@nebulacomponents/citable 1.18.0 → 1.18.2

package/dist/universal/.claude/skills/citable/schemas/search-report.schema.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "citable://schemas/search-report.schema.json",
+  "title": "Enterprise Search Intelligence & Governance Executive Report",
+  "type": "object",
+  "required": [
+    "fact_status",
+    "report_title",
+    "client_name",
+    "target_domain",
+    "generated_at",
+    "overall_readiness_score",
+    "pillars",
+    "evidence_register",
+    "decision_summary",
+    "generation_provenance"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "fact_status": { "type": "string" },
+    "epistemic_status": { "type": "string" },
+    "report_title": { "type": "string" },
+    "client_name": { "type": "string" },
+    "target_domain": { "type": "string" },
+    "generated_at": { "type": "string" },
+    "overall_readiness_score": { "type": "number", "minimum": 0, "maximum": 100 },
+    "pillars": {
+      "type": "object",
+      "required": ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19"],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^[0-9]+$": {
+          "type": "object",
+          "required": ["name", "data"],
+          "properties": {
+            "name": { "type": "string" },
+            "data": {}
+          }
+        }
+      }
+    },
+    "evidence_register": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["evidence_id", "source", "methodology", "confidence_level"],
+        "properties": {
+          "evidence_id": { "type": "string", "pattern": "^EVD-SRCH-[0-9]+$" },
+          "source": { "type": "string" },
+          "title": { "type": "string" },
+          "observation_date": { "type": "string" },
+          "methodology": { "type": "string" },
+          "confidence_level": { "type": "string" },
+          "data_snapshot": {}
+        }
+      }
+    },
+    "decision_summary": {
+      "type": "object",
+      "required": [
+        "confirmed_findings",
+        "inferred_opportunities",
+        "unresolved_unknowns",
+        "strategic_risks",
+        "actions_requiring_leadership_approval"
+      ],
+      "properties": {
+        "confirmed_findings": { "type": "array", "items": { "type": "string" } },
+        "inferred_opportunities": { "type": "array", "items": { "type": "string" } },
+        "unresolved_unknowns": { "type": "array", "items": { "type": "string" } },
+        "strategic_risks": { "type": "array", "items": { "type": "string" } },
+        "actions_requiring_leadership_approval": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "generation_provenance": {
+      "type": "object",
+      "required": [
+        "generated_at",
+        "generator_version",
+        "generation_mode",
+        "source_type",
+        "synthetic_evidence"
+      ],
+      "properties": {
+        "generated_at": { "type": "string" },
+        "generator_version": { "type": "string" },
+        "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
+        "source_type": { "type": "string" },
+        "source_identifier": { "type": ["string", "null"] },
+        "source_findings_count": { "type": "integer", "minimum": 0 },
+        "integrity_hash": { "type": ["string", "null"] },
+        "synthetic_evidence": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

