@nebulacomponents/citable 1.12.0 → 1.13.0

package/dist/universal/.kiro/skills/citable/commands/field-validation.md

@@ -0,0 +1,71 @@
+# Field validation corpus
+
+Use this workflow to assemble, evaluate, and publish an acceptance corpus. A
+fixture-valid corpus is not field evidence. Do not describe a corpus as real,
+representative, accurate, or public until the corresponding records and reviews
+exist.
+
+## Preconditions
+
+For every property, record:
+
+- architecture and property class;
+- owner authorization for collection, retention, review, and the intended
+  publication level;
+- collection methods, authority labels, timestamps, and limitations;
+- unavailable evidence, intentional incompleteness, and contradictions;
+- publication approval, retention, and the exact artifact-reference allowlist;
+- human sanitization review covering personal data, credentials, and source
+  identifiers.
+
+Every execution must reference raw artifacts, deterministic and heuristic
+findings, reviewer assignments, disagreements, exceptions, interventions,
+verification, and its reproducibility receipt where available. Empty reference
+arrays are valid only where that class of evidence did not occur.
+
+## Evaluate
+
+```sh
+citable corpus evaluate --input acceptance-corpus.json
+```
+
+Evaluation validates the v2 contract and writes `accuracy-metrics.json` plus a
+human-readable `accuracy-metrics.md` projection from the same hash-bound data.
+Every reported metric discloses its numerator, denominator, population,
+exclusions, and confidence limits. Sample and census designs remain distinct,
+and detector versions are reported as separate cohorts. Evaluation does not
+authorize publication. Unknown false negatives remain unknown; discovered
+false-negative rates apply only to adjudicated expected detections in the
+disclosed population.
+
+## Publish
+
+```sh
+citable corpus publish \
+  --input acceptance-corpus.json \
+  --output public-corpus.json
+```
+
+Publication fails closed when any property is private or aggregate-only, owner
+authority is expired or incomplete, sanitization review is incomplete, an
+artifact reference is unsafe or outside the allowlist, sensitive patterns are
+detected, or the output already exists. It emits the public corpus, a hash-bound
+publisher-controlled receipt, and an immutable local evidence package.
+
+Automated checks supplement but do not replace human sanitization review. The
+receipt is owner-authorized publication evidence, not independent attestation.
+Never publish production credentials, customer data, private property artifacts,
+or evidence outside the exact approved scope.
+
+## Reproducibility
+
+Create one receipt per sealed acceptance run, then compare repeated envelopes:
+
+```sh
+citable corpus receipt --run <run-id> --input execution-context.json
+citable corpus compare-receipts <receipt-a.json> <receipt-b.json>
+```
+
+Treat fingerprint equality as bounded equality of declared inputs, methods,
+tools, external-system versions, and artifacts. It does not establish causation
+or performance on untested properties.

package/dist/universal/.kiro/skills/citable/commands/observe-and-act.md

@@ -14,6 +14,11 @@ failure_behaviour: unavailable dependency, credential, source run, reviewer, exa
   disclosure, inactive-tab, and load-more-like controls; it does not prove an
   application-specific journey. `--resume-run` reuses only successful profile
   observations from the named immutable run and recollects failed/absent ones.
+  `observe render --input <browser-evidence-plan.json>` executes an
+  explicit Chromium, Firefox, or WebKit profile matrix. Each plan records the
+  browser version, device, JavaScript, locale, consent, authentication state,
+  and ordered interaction steps. Fill/select values are referenced by
+  environment-variable name and are never written to the plan or artifacts.
 - `observe index --input <JSON>` imports owner exports. With `--target`,
   `--site-url`, and `GSC_ACCESS_TOKEN`, it calls Google URL Inspection, which
   reports the indexed version rather than performing a live indexability test.

