domain-pre-flight 0.9.0__tar.gz

domain_pre_flight-0.9.0/.claude/skills/domain-pre-flight/SKILL.md

@@ -0,0 +1,196 @@
+---
+name: domain-pre-flight
+description: Pre-flight checks before registering a domain for a new site or app. Runs structural / history / typosquat / multi-language / LLMO checks against one or more candidates, optionally adds same-name handle availability and trademark deeplinks, and returns per-domain verdict bands plus (when given multiple candidates) a comparison table and a top-3 trademark verify checklist. Use when the user is choosing a domain, evaluating a brainstorm shortlist, or wants a sanity check before pulling the trigger on a registrar.
+argument-hint: <domain> [<domain> ...] [--full] [--handles] [--trademark]
+allowed-tools: Bash, Read
+---
+
+# domain-pre-flight skill
+
+Run pre-flight checks before the user registers a new domain. The CLI lives at https://github.com/kenimo49/domain-pre-flight; this skill is the conversational wrapper around it.
+
+## When to invoke
+
+Use this skill when the user:
+
+- explicitly asks "is this domain safe to register" / "can I take X.com" / "ドメイン取って大丈夫？"
+- gives a list of candidate domains and asks which one to pick
+- mentions registering a name and you want to add a sanity check before they spend money
+- references the companion book `domain-hunter-engineer-collab` or "domain hunter" workflow
+
+Do NOT invoke when:
+
+- the user is asking about a domain they already own (use the trademark / typosquat subcommands manually if needed, but the full pre-flight is for unregistered candidates)
+- the question is about domain investing / aftermarket / drop-catching (out of scope for this tool)
+
+## How it works
+
+1. **Resolve the CLI.** Try in this order and use the first that exists:
+   ```bash
+   DPF=$(command -v dpf 2>/dev/null \
+     || command -v domain-pre-flight 2>/dev/null \
+     || ([ -x "$HOME/repos/domain-pre-flight/.venv/bin/dpf" ] && echo "$HOME/repos/domain-pre-flight/.venv/bin/dpf"))
+   ```
+   If `$DPF` is empty, see the install section below.
+2. **Detect single vs multi.** If the user gave one domain, follow the [single-domain](#single-domain) flow. If two or more, follow the [multi-domain](#multi-domain) flow.
+3. **Always pass `--json`** to the CLI and parse with `python3 -c 'import json, sys; ...'`. Never read coloured terminal output.
+
+## Install (only if `$DPF` did not resolve)
+
+```bash
+# Recommended — pipx isolates the CLI in its own venv but exposes `dpf` on PATH
+pipx install git+https://github.com/kenimo49/domain-pre-flight.git
+
+# Or, from a local clone in editable mode
+pip install -e /home/iris/repos/domain-pre-flight
+```
+
+## Single-domain
+
+```bash
+"$DPF" check "$domain" --json                                # quick (default)
+"$DPF" check "$domain" --check-handles --check-trademark --json   # full pre-flight
+```
+
+Runs basic + history + typosquat + semantics + llmo (`--json` always). The `--check-handles` and `--check-trademark` flags are opt-in for slower / network-heavy / manual-verify paths.
+
+Summarise in 3–6 lines:
+
+```
+**<domain>**: <band> — score <N>/100
+
+What flagged:
+- <deduction reason 1>: -<points>
+- <deduction reason 2>: -<points>
+
+Recommendation: <one sentence — register, walk away, or run a deeper check>
+```
+
+Keep the report under ~6 lines unless the user asks for the full breakdown. The `verdict.deductions` list in the JSON is the source of truth — quote it directly rather than paraphrasing (the wording is calibrated).
+
+If a check returned `lookup_failed` or `unknown` (e.g. handles bot wall), say so explicitly. Do not pretend you got a clean answer.
+
+## Multi-domain
+
+Run the candidates in parallel via background bash jobs, write each to a temp JSON, then aggregate. Pattern:
+
+```bash
+mkdir -p /tmp/dpf-batch
+DOMAINS=("$@")  # the user's argument list
+for d in "${DOMAINS[@]}"; do
+  "$DPF" check "$d" --check-handles --check-trademark --json \
+    > "/tmp/dpf-batch/$d.json" 2> "/tmp/dpf-batch/$d.err" &
+done
+wait
+```
+
+8 candidates running in parallel typically finish inside 30–60 seconds. Read each JSON with `python3 -c 'import json, sys; ...'` and assemble the [output](#multi-domain-output).
+
+For ad-hoc shortlists (≤16 candidates) parallel runs are fine. For larger lists chunk into batches of 8 to avoid overwhelming Wayback / public APIs.
+
+### Multi-domain output
+
+Produce three sections, in this order:
+
+#### 1. Comparison table
+
+One row per candidate. Columns:
+
+| domain | band | score | top deductions | github | npm | pypi | x/ig | tld notes |
+
+- `band` uses the colour emoji: 🟢 GREEN / 🟡 YELLOW / 🟠 ORANGE / 🔴 RED.
+- `top deductions` keeps the 1–2 highest-points entries from `verdict.deductions` (verbatim).
+- `github` / `npm` / `pypi` show ✅ for `available`, ❌ for `taken`, ❓ for `unknown`.
+- `x/ig` is collapsed because both X and Instagram are bot-walled and frequently `unknown` — render as `❓/❓` unless one of them came back `available` (404), then show the actual symbols.
+- `tld notes` flags new gTLDs (`.engineer`, `.app`, etc.) that have a known SEO ramp-up disadvantage even when the band is green.
+
+#### 2. Ranking
+
+Pick the **top 3** candidates by:
+
+1. Verdict band (GREEN > YELLOW > ORANGE > RED).
+2. Within band, by `verdict.score` desc.