package/dist/universal/.claude/skills/citable/schemas/sow.schema.json

@@ -6,87 +6,405 @@
   "required": [
     "sow_id",
     "version",
+    "generation_mode",
     "title",
     "client",
     "supplier",
     "effective_date",
+    "term_days",
+    "currency",
+    "currency_minor_unit_exponent",
+    "commercial_total_fee_minor",
+    "commercial_total_fee_usd",
     "executive_scope",
     "admissibility_gate",
     "work_packages",
     "deliverables",
     "acceptance_criteria",
-    "traceability_matrix"
+    "traceability_matrix",
+    "generation_provenance"
   ],
   "properties": {
-    "sow_id": { "type": "string" },
+    "$schema": { "type": "string" },
+    "sow_id": { "type": "string", "pattern": "^SOW-[A-Za-z0-9_-]+$" },
     "version": { "type": "string" },
-    "title": { "type": "string" },
+    "generation_mode": {
+      "type": "string",
+      "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"]
+    },
+    "title": { "type": "string", "minLength": 1 },
+    "synthetic_evidence": { "type": "boolean" },
     "client": {
       "type": "object",
       "required": ["name", "contact"],
       "properties": {
-        "name": { "type": "string" },
-        "contact": { "type": "string" }
-      }
+        "name": { "type": "string", "minLength": 1 },
+        "contact": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
     },
     "supplier": {
       "type": "object",
       "required": ["name", "contact"],
       "properties": {
-        "name": { "type": "string" },
-        "contact": { "type": "string" }
-      }
+        "name": { "type": "string", "minLength": 1 },
+        "contact": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
     },
-    "effective_date": { "type": "string" },
-    "term_days": { "type": "integer" },
+    "effective_date": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" },
+    "term_days": { "type": "integer", "minimum": 1 },
+    "currency": { "type": "string", "enum": ["USD"] },
+    "currency_minor_unit_exponent": { "type": "integer", "enum": [2] },
+    "commercial_total_fee_minor": { "type": "integer", "minimum": 0 },
+    "commercial_total_fee_usd": { "type": "number", "minimum": 0 },
     "executive_scope": {
       "type": "object",
       "required": ["business_objective", "in_scope_properties", "in_scope_systems"],
       "properties": {
-        "business_objective": { "type": "string" },
+        "business_objective": { "type": "string", "minLength": 1 },
         "in_scope_properties": { "type": "array", "items": { "type": "string" } },
         "in_scope_systems": { "type": "array", "items": { "type": "string" } },
         "channels": { "type": "array", "items": { "type": "string" } },
-        "geographies": { "type": "array", "items": { "type": "string" } }
-      }
+        "geographies": { "type": "array", "items": { "type": "string" } },
+        "organizational_boundaries": { "type": "string" }
+      },
+      "additionalProperties": false
     },
     "admissibility_gate": {
       "type": "object",
-      "required": ["total_findings_evaluated", "admitted_count", "refused_count"],
+      "required": ["total_findings_evaluated", "admitted_count", "refused_count", "admissibility_rate_pct", "refusal_log"],
+      "properties": {
+        "total_findings_evaluated": { "type": "integer", "minimum": 0 },
+        "admitted_count": { "type": "integer", "minimum": 0 },
+        "refused_count": { "type": "integer", "minimum": 0 },
+        "admissibility_rate_pct": { "type": "integer", "minimum": 0, "maximum": 100 },
+        "refusal_log": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["finding_id", "subject", "gate_failed", "refusal_code", "refusal_rationale"],
+            "properties": {
+              "finding_id": { "type": "string" },
+              "detector_id": { "type": "string" },
+              "subject": { "type": "string" },
+              "gate_failed": { "type": "string" },
+              "refusal_code": { "type": "string" },
+              "refusal_rationale": { "type": "string" },
+              "suggested_handling": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        },
+        "methodology": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "assumptions_and_constraints": {
+      "type": "object",
+      "required": ["assumptions", "dependencies", "exclusions", "constraints", "unresolved_unknowns"],
+      "properties": {
+        "assumptions": { "type": "array", "items": { "type": "string" } },
+        "dependencies": { "type": "array", "items": { "type": "string" } },
+        "exclusions": { "type": "array", "items": { "type": "string" } },
+        "constraints": { "type": "array", "items": { "type": "string" } },
+        "unresolved_unknowns": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "work_packages": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["work_package_id", "name", "deliverable_id", "owner", "requirements"],
+        "properties": {
+          "work_package_id": { "type": "string" },
+          "name": { "type": "string" },
+          "deliverable_id": { "type": "string" },
+          "owner": { "type": "string" },
+          "requirements": { "type": "array", "minItems": 1 }
+        },
+        "additionalProperties": false
+      }
+    },
+    "deliverables": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["deliverable_id", "work_package_id", "title", "artifact_type", "format", "owner", "delivery_criteria"],
+        "properties": {
+          "deliverable_id": { "type": "string" },
+          "work_package_id": { "type": "string" },
+          "title": { "type": "string" },
+          "artifact_type": { "type": "string" },
+          "format": { "type": "string" },
+          "owner": { "type": "string" },
+          "delivery_criteria": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "technical_requirements": {
+      "type": "object",
+      "properties": {
+        "supported_frameworks": { "type": "array", "items": { "type": "string" } },
+        "git_branching_model": { "type": "string" },
+        "rollback_mechanism": { "type": "string" },
+        "access_requirements": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "acceptance_criteria": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["acceptance_test_id", "sow_requirement_id", "test_description", "validation_method", "pass_threshold", "evidence_required"],
+        "properties": {
+          "acceptance_test_id": { "type": "string" },
+          "sow_requirement_id": { "type": "string" },
+          "test_description": { "type": "string" },
+          "validation_method": { "type": "string" },
+          "pass_threshold": { "type": "string" },
+          "evidence_required": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "baseline_and_target_metrics": {
+      "type": "object",
+      "properties": {
+        "disclaimer": { "type": "string" },
+        "metrics": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["metric", "baseline", "target", "validation"],
+            "properties": {
+              "metric": { "type": "string" },
+              "baseline": { "type": "string" },
