feat(wallet_screening): refresh OFAC SDN snapshot (#287)

CHANGELOG.md

@@ -10,12 +10,15 @@ Contributors add user-facing entries under `[Unreleased]` in the same PR. Mainta
 
 ### Added
 
+- **Skill (`finance/wallet_screening` v1.0.2):** Full OFAC SDN.CSV snapshot (13 Oct 2026 publication) projected to `normalized_ofac_sdn.json` with a sha256 manifest. Ethereum screening indexes currency code `ETH` only, so non-ETH `0x` identifiers cannot false-hit. Includes the Shelbit ETH addresses missing from the Jul 2025 bundle ([#287](https://github.com/ARPAHLS/skillware/issues/287), [#115](https://github.com/ARPAHLS/skillware/issues/115)).
+
 - **Skill (`data_engineering/telemetry_normalizer` v0.1.0):** Universal, deterministic telemetry normalizer for heterogeneous IoT, robotics kinematics (IMU), battery fleet energy storage, and smart building HVAC sensor arrays. Performs mathematical SI/UCUM unit harmonization, strict UTC ISO-8601 timestamp normalization, physical boundary validation, stuck sensor/fault detection, coverage scoring, and W3C SOSA/SSN JSON-LD semantic export without LLM calls inside execution ([#47](https://github.com/ARPAHLS/skillware/issues/47)).
 - **Governance / Licensing (SPDX & Copyright Headers):** Standardized top-of-file SPDX license identifiers (`SPDX-License-Identifier: MIT`) and explicit copyright notices (`# Copyright (c) 2026 ARPA Hellenic Logical Systems`) across all core framework source files (`skillware/**/*.py`), CLI entry points, and authoring templates (`templates/python_skill/`) to protect against attribution stripping and ensure enterprise SCA compliance ([#416](https://github.com/ARPAHLS/skillware/issues/416)).
 - **Tests / CI:** Added [`tests/test_spdx_headers.py`](tests/test_spdx_headers.py) asserting that all Python source files under `skillware/` and `templates/` enforce valid top-of-file SPDX license identifiers and copyright notices ([#416](https://github.com/ARPAHLS/skillware/issues/416)).
 
 ### Changed
 
+- **Skill (`finance/wallet_screening`):** Removed duplicate mixer rows in `malicious_scs_2025.json` that reused the Sinbad and ChipMixer addresses, and stripped zero-width characters from Israel NBCTF addresses ([#115](https://github.com/ARPAHLS/skillware/issues/115)).
 - **Examples:** Renamed `examples/issue_resolver_github_context.py` to `examples/issue_resolver_common.py` to match the `*_common.py` helper module convention; updated imports in `claude_issue_resolver.py`, `gemini_issue_resolver.py`, and `ollama_issue_resolver.py`; removed `GRANDFATHERED_EXAMPLES` workaround from `tests/test_registry_docs.py` (#233).
 - **Typing:** `skillware/core/ui_schema.py` and `skillware/version_policy.py` are now type-clean and removed from the `[[tool.mypy.overrides]]` list, so `mypy skillware` checks them in CI (#415, Phase 1).
 

docs/skills/README.md

@@ -34,7 +34,7 @@ Tools for financial analysis, blockchain interaction, and regulatory compliance.
 
 | Skill | ID | Version | Issuer | Description |
 | :--- | :--- | :--- | :--- | :--- |
-| **[Wallet Screening](finance/wallet_screening.md)** | `finance/wallet_screening` | `1.0.1` (23 Jul 2026) | [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS)) | Comprehensive risk assessment for Ethereum wallets. Checks sanctions lists (OFAC, FBI) and identifies interactions with malicious contracts (Mixers, Scams). |
+| **[Wallet Screening](finance/wallet_screening.md)** | `finance/wallet_screening` | `1.0.2` (14 Oct 2026) | [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS)) | Comprehensive risk assessment for Ethereum wallets. Checks sanctions lists (OFAC, FBI) and identifies interactions with malicious contracts (Mixers, Scams). |
 | **[UK Companies House Handler](finance/uk_companies_house_handler.md)** | `finance/uk_companies_house_handler` | `1.3.0` (17 Sep 2026) | [@Areen-09](https://github.com/Areen-09) ([@ARPAHLS](https://github.com/ARPAHLS)) | Deterministic UK Companies House API handler: company search, officers with deterministic role/name filtering, PSC, filing history with helpers, and turn-by-turn pipeline orchestration. |
 
