@slicedearth/whoisleuth-cli 2.7.0 → 2.8.0

package/cli/bulk-command-runner.mjs

@@ -8,7 +8,8 @@ import EXIT_CODES from "./exit-codes.mjs";
 import { buildCliBulkDocument, formatJsonDocument, formatJsonLines } from "./formatters/json.mjs";
 import { formatTerminalBulk } from "./formatters/terminal.mjs";
 import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { evaluateCliFailPolicies, reportCliFailPolicies } from "./fail-policy.mjs";
+import { readCliRiskProfile } from "./risk-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 async function runBulkCommand(args, dependencies, context) {
@@ -39,6 +40,7 @@ async function runBulkCommand(args, dependencies, context) {
         context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
         return EXIT_CODES.SUCCESS;
     }
+    const riskProfile = await readCliRiskProfile(args.brandProfileSource, context.readInput, args.brandProfileId);
     const classify = dependencies.classifyQuery || classifyQuery;
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
     const checkpoint = args.checkpoint
@@ -106,6 +108,7 @@ async function runBulkCommand(args, dependencies, context) {
         collectedTotal: items.length,
         filter: args.filter,
     };
+    const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || [], riskProfile);
     const selectedItems = selectBulkItems(items, args.filter);
     const selectedDocument = buildCliBulkDocument(selectedItems, metadata);
     if (!args.quiet) {
@@ -126,9 +129,7 @@ async function runBulkCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalBulk(selectedItems, metadata), args.color));
     }
-    const policyFindings = evaluateCliFailPolicies(buildCliBulkDocument(items, { ...metadata, filter: 'all' }), args.failOn || []);
-    if (policyFindings.length && !eventProgress.enabled)
-        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    reportCliFailPolicies(policyFindings, context.writeStderr, eventProgress);
     const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;

package/cli/collection-arguments.mjs

@@ -29,6 +29,8 @@ function parseLookupArguments(parsed) {
             ? { saveLookup: parsed.optionValue('--save-lookup') }
             : {}),
         ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+        ...(parsed.optionValue('--brand-profile') ? { brandProfileSource: parsed.optionValue('--brand-profile') } : {}),
+        ...(parsed.optionValue('--brand-id') ? { brandProfileId: parsed.optionValue('--brand-id') } : {}),
     };
 }
 function parseBulkArguments(parsed) {
@@ -55,6 +57,8 @@ function parseBulkArguments(parsed) {
         filter,
         ...terminalOptions(parsed),
         ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+        ...(parsed.optionValue('--brand-profile') ? { brandProfileSource: parsed.optionValue('--brand-profile') } : {}),
+        ...(parsed.optionValue('--brand-id') ? { brandProfileId: parsed.optionValue('--brand-id') } : {}),
     };
 }
 function parseDiscoverArguments(parsed) {
@@ -113,6 +117,8 @@ function parseDiscoverScanArguments(parsed) {
         plan: parsed.hasOption('--plan'),
         ...terminalOptions(parsed),
         ...(selectedFailPolicies ? { failOn: selectedFailPolicies } : {}),
+        ...(parsed.optionValue('--brand-profile') ? { brandProfileSource: parsed.optionValue('--brand-profile') } : {}),
+        ...(parsed.optionValue('--brand-id') ? { brandProfileId: parsed.optionValue('--brand-id') } : {}),
     };
 }
 export const COLLECTION_ARGUMENT_PARSERS = Object.freeze({

