@nebulacomponents/citable 1.18.0 → 1.18.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (190) hide show
  1. package/CHANGELOG.md +70 -0
  2. package/dist/universal/.agents/skills/citable/SKILL.md +22 -1
  3. package/dist/universal/.agents/skills/citable/VERSION +1 -1
  4. package/dist/universal/.agents/skills/citable/agents/citable-remediator.md +43 -0
  5. package/dist/universal/.agents/skills/citable/agents/citable-sow-architect.md +43 -0
  6. package/dist/universal/.agents/skills/citable/commands/README.md +13 -0
  7. package/dist/universal/.agents/skills/citable/commands/artifact-interchange.md +5 -0
  8. package/dist/universal/.agents/skills/citable/commands/remediation.md +55 -0
  9. package/dist/universal/.agents/skills/citable/commands/reporting.md +28 -0
  10. package/dist/universal/.agents/skills/citable/commands/sow.md +95 -0
  11. package/dist/universal/.agents/skills/citable/manifest.json +15 -9
  12. package/dist/universal/.agents/skills/citable/schemas/cro-report.schema.json +112 -0
  13. package/dist/universal/.agents/skills/citable/schemas/search-report.schema.json +99 -0
  14. package/dist/universal/.agents/skills/citable/schemas/sow.schema.json +344 -26
  15. package/dist/universal/.claude/agents/citable/citable-remediator.md +43 -0
  16. package/dist/universal/.claude/agents/citable/citable-sow-architect.md +43 -0
  17. package/dist/universal/.claude/agents/citable/manifest.json +6 -4
  18. package/dist/universal/.claude/skills/citable/SKILL.md +22 -1
  19. package/dist/universal/.claude/skills/citable/VERSION +1 -1
  20. package/dist/universal/.claude/skills/citable/agents/citable-remediator.md +43 -0
  21. package/dist/universal/.claude/skills/citable/agents/citable-sow-architect.md +43 -0
  22. package/dist/universal/.claude/skills/citable/commands/README.md +13 -0
  23. package/dist/universal/.claude/skills/citable/commands/artifact-interchange.md +5 -0
  24. package/dist/universal/.claude/skills/citable/commands/remediation.md +55 -0
  25. package/dist/universal/.claude/skills/citable/commands/reporting.md +28 -0
  26. package/dist/universal/.claude/skills/citable/commands/sow.md +95 -0
  27. package/dist/universal/.claude/skills/citable/manifest.json +19 -11
  28. package/dist/universal/.claude/skills/citable/schemas/cro-report.schema.json +112 -0
  29. package/dist/universal/.claude/skills/citable/schemas/search-report.schema.json +99 -0
  30. package/dist/universal/.claude/skills/citable/schemas/sow.schema.json +344 -26
  31. package/dist/universal/.cursor/skills/citable/SKILL.md +22 -1
  32. package/dist/universal/.cursor/skills/citable/VERSION +1 -1
  33. package/dist/universal/.cursor/skills/citable/agents/citable-remediator.md +43 -0
  34. package/dist/universal/.cursor/skills/citable/agents/citable-sow-architect.md +43 -0
  35. package/dist/universal/.cursor/skills/citable/commands/README.md +13 -0
  36. package/dist/universal/.cursor/skills/citable/commands/artifact-interchange.md +5 -0
  37. package/dist/universal/.cursor/skills/citable/commands/remediation.md +55 -0
  38. package/dist/universal/.cursor/skills/citable/commands/reporting.md +28 -0
  39. package/dist/universal/.cursor/skills/citable/commands/sow.md +95 -0
  40. package/dist/universal/.cursor/skills/citable/manifest.json +15 -9
  41. package/dist/universal/.cursor/skills/citable/schemas/cro-report.schema.json +112 -0
  42. package/dist/universal/.cursor/skills/citable/schemas/search-report.schema.json +99 -0
  43. package/dist/universal/.cursor/skills/citable/schemas/sow.schema.json +344 -26
  44. package/dist/universal/.gemini/skills/citable/SKILL.md +22 -1
  45. package/dist/universal/.gemini/skills/citable/VERSION +1 -1
  46. package/dist/universal/.gemini/skills/citable/agents/citable-remediator.md +43 -0
  47. package/dist/universal/.gemini/skills/citable/agents/citable-sow-architect.md +43 -0
  48. package/dist/universal/.gemini/skills/citable/commands/README.md +13 -0
  49. package/dist/universal/.gemini/skills/citable/commands/artifact-interchange.md +5 -0
  50. package/dist/universal/.gemini/skills/citable/commands/remediation.md +55 -0
  51. package/dist/universal/.gemini/skills/citable/commands/reporting.md +28 -0
  52. package/dist/universal/.gemini/skills/citable/commands/sow.md +95 -0
  53. package/dist/universal/.gemini/skills/citable/manifest.json +15 -9
  54. package/dist/universal/.gemini/skills/citable/schemas/cro-report.schema.json +112 -0
  55. package/dist/universal/.gemini/skills/citable/schemas/search-report.schema.json +99 -0
  56. package/dist/universal/.gemini/skills/citable/schemas/sow.schema.json +344 -26
  57. package/dist/universal/.github/skills/citable/SKILL.md +22 -1
  58. package/dist/universal/.github/skills/citable/VERSION +1 -1
  59. package/dist/universal/.github/skills/citable/agents/citable-remediator.md +43 -0
  60. package/dist/universal/.github/skills/citable/agents/citable-sow-architect.md +43 -0
  61. package/dist/universal/.github/skills/citable/commands/README.md +13 -0
  62. package/dist/universal/.github/skills/citable/commands/artifact-interchange.md +5 -0
  63. package/dist/universal/.github/skills/citable/commands/remediation.md +55 -0
  64. package/dist/universal/.github/skills/citable/commands/reporting.md +28 -0
