@nebulacomponents/citable 1.18.0 → 1.18.1

package/dist/universal/.kiro/skills/citable/schemas/sow.schema.json

@@ -6,87 +6,404 @@
   "required": [
     "sow_id",
     "version",
+    "generation_mode",
     "title",
     "client",
     "supplier",
     "effective_date",
+    "term_days",
+    "currency",
+    "currency_minor_unit_exponent",
+    "commercial_total_fee_minor",
+    "commercial_total_fee_usd",
     "executive_scope",
     "admissibility_gate",
     "work_packages",
     "deliverables",
     "acceptance_criteria",
-    "traceability_matrix"
+    "traceability_matrix",
+    "generation_provenance"
   ],
   "properties": {
-    "sow_id": { "type": "string" },
+    "$schema": { "type": "string" },
+    "sow_id": { "type": "string", "pattern": "^SOW-[A-Za-z0-9_-]+$" },
     "version": { "type": "string" },
-    "title": { "type": "string" },
+    "generation_mode": {
+      "type": "string",
+      "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"]
+    },
+    "title": { "type": "string", "minLength": 1 },
+    "synthetic_evidence": { "type": "boolean" },
     "client": {
       "type": "object",
       "required": ["name", "contact"],
       "properties": {
-        "name": { "type": "string" },
-        "contact": { "type": "string" }
-      }
+        "name": { "type": "string", "minLength": 1 },
+        "contact": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
     },
     "supplier": {
       "type": "object",
       "required": ["name", "contact"],
       "properties": {
-        "name": { "type": "string" },
-        "contact": { "type": "string" }
-      }
+        "name": { "type": "string", "minLength": 1 },
+        "contact": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
     },
     "effective_date": { "type": "string" },
-    "term_days": { "type": "integer" },
+    "term_days": { "type": "integer", "minimum": 1 },
+    "currency": { "type": "string", "enum": ["USD"] },
+    "currency_minor_unit_exponent": { "type": "integer", "enum": [2] },
+    "commercial_total_fee_minor": { "type": "integer", "minimum": 0 },
+    "commercial_total_fee_usd": { "type": "number", "minimum": 0 },
     "executive_scope": {
       "type": "object",
       "required": ["business_objective", "in_scope_properties", "in_scope_systems"],
       "properties": {
-        "business_objective": { "type": "string" },
+        "business_objective": { "type": "string", "minLength": 1 },
         "in_scope_properties": { "type": "array", "items": { "type": "string" } },
         "in_scope_systems": { "type": "array", "items": { "type": "string" } },
         "channels": { "type": "array", "items": { "type": "string" } },
-        "geographies": { "type": "array", "items": { "type": "string" } }
-      }
+        "geographies": { "type": "array", "items": { "type": "string" } },
+        "organizational_boundaries": { "type": "string" }
+      },
+      "additionalProperties": false
     },
     "admissibility_gate": {
       "type": "object",
-      "required": ["total_findings_evaluated", "admitted_count", "refused_count"],
+      "required": ["total_findings_evaluated", "admitted_count", "refused_count", "admissibility_rate_pct", "refusal_log"],
+      "properties": {
+        "total_findings_evaluated": { "type": "integer", "minimum": 0 },
+        "admitted_count": { "type": "integer", "minimum": 0 },
+        "refused_count": { "type": "integer", "minimum": 0 },
+        "admissibility_rate_pct": { "type": "integer", "minimum": 0, "maximum": 100 },
+        "refusal_log": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["finding_id", "subject", "gate_failed", "refusal_code", "refusal_rationale"],
+            "properties": {
+              "finding_id": { "type": "string" },
+              "detector_id": { "type": "string" },
+              "subject": { "type": "string" },
+              "gate_failed": { "type": "string" },
+              "refusal_code": { "type": "string" },
+              "refusal_rationale": { "type": "string" },
+              "suggested_handling": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        },
+        "methodology": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "assumptions_and_constraints": {
+      "type": "object",
+      "required": ["assumptions", "dependencies", "exclusions", "constraints", "unresolved_unknowns"],
+      "properties": {
+        "assumptions": { "type": "array", "items": { "type": "string" } },
+        "dependencies": { "type": "array", "items": { "type": "string" } },
+        "exclusions": { "type": "array", "items": { "type": "string" } },
+        "constraints": { "type": "array", "items": { "type": "string" } },
