@nebulacomponents/citable 1.13.1 → 1.15.0

package/dist/universal/.gemini/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.13.1
+version: 1.15.0
 ---
 
 # Citable — evidence and change control for search and AI citation readiness
@@ -87,6 +87,7 @@ prefer running it over re-deriving its checks by hand:
 ```
 citable init                        # initialize .citable/ (non-destructive)
 citable audit [scope] --target <dir|url> [--base-url <url>] [--ref-date YYYY-MM-DD]
+citable plan-audit --target <dir|url> [--base-url <url>]
 citable inspect <page> --target <dir|url>
 citable map-claims --target <dir|url> [--write]
 citable substantiate [--write]
@@ -94,19 +95,26 @@ citable schema --target <dir|url>
 citable validate [registries|claims|evidence|schema|links]
 citable compare-snapshots [runA runB]
 citable action-plan [run-id]          # ordered actions, blockers, semantic gates, verification
-citable observe <mode> [options]      # render/index/citation/log/passage/consensus/performance evidence
+citable observe <mode> [options]      # render/index/citation/log/probe/passage/consensus/performance/stance evidence
+citable observe stance --input <citations|prompts.json> [--entity <id>]
 citable observe bing --dataset <search_performance|ai_performance> --input <csv|json>
+citable observe probes --target <url> [--region <label>]
+citable observe network --input <regional-network-import.json>
 citable observe render --target <url> [--interactions] [--resume-run <run-id>]
 citable observe render --input <browser-evidence-plan.json>
 citable observe performance --target <url> --lighthouse [--repeat 1..5]
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
-citable monitor [runA runB]           # observation regression alerts
+citable monitor [runA runB] [--webhook <url>] [--min-severity <sev>]  # observation regression alerts
+citable report dashboard [--last N] [--since <run-id>]  # cross-run evidence trend (Markdown + HTML)
+citable report share-of-voice [--last N] [--since <run-id>]  # competitor citation share (Markdown + HTML)
 citable metrics import --provider <name> --input <csv|json>
 citable connect status
-citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
-citable connect discover --provider <gsc|ga4>
+citable connect configure --provider <gsc|ga4|wordpress|webflow> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4|wordpress|webflow>
 citable connect validate --connection-id <id>
 citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect read --connection-id <id> --target-id <id>
+citable connect apply --connection-id <id> --input <cms-spec.json> [--write]
 citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
@@ -118,7 +126,7 @@ citable reviews prioritize [--write]
 citable reviews plan --input <json|yaml> [--write]
 citable reviews sample <sampling-plan-id> [--write]
 citable reviews evaluate
-citable schedules run <schedule-id> [--ref-date YYYY-MM-DD]
+citable schedules run <schedule-id> [--ref-date YYYY-MM-DD] [--monitor] [--webhook <url>]
 citable project github <run-id>
 citable observe media --input <manifest.json> [--ocr]
 citable observe representation --input <release-manifest.json> --target <controlled-url>
@@ -134,8 +142,14 @@ citable artifacts import --input <directory>
 Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
 lifecycle corroboration`. Every audit writes an evidence package to
 `.citable/runs/<run-id>/` (manifest, findings.json, report.md, headers, robots,
-sitemaps, schema, link graph, checksums). A report without its evidence package
-is not a deliverable.
+sitemaps, raw JSON-LD, normalized entity graph, link graph, checksums). The
+entity graph preserves declared nodes, relations, unresolved references, parse
+failures, and literal visible-text support; it does not prove semantic
+correctness or search-engine recognition. The source identity-chain artifact
+joins declared publisher, author affiliations, content owner, factual reviewer,
+evidence owner, and correction path while preserving missing links. Registry
+linkage does not prove that disclosures are visible, current, or independent.
+A report without its evidence package is not a deliverable.
 
 ## Finding-to-action protocol
 

package/dist/universal/.gemini/skills/citable/VERSION

@@ -1 +1 @@
-1.13.1
+1.15.0

package/dist/universal/.gemini/skills/citable/agents/citable-auditor.md

@@ -0,0 +1,64 @@
+---
+name: citable-auditor
+description: Run a Citable audit or evidence collection when the user needs a plan, immutable or sealed run, observation, capability diagnosis, or evidence-bounded summary. Not for semantic approval, source remediation, content rewriting, or claims that an outcome is guaranteed.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 20
+skills:
+  - citable
+---
+
+You are Citable's evidence-collection specialist. Establish what the target
+makes observable, what the selected method could not collect, and where the
+resulting immutable evidence package lives.
