Sofia/DB-cleanup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

feat(sources): Wayback pass, automatic trimming, detention rule, ten cases re-sourced

Browse Source 
Second and third rounds on the dossier pipeline, reviewed locally before commit.

Retrieval
- wayback_pass.py: retries every BLOCKED/DEAD/THIN/ERROR linked source through
  the Wayback Machine; blocks carry the snapshot date, archive URL and the live
  verdict. 143 slots retried: 93 fetched, 37 no snapshot, 12 script shells, 1 PDF.
- fetch_sources.py: fetch_wayback() helper.
- add_extra_sources.py: files staged extra_* finds (web search, not on the DB
  record) into the store with a provenance note.
- Cases re-sourced by web search: 248 (Oslo: Document.no, Avisa Oslo, NRK; the
  linked Le Parisien piece is case 242 and is marked OFF-CASE), 258 Kharkiv,
  260 Singapore, 358 Bangkok, 365 Las Vegas, 388 Verneuil-sur-Seine, 390 Zoersel,
  430 Homestead. 341 of 364 cases now hold a fetched article; 11, 66 and 399
  have no public text source (podcast, police video, direct victim report).

Trimming
- auto_trim.py: case-anchored furniture cut for UNTRIMMED blocks. Finds the body
  run that mentions the case, merges across subheadings and short furniture
  gaps, drops teasers, share bars, date/URL/caption lines and subscription
  pitches; refuses pages with no record term or almost no body. 302 blocks
  trimmed; 16 left on auto-trim-review.md (7 OFF-CASE suspects). Every cut is
  labelled AUTO-TRIMMED, UNREVIEWED in the dossier; the full extract stays in
  staging/. Decisions with anchors in trim-decisions-auto.json.
- build_cases.py / verify_all.py: banners for auto-trimmed and archived blocks,
  staged-file check extended to Wayback blocks, flag legend under the record.

Detention rule
- README "Definitions": the DB field `kidnappings` is the DETENTION violence
  type (victim, guard, staff or relative held to force submission or execute
  the theft), distinct from the Kidnapping scenario (taken away and held).
- detention-flag-review.md / detention-flag-corrections.json: 40 records
  reviewed with evidence; 30 set-to-1 proposals accepted by the owner on
  2026-09-06 (listed in corrections-approved.md), 10 still open.
- apply_detention_wording.py: "Violence Used" in the 70 reviewed summaries now
  names detention explicitly (62 of 70 labelled), supported by the summary's
  own text; idempotent; supersedes the batch scripts' wording.

Worklist and docs
- sofia-worklist.md: 248 decisions, detention rule item replacing the old
  "no abduction" item, fresh-search section for the textless cases.
- README-START-HERE.md: progress notes, run commands, next steps.
- Bug fixed in passing: Wayback blocks stored in-memory text with carriage
  returns; now stored as read back from disk.

