@nebulacomponents/citable 1.17.0 → 1.18.1

package/dist/universal/.agents/skills/citable/schemas/sow.schema.json

@@ -0,0 +1,409 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "citable://schemas/sow.schema.json",
+  "title": "Enterprise Statement of Work (SOW)",
+  "type": "object",
+  "required": [
+    "sow_id",
+    "version",
+    "generation_mode",
+    "title",
+    "client",
+    "supplier",
+    "effective_date",
+    "term_days",
+    "currency",
+    "currency_minor_unit_exponent",
+    "commercial_total_fee_minor",
+    "commercial_total_fee_usd",
+    "executive_scope",
+    "admissibility_gate",
+    "work_packages",
+    "deliverables",
+    "acceptance_criteria",
+    "traceability_matrix",
+    "generation_provenance"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "sow_id": { "type": "string", "pattern": "^SOW-[A-Za-z0-9_-]+$" },
+    "version": { "type": "string" },
+    "generation_mode": {
+      "type": "string",
+      "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"]
+    },
+    "title": { "type": "string", "minLength": 1 },
+    "synthetic_evidence": { "type": "boolean" },
+    "client": {
+      "type": "object",
+      "required": ["name", "contact"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "contact": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
+    },
+    "supplier": {
+      "type": "object",
+      "required": ["name", "contact"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "contact": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
+    },
+    "effective_date": { "type": "string" },
+    "term_days": { "type": "integer", "minimum": 1 },
+    "currency": { "type": "string", "enum": ["USD"] },
+    "currency_minor_unit_exponent": { "type": "integer", "enum": [2] },
+    "commercial_total_fee_minor": { "type": "integer", "minimum": 0 },
+    "commercial_total_fee_usd": { "type": "number", "minimum": 0 },
+    "executive_scope": {
+      "type": "object",
+      "required": ["business_objective", "in_scope_properties", "in_scope_systems"],
+      "properties": {
+        "business_objective": { "type": "string", "minLength": 1 },
+        "in_scope_properties": { "type": "array", "items": { "type": "string" } },
+        "in_scope_systems": { "type": "array", "items": { "type": "string" } },
+        "channels": { "type": "array", "items": { "type": "string" } },
+        "geographies": { "type": "array", "items": { "type": "string" } },
+        "organizational_boundaries": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "admissibility_gate": {
+      "type": "object",
+      "required": ["total_findings_evaluated", "admitted_count", "refused_count", "admissibility_rate_pct", "refusal_log"],
+      "properties": {
+        "total_findings_evaluated": { "type": "integer", "minimum": 0 },
+        "admitted_count": { "type": "integer", "minimum": 0 },
+        "refused_count": { "type": "integer", "minimum": 0 },
+        "admissibility_rate_pct": { "type": "integer", "minimum": 0, "maximum": 100 },
+        "refusal_log": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["finding_id", "subject", "gate_failed", "refusal_code", "refusal_rationale"],
+            "properties": {
+              "finding_id": { "type": "string" },
+              "detector_id": { "type": "string" },
+              "subject": { "type": "string" },
+              "gate_failed": { "type": "string" },
+              "refusal_code": { "type": "string" },
+              "refusal_rationale": { "type": "string" },
+              "suggested_handling": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        },
+        "methodology": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "assumptions_and_constraints": {
+      "type": "object",
+      "required": ["assumptions", "dependencies", "exclusions", "constraints", "unresolved_unknowns"],
+      "properties": {
+        "assumptions": { "type": "array", "items": { "type": "string" } },
+        "dependencies": { "type": "array", "items": { "type": "string" } },
+        "exclusions": { "type": "array", "items": { "type": "string" } },
+        "constraints": { "type": "array", "items": { "type": "string" } },
+        "unresolved_unknowns": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "work_packages": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["work_package_id", "name", "deliverable_id", "owner", "requirements"],
+        "properties": {
+          "work_package_id": { "type": "string" },
+          "name": { "type": "string" },
+          "deliverable_id": { "type": "string" },
+          "owner": { "type": "string" },
+          "requirements": { "type": "array", "minItems": 1 }
+        },
+        "additionalProperties": false
+      }
+    },
+    "deliverables": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["deliverable_id", "work_package_id", "title", "artifact_type", "format", "owner", "delivery_criteria"],
+        "properties": {
+          "deliverable_id": { "type": "string" },
+          "work_package_id": { "type": "string" },
+          "title": { "type": "string" },
