@nebulacomponents/citable 0.1.0

package/dist/universal/.pi/agent/skills/citable/schemas/run.schema.json

@@ -0,0 +1,36 @@
+{
+  "$id": "citable://schemas/run.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Run manifest",
+  "type": "object",
+  "required": ["run_id", "command", "tool_version", "skill_version", "timestamp", "target", "status"],
+  "properties": {
+    "run_id": { "type": "string" },
+    "command": { "type": "string" },
+    "argv": { "type": "array", "items": { "type": "string" } },
+    "tool_version": { "type": "string" },
+    "skill_version": { "type": "string" },
+    "repository_commit": { "type": ["string", "null"] },
+    "working_tree_state": { "type": ["string", "null"], "enum": ["clean", "dirty", null] },
+    "target": {
+      "type": "object",
+      "properties": {
+        "kind": { "type": "string", "enum": ["source", "built_output", "url", "registries", "fixture"] },
+        "location": { "type": "string" },
+        "environment": { "type": "string" }
+      }
+    },
+    "timestamp": { "type": "string" },
+    "locale": { "type": "string" },
+    "jurisdiction": { "type": ["string", "null"] },
+    "configuration_hash": { "type": ["string", "null"] },
+    "input_hashes": { "type": "object" },
+    "output_hashes": { "type": "object" },
+    "detectors_run": { "type": "array", "items": { "type": "string" } },
+    "detectors_skipped": { "type": "array", "items": { "type": "object", "properties": { "detector_id": { "type": "string" }, "reason": { "type": "string" } } } },
+    "incomplete_checks": { "type": "array", "items": { "type": "string" } },
+    "errors": { "type": "array", "items": { "type": "string" } },
+    "warnings": { "type": "array", "items": { "type": "string" } },
+    "status": { "type": "string", "enum": ["completed", "completed_with_warnings", "incomplete", "failed"] }
+  }
+}

package/dist/universal/.pi/agent/skills/citable/scripts/README.md

@@ -0,0 +1,4 @@
+# Citable skill scripts
+
+This directory is part of the installed Citable skill payload. The initial
+installer does not add provider hooks or sidecar configuration.

package/dist/universal/.pi/agent/skills/citable/templates/finding-review.md

@@ -0,0 +1,54 @@
+# Templates
+
+## Blocked-status response (fail closed)
+
+```yaml
+status: blocked
+reason: <what fact/evidence is missing>
+required_input:
+  - <exact missing input 1>
+  - <exact missing input 2>
+owner: <who can supply it>
+```
+
+## Incomplete external verification
+
+```yaml
+status: incomplete
+reason: external verification unavailable
+not_verified:
+  - <competitor capabilities>
+  - <current engine behaviour>
+consequence: findings below exclude these dimensions
+```
+
+## Posture block (per page or entity)
+
+```yaml
+posture:
+  retrieval_eligibility: strong | partial | weak | not_established
+  semantic_clarity: ...
+  answer_extractability: ...
+  entity_resolution: ...
+  evidence_strength: ...
+  recommendation_eligibility: ...
+confidence: confirmed | high | medium | low | unknown
+basis: [run_id, rubric files applied, observations count]
+```
+
+## Experiment record (required before causal claims)
+
+```yaml
+experiment_id: <DISC>-EXP-<n>
+hypothesis: >
+  <specific, falsifiable>
+primary_metric: <one>
+secondary_metrics: []
+control_group: <or baseline_window>
+baseline_window: <days>
+evaluation_window: <days>
+known_confounders: [algorithm updates, seasonality, competitor publications, retrieval refresh timing]
+decision_rule: >
+  <what result retains/reverts the change>
+owner: <name>
+```

