mindforge-cc 11.8.2 → 11.9.0

package/.agent/skills/mindforge-verify-work/SKILL.md

@@ -13,7 +13,7 @@ Output: {phase_num}-UAT.md tracking all test results. If issues found: diagnosed
 
 <execution_context>
 @.agent/workflows/mindforge-verify-work.md
-@.agent/templates/UAT.md
+@docs/Templates/Quality/UAT.md
 </execution_context>
 
 <context>

package/.agent/skills/mindforge-workspace-isolated/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: "using-git-worktrees"
+name: "mindforge-workspace-isolated"
 description: "Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification"
 ---
 

package/.agent/skills/node-inspect-debugger/SKILL.md

@@ -267,7 +267,7 @@ require('fs').writeFileSync('/tmp/heap.heapsnapshot', chunks.join(''));
 
 5. **Background kills.** If you `Ctrl+C` out of `node inspect` while the target is paused, the target stays paused. Either `cont` first, or `kill` the target explicitly.
 
-6. **Running `node inspect` through an agent terminal.** It's a PTY-friendly REPL. In the agent, launch it with `terminal(pty=true)` or `background=true` + `process(action='submit', data='...')`. Non-PTY foreground mode will work for one-shot commands but not for interactive stepping.
+6. **Running `node inspect` through an agent terminal.** It's a PTY-friendly REPL. In the agent, launch it with `Bash(pty=true)` or `background=true` + `process(action='submit', data='...')`. Non-PTY foreground mode will work for one-shot commands but not for interactive stepping.
 
 7. **Security.** `--inspect=0.0.0.0:9229` exposes arbitrary code execution. Always bind to `127.0.0.1` (the default) unless you have an isolated network.
 

package/.agent/skills/obsidian/SKILL.md

@@ -11,49 +11,49 @@ Use this skill for filesystem-first Obsidian vault work: reading notes, listing
 
 Use a known or resolved vault path before calling file tools.
 
-The documented vault-path convention is the `OBSIDIAN_VAULT_PATH` environment variable, for example from `${HERMES_HOME:-~/.hermes}/.env`. If it is unset, use `~/Documents/Obsidian Vault`.
+The documented vault-path convention is the `OBSIDIAN_VAULT_PATH` environment variable, for example from `${MINDFORGE_HOME:-~/.mindforge}/.env`. If it is unset, use `~/Documents/Obsidian Vault`.
 
-File tools do not expand shell variables. Do not pass paths containing `$OBSIDIAN_VAULT_PATH` to `read_file`, `write_file`, `patch`, or `search_files`; resolve the vault path first and pass a concrete absolute path. Vault paths may contain spaces, which is another reason to prefer file tools over shell commands.
+File tools do not expand shell variables. Do not pass paths containing `$OBSIDIAN_VAULT_PATH` to `Read`, `Write`, `Edit`, or `Grep`; resolve the vault path first and pass a concrete absolute path. Vault paths may contain spaces, which is another reason to prefer file tools over shell commands.
 
-If the vault path is unknown, `terminal` is acceptable for resolving `OBSIDIAN_VAULT_PATH` or checking whether the fallback path exists. Once the path is known, switch back to file tools.
+If the vault path is unknown, `Bash` is acceptable for resolving `OBSIDIAN_VAULT_PATH` or checking whether the fallback path exists. Once the path is known, switch back to file tools.
 
 ## Read a note
 
-Use `read_file` with the resolved absolute path to the note. Prefer this over `cat` because it provides line numbers and pagination.
+Use `Read` with the resolved absolute path to the note. Prefer this over `cat` because it provides line numbers and pagination.
 
 ## List notes
 
-Use `search_files` with `target: "files"` and the resolved vault path. Prefer this over `find` or `ls`.
+Use `Grep` with `target: "files"` and the resolved vault path. Prefer this over `find` or `ls`.
 
 - To list all markdown notes, use `pattern: "*.md"` under the vault path.
 - To list a subfolder, search under that subfolder's absolute path.
 