+
+## Authority boundary
+
+- You may run the Citable CLI and read its artifacts.
+- Never edit the audited property, its source, its registries, or an existing
+  run package.
+- Do not use `curl`, `wget`, raw browser automation, or ad hoc HTTP clients.
+  Network collection must go through the applicable guarded Citable command.
+- Do not run `citable apply`, use `--write`, or create implementation facts.
+- Do not infer crawling, indexing, ranking, citation, recommendation,
+  inclusion, sentiment, or conversion outcomes.
+
+## Workflow
+
+1. Read repository instructions and identify the target and requested evidence
+   question.
+2. Run `citable doctor` when optional browser, API, OCR, or lab capability is
+   relevant. Treat `ready` as prerequisite presence only.
+3. Run `citable plan-audit --target <target>` when the appropriate scopes or
+   collectors are not already explicit. The plan is not evidence.
+4. Run `citable audit [scope] --target <target>` for deterministic and
+   heuristic site findings. Preserve the full audit unless the user explicitly
+   requested a scope.
+5. Run only the relevant `citable observe <mode>` commands for external or
+   rendered observations. Preserve provider, method, authority, authenticity,
+   collection, and representativeness boundaries.
+6. Read the run manifest, findings, summary, warnings, incomplete state, and
+   checksums before reporting.
+
+If prerequisites, authorization, source facts, or required inputs are absent,
+preserve `blocked`, `incomplete`, `not_established`, or `not_evidenced`.
+Never translate one of those states into zero, pass, absence, or failure of the
+external system.
+
+## Return contract
+
+Report:
+
+1. target, command, scope, and collection method;
+2. run ID and artifact directory;
+3. deterministic observations;
+4. evidence-backed semantic findings and probabilistic inferences, separately;
+5. skipped checks, collection failures, limitations, and residual unknowns;
+6. exact next evidence or owner input required;
+7. whether semantic review or a governed action plan is the next bounded step.
+
+A human-readable report without its run package is not a deliverable.

package/dist/universal/.gemini/skills/citable/agents/citable-semantic-reviewer.md

@@ -0,0 +1,66 @@
+---
+name: citable-semantic-reviewer
+description: Review semantic questions in an existing Citable run, finding, action, or artifact, including claim support, answer extractability, entity clarity, comparison fairness, and narrative accuracy. Not for collecting new evidence, running audits, editing source, or approving publication.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: inherit
+maxTurns: 15
+skills:
+  - citable
+---
+
+You are Citable's read-only semantic reviewer. Evaluate meaning against the
+exact source evidence and review policy without changing technical findings,
+registries, source files, or sealed artifacts.
+
+## Preconditions
+
+Require an existing source run, finding, review item, or action artifact. Bind
+the review to the available run ID, finding ID and finding hash, review-item
+hash, policy, subject, captured evidence, and declared limitations. If the
+binding or source material is unavailable, return `review_required` with the
+missing input instead of reconstructing it.
+
+## Review dimensions
+
+Apply only dimensions relevant to the requested item:
+
+- intent alignment and answer extractability;
+- claim boundedness and evidence strength;
+- entity clarity and source identity;
+- information gain and comparison fairness;
+- recommendation eligibility and narrative accuracy;
+- factual accuracy, accessibility, conversion function, legal defensibility,
+  and maintainability.
+
+Separate deterministic fact from evidence-backed semantic finding,
+probabilistic inference, strategic hypothesis, experiment result, and
+untestable condition. Never present inference as fact.
+
+## Authority boundary
+
+- Never edit source files, registries, findings, review items, action plans, or
+  sealed run artifacts.
+- Do not collect new external evidence or treat general knowledge as source-run
+  evidence.
+- Do not change a technical failure to pass or accepted risk.
+- Do not mark a claim `verified`, complete a required review, approve
+  publication, or satisfy an owner-controlled gate. Automation cannot upgrade
+  evidence authority.
+- Preserve `review_required` when evidence or accountable authority is missing.
+- Preserve `adjudication_required` when current authorized reviewers disagree.
+
+## Return contract
+
+For each reviewed item, report:
+
+1. artifact binding and review dimensions applied;
+2. supporting and contradicting evidence;
+3. semantic assessment with confidence and false-positive conditions;
+4. missing evidence, ambiguity, residual risk, and required owner input;
+5. proposed disposition: `review_required`, `adjudication_required`, or a
+   recommendation for an authorized human reviewer to record.
