@nebulacomponents/citable 1.18.0 → 1.18.1

package/skill/commands/reporting.md

@@ -71,3 +71,31 @@ any observed change to a specific intervention.
    authoritative index guarantees. Divergences are reported as factual observations,
    never fabricated or interpolated.
 
+# Enterprise Search Intelligence Briefing (`citable report search`)
+
+1. Run `citable report search [--target <dir|url>] [--run <id>] [--format md|html|json] [--output <file>]`
+   to generate the 19-pillar Executive Search Intelligence Briefing.
+2. Synthesizes technical crawlability, indexation, Core Web Vitals readiness,
+   AEO answer-extractability, GEO citation frequency, knowledge graph schema
+   architecture, and competitor SERP landscape into an executive document.
+3. Every recommendation binds to a verified finding in the Evidence Register.
+4. Facts and inferences are strictly segregated: deterministic observations are
+   reported in green data panels; strategic hypotheses and inferences are explicitly
+   labeled with confidence ratings.
+5. Refusal boundary: Never promises rankings, algorithmic immunity, or indexing
+   guarantees.
+
+# Enterprise CRO & Customer Journey Briefing (`citable report cro`)
+
+1. Run `citable report cro [--target <dir|url>] [--input <file>] [--format md|html|json] [--output <file>]`
+   to generate the 25-pillar Executive Conversion & Customer Journey Briefing.
+2. Covers end-to-end conversion paths: above-the-fold clarity, message-match
+   scoring, cognitive load, checkout friction, trust and objection analysis, offer
+   architecture, and prioritized A/B experiment blueprints.
+3. Strictly adheres to the **Observation vs Hypothesis vs Causation** taxonomy:
+   - **Observations**: Verbatim DOM defects (e.g. missing autocomplete, undersized touch targets).
+   - **Hypotheses**: Falsifiable experiment statements with measurable primary metrics and guardrails.
+   - **Causation**: Statistical lift attribution requiring concluded, SRM-clean A/B experiments.
+4. Refusal boundary: Revenue lift, conversion percentage improvements, and visual
+   saliency scores are modeled heuristic indices, never observed behavior or guaranteed revenue.
+