 ## Search
 
-Use `search_files` for both filename and content searches. Prefer this over `grep`, `find`, or `ls`.
+Use `Grep` for both filename and content searches. Prefer this over `grep`, `find`, or `ls`.
 
-- For filenames, use `search_files` with `target: "files"` and a filename `pattern`.
-- For note contents, use `search_files` with `target: "content"`, the content regex as `pattern`, and `file_glob: "*.md"` when you want to restrict matches to markdown notes.
+- For filenames, use `Grep` with `target: "files"` and a filename `pattern`.
+- For note contents, use `Grep` with `target: "content"`, the content regex as `pattern`, and `file_glob: "*.md"` when you want to restrict matches to markdown notes.
 
 ## Create a note
 
-Use `write_file` with the resolved absolute path and the full markdown content. Prefer this over shell heredocs or `echo` because it avoids shell quoting issues and returns structured results.
+Use `Write` with the resolved absolute path and the full markdown content. Prefer this over shell heredocs or `echo` because it avoids shell quoting issues and returns structured results.
 
 ## Append to a note
 
 Prefer a native file-tool workflow when it is not awkward:
 
-- Read the target note with `read_file`.
-- Use `patch` for an anchored append when there is stable context, such as adding a section after an existing heading or appending before a known trailing block.
-- Use `write_file` when rewriting the whole note is clearer than constructing a fragile patch.
+- Read the target note with `Read`.
+- Use `Edit` for an anchored append when there is stable context, such as adding a section after an existing heading or appending before a known trailing block.
+- Use `Write` when rewriting the whole note is clearer than constructing a fragile patch.
 
-For an anchored append with `patch`, replace the anchor with the anchor plus the new content.
+For an anchored append with `Edit`, replace the anchor with the anchor plus the new content.
 
-For a simple append with no stable context, `terminal` is acceptable if it is the clearest safe option.
+For a simple append with no stable context, `Bash` is acceptable if it is the clearest safe option.
 
 ## Targeted edits
 
-Use `patch` for focused note changes when the current content gives you stable context. Prefer this over shell text rewriting.
+Use `Edit` for focused note changes when the current content gives you stable context. Prefer this over shell text rewriting.
 
 ## Wikilinks
 

package/.agent/skills/osint-investigation/SKILL.md

@@ -17,6 +17,7 @@ chains.
 sources work with no API key (OpenCorporates has an optional free token
 that raises rate limits).
 
+Adapted from the MIT-licensed ShinMegamiBoson/OpenPlanter project; expanded
 to cover identity / property / litigation / archives / news sources that
 the original didn't address.
 
@@ -40,7 +41,7 @@ Use when the user asks for:
 
 Do NOT use this skill for:
 
-- general web research → `web_search` / `web_extract`
+- general web research → `WebSearch` / `WebFetch`
 - domain/infrastructure OSINT → `domain-intel` skill
 - academic literature → `arxiv` skill
 - social-media profile discovery → `sherlock` skill (optional)
@@ -51,7 +52,7 @@ Do NOT use this skill for:
 
 ## Workflow
 
-The agent runs scripts via the `terminal` tool. `SKILL_DIR` is the directory
+The agent runs scripts via the `Bash` tool. `SKILL_DIR` is the directory
 holding this SKILL.md.
 