+          "artifact_type": { "type": "string" },
+          "format": { "type": "string" },
+          "owner": { "type": "string" },
+          "delivery_criteria": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "technical_requirements": {
+      "type": "object",
+      "properties": {
+        "supported_frameworks": { "type": "array", "items": { "type": "string" } },
+        "git_branching_model": { "type": "string" },
+        "rollback_mechanism": { "type": "string" },
+        "access_requirements": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "acceptance_criteria": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["acceptance_test_id", "sow_requirement_id", "test_description", "validation_method", "pass_threshold", "evidence_required"],
+        "properties": {
+          "acceptance_test_id": { "type": "string" },
+          "sow_requirement_id": { "type": "string" },
+          "test_description": { "type": "string" },
+          "validation_method": { "type": "string" },
+          "pass_threshold": { "type": "string" },
+          "evidence_required": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "baseline_and_target_metrics": {
+      "type": "object",
+      "properties": {
+        "disclaimer": { "type": "string" },
+        "metrics": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["metric", "baseline", "target", "validation"],
+            "properties": {
+              "metric": { "type": "string" },
+              "baseline": { "type": "string" },
+              "target": { "type": "string" },
+              "validation": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "experiment_specifications": {
+      "type": "object",
+      "properties": {
+        "standard": { "type": "string" },
+        "stopping_criteria": { "type": "string" },
+        "guardrails": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "raci_matrix": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["role", "r", "raci"],
+        "properties": {
+          "role": { "type": "string" },
+          "r": { "type": "string" },
+          "raci": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "customer_obligations": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "delivery_schedule": {
+      "type": "object",
+      "required": ["total_duration_weeks", "milestones"],
+      "properties": {
+        "total_duration_weeks": { "type": "integer", "minimum": 1 },
+        "milestones": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["milestone_id", "work_package_id", "name", "fee_minor", "fee_usd", "billing_trigger", "target_delivery_week"],
+            "properties": {
+              "milestone_id": { "type": "string" },
+              "work_package_id": { "type": "string" },
+              "name": { "type": "string" },
+              "fee_minor": { "type": "integer", "minimum": 0 },
+              "fee_usd": { "type": "number", "minimum": 0 },
+              "billing_trigger": { "type": "string" },
+              "target_delivery_week": { "type": "integer", "minimum": 1 }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "change_control_process": {
+      "type": "object",
+      "properties": {
+        "procedure": { "type": "string" },
+        "authorization": { "type": "string" },
+        "superceding_rules": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "risk_register": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "category", "description", "mitigation"],
+        "properties": {
+          "id": { "type": "string" },
+          "category": { "type": "string" },
+          "description": { "type": "string" },
+          "mitigation": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "data_governance": {
+      "type": "object",
+      "properties": {
+        "authorized_sources": { "type": "array", "items": { "type": "string" } },
+        "retention_period": { "type": "string" },
+        "processing_purpose": { "type": "string" },
+        "deletion_upon_termination": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "security_requirements": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "platform_dependencies": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "qa_plan": {
+      "type": "object",
+      "properties": {
+        "methodology": { "type": "string" },
+        "evidence_package": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "governance_model": {
+      "type": "object",
+      "properties": {
+        "weekly_sync": { "type": "string" },
+        "written_reports": { "type": "string" },
+        "decision_logging": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "commercial_terms": {
+      "type": "object",
+      "required": ["total_fixed_fee_minor", "total_fixed_fee_usd", "currency", "payment_terms", "milestones"],
+      "properties": {
+        "total_fixed_fee_minor": { "type": "integer", "minimum": 0 },
+        "total_fixed_fee_usd": { "type": "number", "minimum": 0 },
+        "currency": { "type": "string", "enum": ["USD"] },
+        "payment_terms": { "type": "string" },
+        "milestones": { "type": "array" }
+      },
