{
  "metadata": {
    "description": "OSINT Reasoning Lab — tasks focused on open-source intelligence methodology for locating missing persons. All tasks use publicly available data only. Python automation scripts.",
    "difficulty_scale": "1-5 (1=single-source lookup, 3=multi-source correlation, 5=full investigation pipeline)",
    "purpose": "Train Harvester to reason about OSINT investigation methodology and build automation tools for finding lost children."
  },
  "tasks": [
    {
      "id": 1,
      "name": "EXIF Metadata Extractor",
      "lang": "python",
      "difficulty": 2,
      "category": "image_analysis",
      "prompt": "Write a Python script that extracts all EXIF metadata from an image file (JPEG/PNG). Must extract: GPS coordinates (convert to decimal lat/lon), camera make/model, timestamp, software used, thumbnail if present. Output as structured JSON. Handle images with no EXIF gracefully. Use only Pillow (PIL). Include a function that takes a file path and returns a dict with all extracted fields, plus a convenience function that formats GPS coords as a Google Maps URL."
    },
    {
      "id": 2,
      "name": "Reverse Image Search Automator",
      "lang": "python",
      "difficulty": 3,
      "category": "image_analysis",
      "prompt": "Write a Python module that computes perceptual hashes (pHash, dHash, aHash) for an image, stores them in a local SQLite database for comparison, and provides a search function that finds visually similar images from the database within a configurable Hamming distance threshold. Must support: adding images to the index, querying by image file, returning similarity scores, and batch indexing a directory of images. Use Pillow for image processing. Include a CLI interface that supports 'index', 'search', and 'stats' subcommands."
    },
    {
      "id": 3,
      "name": "Username OSINT Enumerator",
      "lang": "python",
      "difficulty": 2,
      "category": "social_media",
      "prompt": "Write a Python script that takes a username string and checks if that username exists on common public platforms by making HTTP HEAD/GET requests to known profile URL patterns (e.g., github.com/{user}, twitter.com/{user}, reddit.com/user/{user}). Must handle: rate limiting with configurable delays, timeout per request, HTTP status code interpretation (200=found, 404=not found, 403=blocked), output results as JSON with platform name, URL, status, and response time. Use requests library with proper User-Agent header. Support a configurable platform list loaded from a JSON config file."
    },
    {
      "id": 4,
      "name": "Public Records Timeline Builder",
      "lang": "python",
      "difficulty": 3,
      "category": "timeline",
      "prompt": "Write a Python module that builds a chronological timeline from multiple data points. Each data point has: timestamp (various formats — ISO, US date, Unix epoch, relative like '3 days ago'), source name, event description, confidence level (high/medium/low), and optional location. Must parse all timestamp formats into UTC datetime objects, sort chronologically, detect gaps longer than a configurable threshold, identify overlapping events, and export the timeline as both JSON and a formatted text report. Include functions for: add_event(), merge_timelines(), find_gaps(), and export()."
    },
    {
      "id": 5,
      "name": "Geolocation from Coordinates",
      "lang": "python",
      "difficulty": 2,
      "category": "geolocation",
      "prompt": "Write a Python module for working with geographic coordinates in OSINT investigations. Must support: converting between DMS (degrees/minutes/seconds) and decimal degrees, calculating distance between two points using the Haversine formula, finding the bounding box (NW/SE corners) for a given center point and radius in km, generating a static map URL for a list of points, and clustering nearby points within a configurable radius using a simple algorithm (no scipy/sklearn). All math should use the math module only. Include type hints and a CLI that accepts lat/lon pairs."
    },
    {
      "id": 6,
      "name": "WHOIS Data Parser",
      "lang": "python",
      "difficulty": 2,
      "category": "domain_recon",
      "prompt": "Write a Python module that parses raw WHOIS text output (passed as a string) and extracts structured fields: registrant name, organization, email, creation date, expiration date, updated date, nameservers, registrar name, and status codes. Handle the most common WHOIS formats (ICANN thin/thick, various registrars). Return results as a dataclass with optional fields (None if not found). Include a function that compares two WHOIS records and returns a diff of changed fields. Use only regex and standard library — no external WHOIS packages."
    },
    {
      "id": 7,
      "name": "Social Media Post Timestamp Analyzer",
      "lang": "python",
      "difficulty": 3,
      "category": "social_media",
      "prompt": "Write a Python module that analyzes posting patterns from a list of timestamps. Input: a list of ISO-8601 datetime strings representing public post times. Must compute: hourly activity histogram (24 bins), day-of-week distribution, most active hour and day, average time between posts, detect regular posting schedules (e.g., 'posts every Tuesday around 3pm'), identify unusual gaps or bursts in activity, and estimate the user's likely timezone based on activity patterns (assume sleeping hours are 1am-6am local). Output all analysis as a structured dict. Use only standard library (datetime, collections, statistics)."
    },
    {
      "id": 8,
      "name": "DNS Reconnaissance Tool",
      "lang": "python",
      "difficulty": 3,
      "category": "domain_recon",
      "prompt": "Write a Python DNS reconnaissance module using only the socket standard library. Must support: resolving A, AAAA, MX, and TXT records via socket.getaddrinfo and dns queries, checking for common subdomains from a configurable wordlist (www, mail, ftp, api, dev, staging, admin, etc.), detecting wildcard DNS (resolve a random subdomain and check if it matches), outputting all discovered records as structured JSON, and providing a summary with total records found per type. Include rate limiting between queries and timeout handling. No external DNS libraries — socket and struct only."