 ### 1. Identify which sources apply

package/.agent/skills/osint-investigation/references/sources/courtlistener.md

@@ -0,0 +1,98 @@
+# CourtListener — Free Law Project
+
+## 1. Summary
+
+CourtListener (Free Law Project) aggregates court opinions, dockets, oral
+arguments, and judge data. Covers ~10M federal and state court opinions
+back to colonial America, plus PACER docket data from RECAP submissions.
+
+## 2. Access Methods
+
+- **REST API v4:** `https://www.courtlistener.com/api/rest/v4/`
+- **Auth:** Anonymous reads allowed on most endpoints; token raises rate
+  limits and unlocks bulk export
+- **Rate limit:** ~5,000 req/hour unauthenticated for search; higher with token
+
+Set `COURTLISTENER_TOKEN` env var. Get a free token at
+https://www.courtlistener.com/sign-in/ then create an API key.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_courtlistener.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `case_name` | str | Case name |
+| `court` | str | Court name |
+| `court_id` | str | Court ID (e.g. `nysd`, `scotus`, `ca9`) |
+| `date_filed` | str | YYYY-MM-DD |
+| `docket_number` | str | Court docket number |
+| `judge` | str | Judge name(s) |
+| `citation` | str | Reporter citation(s) |
+| `result_type` | str | opinions / dockets / oral / people |
+| `snippet` | str | Search-match snippet (up to 500 chars) |
+| `absolute_url` | str | Direct CourtListener URL |
+
+## 4. Coverage
+
+- Federal: all circuit and district courts, SCOTUS
+- State: all 50 state supreme/appellate courts, many trial courts
+- Opinions: ~10M back to 1600s (colonial), full coverage 1950 → present
+- Dockets via RECAP: ~3M+ from user-submitted PACER PDFs
+- Updated continuously
+
+## 5. Cross-Reference Potential
+
+- **OpenCorporates** ↔ `case_name` (corporate litigation)
+- **SEC EDGAR** ↔ `case_name` (securities class actions)
+- **OFAC SDN** ↔ `case_name` (sanctions-related civil/criminal cases)
+
+Join key: party name from `case_name`. Note: `case_name` often abbreviates
+("Smith v. Jones" rather than full party names) — use the full case URL
+to get all parties.
+
+## 6. Data Quality
+
+- Older opinions (pre-1990) often lack docket numbers and judges
+- State coverage is more uneven than federal
+- PACER docket coverage depends on RECAP user submissions — not exhaustive
+- Sealed documents are excluded
+- Party names in case captions don't always match filing names exactly
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_courtlistener.py`
+
+```bash
+# Search opinions for a party / keyword
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Example Corp" \
+    --out data/cl.csv
+
+# PACER dockets (best for recent litigation)
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Example Corp" \
+    --type dockets --out data/cl_dockets.csv
+
+# Restrict to a court
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Microsoft" \
+    --court ca9 --out data/cl_9th.csv
+
+# Date range
+python3 SKILL_DIR/scripts/fetch_courtlistener.py --query "Example Corp" \
+    --date-from 2020-01-01 --date-to 2024-12-31 --out data/cl.csv
+```
+
+Pass `--token` or set `COURTLISTENER_TOKEN`.
+
+## 8. Legal & Licensing
+
+- Court opinions are public domain
+- Free Law Project provides the data under CC0 / public domain dedication
+- No commercial use restrictions on opinion text or metadata
+- Some PACER PDFs have copyright on layout (not text) — fair use applies
+
+## 9. References
+
+- API docs: https://www.courtlistener.com/help/api/rest/
+- Court IDs: https://www.courtlistener.com/api/jurisdictions/
+- RECAP archive: https://www.courtlistener.com/recap/
+- Bulk data: https://www.courtlistener.com/help/api/bulk-data/