+      "additionalProperties": false
+    },
+    "out_of_scope": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "warranty_terms": {
+      "type": "object",
+      "properties": {
+        "warranty_window_days": { "type": "integer", "minimum": 0 },
+        "defect_definition": { "type": "string" },
+        "exclusion": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "completion_and_handoff": {
+      "type": "object",
+      "properties": {
+        "handoff_assets": { "type": "array", "items": { "type": "string" } },
+        "operational_signoff": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "termination_provisions": {
+      "type": "object",
+      "properties": {
+        "convenience": { "type": "string" },
+        "compensation": { "type": "string" },
+        "asset_transfer": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "traceability_matrix": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": [
+          "finding_id",
+          "recommendation",
+          "sow_requirement_id",
+          "work_package_id",
+          "deliverable_id",
+          "acceptance_test_id",
+          "owner",
+          "evidence_id",
+          "evidence_ids"
+        ],
+        "properties": {
+          "finding_id": { "type": "string" },
+          "detector_id": { "type": "string" },
+          "recommendation": { "type": "string" },
+          "sow_requirement_id": { "type": "string" },
+          "work_package_id": { "type": "string" },
+          "deliverable_id": { "type": "string" },
+          "acceptance_test_id": { "type": "string" },
+          "owner": { "type": "string" },
+          "owner_source": { "type": "string" },
+          "owner_mapping_version": { "type": "string" },
+          "evidence_id": { "type": "string" },
+          "evidence_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+          "severity": { "type": "string" },
+          "target_subject": { "type": "string" },
+          "acceptance_criteria": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "generation_provenance": {
+      "type": "object",
+      "required": [
+        "generated_at",
+        "generator_version",
+        "generation_mode",
+        "source_type",
+        "source_findings_count",
+        "synthetic_evidence"
+      ],
+      "properties": {
+        "generated_at": { "type": "string" },
+        "generator_version": { "type": "string" },
+        "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
+        "source_type": { "type": "string" },
+        "source_identifier": { "type": ["string", "null"] },
+        "source_findings_count": { "type": "integer", "minimum": 0 },
+        "findings_integrity_hash": { "type": ["string", "null"] },
+        "synthetic_evidence": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

package/dist/universal/.claude/agents/citable/citable-remediator.md

@@ -0,0 +1,43 @@
+---
+name: citable-remediator
+description: Execute closed-loop code remediation, AST patch validation, detector rerun verification, and customer delivery kit generation. Not for unreviewed direct file writes, semantic copy generation, or outcome promises.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 25
+skills:
+  - citable
+---
+
+You are Citable's closed-loop remediation specialist. Your responsibility is to take verified audit findings, apply safe, idempotent AST patches, verify that target detectors are resolved with zero regressions, and generate customer implementation packages.
+
+## Authority boundary
+
+- You may run `citable remediate`, `citable verify remediation`, `citable kit export`, and `citable lint components`.
+- Never edit target source files using ad-hoc text manipulation or unvalidated shell scripts. All code mutations must flow through `citable remediate` with AST validation.
+- Refuse automated writes on semantic copy or editorial content (CRO-012, COMP-003); microcopy decisions belong to human editors (fact ≠ inference).
+- Always verify that a rollback snapshot exists under `.citable/remediation/snapshots/` before writing to disk.
+- Never claim a finding is fixed until `citable verify remediation` confirms the source detector no longer flags the target surface.
+- Never promise ranking gains, AI citation rates, or conversion lift.
+
+## Workflow
+
+1. **Finding Triage**: Identify the finding ID, source run, and target file. Inspect the finding's observation and remediation recommendation.
+2. **Dry-Run Inspection**: Execute `citable remediate --finding <id> [--target <file>]` (dry-run by default) to inspect the unified diff, framework classification, and confidence score.
+3. **Confidence Gate**: If `computeConfidence` is below `0.70`, or if the patch involves editorial copy, report `patch_refused` with required human inputs.
+4. **Gated Write**: If confidence is sufficient and structural validation passes, run `citable remediate --finding <id> --write`.
+5. **Closed-Loop Verification**: Run `citable verify remediation --run <run-id> --finding <id> [--target <file>]` to re-execute the source detector against the patched file and check for regressions.
