'Inherited DMARC policy', incomplete || !selected ? 'warning' : 'info', summary, `${detail} Discovery follows RFC 9989 with at most eight owners. This is publication evidence, not message authentication or a guarantee of receiver behaviour.`, rows.map(row => row.record));
+    const effective = !incomplete ? selected : null;
+    return {
+        ...check('dmarc_inheritance', 'Inherited DMARC policy', incomplete || !selected ? 'warning' : 'info', summary, `${detail} Discovery follows RFC 9989 with at most eight owners. This is publication evidence, not message authentication or a guarantee of receiver behaviour.`, rows.map(row => row.record)),
+        dmarcPolicyContext: normalizeDmarcPolicyContext({
+            version: 1, source: 'recursive_dns_txt', complete: !incomplete,
+            relation: effective ? effective.owner === domain ? 'exact' : 'inherited' : 'undetermined',
+            owner: effective?.owner ?? null, observedAt: effective?.observedAt ?? null,
+            policy: effective?.parsed.policy ?? null, subdomainPolicy: effective?.parsed.subdomainPolicy ?? null,
+            nonexistentPolicy: effective?.parsed.nonexistentSubdomainPolicy ?? null,
+            psd: effective?.psd ?? null, testMode: effective?.parsed.testMode ?? null,
+            discovery: rows.map(row => ({ owner: row.owner, state: row.state, observedAt: row.observedAt })),
+        }, domain),
+    };
 }
 function nameservers(value) {
     if (!Array.isArray(value) || value.length > MAX_NS)

package/lib/evidence-export.mjs

@@ -6,7 +6,7 @@ import { buildRegistryInsights } from "./registry-insights.mjs";
 import { buildPortableGeneratorMetadata } from "../packages/analysis/portable-generator.mjs";
 import { assertBoundedJsonStructure } from "../packages/analysis/bounded-json.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-import { LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, } from "../packages/contracts/lookup-evidence.mjs";
+import { LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION, } from "../packages/contracts/lookup-evidence.mjs";
 export * from "../packages/contracts/lookup-evidence.mjs";
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { validLookupObservationScope } from "../packages/evidence/lookup-target.mjs";
@@ -705,6 +705,7 @@ const LOOKUP_WHOIS_PORTABLE_SCALARS = Object.freeze({
     failedHop: nullableText(253),
     conflictingHop: nullableText(253),
 });
+const WHOIS_REGISTRATION_STATUS = enumeration(new Set(['registered', 'not_found', 'inconclusive']));
 const LOOKUP_REGISTRY_INSIGHT_PORTABLE_KEYS = new Set([
     'version', 'contactDisclosure', 'lifecycle', 'reconciliation', 'publications',
     'rdapCapabilities',
@@ -815,11 +816,16 @@ export function projectLookupEvidenceRdapPublication(value) {
     return output;
 }
 /** Positive portable projection for normalized WHOIS publication fields. */
-export function projectLookupEvidenceWhoisPublication(value) {
+export function projectLookupEvidenceWhoisPublication(value, schemaVersion = LOOKUP_EVIDENCE_SCHEMA_VERSION) {
     const input = recordOrNull(value);
     if (!input)
         return null;
     const output = projectedKnownScalarRecord(input, LOOKUP_WHOIS_PORTABLE_SCALARS) || {};
+    if (schemaVersion >= AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION && Object.hasOwn(input, 'registrationStatus')) {
+        const status = WHOIS_REGISTRATION_STATUS(input.registrationStatus);
+        if (status !== undefined)
+            output.registrationStatus = status;
+    }
     if (Object.hasOwn(input, 'lifecycle')) {
         output.lifecycle = projectedKnownScalarRecord(input.lifecycle, LOOKUP_RDAP_LIFECYCLE_SCALARS);
     }
@@ -884,7 +890,7 @@ function projectedWhoisChainHop(value) {
     };
 }
 /** Exact positive projection for one current-schema WHOIS source wrapper. */
-export function projectLookupEvidenceWhoisSourcePublication(value) {
+export function projectLookupEvidenceWhoisSourcePublication(value, schemaVersion = LOOKUP_EVIDENCE_SCHEMA_VERSION) {
     const source = recordOrNull(value);
     if (!source)
         return null;
@@ -895,7 +901,7 @@ export function projectLookupEvidenceWhoisSourcePublication(value) {
             error: boundedSourceError(source.error, 'WHOIS source reported an error.'),
         };
     const hasPublication = status === 'complete' || status === 'partial';
-    const parsed = hasPublication ? projectLookupEvidenceWhoisPublication(source.parsed) : null;
+    const parsed = hasPublication ? projectLookupEvidenceWhoisPublication(source.parsed, schemaVersion) : null;
     if (status === 'complete' && parsed === null)
         return null;
     return {