package/cli/collection-command-definitions.mjs

@@ -2,12 +2,13 @@ import { positional, OPTIONAL_FILE_POSITIONAL, OPTIONAL_TEXT_POSITIONAL, constra
 import { bulkQueryLimit, bulkConcurrencyLimit } from "../lib/bulk-limits.mjs";
 const COLLECTION_CEILINGS = `${bulkQueryLimit('fast')} fast or ${bulkQueryLimit('deep')} deep`;
 const CONCURRENCY_CEILINGS = `${bulkConcurrencyLimit('fast')} fast or ${bulkConcurrencyLimit('deep')} deep`;
+const FAILURE_POLICY_BOUNDARY = 'Failure policies evaluate all collected and restored results before output filtering. For danger review, explicitly select --deep and --brand-profile; use --brand-id to select one profile from a multi-profile export. The current canonical Risk model compares collected evidence with that local reference; Fast, missing or ineligible evidence cannot establish a threshold match. The heuristic review threshold is not a maliciousness or safety verdict. The profile is not sent to collectors, retained in checkpoints or copied into output.';
 export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
     lookup: commandSeed({
         reference: {
             description: 'Collect registration evidence for one domain, IP, or ASN.',
             example: 'whoisleuth lookup example.test --deep --browse',
-            boundary: 'Fast is the default. An ICANN-recognised public domain, reserved documentation domain, IP, or ASN may occupy command position as shorthand; it delegates to this same parser and URL-like input requires the explicit lookup command. Deep mode adds bounded WHOIS, DNS, HTTP, TLS, technology, posture, and network context where applicable. --deep --exact-url explicitly sends the input URL path and query to the website, without its fragment; ordinary URL input sends only the hostname. --plan remains offline and omits the selected URL. Retained paths and page-derived text require review before sharing. A full Deep homepage observation can derive fixed publication and delivery/cache summaries from the same response without retaining raw metadata values or making another request. --browse opens before collection, shows aggregate Fast progress or independently settled planned Deep sources, and then navigates allowlisted retained fields in the completed document. Press ? for help and / to search rendered panel text only. Closing during collection cancels without a partial document. --save-lookup writes the exact completed private JSON only after a normal browser close; it can contain normalised evidence omitted from panels and refuses an existing path.',
+            boundary: 'Fast is the default. An ICANN-recognised public domain, reserved documentation domain, IP, or ASN may occupy command position as shorthand; it delegates to this same parser and URL-like input requires the explicit lookup command. Deep mode adds bounded WHOIS, DNS, HTTP, TLS, technology, posture, and network context where applicable. --deep --exact-url explicitly sends the input URL path and query to the website, without its fragment; ordinary URL input sends only the hostname. --plan remains offline and omits the selected URL. Retained paths and page-derived text require review before sharing. A full Deep homepage observation can derive fixed publication and delivery/cache summaries from the same response without retaining raw metadata values or making another request. --browse opens before collection, shows aggregate Fast progress or independently settled planned Deep sources, and then navigates allowlisted retained fields in the completed document. Press ? for help and / to search rendered panel text only. Closing during collection cancels without a partial document. --save-lookup writes the exact completed private JSON only after a normal browser close; it can contain normalised evidence omitted from panels and refuses an existing path. ' + FAILURE_POLICY_BOUNDARY,
         },
         collection: {
             scope: 'Accepts one target. Fast is the default; deep collection must be selected explicitly.',
@@ -31,6 +32,8 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             '--save-lookup',
             '--strict-exit',
             '--fail-on',
+            '--brand-profile',
+            '--brand-id',
             '--events',
             '--quiet',
             '--no-color',
@@ -39,6 +42,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             positional('target', 'text', 0, 1, [], 'argv_or_stdin', ['--browse']),
         ]),
         constraints: Object.freeze([
+            constraint({ kind: 'requires_all', option: '--brand-id', requiredOptions: ['--brand-profile'] }),
             constraint({
                 kind: 'mutually_exclusive',
                 options: ['--json', '--junit', '--markdown', '--html'],
@@ -106,7 +110,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Triage newline-delimited domains, IPs, or ASNs with bounded concurrency.',
             example: 'cat domains.txt | whoisleuth bulk --jsonl',
-            boundary: 'Fast and deep jobs use separate concurrency ceilings. Filters affect output only; collection failures and inconclusive authority states remain explicit in JSON, JSONL, and CSV. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns.',
+            boundary: 'Fast and deep jobs use separate concurrency ceilings. Filters affect output only; collection failures and inconclusive authority states remain explicit in JSON, JSONL, and CSV. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns. ' + FAILURE_POLICY_BOUNDARY,
         },
         collection: {
             scope: `Accepts at most ${COLLECTION_CEILINGS} targets, with concurrency capped at ${CONCURRENCY_CEILINGS}.`,
@@ -131,11 +135,14 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             '--events',
             '--plan',
             '--fail-on',
+            '--brand-profile',
+            '--brand-id',
             '--quiet',
             '--no-color',
         ],
         positionals: OPTIONAL_FILE_POSITIONAL,
         constraints: Object.freeze([
+            constraint({ kind: 'requires_all', option: '--brand-id', requiredOptions: ['--brand-profile'] }),
             constraint({
                 kind: 'mutually_exclusive',
                 options: [
@@ -236,7 +243,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
         reference: {
             description: 'Generate a bounded candidate set, collect a selected subset, and produce a supervised review queue.',
             example: 'whoisleuth discover-scan example.test --scan-limit 50 --checkpoint scan.json --json',
-            boundary: `This command performs network collection. Fast compact lookup is the default; deep mode is capped at ${bulkQueryLimit('deep')} candidates. Allowlisting changes review priority only and shared infrastructure remains a lead, not attribution. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns.`,
+            boundary: `This command performs network collection. Fast compact lookup is the default; deep mode is capped at ${bulkQueryLimit('deep')} candidates. Allowlisting changes review priority only and shared infrastructure remains a lead, not attribution. --csv-with-metadata adds source versions, separate observation and report times, collection origin and diagnostic states; --csv retains the compact columns. ${FAILURE_POLICY_BOUNDARY}`,
         },
         collection: {
             scope: `Scans at most ${COLLECTION_CEILINGS} candidates, with concurrency capped at ${CONCURRENCY_CEILINGS}.`,
@@ -265,6 +272,8 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
             '--events',
             '--plan',
             '--fail-on',
+            '--brand-profile',
+            '--brand-id',
             '--json',
             '--jsonl',
             '--csv',
@@ -275,6 +284,7 @@ export const COLLECTION_COMMAND_DEFINITIONS = Object.freeze({
         ],
         positionals: OPTIONAL_TEXT_POSITIONAL,
         constraints: Object.freeze([
+            constraint({ kind: 'requires_all', option: '--brand-id', requiredOptions: ['--brand-profile'] }),
             constraint({
                 kind: 'mutually_exclusive',
                 options: ['--json', '--jsonl', '--csv', '--csv-with-metadata', '--domains'],