+              "target": { "type": "string" },
+              "validation": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "experiment_specifications": {
+      "type": "object",
+      "properties": {
+        "standard": { "type": "string" },
+        "stopping_criteria": { "type": "string" },
+        "guardrails": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "raci_matrix": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["role", "r", "raci"],
+        "properties": {
+          "role": { "type": "string" },
+          "r": { "type": "string" },
+          "raci": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "customer_obligations": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "delivery_schedule": {
+      "type": "object",
+      "required": ["total_duration_weeks", "milestones"],
+      "properties": {
+        "total_duration_weeks": { "type": "integer", "minimum": 1 },
+        "milestones": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["milestone_id", "work_package_id", "name", "fee_minor", "fee_usd", "billing_trigger", "target_delivery_week"],
+            "properties": {
+              "milestone_id": { "type": "string" },
+              "work_package_id": { "type": "string" },
+              "name": { "type": "string" },
+              "fee_minor": { "type": "integer", "minimum": 0 },
+              "fee_usd": { "type": "number", "minimum": 0 },
+              "billing_trigger": { "type": "string" },
+              "target_delivery_week": { "type": "integer", "minimum": 1 }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "change_control_process": {
+      "type": "object",
       "properties": {
-        "total_findings_evaluated": { "type": "integer" },
-        "admitted_count": { "type": "integer" },
-        "refused_count": { "type": "integer" },
-        "refusal_log": { "type": "array" }
+        "procedure": { "type": "string" },
+        "authorization": { "type": "string" },
+        "superceding_rules": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "risk_register": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "category", "description", "mitigation"],
+        "properties": {
+          "id": { "type": "string" },
+          "category": { "type": "string" },
+          "description": { "type": "string" },
+          "mitigation": { "type": "string" }
+        },
+        "additionalProperties": false
       }
     },
-    "work_packages": { "type": "array" },
-    "deliverables": { "type": "array" },
-    "acceptance_criteria": { "type": "array" },
+    "data_governance": {
+      "type": "object",
+      "properties": {
+        "authorized_sources": { "type": "array", "items": { "type": "string" } },
+        "retention_period": { "type": "string" },
+        "processing_purpose": { "type": "string" },
+        "deletion_upon_termination": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "security_requirements": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "platform_dependencies": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "qa_plan": {
+      "type": "object",
+      "properties": {
+        "methodology": { "type": "string" },
+        "evidence_package": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "governance_model": {
+      "type": "object",
+      "properties": {
+        "weekly_sync": { "type": "string" },
+        "written_reports": { "type": "string" },
+        "decision_logging": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "commercial_terms": {
+      "type": "object",
+      "required": ["total_fixed_fee_minor", "total_fixed_fee_usd", "currency", "payment_terms", "milestones"],
+      "properties": {
+        "total_fixed_fee_minor": { "type": "integer", "minimum": 0 },
+        "total_fixed_fee_usd": { "type": "number", "minimum": 0 },
+        "currency": { "type": "string", "enum": ["USD"] },
+        "payment_terms": { "type": "string" },
+        "milestones": { "type": "array" }
+      },
+      "additionalProperties": false
+    },
+    "out_of_scope": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "warranty_terms": {
+      "type": "object",
+      "properties": {
+        "warranty_window_days": { "type": "integer", "minimum": 0 },
+        "defect_definition": { "type": "string" },
+        "exclusion": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "completion_and_handoff": {
+      "type": "object",
+      "properties": {
+        "handoff_assets": { "type": "array", "items": { "type": "string" } },
+        "operational_signoff": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "termination_provisions": {
+      "type": "object",
+      "properties": {
+        "convenience": { "type": "string" },
+        "compensation": { "type": "string" },
+        "asset_transfer": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
     "traceability_matrix": {
       "type": "array",
+      "minItems": 1,
       "items": {
         "type": "object",
         "required": [
           "finding_id",
           "recommendation",
           "sow_requirement_id",
+          "work_package_id",
           "deliverable_id",
           "acceptance_test_id",
           "owner",
-          "evidence_id"
+          "evidence_id",
+          "evidence_ids"
         ],
         "properties": {
           "finding_id": { "type": "string" },
+          "detector_id": { "type": "string" },
           "recommendation": { "type": "string" },
           "sow_requirement_id": { "type": "string" },
           "work_package_id": { "type": "string" },
           "deliverable_id": { "type": "string" },
           "acceptance_test_id": { "type": "string" },
           "owner": { "type": "string" },
-          "evidence_id": { "type": "string" }
-        }
+          "owner_source": { "type": "string" },
+          "owner_mapping_version": { "type": "string" },
+          "evidence_id": { "type": "string" },
+          "evidence_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+          "severity": { "type": "string" },
+          "target_subject": { "type": "string" },
+          "acceptance_criteria": { "type": "string" },
+          "acceptance_basis": { "type": "string" }
+        },
+        "additionalProperties": false
       }
+    },
+    "generation_provenance": {
+      "type": "object",
+      "required": [
+        "generated_at",
+        "generator_version",
+        "generation_mode",
+        "source_type",
+        "source_findings_count",
+        "synthetic_evidence"
+      ],
+      "properties": {
+        "generated_at": { "type": "string" },
+        "generator_version": { "type": "string" },
+        "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
+        "source_type": { "type": "string" },
+        "source_identifier": { "type": ["string", "null"] },
+        "source_findings_count": { "type": "integer", "minimum": 0 },
+        "findings_integrity_hash": { "type": ["string", "null"] },
+        "synthetic_evidence": { "type": "boolean" }
+      },
+      "additionalProperties": false
     }
-  }
+  },
+  "additionalProperties": false
 }