package/.agent/skills/osint-investigation/references/sources/gdelt.md

@@ -0,0 +1,104 @@
+# GDELT — Global News Monitoring
+
+## 1. Summary
+
+GDELT (Global Database of Events, Language, and Tone) monitors world news
+in 100+ languages with full-text indexing. Updated every 15 minutes.
+~2015 → present, ~1B+ articles indexed. Free anonymous access.
+
+GDELT is wider than Google News (more international, more long-tail
+sources) and indexed by tone/sentiment, themes (CAMEO codes), people, and
+organizations.
+
+## 2. Access Methods
+
+- **DOC 2.0 API:** `https://api.gdeltproject.org/api/v2/doc/doc`
+- **Events / GKG 2.0:** `https://api.gdeltproject.org/api/v2/events/events`
+- **Auth:** None
+- **Rate limit:** **1 request per 5 seconds** for the DOC API — strict
+
+The fetch script automatically retries after a 6-second sleep when a
+429 is received.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_gdelt.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `title` | str | Article title |
+| `url` | str | Article URL |
+| `seen_date` | str | When GDELT first saw the article (UTC) |
+| `domain` | str | Publisher domain |
+| `language` | str | Source language |
+| `source_country` | str | 2-letter country code |
+| `tone` | str | GDELT-computed tone score (negative = negative coverage) |
+| `social_image` | str | Open Graph image URL when available |
+
+## 4. Coverage
+
+- Worldwide news in 100+ languages
+- ~2015 → present (Events back to 1979 via a separate stream)
+- Update frequency: 15 minutes
+- Bias: heavily Anglophone in volume but very wide source list overall
+
+## 5. Cross-Reference Potential
+
+- **All sources** ↔ `title` / `url` (news context for any subject)
+- **Wikipedia** ↔ event timeline for notable entities
+- **Wayback Machine** ↔ recover articles whose URLs have died
+- **OFAC SDN** ↔ news context for sanctions designations
+- **SEC EDGAR** ↔ news context for 8-K material events
+
+Join key: entity name appearing in article title or full-text. GDELT also
+extracts named entities into a separate stream (GKG) not exposed by this
+fetcher — query GDELT directly for entity-level filtering.
+
+## 6. Data Quality
+
+- Title extraction is automated and can be wrong (sometimes captures the
+  site name + delimiter + article title; sometimes a generic page title)
+- Sentiment / tone is computed by GDELT, not source-supplied
+- Some domains are oversampled (newswires, aggregators)
+- Source country is inferred from domain registration / TLD — can be
+  wrong for international news sites with country-neutral domains
+- Article URLs can rot — pair with Wayback Machine to preserve content
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_gdelt.py`
+
+```bash
+# Recent news mentioning an entity
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query "Nous Research" \
+    --timespan 6m --out data/gdelt.csv
+
+# Phrase-exact (use double quotes inside single quotes for the shell)
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query '"Dillon Rolnick"' \
+    --timespan 1y --out data/gdelt.csv
+
+# Filter to a country / language
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query "Microsoft" \
+    --source-country US --source-lang English --out data/gdelt.csv
+
+# Date range
+python3 SKILL_DIR/scripts/fetch_gdelt.py --query "Microsoft" \
+    --start 2024-01-01 --end 2024-12-31 --out data/gdelt.csv
+```
+
+GDELT supports its own query operators: phrase quoting, AND/OR/NOT,
+`sourcecountry:US`, `theme:ECON_BANKRUPTCY`, `tone<-5`, etc.
+See https://blog.gdeltproject.org/gdelt-doc-2-0-api-debuts/ for syntax.
+
+## 8. Legal & Licensing
+
+- GDELT data is provided free for academic and journalistic use
+- Article URLs link out to original publishers — copyright remains with
+  the publisher
+- GDELT is NOT a content archive; it's a metadata index
+
+## 9. References
+
+- DOC 2.0 API: https://blog.gdeltproject.org/gdelt-doc-2-0-api-debuts/
+- Themes & query syntax: https://blog.gdeltproject.org/gkg-2-0-our-global-knowledge-graph-2-0-amazing-data-at-your-fingertips/
+- Project home: https://www.gdeltproject.org/