+        "unresolved_unknowns": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "work_packages": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["work_package_id", "name", "deliverable_id", "owner", "requirements"],
+        "properties": {
+          "work_package_id": { "type": "string" },
+          "name": { "type": "string" },
+          "deliverable_id": { "type": "string" },
+          "owner": { "type": "string" },
+          "requirements": { "type": "array", "minItems": 1 }
+        },
+        "additionalProperties": false
+      }
+    },
+    "deliverables": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["deliverable_id", "work_package_id", "title", "artifact_type", "format", "owner", "delivery_criteria"],
+        "properties": {
+          "deliverable_id": { "type": "string" },
+          "work_package_id": { "type": "string" },
+          "title": { "type": "string" },
+          "artifact_type": { "type": "string" },
+          "format": { "type": "string" },
+          "owner": { "type": "string" },
+          "delivery_criteria": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "technical_requirements": {
+      "type": "object",
+      "properties": {
+        "supported_frameworks": { "type": "array", "items": { "type": "string" } },
+        "git_branching_model": { "type": "string" },
+        "rollback_mechanism": { "type": "string" },
+        "access_requirements": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "acceptance_criteria": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["acceptance_test_id", "sow_requirement_id", "test_description", "validation_method", "pass_threshold", "evidence_required"],
+        "properties": {
+          "acceptance_test_id": { "type": "string" },
+          "sow_requirement_id": { "type": "string" },
+          "test_description": { "type": "string" },
+          "validation_method": { "type": "string" },
+          "pass_threshold": { "type": "string" },
+          "evidence_required": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "baseline_and_target_metrics": {
+      "type": "object",
+      "properties": {
+        "disclaimer": { "type": "string" },
+        "metrics": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["metric", "baseline", "target", "validation"],
+            "properties": {
+              "metric": { "type": "string" },
+              "baseline": { "type": "string" },
+              "target": { "type": "string" },
+              "validation": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "experiment_specifications": {
+      "type": "object",
+      "properties": {
+        "standard": { "type": "string" },
+        "stopping_criteria": { "type": "string" },
+        "guardrails": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "raci_matrix": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["role", "r", "raci"],
+        "properties": {
+          "role": { "type": "string" },
+          "r": { "type": "string" },
+          "raci": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "customer_obligations": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "delivery_schedule": {
+      "type": "object",
+      "required": ["total_duration_weeks", "milestones"],
+      "properties": {
+        "total_duration_weeks": { "type": "integer", "minimum": 1 },
+        "milestones": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["milestone_id", "work_package_id", "name", "fee_minor", "fee_usd", "billing_trigger", "target_delivery_week"],
+            "properties": {
+              "milestone_id": { "type": "string" },
+              "work_package_id": { "type": "string" },
+              "name": { "type": "string" },
+              "fee_minor": { "type": "integer", "minimum": 0 },
+              "fee_usd": { "type": "number", "minimum": 0 },
+              "billing_trigger": { "type": "string" },
+              "target_delivery_week": { "type": "integer", "minimum": 1 }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "change_control_process": {
+      "type": "object",
       "properties": {
-        "total_findings_evaluated": { "type": "integer" },
-        "admitted_count": { "type": "integer" },
-        "refused_count": { "type": "integer" },
-        "refusal_log": { "type": "array" }
+        "procedure": { "type": "string" },
+        "authorization": { "type": "string" },
+        "superceding_rules": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "risk_register": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "category", "description", "mitigation"],
+        "properties": {
+          "id": { "type": "string" },
+          "category": { "type": "string" },
+          "description": { "type": "string" },