+
+Your output is review context, not an approval or a mutation instruction.

package/dist/universal/.gemini/skills/citable/commands/README.md

@@ -21,9 +21,12 @@ intent, not executability, so statuses are strict:
 | /citable validate, validate-claims, validate-evidence, validate-schema, validate-links | implemented |
 | /citable compare-snapshots / validate-regression | implemented |
 | /citable action-plan | implemented — writes ordered, source-run-bound action artifacts outside immutable evidence packages |
-| /citable observe | implemented — render, index, citation, crawler-log, passage, consensus, performance, and corroboration evidence |
+| /citable observe | implemented — render, index, citation, crawler-log, passage, consensus, performance, corroboration, and stance evidence |
 | /citable apply | implemented — reviewed, hash-locked source replacements; dry run by default |
+| /citable connect status / configure / discover / validate / sync / read / apply / disconnect | implemented — GA4, GSC, WordPress, and Webflow adapters with hash-locked CMS remediation |
 | /citable monitor | implemented — compares immutable observation runs and emits evidence-linked alerts |
+| /citable report dashboard | implemented — folds each run's recorded summary into a cross-run Markdown/HTML trend; derives no new findings and no combined score |
+| /citable report share-of-voice | implemented — joins competitor registry against recorded citation observations to compute verified share-of-citation |
 | /citable metrics import | implemented — validates declared CSV/JSON metrics and writes immutable observations |
 | /citable objectives init / validate | implemented — user-owned metric selection, cohorts, windows, and guardrails |
 | /citable evaluate | implemented — independent baseline/evaluation comparisons with inconclusive handling |

package/dist/universal/.gemini/skills/citable/commands/action-findings.md

@@ -15,6 +15,11 @@ failure_behaviour: missing or invalid source run -> fail; review-required action
 3. Assign owners. Resolve each blocked action's exact required input. Missing
    facts, evidence, legal review, or semantic review are blockers, not drafting
    opportunities.
+   Treat `decision_owner` independently from implementation responsibility when
+   the generated plan names different roles. Empty `depends_on_action_ids`,
+   `leading_indicators`, or `monitoring_window` fields mean those relationships
+   are not established by the source evidence; do not fill them with generic
+   SEO assumptions.
 4. Capture a before state for each subject. Use the finding's evidence,
    preferred remediation, unsafe shortcuts, and detector lineage as the change
    boundary.
@@ -24,7 +29,10 @@ failure_behaviour: missing or invalid source run -> fail; review-required action
    writes use the loader/saver and retain history. Content claims remain equal
    to or narrower than their registered scope.
 7. Build and test the target repository. Run the generated verification
-   command, then compare the new audit to the source run.
+   command, evaluate the explicit `failure_condition`, then compare the new
+   audit to the source run. Monitor only the listed leading indicators over the
+   declared window; an empty list or null window does not authorize an inferred
+   outcome measure.
 8. Close only with evidence: resolved detector/subject pair, before/after run
    IDs, diff, reviewer, and residual risk. Mark blocked, accepted risk, and
    false positive explicitly; do not silently drop findings.

package/dist/universal/.gemini/skills/citable/commands/observe-and-act.md

@@ -19,22 +19,69 @@ failure_behaviour: unavailable dependency, credential, source run, reviewer, exa
   browser version, device, JavaScript, locale, consent, authentication state,
   and ordered interaction steps. Fill/select values are referenced by
   environment-variable name and are never written to the plan or artifacts.
+  Targets, subresources, and navigation steps must remain on public network
+  destinations; unsupported schemes and configured non-public address ranges
+  are blocked. DNS validation does not pin the later browser connection, so
+  isolated execution with egress controls remains required for untrusted URLs.
+  Plans may include a strict semantic-impact policy covering text retention,
+  heading, link, and structured-data parity. Deterministic violations name a
+  review owner and always remain `review_required`; passing configured checks
+  does not establish semantic or retrieval equivalence.
 - `observe index --input <JSON>` imports owner exports. With `--target`,
   `--site-url`, and `GSC_ACCESS_TOKEN`, it calls Google URL Inspection, which
   reports the indexed version rather than performing a live indexability test.
 - `observe citations --input <JSON>` imports complete controlled observations.
   With `--endpoint`, the input is a versioned prompt corpus and each prompt runs
   1-20 times (default 3) through the disclosed adapter protocol. An API is not
-  presumed equivalent to a provider's consumer search experience.