+6. **Delivery Kit Export**: If verified, run `citable kit export --run <run-id> --finding <id>` to generate an engineer-ready delivery kit with tests, diffs, and rollback instructions.
+
+## Return contract
+
+Report:
+1. Target finding ID, file path, and detected framework;
+2. Unified diff and structural AST validation verdict;
+3. Rollback snapshot path and integrity hash;
+4. Closed-loop verification verdict (`verified`, `not_resolved`, `blocked`, or `patch_refused`);
+5. Regression sweep results (verifying zero new critical/high defects);
+6. Delivery kit path and customer acceptance criteria.

package/dist/universal/.claude/agents/citable/citable-sow-architect.md

@@ -0,0 +1,43 @@
+---
+name: citable-sow-architect
+description: Generate contractually enforceable Statements of Work, evaluate Scope Admissibility Gates, enforce 7-column evidence traceability, and compile enterprise search/CRO intelligence briefings. Not for fabricated findings, unevidenced scope, or commercial guarantees.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 25
+skills:
+  - citable
+---
+
+You are Citable's enterprise engagement and SOW architect. Your responsibility is to transform empirical audit findings into contractually enforceable, evidence-traceable Statements of Work (SOWs) and split executive intelligence briefings.
+
+## Authority boundary
+
+- You may run `citable sow generate`, `citable sow validate`, `citable report search`, `citable report cro`, and read audit runs.
+- Never synthesize or hallucinate findings in `CONTRACTUAL` mode. If audit evidence is missing, fail closed and report `NO_FINDINGS`. Synthetic findings are strictly confined to `--sample` / `--demo`.
+- Never force an unqualified finding through the Admissibility Gate. Refused findings must be preserved in `admissibility_gate.refusal_log` with standard refusal codes.
+- Enforce integer minor-unit arithmetic (cents, exponent 2, currency `USD`) for all fees. Never allow fractional pennies or budget drift across milestones.
+- Strictly uphold Citable governance principles: **no search engine crawling, indexation, ranking, AI answer citation, or conversion revenue is guaranteed**. Fees are bound exclusively to verified deliverable acceptance.
+
+## Workflow
+
+1. **Source Evidence Resolution**: Determine the authoritative evidence source: explicit run (`--run <id>`), live scan (`--target <url>`), or sample demonstration (`--sample`). Explicit `--run` takes precedence.
+2. **Admissibility Gating**: Evaluate findings through the 7 admissibility gates (maturity, boundary, feasibility, materiality, acceptance, ownership, discipline). Record refused items in the contractual refusal log.
+3. **Traceability Binding**: Construct the 7-column matrix ensuring every requirement links: Finding ID → Recommendation → SOW Requirement ID → Deliverable ID → Acceptance Test ID → Owner → Source Evidence.
+4. **Commercial Minor-Unit Calculation**: Allocate milestone fees using integer minor units (`commercial_total_fee_minor`) with deterministic penny remainder distribution.
+5. **Contractual Export**: Generate SOW artifacts in Markdown, HTML, or JSON (`citable sow generate`).
+6. **Integrity Validation**: Run `citable sow validate <sow.json>` to verify strict schema conformance against `schemas/sow.schema.json` and cross-object runtime invariants.
+7. **Companion Briefings**: If executive reporting is requested, generate the companion 19-pillar Search Intelligence Briefing (`citable report search`) or 25-pillar CRO Briefing (`citable report cro`).
+
+## Return contract
+
+Report:
+1. SOW ID, generation mode (`CONTRACTUAL`, `DRAFT`, `NON_CONTRACTUAL_SAMPLE`), and generator provenance;
+2. Commercial total value, currency (`USD`), minor units, and milestone fee schedule;
+3. Admissibility gate statistics: total findings, admitted count, refused count, and refusal codes;
+4. 7-column Traceability Matrix summary;
+5. Schema validation verdict against `schemas/sow.schema.json`;
+6. Output artifact paths (Markdown, HTML, JSON).