+          "mitigation": { "type": "string" }
+        },
+        "additionalProperties": false
       }
     },
-    "work_packages": { "type": "array" },
-    "deliverables": { "type": "array" },
-    "acceptance_criteria": { "type": "array" },
+    "data_governance": {
+      "type": "object",
+      "properties": {
+        "authorized_sources": { "type": "array", "items": { "type": "string" } },
+        "retention_period": { "type": "string" },
+        "processing_purpose": { "type": "string" },
+        "deletion_upon_termination": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "security_requirements": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "platform_dependencies": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "qa_plan": {
+      "type": "object",
+      "properties": {
+        "methodology": { "type": "string" },
+        "evidence_package": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "governance_model": {
+      "type": "object",
+      "properties": {
+        "weekly_sync": { "type": "string" },
+        "written_reports": { "type": "string" },
+        "decision_logging": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "commercial_terms": {
+      "type": "object",
+      "required": ["total_fixed_fee_minor", "total_fixed_fee_usd", "currency", "payment_terms", "milestones"],
+      "properties": {
+        "total_fixed_fee_minor": { "type": "integer", "minimum": 0 },
+        "total_fixed_fee_usd": { "type": "number", "minimum": 0 },
+        "currency": { "type": "string", "enum": ["USD"] },
+        "payment_terms": { "type": "string" },
+        "milestones": { "type": "array" }
+      },
+      "additionalProperties": false
+    },
+    "out_of_scope": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "warranty_terms": {
+      "type": "object",
+      "properties": {
+        "warranty_window_days": { "type": "integer", "minimum": 0 },
+        "defect_definition": { "type": "string" },
+        "exclusion": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "completion_and_handoff": {
+      "type": "object",
+      "properties": {
+        "handoff_assets": { "type": "array", "items": { "type": "string" } },
+        "operational_signoff": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "termination_provisions": {
+      "type": "object",
+      "properties": {
+        "convenience": { "type": "string" },
+        "compensation": { "type": "string" },
+        "asset_transfer": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
     "traceability_matrix": {
       "type": "array",
+      "minItems": 1,
       "items": {
         "type": "object",
         "required": [
           "finding_id",
           "recommendation",
           "sow_requirement_id",
+          "work_package_id",
           "deliverable_id",
           "acceptance_test_id",
           "owner",
-          "evidence_id"
+          "evidence_id",
+          "evidence_ids"
         ],
         "properties": {
           "finding_id": { "type": "string" },
+          "detector_id": { "type": "string" },
           "recommendation": { "type": "string" },
           "sow_requirement_id": { "type": "string" },
           "work_package_id": { "type": "string" },
           "deliverable_id": { "type": "string" },
           "acceptance_test_id": { "type": "string" },
           "owner": { "type": "string" },
-          "evidence_id": { "type": "string" }
-        }
+          "owner_source": { "type": "string" },
+          "owner_mapping_version": { "type": "string" },
+          "evidence_id": { "type": "string" },
+          "evidence_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+          "severity": { "type": "string" },
+          "target_subject": { "type": "string" },
+          "acceptance_criteria": { "type": "string" }
+        },
+        "additionalProperties": false
       }
+    },
+    "generation_provenance": {
+      "type": "object",
+      "required": [
+        "generated_at",
+        "generator_version",
+        "generation_mode",
+        "source_type",
+        "source_findings_count",
+        "synthetic_evidence"
+      ],
+      "properties": {
+        "generated_at": { "type": "string" },
+        "generator_version": { "type": "string" },
+        "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
+        "source_type": { "type": "string" },
+        "source_identifier": { "type": ["string", "null"] },
+        "source_findings_count": { "type": "integer", "minimum": 0 },
+        "findings_integrity_hash": { "type": ["string", "null"] },
+        "synthetic_evidence": { "type": "boolean" }
+      },
+      "additionalProperties": false
     }
-  }
+  },
+  "additionalProperties": false
 }