+  presumed equivalent to a provider's consumer search experience. Adapter
+  endpoints require HTTPS, must resolve only to public destinations, and may
+  not redirect.
+  Citation objects may include a strict `source_profile` containing declared
+  format, word and heading counts, freshness date, and evidence features.
+  Competitive summaries group these profiles by cited domain. Imported profile
+  values are comparative metadata, not independently fetched or verified
+  qualities.
 - `observe logs --input <JSON>` imports server/CDN records. User-agent matches
   without IP verification remain low confidence.
+- `observe probes --target <URL> [--region <label>]` sends one bounded synthetic
+  request for every active identity in `crawlers.yaml`, preserving response
+  bodies, safe diagnostic headers, redirects, and coarse edge/challenge
+  classification. The request merely spoofs each declared user agent: it does
+  not establish crawler identity, production access, regional
+  representativeness, or alignment between declared policy and actual crawler
+  treatment.
+- `observe network --input <JSON>` accepts a strict regional runner export with
+  region, network, user agent, DNS answers, TLS authorization/fingerprint,
+  status, latency, and cache state for every probe. Citable validates and seals
+  these observations but does not operate the runner or infer global coverage.
 - `observe passages|consensus --target <dir|URL>` performs static extraction.
+  Passage observations include raw/extracted byte and visible-token ratios plus
+  exact repeated header, navigation, aside, and footer regions across the
+  audited page cohort. These classifications are descriptive and do not imply
+  content harm, retrieval effects, or ranking effects.
+  Versioned passage records also join declared page prompts, questions, and
+  expected answer components. This only creates review context:
+  question-to-passage suitability remains `review_required`.
+  Consensus normalizes parseable HTTP, sitemap, and visible/meta freshness
+  dates, preserves conflicts and invalid values, and compares the current
+  content hash with the latest immutable page snapshot. A detected hash change
+  establishes only an interval after the prior capture—not an exact change
+  time, cause, quality improvement, or ranking effect. Lifecycle review dates
+  remain a separate governance signal.
+  `observe consensus --input <canonical-index-import.json>` additionally joins
+  schema-validated engine-selected canonical observations while preserving
+  their collection authority and authenticity. Missing engine observations
+  remain `null`; they are never inferred from static declarations.
 - `observe performance` imports evidence or calls CrUX with `CRUX_API_KEY`.
   `--lighthouse` instead performs 1-5 local lab runs (default 3) using optional
   `lighthouse` and `chrome-launcher` peers, preserving each result and a median
   summary. Lab evidence remains separate from CrUX field evidence.
-- `observe corroboration --input <JSON>` records observable external mentions;
-  controlled or unverified sources do not become authority claims.
+- `observe corroboration --input <JSON>` accepts only the versioned
+  `corroboration-import` contract. Each mention must disclose source control,
+  relationship, collection authority, authenticity, and dataset coverage.
+  Legacy independence booleans and undisclosed control fail closed. An
+  observable mention does not establish source authority, claim support,
+  ranking impact, citation eligibility, or representative coverage.
 
 ## Guarded remediation
 
@@ -44,9 +91,16 @@ reviewer, matches the exact file hash, and identifies exactly one source string.
 `--write` applies only after all operations validate. Build, tests, semantic
 review, re-audit, and snapshot comparison remain mandatory afterward.
 
-## Monitoring
+## Monitoring and alert delivery
 
-`monitor [runA runB]` reports state changes, missing observations, index loss,
-canonical disagreement, and citation-presence changes. Alerts are evidence
-changes, not causal explanations or ranking conclusions. Schedule it in CI at
-the cadence defined by lifecycle and experiment records.
+`monitor [runA runB] [--webhook <url>] [--min-severity <level>]` reports state
+changes, missing observations, index loss, canonical disagreement, and
+citation-presence changes. With `--webhook`, detected regressions matching or
+exceeding `--min-severity` (default `medium`) are dispatched as sealed JSON
+alert payloads and logged under `.citable/monitoring/deliveries/`. Destination
+URLs must be public network destinations (private/loopback addresses are blocked).
+Alerts are evidence changes, not causal explanations or ranking conclusions.
+
+Scheduled monitoring (`schedules run <id> --monitor [--webhook <url>]`) automatically
+compares the scheduled audit against the preceding baseline run and dispatches
+regression alerts when configured in `schedules.yaml`.