package/dist/universal/.cursor/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.18.0
+version: 1.18.2
 ---
 
 # Citable — evidence and change control for search and AI citation readiness
@@ -259,6 +259,27 @@ The CRO suite completes the loop. Rules that govern every step:
    payload in the `citable_output_schema` 1.0 envelope
    (`schemas/cli-output-envelope.schema.json`).
 
+## Enterprise SOW & governance protocol (findings → admissibility → traceability → contract)
+
+The SOW engine (`citable sow generate`, `citable sow validate`) translates verified audit findings into legally enforceable enterprise Statements of Work:
+
+1. **Authoritative Evidence Gating**: A contractual SOW requires verified audit findings from `--run <id>` or a live target. Never invent or synthesize findings in `CONTRACTUAL` or `DRAFT` modes; missing findings fail closed (`NoFindingsError`). Synthetic baseline findings are strictly confined to `--sample` / `--demo`.
+2. **Scope Admissibility Filter**: Audit findings do not automatically become contractual obligations. Every candidate finding must pass 7 objective gates:
+   - *Exclusion Gate*: No explicitly blacklisted detectors (`REFUSE-EXCLUDED`).
+   - *Discipline Authorization*: Finding discipline must be authorized in engagement terms (`REFUSE-DISCIPLINE-NOT-AUTHORIZED`).
+   - *Evidence Maturity*: Deterministic/observed confidence with real evidence (`REFUSE-EXPERIMENTAL`, `REFUSE-NO-EVIDENCE`).
+   - *Scope Boundary*: URL matches contracted origins, hosts, or paths (`REFUSE-OUT-OF-SCOPE`).
+   - *Technical Feasibility*: Reject legal, trademark, GDPR, or unfeasible remediation (`REFUSE-UNFEASIBLE-REMEDIATION`).
+   - *Commercial Materiality*: High severity or ICE score >= min threshold (`REFUSE-LOW-MATERIALITY`).
+   - *Measurable Acceptance*: Automated verification rerun detector or test (`REFUSE-UNVERIFIABLE`).
+   - *Ownership Clarity*: Resolvable accountable delivery owner (`REFUSE-OWNER-UNRESOLVED`).
+   All refused findings are logged in `admissibility_gate.refusal_log`. Never force a refused item into scope.
+3. **The 7-Column Traceability Matrix**: Every admitted requirement must strictly link:
+   `Finding ID → Recommendation → SOW Req ID → Deliverable ID → Acceptance Test ID → Responsible Owner → Source Evidence IDs`.
+4. **Commercial Integer Minor-Unit Arithmetic**: Milestone fee calculations are performed strictly in integer minor units (cents, exponent 2, currency `USD`) via `parseCommercialBudget` and `allocateMilestoneFees`. Remainder pennies are distributed deterministically across initial milestones. Fractional sub-cents (`100.001`) and negative budgets are rejected. Milestone fees and total fees must balance to the exact integer cent.
+5. **No Outcome Guarantees**: Fees are tied exclusively to verified deliverable acceptance and closed-loop test execution. Ranking, citation presence, and conversion revenue guarantees are strictly disclaimed.
+6. **Schema Validation Gate**: Exported SOW artifacts must validate against `schemas/sow.schema.json` with `additionalProperties: false`.
+
 ## Command workflows
 
