v0.2.0-rc1 tracker — 3 of 11 Tier-A sources shipped, 8 to go (+ 4 broken since Apr research)

Implementation tracker for the v0.2.0-rc1 milestone called out in #4. Plan synthesis lives in [`research/12-v0.2.0-build-plan.md`](https://github.com/AnshumanAtrey/clank/blob/main/research/12-v0.2.0-build-plan.md); this issue is the moving checklist on top of it.

## Shipped this week (v0.1.1 architecture + first 3 Tier-A sources)

**Architecture (the three issue-#4 architecture asks):**
- 493b917 `feat(deep):` auto-run dorks at end of every report
- 86cae09 `feat(deep):` inline-suggestion footer for skipped sources
- 269647e `feat(deep):` default timeout 60s → 30s + pinned `DefaultTimeout` constant

**Tier-A sources (zero-config, no key, no pairing):**
- 33597f7 `feat(fcc):` US unwanted-call complaints — Socrata SODA, ~5M rows, locale-skip for non-US
- 06112c8 `feat(github):` commit-message search across 4 phone format variants, dedup by SHA, optional `GITHUB_TOKEN`
- 8fa80bd `feat(ovh):` EU landline geolocation (FR/BE/CH/CZ/DE/ES/FI/IT/NL/PL/PT/TN/UK)

Each commit includes httptest unit tests; OVH also has a `-tags integration` live test against the real upstream.

## Broken since the April 2026 research (4 sources, need replanning)

Live-curling each endpoint before writing code surfaced these. The April research had them as default-ship; May 2026 reality:

| Source | April status | May status | Action |
|---|---|---|---|
| OpenCNAM Hobbyist | 60 cached lookups/hr no key | `401 WWW-Authenticate: Basic realm=\"TitanCallerID\"` — Hobbyist tier removed | drop, move to opt-in if user has paid creds |
| FreeCnam | unlimited US no key | Cloudflare-fronted, returns `Error: ratelimit or other issue` from any client | drop |
| psbdmp.cc paste search | `GET /api/search/` | 404 Cloudflare; corpus service reorganized or gone | drop |
| FTC DNC complaints | `?CompanyPhoneNumber=...` filter | endpoint live but filter is ignored, returns latest 50 regardless | investigate filter syntax or drop |

Decision: drop OpenCNAM/FreeCnam/psbdmp; keep FTC DNC parked pending filter-syntax discovery.

## Remaining Tier-A (8 of 11) — needs prioritization

**Plain HTTP, achievable next session:**
- [ ] Wayback CDX phone-search (was 503 during last test, may be transient)
- [ ] BrasilAPI Receita Federal (CNPJ → phone — note: this is the inverse direction; useful for B2B lookups but not reverse-by-phone)
- [ ] NPA-NXX rate-center / OCN parsing (offline, ~5MB embed; covers US/CA carrier+rate-center beyond libphonenumber's coarse country)
- [ ] Microsoft `GetCredentialType` phone-hint extractor (chained source — needs an email input, not phone-first)

**Need TLS-fingerprinting layer first** (`bogdanfinn/tls-client` Chrome_146 — see research/12 §A):
- [ ] wa.me probe (Cloudflare-fronted; needs go-rod fallback for HTML drift)
- [ ] tellows multi-locale HTML scrape (DE/IT/FR/ES/UK/JP/KR/TW; one parser, locale-switched)
- [ ] Spy Dialer US scrape (one of the only remaining free CNAM-equivalent sources)

The TLS layer is ~1 day of work and unlocks all 3 of the latter group simultaneously, so building it next is higher ROI than another isolated source.

## Architecture work still missing for rc1 completion

- [ ] `internal/transport/` package wrapping `bogdanfinn/tls-client` with a Chrome_146 profile and 3-5s per-host cooperative rate limit
- [ ] Per-source disk cache at `~/.clank/cache//.json` with TTL — currently each source does its own in-process cache or none
- [ ] Formal `Source.Regions() []string` interface — current sources do region-skip inside `runX()` helpers in `internal/deep/deep.go`; works but isn't the documented adapter shape
- [ ] Drop tech debt flagged RED in research/06-library-health-audit.md:
- [ ] Remove `Oros42/phone-blacklist` (11 yr stale, 3 stars)
- [ ] Remove `jwoertink/blocked-numbers` (8.5 yr stale, no license — currently shipped in binary)
- [ ] Switch MCC/MNC source from `pbakondy/mcc-mnc-list` (3 yr stale) to `CursedHardware/mno-list` (weekly refresh)

## Tier-B (locale richness, after rc1) and Tier-C (bonus, optional)

These are documented in research/12 §"Source map (final)". Quick recap of what's queued:

**Tier-B (10 sources):** NZ Companies Office API, JP iTownPage scrape, IL B144 directory, FR triple parser (118712 + Pages Jaunes inverse + ctqui), IT/ES Pagine/Páginas Bianche, CA Canada411, IN MCA21+GST+ICAI, IN TRAI DND, DE Bundesnetzagentur Maßnahmenliste, US robocall-audio dataset cross-reference.

**Tier-C (6 bonus):** psbdmp paste (now broken — drop), ENUM DNS NAPTR, ViewDNS reverse-WHOIS via knockknock pattern, STI-PA OCN provenance, vanity decoder, plus an extra slot freed up by Tier-A drops.

## Hard skips locked in by the May 2026 research

Not reopening any of these (one-line reason each documented in README per the build plan):

- **Truecaller** — Play Integrity attestation hardware-rooted; truecallerjs/truecallerpy onboarding still broken Apr 2026; TechCrunch 2026-04-26 confirms Truecaller is tightening, not loosening.
- **Google username recovery** — patched June 2025 (Brutecat); no 2026 replacement bug.
- **CallApp / EyeCon / Hiya / Whoscall / Showcaller** — same closed-API class as Truecaller.
- **Amazon sign-in scrape** — Akamai BMP + ToS-borderline at lookup volume.
- **Signal** — CDSI is privacy-by-design, intentionally unenumerable.
- **iMessage** — needs real Apple device push token; not packageable in a single Go binary.
- **DeHashed / LeakCheck / Snusbase** — distribute plaintext stolen credentials; off-ethics.
- **WhitePages / 411 / AnyWho live scrape** — anti-bot too tight; use Wayback for stale snapshots only.
- **shouldianswer / 800notes / mrnumber scrape** — ToS-grey + low quality.
- **Saudi/UAE/Egypt/Iran/Turkey** government registries — citizen-auth-walled.
- **All Africa registries post-POPIA** — phone field paywalled.
- **NPCI UPI VPA → phone** — NPCI hides phone by design.
- **Aadhaar / EPFO / state RTOs / Mexico INE** — consent-gated by law.
- **SS7 / SigPloit / SIM cloning class** — out-of-ethics for clank's positioning.

## Acceptance test recipe (issue #4 verification)

When rc1 is feature-complete, this script in `tests/acceptance.sh` should pass:

```bash
clank deep +14155552671 # US — must hit ≥6 signals in <5s
clank deep +442071234567 # UK — must hit ≥4 signals
clank deep --region IN 9181156055 # IN — must hit ≥3 signals + identity-graph URLs
clank deep --region BR +5511999999999 # BR — Receita Federal must contribute
clank deep --region FR +33123456789 # FR — Pages Jaunes / OVH must contribute
```

Plus: `clank deep --no-cache --json +14155552671 | jq '.dorks | length'` ≥ 25.

## Refs
- Closes (eventually): #4
- Related: research/12-v0.2.0-build-plan.md (synthesis)
- Related: research/01–11.md (deep-dive primitives)