package/.agent/skills/osint-investigation/references/sources/icij-offshore.md

@@ -0,0 +1,104 @@
+# ICIJ Offshore Leaks Database
+
+## 1. Summary
+
+The International Consortium of Investigative Journalists (ICIJ) publishes a
+combined database of offshore entities from the Panama Papers, Paradise Papers,
+Pandora Papers, Bahamas Leaks, and Offshore Leaks. ~800,000+ offshore entities
+with their officers, intermediaries, and addresses.
+
+## 2. Access Methods
+
+- **Bulk download (primary):** `https://offshoreleaks-data.icij.org/offshoreleaks/csv/full-oldb.LATEST.zip` (~70 MB ZIP, refreshed periodically)
+- **Search UI (human):** `https://offshoreleaks.icij.org/`
+- **Auth:** None
+- **Note:** The previous Open Refine reconciliation endpoint at
+  `/reconcile` now returns 404. ICIJ has removed it. The bulk ZIP is the
+  remaining stable access path. The skill's `fetch_icij_offshore.py` caches
+  the ZIP locally (default `~/.cache/hermes-osint/icij/`, refreshes after
+  30 days) and searches it offline.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_icij_offshore.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `node_id` | int | ICIJ canonical node ID |
+| `name` | str | Entity / officer / intermediary name |
+| `node_type` | str | entity / officer / intermediary / address |
+| `country_codes` | str | Semicolon-separated ISO codes |
+| `countries` | str | Country names |
+| `jurisdiction` | str | Offshore jurisdiction (BVI, Panama, etc.) |
+| `incorporation_date` | str | YYYY-MM-DD |
+| `inactivation_date` | str | YYYY-MM-DD (if struck) |
+| `source` | str | Panama Papers / Paradise Papers / Pandora Papers / etc. |
+| `entity_url` | str | Link to ICIJ page |
+| `connections` | str | Semicolon-separated node IDs of related entities |
+
+## 4. Coverage
+
+- Worldwide offshore entity records
+- Earliest records: 1970s (Bahamas Leaks). Most data 1990–2018.
+- NOT updated in real-time — new leaks added when ICIJ publishes them
+- ~810,000 offshore entities + ~750,000 officers + ~150,000 intermediaries
+
+## 5. Cross-Reference Potential
+
+- **SEC EDGAR** ↔ `name` (public companies with offshore arms)
+- **USAspending** ↔ `name` (federal contractors with offshore structure)
+- **OFAC SDN** ↔ `name` (sanctioned entities using offshore vehicles)
+
+Join key: normalized entity/officer name. `node_id` is canonical for cross-
+referencing within ICIJ. Connections graph traversal is in-script (BFS over
+`connections`).
+
+## 6. Data Quality
+
+- Offshore entity names sometimes appear in multiple leaks with slight variations
+- Officers may be nominees (front persons), not beneficial owners
+- Some entries have minimal info (just a name + jurisdiction)
+- The connections graph is incomplete — some relationships are documented in
+  source materials but not in the structured database
+- Inactive/struck-off entities are still included with `inactivation_date`
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_icij_offshore.py`
+
+```bash
+# Search by entity name (case-insensitive substring across the bulk DB)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --entity "EXAMPLE CORP" \
+    --out data/icij.csv
+
+# Search by officer (individual person)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --officer "SMITH JOHN" \
+    --out data/icij.csv
+
+# Search by jurisdiction (filter on cached results)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --officer "SMITH" \
+    --jurisdiction "BRITISH VIRGIN ISLANDS" --out data/icij_bvi.csv
+
+# Force a fresh download (default refresh window is 30 days)
+python3 SKILL_DIR/scripts/fetch_icij_offshore.py --entity "EXAMPLE CORP" \
+    --force-refresh --out data/icij.csv
+```
+
+First call downloads the ~70 MB ZIP under `~/.cache/hermes-osint/icij/`
+(or `$HERMES_OSINT_CACHE/icij/`). Subsequent calls reuse the cache for 30 days.
+
+## 8. Legal & Licensing
+
+- Public record as published by ICIJ under explicit publication
+- No copyright on the underlying facts (entity names, jurisdictions)
+- ICIJ asks for attribution if used in derivative reporting
+- **Ethical note**: Presence in this database does NOT imply wrongdoing. Many
+  offshore structures are legal. The database is a research tool, not a list of
+  criminals.
+
+## 9. References
+
+- Database: https://offshoreleaks.icij.org/
+- About the data: https://offshoreleaks.icij.org/pages/about
+- Methodology: https://www.icij.org/investigations/panama-papers/
+- API hints: Open Refine reconciliation endpoint at `https://offshoreleaks.icij.org/reconcile`

