From 7afe51124b4d7539e73c2f3353adacf0eaf9ca7c Mon Sep 17 00:00:00 2001
From: Cognis Digital <215970675+cognis-digital@users.noreply.github.com>
Date: Fri, 12 Jun 2026 09:57:44 +0000
Subject: [PATCH 1/2] Repo hardening: install instructions, dead imports,
 hygiene

- fix 2 broken `pip install` line(s) in README (package is not on PyPI; use the working git+https install)
- remove 3 unused import(s) (ruff F401/F811)
---
 README.md               | 4 ++--
 integrations/webhook.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 236a14f..d63d836 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@
 </div>
 
 ```bash
-pip install cognis-c2detect
+pip install "git+https://github.com/cognis-digital/c2detect.git"
 c2detect scan .            # → prioritized findings in seconds
 ```
 
@@ -51,7 +51,7 @@ C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel 
 ## Quick start
 
 ```bash
-pip install cognis-c2detect
+pip install "git+https://github.com/cognis-digital/c2detect.git"
 c2detect --version
 c2detect scan .                       # scan current project
 c2detect scan . --format json         # machine-readable
diff --git a/integrations/webhook.py b/integrations/webhook.py
index 91e0211..9bf7258 100644
--- a/integrations/webhook.py
+++ b/integrations/webhook.py
@@ -5,7 +5,7 @@
 Usage:  <tool> scan . --format json | python integrations/webhook.py --url URL
 """
 from __future__ import annotations
-import argparse, json, sys, urllib.request
+import argparse, sys, urllib.request
 
 def main() -> int:
     ap = argparse.ArgumentParser()

From 6e41c039c561246375bd8233f2bad3a331e3a4c2 Mon Sep 17 00:00:00 2001
From: Cognis Digital <engineering@cognisdigital.com>
Date: Sat, 13 Jun 2026 09:29:41 -0400
Subject: [PATCH 2/2] docs: add Domains section (suite taxonomy + JTF MERIDIAN
 mapping)

---
 README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/README.md b/README.md
index d63d836..2598cff 100644
--- a/README.md
+++ b/README.md
@@ -228,6 +228,16 @@ Pipes into your stack: **SARIF** for code-scanning, **JSON** for anything, an **
 <div align="right"><a href="#top">↑ back to top</a></div>
 
 <a name="install-anywhere"></a>
+<!-- cognis:domains:start -->
+## Domains
+
+**Primary domain:** Cyber & Security  ·  **JTF MERIDIAN division:** NULLBYTE · SPECTER
+
+**Topics:** `cognis` `security` `infosec` `cybersecurity` `blue-team`
+
+Part of the **Cognis Neural Suite** — 300+ source-available tools organized across 12 domains under the JTF MERIDIAN command structure. See the [suite on GitHub](https://github.com/cognis-digital) and [jtf-meridian](https://github.com/cognis-digital/jtf-meridian) for how the pieces fit together.
+<!-- cognis:domains:end -->
+
 ## Install — every way, every platform
 
 ```bash