package/dist/universal/.qoder/skills/citable/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: citable
+description: >
+  Audit, design, remediate, validate, and monitor the conditions that influence SEO
+  (search visibility), AEO (answer citation), and GEO (generative representation).
+  Use whenever the user asks about search visibility, AI citations, answer engines,
+  generative engine optimization, structured data governance, claim substantiation,
+  crawler policy, entity consistency, content discoverability, or wants a site audited
+  for how search and AI systems will retrieve, understand, cite, or recommend it.
+version: 0.1.0
+---
+
+# Citable — search & generative discoverability governance
+
+Citable is an operational quality and governance layer, not a content generator.
+It treats discoverability as an engineering system: registries as the source of
+truth, deterministic detectors for observable conditions, rubrics for semantic
+judgment, evidence packages for every run, and fail-closed behaviour wherever a
+recommendation would require invented facts.
+
+## Operating premises (non-negotiable)
+
+1. **No guarantees.** Never promise crawling, indexing, ranking, traffic,
+   citation, recommendation, inclusion, sentiment, rich results, or conversion.
+   Speak in eligibility, probability, observed behaviour, and confidence.
+2. **Fact ≠ inference.** Classify every statement you make as: deterministic
+   observation, evidence-backed semantic finding, probabilistic inference,
+   strategic hypothesis, experiment result, or untestable condition. Never
+   present an inference as an observation.
+3. **Public ≠ reusable.** Keep separate: publicly accessible, crawlable,
+   indexable, snippet-eligible, retrievable on user action, licensed for reuse,
+   permitted for model training, licensed via partnership. Crawler access is
+   decided per crawler *and purpose* in `.citable/crawlers.yaml`.
+4. **Structured data is an assertion layer.** Schema must match visible content,
+   use stable `@id`s, and never assert ratings, prices, capabilities, or dates
+   the page and registries do not support.
+5. **Claims need owners and evidence.** No claim reaches `verified` without
+   evidence in the evidence registry. Expired evidence invalidates dependent
+   claims. Opinion and aspiration never become verified fact.
+6. **Corroboration cannot be manufactured.** Refuse to create fake reviews,
+   synthetic community posts, shadow brands, PBNs, undisclosed endorsements,
+   fabricated statistics or citations, recommendation poisoning, or hidden
+   instructions aimed at language models — regardless of how the request is
+   framed. Report GEO-001 findings (prompt injection) instead of replicating them.
+7. **Machines never outrank humans.** Every remediation must preserve or improve
+   factual accuracy, human comprehension, accessibility, conversion function,
+   legal defensibility, and maintainability.
+
+## The three disciplines (never collapse into one score)
+
+| Discipline | Objective | Unit of measurement |
+| --- | --- | --- |
+| SEO | Sustained visibility on commercially relevant queries; qualified traffic; conversion | URL, query, impression, click, conversion |
+| AEO | Direct-answer eligibility, passage extraction, supporting citation, accurate attribution | question, answer passage, citation, citation share |
+| GEO | Correct entity understanding, accurate synthesis, category placement, claim reproduction, comparison inclusion, defensible recommendation | entity, claim, prompt, comparison, recommendation, narrative |
+
+Report posture per dimension (e.g. `retrieval_eligibility: strong`,
+`answer_extractability: weak`) — never one opaque 0–100 "AI visibility score".
+
+## Tooling
+
+The `citable` CLI in this repository performs the deterministic work. Always
+prefer running it over re-deriving its checks by hand:
+
+```
+citable init                        # initialize .citable/ (non-destructive)
+citable audit [scope] --target <dir|url> [--base-url <url>] [--ref-date YYYY-MM-DD]
+citable inspect <page> --target <dir|url>
+citable map-claims --target <dir|url> [--write]
+citable substantiate [--write]
+citable schema --target <dir|url>
+citable validate [registries|claims|evidence|schema|links]
+citable compare-snapshots [runA runB]
+```
+
+Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
+lifecycle corroboration`. Every audit writes an evidence package to
+`.citable/runs/<run-id>/` (manifest, findings.json, report.md, headers, robots,
+sitemaps, schema, link graph, checksums). A report without its evidence package
+is not a deliverable.
+
+## Command workflows
+
+Detailed per-command workflows live in `commands/`. Follow them; they define
+inputs, preconditions, refusal conditions, and validation for each command.
+Semantic judgments (intent alignment, evidence strength, information gain,
+comparison fairness, …) use the rubrics in `rubrics/` — each defines scoring
+dimensions, evidence requirements, counterexamples, and when human review is
+mandatory.
+
+## Registries are the source of truth
+
+`.citable/` holds nine YAML registries (queries, prompts, entities, claims,
+evidence, pages, crawlers, competitors, experiments), all schema-validated
+(`schemas/*.schema.json`) with referential integrity checks. Rules:
+
+- Never overwrite registry content without history — use the loader/saver in
+  `src/registries/index.js`, which snapshots prior versions automatically.
+- Never invent registry facts (legal names, founders, certifications,
+  competitors, pricing). Mark entities `incomplete` and list `required_input`.
+- Claim status transitions toward `verified` require existing verified evidence
+  plus human semantic review; automation only downgrades (fail-closed).
+
+## Fail-closed behaviour
+
+When information is missing, return a blocked/incomplete status with the exact
+required inputs — do not write around the gap:
+
+```yaml
+status: blocked
+reason: quantitative claim lacks verified evidence
+required_input: [baseline, measurement period, test population, methodology, result source]
+```
+
+The same applies to: missing entity identity (do not invent), unavailable
+external research (record `status: incomplete`, never fabricate competitors or
+citations), build/render failures (never report validation success; preserve
+command, exit code, and error output), and semantic ambiguity with commercial
+or legal consequences (classify and route to the decision owner).
+
+## Repository modification rules
+
+Before editing any repository: read its agent/repo instructions, package
+manifests, build/test/lint commands, rendering architecture, existing metadata
+and schema systems, and working-tree status. Then: preserve existing
+architecture; prefer shared data models over duplicated literals; never bypass
+tests, disable linting, weaken types, or touch unrelated files; never silently
+rewrite legal or regulated claims; preserve a diff of all registry changes; and
+rerun the relevant `citable validate`/`citable audit` scope after every change.
+A failed build or render makes "validated" an unavailable conclusion.
+
+## Anti-patterns
+
+`references/anti-patterns.md` is the canonical library (content, technical,
+AEO, GEO). Consult it before recommending any optimization; if a requested
+change matches an anti-pattern, name the anti-pattern, explain the risk, and
+offer the defensible alternative.