  65. package/dist/universal/.github/skills/citable/commands/sow.md +95 -0
  66. package/dist/universal/.github/skills/citable/manifest.json +15 -9
  67. package/dist/universal/.github/skills/citable/schemas/cro-report.schema.json +112 -0
  68. package/dist/universal/.github/skills/citable/schemas/search-report.schema.json +99 -0
  69. package/dist/universal/.github/skills/citable/schemas/sow.schema.json +344 -26
  70. package/dist/universal/.kiro/skills/citable/SKILL.md +22 -1
  71. package/dist/universal/.kiro/skills/citable/VERSION +1 -1
  72. package/dist/universal/.kiro/skills/citable/agents/citable-remediator.md +43 -0
  73. package/dist/universal/.kiro/skills/citable/agents/citable-sow-architect.md +43 -0
  74. package/dist/universal/.kiro/skills/citable/commands/README.md +13 -0
  75. package/dist/universal/.kiro/skills/citable/commands/artifact-interchange.md +5 -0
  76. package/dist/universal/.kiro/skills/citable/commands/remediation.md +55 -0
  77. package/dist/universal/.kiro/skills/citable/commands/reporting.md +28 -0
  78. package/dist/universal/.kiro/skills/citable/commands/sow.md +95 -0
  79. package/dist/universal/.kiro/skills/citable/manifest.json +15 -9
  80. package/dist/universal/.kiro/skills/citable/schemas/cro-report.schema.json +112 -0
  81. package/dist/universal/.kiro/skills/citable/schemas/search-report.schema.json +99 -0
  82. package/dist/universal/.kiro/skills/citable/schemas/sow.schema.json +344 -26
  83. package/dist/universal/.opencode/skills/citable/SKILL.md +22 -1
  84. package/dist/universal/.opencode/skills/citable/VERSION +1 -1
  85. package/dist/universal/.opencode/skills/citable/agents/citable-remediator.md +43 -0
  86. package/dist/universal/.opencode/skills/citable/agents/citable-sow-architect.md +43 -0
  87. package/dist/universal/.opencode/skills/citable/commands/README.md +13 -0
  88. package/dist/universal/.opencode/skills/citable/commands/artifact-interchange.md +5 -0
  89. package/dist/universal/.opencode/skills/citable/commands/remediation.md +55 -0
  90. package/dist/universal/.opencode/skills/citable/commands/reporting.md +28 -0
  91. package/dist/universal/.opencode/skills/citable/commands/sow.md +95 -0
  92. package/dist/universal/.opencode/skills/citable/manifest.json +15 -9
  93. package/dist/universal/.opencode/skills/citable/schemas/cro-report.schema.json +112 -0
  94. package/dist/universal/.opencode/skills/citable/schemas/search-report.schema.json +99 -0
  95. package/dist/universal/.opencode/skills/citable/schemas/sow.schema.json +344 -26
  96. package/dist/universal/.pi/agent/skills/citable/SKILL.md +22 -1
  97. package/dist/universal/.pi/agent/skills/citable/VERSION +1 -1
  98. package/dist/universal/.pi/agent/skills/citable/agents/citable-remediator.md +43 -0
  99. package/dist/universal/.pi/agent/skills/citable/agents/citable-sow-architect.md +43 -0
  100. package/dist/universal/.pi/agent/skills/citable/commands/README.md +13 -0
  101. package/dist/universal/.pi/agent/skills/citable/commands/artifact-interchange.md +5 -0
  102. package/dist/universal/.pi/agent/skills/citable/commands/remediation.md +55 -0
  103. package/dist/universal/.pi/agent/skills/citable/commands/reporting.md +28 -0
  104. package/dist/universal/.pi/agent/skills/citable/commands/sow.md +95 -0
  105. package/dist/universal/.pi/agent/skills/citable/manifest.json +15 -9
  106. package/dist/universal/.pi/agent/skills/citable/schemas/cro-report.schema.json +112 -0
  107. package/dist/universal/.pi/agent/skills/citable/schemas/search-report.schema.json +99 -0
  108. package/dist/universal/.pi/agent/skills/citable/schemas/sow.schema.json +344 -26
  109. package/dist/universal/.qoder/skills/citable/SKILL.md +22 -1
  110. package/dist/universal/.qoder/skills/citable/VERSION +1 -1
  111. package/dist/universal/.qoder/skills/citable/agents/citable-remediator.md +43 -0
  112. package/dist/universal/.qoder/skills/citable/agents/citable-sow-architect.md +43 -0
  113. package/dist/universal/.qoder/skills/citable/commands/README.md +13 -0
  114. package/dist/universal/.qoder/skills/citable/commands/artifact-interchange.md +5 -0
  115. package/dist/universal/.qoder/skills/citable/commands/remediation.md +55 -0
  116. package/dist/universal/.qoder/skills/citable/commands/reporting.md +28 -0
  117. package/dist/universal/.qoder/skills/citable/commands/sow.md +95 -0
  118. package/dist/universal/.qoder/skills/citable/manifest.json +15 -9
  119. package/dist/universal/.qoder/skills/citable/schemas/cro-report.schema.json +112 -0
  120. package/dist/universal/.qoder/skills/citable/schemas/search-report.schema.json +99 -0
  121. package/dist/universal/.qoder/skills/citable/schemas/sow.schema.json +344 -26
  122. package/dist/universal/.rovodev/skills/citable/SKILL.md +22 -1
  123. package/dist/universal/.rovodev/skills/citable/VERSION +1 -1
  124. package/dist/universal/.rovodev/skills/citable/agents/citable-remediator.md +43 -0
  125. package/dist/universal/.rovodev/skills/citable/agents/citable-sow-architect.md +43 -0
  126. package/dist/universal/.rovodev/skills/citable/commands/README.md +13 -0
  127. package/dist/universal/.rovodev/skills/citable/commands/artifact-interchange.md +5 -0
