From 42a36e88424aa3dac13ed3d578bfa871e44ad460 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Wed, 9 Sep 2026 08:56:25 +0200 Subject: docs: spec the contacts subcommand Settles what the umbrella design left open for this part: RDAP bootstrap, caching policy, and what happens for a netblock that publishes no abuse contact. Scope is IPs and domains, with a URL contributing only its host. The bootstrap files are fetched from IANA and cached with a long TTL, while responses are cached in memory for one run only: a stale bootstrap merely misses, but a stale abuse address sends a report into a dead mailbox silently. The registrable domain is found by walking up the labels and asking the registry rather than by bundling a Public Suffix List, which would be a transcribed table that goes stale weekly. Address extraction is a strict abuse-role match with no fallback. In particular it never constructs abuse@, because for a phishing domain that mailbox belongs to the attacker and mailing it would confirm both the catch and that the address is live. Adds a fourth non-negotiable property: a query carries a bare host or IP and never a URL. Property 1 governs what is published, and a query is a disclosure that appears in no report, so a path segment that parse deliberately flags rather than redacts would otherwise leak. Transport is urllib with an injected fetch, so requirements.txt stays empty and the suite keeps passing with sockets raising, for the whole suite rather than for everything except contacts. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Wrfqr2xqQfhtXCscU7zrdz --- AGENTS.md | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'AGENTS.md') diff --git a/AGENTS.md b/AGENTS.md index 9aa6b08..f4e40e1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -282,6 +282,10 @@ umbrella design settles only what they share. - `docs/specs/2026-09-08-abusectl-design.md` — the umbrella design. Read it before changing anything about the case format, the redaction rule, or the ordering between MISP and the vendors. +- `docs/specs/2026-09-09-contacts.md` — the `contacts` spec. Read it before + touching RDAP, the bootstrap cache, or anything that issues a query: it adds + a FOURTH non-negotiable property, that a query carries a bare host or IP and + never a URL. - `docs/plans/2026-09-08-parse.md` — the plan `init` and `parse` were built from. Historical once built, but it records why each test exists. - `docs/BACKLOG.md` — open items, with the cause verified in the code rather -- cgit v1.2.3