verify_all.py PASSES (2321 checks).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt
This commit is contained in:
StellarCrow
2026-09-06 19:36:45 +02:00
co-authored by Claude Fable 5.1
parent 499fd61f79
commit 439e83a4cb
588 changed files with 24800 additions and 13190 deletions
Download Patch File Download Diff File Expand all files Collapse all files
merge-output/sources/423_Unnamed-Sunnyvale-crypto-holder.txt
+65 -64
View File
@@ -27,6 +27,9 @@ DATABASE RECORD
has_processed_date 0
created_at 2026-04-07 14:51:41
(flag legend: 'kidnappings' is the DETENTION flag — 1 when the victim was held against
their will at any point, tied, locked in, held at gunpoint or taken away; it is NOT the
same as the 'Kidnapping' scenario, which means taken away and held. See README, Definitions.)
AI SUMMARY [generated at bulk import, NOT verified against sources]
**Victim:** Sunnyvale resident with large cryptocurrency holdings
@@ -45,24 +48,20 @@ LINKED SOURCES
[url] https://www.sfchronicle.com/crime/article/crypto-wrench-attack-home-invasion-22088091.php
[url_2] https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/
OTHER LINKED SOURCES
[BLOCKED] url_2 None — raw request refused; try the WebFetch path, which is a model transcription and must be labelled as such
https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/
------------------------------------------------------------------------------------------------
FETCHED ARTICLE 1 [RAW EXTRACT — NOT YET TRIMMED]
!! This is the whole page as extracted. It still contains site furniture,
!! and may contain teaser headlines for UNRELATED cases. Trim on read-through.
!! Do not quote from it without checking the passage belongs to this case.
FETCHED ARTICLE 1 [AUTO-TRIMMED — UNREVIEWED]
!! Furniture was cut by a script keyed on this case's record, not by a person.
!! It may still carry passages about OTHER cases from a round-up article.
!! The full page extract is kept in staging/ if a cut needs revisiting.
Source sfchronicle.com
URL https://www.sfchronicle.com/crime/article/crypto-wrench-attack-home-invasion-22088091.php
Field url
Retrieved 2026-08-06T13:40:52+00:00 via raw HTTP retrieval, deterministic extraction (HTTP 200)
Language unknown
Kept paragraphs ALL 81 paragraphs, untrimmed
Length 16,038 chars
Integrity sha256 a023674e67e652a8b36377cb73530ad7e14310ad1e7c75ffb0fd4d4423ea6e4a
Trimmed NOT TRIMMED. Full page extract; trim on read-through.
Kept paragraphs headline [0] + 20-66 of 81
Length 10,794 chars
Integrity sha256 cafddee5b8a70554250bcfa34f1dd0ba28cefc6fd89681170bec1387fa54f74d
Trimmed AUTO-TRIMMED, unreviewed: kept paragraphs 20-66 plus headline [0]; dropped 19 leading and 14 trailing paragraphs. Case-term hits on page: 37.
Caveat retrieved from a live page on the date above. Unlike text copied
from the spreadsheet, there is no second copy to hash it against.
------------------------------------------------------------------------------------------------
@@ -71,44 +70,6 @@ ORIGINAL (unknown, verbatim as retrieved)
Crime ring stole millions in crypto in California ‘wrench attacks’
Fake deliveries, then guns: How a ‘wrench attack’ crime ring chased crypto millions from S.F. to L.A.
Daymond Gascon/S.F. Chronicle; Getty Images
By Megan Cassidy, Staff WriterApril 3, 2026
San Francisco, San Jose, Sunnyvale, Los Angeles.
In each city, the plan was the same: Stake out a major cryptocurrency holder, pose as a food or package courier, and pull out the gun.
Documents obtained by the Chronicle reveal evidence that police say links three attempted armed crypto robberies in the Bay Area and Los Angeles in December to a harrowing home invasion a month earlier, in which a San Francisco man was drained of $13 million worth of digital currency after members of the crime ring ordered pizzas to his home before binding him with duct tape, pistol-whipping him and threatening to cut off his fingers.
As of this week, three men from Tennessee were in custody and charged in connection with the targeting of large crypto account holders in two of the crimes, in Sunnyvale and Los Angeles. Sources said authorities were still looking for higher-level operatives in the four cases, which resemble an emerging strain of crypto theft known as “wrench attacks.”
Unlike other crimes that use hacking or social engineering scams to access victims’ funds remotely, wrench attacks rely on more brutish methods of coercion like kidnapping and torture. The crime’s nickname stems from a stick-figure web comic depicting one cybercriminal instructing another to hit a victim “with this $5 wrench until he tells us the password.”
A recent report from cybersecurity firm Certik showed 72 documented instances of wrench attacks across the globe in 2025 — a 75% spike from the year prior — though the company said the crimes are certainly underreported.