package/cli/command-definition.mjs

@@ -156,6 +156,8 @@ const CLI_OPTION_DEFINITIONS = Object.freeze({
     '--interactive': flag('Prompt for missing supported inputs on an interactive terminal.'),
     '--save-lookup': file('After a normal evidence-browser close, save the completed private Lookup JSON to a new file.'),
     '--strict-exit': flag('Use the command’s strict outcome policy when deciding the exit status.'),
+    '--brand-profile': file('Read a local Brand Profile export for danger-policy comparisons; no additional requests or profile retention.'),
+    '--brand-id': text('Select an exact profile ID when --brand-profile contains multiple profiles.'),
     '--fail-on': optionDefinition('policy_list', 'Return a failure-policy exit status for the selected comma-separated outcomes.', {
         values: (command) => CLI_FAIL_POLICIES_BY_COMMAND[command] ?? [],
     }),

package/cli/discovery-scan-command-runner.mjs

@@ -10,7 +10,8 @@ import EXIT_CODES from "./exit-codes.mjs";
 import { formatJsonDocument } from "./formatters/json.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { buildCollectionPreflight, formatCollectionPreflight } from "./collection-preflight.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { evaluateCliFailPolicies, reportCliFailPolicies } from "./fail-policy.mjs";
+import { readCliRiskProfile } from "./risk-policy.mjs";
 async function readAllowlist(source, dependencies, context, classify) {
     if (!source)
         return new Set();
@@ -59,6 +60,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         context.writeStdout(args.output === 'json' ? formatJsonDocument(document) : context.terminal(formatCollectionPreflight(document), args.color));
         return EXIT_CODES.SUCCESS;
     }
+    const riskProfile = await readCliRiskProfile(args.brandProfileSource, context.readInput, args.brandProfileId);
     const classify = dependencies.classifyQuery || classifyQuery;
     const allowlist = await readAllowlist(args.allowlistSource, dependencies, context, classify);
     const checkpointWriter = dependencies.createBulkCheckpointWriter || createBulkCheckpointWriter;
@@ -144,7 +146,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
     const snapshot = args.observationSnapshot
         ? await updateDiscoveryObservationSnapshot(args.observationSnapshot, candidates, items, { deep: args.deep, resolverServers }, generationMetadata.generatedAt)
         : null;
-    const document = buildDiscoveryScanDocument(candidates, items, {
+    const metadata = {
         generatedAt: generationMetadata.generatedAt,
         seed: generationMetadata.seed,
         preset: generationMetadata.preset,
@@ -157,9 +159,15 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         chunkSize: args.chunkSize,
         concurrency: args.concurrency,
         deep: args.deep,
-        filter: args.filter,
+        filter: 'all',
         resolverServers,
-    }, allowlist, snapshot);
+    };
+    // Policies describe the complete collected run, including restored results,
+    // source diagnostics and candidate context, before presentation selection.
+    const collectedDocument = buildDiscoveryScanDocument(candidates, items, metadata, allowlist, snapshot);
+    const policyFindings = evaluateCliFailPolicies(collectedDocument, args.failOn || [], riskProfile);
+    const document = args.filter === 'all' ? collectedDocument
+        : buildDiscoveryScanDocument(candidates, items, { ...metadata, filter: args.filter }, allowlist, snapshot);
     if (!args.quiet) {
         if (args.output === 'json')
             context.writeStdout(formatJsonDocument(document));
@@ -174,9 +182,7 @@ async function runDiscoveryScanCommand(args, dependencies, context) {
         else
             context.writeStdout(context.terminal(formatTerminalDiscoveryScan(document), args.color));
     }
-    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
-    if (policyFindings.length && !eventProgress.enabled)
-        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    reportCliFailPolicies(policyFindings, context.writeStderr, eventProgress);
     const exitCode = checkpointFailure || items.some((item) => !item.ok) || policyFindings.length
         ? EXIT_CODES.PARTIAL_FAILURE
         : EXIT_CODES.SUCCESS;