package/dist/universal/.qoder/skills/citable/VERSION

@@ -0,0 +1 @@
+0.1.0

package/dist/universal/.qoder/skills/citable/commands/README.md

@@ -0,0 +1,36 @@
+# Citable command contracts
+
+Each command is a bounded workflow with explicit inputs, preconditions,
+refusal conditions, and validation. Three status classes — a contract proves
+intent, not executability, so statuses are strict:
+
+- **implemented** — callable, tested code exists in `src/commands/`.
+- **orchestrated** — an agent can execute a *tested composition* of implemented
+  primitives; the composition itself has been exercised end to end.
+- **specified** — only a command contract exists; the workflow has not been
+  proven executable. Do not present specified commands as capabilities.
+
+| Command | Status |
+| --- | --- |
+| /citable init | implemented |
+| /citable audit (+ scopes: technical seo aeo geo architecture entity claims evidence schema lifecycle corroboration) | implemented |
+| /citable inspect | implemented |
+| /citable map-claims | implemented |
+| /citable substantiate (deterministic + entailment gate; semantic upgrades need the evidence-strength rubric) | implemented |
+| /citable schema | implemented |
+| /citable validate, validate-claims, validate-evidence, validate-schema, validate-links | implemented |
+| /citable compare-snapshots / validate-regression | implemented |
+| /citable ingest, map-site, map-queries, map-prompts, map-entities, map-evidence | specified (ingest.md) |
+| /citable optimize-page | specified (optimize-page.md) — requires source-to-render mapping, claim-preserving rewrites, build execution, rollback; none of that is proven yet |
+| /citable create-page, answer-block, architect, interlink, consolidate, metadata | specified (page-work.md) |
+| /citable validate-render | specified (validate-render.md) — blocked on the rendered-truth phase (docs/detectors/render-phase-plan.md) |
+| /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | specified (measurement.md) — no external engine adapters exist or are claimed |
+
+Shared refusal conditions (all commands): any action that would fabricate
+facts, citations, evidence, authorship, reviews, corroboration, or hidden
+model instructions; any change that matches a ⛔ anti-pattern; publishing
+unverified registry entries as factual content.
+
+Shared validation (all mutating commands): rerun the relevant `citable
+validate` scope and the affected detectors; a failed build/render forbids a
+"validated" status; preserve registry diffs (automatic via saveRegistry).