Cases that are known to the public have laid bare some of the extreme measures criminals have taken to extract the victims’ funds. In January 2025, a gang in France abducted a crypto firm’s co-founder and his wife, cut off one of the man’s fingers, and held the pair ransom under demands for funds from the company. In May, an Italian man was held captive for weeks in a Manhattan town house while abductors beat him, shocked him with electric wires and held him over a ledge in order to get his Bitcoin password.
The attacks bring into sharp relief how some of the key selling points of crypto — decentralization from banks, the ease of transferring large sums, irreversible transactions — also double as its vulnerabilities.
Banks are tightly regulated by laws meant to protect consumers from theft and fraud. They can freeze accounts or reverse funds, set limits on the amounts that can be transferred in one day, and flag suspicious activities.
Crypto, meanwhile, is attractive because of the autonomy it affords account holders, said Ari Redbord, head of global policy at TRM Labs, a firm that monitors and investigates digital-asset fraud.
“The promise of the technology itself is this idea of cross-border value transfer at the speed of the internet,” Redbord said.
“However,” he added, “bad guys also want to move funds, and transactions are irreversible, which makes it very ripe for this type of activity.”
While specifics on how the thieves identified or found their targets in California remains unclear, police and court records, as well as interviews with individuals close to the investigations, shed light on some of the patterns.
A Sunnyvale financial crimes detective who investigated one of the recent cases, and asked to withhold his name, described the robberies as a “long play” that begins with surveillance. In at least some of the recent cases, this involved infiltrating the victim’ delivery apps like DoorDash or Uber Eats with malware, allowing thieves to learn the victim’s address and other key information.
“They figure out your trends, your life cycle,” said the detective. “What do you normally order online? What do you normally order for takeout? Where do your packages normally come from? And then the suspects are disguising themselves as Door Dash drivers or UPS delivery drivers — finding a way to get you to your front door and open the front door.”
A victim who spoke to the Chronicle but asked that their name be withheld said the suspects visited their home multiple times. Three days before the incident, someone had dropped off cookies from a bakery he had recently ordered from.
After speaking with detectives, the victim learned one of his recycled passwords was likely compromised in a data breach, laying the groundwork for a targeted attack.
While he said it’s not clear exactly how the suspects found him, the victim said a common scenario begins with hackers distributing batches of information to a second layer of bad actors, often through apps like Telegram or Signal.
@@ -203,33 +164,73 @@ Oakland renters had the upper hand. Now, the market is turning against them
As San Francisco’s artificial intelligence boom drives up housing demand and rents, some of that pressure is moving east across the bay.
Wealthy Bay Area region eyes $365 million event center, but not everyone is on board
------------------------------------------------------------------------------------------------
FETCHED ARTICLE 2 [AUTO-TRIMMED — UNREVIEWED]
!! Furniture was cut by a script keyed on this case's record, not by a person.
!! It may still carry passages about OTHER cases from a round-up article.
!! The full page extract is kept in staging/ if a cut needs revisiting.
Source ktla.com
URL https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/
Field url_2
Retrieved 2026-09-05T13:22:55+00:00 via Wayback Machine snapshot 20260407082519, deterministic extraction (HTTP None)
Language unknown
Kept paragraphs headline [0] + 1-22 of 44
Length 4,187 chars
Integrity sha256 6e59a93f7d149506aa3ab7bef2879fc92e66f70a871ae2017a2b065b1cd4f39f
Trimmed AUTO-TRIMMED, unreviewed: kept paragraphs 1-22 plus headline [0]; dropped 0 leading and 21 trailing paragraphs. Case-term hits on page: 16.
Note live URL was BLOCKED on the first pass; text comes from an archived copy dated 2026-04-07
Archive http://web.archive.org/web/20260407082519/https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/
Caveat retrieved from a Wayback Machine snapshot, not the live page. The
snapshot date is in the method line; the live URL was unreadable.
------------------------------------------------------------------------------------------------
Oakland approved a $105 million teachers deal. One board member’s dual role could threaten it
ORIGINAL (unknown, verbatim as retrieved)
UC Berkeley close to landing Memorial Stadium’s first major concert in 36 years. Neighbors are worried