package/dist/universal/.claude/agents/citable/manifest.json

@@ -1,12 +1,14 @@
 {
   "name": "citable-agent-profiles",
-  "version": "1.17.0",
+  "version": "1.18.1",
   "managedBy": "citable-cli",
   "provider": "claude",
-  "sourcePackage": "@nebulacomponents/citable@1.17.0",
+  "sourcePackage": "@nebulacomponents/citable@1.18.1",
   "files": {
     "citable-auditor.md": "sha256:06fe8d84834b2c09b7e7083aa6f57e94e837e0643dbe4ead4bbecf651fb41cad",
-    "citable-semantic-reviewer.md": "sha256:77582263a048ea41ae3f7ee326dbd036222fab81ed83bda98034ec83ee21ef2e"
+    "citable-remediator.md": "sha256:c990e929f411fc2f2de3aca759333502c956e96924b3a0f809ab0927062623dc",
+    "citable-semantic-reviewer.md": "sha256:77582263a048ea41ae3f7ee326dbd036222fab81ed83bda98034ec83ee21ef2e",
+    "citable-sow-architect.md": "sha256:d55cf8bc2ab8f364c0d95ec39fc44406684110d1e4d1ff2e34702ded003094b4"
   },
-  "treeHash": "sha256:7f1b8c952018afce74f63fdb8142b8b30422a52a1704afa15c37ffd0327376ce"
+  "treeHash": "sha256:8f28264cf0dde04e14d1b4c55e852803b26fc54e821cab126c86d28abac80452"
 }

package/dist/universal/.claude/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.17.0
+version: 1.18.1
 ---
 
 # Citable — evidence and change control for search and AI citation readiness
@@ -88,7 +88,13 @@ prefer running it over re-deriving its checks by hand:
 citable init                        # initialize .citable/ (non-destructive)
 citable audit [scope] --target <dir|url> [--base-url <url>] [--ref-date YYYY-MM-DD]
 citable plan-audit --target <dir|url> [--base-url <url>]
+citable sweep technical --target <dir|url> # Technical SEO sweep + Core Web Vitals metrics
 citable inspect <page> --target <dir|url>
+citable inspect eeat <page> --target <dir|url> # On-page content analysis & 0-5 E-E-A-T score
+citable inspect readiness <page> --target <dir|url> # Answer-engine readiness (Perplexity, Copilot, ChatGPT)
+citable audit backlinks --input <file>  # Off-page authority assessment & toxic domain identification
+citable prioritize matrix [--run <run-id>] # Impact/Effort/Confidence (ICE) scoring matrix
+citable roadmap [generate|show]         # 30/90/180-day strategic milestone roadmap
 citable map-claims --target <dir|url> [--write]
 citable substantiate [--write]
 citable schema --target <dir|url>
@@ -109,6 +115,8 @@ citable monitor [runA runB] [--webhook <url>] [--min-severity <sev>]  # observat
 citable report dashboard [--last N] [--since <run-id>]  # cross-run evidence trend (Markdown + HTML)
 citable report share-of-voice [--last N] [--since <run-id>]  # competitor citation share (Markdown + HTML)
 citable report consensus [--last N] [--since <run-id>]  # canonical discovery consensus matrix (Markdown + HTML)
+citable report search [--target <dir|url>] [--run <id>] [--format md|html|json] # Enterprise Search Intelligence Briefing (19 pillars, evidence-traceable)
+citable report cro [--target <dir|url>] [--input <file>] [--format md|html|json] # Enterprise CRO & Journey Briefing (25 pillars: observations vs hypotheses vs causation)
 citable metrics import --provider <name> --input <csv|json>
 citable connect status
 citable connect configure --provider <gsc|ga4|wordpress|webflow> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
@@ -143,6 +151,15 @@ citable artifacts export <run-id> --output <directory>
 citable artifacts verify --input <directory>
 citable artifacts import --input <directory>
 citable inspect cro <page> --target <dir|url>   # CRO readiness: CTAs, forms, payment-wallet vs authentication readiness, modeled saliency indices
+citable cro [--target <dir|url>] [--funnel <id>] # Full CRO intelligence suite: funnel, ATF clarity, trust, cognitive load, ICE matrix, roadmap
+citable cro backlog [--target <dir|url>]         # Prioritized A/B experiment backlog with falsifiable hypotheses & guardrails
+citable cro roadmap [--target <dir|url>]         # 30/90/180-day CRO strategic roadmap tied to measurable conversion outcomes