 ## DeFi

docs/skills/finance/README.md

@@ -10,7 +10,7 @@ This hub is the documentation landing page for Skillware **finance** agent skill
 
 | Skill | ID | Version | Issuer | Description |
 | :--- | :--- | :--- | :--- | :--- |
-| **[Wallet Screening](wallet_screening.md)** | `finance/wallet_screening` | `1.0.1` (23 Jul 2026) | [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS)) | Comprehensive risk assessment for Ethereum wallets. Checks sanctions lists (OFAC, FBI) and identifies interactions with malicious contracts (Mixers, Scams). |
+| **[Wallet Screening](wallet_screening.md)** | `finance/wallet_screening` | `1.0.2` (14 Oct 2026) | [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS)) | Comprehensive risk assessment for Ethereum wallets. Checks sanctions lists (OFAC, FBI) and identifies interactions with malicious contracts (Mixers, Scams). |
 | **[UK Companies House Handler](uk_companies_house_handler.md)** | `finance/uk_companies_house_handler` | `1.3.0` (17 Sep 2026) | [@Areen-09](https://github.com/Areen-09) ([@ARPAHLS](https://github.com/ARPAHLS)) | Deterministic UK Companies House API handler: company search, officers with deterministic role/name filtering, PSC, filing history with helpers, and turn-by-turn pipeline orchestration. |
 
 ## Typical host pipelines

docs/skills/finance/wallet_screening.md

@@ -3,7 +3,7 @@
 **ID**: `finance/wallet_screening`
 **Issuer**: [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS))
 <!-- skill-doc-meta:begin -->
-**Version**: `1.0.1` — 23 Jul 2026
+**Version**: `1.0.2` — 14 Oct 2026
 <!-- skill-doc-meta:end -->
 <!-- skill-intent:begin -->
 **Solves:** Screen Ethereum wallets against OFAC / FBI sanctions lists and known mixer or scam contracts before a host agent acts.
@@ -18,7 +18,7 @@ A rigorous compliance and risk assessment tool for Ethereum wallets. This skill
 
 ## Capabilities
 
-*   **Sanctions Check**: Screens against **880+** bundled lists (OFAC, FBI, Israel NBCTF, etc.) via dynamic dataset loading.
+*   **Sanctions Check**: Screens Ethereum addresses against bundled OFAC SDN, FBI Lazarus, Israel NBCTF, Uniswap TRM, and OpenSanctions `il_mod_crypto` snapshots.
 *   **Malicious Contract Detection**: Identifies interactions with known bad actors (Tornado Cash, Drainers).
 *   **Financial Forensic Analysis**:
     *   Calculates total Inflows/Outflows/Gas.
@@ -46,13 +46,15 @@ The Python implementation has been engineered for speed and depth:
 
 ### Corpus (`data/`)
 Contains localized JSON snapshots of global sanctions lists.
-*   `entities.ftm.json`: Core sanctions list.
+*   `entities.ftm.json`: OpenSanctions FollowTheMoney extract (`il_mod_crypto`).
 *   `malicious_scs_2025.json`: Known malicious smart contracts.
-*   `data/*.json`: Hundreds of normalized lists (UniSwap TRM, FBI Lazarus, etc.).
+*   `normalized_ofac_sdn.json`: Full OFAC SDN digital-currency snapshot. Only `ETH` identifiers are Ethereum match keys. `ofac_sdn_manifest.json` and `ofac_sdn_quarantine.json` are metadata and are not screened.
+*   `normalized_fbi_lazarus_*.json`, `normalized_israel_nbctf_*.json`, `normalized_uniswap_trm.json`: Other bundled lists.
 
 ### Corpus tooling (`maintenance/`)
 Offline tools to refresh Corpus (not loaded by `execute()`).
 *   `normalization_tool.py`: Ingests raw CSVs from authorities (FBI, Israel NBCTF) and converts them to the Skillware JSON schema.
+*   `normalize_ofac_sdn.py`: Projects a full OFAC `SDN.CSV` publication into `normalized_ofac_sdn.json` plus a manifest. Re-run this instead of editing the JSON.
 *   `normalize_uniswap_trm.py`: Converts Uniswap's blocked address list into our risk format.
 