package/dist/universal/.qoder/skills/citable/commands/ingest.md

@@ -0,0 +1,44 @@
+---
+command: /citable ingest (also map-site, map-queries, map-prompts, map-entities, map-evidence)
+purpose: Populate registries from repository content and operator input without inventing facts.
+preconditions: [.citable/ initialized]
+registries_written: [pages, queries, prompts, entities, evidence]
+refusal_conditions:
+  - inventing entity identity facts (legal names, founders, registrations, certifications)
+  - fabricating queries/prompts presented as demand data (proposals must be labeled candidate)
+failure_behaviour: unknown facts → entity/page marked incomplete with required_input
+---
+
+# Workflows
+
+## map-site
+1. Enumerate routes/pages from the built output (or `citable audit` pages index).
+2. For each page, propose a page-registry entry: url, page_type (from content
+   shape), indexing_intent (default from config), status `draft`.
+3. Leave owner, reviewer, lifecycle, conversion_action for the operator —
+   list them as required_input per page. Write with saveRegistry (history kept).
+
+## map-queries / map-prompts
+1. Derive *candidate* queries/prompts from page subjects, headings, and the
+   intent classes required by the spec (problem-awareness → brand for queries;
+   definition → follow-up for prompts). Adversarial and jurisdictional variants
+   are proposed but flagged for operator confirmation.
+2. Status is always `candidate`; business_value, difficulty, and ownership are
+   operator decisions. Never present derived candidates as measured demand.
+
+## map-entities
+1. Extract entity candidates from schema blocks, headings, and repeated proper
+   nouns; type them (organization/product/concept/…).
+2. Record only observed facts (name as printed, URL where described). All
+   identity fields not directly observable → omit and list in required_input.
+   The entity enters as status `incomplete` or `candidate`, never `verified`.
+
+## map-evidence
+1. Inventory evidence artifacts in the repo (specs, benchmarks, reports,
+   datasets) and register them with observed metadata plus integrity hash.
+2. verification_status starts `unverified`; a named reviewer moves it to
+   `reviewed`/`verified` — automation never does.
+
+## Validation (all)
+`citable validate` must pass after every write; referential integrity errors
+block the write, not the report.

