calvyn-code 0.14.0

package/optional-skills/research/osint-investigation/SKILL.md

@@ -0,0 +1,277 @@
+---
+name: osint-investigation
+description: Public-records OSINT investigation framework — SEC EDGAR filings, USAspending contracts, Senate lobbying, OFAC sanctions, ICIJ offshore leaks, NYC property records (ACRIS), OpenCorporates registries, CourtListener court records, Wayback Machine archives, Wikipedia + Wikidata, GDELT news monitoring. Entity resolution across sources, cross-link analysis, timing correlation, evidence chains. Python stdlib only.
+version: 0.1.0
+platforms: [linux, macos, windows]
+author: Hermes Agent (adapted from ShinMegamiBoson/OpenPlanter, MIT)
+metadata:
+  hermes:
+    tags: [osint, investigation, public-records, sec, sanctions, corporate-registry, property, courts, due-diligence, journalism]
+    category: research
+    related_skills: [domain-intel, arxiv]
+---
+
+# OSINT Investigation — Public Records Cross-Reference
+
+Investigative framework for public-records OSINT: government contracts,
+corporate filings, lobbying, sanctions, offshore leaks, property records,
+court records, web archives, knowledge bases, and global news. Resolve
+entities across heterogeneous sources, build cross-links with explicit
+confidence, run statistical timing tests, and produce structured evidence
+chains.
+
+**Python stdlib only.** Zero install. Works on Linux, macOS, Windows. Most
+sources work with no API key (OpenCorporates has an optional free token
+that raises rate limits).
+
+Adapted from the MIT-licensed ShinMegamiBoson/OpenPlanter project; expanded
+to cover identity / property / litigation / archives / news sources that
+the original didn't address.
+
+## When to use this skill
+
+Use when the user asks for:
+
+- "follow the money" — government contracts, lobbying → legislation, sanctions
+- corporate due diligence — who controls company X, where are they
+  incorporated, who serves on their boards, what filings have they made
+- sanctions screening — is entity X on OFAC SDN, ICIJ offshore leaks
+- pay-to-play investigation — contractors with offshore ties, lobbying
+  clients winning awards
+- property ownership — find recorded deeds/mortgages by name or address
+  (NYC; for other counties point users at the relevant recorder)
+- litigation history — find federal + state court opinions and PACER dockets
+- multi-source entity resolution where naming varies (LLC suffixes, abbreviations)
+- evidence-chain construction with explicit confidence levels
+- "what's been said about X" — international news (GDELT) + Wikipedia
+  narrative + Wayback Machine to recover dead URLs
+
+Do NOT use this skill for:
+
+- general web research → `web_search` / `web_extract`
+- domain/infrastructure OSINT → `domain-intel` skill
+- academic literature → `arxiv` skill
+- social-media profile discovery → `sherlock` skill (optional)
+- US **federal** campaign finance — FEC is intentionally NOT covered here
+  (the API is unreliable for ad-hoc contributor-name queries on the free
+  DEMO_KEY tier). For federal donations, point users at
+  https://www.fec.gov/data/ directly.
+
+## Workflow
+
+The agent runs scripts via the `terminal` tool. `SKILL_DIR` is the directory
+holding this SKILL.md.
+
+### 1. Identify which sources apply
+
+Read the data-source wiki entries to plan the investigation:
+
+```
+ls SKILL_DIR/references/sources/
+
+# Federal financial / regulatory
+cat SKILL_DIR/references/sources/sec-edgar.md       # corporate filings
+cat SKILL_DIR/references/sources/usaspending.md     # federal contracts
+cat SKILL_DIR/references/sources/senate-ld.md       # lobbying
+cat SKILL_DIR/references/sources/ofac-sdn.md        # sanctions
+cat SKILL_DIR/references/sources/icij-offshore.md   # offshore leaks
+
+# Identity / property / litigation / archives / news
+cat SKILL_DIR/references/sources/nyc-acris.md       # NYC property records
+cat SKILL_DIR/references/sources/opencorporates.md  # global corporate registry
+cat SKILL_DIR/references/sources/courtlistener.md   # court records (federal + state)
+cat SKILL_DIR/references/sources/wayback.md         # Wayback Machine archives
+cat SKILL_DIR/references/sources/wikipedia.md       # Wikipedia + Wikidata
+cat SKILL_DIR/references/sources/gdelt.md           # global news monitoring
+```
+
+Each entry follows a 9-section template: summary, access, schema, coverage,
+cross-reference keys, data quality, acquisition, legal, references.