package/dist/universal/.gemini/skills/citable/commands/plan-audit.md

@@ -0,0 +1,35 @@
+---
+command: /citable plan-audit --target <dir|url>
+purpose: Inspect observable target signals and propose an evidence-bounded audit and collector plan without creating a run or treating inferred business profiles as facts.
+preconditions: [readable built output directory or permitted public URL]
+artifacts_created: []
+failure_behaviour: missing or unreadable target -> fail; fewer than two supporting signals -> no profile established; unavailable optional prerequisite -> collector blocked
+---
+
+# Profile-aware audit planning
+
+1. Run `citable plan-audit --target <dir|url>` before choosing optional
+   collectors. The command builds the same bounded site model used by audit but
+   does not create an audit, observation, snapshot, or remediation artifact.
+2. Treat every returned profile as `probabilistic_inference`. Preserve its
+   confidence and evidence list. A profile changes semantic emphasis only; it
+   does not suppress detectors or establish the target's business model.
+3. Use the proposed full audit as the deterministic baseline. Do not translate
+   an inferred profile into a reduced audit that could hide cross-discipline
+   findings.
+4. Read collector states independently. `available` means the prerequisite is
+   present, not that browser launch, authorization, property access, quota, or
+   collection will succeed. `blocked` lists the missing input and remains
+   unresolved until the relevant collector produces evidence.
+5. Keep profile-specific emphasis bounded:
+   SaaS focuses review on pricing, capability claims, and product identity;
+   e-commerce on product/offer support; local on identity/NAP and review
+   evidence; publisher on authorship/freshness; multilingual on hreflang and
+   parity; API/docs on machine interfaces and authentication claims.
+
+# Refusal boundary
+
+Do not invent an industry, customer segment, locale strategy, product catalog,
+local presence, or API capability to complete the plan. If no profile reaches
+the two-signal threshold, report that none is established and run the full
+audit without profile-specific emphasis.

package/dist/universal/.gemini/skills/citable/commands/reporting.md

@@ -0,0 +1,57 @@
+---
+command: /citable report dashboard [--last N] [--since <run-id>]
+purpose: Fold the summary each audit run already recorded into a cross-run Markdown table and self-contained HTML page without deriving new findings, scores, or causal explanations.
+preconditions: [at least one finalized audit run under .citable/runs/ with a summary.json]
+failure_behaviour: fewer than two audit runs -> explicit insufficient-history state, not a trend; unreadable summary or manifest -> run reported under skipped runs; non-integer --last -> fail
+artifacts_created: [.citable/reports/dashboard.md, .citable/reports/dashboard.html]
+---
+
+# Cross-run evidence reporting
+
+1. Run `citable report dashboard` to read severity counts, retrieval
+   eligibility, source extraction and support, and observed citation presence
+   rate across run history. Every value is copied from a run's own
+   `summary.json`. The command runs no detector, opens no network connection,
+   and never edits an immutable run package.
+2. Treat the output as derived, not canonical. It is written to
+   `.citable/reports/`, alongside `monitor` and `action-plan` derived
+   artifacts. The evidence of record remains `.citable/runs/<run-id>/`.
+3. Window the history with `--since <run-id>` (keeps that run and everything
+   after it) and `--last N` (keeps the final N runs). Run IDs sort
+   chronologically, so both filters are deterministic.
+4. Read fewer than two runs as no trend. With zero or one run the dashboard
+   states insufficient history explicitly instead of drawing a line through a
+   single point. Direction, rate of change, and improvement are not established
+   by one observation.
+5. Read skipped runs as a gap in the series, not as absence of a problem. A run
+   whose `summary.json` or `manifest.json` cannot be parsed, and an observation
+   run whose summary records no severity or posture, is listed with its reason
+   rather than counted as zero findings.
+6. Read a falling count as an observed difference between runs, not as proof
+   that a condition was fixed. Use `citable compare-snapshots` to establish
+   whether two runs are comparable at all — detector set, configuration,
+   observation method, and tool version all change what a count means.
+
+# Refusal boundary
+
+Do not present the dashboard as an AI visibility score, a ranking forecast, or
+a measure of citation likelihood. The three posture dimensions are reported
+separately and are never combined into a single number. Do not interpolate,
+estimate, or carry forward a missing value: a run with no evidenced citation
+presence rate is omitted from that trend line, not filled in. Do not attribute
+any observed change to a specific intervention.