package/dist/universal/.opencode/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.18.0
+version: 1.18.1
 ---
 
 # Citable — evidence and change control for search and AI citation readiness
@@ -259,6 +259,27 @@ The CRO suite completes the loop. Rules that govern every step:
    payload in the `citable_output_schema` 1.0 envelope
    (`schemas/cli-output-envelope.schema.json`).
 
+## Enterprise SOW & governance protocol (findings → admissibility → traceability → contract)
+
+The SOW engine (`citable sow generate`, `citable sow validate`) translates verified audit findings into legally enforceable enterprise Statements of Work:
+
+1. **Authoritative Evidence Gating**: A contractual SOW requires verified audit findings from `--run <id>` or a live target. Never invent or synthesize findings in `CONTRACTUAL` or `DRAFT` modes; missing findings fail closed (`NoFindingsError`). Synthetic baseline findings are strictly confined to `--sample` / `--demo`.
+2. **Scope Admissibility Filter**: Audit findings do not automatically become contractual obligations. Every candidate finding must pass 7 objective gates:
+   - *Exclusion Gate*: No explicitly blacklisted detectors (`REFUSE-EXCLUDED`).
+   - *Discipline Authorization*: Finding discipline must be authorized in engagement terms (`REFUSE-DISCIPLINE-NOT-AUTHORIZED`).
+   - *Evidence Maturity*: Deterministic/observed confidence with real evidence (`REFUSE-EXPERIMENTAL`, `REFUSE-NO-EVIDENCE`).
+   - *Scope Boundary*: URL matches contracted origins, hosts, or paths (`REFUSE-OUT-OF-SCOPE`).
+   - *Technical Feasibility*: Reject legal, trademark, GDPR, or unfeasible remediation (`REFUSE-UNFEASIBLE-REMEDIATION`).
+   - *Commercial Materiality*: High severity or ICE score >= min threshold (`REFUSE-LOW-MATERIALITY`).
+   - *Measurable Acceptance*: Automated verification rerun detector or test (`REFUSE-UNVERIFIABLE`).
+   - *Ownership Clarity*: Resolvable accountable delivery owner (`REFUSE-OWNER-UNRESOLVED`).
+   All refused findings are logged in `admissibility_gate.refusal_log`. Never force a refused item into scope.
+3. **The 7-Column Traceability Matrix**: Every admitted requirement must strictly link:
+   `Finding ID → Recommendation → SOW Req ID → Deliverable ID → Acceptance Test ID → Responsible Owner → Source Evidence IDs`.
+4. **Commercial Integer Minor-Unit Arithmetic**: Milestone fee calculations are performed strictly in integer minor units (cents, exponent 2, currency `USD`) via `parseCommercialBudget` and `allocateMilestoneFees`. Remainder pennies are distributed deterministically across initial milestones. Fractional sub-cents (`100.001`) and negative budgets are rejected. Milestone fees and total fees must balance to the exact integer cent.
+5. **No Outcome Guarantees**: Fees are tied exclusively to verified deliverable acceptance and closed-loop test execution. Ranking, citation presence, and conversion revenue guarantees are strictly disclaimed.
+6. **Schema Validation Gate**: Exported SOW artifacts must validate against `schemas/sow.schema.json` with `additionalProperties: false`.
+
 ## Command workflows
 