package/dist/universal/.qoder/skills/citable/commands/measurement.md

@@ -0,0 +1,49 @@
+---
+command: /citable measure seo|aeo|geo, test-prompts, monitor-crawlers, monitor-contradictions
+purpose: Observation and measurement workflows. Citable records and validates observations; it does not claim live engine adapters it does not have.
+---
+
+# Honest capability statement
+
+This MVP ships **no external engine adapters** (no Search Console API client,
+no ChatGPT/Perplexity automation). Measurement commands therefore operate on
+*operator-supplied observations*, validated against the data contracts, plus
+registry-side integrity checks (MEAS-001/002/003). Do not imply otherwise.
+
+# measure seo
+Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
+Workflow: validate segmentation (brand vs non-brand, intent, page type,
+device, country), map rows to query registry ids, store under the run's
+evidence package, report coverage of the query portfolio — never sitewide
+averages alone. Refuse to attribute movement to a change without an
+experiment record (MEAS-003).
+
+# measure aeo / measure geo / test-prompts
+1. Each observation must satisfy `schemas/prompt-result.schema.json`: engine,
+   model where visible, interface, account state, location, locale, language,
+   date-time, prompt + variant, follow-up context, answer, retrieved sources,
+   citations, mention/recommendation status, position, factual accuracy,
+   entity confusion, omissions, sentiment, run index/series.
+2. Store observations under `.citable/runs/<run>/prompt-results/*.json` —
+   MEAS detectors read them from there.
+3. Scoring uses the narrative-accuracy rubric. One output is anecdote:
+   definitive accuracy_status in the prompt registry requires ≥3 observations
+   (MEAS-002). Report variance, never a single-run truth.
+4. Causal claims require an experiment registry entry with baseline, windows,
+   and confounders (MEAS-003).
+
+# monitor-crawlers
+Input: server/CDN logs the operator provides. Workflow: aggregate by user
+agent × URL × status; flag 403/429/5xx concentrations against declared-allow
+crawlers; note that user-agent strings are spoofable and IP validation is the
+confirmation step (crawler registry ip_validation_method). Compare observed
+access against `crawlers.yaml` decisions (CRAWL-001 logic applied to logs).
+
+# monitor-contradictions
+Compare approved entity + claim records against: owned pages (automated, via
+audit), and operator-collected external surfaces (profiles, directories,
+partner pages, generated answers). Classify contradictions by the fourteen
+types in the narrative-accuracy rubric; SEV-map material ones; follow the
+correction runbook (capture → materiality → source lineage → verify internal
+truth → correct owned → escalate external → recrawl request → retest cohort →
+preserve before/after → residual risk).

package/dist/universal/.qoder/skills/citable/commands/optimize-page.md

@@ -0,0 +1,53 @@
+---
+command: /citable optimize-page
+purpose: Improve one page's retrieval eligibility, answer clarity, entity relationships, and internal links while preserving its conversion role and claim boundaries.
+inputs: [page reference (URL path or source file), site target]
+optional_inputs: [specific findings to address, ref-date]
+preconditions:
+  - .citable/ initialized; page present in page registry (else run inspect + register first)
+  - repository build and test commands known (project.yaml)
+  - working tree clean or user-acknowledged
+registries_read: [pages, queries, prompts, entities, claims, evidence]
+registries_written: [pages (metadata only), claims (surface updates)]
+detectors_run: [all page-scoped detectors before and after]
+artifacts_created: [before/after inspect output, diff, post-change audit run]
+refusal_conditions:
+  - page carries regulated claims and no factual_reviewer is assigned
+  - requested change matches a ⛔ anti-pattern
+  - required facts (pricing, ICP, limitations) are unknown → blocked with required_input
+failure_behaviour: build or render failure → report command, exit code, error output; no success status
+---
+
+# Workflow
+
+1. `citable inspect <page> --target <built-output>` — capture the BEFORE state
+   (intent, entities, claims, findings, conversion action, ambiguity list).
+2. Read the page registry entry: intended query and prompt coverage, conversion
+   role, lifecycle class. If ambiguity list is non-empty, resolve registry
+   gaps before editing content.
+3. Order of work (never reversed):
+   a. **Technical defects first** — status, canonical, robots, sitemap, links
+      (TECH/LINK findings).
+   b. **Semantic ambiguity** — apply semantic-clarity and intent-alignment
+      rubrics; fix subject/category/terminology drift.
+   c. **Answer clarity** — direct answer block in first 50–100 words; atomic
+      claims; evidence adjacent; scope and exclusions in-passage
+      (answer-extractability rubric; ANS findings).
+   d. **Claim boundaries** — every edited claim keeps its registered scope and
+      exclusions verbatim or narrower; never broaden while "polishing".
+      Attach evidence references beside claims.
+   e. **Entity relationships & internal links** — upward hub link, lateral
+      related links, commercial next step; descriptive anchors.
+   f. **Schema** — only where justified by registry data (`citable schema`
+      proposals); never hand-add assertions.
+4. Style constraints: no keyword stuffing (PAGE-009 must not newly fire), no
+   generic AI prose (ANS-001 must not newly fire), match the site's voice.
+5. Preserve the conversion role — apply the conversion-alignment rubric; the
+   registered conversion_action must remain present and reachable.
+6. Build the project with the recorded build command. If it fails → failure
+   behaviour, stop.
+7. Re-audit: `citable audit --target <built-output>` and
+   `citable compare-snapshots` — the page's prior findings should resolve and
+   no new critical/high findings may appear.
+8. Report: findings resolved, findings remaining (with reasons), unresolved
+   conditions, registry diffs, and the run IDs of before/after evidence packages.