  128. package/dist/universal/.rovodev/skills/citable/commands/remediation.md +55 -0
  129. package/dist/universal/.rovodev/skills/citable/commands/reporting.md +28 -0
  130. package/dist/universal/.rovodev/skills/citable/commands/sow.md +95 -0
  131. package/dist/universal/.rovodev/skills/citable/manifest.json +15 -9
  132. package/dist/universal/.rovodev/skills/citable/schemas/cro-report.schema.json +112 -0
  133. package/dist/universal/.rovodev/skills/citable/schemas/search-report.schema.json +99 -0
  134. package/dist/universal/.rovodev/skills/citable/schemas/sow.schema.json +344 -26
  135. package/dist/universal/.trae/skills/citable/SKILL.md +22 -1
  136. package/dist/universal/.trae/skills/citable/VERSION +1 -1
  137. package/dist/universal/.trae/skills/citable/agents/citable-remediator.md +43 -0
  138. package/dist/universal/.trae/skills/citable/agents/citable-sow-architect.md +43 -0
  139. package/dist/universal/.trae/skills/citable/commands/README.md +13 -0
  140. package/dist/universal/.trae/skills/citable/commands/artifact-interchange.md +5 -0
  141. package/dist/universal/.trae/skills/citable/commands/remediation.md +55 -0
  142. package/dist/universal/.trae/skills/citable/commands/reporting.md +28 -0
  143. package/dist/universal/.trae/skills/citable/commands/sow.md +95 -0
  144. package/dist/universal/.trae/skills/citable/manifest.json +15 -9
  145. package/dist/universal/.trae/skills/citable/schemas/cro-report.schema.json +112 -0
  146. package/dist/universal/.trae/skills/citable/schemas/search-report.schema.json +99 -0
  147. package/dist/universal/.trae/skills/citable/schemas/sow.schema.json +344 -26
  148. package/dist/universal/.trae-cn/skills/citable/SKILL.md +22 -1
  149. package/dist/universal/.trae-cn/skills/citable/VERSION +1 -1
  150. package/dist/universal/.trae-cn/skills/citable/agents/citable-remediator.md +43 -0
  151. package/dist/universal/.trae-cn/skills/citable/agents/citable-sow-architect.md +43 -0
  152. package/dist/universal/.trae-cn/skills/citable/commands/README.md +13 -0
  153. package/dist/universal/.trae-cn/skills/citable/commands/artifact-interchange.md +5 -0
  154. package/dist/universal/.trae-cn/skills/citable/commands/remediation.md +55 -0
  155. package/dist/universal/.trae-cn/skills/citable/commands/reporting.md +28 -0
  156. package/dist/universal/.trae-cn/skills/citable/commands/sow.md +95 -0
  157. package/dist/universal/.trae-cn/skills/citable/manifest.json +15 -9
  158. package/dist/universal/.trae-cn/skills/citable/schemas/cro-report.schema.json +112 -0
  159. package/dist/universal/.trae-cn/skills/citable/schemas/search-report.schema.json +99 -0
  160. package/dist/universal/.trae-cn/skills/citable/schemas/sow.schema.json +344 -26
  161. package/dist/universal/manifest.json +186 -112
  162. package/package.json +2 -1
  163. package/schemas/cro-report.schema.json +112 -0
  164. package/schemas/search-report.schema.json +99 -0
  165. package/schemas/sow.schema.json +344 -26
  166. package/skill/SKILL.md +22 -1
  167. package/skill/agents/citable-remediator.md +43 -0
  168. package/skill/agents/citable-sow-architect.md +43 -0
  169. package/skill/commands/README.md +13 -0
  170. package/skill/commands/artifact-interchange.md +5 -0
  171. package/skill/commands/remediation.md +55 -0
  172. package/skill/commands/reporting.md +28 -0
  173. package/skill/commands/sow.md +95 -0
  174. package/src/analysis/behavioral.js +5 -4
  175. package/src/analysis/eeat.js +10 -9
  176. package/src/analysis/offpage.js +19 -36
  177. package/src/analysis/readiness.js +8 -2
  178. package/src/artifacts/verifyCustomerArtifact.js +283 -0
  179. package/src/cli/index.js +8 -1
  180. package/src/commands/sowCmd.js +17 -0
  181. package/src/reporting/executiveCroReport.js +393 -229
  182. package/src/reporting/executiveExport.js +6 -2
  183. package/src/reporting/executiveSearchReport.js +519 -271
  184. package/src/shared/domainUtils.js +140 -0
  185. package/src/shared/epistemicStatus.js +111 -0
  186. package/src/shared/evidenceSourceResolver.js +286 -0
  187. package/src/shared/htmlEscape.js +65 -0
  188. package/src/shared/runPackageVerifier.js +153 -0
  189. package/src/sow/admissibilityGate.js +234 -46
  190. package/src/sow/generateSow.js +524 -142
@@ -6,87 +6,405 @@
6
6
  "required": [
7
7
  "sow_id",
8
8
  "version",
9
+ "generation_mode",
9
10
  "title",
10
11
  "client",
11
12
  "supplier",
12
13
  "effective_date",
14
+ "term_days",
15
+ "currency",
16
+ "currency_minor_unit_exponent",
17
+ "commercial_total_fee_minor",
18
+ "commercial_total_fee_usd",
13
19
  "executive_scope",
14
20
  "admissibility_gate",
15
21
  "work_packages",
16
22
  "deliverables",
17
23
  "acceptance_criteria",
18
- "traceability_matrix"
24
+ "traceability_matrix",
25
+ "generation_provenance"
19
26
  ],
20
27
  "properties": {
21
- "sow_id": { "type": "string" },
28
+ "$schema": { "type": "string" },
29
+ "sow_id": { "type": "string", "pattern": "^SOW-[A-Za-z0-9_-]+$" },
22
30
  "version": { "type": "string" },
23
- "title": { "type": "string" },
31
+ "generation_mode": {
32
+ "type": "string",
33
+ "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"]
34
+ },
35
+ "title": { "type": "string", "minLength": 1 },
36
+ "synthetic_evidence": { "type": "boolean" },