 Detailed per-command workflows live in `commands/`. Follow them; they define

package/dist/universal/.opencode/skills/citable/VERSION

@@ -1 +1 @@
-1.18.0
+1.18.1

package/dist/universal/.opencode/skills/citable/agents/citable-remediator.md

@@ -0,0 +1,43 @@
+---
+name: citable-remediator
+description: Execute closed-loop code remediation, AST patch validation, detector rerun verification, and customer delivery kit generation. Not for unreviewed direct file writes, semantic copy generation, or outcome promises.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 25
+skills:
+  - citable
+---
+
+You are Citable's closed-loop remediation specialist. Your responsibility is to take verified audit findings, apply safe, idempotent AST patches, verify that target detectors are resolved with zero regressions, and generate customer implementation packages.
+
+## Authority boundary
+
+- You may run `citable remediate`, `citable verify remediation`, `citable kit export`, and `citable lint components`.
+- Never edit target source files using ad-hoc text manipulation or unvalidated shell scripts. All code mutations must flow through `citable remediate` with AST validation.
+- Refuse automated writes on semantic copy or editorial content (CRO-012, COMP-003); microcopy decisions belong to human editors (fact ≠ inference).
+- Always verify that a rollback snapshot exists under `.citable/remediation/snapshots/` before writing to disk.
+- Never claim a finding is fixed until `citable verify remediation` confirms the source detector no longer flags the target surface.
+- Never promise ranking gains, AI citation rates, or conversion lift.
+
+## Workflow
+
+1. **Finding Triage**: Identify the finding ID, source run, and target file. Inspect the finding's observation and remediation recommendation.
+2. **Dry-Run Inspection**: Execute `citable remediate --finding <id> [--target <file>]` (dry-run by default) to inspect the unified diff, framework classification, and confidence score.
+3. **Confidence Gate**: If `computeConfidence` is below `0.70`, or if the patch involves editorial copy, report `patch_refused` with required human inputs.
+4. **Gated Write**: If confidence is sufficient and structural validation passes, run `citable remediate --finding <id> --write`.
+5. **Closed-Loop Verification**: Run `citable verify remediation --run <run-id> --finding <id> [--target <file>]` to re-execute the source detector against the patched file and check for regressions.
+6. **Delivery Kit Export**: If verified, run `citable kit export --run <run-id> --finding <id>` to generate an engineer-ready delivery kit with tests, diffs, and rollback instructions.
+
+## Return contract
+
+Report:
+1. Target finding ID, file path, and detected framework;
+2. Unified diff and structural AST validation verdict;
+3. Rollback snapshot path and integrity hash;
+4. Closed-loop verification verdict (`verified`, `not_resolved`, `blocked`, or `patch_refused`);
+5. Regression sweep results (verifying zero new critical/high defects);
+6. Delivery kit path and customer acceptance criteria.

package/dist/universal/.opencode/skills/citable/agents/citable-sow-architect.md

@@ -0,0 +1,43 @@
+---
+name: citable-sow-architect
+description: Generate contractually enforceable Statements of Work, evaluate Scope Admissibility Gates, enforce 7-column evidence traceability, and compile enterprise search/CRO intelligence briefings. Not for fabricated findings, unevidenced scope, or commercial guarantees.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 25
+skills:
+  - citable
+---
+
+You are Citable's enterprise engagement and SOW architect. Your responsibility is to transform empirical audit findings into contractually enforceable, evidence-traceable Statements of Work (SOWs) and split executive intelligence briefings.
+
+## Authority boundary
+
+- You may run `citable sow generate`, `citable sow validate`, `citable report search`, `citable report cro`, and read audit runs.
+- Never synthesize or hallucinate findings in `CONTRACTUAL` mode. If audit evidence is missing, fail closed and report `NO_FINDINGS`. Synthetic findings are strictly confined to `--sample` / `--demo`.
+- Never force an unqualified finding through the Admissibility Gate. Refused findings must be preserved in `admissibility_gate.refusal_log` with standard refusal codes.
+- Enforce integer minor-unit arithmetic (cents, exponent 2, currency `USD`) for all fees. Never allow fractional pennies or budget drift across milestones.
+- Strictly uphold Citable governance principles: **no search engine crawling, indexation, ranking, AI answer citation, or conversion revenue is guaranteed**. Fees are bound exclusively to verified deliverable acceptance.
+
+## Workflow
+
+1. **Source Evidence Resolution**: Determine the authoritative evidence source: explicit run (`--run <id>`), live scan (`--target <url>`), or sample demonstration (`--sample`). Explicit `--run` takes precedence.
+2. **Admissibility Gating**: Evaluate findings through the 7 admissibility gates (maturity, boundary, feasibility, materiality, acceptance, ownership, discipline). Record refused items in the contractual refusal log.
+3. **Traceability Binding**: Construct the 7-column matrix ensuring every requirement links: Finding ID → Recommendation → SOW Requirement ID → Deliverable ID → Acceptance Test ID → Owner → Source Evidence.
+4. **Commercial Minor-Unit Calculation**: Allocate milestone fees using integer minor units (`commercial_total_fee_minor`) with deterministic penny remainder distribution.
+5. **Contractual Export**: Generate SOW artifacts in Markdown, HTML, or JSON (`citable sow generate`).
+6. **Integrity Validation**: Run `citable sow validate <sow.json>` to verify strict schema conformance against `schemas/sow.schema.json` and cross-object runtime invariants.
+7. **Companion Briefings**: If executive reporting is requested, generate the companion 19-pillar Search Intelligence Briefing (`citable report search`) or 25-pillar CRO Briefing (`citable report cro`).
+
+## Return contract
+
+Report:
+1. SOW ID, generation mode (`CONTRACTUAL`, `DRAFT`, `NON_CONTRACTUAL_SAMPLE`), and generator provenance;
+2. Commercial total value, currency (`USD`), minor units, and milestone fee schedule;
+3. Admissibility gate statistics: total findings, admitted count, refused count, and refusal codes;
+4. 7-column Traceability Matrix summary;
+5. Schema validation verdict against `schemas/sow.schema.json`;
+6. Output artifact paths (Markdown, HTML, JSON).