    },
    {
      "id": 9,
      "name": "Missing Person Report Generator",
      "lang": "python",
      "difficulty": 4,
      "category": "reporting",
      "prompt": "Write a Python module that generates a structured intelligence report from collected OSINT data points. Input is a dict containing: person description (name, age, last_seen_date, last_seen_location), a list of sighting data points (timestamp, location, source, confidence), a list of associated online accounts (platform, username, last_active), and timeline events. The module must: validate all input data, generate a formatted text report with sections (Subject Info, Timeline, Online Presence, Sighting Analysis, Recommended Next Steps), calculate a 'data freshness' score based on how recent the data points are, identify geographic patterns in sightings, and flag any data inconsistencies. Output as both plain text and structured JSON."
    },
    {
      "id": 10,
      "name": "Alert Monitor Framework",
      "lang": "python",
      "difficulty": 4,
      "category": "monitoring",
      "prompt": "Write a Python framework for monitoring public data feeds for keyword matches. Must support: configurable keyword lists with boolean logic (AND, OR, NOT), case-insensitive and regex-capable matching, a pluggable source interface (abstract base class for feed sources), a SQLite-backed alert log with deduplication (same content from same source within configurable window = skip), configurable check intervals per source, and alert callbacks (print, log to file, or call a function). Include one concrete source implementation: an RSS feed reader using only urllib and xml.etree. The framework should be runnable as a long-lived process with graceful shutdown on SIGINT."
    },
    {
      "id": 11,
      "name": "Data Correlation Engine",
      "lang": "python",
      "difficulty": 5,
      "category": "analysis",
      "prompt": "Write a Python module that correlates entities across multiple data sources. Entities are dicts with fields like name, email, phone, username, location, and timestamp. The engine must: perform fuzzy name matching (handle typos, nicknames, abbreviations using Levenshtein distance — implement from scratch, no external libs), match entities by shared identifiers (exact email, phone normalization), score entity similarity on a 0-1 scale based on matching fields, merge correlated entities into unified profiles with provenance tracking (which source contributed each field), detect conflicts (same field, different values) and flag them, and output a list of unified profiles with confidence scores. Use only standard library plus basic string operations."
    },
    {
      "id": 12,
      "name": "Location History Heatmap Builder",
      "lang": "python",
      "difficulty": 3,
      "category": "geolocation",
      "prompt": "Write a Python module that takes a list of location data points (lat, lon, timestamp, source) and produces analysis for a heatmap. Must: cluster nearby points using a grid-based approach (configurable cell size in meters), count visits per cell, identify the top N most-visited locations, calculate time spent at each cluster (based on consecutive timestamps within the cluster), detect travel patterns (sequences of locations ordered by time), estimate travel speed between consecutive points and flag impossible speeds (teleportation detection > 900 km/h), and output the grid data as a JSON structure with cell coordinates, visit counts, and time-spent estimates. Use only math and standard library."
    },
    {
      "id": 13,
      "name": "Text Entity Extractor",
      "lang": "python",
      "difficulty": 3,
      "category": "analysis",
      "prompt": "Write a Python module that extracts structured entities from unstructured text using regex patterns. Must extract: email addresses, phone numbers (US and international formats), URLs, physical addresses (street number + street name patterns), dates in multiple formats (MM/DD/YYYY, YYYY-MM-DD, Month Day Year, relative dates), @mentions and #hashtags, and IP addresses (v4). Each extracted entity should include: the matched text, entity type, position in the original text (start/end index), and a confidence score based on pattern specificity. Return results grouped by entity type. Use only the re module — no NLP libraries."
    },
    {
      "id": 14,
      "name": "Secure Evidence Hasher",
      "lang": "python",
      "difficulty": 2,
      "category": "reporting",
      "prompt": "Write a Python module for chain-of-custody evidence handling in digital investigations. Must: compute SHA-256 and MD5 hashes of files (streaming, handle files of any size), generate a timestamped evidence receipt (JSON) with file name, size, hashes, collection timestamp, collector name, and case ID, verify a file against a previously generated receipt, maintain an append-only evidence log in a SQLite database, and support batch processing of a directory (hash all files, generate manifest). Include integrity verification that detects any modified files. Use only hashlib, sqlite3, and standard library."
    },
    {
      "id": 15,
      "name": "Investigation Case Manager",
      "lang": "python",
      "difficulty": 5,
      "category": "reporting",
      "prompt": "Write a Python module that manages OSINT investigation cases. A case contains: case ID, subject info, status (open/active/closed), assigned investigators list, a timeline of events, collected evidence records, data source logs, and notes. Must support: creating and updating cases in SQLite, adding timeline events with automatic timestamping, linking evidence (files with hashes) to cases, generating a case summary report, searching across cases by subject name or keyword, tracking investigation hours per investigator, and exporting a complete case as a single JSON file for sharing. All data must be stored in a normalized SQLite schema (cases, events, evidence, investigators, notes tables). Include CLI with subcommands: create, update, add-event, add-evidence, report, search, export."
    }
  ]
}