24
37
  "client": {
25
38
  "type": "object",
26
39
  "required": ["name", "contact"],
27
40
  "properties": {
28
- "name": { "type": "string" },
29
- "contact": { "type": "string" }
30
- }
41
+ "name": { "type": "string", "minLength": 1 },
42
+ "contact": { "type": "string", "minLength": 1 }
43
+ },
44
+ "additionalProperties": false
31
45
  },
32
46
  "supplier": {
33
47
  "type": "object",
34
48
  "required": ["name", "contact"],
35
49
  "properties": {
36
- "name": { "type": "string" },
37
- "contact": { "type": "string" }
38
- }
50
+ "name": { "type": "string", "minLength": 1 },
51
+ "contact": { "type": "string", "minLength": 1 }
52
+ },
53
+ "additionalProperties": false
39
54
  },
40
- "effective_date": { "type": "string" },
41
- "term_days": { "type": "integer" },
55
+ "effective_date": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" },
56
+ "term_days": { "type": "integer", "minimum": 1 },
57
+ "currency": { "type": "string", "enum": ["USD"] },
58
+ "currency_minor_unit_exponent": { "type": "integer", "enum": [2] },
59
+ "commercial_total_fee_minor": { "type": "integer", "minimum": 0 },
60
+ "commercial_total_fee_usd": { "type": "number", "minimum": 0 },
42
61
  "executive_scope": {
43
62
  "type": "object",
44
63
  "required": ["business_objective", "in_scope_properties", "in_scope_systems"],
45
64
  "properties": {
46
- "business_objective": { "type": "string" },
65
+ "business_objective": { "type": "string", "minLength": 1 },
47
66
  "in_scope_properties": { "type": "array", "items": { "type": "string" } },
48
67
  "in_scope_systems": { "type": "array", "items": { "type": "string" } },
49
68
  "channels": { "type": "array", "items": { "type": "string" } },
50
- "geographies": { "type": "array", "items": { "type": "string" } }
51
- }
69
+ "geographies": { "type": "array", "items": { "type": "string" } },
70
+ "organizational_boundaries": { "type": "string" }
71
+ },
72
+ "additionalProperties": false
52
73
  },
53
74
  "admissibility_gate": {
54
75
  "type": "object",
55
- "required": ["total_findings_evaluated", "admitted_count", "refused_count"],
76
+ "required": ["total_findings_evaluated", "admitted_count", "refused_count", "admissibility_rate_pct", "refusal_log"],
77
+ "properties": {
78
+ "total_findings_evaluated": { "type": "integer", "minimum": 0 },
79
+ "admitted_count": { "type": "integer", "minimum": 0 },
80
+ "refused_count": { "type": "integer", "minimum": 0 },
81
+ "admissibility_rate_pct": { "type": "integer", "minimum": 0, "maximum": 100 },
82
+ "refusal_log": {
83
+ "type": "array",
84
+ "items": {
85
+ "type": "object",
86
+ "required": ["finding_id", "subject", "gate_failed", "refusal_code", "refusal_rationale"],
87
+ "properties": {
88
+ "finding_id": { "type": "string" },
89
+ "detector_id": { "type": "string" },
90
+ "subject": { "type": "string" },
91
+ "gate_failed": { "type": "string" },
92
+ "refusal_code": { "type": "string" },
93
+ "refusal_rationale": { "type": "string" },
94
+ "suggested_handling": { "type": "string" }
95
+ },
96
+ "additionalProperties": false
97
+ }
98
+ },
99
+ "methodology": { "type": "string" }
100
+ },
101
+ "additionalProperties": false
102
+ },
103
+ "assumptions_and_constraints": {
104
+ "type": "object",
105
+ "required": ["assumptions", "dependencies", "exclusions", "constraints", "unresolved_unknowns"],
106
+ "properties": {
107
+ "assumptions": { "type": "array", "items": { "type": "string" } },
108
+ "dependencies": { "type": "array", "items": { "type": "string" } },
109
+ "exclusions": { "type": "array", "items": { "type": "string" } },
110
+ "constraints": { "type": "array", "items": { "type": "string" } },
111
+ "unresolved_unknowns": { "type": "array", "items": { "type": "string" } }
112
+ },
113
+ "additionalProperties": false
114
+ },
115
+ "work_packages": {
116
+ "type": "array",
117
+ "minItems": 1,
118
+ "items": {
119
+ "type": "object",
120
+ "required": ["work_package_id", "name", "deliverable_id", "owner", "requirements"],
121
+ "properties": {
122
+ "work_package_id": { "type": "string" },
123
+ "name": { "type": "string" },
124
+ "deliverable_id": { "type": "string" },
125
+ "owner": { "type": "string" },
126
+ "requirements": { "type": "array", "minItems": 1 }
127
+ },
128
+ "additionalProperties": false
129
+ }
130
+ },
131
+ "deliverables": {
132
+ "type": "array",
133
+ "minItems": 1,
134
+ "items": {
135
+ "type": "object",
136
+ "required": ["deliverable_id", "work_package_id", "title", "artifact_type", "format", "owner", "delivery_criteria"],
137
+ "properties": {
138
+ "deliverable_id": { "type": "string" },
139
+ "work_package_id": { "type": "string" },
140
+ "title": { "type": "string" },
141
+ "artifact_type": { "type": "string" },
142
+ "format": { "type": "string" },
143
+ "owner": { "type": "string" },
144
+ "delivery_criteria": { "type": "string" }
145
+ },
146
+ "additionalProperties": false
147
+ }
148
+ },
149
+ "technical_requirements": {
150
+ "type": "object",
151
+ "properties": {
152
+ "supported_frameworks": { "type": "array", "items": { "type": "string" } },
153
+ "git_branching_model": { "type": "string" },
154
+ "rollback_mechanism": { "type": "string" },
155
+ "access_requirements": { "type": "array", "items": { "type": "string" } }