package/cli/domain-control-monitor.mjs

@@ -9,6 +9,8 @@ import { requireDomainName, requireIsoTimestamp } from "../lib/bounded-contract-
 import { buildCliLookupDocument } from "./formatters/json.mjs";
 import { buildCliDomainControlReview, DOMAIN_CONTROL_REVIEW_SOURCE_FIELDS, } from "./domain-control-observations.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { lookupStrictExitFindings } from "./strict-exit.mjs";
+import { lookupObservationHostname } from "../packages/evidence/lookup-target.mjs";
 export { CLI_DOMAIN_CONTROL_MONITOR_SCHEMA, CLI_DOMAIN_CONTROL_MONITOR_VERSION };
 export const MAX_DOMAIN_CONTROL_MONITOR_DOMAINS = CONTRACT_MAX_DOMAIN_CONTROL_MONITOR_DOMAINS;
 function parseMonitorJson(input, label) {
@@ -232,6 +234,19 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
     }
     const previous = previousSnapshot(previousInput, startedAt);
     const entries = manifest.entries.slice(0, Math.min(options.limit, MAX_DOMAIN_CONTROL_MONITOR_DOMAINS));
+    const targets = entries.map(entry => {
+        let classified;
+        try {
+            classified = classifyQuery(entry.domain);
+        }
+        catch {
+            throw new CliUsageError('monitor-once requires registrable-domain targets.');
+        }
+        if (classified.type !== 'domain' || classified.isSubdomain) {
+            throw new CliUsageError('monitor-once supports registrable-domain targets only; exact-host monitoring is not supported.');
+        }
+        return classified;
+    });
     const lookups = new Array(entries.length);
     const failuresByIndex = new Array(entries.length);
     let cursor = 0;
@@ -244,13 +259,18 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
             if (!entry)
                 break;
             try {
-                const classified = classifyQuery(entry.domain);
+                const classified = targets[index];
                 const result = await options.executeLookup(classified, { fast: false, compact: false, ...(options.signal ? { signal: options.signal } : {}) });
                 options.signal?.throwIfAborted();
                 const capturedAt = requireIsoTimestamp(options.now(), 'Domain-control capture time');
                 if (Date.parse(capturedAt) < checkedAt)
                     throw new CliUsageError('Domain-control capture time must not precede the run.');
-                lookups[index] = buildCliLookupDocument(entry.domain, classified, result, capturedAt, 'deep');
+                const lookup = buildCliLookupDocument(entry.domain, classified, result, capturedAt, 'deep');
+                const observedHostname = lookupObservationHostname({ domain: entry.domain, ...lookup.availability });
+                if (observedHostname !== null && observedHostname !== entry.domain) {
+                    throw new TypeError('Lookup observation does not match the monitor target.');
+                }
+                lookups[index] = lookup;
             }
             catch {
                 if (options.signal?.aborted) {
@@ -270,6 +290,9 @@ export async function runDomainControlMonitor(manifestInput, previousInput, opti
     const successful = lookups.filter(Boolean);
     if (!successful.length)
         throw new Error('No domain-control monitor lookup completed successfully.');
+    // Only current Lookup diagnostics contribute; checkpoints retain observations,
+    // not policy metadata or raw diagnostics.
+    options.onSourceFailures?.(successful.reduce((count, lookup) => count + lookupStrictExitFindings(lookup).length, 0));
     const generatedAt = requireIsoTimestamp(options.now(), 'Domain-control completion time');
     if (Date.parse(generatedAt) < checkedAt || successful.some((lookup) => Date.parse(String(lookup.generatedAt)) > Date.parse(generatedAt))) {
         throw new CliUsageError('Domain-control completion time must not precede its captures.');