 Detailed per-command workflows live in `commands/`. Follow them; they define

package/dist/universal/.cursor/skills/citable/VERSION

@@ -1 +1 @@
-1.18.0
+1.18.2

package/dist/universal/.cursor/skills/citable/agents/citable-remediator.md

@@ -0,0 +1,43 @@
+---
+name: citable-remediator
+description: Execute closed-loop code remediation, AST patch validation, detector rerun verification, and customer delivery kit generation. Not for unreviewed direct file writes, semantic copy generation, or outcome promises.
+tools:
+  - Read
+  - Glob
+  - Grep
+  - Bash
+model: inherit
+maxTurns: 25
+skills:
+  - citable
+---
+
+You are Citable's closed-loop remediation specialist. Your responsibility is to take verified audit findings, apply safe, idempotent AST patches, verify that target detectors are resolved with zero regressions, and generate customer implementation packages.
+
+## Authority boundary
+
+- You may run `citable remediate`, `citable verify remediation`, `citable kit export`, and `citable lint components`.
+- Never edit target source files using ad-hoc text manipulation or unvalidated shell scripts. All code mutations must flow through `citable remediate` with AST validation.
+- Refuse automated writes on semantic copy or editorial content (CRO-012, COMP-003); microcopy decisions belong to human editors (fact ≠ inference).
+- Always verify that a rollback snapshot exists under `.citable/remediation/snapshots/` before writing to disk.
+- Never claim a finding is fixed until `citable verify remediation` confirms the source detector no longer flags the target surface.
+- Never promise ranking gains, AI citation rates, or conversion lift.
+
+## Workflow
+
+1. **Finding Triage**: Identify the finding ID, source run, and target file. Inspect the finding's observation and remediation recommendation.
+2. **Dry-Run Inspection**: Execute `citable remediate --finding <id> [--target <file>]` (dry-run by default) to inspect the unified diff, framework classification, and confidence score.
+3. **Confidence Gate**: If `computeConfidence` is below `0.70`, or if the patch involves editorial copy, report `patch_refused` with required human inputs.
+4. **Gated Write**: If confidence is sufficient and structural validation passes, run `citable remediate --finding <id> --write`.
+5. **Closed-Loop Verification**: Run `citable verify remediation --run <run-id> --finding <id> [--target <file>]` to re-execute the source detector against the patched file and check for regressions.
+6. **Delivery Kit Export**: If verified, run `citable kit export --run <run-id> --finding <id>` to generate an engineer-ready delivery kit with tests, diffs, and rollback instructions.
+
+## Return contract
+
+Report:
+1. Target finding ID, file path, and detected framework;
+2. Unified diff and structural AST validation verdict;
+3. Rollback snapshot path and integrity hash;
+4. Closed-loop verification verdict (`verified`, `not_resolved`, `blocked`, or `patch_refused`);
+5. Regression sweep results (verifying zero new critical/high defects);
+6. Delivery kit path and customer acceptance criteria.