156
+ },
157
+ "additionalProperties": false
158
+ },
159
+ "acceptance_criteria": {
160
+ "type": "array",
161
+ "minItems": 1,
162
+ "items": {
163
+ "type": "object",
164
+ "required": ["acceptance_test_id", "sow_requirement_id", "test_description", "validation_method", "pass_threshold", "evidence_required"],
165
+ "properties": {
166
+ "acceptance_test_id": { "type": "string" },
167
+ "sow_requirement_id": { "type": "string" },
168
+ "test_description": { "type": "string" },
169
+ "validation_method": { "type": "string" },
170
+ "pass_threshold": { "type": "string" },
171
+ "evidence_required": { "type": "string" }
172
+ },
173
+ "additionalProperties": false
174
+ }
175
+ },
176
+ "baseline_and_target_metrics": {
177
+ "type": "object",
178
+ "properties": {
179
+ "disclaimer": { "type": "string" },
180
+ "metrics": {
181
+ "type": "array",
182
+ "items": {
183
+ "type": "object",
184
+ "required": ["metric", "baseline", "target", "validation"],
185
+ "properties": {
186
+ "metric": { "type": "string" },
187
+ "baseline": { "type": "string" },
188
+ "target": { "type": "string" },
189
+ "validation": { "type": "string" }
190
+ },
191
+ "additionalProperties": false
192
+ }
193
+ }
194
+ },
195
+ "additionalProperties": false
196
+ },
197
+ "experiment_specifications": {
198
+ "type": "object",
199
+ "properties": {
200
+ "standard": { "type": "string" },
201
+ "stopping_criteria": { "type": "string" },
202
+ "guardrails": { "type": "array", "items": { "type": "string" } }
203
+ },
204
+ "additionalProperties": false
205
+ },
206
+ "raci_matrix": {
207
+ "type": "array",
208
+ "items": {
209
+ "type": "object",
210
+ "required": ["role", "r", "raci"],
211
+ "properties": {
212
+ "role": { "type": "string" },
213
+ "r": { "type": "string" },
214
+ "raci": { "type": "string" }
215
+ },
216
+ "additionalProperties": false
217
+ }
218
+ },
219
+ "customer_obligations": {
220
+ "type": "array",
221
+ "items": { "type": "string" }
222
+ },
223
+ "delivery_schedule": {
224
+ "type": "object",
225
+ "required": ["total_duration_weeks", "milestones"],
226
+ "properties": {
227
+ "total_duration_weeks": { "type": "integer", "minimum": 1 },
228
+ "milestones": {
229
+ "type": "array",
230
+ "minItems": 1,
231
+ "items": {
232
+ "type": "object",
233
+ "required": ["milestone_id", "work_package_id", "name", "fee_minor", "fee_usd", "billing_trigger", "target_delivery_week"],
234
+ "properties": {
235
+ "milestone_id": { "type": "string" },
236
+ "work_package_id": { "type": "string" },
237
+ "name": { "type": "string" },
238
+ "fee_minor": { "type": "integer", "minimum": 0 },
239
+ "fee_usd": { "type": "number", "minimum": 0 },
240
+ "billing_trigger": { "type": "string" },
241
+ "target_delivery_week": { "type": "integer", "minimum": 1 }
242
+ },
243
+ "additionalProperties": false
244
+ }
245
+ }
246
+ },
247
+ "additionalProperties": false
248
+ },
249
+ "change_control_process": {
250
+ "type": "object",
56
251
  "properties": {
57
- "total_findings_evaluated": { "type": "integer" },
58
- "admitted_count": { "type": "integer" },
59
- "refused_count": { "type": "integer" },
60
- "refusal_log": { "type": "array" }
252
+ "procedure": { "type": "string" },
253
+ "authorization": { "type": "string" },
254
+ "superceding_rules": { "type": "string" }
255
+ },
256
+ "additionalProperties": false
257
+ },
258
+ "risk_register": {
259
+ "type": "array",
260
+ "items": {
261
+ "type": "object",
262
+ "required": ["id", "category", "description", "mitigation"],
263
+ "properties": {
264
+ "id": { "type": "string" },
265
+ "category": { "type": "string" },
266
+ "description": { "type": "string" },
267
+ "mitigation": { "type": "string" }
268
+ },
269
+ "additionalProperties": false
61
270
  }
62
271
  },
63
- "work_packages": { "type": "array" },
64
- "deliverables": { "type": "array" },
65
- "acceptance_criteria": { "type": "array" },
272
+ "data_governance": {
273
+ "type": "object",
274
+ "properties": {
275
+ "authorized_sources": { "type": "array", "items": { "type": "string" } },
276
+ "retention_period": { "type": "string" },
277
+ "processing_purpose": { "type": "string" },
278
+ "deletion_upon_termination": { "type": "string" }
279
+ },
280
+ "additionalProperties": false
281
+ },
282
+ "security_requirements": {
283
+ "type": "array",
284
+ "items": { "type": "string" }
285
+ },
286
+ "platform_dependencies": {
287
+ "type": "array",
288
+ "items": { "type": "string" }
289
+ },
290
+ "qa_plan": {
291
+ "type": "object",
292
+ "properties": {
293
+ "methodology": { "type": "string" },
294
+ "evidence_package": { "type": "string" }
295
+ },
296
+ "additionalProperties": false
297
+ },
298
+ "governance_model": {
299
+ "type": "object",
300
+ "properties": {
301
+ "weekly_sync": { "type": "string" },
302
+ "written_reports": { "type": "string" },
303
+ "decision_logging": { "type": "string" }
304
+ },
305
+ "additionalProperties": false
306
+ },
307
+ "commercial_terms": {
308
+ "type": "object",
309
+ "required": ["total_fixed_fee_minor", "total_fixed_fee_usd", "currency", "payment_terms", "milestones"],
310
+ "properties": {
311
+ "total_fixed_fee_minor": { "type": "integer", "minimum": 0 },
312
+ "total_fixed_fee_usd": { "type": "number", "minimum": 0 },