package/dist/universal/.kiro/skills/citable/manifest.json

@@ -1,29 +1,31 @@
 {
   "name": "citable",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "managedBy": "citable-cli",
   "provider": "kiro",
   "providerName": "Kiro",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.12.0",
+  "sourcePackage": "@nebulacomponents/citable@1.13.0",
   "variantPath": ".kiro/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
+    "commands/artifact-interchange.md": "sha256:18d56fbfa6bb3f23f08593a9a8135e51c268618b049e53c793969b68000875c3",
     "commands/delivery.md": "sha256:3b29250f9e9f84442812e320a70d5d2784b4286e91af3866f99cb6062a85a10f",
+    "commands/field-validation.md": "sha256:4f24b2758eef746d704b218364f1e45ee9e07418c8ae111081b1fd41f93dde2d",
     "commands/governance.md": "sha256:1fd6272f18b00237fc6e602ac126ae812747937b2bb575068a0d617137eea2b0",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
     "commands/measurement.md": "sha256:9cade6dfec23338e18aa67ede3335ac9e2888dc577a7d4d8e3ceac948bce403f",
     "commands/media-evidence.md": "sha256:f2218feabe3360a2c9d569a5fa9b70d4b33a83a270d657151635e6f404fb34e0",
-    "commands/observe-and-act.md": "sha256:00b24966c537b2868e722a49fe49b79e73b60b2454ecdb13b1a34ff3475036ae",
+    "commands/observe-and-act.md": "sha256:3862708da9d787d61a9c7bc8639b2fb28bc021d5784e11f313b0e9ecdff261bc",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:ced929fc2ea3af9be2b87433b88a1add8d6e0938d59c5b3cd24340a7ccc6abdb",
+    "commands/README.md": "sha256:c27f69e0e33712e00f780c0988c7b033650c17d3450baea33f2b14212be8438e",
     "commands/reviews.md": "sha256:902904aaa405fe5724cf0662c7a5a36eab9a4fe0eb81cbd95ffa2fff946e0ac8",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
-    "references/aeo-geo-validation.md": "sha256:47a33e717994191069ce96871e62e9bd6f9db32e8121c8784793ed1a58a1f245",
+    "references/aeo-geo-validation.md": "sha256:4b0041764f2fdbfbff1e1a2907eaed02cf0aef491254a9c98ec9250ff1084e80",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
-    "references/capability-boundaries.md": "sha256:66d6860a6893a1613d4416b2185c48308457bf006bb943817623fd1bd700d9a8",
+    "references/capability-boundaries.md": "sha256:4901a32efbe747c8fed54ed1bffe345603c03a1bf5906b7f6da91395720f00e0",
     "references/evidence-authority.md": "sha256:b81ee09953999f16b19dc0eaba6fffe794b58d152e2adbd95c3179730bc08ffc",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
@@ -38,43 +40,61 @@
     "rubrics/recommendation-eligibility.md": "sha256:38d2055fc5f6ab5e40fd1b48de4e0518fc4382da0b7062ad09c5afebcc673fc3",
     "rubrics/semantic-clarity.md": "sha256:66d9f4843a4a620ea8c00625c5e17c02baeaa373f2b445ce13de6f81d78ec7ba",
     "rubrics/source-authority.md": "sha256:8dbfe46bdcd0b5351f038be503601268c7d0abb9bed83be9ca58bf54dec5a73b",
+    "schemas/acceptance-corpus.schema.json": "sha256:b703be371ee33747d83814e448d18cd01f103f1832480a95df4331b86982165d",
+    "schemas/acceptance-run-context.schema.json": "sha256:56d75c7bcd166c3578a71699df1aa5466327c23c1e06e33773f2493f5caa1a50",
+    "schemas/acceptance-run-receipt.schema.json": "sha256:6c6e66767cf3b9adb42ace087f7e9a428312f41b7ecbaf533fc8d7ba5953da44",
     "schemas/action-plan.schema.json": "sha256:4b6c4c877840a065c7c0c0c7b52f696502bf3d4ca6d31179622fc364ea868d5e",
+    "schemas/artifact-interchange.schema.json": "sha256:c6f628934c8a1b8ea2996e03c2c5abd46c2a0e74c680b0a43e44c2343dc9aa21",
+    "schemas/assumption.schema.json": "sha256:31a0f44bbf1d207e013961ec4c39eea85c3ae9efde1485b5e26084562c816844",
     "schemas/bing-webmaster.schema.json": "sha256:8357c518a8cb4ccd1def2da38950fbba68270e2b1613ad522b50c568a3b8538f",
+    "schemas/browser-evidence-plan.schema.json": "sha256:f2c1a3fe05cdaf72a41c0a3d548ccf5bdf247dbe71b546759b15277df0e723ba",
     "schemas/claim.schema.json": "sha256:ce79ccbfa34ece9b7a309a6962522ea06a1f44c468b4c472b5c376554a788537",
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
     "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