+citable sweep technical [--target <dir|url>]    # Technical SEO sweep with Core Web Vitals readiness metrics (LCP, INP, CLS)
+citable inspect eeat <page> --target <dir|url>  # On-page E-E-A-T evaluation on a 0-5 rubric scale
+citable inspect readiness <page> --target <dir|url> # Answer-engine readiness across Perplexity, Bing Copilot, ChatGPT
+citable audit backlinks --input <backlinks.json> # Off-page authority assessment and toxic domain identification
+citable prioritize matrix                       # Impact/Effort/Confidence (ICE) scoring matrix for findings & roadmap
+citable roadmap strategic                       # 30/90/180-day strategic milestone horizons with KPI linkages
 citable preview cro <page> [--export <file.html>]  # split-screen before/remediated sandbox (layout-contract checked; accessibility-aware)
 citable remediate --finding <id> [--target <file>] [--write]  # production-safe patch: framework detection, unified diff, static validation, confidence gate, rollback snapshot; semantic copy changes always refuse automated write
 citable verify remediation --run <run-id> --finding <id> [--target <file>] [--apply]  # closed loop: re-run the detector and emit a before/after evidence bundle (schema remediation-verification)
@@ -150,6 +167,8 @@ citable verify page <page> --target <dir|url>   # all detectors scoped to one pa
 citable check experiment <id> [--observed-control N --observed-variant N --days-running N]  # SRM, stopping, power, contamination; lifecycle: planned|running|inconclusive|validated
 citable compatibility   # Node engine, optional adapters, browser, framework, registries, edge size limits
 citable kit export --run <run-id> --finding <id> [--target <file>]  # customer-ready implementation kit (finding, diff, evidence, acceptance tests, deployment, limitations)
+citable sow generate [--target <dir|url>] [--budget <amount>] [--format md|html|json] [--output <path>] # Enterprise SOW from findings with 6-gate admissibility & 7-column traceability
+citable sow validate <sow.json>                  # Validate SOW schema, admissibility gates, and complete traceability matrix
 ```
 
 Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
@@ -240,6 +259,27 @@ The CRO suite completes the loop. Rules that govern every step:
    payload in the `citable_output_schema` 1.0 envelope
    (`schemas/cli-output-envelope.schema.json`).
 
+## Enterprise SOW & governance protocol (findings → admissibility → traceability → contract)
+
+The SOW engine (`citable sow generate`, `citable sow validate`) translates verified audit findings into legally enforceable enterprise Statements of Work:
+
+1. **Authoritative Evidence Gating**: A contractual SOW requires verified audit findings from `--run <id>` or a live target. Never invent or synthesize findings in `CONTRACTUAL` or `DRAFT` modes; missing findings fail closed (`NoFindingsError`). Synthetic baseline findings are strictly confined to `--sample` / `--demo`.
+2. **Scope Admissibility Filter**: Audit findings do not automatically become contractual obligations. Every candidate finding must pass 7 objective gates:
+   - *Exclusion Gate*: No explicitly blacklisted detectors (`REFUSE-EXCLUDED`).
+   - *Discipline Authorization*: Finding discipline must be authorized in engagement terms (`REFUSE-DISCIPLINE-NOT-AUTHORIZED`).
+   - *Evidence Maturity*: Deterministic/observed confidence with real evidence (`REFUSE-EXPERIMENTAL`, `REFUSE-NO-EVIDENCE`).
+   - *Scope Boundary*: URL matches contracted origins, hosts, or paths (`REFUSE-OUT-OF-SCOPE`).
+   - *Technical Feasibility*: Reject legal, trademark, GDPR, or unfeasible remediation (`REFUSE-UNFEASIBLE-REMEDIATION`).
+   - *Commercial Materiality*: High severity or ICE score >= min threshold (`REFUSE-LOW-MATERIALITY`).
+   - *Measurable Acceptance*: Automated verification rerun detector or test (`REFUSE-UNVERIFIABLE`).