+3. Tie-breaker by handles availability (more ✅ wins).
+
+For each top-3 entry, give:
+
+- 🥇 / 🥈 / 🥉 medal + domain
+- 1-line strategic rationale (relate to the user's stated project goals if known)
+- 1-line weakness or risk
+- handles status summary
+
+#### 3. Top-3 trademark verify checklist
+
+**This is the headline UX of multi-domain mode.** Render only the **top 3** candidates' trademark deeplinks, as a 3×3 markdown table:
+
+| candidate | USPTO | EUIPO | J-PlatPat |
+|-----------|-------|-------|-----------|
+| **<domain1>** | [search](url) | [search](url) | [search](url) |
+| <domain2>     | [search](url) | [search](url) | [search](url) |
+| <domain3>     | [search](url) | [search](url) | [search](url) |
+
+The deeplink URLs come straight from the CLI's `trademark.jurisdictions[].deeplink` field — do not reconstruct them by hand.
+
+Tell the user: **trademark verification is manual** (per ADR 0009 — none of the registries publishes a stable public search API). 9 link clicks for the top 3 candidates is the minimum honest verify pass; anything beyond top 3 is over-clicking unless a top-3 entry hits a conflict and the next candidate inherits the slot.
+
+For the **bottom candidates (rank 4+)**, do NOT render their trademark deeplinks. Only flag if the entire top 3 has issues, in which case re-run the verify checklist for ranks 4–6 explicitly when asked.
+
+#### 4. Falsifiable next step
+
+End with one sentence telling the user what to do next: e.g. *"Click the 9 links above; if any USPTO/EUIPO entry returns a hit in class 9 / 33 / 35, the candidate falls out and rank #4 takes its slot."* Make it concrete enough that the user knows when they are done.
+
+## Targeted single-axis checks
+
+When the user only cares about one axis, call the corresponding subcommand directly:
+
+| User intent                             | Run                                    |
+| --------------------------------------- | -------------------------------------- |
+| "Is the GitHub / npm name free?"        | `"$DPF" handles <domain> --json`       |
+| "Does this name look like a typosquat?" | `"$DPF" typosquat <domain> --json`     |
+| "Get me the trademark deeplinks."       | `"$DPF" trademark <domain> --jurisdictions us,eu --json` |
+| "How does this read in Spanish?"        | `"$DPF" semantics <domain> --languages es --json` |
+| "Is this name memorable for voice?"     | `"$DPF" llmo <domain> --json`          |
+| "Has this domain been used before?"     | `"$DPF" history <domain> --json`       |
+| "Is the structure valid at all?"        | `"$DPF" basic <domain> --json`         |
+
+These can also be batched — same parallel pattern as multi-domain `check`.
+
+## Trademark output (every mode)
+
+Every trademark check returns `status="not_supported"` with a populated `deeplink`. **This is not a bug** — see ADR 0009. The CLI no longer attempts live queries against USPTO / EUIPO / J-PlatPat because none of those registries publishes a stable, documented, no-auth search API.
+
+When summarising:
+
+- Single-domain mode: surface the 3 deeplinks inline (one for each jurisdiction).
+- Multi-domain mode: surface the **top-3** candidates' deeplinks in the verify checklist (9 total). Skip ranks 4+.
+- Always tell the user trademark verification is **manual** — clicking a deeplink opens the official search UI pre-filled with the SLD.
+- Never say "no trademark conflict found" — the CLI cannot determine that.
+
+## Error handling
+
+- **CLI not installed**: tell the user how to install (see install section above).
+- **Network error during `--check-handles`**: re-run the same command once before reporting failure; if still failing, surface the unknown entries in the summary as `❓` and note "transport error" inline.
+- **Wayback CDX timeout**: a single ReadTimeout is common; for new / freshly-registered domains, "no Wayback snapshots" is the expected outcome anyway. Note the timeout but do not block on it.
+- **Domain has obvious syntactic issues** (`-foo-.com`): the `basic` check returns RED with `is_valid_syntax = false`; pass that signal up immediately rather than running the rest.
+
+## Exit-code conventions
+
+`dpf check` exit codes encode the band:
+- `0` — GREEN or YELLOW (proceed / proceed with caution)
+- `1` — ORANGE (mitigate before proceeding)
+- `2` — RED (do not register without manual review)
+
+In a shell script, `if dpf check "$d" --json > out.json; then ...` works because both clean bands return 0. In multi-domain mode, do **not** rely on the per-call exit code to abort early — collect all results, then rank.
+
+## Related docs
+
+- Full CLI walkthrough: `docs/guide/usage.md` in the repo
+- Architecture: `docs/architecture.md`
+- ADRs: `docs/decisions/` (especially 0009 for trademark)
+
+## Stylistic notes
+
+- Mirror the user's language (English in / English out, 日本語 in / 日本語 out).
+- The tool flags candidates, not legal opinions — when surfacing trademark hits, never claim infringement; say "consult counsel" if the user asks for a verdict on the legal angle.
+- Treat the LLMO score as one input among many; it is permanently marked experimental.
+- Multi-domain output is dense. Resist the urge to add filler explanation between the table, the ranking, and the verify checklist — the user will read them in order, not as one long paragraph.

