@nebulacomponents/citable 1.18.1 → 1.18.2

package/CHANGELOG.md

@@ -15,6 +15,36 @@ _No entries yet. See [`BOUNTY.md`](BOUNTY.md) to submit the first one._
 
 ## Unreleased
 
+## 1.18.2 — 2026-09-10
+
+### Fixed — Executive Reporting, Evidence Provenance, and Commercial Artifact Hardening
+
+- **Eliminated Fabricated Metrics in Executive Reports**:
+  - `src/reporting/executiveSearchReport.js`: Replaced all hardcoded fallback percentages and default metrics across Visibility Baseline, Organic Performance, SERP Landscape, AEO/GEO, E-E-A-T, Competitive Intelligence, Backlinks, and Measurement Integrity with standardized `NOT_OBSERVED` epistemic status envelopes whenever underlying analytics or platform telemetry (GSC, GA4, GTM, backlink crawls) is absent.
+  - `src/reporting/executiveCroReport.js`: Refactored to separate empirical observations from predictive hypotheses and causal evidence across all 25 enterprise pillars. Telemetry metrics (e.g. bounce rates, rage clicks, cohort divergence) fail closed to `NOT_OBSERVED` when session event streams are not provided.
+  - Added strict JSON schemas: `schemas/search-report.schema.json` and `schemas/cro-report.schema.json` compiled and validated with Ajv.
+- **Unified Canonical Evidence Source Resolver & Run Verifier**:
+  - `src/shared/evidenceSourceResolver.js`: Unified evidence source resolution (`DIRECT_INPUT`, `EXPLICIT_RUN`, `LIVE_INSPECTION`, `LATEST_RECORDED_RUN`, `SAMPLE`) across SOW and Executive Reports with deterministic chronology and tie-breaking.
+  - `src/shared/runPackageVerifier.js`: Enforces checksum verification, file sha256 integrity, manifest schema validation, and run completion checks.
+- **Epistemic Invariant Envelopes**:
+  - `src/shared/epistemicStatus.js`: Defined standard epistemic status values (`OBSERVED`, `DERIVED`, `MODELED`, `HUMAN_REVIEWED`, `NOT_OBSERVED`, `NOT_APPLICABLE`, `UNRESOLVED`, `SYNTHETIC_SAMPLE`) and typed value wrappers ensuring missing facts are explicitly visible rather than silently substituted with plausible numbers.
+- **Domain & Public Suffix Boundary Parsing**:
+  - `src/shared/domainUtils.js`: Implemented multi-part public suffix extraction (`extractRegistrableDomain`, `extractPublicSuffix`, `isAuthoritativeDomain`) handling multi-part suffixes (e.g. `.co.uk`, `.com.au`, `.gov.uk`) and preventing substring boundary spoofing.
+  - `src/analysis/eeat.js`: Replaced naive substring matching with authoritative domain checks and enforced strict page-scoped claim filtering.
+  - `src/analysis/offpage.js`: Applied public suffix parsing to backlink profiles; empty anchor text is strictly categorized as `empty_anchor` rather than branded; corrected multi-token `rel` attribution (`nofollow`, `ugc`, `sponsored`).
+- **AEO Readiness Scoring & Null Safety**:
+  - `src/analysis/readiness.js`: Standardized score naming (`score`, `readiness_score`), eliminated NaN drift, reclassified checks as `MODELED_EXTRACTION_READINESS` (`epistemic_status: 'MODELED'`).
+  - `src/analysis/behavioral.js`: Fixed null-handling when telemetry streams are absent.
+- **Commercial SOW Contractual Mode Hardening**:
+  - `src/sow/generateSow.js` & `src/sow/admissibilityGate.js`: Refactored to use canonical source resolver and HTML escaping. In contractual mode, explicit commercial parameters and non-empty in-scope properties are strictly required; built-in template default owners are refused (`REFUSE-TEMPLATE-DEFAULT-OWNER`); `acceptance_basis` is recorded on every requirement; finding ID and requirement ID uniqueness invariants are enforced.
+- **HTML/Markdown Escaping & Injection Protection**:
+  - `src/shared/htmlEscape.js`: Implemented canonical escaping utilities (`escapeHtml`, `escapeHtmlAttr`, `sanitizeUrl`, `escapeMarkdownTableCell`, `sanitizeForMarkdown`) protecting all rendered client names, finding summaries, recommendations, and subjects against raw script and event handler injection.
+- **Customer Artifact Verification Tooling**:
+  - `src/artifacts/verifyCustomerArtifact.js`: Validates customer artifacts (SOW, Search Report, CRO Report) against schemas, verifies arithmetic invariants, enforces absence of synthetic/sample data in contractual mode, and detects unescaped script injections. Exposed via CLI command `citable artifacts verify-customer <file>`.
+- **Supply Chain Security & Schema Validation**:
+  - Pinned all GitHub Action steps across all 8 workflows to immutable commit SHAs.
+  - Added `npm run validate:schemas` compiling all 64 schemas cleanly with Ajv.
+
 ## 1.18.1 — 2026-09-10
 