Wealthy California crypto holders targeted in violent ‘wrench attacks’ | KTLA
Yemeni cafés are everywhere in the Bay Area. This restaurant shows its food deserves a spotlight, too
A series of so-called “wrench attacks,” violent robberies targeting wealthy cryptocurrency holders, are making headlines after victims in Los Angeles and the Bay Area were targeted, the San Francisco Chronicle reported.
1.
On Nov. 22, a San Francisco man was robbed of $13 million in digital currency after thieves posing as pizza delivery drivers forced their way into his home, bound him with duct tape, beat him with a firearm and threatened to cut off his fingers.
Broadcaster Greg Papa laid off by KNBR as part of shuffle in midday programming
The victim told investigators he had been expecting a package when a man carrying a white box arrived on the front porch of his Mission Dolores home around 5 p.m.
2.
He was reportedly pushed away from the door and overtaken. For the next hour, a suspect inside the home and another on the phone demanded his passwords and ultimately made off with $10 million in Bitcoin and $3 million in Ethereum, according to The Chronicle.
A mysterious landlord. A tenant revolt. Inside a bizarre, only-in-San Francisco housing battle
Experts say the decentralized nature of cryptocurrencies and the ability to transfer large sums in irreversible transactions, features that attract speculators, also make large account holders vulnerable to bad actors.
3.
Three attempted wrench attacks in Sunnyvale, San Jose and Los Angeles that occurred in the days and weeks following the San Francisco home invasion appear to be linked.
Powerful El Niño puts California in the bull’s-eye for soaking winter, models show
In some cases, investigators believe suspects infiltrated victims’ DoorDash or Uber Eats accounts and obtained key information, including home addresses.
4.
On Dec. 17, a San Jose man was met in his driveway by an armed suspect who ordered him into the garage and told him to close the door. He was struck on the back of the head with the gun and fell, later telling investigators he pretended to be seriously injured.
Do S.F. two-bedrooms really rent for $6,000 now? What the viral claim leaves out
The suspect and another man were spooked when an Amazon delivery van drove by, prompting them to flee.
5.
The victim also recounted two pizza deliveries to his home 11 days earlier that he had not ordered. Just two days before the attack, he was approached by individuals offering to power wash his driveway for free, an offer he declined.
Millions of older adults in California may face higher Medicare prescription drug premiums in 2027
Five days later in Sunnyvale, another man reported that a person posing as a DoorDash driver delivering coffee brandished a gun and pushed his way inside the victim’s home. The suspect fled in a black Kia after the victim fought back.
The suspect was later pulled over and arrested. He was identified as Nino Chindavanh, a 21-year-old resident of Tennessee.
Eight days later, a second suspect attempted the same coffee delivery ruse at the same home.
On New Year’s Eve in Los Angeles’ Brentwood neighborhood, a man posing as a delivery driver asked if he could get a drink of water. The victim obliged and was followed into the home at gunpoint.
He was bound with duct tape and zip ties by the time a second suspect arrived, while a third person was contacted by phone. The suspects threatened to cut off his fingers, prompting the victim to give up his computer password, allowing them to view his cryptocurrency holdings.
A witness hiding in a pantry during the ordeal managed to escape and call 911.
When the suspects heard a helicopter circling overhead, they attempted to flee and were later arrested following a police pursuit.
The two suspects were identified as Elijah Armstrong and Jayden Rucker, both residents of Tennessee. Rucker’s wallet and ID were also found in the black Kia Chindavanh had been driving.
While the three men have been charged with robbery, burglary, assault with a firearm and attempted extortion, among other offenses, investigators believe higher-level operatives are involved in the wrench attacks, a term derived from a web comic.
It’s unclear if investigators, including those at the Federal Bureau of Investigation, have identified any of the larger players in the scheme.
Detectives believe all suspects involved in the in-person robberies in the Bay Area and Los Angeles have now been taken into custody.
A DoorDash spokesperson told The Chronicle that the company is unable to comment on the cases as the investigation remains ongoing, but said the company is cooperating with state, local and federal investigators.
================================================================================================
generated from attacks-export-Gart-website.json + reported_K&R | case 423