attribution-suite

One install and one CLI over the attribution toolchain.

pip install attribution-suite
attribution run --case case.yaml --index adtx.sqlite --out ./out

Why the packages are separate at all

attribution-graph is a pure inference library with no network I/O — that is what makes its scoring auditable, since every number is a function of claims plus index counts with no hidden network state. adtx-attribution carries the collectors and their dependencies. handle-correlation is independent of both.

Someone who only wants the scoring model should not have to install an HTTP client, and someone writing their own collectors should not inherit ours. This package exists for when you want all of it.

Unified run

One case file drives the whole chain:

attribution run \
  --case case.yaml \
  --index adtx.sqlite \
  --handles observed_handles.csv \
  --spiderfoot scan.db \
  --opencti bundle.json \
  --robin investigations/kraken.json \
  --out ./out

Robin handles feed the handle-correlation pass automatically, carrying the durable identifiers found alongside them. .onion-derived claims raise a warning in the run summary: those sources have no archive and no preserved body, so they cannot be verified after the fact by anyone, including you.

Order is fixed, and the ordering is the point: imported claims seed the frontier before collection, adversarial checks run before scoring so a planted identifier never reaches the model at full weight, and evidence verification runs before reporting so findings from a package that failed its integrity check are never presented. attribution run exits non-zero if verification fails, so a scripted caller can detect an unpresentable result.

Passthrough commands

attribution index build --domains tranco.txt --db adtx.sqlite
attribution portfolio scraper-site.example --index adtx.sqlite --registrants
attribution handles --observations handles.csv --corpus usernames.txt
attribution registries --jurisdiction IN
attribution verify ./out/evidence
attribution version

These delegate to the component CLIs rather than duplicating their flags.

Outputs

Collection policy

robots_policy in the case file: respect, record (default), or ignore.

There is no silent enforcement — robots.txt is routinely bypassed in practice and a library pretending otherwise would be enforcing an abandoned norm. What matters for this toolchain is different: the output is meant to survive review, and the question there is never "did the tool obey robots.txt" but "can you state what your collection policy was". Whichever setting you choose is written into the evidence manifest and the declaration draft.

In practice it rarely bites. RDAP, crt.sh, GLEIF, EDGAR, sellers.json and ads.txt are all published for machine consumption; only imprint scraping and county-records HTML touch robots-relevant paths.

Version reporting

Every run prints the version of each component, and attribution version reports them. A finding that cannot name its toolchain is hard to re-examine once the scoring model has moved.

License

Apache-2.0.