domain_pre_flight-0.9.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,34 @@
+---
+name: Bug report
+about: Something is wrong with the CLI or a check
+title: "[bug] "
+labels: bug
+---
+
+## What happened
+
+A clear, single-paragraph description of the actual behaviour.
+
+## What I expected
+
+What the docs or your intuition said *should* have happened.
+
+## Reproduction
+
+```bash
+# the exact CLI invocation
+dpf check ...
+```
+
+If the bug is data-driven (a specific domain trips a wrong band, a brand list miss, etc.), include the domain.
+
+## Output
+
+The relevant stdout / JSON. If the report is large, paste the `verdict.deductions` array and the offending check section only.
+
+## Environment
+
+- domain-pre-flight version: `dpf --version`
+- Python: `python --version`
+- OS:
+- Install method: `pipx install` / `pip install -e` / other

domain_pre_flight-0.9.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature request
+about: Suggest a new check, flag, platform, or data update
+title: "[feature] "
+labels: enhancement
+---
+
+## What you want
+
+One paragraph describing the feature.
+
+## Why it matters
+
+The decision the feature would help the user make. "Make X possible" is OK; "tool would be more complete" is not.
+
+## What it should NOT do
+
+Things that are out of scope. (See README for the project's stated boundaries.)
+
+## How it might fit
+
+If you have an opinion on which existing check / module / data file this slots into, mention it. The maintainer will route otherwise.

domain_pre_flight-0.9.0/.github/pull_request_template.md

@@ -0,0 +1,22 @@
+## What this PR does
+
+One paragraph; the imperative form ("add ...", "fix ...", "refactor ...").
+
+## Why
+
+Linked issue or one-line motivation.
+
+## Tests
+
+- [ ] `pytest -q` passes
+- [ ] `ruff check src tests scripts` clean
+- [ ] `mypy src/domain_pre_flight` clean
+- [ ] `bash scripts/smoke.sh --offline` passes
+- [ ] Coverage stays at ≥70% for the cli-omitted bundle
+
+## Checklist (delete what doesn't apply)
+
+- [ ] No new runtime dependency added (or, if added, justified in the commit message).
+- [ ] If a new check: `score.py` updated with a `_<name>_deductions` function; `cli.py` integrated.
+- [ ] If a doc-bearing design choice: ADR added under `docs/decisions/`.
+- [ ] CHANGELOG.md updated.