package/cli/domain-control-observations.mjs

@@ -3,10 +3,11 @@ import { latestObservationCohort } from "../packages/evidence/latest-observation
 import { canonicalCaaRecord, canonicalDsRecord, canonicalMxRecord, canonicalDomainControlRecords, canonicalPostureRecords } from "../packages/evidence/domain-control-runtime.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
 import { postureTransferRestriction } from "../packages/evidence/domain-posture-context.mjs";
+import { lookupObservationHostname } from "../packages/evidence/lookup-target.mjs";
 import { MAX_DOMAIN_CONTROL_INPUT_RECORDS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION } from "../packages/contracts/domain-control-manifest.mjs";
 import { scanBoundedJson, } from "../packages/analysis/bounded-json.mjs";
 import { CLI_DOMAIN_CONTROL_REVIEW_INPUT_KEYS, CLI_DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS, CLI_DOMAIN_CONTROL_REVIEW_SCHEMA, CLI_DOMAIN_CONTROL_REVIEW_VERSION, PUBLIC_CLI_DOMAIN_CONTROL_REVIEW_VERSION, SUPPORTED_CLI_DOMAIN_CONTROL_REVIEW_VERSIONS, DOMAIN_CONTROL_REVIEW_VERSION, MAX_DOMAIN_CONTROL_REVIEW_INPUT_BYTES, MAX_DOMAIN_CONTROL_REVIEW_JSON_DEPTH, MAX_DOMAIN_CONTROL_REVIEW_JSON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_JSON_VALUES, MAX_DOMAIN_CONTROL_REVIEW_LOOKUPS, MIN_DOMAIN_CONTROL_REVIEW_LOOKUPS, } from "../packages/contracts/domain-control-review.mjs";
-import { MAX_FLIGHT_RECORDER_VALUES, mergeConcurrentDomainControlFields, } from "../lib/domain-control-flight-recorder.mjs";
+import { MAX_FLIGHT_RECORDER_VALUES, DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, mergeConcurrentDomainControlFields, } from "../lib/domain-control-flight-recorder.mjs";
 import { DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, reviewDomainControlManifest, verifyDomainControlManifest, } from "../lib/domain-control-manifest.mjs";
 import { CliUsageError } from "./errors.mjs";
 import { parseSavedLookupDocument } from "./saved-lookup.mjs";
@@ -113,12 +114,21 @@ function pageIdentityValue(availability) {
     ].filter((item) => Boolean(item));
     return components.length ? [components.join(' | ')] : [];
 }
-export function domainControlObservationFromSavedLookup(document) {
+function serviceHostname(document) {
+    // Historical saved Lookups collected supporting evidence at the registration
+    // domain unless availability retained a more specific scope. Never use query.
+    return lookupObservationHostname({ domain: document.registrableDomain, ...record(document.availability) });
+}
+export function domainControlObservationFromSavedLookup(document, domain = document.registrableDomain) {
     const availability = record(document.availability);
+    const observedHostname = serviceHostname(document);
     const dns = record(availability.dns);
     const dnsRecords = record(dns.records);
     const dnsAt = sourceClock(dns.observedAt, dns.checkedAt);
     const delegation = record(dns.delegation);
+    const delegationHostname = delegation.domain === undefined
+        ? observedHostname === document.registrableDomain ? observedHostname : null
+        : lookupObservationHostname({ domain: delegation.domain });
     const delegationRecords = record(delegation.records);
     const tls = record(availability.tls);
     const tlsState = sourceState(tls);
@@ -134,14 +144,15 @@ export function domainControlObservationFromSavedLookup(document) {
     const hostname = (value) => canonicalDomainControlRecords([value], 'nameservers')[0] ?? '';
     const identity = record(availability.pageIdentity);
     const identityValues = pageIdentityValue(availability);
-    const fields = [
+    const registrationFields = [
         scalar('registrar', registry.source, registry.sourceState, record(registry.parsed.registrar).name ?? registry.parsed.registrar, registry.observedAt, 300),
         scalar('registrar_lock', registry.source, registry.sourceState, lockValue(registry.parsed), registry.observedAt, 20),
         scalar('registry_dnssec', 'Registry RDAP', rdapState, rdapParsed.dnssec, rdapAt, 80),
         recordField('registry_nameservers', 'Registry RDAP', rdapState, rdapParsed.nameservers, hostname, rdapAt),
         recordField('whois_nameservers', 'WHOIS', diagnostic(document, 'whois'), record(record(document.whois).parsed).nameservers, hostname, registryClock(document, 'whois')),
+    ];
+    const serviceFields = [
         recordField('delegated_nameservers', 'DNS NS', dnsRecordState(dns, 'ns'), dnsRecords.ns, hostname, dnsAt),
-        recordField('delegation_ds', 'DNS delegation', Object.hasOwn(delegationRecords, 'ds') ? sourceState(delegation) : 'unsupported', delegationRecords.ds, canonicalDsRecord, sourceClock(delegation.observedAt)),
         recordField('mail_exchangers', 'DNS MX', dnsRecordState(dns, 'mx'), dnsRecords.mx, canonicalMxRecord, dnsAt),
         recordField('caa_policy', 'DNS CAA', dnsRecordState(dns, 'caa'), dnsRecords.caa, canonicalCaaRecord, dnsAt),
         scalar('tls_certificate', 'TLS', tlsState, certificate.fingerprintSha256 ?? tls.fingerprintSha256, tlsAt, 128),
@@ -149,8 +160,13 @@ export function domainControlObservationFromSavedLookup(document) {
         scalar('http_origin', 'HTTP', sourceState(http), http.finalOrigin, sourceClock(http.observedAt, http.checkedAt)),