313
+ "currency": { "type": "string", "enum": ["USD"] },
314
+ "payment_terms": { "type": "string" },
315
+ "milestones": { "type": "array" }
316
+ },
317
+ "additionalProperties": false
318
+ },
319
+ "out_of_scope": {
320
+ "type": "array",
321
+ "items": { "type": "string" }
322
+ },
323
+ "warranty_terms": {
324
+ "type": "object",
325
+ "properties": {
326
+ "warranty_window_days": { "type": "integer", "minimum": 0 },
327
+ "defect_definition": { "type": "string" },
328
+ "exclusion": { "type": "string" }
329
+ },
330
+ "additionalProperties": false
331
+ },
332
+ "completion_and_handoff": {
333
+ "type": "object",
334
+ "properties": {
335
+ "handoff_assets": { "type": "array", "items": { "type": "string" } },
336
+ "operational_signoff": { "type": "string" }
337
+ },
338
+ "additionalProperties": false
339
+ },
340
+ "termination_provisions": {
341
+ "type": "object",
342
+ "properties": {
343
+ "convenience": { "type": "string" },
344
+ "compensation": { "type": "string" },
345
+ "asset_transfer": { "type": "string" }
346
+ },
347
+ "additionalProperties": false
348
+ },
66
349
  "traceability_matrix": {
67
350
  "type": "array",
351
+ "minItems": 1,
68
352
  "items": {
69
353
  "type": "object",
70
354
  "required": [
71
355
  "finding_id",
72
356
  "recommendation",
73
357
  "sow_requirement_id",
358
+ "work_package_id",
74
359
  "deliverable_id",
75
360
  "acceptance_test_id",
76
361
  "owner",
77
- "evidence_id"
362
+ "evidence_id",
363
+ "evidence_ids"
78
364
  ],
79
365
  "properties": {
80
366
  "finding_id": { "type": "string" },
367
+ "detector_id": { "type": "string" },
81
368
  "recommendation": { "type": "string" },
82
369
  "sow_requirement_id": { "type": "string" },
83
370
  "work_package_id": { "type": "string" },
84
371
  "deliverable_id": { "type": "string" },
85
372
  "acceptance_test_id": { "type": "string" },
86
373
  "owner": { "type": "string" },
87
- "evidence_id": { "type": "string" }
88
- }
374
+ "owner_source": { "type": "string" },
375
+ "owner_mapping_version": { "type": "string" },
376
+ "evidence_id": { "type": "string" },
377
+ "evidence_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
378
+ "severity": { "type": "string" },
379
+ "target_subject": { "type": "string" },
380
+ "acceptance_criteria": { "type": "string" },
381
+ "acceptance_basis": { "type": "string" }
382
+ },
383
+ "additionalProperties": false
89
384
  }
385
+ },
386
+ "generation_provenance": {
387
+ "type": "object",
388
+ "required": [
389
+ "generated_at",
390
+ "generator_version",
391
+ "generation_mode",
392
+ "source_type",
393
+ "source_findings_count",
394
+ "synthetic_evidence"
395
+ ],
396
+ "properties": {
397
+ "generated_at": { "type": "string" },
398
+ "generator_version": { "type": "string" },
399
+ "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
400
+ "source_type": { "type": "string" },
401
+ "source_identifier": { "type": ["string", "null"] },
402
+ "source_findings_count": { "type": "integer", "minimum": 0 },
403
+ "findings_integrity_hash": { "type": ["string", "null"] },
404
+ "synthetic_evidence": { "type": "boolean" }
405
+ },
406
+ "additionalProperties": false
90
407
  }
91
- }
408
+ },
409
+ "additionalProperties": false
92
410
  }
@@ -7,7 +7,7 @@ description: >
7
7
  generative engine optimization, structured data governance, claim substantiation,
8
8
  crawler policy, entity consistency, content discoverability, or wants a site audited
9
9
  for how search and AI systems will retrieve, understand, cite, or recommend it.
10
- version: 1.18.0
10
+ version: 1.18.2
11
11
  ---
12
12
 
13
13
  # Citable — evidence and change control for search and AI citation readiness
@@ -259,6 +259,27 @@ The CRO suite completes the loop. Rules that govern every step:
259
259
  payload in the `citable_output_schema` 1.0 envelope
260
260
  (`schemas/cli-output-envelope.schema.json`).
261
261
 
262
+ ## Enterprise SOW & governance protocol (findings → admissibility → traceability → contract)
263
+
264
+ The SOW engine (`citable sow generate`, `citable sow validate`) translates verified audit findings into legally enforceable enterprise Statements of Work:
265
+
266
+ 1. **Authoritative Evidence Gating**: A contractual SOW requires verified audit findings from `--run <id>` or a live target. Never invent or synthesize findings in `CONTRACTUAL` or `DRAFT` modes; missing findings fail closed (`NoFindingsError`). Synthetic baseline findings are strictly confined to `--sample` / `--demo`.
267
+ 2. **Scope Admissibility Filter**: Audit findings do not automatically become contractual obligations. Every candidate finding must pass 7 objective gates:
268
+ - *Exclusion Gate*: No explicitly blacklisted detectors (`REFUSE-EXCLUDED`).
269
+ - *Discipline Authorization*: Finding discipline must be authorized in engagement terms (`REFUSE-DISCIPLINE-NOT-AUTHORIZED`).
270
+ - *Evidence Maturity*: Deterministic/observed confidence with real evidence (`REFUSE-EXPERIMENTAL`, `REFUSE-NO-EVIDENCE`).
271
+ - *Scope Boundary*: URL matches contracted origins, hosts, or paths (`REFUSE-OUT-OF-SCOPE`).
272
+ - *Technical Feasibility*: Reject legal, trademark, GDPR, or unfeasible remediation (`REFUSE-UNFEASIBLE-REMEDIATION`).