domain_pre_flight-0.9.0/.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: publish
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/domain-pre-flight
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: Verify package metadata
+        run: twine check dist/*
+
+      - name: Publish to PyPI (Trusted Publisher OIDC)
+        uses: pypa/gh-action-pypi-publish@release/v1

domain_pre_flight-0.9.0/.github/workflows/refresh-known-brands.yml

@@ -0,0 +1,42 @@
+name: refresh-known-brands
+
+on:
+  schedule:
+    # First Tuesday of each month at 03:30 UTC (offset from refresh-tld-risk).
+    - cron: "30 3 1-7 * 2"
+  workflow_dispatch: {}
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install runtime deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install requests tldextract
+
+      - name: Refresh brand list from Tranco
+        run: python scripts/refresh_known_brands.py --top 2000
+
+      - name: Open PR if data changed
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "data: refresh known_brands.txt from Tranco"
+          title: "data: refresh known_brands.txt (auto, Tranco top 2000)"
+          body: |
+            Automated monthly refresh of `src/domain_pre_flight/data/known_brands.txt`.
+            Pulls the latest Tranco top 2000 and unions stems with the curated
+            baseline. Manually re-run with `python scripts/refresh_known_brands.py`.
+          branch: auto/known-brands-refresh
+          delete-branch: true

domain_pre_flight-0.9.0/.github/workflows/refresh-tld-risk.yml

@@ -0,0 +1,41 @@
+name: refresh-tld-risk
+
+on:
+  schedule:
+    # First Monday of each month at 03:00 UTC.
+    - cron: "0 3 1-7 * 1"
+  workflow_dispatch: {}
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install runtime deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install requests
+
+      - name: Refresh TLD risk bundle
+        run: python scripts/refresh_tld_risk.py
+
+      - name: Open PR if data changed
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "data: refresh tld_risk.json"
+          title: "data: refresh tld_risk.json (auto)"
+          body: |
+            Automated monthly refresh of `src/domain_pre_flight/data/tld_risk.json`.
+            Re-run locally with `python scripts/refresh_tld_risk.py`.
+          branch: auto/tld-risk-refresh
+          delete-branch: true

domain_pre_flight-0.9.0/.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: Verify package metadata
+        run: twine check dist/*
+
+      - name: Upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${GITHUB_REF##*/}" dist/* --clobber
+
+      # PyPI publishing is handled by publish.yml (Trusted Publisher / OIDC).
+      # This workflow only uploads the sdist + wheel to the GitHub Release.

domain_pre_flight-0.9.0/.github/workflows/test.yml

@@ -0,0 +1,57 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install package and dev dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Run pytest with coverage
+        run: pytest --cov --cov-report=term-missing --cov-fail-under=70
+
+      - name: Run smoke tests (offline)
+        if: matrix.python-version == '3.12'
+        run: bash scripts/smoke.sh --offline
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install dev dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Ruff check
+        run: ruff check src tests scripts
+
+      - name: Mypy check
+        run: mypy src/domain_pre_flight

domain_pre_flight-0.9.0/.gitignore

@@ -0,0 +1,22 @@
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+env/
+.env
+.env.local
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.tox/
+.idea/
+.vscode/
+*.swp
+.DS_Store