         field('page_identity', 'Static page identity', sourceState(identity) === 'observed' && !identityValues.length ? 'partial' : sourceState(identity), identityValues, sourceClock(identity.observedAt)),
     ];
+    const fields = mergeConcurrentDomainControlFields([
+        domain === document.registrableDomain ? registrationFields : [],
+        domain === observedHostname ? serviceFields : [],
+        domain === delegationHostname ? [recordField('delegation_ds', 'DNS delegation', Object.hasOwn(delegationRecords, 'ds') ? sourceState(delegation) : 'unsupported', delegationRecords.ds, canonicalDsRecord, sourceClock(delegation.observedAt))] : [],
+    ]);
     return Object.freeze({
-        domain: document.registrableDomain, capturedAt: document.generatedAt, collectionDepth: document.mode,
+        domain, capturedAt: document.generatedAt, collectionDepth: document.mode,
         fields: Object.freeze(fields.map((item) => item.state === 'observed' && item.observedAt !== null
             && Date.parse(item.observedAt) > Date.parse(document.generatedAt) ? Object.freeze({ ...item, state: 'partial' }) : item)),
     });
@@ -219,19 +235,40 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
     const lookups = input.lookups.map((item, index) => parseSavedLookupDocument(JSON.stringify(item), { label: `Lookup ${index + 1}` }));
     const byDomain = new Map();
     for (const lookup of lookups) {
-        const group = byDomain.get(lookup.registrableDomain) ?? [];
-        group.push(lookup);
-        byDomain.set(lookup.registrableDomain, group);
+        const domains = new Set([lookup.registrableDomain, serviceHostname(lookup)]);
+        for (const domain of domains) {
+            if (domain === null)
+                continue;
+            const group = byDomain.get(domain) ?? [];
+            group.push(lookup);
+            byDomain.set(domain, group);
+        }
     }
-    let ignoredHistoricalLookups = 0;
+    const retainedLookups = new Set();
     const selected = [...byDomain.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([domain, documents]) => {
-        const cohort = latestObservationCohort(documents, (document) => document.generatedAt);
-        ignoredHistoricalLookups += cohort.superseded;
-        const captures = cohort.latest.map((document) => ({ document, observation: domainControlObservationFromSavedLookup(document) }));
+        const candidates = documents.map((document) => {
+            const observation = domainControlObservationFromSavedLookup(document, domain);
+            return { document, observation, reviewFields: reviewFields(document, observation) };
+        });
+        const currentCaptures = new Set();
+        const currentFields = [];
+        const currentReviewFields = [];
+        for (const id of DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS) {
+            const eligible = candidates.filter(candidate => candidate.observation.fields.some(item => item.id === id));
+            const latest = latestObservationCohort(eligible, candidate => candidate.document.generatedAt);
+            for (const capture of latest.latest) {
+                currentCaptures.add(capture);
+                retainedLookups.add(capture.document);
+                currentFields.push(capture.observation.fields.filter(item => item.id === id));
+                currentReviewFields.push(capture.reviewFields.filter(item => item.id === id));
+            }
+        }
+        const captures = [...currentCaptures];
+        const cohort = latestObservationCohort(captures, capture => capture.document.generatedAt);
         const first = captures[0];
         if (!first || !cohort.observedAt || cohort.undated.length)
             throw new CliUsageError('Saved Lookup observation times could not be ordered.');
-        const mergedFields = mergeConcurrentDomainControlFields(captures.map((capture) => capture.observation.fields));
+        const mergedFields = mergeConcurrentDomainControlFields(currentFields);
         const futureCapture = Date.parse(cohort.observedAt) > Date.parse(generatedAt);
         const observation = Object.freeze({
             domain,
@@ -240,7 +277,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
                 ? first.observation.collectionDepth : 'unknown',
             fields: futureCapture ? mergedFields.map((field) => ({ ...field, state: 'partial' })) : mergedFields,
         });
-        const fields = mergeConcurrentDomainControlFields(captures.map((capture) => reviewFields(capture.document, capture.observation)));
+        const fields = mergeConcurrentDomainControlFields(currentReviewFields);
         return { observation, reviewFields: futureCapture || observation.collectionDepth === 'unknown'
                 ? fields.map((field) => ({ ...field, state: 'partial' })) : fields };
     });
@@ -268,7 +305,7 @@ export function buildCliDomainControlReview(inputText, generatedAt = new Date().
         input: Object.freeze({
             lookupsReceived: lookups.length,
             latestDomainObservations: observations.length,
-            ignoredHistoricalLookups,
+            ignoredHistoricalLookups: lookups.length - retainedLookups.size,
         }),
         limitations: CLI_DOMAIN_CONTROL_REVIEW_LIMITATIONS,
     });