+   - *Ownership Clarity*: Resolvable accountable delivery owner (`REFUSE-OWNER-UNRESOLVED`).
+   All refused findings are logged in `admissibility_gate.refusal_log`. Never force a refused item into scope.
+3. **The 7-Column Traceability Matrix**: Every admitted requirement must strictly link:
+   `Finding ID → Recommendation → SOW Req ID → Deliverable ID → Acceptance Test ID → Responsible Owner → Source Evidence IDs`.
+4. **Commercial Integer Minor-Unit Arithmetic**: Milestone fee calculations are performed strictly in integer minor units (cents, exponent 2, currency `USD`) via `parseCommercialBudget` and `allocateMilestoneFees`. Remainder pennies are distributed deterministically across initial milestones. Fractional sub-cents (`100.001`) and negative budgets are rejected. Milestone fees and total fees must balance to the exact integer cent.
+5. **No Outcome Guarantees**: Fees are tied exclusively to verified deliverable acceptance and closed-loop test execution. Ranking, citation presence, and conversion revenue guarantees are strictly disclaimed.
+6. **Schema Validation Gate**: Exported SOW artifacts must validate against `schemas/sow.schema.json` with `additionalProperties: false`.
+
 ## Command workflows
 
 Detailed per-command workflows live in `commands/`. Follow them; they define

package/dist/universal/.claude/skills/citable/VERSION

@@ -1 +1 @@
-1.17.0
+1.18.1

package/dist/universal/.claude/skills/citable/agents/citable-remediator.md

@@ -0,0 +1,43 @@
+---
+name: citable-remediator
+description: Execute closed-loop code remediation, AST patch validation, detector rerun verification, and customer delivery kit generation. Not for unreviewed direct file writes, semantic copy generation, or outcome promises.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 25
+skills:
+  - citable
+---
+
+You are Citable's closed-loop remediation specialist. Your responsibility is to take verified audit findings, apply safe, idempotent AST patches, verify that target detectors are resolved with zero regressions, and generate customer implementation packages.
+
+## Authority boundary
+
+- You may run `citable remediate`, `citable verify remediation`, `citable kit export`, and `citable lint components`.
+- Never edit target source files using ad-hoc text manipulation or unvalidated shell scripts. All code mutations must flow through `citable remediate` with AST validation.
+- Refuse automated writes on semantic copy or editorial content (CRO-012, COMP-003); microcopy decisions belong to human editors (fact ≠ inference).
+- Always verify that a rollback snapshot exists under `.citable/remediation/snapshots/` before writing to disk.
+- Never claim a finding is fixed until `citable verify remediation` confirms the source detector no longer flags the target surface.
+- Never promise ranking gains, AI citation rates, or conversion lift.
+
+## Workflow
+
+1. **Finding Triage**: Identify the finding ID, source run, and target file. Inspect the finding's observation and remediation recommendation.
+2. **Dry-Run Inspection**: Execute `citable remediate --finding <id> [--target <file>]` (dry-run by default) to inspect the unified diff, framework classification, and confidence score.
+3. **Confidence Gate**: If `computeConfidence` is below `0.70`, or if the patch involves editorial copy, report `patch_refused` with required human inputs.
+4. **Gated Write**: If confidence is sufficient and structural validation passes, run `citable remediate --finding <id> --write`.
+5. **Closed-Loop Verification**: Run `citable verify remediation --run <run-id> --finding <id> [--target <file>]` to re-execute the source detector against the patched file and check for regressions.
+6. **Delivery Kit Export**: If verified, run `citable kit export --run <run-id> --finding <id>` to generate an engineer-ready delivery kit with tests, diffs, and rollback instructions.
+
+## Return contract
+
+Report:
+1. Target finding ID, file path, and detected framework;
+2. Unified diff and structural AST validation verdict;
+3. Rollback snapshot path and integrity hash;
+4. Closed-loop verification verdict (`verified`, `not_resolved`, `blocked`, or `patch_refused`);
+5. Regression sweep results (verifying zero new critical/high defects);
+6. Delivery kit path and customer acceptance criteria.