package/skill/commands/sow.md

@@ -0,0 +1,95 @@
+---
+command: /citable sow generate [--target <dir|url>] [--run <id>] [--budget <amount>] [--budget-minor <cents>] [--format md|html|json] [--output <path>] [--sample] [--draft]
+purpose: Generate a contractually binding, evidence-traceable enterprise Statement of Work (SOW) from verified audit findings through a formal 7-gate scope admissibility filter and 7-column traceability matrix.
+preconditions: [at least one finalized audit run with verified findings or live target; sample mode required for synthetic demonstrations]
+failure_behaviour: absent or unverified findings in contractual mode -> NoFindingsError; all findings refused -> NoAdmissibleRequirementsError; non-existent run -> RunNotFoundError; negative or sub-cent budget -> BudgetCalculationError; invariant drift -> SowInvariantError
+artifacts_created: [SOW.md, SOW.html, or SOW.json at specified output path]
+---
+
+# Enterprise Statement of Work (SOW) Contract
+
+The `citable sow` command generates enterprise-grade, evidence-backed Statements of Work derived from verified technical SEO, AEO, GEO, schema, and CRO audit findings. It establishes rigid, downward traceability:
+
+```text
+Evidence (observation envelope)
+  ↓
+Observation (deterministic DOM / HTTP probe)
+  ↓
+Finding (verified defect / friction)
+  ↓
+Recommendation (governed remediation)
+  ↓
+SOW Requirement (contractual scope)
+  ↓
+Deliverable (code patch / AST modification)
+  ↓
+Acceptance Test (automated closed-loop detector rerun)
+```
+
+## 1. Operating Premises & Commercial Disclaimers
+
+1. **Fee Binding**: Supplier fees are bound exclusively to verified deliverable acceptance and closed-loop test execution.
+2. **Strict Outcome Disclaimers**: In strict compliance with Citable governance principles, **no search engine crawling, indexation, ranking, AI answer citation, or conversion revenue is guaranteed**.
+3. **No Synthetic Data in Contracts**: Attempting to generate a `CONTRACTUAL` SOW without verified empirical findings immediately fails closed with `NoFindingsError`. Synthetic findings are strictly confined to `--sample` / `--demo`.
+
+## 2. The Scope Admissibility Gate
+
+Audit findings do NOT automatically become contractual obligations. Every candidate finding must pass 7 admissibility gates:
+
+| Gate | Verification Check | Failure Refusal Code | Contractual Handling |
+| :--- | :--- | :--- | :--- |
+| **1. Exclusion Gate** | Check against explicit excluded detectors list | `REFUSE-EXCLUDED` | Track in internal backlog; execute under separate advisory engagement. |
+| **2. Discipline Authorization** | Check if discipline is authorized under contract | `REFUSE-DISCIPLINE-NOT-AUTHORIZED` | Expand authorized disciplines in SOW engagement terms or contract under separate SOW. |
+| **3. Evidence Maturity** | Require deterministic/observed confidence & evidence | `REFUSE-EXPERIMENTAL` / `REFUSE-NO-EVIDENCE` | Run controlled observation probes before considering for contractual obligation. |
+| **4. Scope Boundary** | Verify URL matches authorized host, subdomain, or path | `REFUSE-OUT-OF-SCOPE` | Escalate domain ownership verification or expand contractual executive scope. |
+| **5. Feasibility Gate** | Reject legal, trademark, GDPR, or unfeasible remediation | `REFUSE-UNFEASIBLE-REMEDIATION` | Refer to specialized legal or compliance counsel outside scope. |
+| **6. Materiality Gate** | Require critical/high severity or ICE score >= threshold | `REFUSE-LOW-MATERIALITY` | Log to internal product maintenance backlog; omit from high-value SOW. |
+| **7. Acceptance Gate** | Require automated rerun detector or objective pass/fail test | `REFUSE-UNVERIFIABLE` | Define deterministic verification criteria before adding to scope. |
+| **8. Ownership Clarity** | Resolve accountable owner from finding or role mappings | `REFUSE-OWNER-UNRESOLVED` | Specify delivery_owner on finding or map discipline to accountable role. |
+
+All refused findings are recorded in the SOW's `admissibility_gate.refusal_log` with standard refusal codes and contractual handling guidance.
+
+## 3. The 7-Column Traceability Matrix
+
+Every admitted requirement must satisfy complete 7-column bidirectional traceability:
+
+1. **Finding ID**: Verbatim identifier of the empirical defect (e.g. `F-TECH-001`).
+2. **Recommendation**: Governed, safe remediation instruction.
+3. **SOW Requirement ID**: Contractual clause identifier (`REQ-SOW-001`).
+4. **Deliverable ID**: Accountable work package deliverable (`DELIV-01`).
+5. **Acceptance Test ID**: Automated closed-loop test (`ACC-TEST-001`).
+6. **Responsible Owner**: Named lead dev, architect, or agency practice owner.
+7. **Source Evidence IDs**: Array of cryptographic observation IDs (`['EVD-CWV-001']`).
+
+## 4. Commercial Currency & Minor-Unit Semantics
+
+To eliminate commercial fee drift and rounding leaks, all internal calculations use exact **integer minor units (cents, exponent 2, currency `USD`)**:
+
+* `currency`: Declared as `USD`.
+* `currency_minor_unit_exponent`: Declared as `2`.
+* `commercial_total_fee_minor`: Integer cents (e.g. `$50,000.00` = `5000000` cents).
+* `milestones[].fee_minor`: Integer floor allocation across milestones with remainder pennies distributed deterministically to initial milestones.
+* `commercial_total_fee_usd` / `milestones[].fee_usd`: Derived dollar representation formatted at presentation boundaries (`$33.34`, `$50,000`).
+* Sub-cent fractional budgets (`100.001`) and negative budgets are strictly rejected.
+
+## 5. Generation Modes & Machine-Readable Provenance
+
+Every generated SOW embeds an immutable `generation_provenance` block:
+
+* **`CONTRACTUAL`**: Generated from verified historical run findings or live target; synthetic evidence forbidden.
+* **`DRAFT`**: Generated with preliminary scope or unfinalized commercial terms; requires executive sign-off.
+* **`NON_CONTRACTUAL_SAMPLE`**: Generated with synthetic baseline findings strictly for evaluation/demo (`--sample`).
+
+Provenance tracks:
+* `generator_version`: Exact Citable semver.
+* `generated_at`: ISO 8601 timestamp.
+* `source_type`: `HISTORICAL_RUN`, `LIVE_INSPECTION`, `DIRECT_FINDINGS`, or `SAMPLE_BASELINE`.
+* `source_identifier`: Target URL, run ID, or sample identifier.
+* `source_findings_count`: Integer count of evaluated findings.
+* `findings_integrity_hash`: SHA-256 hash of input findings.
+
+## 6. SOW Verification Command
+
+Run `citable sow validate <sow.json>` to verify:
+1. Strict schema compliance against `schemas/sow.schema.json` (`additionalProperties: false`).
+2. Cross-object invariants via `validateSowInvariants` (fee balancing, work package and deliverable parity, non-empty evidence links).