package/cli/fail-policy.mjs

@@ -1,5 +1,8 @@
 import { lookupStrictExitFindings } from "./strict-exit.mjs";
 import { CliUsageError } from "./errors.mjs";
+import { RISK_REVIEW_THRESHOLD } from "../packages/analysis/risk-scoring.mjs";
+import { explainCliLookupRisk } from "./risk-policy.mjs";
+import { DOMAIN_CONTROL_REVIEW_SCHEMA } from "../packages/contracts/domain-control-review.mjs";
 export const CLI_FAIL_POLICIES = ['source-failure', 'inconclusive', 'danger', 'material-drift'];
 export const CLI_FAIL_POLICIES_BY_COMMAND = Object.freeze({
     lookup: Object.freeze(['source-failure', 'inconclusive', 'danger']),
@@ -31,14 +34,7 @@ function availabilityStates(document) {
     });
     return [direct, review, ...resultStates].filter(Boolean);
 }
-function riskScore(value) {
-    const raw = record(value.risk).score ?? value.riskScore;
-    if (raw === null || raw === undefined || raw === '')
-        return null;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) ? parsed : null;
-}
-export function evaluateCliFailPolicies(document, policies) {
+export function evaluateCliFailPolicies(document, policies, profile = null, currentSourceFailureCount = 0) {
     const root = record(document);
     const findings = [];
     for (const policy of policies) {
@@ -50,28 +46,31 @@ export function evaluateCliFailPolicies(document, policies) {
             const collection = record(root.collection);
             const summary = record(root.summary);
             const failed = Number(collection.failed ?? summary.failed ?? 0);
-            if (sourceFindings.length || failed > 0)
-                findings.push({ policy, reason: `${sourceFindings.length + failed} failed or incomplete collection state(s)` });
+            const failures = sourceFindings.length + failed + currentSourceFailureCount;
+            if (failures > 0)
+                findings.push({ policy, reason: `${failures} failed or incomplete collection state(s)` });
         }
         else if (policy === 'inconclusive') {
-            const count = availabilityStates(root).filter((state) => ['unknown', 'inconclusive', 'partial', 'unavailable'].includes(state)).length;
+            const review = record(root.review);
+            const comparisons = review.schema === DOMAIN_CONTROL_REVIEW_SCHEMA;
+            const counts = record(review.counts);
+            const count = comparisons
+                ? Number(counts.partial ?? 0) + Number(counts.unavailable ?? 0) + Number(counts.unsupported ?? 0)
+                : availabilityStates(root).filter((state) => ['unknown', 'inconclusive', 'partial', 'unavailable'].includes(state)).length;
             if (count)
-                findings.push({ policy, reason: `${count} authority or availability state(s) remained inconclusive` });
+                findings.push({ policy, reason: `${count} ${comparisons ? 'requested comparison(s)' : 'authority or availability state(s)'} remained inconclusive` });
         }
         else if (policy === 'danger') {
             const documents = [root, ...(Array.isArray(root.results) ? root.results.map(record) : [])];
-            const risks = documents.map(riskScore).filter((score) => score !== null);
-            const severities = documents
-                .flatMap((item) => [item.severity, record(item.review).severity])
-                .map((severity) => String(severity || '').toLowerCase())
-                .filter((severity) => severity === 'danger' || severity === 'critical');
-            const highestRisk = risks.length ? Math.max(...risks) : null;
-            if ((highestRisk !== null && highestRisk >= 70) || severities.length) {
+            const risks = documents.flatMap(item => {
+                const risk = explainCliLookupRisk(item, profile, item.mode ?? root.mode);
+                return risk ? [risk] : [];
+            });
+            const highestRisk = risks.reduce((highest, risk) => (!highest || risk.score > highest.score ? risk : highest), null);
+            if (highestRisk && highestRisk.score >= RISK_REVIEW_THRESHOLD) {
                 findings.push({
                     policy,
-                    reason: highestRisk !== null && highestRisk >= 70
-                        ? `risk score ${highestRisk} met the 70 review threshold`
-                        : `explicit ${severities[0]} severity was present`,
+                    reason: `risk score ${highestRisk.score} met the ${RISK_REVIEW_THRESHOLD} review threshold; model v${highestRisk.modelVersion}; evidence ${highestRisk.evidenceQuality.state} (heuristic, not a verdict)`,
                 });
             }
         }
@@ -87,3 +86,13 @@ export function evaluateCliFailPolicies(document, policies) {
 export function formatFailPolicyNotice(findings) {
     return `Failure policy matched: ${findings.map((item) => `${item.policy} (${item.reason})`).join('; ')}.\n`;
 }
+export function reportCliFailPolicies(findings, writeStderr, progress) {
+    if (!findings.length)
+        return;
+    if (!progress.enabled)
+        writeStderr(formatFailPolicyNotice(findings));
+    else
+        for (const finding of findings) {
+            progress.emit({ event: 'warning', state: 'failure_policy_matched', source: finding.policy, reason: finding.reason });
+        }
+}