+
+# Share of voice and competitor reporting
+
+1. Run `citable report share-of-voice [--last N] [--since <run-id>]` to evaluate
+   first-party and competitor citation presence and share across recorded
+   `observe citation` runs.
+2. Contested competitor domains are loaded from `.citable/competitors.yaml`.
+   Citations whose canonical URL matches declared competitor domains are joined
+   into per-prompt and aggregate shares.
+3. Competitor share is calculated strictly from evidenced observations; missing
+   observations or unevaluated prompts are never filled with fabricated zeros or
+   interpolated estimates.
+4. Outputs are written to `.citable/reports/share-of-voice.md` and
+   `.citable/reports/share-of-voice.html`.
+

package/dist/universal/.gemini/skills/citable/manifest.json

@@ -1,14 +1,20 @@
 {
   "name": "citable",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "managedBy": "citable-cli",
   "provider": "gemini",
   "providerName": "Gemini CLI",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.13.1",
+  "sourcePackage": "@nebulacomponents/citable@1.15.0",
   "variantPath": ".gemini/skills/citable",
+  "agentProfiles": {
+    "status": "unsupported",
+    "reason": "native agent profile discovery and permission contract not verified for this host"
+  },
   "files": {
-    "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
+    "agents/citable-auditor.md": "sha256:06fe8d84834b2c09b7e7083aa6f57e94e837e0643dbe4ead4bbecf651fb41cad",
+    "agents/citable-semantic-reviewer.md": "sha256:77582263a048ea41ae3f7ee326dbd036222fab81ed83bda98034ec83ee21ef2e",
+    "commands/action-findings.md": "sha256:b1d5c4d8d8b1092bc73b99430bea0a2e460031658e42bed33eb94da9a3c0e48f",
     "commands/artifact-interchange.md": "sha256:18d56fbfa6bb3f23f08593a9a8135e51c268618b049e53c793969b68000875c3",
     "commands/delivery.md": "sha256:3b29250f9e9f84442812e320a70d5d2784b4286e91af3866f99cb6062a85a10f",
     "commands/field-validation.md": "sha256:4f24b2758eef746d704b218364f1e45ee9e07418c8ae111081b1fd41f93dde2d",
@@ -16,10 +22,12 @@
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
     "commands/measurement.md": "sha256:9cade6dfec23338e18aa67ede3335ac9e2888dc577a7d4d8e3ceac948bce403f",
     "commands/media-evidence.md": "sha256:f2218feabe3360a2c9d569a5fa9b70d4b33a83a270d657151635e6f404fb34e0",
-    "commands/observe-and-act.md": "sha256:3862708da9d787d61a9c7bc8639b2fb28bc021d5784e11f313b0e9ecdff261bc",
+    "commands/observe-and-act.md": "sha256:32ad048f14610de0e9a00a7faf27ff18ec0d892f5b20d568f519e44a7ffc0faf",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:c27f69e0e33712e00f780c0988c7b033650c17d3450baea33f2b14212be8438e",
+    "commands/plan-audit.md": "sha256:69875c9654e13b84566dafb16afe5afe08cffb9f3bded1f2d8d2261ae871c869",
+    "commands/README.md": "sha256:a8242f715219a549ad4b40a3573b62e1d2249a76a3162622e0cd61f80682d971",
+    "commands/reporting.md": "sha256:b4e7003d291180ddac574915ebc17a05faac0a72acf5ae2f21bcaa59d273e7ad",
     "commands/reviews.md": "sha256:902904aaa405fe5724cf0662c7a5a36eab9a4fe0eb81cbd95ffa2fff946e0ac8",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
@@ -43,24 +51,27 @@
     "schemas/acceptance-corpus.schema.json": "sha256:b703be371ee33747d83814e448d18cd01f103f1832480a95df4331b86982165d",
     "schemas/acceptance-run-context.schema.json": "sha256:56d75c7bcd166c3578a71699df1aa5466327c23c1e06e33773f2493f5caa1a50",
     "schemas/acceptance-run-receipt.schema.json": "sha256:6c6e66767cf3b9adb42ace087f7e9a428312f41b7ecbaf533fc8d7ba5953da44",
-    "schemas/action-plan.schema.json": "sha256:4b6c4c877840a065c7c0c0c7b52f696502bf3d4ca6d31179622fc364ea868d5e",
+    "schemas/action-plan.schema.json": "sha256:e2ca871c92595a55ac56248cd87df67d94449ac39ac216e60751baaec5b74f1e",
     "schemas/artifact-interchange.schema.json": "sha256:c6f628934c8a1b8ea2996e03c2c5abd46c2a0e74c680b0a43e44c2343dc9aa21",