+    "schemas/corpus-publication-receipt.schema.json": "sha256:a4d523fd1c1fa53762522891c06c06edb668cd15e1de3c7123d2b9948445ae32",
     "schemas/crawler-identity.schema.json": "sha256:e1e3e6da203a8bc49fba8f9bbde525368891db022d542fc615b677401825351d",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
+    "schemas/customer-outcome.schema.json": "sha256:c0cdfee31a692feadb31dc6be734d45ae178ee53f28349c2a9e7504bdfcf9e50",
+    "schemas/decision.schema.json": "sha256:7c30f3ad83a6aa0b67ecc51ac6691e5e041b633d01bab17cee2b5218d926204e",
+    "schemas/deployment-receipt.schema.json": "sha256:789455907e7f3039fd55ee5b2568e09871128f513f5ddfe1f3afac1a4dd6b2bd",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
     "schemas/evidence-authority.schema.json": "sha256:4f8165a37304ebab019e1c2dfec13f1168ecf89ce9bec88f7dca9c8554e39ac0",
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/exception.schema.json": "sha256:c88985494ec66554330fdc5b65d033527d0005acf41f10798b1e831d171f8944",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
+    "schemas/field-validation-metrics.schema.json": "sha256:bd5daeafc1593f1c4707d75180e1feb1e81d9345a57c1f269eadf13c36cb7012",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
+    "schemas/initiative.schema.json": "sha256:491f6cc022c7ac1f9ea9ac9ddfcd270cb49c390e2601fe1e73aa6192a9e7689a",
     "schemas/intervention.schema.json": "sha256:fcf28e117b207e64ffc96088aa70a95370841a2a9fa43ecb1c82b34c2058a818",
+    "schemas/kpi.schema.json": "sha256:a45e2178ac03a97692b2c1dd667abde6b25b936c73ba0c32e4e98becb3d9d1c2",
     "schemas/media-manifest.schema.json": "sha256:3f37301aab9e913fa7febb15c720ed6384b106f12cef8d26cdd12d93fd85b41f",
     "schemas/metric.schema.json": "sha256:2ada648e7274a8d78cc9d6e7ed616f91faa79cf9ed07613e2c1fc53b247aac8d",
     "schemas/objective.schema.json": "sha256:94404dc95d04a6641ea7b9654317d0222793251ad44d3dfd2875738622a36025",
-    "schemas/observation.schema.json": "sha256:eebb7deb445b9de8c2ffa603fce441f9a857ce290602d8828915fb630b566693",
+    "schemas/observation.schema.json": "sha256:b572ae8ba3d175509cc9fae914d8d054c0fb84ebcaf81de981532b527064538d",
     "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
+    "schemas/release-manifest.schema.json": "sha256:962be645e790b5f3dc6f6ea455e187492d727dcb91d00f91e4e25b40e2dbc360",
+    "schemas/release-state.schema.json": "sha256:9920f68e538915d0d07044f313a9e410775a38ce9bb46a55d9ebe02970784803",
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/review-item.schema.json": "sha256:df532a70385d5031bbc18654f3ccb436dc6e8d402ccf987e58f8f7e3ad2fb3f1",
     "schemas/review-policy.schema.json": "sha256:b2d176b1886f78c384b25532a0c3eb18548dfbd17f362a305e622bab562a1d04",
     "schemas/reviewer.schema.json": "sha256:3716697b752575a1277f2c2b318b1f2565de02bf9dce2a0c165567ab5330d18b",
+    "schemas/risk.schema.json": "sha256:ea3ca47a8457d98ea65df78e07ba6c20479906e8a3df07a6fa4be5644828fc49",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "schemas/sampling-plan.schema.json": "sha256:005f70f149baaacd7de698548d556d3e401c630978748271b0e14a74726dd413",
+    "schemas/scenario.schema.json": "sha256:3f5bc2032d08f973600db068f475176a0e4706b33be42f99c778fe755a0ff38b",
     "schemas/schedule.schema.json": "sha256:0f02174ab0fc7bbbce9759fd358b18ed97cc683c76933fd3001cf053c499b157",
+    "schemas/variance.schema.json": "sha256:68389f64f0a3be13ff8951e8eefba9a5c31d0738325cb47e37c1a8435bea48f0",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:b5607872edd36746674f596db543f02004d30c98d4c15b745bfdc42afa77be8d",
+    "SKILL.md": "sha256:ac5817aa956c0d845ab4cc3adcc07b8bd814f924883b9c1178cbe745333616d1",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:c92df6bdde330be219d62f48ec6490b01889436f2f59027aab200e74de619168"
+    "VERSION": "sha256:b4a9545a385e9701482be56a0efee678d467d9c586ec476f2c5986cfaa24e96c"
   },
-  "treeHash": "sha256:bf020f14e20b04db5037c18aa9bcbfa6ac5e39522681be610676de380ab7eeec"
+  "treeHash": "sha256:8c0cfbcf3b6ed8a20ec337f655a3ee299f3f7cfd837bad5f7beb8627f3954242"
 }