+
+The **cross-reference potential** section maps join keys between sources — read
+those first to pick the right pair.
+
+### 2. Acquire data
+
+Each source has a stdlib-only fetch script in `SKILL_DIR/scripts/`:
+
+**Federal financial / regulatory**
+
+```bash
+# SEC EDGAR filings (corporate disclosures)
+python3 SKILL_DIR/scripts/fetch_sec_edgar.py --cik 0000320193 \
+    --types 10-K,10-Q --out data/edgar_filings.csv
+
+# USAspending federal contracts
+python3 SKILL_DIR/scripts/fetch_usaspending.py --recipient "EXAMPLE CORP" \
+    --fy 2024 --out data/contracts.csv
+
+# Senate LD-1 / LD-2 lobbying disclosures
+python3 SKILL_DIR/scripts/fetch_senate_ld.py --client "EXAMPLE CORP" \
+    --year 2024 --out data/lobbying.csv
+
+# OFAC SDN sanctions list (full snapshot)
+python3 SKILL_DIR/scripts/fetch_ofac_sdn.py --out data/ofac_sdn.csv
+
+# ICIJ Offshore Leaks — downloads ~70 MB bulk CSV on first use,
+# then searches it locally. Cached for 30 days under
+# $HERMES_OSINT_CACHE/icij/ (default: ~/.cache/hermes-osint/icij/).
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --entity "EXAMPLE CORP" \
+    --out data/icij.csv
+```
+
+**Identity / property / litigation / archives / news**
+
+```bash
+# NYC property records (deeds, mortgages, liens) — ACRIS via Socrata
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --name "SMITH, JOHN" \
+    --out data/acris.csv
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --address "571 HUDSON" \
+    --out data/acris_addr.csv
+
+# OpenCorporates — 130+ jurisdiction corporate registry
+# (free token required; set OPENCORPORATES_API_TOKEN or pass --token)
+python3 SKILL_DIR/scripts/fetch_opencorporates.py --query "Example Corp" \
+    --jurisdiction us_ny --out data/opencorporates.csv
+
+# CourtListener — federal + state court opinions, PACER dockets
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Smith v. Example Corp" \
+    --type opinions --out data/courts.csv
+
+# Wayback Machine — historical web captures
+python3 SKILL_DIR/scripts/fetch_wayback.py --url "example.com" \
+    --match host --collapse digest --out data/wayback.csv
+
+# Wikipedia + Wikidata — narrative bio + structured facts
+# Set HERMES_OSINT_UA=your-app/1.0 (your@email) to identify yourself
+python3 SKILL_DIR/scripts/fetch_wikipedia.py --query "Bill Gates" \
+    --out data/wp.csv
+
+# GDELT — global news in 100+ languages, ~2015→present
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query '"Example Corp"' \
+    --timespan 1y --out data/gdelt.csv
+```
+
+All outputs are normalized CSV with a header row. Re-run scripts idempotently.
+
+When a private individual won't be in a source (e.g. SEC EDGAR for a non-public-
+company person, USAspending for someone who isn't a federal contractor, Senate
+LDA for someone who isn't a lobbying client), the script returns 0 rows with a
+clear warning rather than silently writing an empty CSV. EDGAR specifically
+flags when the company-name resolver matched an individual Form 3/4/5 filer
+rather than a corporate registrant.
+
+Rate-limit notes are in each source's wiki entry. Default fetchers sleep
+politely between paginated requests. **API keys raise rate limits** for
+sources that support them (`SEC_USER_AGENT`, `SENATE_LDA_TOKEN`,
+`OPENCORPORATES_API_TOKEN`, `COURTLISTENER_TOKEN`). All scripts surface
+429 responses immediately with the upstream's quota message so the user
+knows to slow down or supply a key.