273
+ - *Commercial Materiality*: High severity or ICE score >= min threshold (`REFUSE-LOW-MATERIALITY`).
274
+ - *Measurable Acceptance*: Automated verification rerun detector or test (`REFUSE-UNVERIFIABLE`).
275
+ - *Ownership Clarity*: Resolvable accountable delivery owner (`REFUSE-OWNER-UNRESOLVED`).
276
+ All refused findings are logged in `admissibility_gate.refusal_log`. Never force a refused item into scope.
277
+ 3. **The 7-Column Traceability Matrix**: Every admitted requirement must strictly link:
278
+ `Finding ID → Recommendation → SOW Req ID → Deliverable ID → Acceptance Test ID → Responsible Owner → Source Evidence IDs`.
279
+ 4. **Commercial Integer Minor-Unit Arithmetic**: Milestone fee calculations are performed strictly in integer minor units (cents, exponent 2, currency `USD`) via `parseCommercialBudget` and `allocateMilestoneFees`. Remainder pennies are distributed deterministically across initial milestones. Fractional sub-cents (`100.001`) and negative budgets are rejected. Milestone fees and total fees must balance to the exact integer cent.
280
+ 5. **No Outcome Guarantees**: Fees are tied exclusively to verified deliverable acceptance and closed-loop test execution. Ranking, citation presence, and conversion revenue guarantees are strictly disclaimed.
281
+ 6. **Schema Validation Gate**: Exported SOW artifacts must validate against `schemas/sow.schema.json` with `additionalProperties: false`.
282
+
262
283
  ## Command workflows
263
284
 
264
285
  Detailed per-command workflows live in `commands/`. Follow them; they define
@@ -1 +1 @@
1
- 1.18.0
1
+ 1.18.2
@@ -0,0 +1,43 @@
1
+ ---
2
+ name: citable-remediator
3
+ description: Execute closed-loop code remediation, AST patch validation, detector rerun verification, and customer delivery kit generation. Not for unreviewed direct file writes, semantic copy generation, or outcome promises.
4
+ tools:
5
+ - Read
6
+ - Glob
7
+ - Grep
8
+ - Bash
9
+ model: inherit
10
+ maxTurns: 25
11
+ skills:
12
+ - citable
13
+ ---
14
+
15
+ You are Citable's closed-loop remediation specialist. Your responsibility is to take verified audit findings, apply safe, idempotent AST patches, verify that target detectors are resolved with zero regressions, and generate customer implementation packages.
16
+
17
+ ## Authority boundary
18
+
19
+ - You may run `citable remediate`, `citable verify remediation`, `citable kit export`, and `citable lint components`.
20
+ - Never edit target source files using ad-hoc text manipulation or unvalidated shell scripts. All code mutations must flow through `citable remediate` with AST validation.
21
+ - Refuse automated writes on semantic copy or editorial content (CRO-012, COMP-003); microcopy decisions belong to human editors (fact ≠ inference).
22
+ - Always verify that a rollback snapshot exists under `.citable/remediation/snapshots/` before writing to disk.
23
+ - Never claim a finding is fixed until `citable verify remediation` confirms the source detector no longer flags the target surface.
24
+ - Never promise ranking gains, AI citation rates, or conversion lift.
25
+
26
+ ## Workflow
27
+
28
+ 1. **Finding Triage**: Identify the finding ID, source run, and target file. Inspect the finding's observation and remediation recommendation.
29
+ 2. **Dry-Run Inspection**: Execute `citable remediate --finding <id> [--target <file>]` (dry-run by default) to inspect the unified diff, framework classification, and confidence score.
30
+ 3. **Confidence Gate**: If `computeConfidence` is below `0.70`, or if the patch involves editorial copy, report `patch_refused` with required human inputs.
31
+ 4. **Gated Write**: If confidence is sufficient and structural validation passes, run `citable remediate --finding <id> --write`.
32
+ 5. **Closed-Loop Verification**: Run `citable verify remediation --run <run-id> --finding <id> [--target <file>]` to re-execute the source detector against the patched file and check for regressions.
33
+ 6. **Delivery Kit Export**: If verified, run `citable kit export --run <run-id> --finding <id>` to generate an engineer-ready delivery kit with tests, diffs, and rollback instructions.
34
+
35
+ ## Return contract
36
+
37
+ Report:
38
+ 1. Target finding ID, file path, and detected framework;
39
+ 2. Unified diff and structural AST validation verdict;
40
+ 3. Rollback snapshot path and integrity hash;
41
+ 4. Closed-loop verification verdict (`verified`, `not_resolved`, `blocked`, or `patch_refused`);
42
+ 5. Regression sweep results (verifying zero new critical/high defects);
43
+ 6. Delivery kit path and customer acceptance criteria.
@@ -0,0 +1,43 @@
1
+ ---
2
+ name: citable-sow-architect
3
+ description: Generate contractually enforceable Statements of Work, evaluate Scope Admissibility Gates, enforce 7-column evidence traceability, and compile enterprise search/CRO intelligence briefings. Not for fabricated findings, unevidenced scope, or commercial guarantees.
4
+ tools:
5
+ - Read
6
+ - Glob
7
+ - Grep
8
+ - Bash
9
+ model: inherit
10
+ maxTurns: 25
11
+ skills:
12
+ - citable
13
+ ---
14
+
15
+ You are Citable's enterprise engagement and SOW architect. Your responsibility is to transform empirical audit findings into contractually enforceable, evidence-traceable Statements of Work (SOWs) and split executive intelligence briefings.
16
+
17
+ ## Authority boundary
18
+
19
+ - You may run `citable sow generate`, `citable sow validate`, `citable report search`, `citable report cro`, and read audit runs.
20
+ - Never synthesize or hallucinate findings in `CONTRACTUAL` mode. If audit evidence is missing, fail closed and report `NO_FINDINGS`. Synthetic findings are strictly confined to `--sample` / `--demo`.