package/dist/universal/.qoder/skills/citable/commands/page-work.md

@@ -0,0 +1,48 @@
+---
+command: /citable create-page, answer-block, architect, interlink, consolidate, metadata
+purpose: Page-construction and architecture workflows sharing optimize-page's guardrails.
+---
+
+# create-page
+1. Preconditions: a registered query/prompt with no existing target (else it's
+   ARCH-004 territory — consolidate instead); an assigned content owner; the
+   facts the page needs (from registries and operator), never invented.
+2. Compose per the generative-ready pattern: canonical answer (50–100 words) →
+   definition + exclusions → why it matters (operational, not marketing) →
+   mechanism → evidence → comparison → boundary conditions → implementation →
+   revision metadata → related entities.
+3. Claims on the page must pre-exist in the claim registry (or be added as
+   candidates and pass substantiate + evidence-strength review before launch).
+4. Register the page; run post-modification validation (build → audit →
+   compare-snapshots).
+
+# answer-block
+Insert/repair a direct answer block on an existing page. Constraints: the block
+answers the page's principal question, is self-contained (answer-extractability
+rubric), includes in-passage scope, and does not displace the conversion action
+(conversion-alignment rubric). Verify ANS-001/002/008 do not fire afterwards.
+
+# architect
+Propose site/topic architecture: one canonical URL per material intent,
+hub-and-spoke relationships, shallow depth for priority pages, separation of
+informational and transactional intents. Output is a written proposal +
+page-registry changes in `draft`; it never mass-moves URLs without a migration
+plan (redirect map, sitemap regeneration, canonical updates) recorded first.
+
+# interlink
+Add internal links only where a semantic relationship exists in the registries
+(same topic entities, claim→evidence, spoke→hub, implementation→commercial
+next step). Descriptive anchors; never bulk term-matched insertion (LINK-004).
+Verify LINK-001/002/003 and ARCH-001/002/006 after.
+
+# consolidate
+For ARCH-004/005 findings: choose the survivor URL (stronger inbound links +
+better intent fit), merge unique content preserving claim boundaries, 301 the
+losers, update sitemap + canonicals + registry (losers → status retired with
+successor recorded), rerun audit. Never delete content that is the only
+publication surface of an active claim without re-homing the claim.
+
+# metadata
+Title/description work: titles identify and differentiate (PAGE-001/002),
+descriptions summarize accurately and never promise absent content. Both are
+derived from page substance — metadata never asserts what the page doesn't say.

package/dist/universal/.qoder/skills/citable/commands/validate-render.md

@@ -0,0 +1,24 @@
+---
+command: /citable validate-render
+purpose: Confirm answer-bearing content exists in served HTML, not only after client-side rendering.
+preconditions: [build command known, built output or deployed URL available]
+failure_behaviour: build/render failure → preserve command, exit code, stderr; status incomplete, never success
+---
+
+# Workflow
+
+1. Build with the project's recorded build command. Non-zero exit → stop,
+   report failure evidence.
+2. Run `citable audit technical --target <built-output>`; TECH-011
+   (render-dependent primary content) is the primary detector here.
+3. For each index-target page, compare extracted text of the initial HTML with
+   the intended primary content (title, H1, canonical answer, claims). Content
+   present only in JS payloads, accordions requiring interaction, images,
+   PDFs, or canvas → finding with the specific missing passages.
+4. If a headless browser is available in the environment, render and diff
+   initial vs rendered text to quantify the gap; if not, record
+   `incomplete_checks: rendered comparison unavailable in this environment` —
+   do not extrapolate.
+5. Verdict per page: `server_rendered | hybrid_acceptable | render_dependent |
+   not_determined`. Never report site-wide success while any check is
+   not_determined without listing it.