+
+### 3. Resolve entities across sources
+
+Normalize names and find matches between two CSV files:
+
+```bash
+# Match lobbying clients (Senate LDA) against contract recipients (USAspending)
+python3 SKILL_DIR/scripts/entity_resolution.py \
+    --left  data/lobbying.csv   --left-name-col  client_name \
+    --right data/contracts.csv  --right-name-col recipient_name \
+    --out data/cross_links.csv
+```
+
+Three matching tiers with explicit confidence:
+
+| Tier | Method | Confidence |
+|------|--------|------------|
+| `exact` | Normalized strings equal after suffix/punctuation strip | high |
+| `fuzzy` | Sorted-token equality (word-bag match) | medium |
+| `token_overlap` | ≥60% token overlap, ≥2 shared tokens, tokens ≥4 chars | low |
+
+Output `cross_links.csv` columns: `match_type, confidence, left_name,
+right_name, left_normalized, right_normalized, left_row, right_row`.
+
+### 4. Statistical timing correlation (optional)
+
+Test whether two time series cluster suspiciously close together — e.g.
+lobbying filings near contract awards — using a permutation test:
+
+```bash
+python3 SKILL_DIR/scripts/timing_analysis.py \
+    --donations data/lobbying.csv --donation-date-col filing_date \
+        --donation-amount-col income --donation-donor-col client_name \
+        --donation-recipient-col registrant_name \
+    --contracts data/contracts.csv --contract-date-col award_date \
+        --contract-vendor-col recipient_name \
+    --cross-links data/cross_links.csv \
+    --permutations 1000 \
+    --out data/timing.json
+```
+
+The script's column flags are intentionally generic — the original tool was
+written for donations vs awards, but it works for any (event, payee) time
+series joined through cross-links. Null hypothesis: event timing is
+independent of award dates. One-tailed p-value = fraction of permutations
+with mean nearest-award distance ≤ observed. Minimum 3 events per (payer,
+vendor) pair to run the test.
+
+### 5. Build the findings JSON (evidence chain)
+
+```bash
+python3 SKILL_DIR/scripts/build_findings.py \
+    --cross-links data/cross_links.csv \
+    --timing data/timing.json \
+    --out data/findings.json
+```
+
+Every finding has `id, title, severity, confidence, summary, evidence[], sources[]`.
+Each evidence item points back to a specific row in a source CSV. The user (or a
+follow-up agent) can verify every claim against its source.
+
+## Confidence and evidence discipline
+
+This is the load-bearing rule of the skill. Tell the user:
+
+- Every claim must trace to a record. No naked assertions.
+- Confidence tier travels with the claim. `match_type=fuzzy` is "probable",
+  not "confirmed."
+- Entity resolution produces candidates, NOT conclusions. A `fuzzy` match
+  between "ACME LLC" and "Acme Holdings Group" is a lead, not a fact.
+- Statistical significance ≠ wrongdoing. p < 0.05 means the timing pattern
+  is unlikely under the null. It does not establish corruption.
+- All data sources here are public records. They may still contain
+  inaccuracies, stale info, or redactions (GDPR, sealed records).
+
+## Adding a new data source
+
+Use the template:
+
+```bash
+cp SKILL_DIR/templates/source-template.md \
+    SKILL_DIR/references/sources/<your-source>.md
+```
+
+Fill in all 9 sections. Write a `fetch_<source>.py` script in `scripts/` that
+uses stdlib only and writes a normalized CSV. Update the source list in the
+"When to use" section above.
+
+## Tools and their limits
+
+- `entity_resolution.py` does NOT use external fuzzy libraries (no rapidfuzz,
+  no jellyfish). Token-bag matching is the upper bound here. If you need
+  Levenshtein, transliteration, or phonetic matching, pip-install separately.
+- `timing_analysis.py` uses Python's `random` for permutations. For
+  reproducibility, pass `--seed N`.
+- `fetch_*.py` scripts use `urllib.request` and respect `Retry-After`. Heavy
+  bulk usage may still violate ToS — read each source's legal section first.
+
+## Legal note
+
+All Phase-1 sources are public records. Bulk acquisition is permitted under
+their respective access terms (FOIA, public records law, ICIJ explicit
+publication, OFAC public data). However:
+
+- Some sources rate-limit aggressively. Respect their headers.