 ### Fixed — SOW Evidence Traceability & Admissibility Gate Hardening

package/dist/universal/.agents/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.18.1
+version: 1.18.2
 ---
 
 # Citable — evidence and change control for search and AI citation readiness

package/dist/universal/.agents/skills/citable/VERSION

@@ -1 +1 @@
-1.18.1
+1.18.2

package/dist/universal/.agents/skills/citable/commands/artifact-interchange.md

@@ -7,6 +7,7 @@ external workspaces without changing its canonical bytes.
 citable artifacts export <run-id> --output <directory>
 citable artifacts verify --input <directory>
 citable artifacts import --input <directory>
+citable artifacts verify-customer <file>
 ```
 
 An export contains the original run package plus
@@ -26,3 +27,7 @@ was authentic, that external observations were representative or complete, or
 that an intervention caused an outcome. Hosted tenancy, authentication,
 storage, retention, billing, scheduling, and dashboards are outside this
 contract.
+
+Use `citable artifacts verify-customer <file>` to validate customer deliverables
+(SOW, Search, and CRO JSON reports) against their JSON Schemas, verify arithmetic
+consistency (e.g. minor-unit fee totals), and reject unescaped script or event handler injections.

package/dist/universal/.agents/skills/citable/commands/remediation.md

@@ -12,7 +12,7 @@ The remediation suite provides safe, gated code fixes for deterministic technica
 
 ## 1. Safe Patch Application (`citable remediate`)
 
-1. **Framework Detection**: Identifies target source syntax (`jsx`, `tsx`, `vue`, `html`). Fails closed on unknown or ambiguous frameworks.
+1. **Framework Detection**: Identifies target source syntax (`jsx`, `tsx`, `vue`, `svelte`, `html`). Fails closed on unknown or ambiguous frameworks.
 2. **Idempotent AST Patching**: Patches are mathematically verified to be idempotent (`applyPatchDetailed`): applying the patch a second time produces an identical AST (a fixed point).
 3. **Structural Validation Gate**: Runs `validatePatchedSource` to confirm that the patch does not break AST structure, introduce syntax errors, or alter unrelated code blocks.
 4. **Confidence Threshold**: Computes an explicit multi-factor confidence score (`computeConfidence`). `--write` is refused if confidence falls below `0.70`.

package/dist/universal/.agents/skills/citable/commands/sow.md

@@ -1,6 +1,6 @@
 ---
 command: /citable sow generate [--target <dir|url>] [--run <id>] [--budget <amount>] [--budget-minor <cents>] [--format md|html|json] [--output <path>] [--sample] [--draft]
-purpose: Generate a contractually binding, evidence-traceable enterprise Statement of Work (SOW) from verified audit findings through a formal 7-gate scope admissibility filter and 7-column traceability matrix.
+purpose: Generate a contractually binding, evidence-traceable enterprise Statement of Work (SOW) from verified audit findings through a formal 8-gate scope admissibility filter and 7-column traceability matrix.
 preconditions: [at least one finalized audit run with verified findings or live target; sample mode required for synthetic demonstrations]
