diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-09 08:56:25 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-09 08:56:25 +0200 |
| commit | 42a36e88424aa3dac13ed3d578bfa871e44ad460 (patch) | |
| tree | badad98b9b5e2c069ba01a41189a0b8f56233e2d /AGENTS.md | |
| parent | 00c68e841c416c7c069869a52d64e8c15a72e1de (diff) | |
| download | abusectl-42a36e88424aa3dac13ed3d578bfa871e44ad460.tar.gz abusectl-42a36e88424aa3dac13ed3d578bfa871e44ad460.zip | |
docs: spec the contacts subcommand
Settles what the umbrella design left open for this part: RDAP bootstrap,
caching policy, and what happens for a netblock that publishes no abuse
contact.
Scope is IPs and domains, with a URL contributing only its host. The
bootstrap files are fetched from IANA and cached with a long TTL, while
responses are cached in memory for one run only: a stale bootstrap merely
misses, but a stale abuse address sends a report into a dead mailbox
silently. The registrable domain is found by walking up the labels and
asking the registry rather than by bundling a Public Suffix List, which
would be a transcribed table that goes stale weekly.
Address extraction is a strict abuse-role match with no fallback. In
particular it never constructs abuse@<domain>, because for a phishing
domain that mailbox belongs to the attacker and mailing it would confirm
both the catch and that the address is live.
Adds a fourth non-negotiable property: a query carries a bare host or IP
and never a URL. Property 1 governs what is published, and a query is a
disclosure that appears in no report, so a path segment that parse
deliberately flags rather than redacts would otherwise leak.
Transport is urllib with an injected fetch, so requirements.txt stays
empty and the suite keeps passing with sockets raising, for the whole
suite rather than for everything except contacts.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wrfqr2xqQfhtXCscU7zrdz
Diffstat (limited to 'AGENTS.md')
| -rw-r--r-- | AGENTS.md | 4 |
1 files changed, 4 insertions, 0 deletions
@@ -282,6 +282,10 @@ umbrella design settles only what they share. - `docs/specs/2026-09-08-abusectl-design.md` — the umbrella design. Read it before changing anything about the case format, the redaction rule, or the ordering between MISP and the vendors. +- `docs/specs/2026-09-09-contacts.md` — the `contacts` spec. Read it before + touching RDAP, the bootstrap cache, or anything that issues a query: it adds + a FOURTH non-negotiable property, that a query carries a bare host or IP and + never a URL. - `docs/plans/2026-09-08-parse.md` — the plan `init` and `parse` were built from. Historical once built, but it records why each test exists. - `docs/BACKLOG.md` — open items, with the cause verified in the code rather |