+- Some redact registrant info (GDPR on WHOIS, sealed filings).
+- Cross-referencing public records to identify private individuals can have
+  ethical implications. The skill produces evidence chains, not accusations.

package/optional-skills/research/osint-investigation/references/sources/courtlistener.md

@@ -0,0 +1,98 @@
+# CourtListener — Free Law Project
+
+## 1. Summary
+
+CourtListener (Free Law Project) aggregates court opinions, dockets, oral
+arguments, and judge data. Covers ~10M federal and state court opinions
+back to colonial America, plus PACER docket data from RECAP submissions.
+
+## 2. Access Methods
+
+- **REST API v4:** `https://www.courtlistener.com/api/rest/v4/`
+- **Auth:** Anonymous reads allowed on most endpoints; token raises rate
+  limits and unlocks bulk export
+- **Rate limit:** ~5,000 req/hour unauthenticated for search; higher with token
+
+Set `COURTLISTENER_TOKEN` env var. Get a free token at
+https://www.courtlistener.com/sign-in/ then create an API key.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_courtlistener.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `case_name` | str | Case name |
+| `court` | str | Court name |
+| `court_id` | str | Court ID (e.g. `nysd`, `scotus`, `ca9`) |
+| `date_filed` | str | YYYY-MM-DD |
+| `docket_number` | str | Court docket number |
+| `judge` | str | Judge name(s) |
+| `citation` | str | Reporter citation(s) |
+| `result_type` | str | opinions / dockets / oral / people |
+| `snippet` | str | Search-match snippet (up to 500 chars) |
+| `absolute_url` | str | Direct CourtListener URL |
+
+## 4. Coverage
+
+- Federal: all circuit and district courts, SCOTUS
+- State: all 50 state supreme/appellate courts, many trial courts
+- Opinions: ~10M back to 1600s (colonial), full coverage 1950 → present
+- Dockets via RECAP: ~3M+ from user-submitted PACER PDFs
+- Updated continuously
+
+## 5. Cross-Reference Potential
+
+- **OpenCorporates** ↔ `case_name` (corporate litigation)
+- **SEC EDGAR** ↔ `case_name` (securities class actions)
+- **OFAC SDN** ↔ `case_name` (sanctions-related civil/criminal cases)
+
+Join key: party name from `case_name`. Note: `case_name` often abbreviates
+("Smith v. Jones" rather than full party names) — use the full case URL
+to get all parties.
+
+## 6. Data Quality
+
+- Older opinions (pre-1990) often lack docket numbers and judges
+- State coverage is more uneven than federal
+- PACER docket coverage depends on RECAP user submissions — not exhaustive
+- Sealed documents are excluded
+- Party names in case captions don't always match filing names exactly
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_courtlistener.py`
+
+```bash
+# Search opinions for a party / keyword
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Example Corp" \
+    --out data/cl.csv
+
+# PACER dockets (best for recent litigation)
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Example Corp" \
+    --type dockets --out data/cl_dockets.csv
+
+# Restrict to a court
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Microsoft" \
+    --court ca9 --out data/cl_9th.csv
+
+# Date range
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Example Corp" \
+    --date-from 2020-01-01 --date-to 2024-12-31 --out data/cl.csv
+```
+
+Pass `--token` or set `COURTLISTENER_TOKEN`.
+
+## 8. Legal & Licensing
+
+- Court opinions are public domain
+- Free Law Project provides the data under CC0 / public domain dedication
+- No commercial use restrictions on opinion text or metadata
+- Some PACER PDFs have copyright on layout (not text) — fair use applies
+
+## 9. References
+
+- API docs: https://www.courtlistener.com/help/api/rest/
+- Court IDs: https://www.courtlistener.com/api/jurisdictions/
+- RECAP archive: https://www.courtlistener.com/recap/
+- Bulk data: https://www.courtlistener.com/help/api/bulk-data/

package/optional-skills/research/osint-investigation/references/sources/gdelt.md

@@ -0,0 +1,104 @@
+# GDELT — Global News Monitoring
+
+## 1. Summary
+
+GDELT (Global Database of Events, Language, and Tone) monitors world news
+in 100+ languages with full-text indexing. Updated every 15 minutes.