 ## Integration Guide
@@ -299,7 +301,10 @@ The skill returns a rich forensic report. Agents act on this data. `metadata.war
 
 - **Ethereum only**: The skill screens Ethereum (EVM) addresses exclusively. Bitcoin, Solana, or other chain addresses are not supported and will fail address validation.
 - **Etherscan transaction cap**: Normal ETH history is fetched via paginated `txlist` (1,000 txs per page, max 10 pages → **10,000 txs**). When that cap is hit, or Etherscan fails, the report includes `metadata.warnings` with codes such as `etherscan_txlist_truncated`, `etherscan_txlist_unavailable`, or `etherscan_txlist_partial`. Treat PnL and counterparty stats as incomplete when warnings are present.
-- **Point-in-time sanctions data**: The bundled JSON lists (`entities.ftm.json`, `malicious_scs_2025.json`, and the normalized lists) reflect the state at the time of the last `maintenance/` run. They must be refreshed periodically to stay current.
+- **Point-in-time sanctions data**: Bundled lists are snapshots, not a live OFAC feed. `ofac_sdn_manifest.json` records the SDN.CSV sha256, download time, and source `Last-Modified`. A wallet missing from a newer snapshot was not observed in that file. That is not a delisting or legal clearance.
+- **ETH identifiers only**: Screening matches currency code `ETH` with a 40-hex address. USDT, USDC, TRON, Bitcoin, and other SDN identifiers are stored but are not Ethereum hits, even when the identifier looks like `0x`.
+- **Entity-only designations**: Aban Tether is designated without a digital-currency identifier in SDN remarks, so address screening cannot hit it.
+- **Deferred peer lists**: OpenSanctions `il_mod_crypto` (`entities.ftm.json`), FBI Lazarus, Israel NBCTF, and Uniswap TRM stay at their 22 Jul 2025 snapshots. UK OFSI, the EU 20th package, and MEW darklist had no public address file in this bundle to ingest.
 - **No ERC-20 or internal transaction coverage**: Only standard ETH transfers from the Etherscan `txlist` action are analyzed. ERC-20 token transfers, internal transactions, and NFT transfers are not included in financial flow calculations.
 - **Not legal advice**: Risk flags are derived from open-source sanctions data and pattern heuristics. A clean result does not constitute legal clearance.
 
@@ -312,6 +317,7 @@ Commits that touched this skill bundle or its catalog page ([`finance/wallet_scr
 
 | Commit | Description | Date | Version | Contributors |
 | :--- | :--- | :--- | :--- | :--- |
+| [`eb43793`](https://github.com/ARPAHLS/skillware/commit/eb437934af578a0dcebc65b099347a1940a1de22) | feat(wallet_screening): refresh OFAC SDN snapshot for Ethereum screening | 14 Oct 2026 | `1.0.2` | [@Hendobox](https://github.com/Hendobox) |
 | [`790787d`](https://github.com/ARPAHLS/skillware/commit/790787d0e72262ddfeb26f747f880012ca2b1ca6) | docs: five-provider Usage Examples guard and catalog loop backfill (#347) | 10 Sep 2026 | `1.0.1` | [@rosspeili](https://github.com/rosspeili) |
 | [`12fbd1a`](https://github.com/ARPAHLS/skillware/commit/12fbd1a11bdf66250008afc59df7048935eafc73) | docs: adopt Skill anatomy vocabulary on catalog page (#319) | 1 Sep 2026 | `1.0.1` | [@rosspeili](https://github.com/rosspeili) |
 | [`0b308d3`](https://github.com/ARPAHLS/skillware/commit/0b308d3) | feat(wallet_screening): paginate Etherscan txlist and surface warnings (#214) (#215) | 23 Jul 2026 | `1.0.1` | [@Hendobox](https://github.com/Hendobox) |