package/dist/universal/.opencode/skills/citable/commands/README.md

@@ -42,6 +42,19 @@ intent, not executability, so statuses are strict:
 | /citable validate-render | partially implemented by `observe render`; fixed Chromium profiles and schema-validated Chromium/Firefox/WebKit journeys are implemented, while reviewed semantic-impact detectors and reusable application-specific journey libraries remain |
 | /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | partially implemented by metric/observation imports, objective evaluation, Google/CrUX live APIs, custom citation adapters, and monitor comparisons |
 | `citable artifacts export/verify/import` | implemented — portable, versioned, checksum-bound run interchange without hosted-service authority |
+| /citable sow generate / validate | implemented — 25-pillar SOW with 7-gate admissibility, 7-column traceability matrix, and integer minor-unit arithmetic (sow.md) |
+| /citable report search / cro | implemented — split 19-pillar Search and 25-pillar CRO executive briefings with observation vs hypothesis vs causation taxonomy (reporting.md) |
+| /citable sweep technical | implemented — static Core Web Vitals readiness analysis (LCP, INP, CLS) |
+| /citable inspect eeat / inspect readiness | implemented — on-page 0-5 E-E-A-T rubric scoring and multi-answer-engine readiness (Perplexity, Copilot, ChatGPT) |
+| /citable audit backlinks | implemented — off-page authority assessment, toxic TLD detection, and disavow generator |
+| /citable prioritize matrix | implemented — Impact / Effort / Confidence (ICE) scoring matrix for findings |
+| /citable roadmap strategic / cro roadmap | implemented — 30/90/180-day milestone implementation roadmaps |
+| /citable cro / cro backlog | implemented — conversion path continuity, message match, cognitive friction, and falsifiable experiment backlog |
+| /citable remediate / verify remediation / kit export | implemented — framework detection, idempotent AST patches, confidence gate, detector rerun verification, and customer delivery kits (remediation.md) |
+| /citable check experiment | implemented — sample-ratio mismatch (SRM), early stopping, and statistical power guardrails |
+| /citable test visual / preview cro | implemented — visual layout contract testing and accessibility-aware preview sandbox |
+| /citable compatibility | implemented — pre-flight runtime, dependency, framework, and edge worker diagnostics |
+| /citable corpus benchmark | implemented — golden benchmark corpus evaluation with per-detector precision/recall gates |
 