+~2015 → present, ~1B+ articles indexed. Free anonymous access.
+
+GDELT is wider than Google News (more international, more long-tail
+sources) and indexed by tone/sentiment, themes (CAMEO codes), people, and
+organizations.
+
+## 2. Access Methods
+
+- **DOC 2.0 API:** `https://api.gdeltproject.org/api/v2/doc/doc`
+- **Events / GKG 2.0:** `https://api.gdeltproject.org/api/v2/events/events`
+- **Auth:** None
+- **Rate limit:** **1 request per 5 seconds** for the DOC API — strict
+
+The fetch script automatically retries after a 6-second sleep when a
+429 is received.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_gdelt.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `title` | str | Article title |
+| `url` | str | Article URL |
+| `seen_date` | str | When GDELT first saw the article (UTC) |
+| `domain` | str | Publisher domain |
+| `language` | str | Source language |
+| `source_country` | str | 2-letter country code |
+| `tone` | str | GDELT-computed tone score (negative = negative coverage) |
+| `social_image` | str | Open Graph image URL when available |
+
+## 4. Coverage
+
+- Worldwide news in 100+ languages
+- ~2015 → present (Events back to 1979 via a separate stream)
+- Update frequency: 15 minutes
+- Bias: heavily Anglophone in volume but very wide source list overall
+
+## 5. Cross-Reference Potential
+
+- **All sources** ↔ `title` / `url` (news context for any subject)
+- **Wikipedia** ↔ event timeline for notable entities
+- **Wayback Machine** ↔ recover articles whose URLs have died
+- **OFAC SDN** ↔ news context for sanctions designations
+- **SEC EDGAR** ↔ news context for 8-K material events
+
+Join key: entity name appearing in article title or full-text. GDELT also
+extracts named entities into a separate stream (GKG) not exposed by this
+fetcher — query GDELT directly for entity-level filtering.
+
+## 6. Data Quality
+
+- Title extraction is automated and can be wrong (sometimes captures the
+  site name + delimiter + article title; sometimes a generic page title)
+- Sentiment / tone is computed by GDELT, not source-supplied
+- Some domains are oversampled (newswires, aggregators)
+- Source country is inferred from domain registration / TLD — can be
+  wrong for international news sites with country-neutral domains
+- Article URLs can rot — pair with Wayback Machine to preserve content
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_gdelt.py`
+
+```bash
+# Recent news mentioning an entity
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query "Nous Research" \
+    --timespan 6m --out data/gdelt.csv
+
+# Phrase-exact (use double quotes inside single quotes for the shell)
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query '"Dillon Rolnick"' \
+    --timespan 1y --out data/gdelt.csv
+
+# Filter to a country / language
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query "Microsoft" \
+    --source-country US --source-lang English --out data/gdelt.csv
+
+# Date range
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query "Microsoft" \
+    --start 2024-01-01 --end 2024-12-31 --out data/gdelt.csv
+```
+
+GDELT supports its own query operators: phrase quoting, AND/OR/NOT,
+`sourcecountry:US`, `theme:ECON_BANKRUPTCY`, `tone<-5`, etc.
+See https://blog.gdeltproject.org/gdelt-doc-2-0-api-debuts/ for syntax.
+
+## 8. Legal & Licensing
+
+- GDELT data is provided free for academic and journalistic use
+- Article URLs link out to original publishers — copyright remains with
+  the publisher
+- GDELT is NOT a content archive; it's a metadata index
+
+## 9. References
+
+- DOC 2.0 API: https://blog.gdeltproject.org/gdelt-doc-2-0-api-debuts/
+- Themes & query syntax: https://blog.gdeltproject.org/gkg-2-0-our-global-knowledge-graph-2-0-amazing-data-at-your-fingertips/
+- Project home: https://www.gdeltproject.org/

package/optional-skills/research/osint-investigation/references/sources/icij-offshore.md

@@ -0,0 +1,104 @@
+# ICIJ Offshore Leaks Database
+
+## 1. Summary
+
+The International Consortium of Investigative Journalists (ICIJ) publishes a
+combined database of offshore entities from the Panama Papers, Paradise Papers,
+Pandora Papers, Bahamas Leaks, and Offshore Leaks. ~800,000+ offshore entities
+with their officers, intermediaries, and addresses.