domain_pre_flight-0.9.0/CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+All notable changes to **domain-pre-flight** are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) loosely; versions follow [SemVer](https://semver.org/) with the convention that **0.x is experimental** — breaking changes can land on a minor bump.
+
+## [0.9.0] — 2026-07-07
+
+### Added
+
+- **MCP server** (`domain-pre-flight[mcp]`) — new optional extra and `domain-pre-flight-mcp` entry point. Ships an MCP (Model Context Protocol) server built on FastMCP so AI assistants (Claude Code / Cursor / Claude Desktop) can call the checks as tools. Exposes 4 use-case-oriented tools rather than mapping every CLI flag: `check_domain`, `check_handles`, `check_trademark`, `list_typo_permutations`.
+- **Subprocess-variant reference implementation** — `examples/subprocess-variant/` ships a deliberately naive subprocess-based MCP server plus a benchmark script (`bench.py`) as the "before" half of a security / latency comparison. Not for production.
+- **PyPI publishing workflow** — `.github/workflows/publish.yml` publishes to PyPI via Trusted Publisher OIDC on every `v*` tag push; no long-lived API tokens.
+
+### Changed
+
+- `pyproject.toml` gains `[project.optional-dependencies].mcp = ["mcp>=1.2"]` and `[project.scripts].domain-pre-flight-mcp = "..."`. Core CLI users are unaffected — the `mcp` dependency only installs when `[mcp]` is requested.
+- `release.yml` no longer holds a `PYPI_API_TOKEN` fallback path; PyPI publishing is centralised in `publish.yml`.
+
+## [0.8.0] — 2026-05-08
+
+### Added
+
+- **IDN homograph detection** — new `dpf homograph` subcommand and `--no-homograph` flag. UTS #39 confusable matching against the brand list. `gооgle.com` (Cyrillic о) is flagged as a brand collision.
+- **RDAP lifecycle check** — new `dpf rdap` subcommand and `--check-rdap` flag. Surfaces creation date, expiration date, registrar, and registry status (clientHold / redemptionPeriod / etc.) via the rdap.org public gateway.
+- **DNS hygiene check** — new `dpf dns` subcommand and `--check-dns` flag. Probes MX / SPF / DMARC / DKIM presence; flags MX-without-SPF / MX-without-DMARC as deductions.
+- **dnstwist-style permutations** — new `dpf permutations` subcommand. Generates 8 kinds of typo / spoof variants (omission, transposition, doubling, homoglyph, keyboard_adjacent, substitution, addition, hyphenation).
+- **GitLab handle availability** — added to `dpf handles` defaults.
+- **5 new languages** in semantics: Hindi (`hi`), Arabic (`ar`), Vietnamese (`vi`), Thai (`th`), Indonesian (`id`). Romanised forms only.
+- **LLMO locale profile** — `--llmo-locale en|neutral`. Neutral mode relaxes the cluster ceiling so transliterated names (roomaji, pinyin) aren't unfairly penalised.
+- **Tranco-driven brand list refresh** — `scripts/refresh_known_brands.py` + monthly `refresh-known-brands` workflow.
+- **CI quality gates** — ruff lint job, mypy type job, pytest with `--cov-fail-under=70` (cli.py omitted from coverage).
+- **Project hygiene files** — `CHANGELOG.md`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md`, `.github/ISSUE_TEMPLATE/*`, `.github/pull_request_template.md`, `release.yml` workflow.
+
+### Changed
+
+- **Trademark module** — every jurisdiction now resolves to `not_supported` + deeplink (no live API queries). See ADR 0009. Doc drift in `CLAUDE.md`, `docs/architecture.md`, and `docs/guide/usage.md` swept to match.
+- **Skill** — `argument-hint` accepts multiple domains; multi-domain output spec added (comparison table → ranking → top-3 trademark verify checklist → next step).
+
+### Fixed
+
+- `_de_confuse` previously rewrote ASCII characters into other confusables; now only non-Latin characters are de-confused (preserves Latin SLDs unchanged).
+
+### Internal
+
+- `basic.normalise(domain) → (domain, sld, tld)` shared helper, replaces 5 duplicated normalisation passes across check modules.
+- Ten check modules now share consistent shapes (`check_<name>(domain) → <Name>Report` returning `issues` + `notes`).
+
+## [0.7.2] — 2026-05-08
+
+### Changed
+
+- Skill multi-domain mode + top-3 trademark verify checklist (9 links instead of 24).
+
+## [0.7.0] — 2026-05-08
+
+### Added
+
+- ROADMAP issues #1–#6 all shipped: same-name handle availability, typosquat / brand similarity, trademark deeplinks, multi-language semantics, refreshable TLD risk JSON, LLMO fitness heuristic.
+
+## [0.1.0] — 2026-05-08
+
+### Added
+
+- Initial public release. `dpf check / basic / history`, scoring engine, GREEN / YELLOW / ORANGE / RED bands.