package/lib/evidence-report.mjs

@@ -1,4 +1,5 @@
 import { registryAccessProfileLabel } from "./registry-access.mjs";
+import { isSupportedRegistryInsightsVersion } from "../packages/contracts/registry-insights.mjs";
 import { dnsAddressFamilyEvidence } from "../packages/evidence/dns-query-outcome.mjs";
 import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../packages/analysis/portable-generator.mjs";
 import { technologyEvidenceRoles, } from "./technology-evidence-role.mjs";
@@ -386,7 +387,7 @@ function buildLookupEvidenceReport(document, options = {}) {
             reportField('Standing limitations', listText(registrarStanding.limitations)),
             reportField('Review steps', listText(registrarStanding.nextActions)),
         ] : [],
-        registryInterpretation: registryInsights.version === 1 ? [
+        registryInterpretation: isSupportedRegistryInsightsVersion(registryInsights.version) ? [
             reportField('Lifecycle', displayLabel(registryLifecycle.label)),
             reportField('Raw lifecycle statuses', listText(registryLifecycle.rawStatuses)),
             reportField('Client registration lock observed', yesNoUnknown(registryLocks.client)),

package/lib/generated/cisa-kev-catalog.mjs

@@ -1,9 +1,9 @@
 // Generated by tools/cisa-kev-catalog.mts from the pinned CISA KEV feed.
 // United States Government work; do not edit by hand.
 const CISA_KEV_CATALOG = Object.freeze({
-    catalogVersion: "2026.10.02",
-    releasedAt: "2026-10-02T15:19:38.2945Z",
-    sourceSha256: "d2c8c6cb23291b46ff2b086197641a6b1fa35e6b746bba714cc280a1778f9e48",
+    catalogVersion: "2026.10.16",
+    releasedAt: "2026-10-16T17:15:48.8752Z",
+    sourceSha256: "b6e27975f6635ecfc546fbd4fd6e444ba63a07ab2abc8876229d77fe083d357d",
     sourceUrl: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
     identifiers: Object.freeze([
         "CVE-2002-0367",
@@ -194,6 +194,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2015-3043",
         "CVE-2015-3113",
         "CVE-2015-3246",
+        "CVE-2015-3306",
         "CVE-2015-4068",
         "CVE-2015-4495",
         "CVE-2015-4852",
@@ -203,6 +204,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2015-5123",
         "CVE-2015-5287",
         "CVE-2015-5317",
+        "CVE-2015-5477",
         "CVE-2015-6175",
         "CVE-2015-7450",
         "CVE-2015-7645",
@@ -229,6 +231,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2016-20017",
         "CVE-2016-2386",
         "CVE-2016-2388",
+        "CVE-2016-3081",
         "CVE-2016-3088",
         "CVE-2016-3235",
         "CVE-2016-3298",
@@ -842,6 +845,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2021-31955",
         "CVE-2021-31956",
         "CVE-2021-31979",
+        "CVE-2021-3199",
         "CVE-2021-32030",
         "CVE-2021-32648",
         "CVE-2021-33044",
@@ -1080,6 +1084,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2023-22515",
         "CVE-2023-22518",
         "CVE-2023-22527",
+        "CVE-2023-22894",
         "CVE-2023-22952",
         "CVE-2023-23376",
         "CVE-2023-23397",
@@ -1542,6 +1547,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2025-59689",
         "CVE-2025-59718",
         "CVE-2025-60710",
+        "CVE-2025-61624",
         "CVE-2025-61757",
         "CVE-2025-61882",
         "CVE-2025-61884",
@@ -1573,10 +1579,15 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2025-9377",
         "CVE-2026-0257",
         "CVE-2026-0300",
+        "CVE-2026-0322",
         "CVE-2026-0770",
         "CVE-2026-102489",
         "CVE-2026-102490",
+        "CVE-2026-102764",
         "CVE-2026-104286",
+        "CVE-2026-104935",
+        "CVE-2026-105133",
+        "CVE-2026-105134",
         "CVE-2026-10520",
         "CVE-2026-11645",
         "CVE-2026-12569",
@@ -1616,6 +1627,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-21519",
         "CVE-2026-21525",
         "CVE-2026-21533",
+        "CVE-2026-21589",
         "CVE-2026-21643",
         "CVE-2026-21962",
         "CVE-2026-22719",
@@ -1711,6 +1723,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-76460",
         "CVE-2026-76461",
         "CVE-2026-76504",
+        "CVE-2026-76519",
         "CVE-2026-8037",
         "CVE-2026-81578",
         "CVE-2026-81963",
@@ -1733,12 +1746,14 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-87902",
         "CVE-2026-88771",
         "CVE-2026-88772",
+        "CVE-2026-88779",
         "CVE-2026-9082",
         "CVE-2026-9198",
         "CVE-2026-93616",
         "CVE-2026-93952",
         "CVE-2026-94127",
-        "CVE-2026-9586"
+        "CVE-2026-9586",
+        "CVE-2026-96951"
     ]),
 });
 export { CISA_KEV_CATALOG };