+
+## 2. Access Methods
+
+- **Bulk download (primary):** `https://offshoreleaks-data.icij.org/offshoreleaks/csv/full-oldb.LATEST.zip` (~70 MB ZIP, refreshed periodically)
+- **Search UI (human):** `https://offshoreleaks.icij.org/`
+- **Auth:** None
+- **Note:** The previous Open Refine reconciliation endpoint at
+  `/reconcile` now returns 404. ICIJ has removed it. The bulk ZIP is the
+  remaining stable access path. The skill's `fetch_icij_offshore.py` caches
+  the ZIP locally (default `~/.cache/hermes-osint/icij/`, refreshes after
+  30 days) and searches it offline.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_icij_offshore.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `node_id` | int | ICIJ canonical node ID |
+| `name` | str | Entity / officer / intermediary name |
+| `node_type` | str | entity / officer / intermediary / address |
+| `country_codes` | str | Semicolon-separated ISO codes |
+| `countries` | str | Country names |
+| `jurisdiction` | str | Offshore jurisdiction (BVI, Panama, etc.) |
+| `incorporation_date` | str | YYYY-MM-DD |
+| `inactivation_date` | str | YYYY-MM-DD (if struck) |
+| `source` | str | Panama Papers / Paradise Papers / Pandora Papers / etc. |
+| `entity_url` | str | Link to ICIJ page |
+| `connections` | str | Semicolon-separated node IDs of related entities |
+
+## 4. Coverage
+
+- Worldwide offshore entity records
+- Earliest records: 1970s (Bahamas Leaks). Most data 1990–2018.
+- NOT updated in real-time — new leaks added when ICIJ publishes them
+- ~810,000 offshore entities + ~750,000 officers + ~150,000 intermediaries
+
+## 5. Cross-Reference Potential
+
+- **SEC EDGAR** ↔ `name` (public companies with offshore arms)
+- **USAspending** ↔ `name` (federal contractors with offshore structure)
+- **OFAC SDN** ↔ `name` (sanctioned entities using offshore vehicles)
+
+Join key: normalized entity/officer name. `node_id` is canonical for cross-
+referencing within ICIJ. Connections graph traversal is in-script (BFS over
+`connections`).
+
+## 6. Data Quality
+
+- Offshore entity names sometimes appear in multiple leaks with slight variations
+- Officers may be nominees (front persons), not beneficial owners
+- Some entries have minimal info (just a name + jurisdiction)
+- The connections graph is incomplete — some relationships are documented in
+  source materials but not in the structured database
+- Inactive/struck-off entities are still included with `inactivation_date`
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_icij_offshore.py`
+
+```bash
+# Search by entity name (case-insensitive substring across the bulk DB)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --entity "EXAMPLE CORP" \
+    --out data/icij.csv
+
+# Search by officer (individual person)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --officer "SMITH JOHN" \
+    --out data/icij.csv
+
+# Search by jurisdiction (filter on cached results)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --officer "SMITH" \
+    --jurisdiction "BRITISH VIRGIN ISLANDS" --out data/icij_bvi.csv
+
+# Force a fresh download (default refresh window is 30 days)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --entity "EXAMPLE CORP" \
+    --force-refresh --out data/icij.csv
+```
+
+First call downloads the ~70 MB ZIP under `~/.cache/hermes-osint/icij/`
+(or `$HERMES_OSINT_CACHE/icij/`). Subsequent calls reuse the cache for 30 days.
+
+## 8. Legal & Licensing
+
+- Public record as published by ICIJ under explicit publication
+- No copyright on the underlying facts (entity names, jurisdictions)
+- ICIJ asks for attribution if used in derivative reporting
+- **Ethical note**: Presence in this database does NOT imply wrongdoing. Many
+  offshore structures are legal. The database is a research tool, not a list of
+  criminals.