21
+ - Never force an unqualified finding through the Admissibility Gate. Refused findings must be preserved in `admissibility_gate.refusal_log` with standard refusal codes.
22
+ - Enforce integer minor-unit arithmetic (cents, exponent 2, currency `USD`) for all fees. Never allow fractional pennies or budget drift across milestones.
23
+ - Strictly uphold Citable governance principles: **no search engine crawling, indexation, ranking, AI answer citation, or conversion revenue is guaranteed**. Fees are bound exclusively to verified deliverable acceptance.
24
+
25
+ ## Workflow
26
+
27
+ 1. **Source Evidence Resolution**: Determine the authoritative evidence source: explicit run (`--run <id>`), live scan (`--target <url>`), or sample demonstration (`--sample`). Explicit `--run` takes precedence.
28
+ 2. **Admissibility Gating**: Evaluate findings through the 7 admissibility gates (maturity, boundary, feasibility, materiality, acceptance, ownership, discipline). Record refused items in the contractual refusal log.
29
+ 3. **Traceability Binding**: Construct the 7-column matrix ensuring every requirement links: Finding ID → Recommendation → SOW Requirement ID → Deliverable ID → Acceptance Test ID → Owner → Source Evidence.
30
+ 4. **Commercial Minor-Unit Calculation**: Allocate milestone fees using integer minor units (`commercial_total_fee_minor`) with deterministic penny remainder distribution.
31
+ 5. **Contractual Export**: Generate SOW artifacts in Markdown, HTML, or JSON (`citable sow generate`).
32
+ 6. **Integrity Validation**: Run `citable sow validate <sow.json>` to verify strict schema conformance against `schemas/sow.schema.json` and cross-object runtime invariants.
33
+ 7. **Companion Briefings**: If executive reporting is requested, generate the companion 19-pillar Search Intelligence Briefing (`citable report search`) or 25-pillar CRO Briefing (`citable report cro`).
34
+
35
+ ## Return contract
36
+
37
+ Report:
38
+ 1. SOW ID, generation mode (`CONTRACTUAL`, `DRAFT`, `NON_CONTRACTUAL_SAMPLE`), and generator provenance;
39
+ 2. Commercial total value, currency (`USD`), minor units, and milestone fee schedule;
40
+ 3. Admissibility gate statistics: total findings, admitted count, refused count, and refusal codes;
41
+ 4. 7-column Traceability Matrix summary;
42
+ 5. Schema validation verdict against `schemas/sow.schema.json`;
43
+ 6. Output artifact paths (Markdown, HTML, JSON).
@@ -42,6 +42,19 @@ intent, not executability, so statuses are strict:
42
42
  | /citable validate-render | partially implemented by `observe render`; fixed Chromium profiles and schema-validated Chromium/Firefox/WebKit journeys are implemented, while reviewed semantic-impact detectors and reusable application-specific journey libraries remain |
43
43
  | /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | partially implemented by metric/observation imports, objective evaluation, Google/CrUX live APIs, custom citation adapters, and monitor comparisons |
44
44
  | `citable artifacts export/verify/import` | implemented — portable, versioned, checksum-bound run interchange without hosted-service authority |
45
+ | /citable sow generate / validate | implemented — 25-pillar SOW with 7-gate admissibility, 7-column traceability matrix, and integer minor-unit arithmetic (sow.md) |
46
+ | /citable report search / cro | implemented — split 19-pillar Search and 25-pillar CRO executive briefings with observation vs hypothesis vs causation taxonomy (reporting.md) |
47
+ | /citable sweep technical | implemented — static Core Web Vitals readiness analysis (LCP, INP, CLS) |
48
+ | /citable inspect eeat / inspect readiness | implemented — on-page 0-5 E-E-A-T rubric scoring and multi-answer-engine readiness (Perplexity, Copilot, ChatGPT) |
49
+ | /citable audit backlinks | implemented — off-page authority assessment, toxic TLD detection, and disavow generator |
50
+ | /citable prioritize matrix | implemented — Impact / Effort / Confidence (ICE) scoring matrix for findings |
51
+ | /citable roadmap strategic / cro roadmap | implemented — 30/90/180-day milestone implementation roadmaps |
52
+ | /citable cro / cro backlog | implemented — conversion path continuity, message match, cognitive friction, and falsifiable experiment backlog |
53
+ | /citable remediate / verify remediation / kit export | implemented — framework detection, idempotent AST patches, confidence gate, detector rerun verification, and customer delivery kits (remediation.md) |
54
+ | /citable check experiment | implemented — sample-ratio mismatch (SRM), early stopping, and statistical power guardrails |
55
+ | /citable test visual / preview cro | implemented — visual layout contract testing and accessibility-aware preview sandbox |
56
+ | /citable compatibility | implemented — pre-flight runtime, dependency, framework, and edge worker diagnostics |
57
+ | /citable corpus benchmark | implemented — golden benchmark corpus evaluation with per-detector precision/recall gates |
45
58
 
46
59
  Shared refusal conditions (all commands): any action that would fabricate
47
60
  facts, citations, evidence, authorship, reviews, corroboration, or hidden
@@ -7,6 +7,7 @@ external workspaces without changing its canonical bytes.
7
7
  citable artifacts export <run-id> --output <directory>
8
8
  citable artifacts verify --input <directory>
9
9
  citable artifacts import --input <directory>
10
+ citable artifacts verify-customer <file>
10
11
  ```
11
12
 
12
13
  An export contains the original run package plus
@@ -26,3 +27,7 @@ was authentic, that external observations were representative or complete, or
26
27
  that an intervention caused an outcome. Hosted tenancy, authentication,
27
28
  storage, retention, billing, scheduling, and dashboards are outside this
28
29
  contract.
30
+
31
+ Use `citable artifacts verify-customer <file>` to validate customer deliverables
32
+ (SOW, Search, and CRO JSON reports) against their JSON Schemas, verify arithmetic
33
+ consistency (e.g. minor-unit fee totals), and reject unescaped script or event handler injections.