package/src/commands/sowCmd.js

@@ -32,14 +32,22 @@ export async function sowCommand(argv = [], root = process.cwd()) {
     target: args.target,
     baseUrl: args.baseUrl,
     runId: args.runId,
+    live: args.live,
+    sample: args.sample,
+    demo: args.demo,
+    draft: args.draft,
     client: args.client || 'Enterprise Customer',
     clientContact: args.clientContact || 'procurement@customer.test',
     supplier: args.supplier || 'Nebula Components & Citable Advisory Practice',
     supplierContact: args.supplierContact || 'advisory@nebulacomponents.test',
     budget: args.budget ? Number(args.budget) : 45000,
+    budgetMinor: args.budgetMinor ? Number(args.budgetMinor) : null,
     termDays: args.term ? Number(args.term) : 90,
     format: args.format || 'markdown',
     output: args.output,
+    inScopeProperties: args.inScope ? args.inScope.split(',').map((s) => s.trim()) : [],
+    scopeMode: args.scopeMode || 'HOST_AND_SUBDOMAINS',
+    minIceScore: args.minIce ? Number(args.minIce) : 8.0,
   });
 
   return result;
@@ -52,16 +60,25 @@ function parseSowArgs(argv) {
     if (a === '--target') args.target = argv[++i];
     else if (a === '--base-url') args.baseUrl = argv[++i];
     else if (a === '--run') args.runId = argv[++i];
+    else if (a === '--live') args.live = true;
+    else if (a === '--sample') args.sample = true;
+    else if (a === '--demo') args.demo = true;
+    else if (a === '--draft') args.draft = true;
     else if (a === '--client') args.client = argv[++i];
     else if (a === '--client-contact') args.clientContact = argv[++i];
     else if (a === '--supplier') args.supplier = argv[++i];
     else if (a === '--supplier-contact') args.supplierContact = argv[++i];
     else if (a === '--budget') args.budget = argv[++i];
+    else if (a === '--budget-minor') args.budgetMinor = argv[++i];
     else if (a === '--term') args.term = argv[++i];
     else if (a === '--format') args.format = argv[++i];
     else if (a === '--output') args.output = argv[++i];
     else if (a === '--json') args.format = 'json';
+    else if (a === '--scope-mode' || a === '--scope') args.scopeMode = argv[++i];
+    else if (a === '--in-scope') args.inScope = argv[++i];
+    else if (a === '--min-ice') args.minIce = argv[++i];
     else args._.push(a);
   }
   return args;
 }
+