+
+## 9. References
+
+- Database: https://offshoreleaks.icij.org/
+- About the data: https://offshoreleaks.icij.org/pages/about
+- Methodology: https://www.icij.org/investigations/panama-papers/
+- API hints: Open Refine reconciliation endpoint at `https://offshoreleaks.icij.org/reconcile`

package/optional-skills/research/osint-investigation/references/sources/nyc-acris.md

@@ -0,0 +1,90 @@
+# NYC ACRIS — NYC Real Property Records
+
+## 1. Summary
+
+The Automated City Register Information System (ACRIS) is NYC's index of
+recorded property documents: deeds, mortgages, satisfactions, liens, UCC
+filings. Covers Manhattan, Bronx, Brooklyn, Queens, Staten Island.
+Published as 4 linked Socrata datasets on the NYC Open Data portal.
+
+## 2. Access Methods
+
+- **Socrata API:** `https://data.cityofnewyork.us/resource/636b-3b5g.json` (Parties)
+- **Other datasets:** `bnx9-e6tj` (Master), `8h5j-fqxa` (Legal), `uqqa-hym2` (References)
+- **Auth:** None for read access (Socrata `$app_token` raises rate limits if needed)
+- **Rate limit:** Generous (~1000 req/hour unauthenticated)
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_nyc_acris.py` (Parties joined to Master):
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `document_id` | str | ACRIS document ID |
+| `name` | str | Party name as recorded (often "LAST, FIRST" but varies) |
+| `party_type` | str | 1=grantor, 2=grantee, 3=other |
+| `party_role` | str | Human-readable role label |
+| `address_1` | str | Property or party address line 1 |
+| `city`, `state`, `zip`, `country` | str | Address parts |
+| `doc_type` | str | DEED, MTGE (mortgage), SAT (satisfaction), AGMT, etc. |
+| `doc_date`, `recorded_date` | str | YYYY-MM-DD |
+| `borough` | str | Manhattan / Bronx / Brooklyn / Queens / Staten Island |
+| `amount` | str | Document amount (USD, when applicable) |
+| `filing_url` | str | Direct ACRIS DocumentImageView link |
+
+## 4. Coverage
+
+- NYC 5 boroughs only — other counties have their own recorders
+- 1966 → present (older filings exist on microfilm at the County Clerk)
+- Updated nightly
+- ~70M+ party records cumulative
+
+## 5. Cross-Reference Potential
+
+- **SEC EDGAR** ↔ `name` (insider filers with NYC property)
+- **USAspending** ↔ `name` (federal contractors with NYC property)
+- **Senate LDA** ↔ `name` (lobbyists / clients with NYC property)
+- **ICIJ Offshore** ↔ `name` (NYC properties owned via offshore vehicles)
+
+Join key: normalized party name. NYC property records typically store names
+as "LAST, FIRST" or full LLC names — use `entity_resolution.py`.
+
+## 6. Data Quality
+
+- Same person appears with multiple name formats over time
+- LLC and trust ownership obscures beneficial owners
+- Recording lag can be 2-4 weeks after closing
+- Older documents have spottier address data
+- Sealed records (e.g. domestic violence shelters) are excluded by law
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_nyc_acris.py`
+
+```bash
+# By party name
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --name "ROLNICK" --out data/acris.csv
+
+# By address (useful when you know the property but not the names)
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --address "571 HUDSON" --out data/acris.csv
+
+# Restrict to grantees (buyers / mortgagees)
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --name "ROLNICK" --party-type 2 \
+    --out data/acris_buyers.csv
+```
+
+The script joins Parties → Master to populate doc_type, dates, borough, and
+amount. Pass `--no-enrich` to skip the join (faster, fewer columns).
+
+## 8. Legal & Licensing
+
+- Public record under NYS Real Property Law and NYC Charter
+- No commercial use restrictions on the data
+- All ACRIS data is public information by statute
+
+## 9. References
+
+- ACRIS portal: https://a836-acris.nyc.gov/CP/
+- NYC Open Data: https://data.cityofnewyork.us/
+- Parties dataset: https://data.cityofnewyork.us/City-Government/ACRIS-Real-Property-Parties/636b-3b5g
+- Document type codes: https://www1.nyc.gov/site/finance/taxes/acris.page