package/dist/universal/.kiro/skills/citable/references/aeo-geo-validation.md

@@ -9,7 +9,7 @@ not a prediction of citation or recommendation. Report every row as
 | State | Current evidence boundary |
 | --- | --- |
 | Retrieval eligibility | Static policy plus captured synthetic HTTP response; crawler identity remains simulated unless verified logs/IP evidence are supplied |
-| Source extraction and support suitability | Initial HTML plus registries/detectors/rubrics; optional Chromium profiles can establish bounded raw/desktop/mobile/JavaScript-disabled parity, while cross-browser and application-specific journeys remain unproven |
+| Source extraction and support suitability | Initial HTML plus registries/detectors/rubrics; optional fixed Chromium profiles and explicit Chromium/Firefox/WebKit journey plans establish bounded artifact-level parity, while semantic impact remains unproven |
 | Observed citation behavior | Operator-supplied prompt-result observations only; report cohort size and property citation presence, never infer from readiness |
 
 ## AEO checks

package/dist/universal/.kiro/skills/citable/references/capability-boundaries.md

@@ -10,6 +10,7 @@ Use the narrowest supported state. Never promote evidence across rows.
 | Observed in production logs | Imported evidence | Timestamped `observe logs` artifact with URL, status, bytes, latency, cache result, UA, and verification result |
 | Indexed | Google API or imported evidence | `observe index`; Google inspection covers the indexed version, other engines require owner exports |
 | Rendered profile observed | Optional local browser evidence | Successful profile-specific Chromium DOM, text, screenshot, failed requests, interactions, viewport, and configuration; failed profiles remain independent |
+| Browser journey observed | Schema-validated local browser plan | Engine/version, device, JavaScript, locale, consent, authentication declaration, steps, DOM, text, accessibility snapshot, screenshots, and failures remain separate; differences do not establish semantic or citation impact |
 | Render parity compared | Bounded local comparison | Raw/desktop and mobile/desktop word ratios from the same run or explicitly resumed immutable profiles; not semantic equivalence |
 | Returned by retrieval | Operator supplied | Provider observation containing retrieved source URL |
 | Cited | Import or disclosed adapter | Complete `observe citations` answer with citation URL and product/adapter mode |

package/dist/universal/.kiro/skills/citable/schemas/acceptance-corpus.schema.json