package/src/sow/admissibilityGate.js

@@ -1,5 +1,3 @@
-import { safePath } from '../detectors/framework.js';
-
 /**
  * Enterprise Scope Admissibility Gate
  *
@@ -7,32 +5,138 @@ import { safePath } from '../detectors/framework.js';
  * work packages, explicitly refusing findings that are exploratory, unverified,
  * economically unjustified, out of organizational boundary, or lack testable acceptance.
  */
+
+export const DEFAULT_ROLE_MAPPINGS = {
+  TECH: 'Supplier Engineering Lead',
+  TECHNICAL: 'Supplier Engineering Lead',
+  CRO: 'Supplier CRO Architect',
+  AEO: 'Supplier Discovery Specialist',
+  ANS: 'Supplier Discovery Specialist',
+  GEO: 'Supplier Discovery Specialist',
+  SCHEMA: 'Supplier Data Engineer',
+  ENTITY: 'Supplier Data Engineer',
+  SEO: 'Supplier Search Strategist',
+};
+
+/**
+ * Check whether a target subject falls within declared in-scope properties.
+ *
+ * Supported scope modes:
+ * - 'HOST_AND_SUBDOMAINS' (default): matches host and any subdomains
+ * - 'HOST': matches exact host only
+ * - 'EXACT_ORIGIN': matches exact scheme + host + port
+ * - 'PATH_PREFIX': matches host/subdomain and path prefix
+ * - 'EXACT_RESOURCE': matches exact host and path
+ */
+export function checkScopeBoundary(subject, inScopeProperties = [], scopeMode = 'HOST_AND_SUBDOMAINS') {
+  if (!inScopeProperties || inScopeProperties.length === 0) return true;
+  if (!subject) return false;
+
+  const subjectStr = typeof subject === 'string' ? subject : (subject.url || subject.identifier || '');
+  if (!subjectStr) return false;
+
+  const isRelative = !/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/|^\/\//.test(subjectStr);
+
+  for (const prop of inScopeProperties) {
+    let propUrl;
+    try {
+      propUrl = new URL(prop.includes('://') ? prop : `https://${prop}`);
+    } catch {
+      continue;
+    }
+    const propHost = propUrl.hostname.toLowerCase();
+    const propPath = propUrl.pathname.replace(/\/+$/, '');
+
+    if (isRelative) {
+      if (scopeMode === 'PATH_PREFIX') {
+        const normSubj = subjectStr.startsWith('/') ? subjectStr : `/${subjectStr}`;
+        if (normSubj.startsWith(propPath || '/')) return true;
+      } else if (scopeMode === 'EXACT_RESOURCE') {
+        const normSubj = subjectStr.startsWith('/') ? subjectStr : `/${subjectStr}`;
+        if (normSubj === (propPath || '/')) return true;
+      } else {
+        return true;
+      }
+      continue;
+    }
+
+    let subjUrl;
+    try {
+      subjUrl = new URL(subjectStr);
+    } catch {
+      continue;
+    }
+
+    const subjHost = subjUrl.hostname.toLowerCase();
+    const subjPath = subjUrl.pathname.replace(/\/+$/, '');
+
+    switch (scopeMode) {
+      case 'EXACT_ORIGIN':
+        if (subjUrl.origin.toLowerCase() === propUrl.origin.toLowerCase()) return true;
+        break;
+      case 'HOST':
+        if (subjHost === propHost) return true;
+        break;
+      case 'HOST_AND_SUBDOMAINS':
+        if (subjHost === propHost || subjHost.endsWith(`.${propHost}`)) return true;
+        break;
+      case 'PATH_PREFIX':
+        if ((subjHost === propHost || subjHost.endsWith(`.${propHost}`)) &&
+            (subjPath === propPath || subjPath.startsWith(`${propPath}/`))) return true;
+        break;
+      case 'EXACT_RESOURCE':
+        if (subjHost === propHost && subjPath === propPath) return true;
+        break;
+      default:
+        if (subjHost === propHost || subjHost.endsWith(`.${propHost}`)) return true;
+    }
+  }
+
+  return false;
+}
+
 export function evaluateScopeAdmissibility(findings = [], {
   inScopeProperties = [],
+  scopeMode = 'HOST_AND_SUBDOMAINS',
   minIceScore = 8.0,
   allowedDisciplines = ['seo', 'aeo', 'geo', 'technical', 'schema', 'entity', 'cro'],
   allowExperimental = false,
   excludedDetectors = [],
+  roleMapping = null,
+  ownerMappingVersion = '1.0',
 } = {}) {
   const admitted = [];
   const refused = [];
 
   let reqIndex = 1;
   let testIndex = 1;
+  const seenFindingIds = new Map();
 
   for (let i = 0; i < findings.length; i++) {
     const f = findings[i];
-    const detectorId = f.detector_id || `FINDING-${i + 1}`;
-    const subject = f.subject?.identifier || f.subject?.url || '/';
+    const subject = f.subject?.identifier || f.subject?.url || (typeof f.subject === 'string' ? f.subject : '/');
+    const detectorId = f.detector_id || (f.finding_id ? f.finding_id.replace(/^F-/, '') : `FINDING-${i + 1}`);
+
+    const rawFindingId = f.finding_id || f.id || f.detector_id || `FINDING-${i + 1}`;
+    let findingId = rawFindingId;
+    if (seenFindingIds.has(rawFindingId)) {
+      const count = seenFindingIds.get(rawFindingId) + 1;
+      seenFindingIds.set(rawFindingId, count);
+      findingId = `${rawFindingId}:${subject || count}`;
+    } else {
+      seenFindingIds.set(rawFindingId, 1);
+    }
+
     const severity = f.classification?.severity || 'medium';
     const confidence = f.classification?.confidence || 'observed';
     const evidenceList = f.observation?.evidence || [];
-    const remediation = f.remediation?.preferred || '';
+    const remediation = f.remediation?.preferred || (typeof f.remediation === 'string' ? f.remediation : '');
 