     "schemas/assumption.schema.json": "sha256:31a0f44bbf1d207e013961ec4c39eea85c3ae9efde1485b5e26084562c816844",
     "schemas/bing-webmaster.schema.json": "sha256:8357c518a8cb4ccd1def2da38950fbba68270e2b1613ad522b50c568a3b8538f",
-    "schemas/browser-evidence-plan.schema.json": "sha256:f2c1a3fe05cdaf72a41c0a3d548ccf5bdf247dbe71b546759b15277df0e723ba",
+    "schemas/browser-evidence-plan.schema.json": "sha256:81ef14f665b4a00f01afb747576faeb06025722e5c15a36eff3d17e59e978851",
+    "schemas/canonical-index-import.schema.json": "sha256:ef633662cb30873242ca356443bc4835afe56bb020208e8f42fa47ac8047b66e",
     "schemas/claim.schema.json": "sha256:ce79ccbfa34ece9b7a309a6962522ea06a1f44c468b4c472b5c376554a788537",
-    "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
+    "schemas/common.defs.json": "sha256:ac66081df6b86f652e066ea868edecfcd36cdd1b1c81e55a1e3af880f671b727",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
     "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
     "schemas/corpus-publication-receipt.schema.json": "sha256:a4d523fd1c1fa53762522891c06c06edb668cd15e1de3c7123d2b9948445ae32",
+    "schemas/corroboration-import.schema.json": "sha256:927983d0590f1ec569e86195d2031be0cd212f9436ff98acca468cbae108d85e",
     "schemas/crawler-identity.schema.json": "sha256:e1e3e6da203a8bc49fba8f9bbde525368891db022d542fc615b677401825351d",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/customer-outcome.schema.json": "sha256:c0cdfee31a692feadb31dc6be734d45ae178ee53f28349c2a9e7504bdfcf9e50",
     "schemas/decision.schema.json": "sha256:7c30f3ad83a6aa0b67ecc51ac6691e5e041b633d01bab17cee2b5218d926204e",
     "schemas/deployment-receipt.schema.json": "sha256:789455907e7f3039fd55ee5b2568e09871128f513f5ddfe1f3afac1a4dd6b2bd",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
-    "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
+    "schemas/entity-graph.schema.json": "sha256:b9cc1312e3c7657d301e63c8dd302d79c7348f245ce3c324eeaa1e796720b74b",
+    "schemas/entity.schema.json": "sha256:ce7cb7a0117a2fbd3032c9f244ab43855b47b285b81313513c3bb3287d37a33b",
     "schemas/evidence-authority.schema.json": "sha256:4f8165a37304ebab019e1c2dfec13f1168ecf89ce9bec88f7dca9c8554e39ac0",
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/exception.schema.json": "sha256:c88985494ec66554330fdc5b65d033527d0005acf41f10798b1e831d171f8944",
@@ -73,12 +84,13 @@
     "schemas/media-manifest.schema.json": "sha256:3f37301aab9e913fa7febb15c720ed6384b106f12cef8d26cdd12d93fd85b41f",
     "schemas/metric.schema.json": "sha256:2ada648e7274a8d78cc9d6e7ed616f91faa79cf9ed07613e2c1fc53b247aac8d",
     "schemas/objective.schema.json": "sha256:94404dc95d04a6641ea7b9654317d0222793251ad44d3dfd2875738622a36025",
-    "schemas/observation.schema.json": "sha256:b572ae8ba3d175509cc9fae914d8d054c0fb84ebcaf81de981532b527064538d",
-    "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
+    "schemas/observation.schema.json": "sha256:a5daabab86dacaa1a81e1f4c4900a0332bb3bf657ffeed60e5c6e0c5a8e5b7da",
+    "schemas/page.schema.json": "sha256:11d116b22ab79c152cfc7bbbec3a00cebe6dcd8ea2845b0ce819c15111fb0166",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
+    "schemas/regional-network-import.schema.json": "sha256:9dc1062fbab9b98ccc485d605bb7e7d65d21449cccc17005251d4efea910fed0",
     "schemas/release-manifest.schema.json": "sha256:962be645e790b5f3dc6f6ea455e187492d727dcb91d00f91e4e25b40e2dbc360",
     "schemas/release-state.schema.json": "sha256:9920f68e538915d0d07044f313a9e410775a38ce9bb46a55d9ebe02970784803",
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
@@ -89,12 +101,13 @@
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "schemas/sampling-plan.schema.json": "sha256:005f70f149baaacd7de698548d556d3e401c630978748271b0e14a74726dd413",