@@ -0,0 +1,168 @@
+{
+  "$id": "citable://schemas/acceptance-corpus.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Real-property acceptance corpus",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "corpus_id", "version", "created_at", "evaluation_design", "properties", "detector_cases", "semantic_reviews", "executions", "remediation_verifications", "false_negative_discovery_limitations", "causal_limitations", "limitations"],
+  "properties": {
+    "schema_version": { "const": 2 },
+    "corpus_id": { "type": "string", "pattern": "^CORPUS-" },
+    "version": { "type": "string", "minLength": 1 },
+    "created_at": { "type": "string", "format": "date-time" },
+    "evaluation_design": {
+      "type": "object", "additionalProperties": false,
+      "required": ["mode", "population_definition", "selection_method", "sampling_plan_ref", "inclusion_criteria", "exclusion_criteria", "extrapolation_limits", "collection_started_at", "collection_ended_at"],
+      "properties": {
+        "mode": { "enum": ["census", "sample"] },
+        "population_definition": { "type": "string", "minLength": 1 },
+        "selection_method": { "type": "string", "minLength": 1 },
+        "sampling_plan_ref": { "type": ["string", "null"] },
+        "inclusion_criteria": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+        "exclusion_criteria": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "extrapolation_limits": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+        "collection_started_at": { "type": "string", "format": "date-time" },
+        "collection_ended_at": { "type": "string", "format": "date-time" }
+      }
+    },
+    "properties": {
+      "type": "array", "minItems": 1,
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["property_id", "property_class", "architecture", "authorization", "collection_methods", "publication", "sanitization", "evidence_package_refs", "unavailable_evidence", "intentionally_incomplete", "contradiction_status", "limitations"],
+        "properties": {
+          "property_id": { "type": "string", "pattern": "^PROP-[A-Z0-9_-]+$" },
+          "property_class": { "enum": ["static", "framework_rendered", "cms", "ecommerce", "multilingual", "waf_protected", "large_sitemap", "javascript_heavy", "media_heavy", "publisher_surface", "other"] },
+          "architecture": {
+            "type": "object", "additionalProperties": false,
+            "required": ["platform", "rendering", "protections", "languages", "content_types"],
+            "properties": {
+              "platform": { "type": "string", "minLength": 1 },
+              "rendering": { "enum": ["static", "server", "client", "hybrid", "unknown"] },
+              "protections": { "type": "array", "items": { "type": "string" } },
+              "languages": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+              "content_types": { "type": "array", "minItems": 1, "items": { "type": "string" } }
+            }
+          },
+          "authorization": {
+            "type": "object", "additionalProperties": false,
+            "required": ["status", "authorized_by", "authorized_at", "expires_at", "scope", "evidence_ref"],
+            "properties": {
+              "status": { "const": "owner_authorized" },
+              "authorized_by": { "type": "string", "minLength": 1 },
+              "authorized_at": { "type": "string", "format": "date-time" },
+              "expires_at": { "type": ["string", "null"], "format": "date-time" },
+              "scope": { "type": "array", "minItems": 1, "items": { "enum": ["collect", "retain", "review", "publish_aggregate", "publish_artifacts"] } },
+              "evidence_ref": { "type": "string", "minLength": 1 }
+            }
+          },
+          "collection_methods": {
+            "type": "array", "minItems": 1,
+            "items": {
+              "type": "object", "additionalProperties": false,
+              "required": ["method", "authority", "collector", "collected_at", "limitations"],
+              "properties": {
+                "method": { "type": "string", "minLength": 1 },
+                "authority": { "enum": ["owner_controlled", "provider_published", "independent", "synthetic", "external_unverified"] },
+                "collector": { "type": "string", "minLength": 1 },
+                "collected_at": { "type": "string", "format": "date-time" },
+                "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+              }
+            }
+          },
+          "publication": {
+            "type": "object", "additionalProperties": false,
+            "required": ["level", "approved_by", "approved_at", "retention_days", "allowed_artifact_refs"],
+            "properties": {
+              "level": { "enum": ["private", "aggregate_only", "sanitized_artifacts", "public_artifacts"] },
+              "approved_by": { "type": ["string", "null"] },
+              "approved_at": { "type": ["string", "null"], "format": "date-time" },
+              "retention_days": { "type": "integer", "minimum": 1 },