     // Gate 1: Excluded detectors / explicitly blacklisted checks
-    if (excludedDetectors.includes(detectorId)) {
+    if (excludedDetectors.includes(detectorId) || excludedDetectors.includes(findingId)) {
       refused.push({
-        finding_id: detectorId,
+        finding_id: findingId,
+        detector_id: detectorId,
         subject,
         gate_failed: 'excluded_detector',
         refusal_code: 'REFUSE-EXCLUDED',
@@ -45,7 +149,8 @@ export function evaluateScopeAdmissibility(findings = [], {
     // Gate 2: Evidence Maturity Gate
     if (!allowExperimental && (confidence === 'experimental' || f.classification?.finding_type === 'experimental')) {
       refused.push({
-        finding_id: detectorId,
+        finding_id: findingId,
+        detector_id: detectorId,
         subject,
         gate_failed: 'evidence_maturity',
         refusal_code: 'REFUSE-EXPERIMENTAL',
@@ -55,9 +160,10 @@ export function evaluateScopeAdmissibility(findings = [], {
       continue;
     }
 
-    if (evidenceList.length === 0) {
+    if (!Array.isArray(evidenceList) || evidenceList.length === 0) {
       refused.push({
-        finding_id: detectorId,
+        finding_id: findingId,
+        detector_id: detectorId,
         subject,
         gate_failed: 'evidence_maturity',
         refusal_code: 'REFUSE-NO-EVIDENCE',
@@ -67,17 +173,13 @@ export function evaluateScopeAdmissibility(findings = [], {
       continue;
     }
 
-    // Gate 3: Scope Boundary Gate
+    // Gate 4: Scope Boundary Gate
     if (inScopeProperties.length > 0) {
-      const isInScope = inScopeProperties.some((prop) => {
-        const pStem = prop.replace(/^https?:\/\//, '').replace(/\/+$/, '').toLowerCase();
-        const sStem = subject.replace(/^https?:\/\//, '').replace(/\/+$/, '').toLowerCase();
-        return sStem.includes(pStem) || pStem.includes(sStem);
-      });
-
-      if (!isInScope) {
+      const inScope = checkScopeBoundary(f.subject || subject, inScopeProperties, scopeMode);
+      if (!inScope) {
         refused.push({
-          finding_id: detectorId,
+          finding_id: findingId,
+          detector_id: detectorId,
           subject,
           gate_failed: 'scope_boundary',
           refusal_code: 'REFUSE-OUT-OF-SCOPE',
@@ -88,28 +190,30 @@ export function evaluateScopeAdmissibility(findings = [], {
       }
     }
 
-    // Gate 4: Technical Feasibility & Remediation Safety
-    if (!remediation || remediation.toLowerCase().includes('consult external legal') || remediation.toLowerCase().includes('out of scope')) {
+    // Gate 5: Technical Feasibility & Remediation Safety
+    const remLower = remediation.toLowerCase();
+    if (!remediation || remLower.includes('consult external legal') || remLower.includes('out of scope') || remLower.includes('unfeasible')) {
       refused.push({
-        finding_id: detectorId,
+        finding_id: findingId,
+        detector_id: detectorId,
         subject,
         gate_failed: 'technical_feasibility',
         refusal_code: 'REFUSE-UNFEASIBLE-REMEDIATION',
-        refusal_rationale: 'Finding requires external legal advice or lacks defined engineering remediation method.',
-        suggested_handling: 'Refer to customer legal counsel; exclude from engineering delivery.',
+        refusal_rationale: 'Finding requires external legal advice, lacks defined engineering remediation method, or is declared technically unfeasible.',
+        suggested_handling: 'Refer to customer legal counsel or appropriate third party; exclude from engineering delivery.',
       });
       continue;
     }
 