package/.agent/skills/osint-investigation/references/sources/nyc-acris.md

@@ -0,0 +1,90 @@
+# NYC ACRIS — NYC Real Property Records
+
+## 1. Summary
+
+The Automated City Register Information System (ACRIS) is NYC's index of
+recorded property documents: deeds, mortgages, satisfactions, liens, UCC
+filings. Covers Manhattan, Bronx, Brooklyn, Queens, Staten Island.
+Published as 4 linked Socrata datasets on the NYC Open Data portal.
+
+## 2. Access Methods
+
+- **Socrata API:** `https://data.cityofnewyork.us/resource/636b-3b5g.json` (Parties)
+- **Other datasets:** `bnx9-e6tj` (Master), `8h5j-fqxa` (Legal), `uqqa-hym2` (References)
+- **Auth:** None for read access (Socrata `$app_token` raises rate limits if needed)
+- **Rate limit:** Generous (~1000 req/hour unauthenticated)
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_nyc_acris.py` (Parties joined to Master):
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `document_id` | str | ACRIS document ID |
+| `name` | str | Party name as recorded (often "LAST, FIRST" but varies) |
+| `party_type` | str | 1=grantor, 2=grantee, 3=other |
+| `party_role` | str | Human-readable role label |
+| `address_1` | str | Property or party address line 1 |
+| `city`, `state`, `zip`, `country` | str | Address parts |
+| `doc_type` | str | DEED, MTGE (mortgage), SAT (satisfaction), AGMT, etc. |
+| `doc_date`, `recorded_date` | str | YYYY-MM-DD |
+| `borough` | str | Manhattan / Bronx / Brooklyn / Queens / Staten Island |
+| `amount` | str | Document amount (USD, when applicable) |
+| `filing_url` | str | Direct ACRIS DocumentImageView link |
+
+## 4. Coverage
+
+- NYC 5 boroughs only — other counties have their own recorders
+- 1966 → present (older filings exist on microfilm at the County Clerk)
+- Updated nightly
+- ~70M+ party records cumulative
+
+## 5. Cross-Reference Potential
+
+- **SEC EDGAR** ↔ `name` (insider filers with NYC property)
+- **USAspending** ↔ `name` (federal contractors with NYC property)
+- **Senate LDA** ↔ `name` (lobbyists / clients with NYC property)
+- **ICIJ Offshore** ↔ `name` (NYC properties owned via offshore vehicles)
+
+Join key: normalized party name. NYC property records typically store names
+as "LAST, FIRST" or full LLC names — use `entity_resolution.py`.
+
+## 6. Data Quality
+
+- Same person appears with multiple name formats over time
+- LLC and trust ownership obscures beneficial owners
+- Recording lag can be 2-4 weeks after closing
+- Older documents have spottier address data
+- Sealed records (e.g. domestic violence shelters) are excluded by law
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_nyc_acris.py`
+
+```bash
+# By party name
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --name "ROLNICK" --out data/acris.csv
+
+# By address (useful when you know the property but not the names)
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --address "571 HUDSON" --out data/acris.csv
+
+# Restrict to grantees (buyers / mortgagees)
+python3 SKILL_DIR/scripts/fetch_nyc_acris.py --name "ROLNICK" --party-type 2 \
+    --out data/acris_buyers.csv
+```
+
+The script joins Parties → Master to populate doc_type, dates, borough, and
+amount. Pass `--no-enrich` to skip the join (faster, fewer columns).
+
+## 8. Legal & Licensing
+
+- Public record under NYS Real Property Law and NYC Charter
+- No commercial use restrictions on the data
+- All ACRIS data is public information by statute
+
+## 9. References
+
+- ACRIS portal: https://a836-acris.nyc.gov/CP/
+- NYC Open Data: https://data.cityofnewyork.us/
+- Parties dataset: https://data.cityofnewyork.us/City-Government/ACRIS-Real-Property-Parties/636b-3b5g
+- Document type codes: https://www1.nyc.gov/site/finance/taxes/acris.page