skills/finance/wallet_screening/data/malicious_scs_2025.json

@@ -6,15 +6,22 @@
     "creator": "unknown",
     "reason": "Sanctioned privacy mixer contract",
     "source": "OFAC, Etherscan",
-    "jurisdictions_blocked": ["US", "EU", "IL"],
+    "jurisdictions_blocked": [
+      "US",
+      "EU",
+      "IL"
+    ],
     "severity": "high",
     "known_victims": [],
     "related_hashes": [],
     "references": [
       "https://etherscan.io/address/0x910cbd523d972eb0a6f4cae4618ad62622b39dbf",
       "https://home.treasury.gov/news/press-releases/jy0916"
     ],
-    "tags": ["mixer", "sanctioned"],
+    "tags": [
+      "mixer",
+      "sanctioned"
+    ],
     "notes": "OFAC-sanctioned contract. Used for anonymizing ETH transactions."
   },
   {
@@ -24,15 +31,22 @@
     "creator": "unknown",
     "reason": "OFAC-sanctioned mixer, successor to Blender.io, used by Lazarus Group",
     "source": "OFAC",
-    "jurisdictions_blocked": ["US", "EU", "IL"],
+    "jurisdictions_blocked": [
+      "US",
+      "EU",
+      "IL"
+    ],
     "severity": "high",
     "known_victims": [],
     "related_hashes": [],
     "references": [
       "https://home.treasury.gov/news/press-releases/jy1701",
       "https://www.chainalysis.com/blog/sinbad-sanctions/"
     ],
-    "tags": ["mixer", "sanctioned"],
+    "tags": [
+      "mixer",
+      "sanctioned"
+    ],
     "notes": "OFAC-sanctioned contract. Used for laundering by North Korean hackers."
   },
   {
@@ -42,15 +56,22 @@
     "creator": "unknown",
     "reason": "First crypto mixer sanctioned by OFAC, used by Lazarus Group",
     "source": "OFAC",
-    "jurisdictions_blocked": ["US", "EU", "IL"],
+    "jurisdictions_blocked": [
+      "US",
+      "EU",
+      "IL"
+    ],
     "severity": "high",
     "known_victims": [],
     "related_hashes": [],
     "references": [
       "https://home.treasury.gov/news/press-releases/jy0819",
       "https://www.chainalysis.com/blog/blender-sanctions/"
     ],
-    "tags": ["mixer", "sanctioned"],
+    "tags": [
+      "mixer",
+      "sanctioned"
+    ],
     "notes": "OFAC-sanctioned contract. Used for laundering illicit funds."
   },
   {
@@ -60,50 +81,22 @@
     "creator": "unknown",
     "reason": "Seized by law enforcement, used for laundering illicit funds.",
     "source": "Europol, DOJ",
-    "jurisdictions_blocked": ["US", "EU", "IL"],
+    "jurisdictions_blocked": [
+      "US",
+      "EU",
+      "IL"
+    ],
     "severity": "high",
     "known_victims": [],
     "related_hashes": [],
     "references": [
       "https://www.europol.europa.eu/media-press/newsroom/news/chipmixer-takedown-darkweb-cryptocurrency-mixer-seized",
       "https://www.justice.gov/opa/pr/justice-department-seizes-cryptocurrency-mixer-chipmixer-charges-operator"
     ],
-    "tags": ["mixer", "seized"],
-    "notes": "Seized by law enforcement. Used for laundering by ransomware groups and darknet markets."
-  },
-  {
-    "address": "0x6f1b9b64e2932f6a2db338f616844400cd58e8a",
-    "name": "Helix Mixer",
-    "created_at": "2020-02-10T00:00:00Z",
-    "creator": "Larry Dean Harmon",
-    "reason": "Linked to darknet markets and sanctioned activity.",
-    "source": "FinCEN, DOJ",
-    "jurisdictions_blocked": ["US", "EU", "IL"],
-    "severity": "high",
-    "known_victims": [],
-    "related_hashes": [],
-    "references": [
-      "https://www.fincen.gov/news/news-releases/fincen-assesses-60-million-civil-money-penalty-against-operator-virtual-currency",
-      "https://www.justice.gov/opa/pr/ohio-man-charged-operating-darknet-based-bitcoin-mixer-which-laundered-over-300-million"
-    ],
-    "tags": ["mixer", "sanctioned"],
-    "notes": "Sanctioned by FinCEN and DOJ. Used for laundering darknet market proceeds."
-  },
-  {
-    "address": "0x6e2b76966cb5b6bbbc2c7b7bffb3a8e389d8f3c0",
-    "name": "Hydra Market Contract",
-    "created_at": "2022-04-05T00:00:00Z",
-    "creator": "unknown",
-    "reason": "Darknet market, sanctioned by OFAC.",
-    "source": "OFAC",
-    "jurisdictions_blocked": ["US", "EU", "IL"],
-    "severity": "high",
-    "known_victims": [],
-    "related_hashes": [],
-    "references": [
-      "https://home.treasury.gov/news/press-releases/jy0701"
+    "tags": [
+      "mixer",
+      "seized"
     ],
-    "tags": ["market", "sanctioned"],
-    "notes": "Hydra Market contract sanctioned by OFAC."
+    "notes": "Seized by law enforcement. Used for laundering by ransomware groups and darknet markets."
   }
-] 
+]