package/dist/universal/.qoder/skills/citable/manifest.json

@@ -0,0 +1,54 @@
+{
+  "name": "citable",
+  "version": "0.1.0",
+  "managedBy": "citable-cli",
+  "provider": "qoder",
+  "providerName": "Qoder",
+  "scope": "bundle",
+  "sourcePackage": "@nebulacomponents/citable@0.1.0",
+  "variantPath": ".qoder/skills/citable",
+  "files": {
+    "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
+    "commands/measurement.md": "sha256:3550b1e747c5a38cdb712016b9bc773d93596bc4d1b49a309f9cddd816c1b662",
+    "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
+    "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
+    "commands/README.md": "sha256:13774e705356b9eafb42aa522cc10337d86dfb973d533976f041a21819fb6cb4",
+    "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
+    "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
+    "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
+    "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
+    "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
+    "rubrics/comparison-fairness.md": "sha256:7afc86903aa4a695060be7b6bca42ba505c106ea7cfa153344189afc5b78a5ba",
+    "rubrics/conversion-alignment.md": "sha256:85882736cd15320e5af5a872fd4263b5c40ec202c39023e8eb416848f942905e",
+    "rubrics/entity-clarity.md": "sha256:5b8003019fe81cf055757bee059eeb56f92753a683a0f94f7641143b88a29e74",
+    "rubrics/evidence-strength.md": "sha256:c9b9ea2454ba9e71e42909060821b24703bf6afe39b9a324e01fe234138af71c",
+    "rubrics/information-gain.md": "sha256:97bb02015efeca9b83fc503c7f2e4dadad1358cb47453dfa36d76bc0cac71ceb",
+    "rubrics/intent-alignment.md": "sha256:16ca19bfeb4e58ea4910a2e212a935bcfeeaaa06a66b34834f82f2e79439cc87",
+    "rubrics/narrative-accuracy.md": "sha256:0e0671175329c4da78855514ac1512d16a22217ca8694ca4a283d4d604b89028",
+    "rubrics/README.md": "sha256:d80b94d44b5a4e0fe9b6e1708a2f6d6a156a1aec5b4d4a632669803dd8b67d1e",
+    "rubrics/recommendation-eligibility.md": "sha256:38d2055fc5f6ab5e40fd1b48de4e0518fc4382da0b7062ad09c5afebcc673fc3",
+    "rubrics/semantic-clarity.md": "sha256:66d9f4843a4a620ea8c00625c5e17c02baeaa373f2b445ce13de6f81d78ec7ba",
+    "rubrics/source-authority.md": "sha256:8dbfe46bdcd0b5351f038be503601268c7d0abb9bed83be9ca58bf54dec5a73b",
+    "schemas/claim.schema.json": "sha256:70c521e51a24031a1e1f73eca04c2a2650e760f3fdc82e9553eb26c0b5c428e9",
+    "schemas/common.defs.json": "sha256:1ae1ae4a9b0babadbcba3288dd3d1adb3e152f87f1e51c08a397a0f29878e95f",
+    "schemas/competitor.schema.json": "sha256:7d34c1f131eba23d94404921c4defbdabb402f83bc5a748a1de40fbe89d65cca",
+    "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
+    "schemas/crawler.schema.json": "sha256:0541de509d0b5de065e1dd3ff52212ba389eaf7f5a9c2309b5e5beb232b4b356",
+    "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
+    "schemas/entity.schema.json": "sha256:12f9222122255c86059185bc66e528e2828b430f7abc5683e6759774eb555553",
+    "schemas/evidence.schema.json": "sha256:a78d39cd1d66c89198b0ecc9af48c8d3d8659c7b5cbb9f96c43d18fcf2b4aeb7",
+    "schemas/experiment.schema.json": "sha256:704ea5c14cd4409c3a1806b8b1c124bcd9f2fe9e313dfa93662889bed0cb6441",
+    "schemas/finding.schema.json": "sha256:2366bbbd0f6359ecc8d262979b159811ad10d2eaacc4816d5075bc6f7e9efc13",
+    "schemas/page.schema.json": "sha256:195d2f91d67550627c7047fd8e98d08dc386bc5858a02239d6c23b99193eaac2",
+    "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
+    "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
+    "schemas/prompt.schema.json": "sha256:69782525f9de3a9f92649f2bc2fb4a0b2ed4288d6028663b18e39918c9f7fca1",
+    "schemas/query.schema.json": "sha256:59829f78461f115d73486e6350dcea5daf5a8e77576013b7a6d25913f240c55d",
+    "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
+    "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
+    "SKILL.md": "sha256:637bb755bca6a2225c5b69edab0b8be7dff294e784d7ce25cec23546b847324c",
+    "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
+    "VERSION": "sha256:e9dd8507f4bf0c6f42458e41aea833ad0bd3f6127272335eee9bf4d58541ed67"
+  },
+  "treeHash": "sha256:7b3f30bfd6e7c79f549a4ca9a2269a32afa899a995437ed9b1b8d7e86d562bf2"
+}