-    // Gate 5: Commercial Materiality & ICE-BV Gate
-    // High & critical severity are automatically material; medium/low must meet ICE threshold or be key conversion/vitals defects
-    const isCoreSeverity = ['critical', 'high'].includes(severity);
+    // Gate 6: Commercial Materiality & ICE-BV Gate
+    const isCoreSeverity = ['critical', 'high'].includes(severity.toLowerCase());
     const isVitalsOrFunnel = ['TECH-001', 'TECH-002', 'CRO-001', 'CRO-002', 'CRO-005', 'CRO-006', 'CRO-007', 'CRO-013', 'CRO-021', 'SCHEMA-001'].includes(detectorId);
-    const iceScore = f.ice_score || (isCoreSeverity ? 12 : 6);
+    const iceScore = typeof f.ice_score === 'number' ? f.ice_score : (isCoreSeverity ? 12 : 6);
 
     if (!isCoreSeverity && !isVitalsOrFunnel && iceScore < minIceScore) {
       refused.push({
-        finding_id: detectorId,
+        finding_id: findingId,
+        detector_id: detectorId,
         subject,
         gate_failed: 'commercial_materiality',
         refusal_code: 'REFUSE-LOW-MATERIALITY',
@@ -119,11 +223,17 @@ export function evaluateScopeAdmissibility(findings = [], {
       continue;
     }
 
-    // Gate 6: Objectively Testable Acceptance Gate
-    const rerunDetector = f.verification?.detector_to_rerun || detectorId;
-    if (!rerunDetector && !f.verification?.method) {
+    // Gate 7: Objectively Testable Acceptance Gate
+    const hasVerification = Boolean(
+      f.verification?.detector_to_rerun ||
+      f.verification?.method ||
+      f.verification?.acceptance_test
+    );
+
+    if (!hasVerification) {
       refused.push({
-        finding_id: detectorId,
+        finding_id: findingId,
+        detector_id: detectorId,
         subject,
         gate_failed: 'measurable_acceptance',
         refusal_code: 'REFUSE-UNVERIFIABLE',
@@ -133,36 +243,93 @@ export function evaluateScopeAdmissibility(findings = [], {
       continue;
     }
 
-    // Passed All 6 Gates -> Admitted to Contractual SOW Scope
-    const discipline = (f.discipline?.[0] || detectorId.split('-')[0] || 'TECH').toUpperCase();
+    // Gate 8: Ownership Clarity Gate
+    const effectiveRoles = { ...DEFAULT_ROLE_MAPPINGS, ...(roleMapping || {}) };
+    const disciplineKey = (f.discipline?.[0] || detectorId.split('-')[0] || 'TECH').toUpperCase();
+
+    let resolvedOwner = null;
+    let ownerSource = null;
+
+    if (f.delivery_owner && f.delivery_owner !== 'UNRESOLVED') {
+      resolvedOwner = f.delivery_owner;
+      ownerSource = 'finding.delivery_owner';
+    } else if (f.remediation?.owner && f.remediation.owner !== 'UNRESOLVED') {
+      resolvedOwner = f.remediation.owner;
+      ownerSource = 'finding.remediation.owner';
+    } else if (f.owner && f.owner !== 'UNRESOLVED') {
+      resolvedOwner = f.owner;
+      ownerSource = 'finding.owner';
+    } else if (effectiveRoles[disciplineKey] && effectiveRoles[disciplineKey] !== 'UNRESOLVED') {
+      resolvedOwner = effectiveRoles[disciplineKey];
+      ownerSource = 'engagement_role_mapping';
+    } else if (effectiveRoles[detectorId] && effectiveRoles[detectorId] !== 'UNRESOLVED') {
+      resolvedOwner = effectiveRoles[detectorId];
+      ownerSource = 'engagement_role_mapping';
+    }
+
+    if (!resolvedOwner || resolvedOwner === 'UNRESOLVED' || resolvedOwner.toLowerCase() === 'unassigned') {
+      refused.push({
+        finding_id: findingId,
+        detector_id: detectorId,
+        subject,
+        gate_failed: 'ownership_clarity',
+        refusal_code: 'REFUSE-OWNER-UNRESOLVED',
+        refusal_rationale: `Responsible delivery owner could not be resolved for finding ${findingId} (discipline: ${disciplineKey}).`,
+        suggested_handling: 'Specify delivery_owner on finding or map discipline to accountable delivery role in SOW configuration.',
+      });
+      continue;
+    }
+
+    // Gate 8b: Discipline Authorization Gate
+    const rawDisciplines = Array.isArray(f.discipline)
+      ? f.discipline
+      : (f.discipline ? [f.discipline] : [detectorId.split('-')[0]]);
+    const findingDisciplines = rawDisciplines.map((d) => String(d).toLowerCase());
+
+    if (allowedDisciplines && allowedDisciplines.length > 0) {
+      const normAllowed = allowedDisciplines.map((d) => String(d).toLowerCase());
+      const isAuthorized = findingDisciplines.some((d) => normAllowed.includes(d));
+      if (!isAuthorized) {
+        refused.push({
+          finding_id: findingId,
+          detector_id: detectorId,
+          subject,
+          gate_failed: 'discipline_authorization',
+          refusal_code: 'REFUSE-DISCIPLINE-NOT-AUTHORIZED',
+          refusal_rationale: `Discipline (${findingDisciplines.join(', ')}) is not authorized under contracted delivery disciplines (${allowedDisciplines.join(', ')}).`,
+          suggested_handling: 'Expand authorized disciplines in SOW engagement terms or contract under separate statement of work.',
+        });
+        continue;
+      }
+    }
+
+    // Passed all gates -> Admitted to Contractual SOW Scope
     let wpId = 'WP-TECH-01';
     let wpName = 'Technical Search & Performance Infrastructure';
     let deliverableId = 'DELIV-01';
-    let owner = 'Supplier Engineering Lead';
 