     "schemas/scenario.schema.json": "sha256:3f5bc2032d08f973600db068f475176a0e4706b33be42f99c778fe755a0ff38b",
-    "schemas/schedule.schema.json": "sha256:0f02174ab0fc7bbbce9759fd358b18ed97cc683c76933fd3001cf053c499b157",
+    "schemas/schedule.schema.json": "sha256:645df065bf33577a960c0bf8bb97e141e9326840303569468dae8a553d468482",
+    "schemas/source-identity-chain.schema.json": "sha256:a65d9c12eaed1bd6b637c66a2f9362c17287fdfcb454d8676fb611d2d28aa019",
     "schemas/variance.schema.json": "sha256:68389f64f0a3be13ff8951e8eefba9a5c31d0738325cb47e37c1a8435bea48f0",
-    "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:27be7a85cff672dfd0ed505b4b4a2af7572aa5c33ff98ef6c8497183acc5dabe",
+    "scripts/README.md": "sha256:9eee4e8beb4579a183bd714c9dd24b83abd020753eada5caeffae004739d60b5",
+    "SKILL.md": "sha256:b1aaeca8a5b2489e904d6d68491b9df409b5ec4599868e91892bb70c13771422",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:ca0bc79c4cde0ad64e1ec9df2882425197b5ba85704a4ac6bd67f8f99936eb25"
+    "VERSION": "sha256:d5b1f46669d1cff3be556b1656732c8777ad8ad3f3d05459cfb11dadb1f17d19"
   },
-  "treeHash": "sha256:d263f9f8d9be899e61d93ccedb51a671dacb679b6bc97fad128e27ccd4b6e420"
+  "treeHash": "sha256:d0e363afa74d831ac7721911acf254eb3c8b613d3c56cc55b596d99c789cc7c7"
 }

package/dist/universal/.gemini/skills/citable/schemas/action-plan.schema.json

@@ -28,15 +28,28 @@
         "properties": {
           "action_id": { "$ref": "citable://schemas/common.defs.json#/definitions/id" },
           "finding_ids": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+          "depends_on_action_ids": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": { "$ref": "citable://schemas/common.defs.json#/definitions/id" }
+          },
           "phase": { "type": "string", "enum": ["unblock", "governance", "content", "optimization"] },
           "priority": { "type": "string", "enum": ["critical", "high", "medium", "low"] },
           "subject": { "type": "string" },
           "action": { "type": "string", "minLength": 1 },
           "owner": { "type": ["string", "null"] },
+          "decision_owner": { "type": ["string", "null"] },
           "status": { "type": "string", "enum": ["ready", "blocked"] },
           "required_input": { "type": "array", "items": { "type": "string" } },
           "semantic_gates": { "type": "array", "items": { "type": "string" } },
           "unsafe_shortcuts": { "type": "array", "items": { "type": "string" } },
+          "failure_condition": { "type": "string", "minLength": 1 },
+          "leading_indicators": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "monitoring_window": { "type": ["string", "null"], "minLength": 1 },
           "verification": {
             "type": "object",
             "additionalProperties": false,

package/dist/universal/.gemini/skills/citable/schemas/browser-evidence-plan.schema.json

@@ -9,6 +9,20 @@
     "schema_version": { "const": 1 },
     "plan_id": { "type": "string", "pattern": "^BROWSER-PLAN-[A-Z0-9_-]+$" },
     "target": { "type": "string", "format": "uri", "pattern": "^https?://" },
+    "semantic_impact_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["policy_id", "review_owner", "min_text_retention_ratio", "require_heading_parity", "require_link_parity", "require_structured_data_parity", "limitations"],
+      "properties": {
+        "policy_id": { "type": "string", "pattern": "^RENDER-POLICY-[A-Z0-9_-]+$" },
+        "review_owner": { "type": "string", "minLength": 1 },
+        "min_text_retention_ratio": { "type": "number", "minimum": 0, "maximum": 1 },
+        "require_heading_parity": { "type": "boolean" },
+        "require_link_parity": { "type": "boolean" },
+        "require_structured_data_parity": { "type": "boolean" },
+        "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+      }
+    },
     "profiles": {
       "type": "array",
       "minItems": 1,