+              "allowed_artifact_refs": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } }
+            }
+          },
+          "sanitization": {
+            "type": "object", "additionalProperties": false,
+            "required": ["reviewed_by", "reviewed_at", "pii_status", "credential_status", "source_identifiers", "evidence_ref"],
+            "properties": {
+              "reviewed_by": { "type": ["string", "null"] },
+              "reviewed_at": { "type": ["string", "null"], "format": "date-time" },
+              "pii_status": { "enum": ["not_reviewed", "none_detected", "redacted"] },
+              "credential_status": { "enum": ["not_reviewed", "none_detected", "redacted"] },
+              "source_identifiers": { "enum": ["not_reviewed", "approved", "pseudonymized"] },
+              "evidence_ref": { "type": ["string", "null"] }
+            }
+          },
+          "evidence_package_refs": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+          "unavailable_evidence": { "type": "array", "items": { "type": "string" } },
+          "intentionally_incomplete": { "type": "boolean" },
+          "contradiction_status": { "enum": ["none_observed", "observed", "unresolved", "not_evaluated"] },
+          "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+        }
+      }
+    },
+    "detector_cases": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["case_id", "property_id", "detector_id", "detector_version", "namespace", "expected", "observed", "adjudicator", "evidence_refs"],
+        "properties": {
+          "case_id": { "type": "string", "minLength": 1 }, "property_id": { "type": "string", "minLength": 1 },
+          "detector_id": { "type": "string", "minLength": 1 }, "detector_version": { "type": "string", "minLength": 1 }, "namespace": { "type": "string", "minLength": 1 },
+          "expected": { "enum": ["detection", "non_detection"] }, "observed": { "enum": ["detected", "not_detected", "incomplete"] },
+          "adjudicator": { "type": "string", "minLength": 1 },
+          "evidence_refs": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+        }
+      }
+    },
+    "semantic_reviews": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["review_id", "property_id", "review_type", "reviewer_verdicts", "reviewer_assignment_refs", "disagreement_refs", "adjudicated", "evidence_refs"],
+        "properties": {
+          "review_id": { "type": "string", "minLength": 1 }, "property_id": { "type": "string", "minLength": 1 },
+          "review_type": { "type": "string", "minLength": 1 },
+          "reviewer_verdicts": { "type": "array", "minItems": 2, "items": { "type": "string", "minLength": 1 } },
+          "reviewer_assignment_refs": { "$ref": "#/definitions/refs" }, "disagreement_refs": { "$ref": "#/definitions/refs" },
+          "adjudicated": { "type": "boolean" }, "evidence_refs": { "$ref": "#/definitions/nonempty_refs" }
+        }
+      }
+    },
+    "executions": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["property_id", "run_id", "raw_artifact_refs", "deterministic_finding_refs", "heuristic_finding_refs", "reviewer_assignment_refs", "disagreement_refs", "exception_refs", "intervention_refs", "verification_refs", "reproducibility_receipt_ref", "runtime_ms", "peak_memory_bytes", "evidence_bytes", "reproducible", "incomplete"],
+        "properties": {
+          "property_id": { "type": "string" }, "run_id": { "type": "string" },
+          "raw_artifact_refs": { "$ref": "#/definitions/nonempty_refs" }, "deterministic_finding_refs": { "$ref": "#/definitions/refs" },
+          "heuristic_finding_refs": { "$ref": "#/definitions/refs" }, "reviewer_assignment_refs": { "$ref": "#/definitions/refs" },
+          "disagreement_refs": { "$ref": "#/definitions/refs" }, "exception_refs": { "$ref": "#/definitions/refs" },
+          "intervention_refs": { "$ref": "#/definitions/refs" }, "verification_refs": { "$ref": "#/definitions/refs" },
+          "reproducibility_receipt_ref": { "type": ["string", "null"] },
+          "runtime_ms": { "type": "number", "minimum": 0 }, "peak_memory_bytes": { "type": "integer", "minimum": 0 },
+          "evidence_bytes": { "type": "integer", "minimum": 0 }, "reproducible": { "type": "boolean" }, "incomplete": { "type": "boolean" }
+        }
+      }
+    },
+    "remediation_verifications": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["verification_id", "property_id", "status", "evidence_refs"],
+        "properties": {
+          "verification_id": { "type": "string" }, "property_id": { "type": "string" },
+          "status": { "enum": ["verified", "failed", "incomplete"] }, "evidence_refs": { "$ref": "#/definitions/nonempty_refs" }
+        }
+      }
+    },
+    "false_negative_discovery_limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+    "causal_limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+    "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+  },
+  "definitions": {
+    "refs": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "nonempty_refs": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/acceptance-run-context.schema.json