-    if (discipline === 'CRO' || detectorId.startsWith('CRO-')) {
+    if (disciplineKey === 'CRO' || detectorId.startsWith('CRO-')) {
       wpId = 'WP-CRO-02';
       wpName = 'Conversion Funnel & Offer Architecture Optimization';
       deliverableId = 'DELIV-02';
-      owner = 'Supplier CRO Architect';
-    } else if (discipline === 'AEO' || discipline === 'GEO' || discipline === 'ANS') {
+    } else if (disciplineKey === 'AEO' || disciplineKey === 'GEO' || disciplineKey === 'ANS') {
       wpId = 'WP-AEO-03';
       wpName = 'Answer-Engine (AEO) & Generative Search Extraction';
       deliverableId = 'DELIV-03';
-      owner = 'Supplier Discovery Specialist';
-    } else if (discipline === 'SCHEMA' || discipline === 'ENTITY') {
+    } else if (disciplineKey === 'SCHEMA' || disciplineKey === 'ENTITY') {
       wpId = 'WP-SCHEMA-04';
       wpName = 'Structured Data & Entity Knowledge Graph Architecture';
       deliverableId = 'DELIV-04';
-      owner = 'Supplier Data Engineer';
     }
 
     const sowReqId = `REQ-SOW-${String(reqIndex++).padStart(3, '0')}`;
     const accTestId = `ACC-TEST-${String(testIndex++).padStart(3, '0')}`;
-    const evidenceId = evidenceList[0] || `EVD-OBS-${detectorId}`;
+    const evidenceId = evidenceList[0];
+    const detectorToRerun = f.verification?.detector_to_rerun || detectorId;
 
     admitted.push({
-      finding_id: detectorId,
+      finding_id: findingId,
+      detector_id: detectorId,
       sow_requirement_id: sowReqId,
       work_package_id: wpId,
       work_package_name: wpName,
@@ -172,9 +339,12 @@ export function evaluateScopeAdmissibility(findings = [], {
       severity,
       confidence,
       recommendation: remediation,
-      acceptance_test: `Execute closed-loop verification: citable verify remediation --finding ${detectorId} --target ${subject} (Expect status: RESOLVED, zero regressions)`,
-      owner,
+      acceptance_test: f.verification?.acceptance_test || `Execute closed-loop verification: citable verify remediation --finding ${detectorToRerun} --target ${subject} (Expect status: RESOLVED, zero regressions)`,
+      owner: resolvedOwner,
+      owner_source: ownerSource,
+      owner_mapping_version: ownerMappingVersion,
       evidence_id: evidenceId,
+      evidence_ids: [...evidenceList],
       commercial_priority: isCoreSeverity ? 'P1_CRITICAL' : 'P2_HIGH_VALUE',
       ice_bv_score: iceScore,
     });