 Shared refusal conditions (all commands): any action that would fabricate
 facts, citations, evidence, authorship, reviews, corroboration, or hidden

package/dist/universal/.opencode/skills/citable/commands/remediation.md

@@ -0,0 +1,55 @@
+---
+command: /citable remediate --finding <id> [--target <file>] [--write]
+purpose: Apply safe, validated AST code patches for deterministic defects with automated rollback snapshots, structural syntax validation, and confidence gating.
+preconditions: [valid finding from audit run; target source file identified and writeable]
+failure_behaviour: unknown framework -> fail closed; invalid syntax after patch -> rollback and refuse; confidence < 0.7 -> refuse write; semantic microcopy changes -> always refuse automated write (human editorial decision required)
+artifacts_created: [.citable/remediation/snapshots/<snapshot-id>/, unified diff on stdout]
+---
+
+# Closed-Loop Code Remediation & Verification
+
+The remediation suite provides safe, gated code fixes for deterministic technical, schema, and CRO defects discovered during audits. It bridges the gap between audit findings and customer-verified pull requests.
+
+## 1. Safe Patch Application (`citable remediate`)
+
+1. **Framework Detection**: Identifies target source syntax (`jsx`, `tsx`, `vue`, `html`). Fails closed on unknown or ambiguous frameworks.
+2. **Idempotent AST Patching**: Patches are mathematically verified to be idempotent (`applyPatchDetailed`): applying the patch a second time produces an identical AST (a fixed point).
+3. **Structural Validation Gate**: Runs `validatePatchedSource` to confirm that the patch does not break AST structure, introduce syntax errors, or alter unrelated code blocks.
+4. **Confidence Threshold**: Computes an explicit multi-factor confidence score (`computeConfidence`). `--write` is refused if confidence falls below `0.70`.
+5. **Editorial Boundary (Semantic Microcopy Refusal)**: Automated `--write` is strictly refused for semantic copy, CTA wording, or headline changes (e.g. `CRO-012`, `COMP-003`). Microcopy is a human editorial and brand judgment (fact ≠ inference).
+6. **Rollback Snapshot**: Every `--write` automatically snapshots the target file under `.citable/remediation/snapshots/<timestamp>/` with a SHA-256 manifest before making any disk modifications.
+
+## 2. Closed-Loop Verification (`citable verify remediation`)
+
+Running a patch is NOT proof that a defect is resolved:
+
+```bash
+citable verify remediation --run <run-id> --finding <id> [--target <file>] [--apply]
+```
+
+1. **Deterministic Detector Rerun**: Re-executes the exact source detector (`detector_to_rerun`) against the patched target.
+2. **Regression Sweep**: Sweeps for newly introduced critical or high severity defects compared to the baseline run.
+3. **Verification Envelopes**: Emits a checksum-bound before/after verification envelope conforming to `schemas/remediation-verification.schema.json`.
+4. **Verdict Classification**:
+   * `verified`: Target detector no longer reports the defect; zero regressions introduced.
+   * `not_resolved`: Target detector still detects the condition on the patched surface.
+   * `blocked`: Prerequisite dependencies, build tools, or environments unavailable.
+   * `patch_refused`: Confidence below threshold, semantic copy gated, or syntax check failed.
+5. **Outcome Boundary**: Resolution means the detector no longer flags the subject — **it is never an outcome guarantee of rankings, AI citations, or conversion lift**.
+
+## 3. Customer Implementation Kits (`citable kit export`)
+
+Produce an engineer-ready delivery kit for customer development teams:
+
+```bash
+citable kit export --run <run-id> --finding <id> [--target <file>]
+```
+
+Creates a self-contained directory containing:
+* Verbatim finding with evidence lineage.
+* Exact unified diff for code review.
+* Reusable Nebula design system component template (React / Vue / HTML).
+* Rendering-evidence manifest (real captured DOM/visual state; synthetic evidence forbidden).
+* Acceptance test criteria and re-audit verification script.
+* Deployment and rollback instructions.
+* Explicit technical limitations and non-guarantee disclosures.