package/.agent/skills/osint-investigation/references/sources/ofac-sdn.md

@@ -0,0 +1,92 @@
+# OFAC SDN — Specially Designated Nationals List
+
+## 1. Summary
+
+The Office of Foreign Assets Control (OFAC) publishes the Specially Designated
+Nationals and Blocked Persons List (SDN). US persons are generally prohibited
+from dealing with individuals and entities on this list. Also published:
+non-SDN consolidated lists (BIS Denied Persons, FSE, etc.).
+
+## 2. Access Methods
+
+- **Full XML:** `https://www.treasury.gov/ofac/downloads/sdn.xml`
+- **Delimited:** `https://www.treasury.gov/ofac/downloads/sdn.csv`
+- **Consolidated:** `https://www.treasury.gov/ofac/downloads/consolidated/consolidated.xml`
+- **Auth:** None
+- **Rate limit:** None (static file downloads). Updated continuously.
+
+## 3. Data Schema
+
+Key fields emitted by `fetch_ofac_sdn.py`:
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `entity_id` | int | OFAC unique ID |
+| `name` | str | Primary name |
+| `entity_type` | str | individual / entity / vessel / aircraft |
+| `program_list` | str | Semicolon-separated sanctions programs (e.g. SDGT;IRAN) |
+| `title` | str | For individuals: title/role |
+| `nationalities` | str | Semicolon-separated country codes |
+| `aka_list` | str | Semicolon-separated "also known as" names |
+| `addresses` | str | Semicolon-separated known addresses |
+| `dob` | str | Date of birth (individuals) |
+| `pob` | str | Place of birth (individuals) |
+| `remarks` | str | OFAC's free-text remarks |
+| `last_updated` | str | YYYY-MM-DD (publication date) |
+
+## 4. Coverage
+
+- Worldwide — all entities sanctioned by US Treasury
+- ~10,000 entries on SDN, ~15,000 on consolidated lists
+- Updated continuously (sometimes daily during active enforcement)
+- Includes AKAs (very common, can be 10+ per entity)
+
+## 5. Cross-Reference Potential
+
+- **SEC EDGAR** ↔ `name` (public companies sanctioned)
+- **USAspending** ↔ `name` (sanctioned entity as federal contractor — should
+  be impossible but verify)
+- **ICIJ Offshore** ↔ `name` (offshore entities also sanctioned)
+
+Join key: normalized name. **CRITICAL**: must match against `aka_list` too.
+Many sanctioned entities are caught only via aliases.
+
+## 6. Data Quality
+
+- Names are transliterated from many scripts — multiple romanizations possible
+- AKAs often differ wildly from primary name
+- Some entries have minimal info (no DOB, no address) for individuals
+- Free-text `remarks` contain critical context — read them
+- "Specially Designated Global Terrorists" (SDGT) and "Cyber-related" (CYBER2)
+  programs add and remove entries frequently
+
+## 7. Acquisition Script
+
+Path: `scripts/fetch_ofac_sdn.py`
+
+```bash
+# Full snapshot
+python3 SKILL_DIR/scripts/fetch_ofac_sdn.py --out data/ofac_sdn.csv
+
+# Filter to specific program
+python3 SKILL_DIR/scripts/fetch_ofac_sdn.py --program SDGT --out data/sdn_sdgt.csv
+
+# Entities only (skip individuals, vessels, aircraft)
+python3 SKILL_DIR/scripts/fetch_ofac_sdn.py --entity-type entity --out data/sdn_entities.csv
+```
+
+## 8. Legal & Licensing
+
+- Public record under Executive Order authority and statutory sanctions programs
+- US persons MUST screen against this list — it is enforced
+- No restrictions on the data itself; restrictions are on transactions with
+  the listed entities
+- ZERO penalty for "over-matching" — false positives must be cleared but are not
+  prohibited
+
+## 9. References
+
+- OFAC home: https://ofac.treasury.gov/
+- SDN list: https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists
+- Data formats: https://ofac.treasury.gov/sdn-list/sanctions-list-search-tool
+- Compliance guidance: https://ofac.treasury.gov/recent-actions