package/cli/lookup-command-runner.mjs

@@ -13,7 +13,8 @@ import { buildCliLookupPlan, formatCliLookupPlan } from "./lookup-plan.mjs";
 import { createCliProgressEvents } from "./progress-events.mjs";
 import { serializeCliLookupDocument } from "./saved-lookup.mjs";
 import { lookupStrictExitFindings } from "./strict-exit.mjs";
-import { evaluateCliFailPolicies, formatFailPolicyNotice } from "./fail-policy.mjs";
+import { evaluateCliFailPolicies, reportCliFailPolicies } from "./fail-policy.mjs";
+import { readCliRiskProfile } from "./risk-policy.mjs";
 import { formatCliJunit } from "./ci-report.mjs";
 import { browseLookupOperation, canBrowseLookup } from "./lookup-browser.mjs";
 import { writePrivateFile } from "./output-file.mjs";
@@ -66,6 +67,7 @@ async function runLookupCommand(args, dependencies, context) {
             : context.terminal(formatCliLookupPlan(plan), args.color));
         return EXIT_CODES.SUCCESS;
     }
+    const riskProfile = await readCliRiskProfile(args.brandProfileSource, context.readInput, args.brandProfileId);
     let documentGeneratedAt = '';
     const buildDocument = ({ result, collectionReceipt }) => {
         documentGeneratedAt = context.now();
@@ -139,6 +141,8 @@ async function runLookupCommand(args, dependencies, context) {
         }
         document = buildDocument(result);
     }
+    const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || [], riskProfile);
     if (!args.quiet) {
         if (args.output === 'json')
             context.writeStdout(serializeCliLookupDocument(document));
@@ -156,14 +160,11 @@ async function runLookupCommand(args, dependencies, context) {
             context.writeStdout(context.terminal(formatTerminalLookup(document, { detail: args.detail }), args.color));
         }
     }
-    const strictFindings = args.strictExit ? lookupStrictExitFindings(document) : [];
-    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
     const exitCode = strictFindings.length || policyFindings.length ? EXIT_CODES.PARTIAL_FAILURE : EXIT_CODES.SUCCESS;
     if (strictFindings.length && !args.events) {
         context.writeStderr(`Strict exit: ${strictFindings.length} requested source state${strictFindings.length === 1 ? '' : 's'} were incomplete.\n`);
     }
-    if (policyFindings.length && !args.events)
-        context.writeStderr(formatFailPolicyNotice(policyFindings));
+    reportCliFailPolicies(policyFindings, context.writeStderr, eventProgress);
     eventProgress.emit({ event: 'completed', exitCode });
     return exitCode;
 }

package/cli/lookup-diff.mjs

@@ -83,6 +83,7 @@ function lookupComparisonInput(document) {
         trusted: null,
         error: '',
         scanDepth: document.mode,
+        webCollectionQuality: availability.webCollectionQuality,
         createdDate: lifecycleValue(preferredRegistry, 'createdDate'),
         expiryDate: lifecycleValue(preferredRegistry, 'expiryDate'),
         nameservers: relationship.nameservers.length ? relationship.nameservers : stringList(preferredRegistry.nameservers, 20),