@@ -0,0 +1,17 @@
+{
+  "$id": "citable://schemas/acceptance-run-context.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Acceptance-run disclosed execution context",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "source_commit": { "type": ["string", "null"] },
+    "content_hashes": { "type": "object", "additionalProperties": { "type": "string", "pattern": "^[a-f0-9]{64}$" } },
+    "collectors": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } },
+    "external_systems": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } },
+    "node_version": { "type": "string", "pattern": "^v?\\d+\\.\\d+\\.\\d+" },
+    "locale": { "type": "string", "minLength": 1 },
+    "region": { "type": ["string", "null"] },
+    "unavailable_observations": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/acceptance-run-receipt.schema.json

@@ -0,0 +1,88 @@
+{
+  "$id": "citable://schemas/acceptance-run-receipt.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Acceptance-run reproducibility receipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "receipt_id", "run_id", "property", "detectors", "configuration", "observation_method", "toolchain", "external_systems", "execution", "canonical_artifacts", "reproducibility", "limitations", "receipt_hash"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "receipt_id": { "type": "string", "pattern": "^ACCEPTANCE-RECEIPT-[A-F0-9]{20}$" },
+    "run_id": { "type": "string", "minLength": 1 },
+    "property": {
+      "type": "object", "additionalProperties": false,
+      "required": ["target", "source_commit", "working_tree_state", "content_hashes"],
+      "properties": {
+        "target": { "type": "object" },
+        "source_commit": { "type": ["string", "null"] },
+        "working_tree_state": { "type": ["string", "null"] },
+        "content_hashes": { "type": "object", "additionalProperties": { "type": "string" } }
+      }
+    },
+    "detectors": {
+      "type": "object", "additionalProperties": false,
+      "required": ["run", "skipped"],
+      "properties": {
+        "run": { "type": "array", "items": { "type": "string" } },
+        "skipped": {
+          "type": "array",
+          "items": {
+            "type": "object", "additionalProperties": false,
+            "required": ["detector_id", "reason"],
+            "properties": { "detector_id": { "type": "string" }, "reason": { "type": "string" } }
+          }
+        }
+      }
+    },
+    "configuration": {
+      "type": "object", "additionalProperties": false,
+      "required": ["hash"], "properties": { "hash": { "type": ["string", "null"] } }
+    },
+    "observation_method": {
+      "type": "object", "additionalProperties": false,
+      "required": ["command", "arguments", "target_kind", "collectors"],
+      "properties": {
+        "command": { "type": "string" },
+        "arguments": { "type": "array", "items": { "type": "string" } },
+        "target_kind": { "type": ["string", "null"] },
+        "collectors": { "type": "object", "additionalProperties": { "type": "string" } }
+      }
+    },
+    "toolchain": {
+      "type": "object", "additionalProperties": false,
+      "required": ["citable_version", "skill_version", "node_version"],
+      "properties": {
+        "citable_version": { "type": "string" },
+        "skill_version": { "type": "string" },
+        "node_version": { "type": "string" }
+      }
+    },
+    "external_systems": { "type": "object", "additionalProperties": { "type": "string" } },
+    "execution": {
+      "type": "object", "additionalProperties": false,
+      "required": ["started_at", "receipt_created_at", "locale", "region", "status", "partial", "unavailable_observations", "errors"],
+      "properties": {
+        "started_at": { "type": "string", "format": "date-time" },
+        "receipt_created_at": { "type": "string", "format": "date-time" },
+        "locale": { "type": "string" },
+        "region": { "type": ["string", "null"] },
+        "status": { "type": "string" },
+        "partial": { "type": "boolean" },
+        "unavailable_observations": { "type": "array", "items": { "type": "string" } },
+        "errors": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "canonical_artifacts": { "type": "object", "additionalProperties": { "type": "string", "pattern": "^[a-f0-9]{64}$" } },
+    "reproducibility": {
+      "type": "object", "additionalProperties": false,
+      "required": ["fingerprint", "included_fields", "excluded_environment_fields"],
+      "properties": {
+        "fingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "included_fields": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+        "excluded_environment_fields": { "type": "array", "minItems": 1, "items": { "type": "string" } }
+      }
+    },
+    "limitations": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+    "receipt_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/artifact-interchange.schema.json

@@ -0,0 +1,58 @@
+{
+  "$id": "citable://schemas/artifact-interchange.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Citable artifact interchange envelope",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["contract", "contract_version", "created_at", "producer", "run", "artifacts", "package_hash", "limitations"],
+  "properties": {
+    "contract": { "const": "citable-artifact-interchange" },
+    "contract_version": { "const": 1 },
+    "created_at": { "type": "string", "format": "date-time" },
+    "producer": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["tool", "tool_version", "skill_version"],
+      "properties": {
+        "tool": { "const": "citable" },
+        "tool_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" },
+        "skill_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" }
+      }
+    },
+    "run": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["run_id", "command", "status", "timestamp", "tool_version", "skill_version", "manifest_sha256", "checksums_sha256"],
+      "properties": {
+        "run_id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+        "command": { "type": "string", "minLength": 1 },
+        "status": { "type": "string", "enum": ["completed", "completed_with_warnings", "incomplete", "failed"] },
+        "timestamp": { "type": "string", "format": "date-time" },
+        "tool_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" },
+        "skill_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" },
+        "manifest_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "checksums_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+      }
+    },
+    "artifacts": {
+      "type": "array",
+      "minItems": 2,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "sha256", "bytes"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$" },
+          "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "bytes": { "type": "integer", "minimum": 0 }
+        }
+      }
+    },
+    "package_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "limitations": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string", "minLength": 1 }
+    }
+  }
+}