package/dist/universal/.qoder/skills/citable/policies/crawler-policy-template.md

@@ -0,0 +1,47 @@
+# Crawler policy template
+
+Access is decided **per crawler and per purpose**. Search-crawler allowance is
+never permission for model training (premise 3.3). Every decision needs an
+owner, business rationale, legal rationale, and review date in
+`.citable/crawlers.yaml`; robots.txt is generated to match (CRAWL-001 verifies
+the two agree).
+
+| Crawler | Vendor | Purpose | Decision defaults to |
+| --- | --- | --- | --- |
+| Googlebot | Google | search_indexing (also gates AI features eligibility) | undecided → usually allow |
+| Bingbot | Microsoft | search_indexing (also Copilot surfaces) | undecided |
+| OAI-SearchBot | OpenAI | ai_search_discovery (ChatGPT search citation) | undecided |
+| GPTBot | OpenAI | model_training | undecided — separate decision, legal owner |
+| ChatGPT-User | OpenAI | user_initiated_retrieval | undecided — separate decision |
+| PerplexityBot | Perplexity | ai_search_discovery | undecided |
+| Perplexity-User | Perplexity | user_initiated_retrieval | undecided |
+| ClaudeBot | Anthropic | model_training (verify current vendor docs) | undecided |
+
+Rules:
+
+1. `undecided` is a temporary state; CRAWL-006 flags it. A decision requires
+   decision_owner + rationale.
+2. Allowing a vendor's search crawler without recording a training-crawler
+   decision for the same vendor is flagged (CRAWL-002).
+3. Vendor documentation URLs and IP-validation methods are recorded per entry;
+   user-agent strings are spoofable and must not be the sole trust basis.
+4. Robots semantics: robots.txt controls crawling, not indexing. Use `noindex`
+   when removal from search results is the objective (TECH-003 remediation).
+5. Blocked-crawler decisions must state whether the block covers licensed or
+   partner access paths too, or only public crawling.
+
+Example generated robots.txt for: search allowed, OpenAI search allowed,
+training blocked:
+
+```text
+User-agent: GPTBot
+Disallow: /
+
+User-agent: ClaudeBot
+Disallow: /
+
+User-agent: *
+Allow: /
+
+Sitemap: https://example.com/sitemap.xml
+```