 failure_behaviour: absent or unverified findings in contractual mode -> NoFindingsError; all findings refused -> NoAdmissibleRequirementsError; non-existent run -> RunNotFoundError; negative or sub-cent budget -> BudgetCalculationError; invariant drift -> SowInvariantError
 artifacts_created: [SOW.md, SOW.html, or SOW.json at specified output path]
@@ -34,7 +34,7 @@ Acceptance Test (automated closed-loop detector rerun)
 
 ## 2. The Scope Admissibility Gate
 
-Audit findings do NOT automatically become contractual obligations. Every candidate finding must pass 7 admissibility gates:
+Audit findings do NOT automatically become contractual obligations. Every candidate finding must pass 8 admissibility gates:
 
 | Gate | Verification Check | Failure Refusal Code | Contractual Handling |
 | :--- | :--- | :--- | :--- |

package/dist/universal/.agents/skills/citable/manifest.json

@@ -1,11 +1,11 @@
 {
   "name": "citable",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "managedBy": "citable-cli",
   "provider": "codex",
   "providerName": "OpenAI Codex",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.18.1",
+  "sourcePackage": "@nebulacomponents/citable@1.18.2",
   "variantPath": ".agents/skills/citable",
   "agentProfiles": {
     "status": "unsupported",
@@ -17,7 +17,7 @@
     "agents/citable-semantic-reviewer.md": "sha256:77582263a048ea41ae3f7ee326dbd036222fab81ed83bda98034ec83ee21ef2e",
     "agents/citable-sow-architect.md": "sha256:d55cf8bc2ab8f364c0d95ec39fc44406684110d1e4d1ff2e34702ded003094b4",
     "commands/action-findings.md": "sha256:b1d5c4d8d8b1092bc73b99430bea0a2e460031658e42bed33eb94da9a3c0e48f",
-    "commands/artifact-interchange.md": "sha256:18d56fbfa6bb3f23f08593a9a8135e51c268618b049e53c793969b68000875c3",
+    "commands/artifact-interchange.md": "sha256:300062880e141b80ce23024c0a9b309e93a1e2aeb87e22a68860d27388a3acb7",
     "commands/delivery.md": "sha256:3b29250f9e9f84442812e320a70d5d2784b4286e91af3866f99cb6062a85a10f",
     "commands/field-validation.md": "sha256:4f24b2758eef746d704b218364f1e45ee9e07418c8ae111081b1fd41f93dde2d",
     "commands/governance.md": "sha256:41792a2a08930c604cc7b635c23fb3cbdeebc5af610ef38c795f1a412c4a0816",
@@ -29,10 +29,10 @@
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
     "commands/plan-audit.md": "sha256:69875c9654e13b84566dafb16afe5afe08cffb9f3bded1f2d8d2261ae871c869",
     "commands/README.md": "sha256:683b226020582dd93e24a2fb59ce6264735f44eb26353f977153034a615f871c",
-    "commands/remediation.md": "sha256:7f983ecf63ec6741fa7e291243c6faeb44a5b140655a5ec3a62bcbc4c16d8870",
+    "commands/remediation.md": "sha256:f2a90608079d823b8192aa7acad8a60c923ac02b4e01e5ca653f45e9f52c7998",
     "commands/reporting.md": "sha256:f560f3c8349fcdaf6d3c3a27968016e20ef42ef2473292f7b83260cfb4b3b2e6",
     "commands/reviews.md": "sha256:902904aaa405fe5724cf0662c7a5a36eab9a4fe0eb81cbd95ffa2fff946e0ac8",
-    "commands/sow.md": "sha256:576c0ff119e5a9193476c20aee65019dbe91502d624d3a8fc8469915a3bc2b19",
+    "commands/sow.md": "sha256:caf4b7e4b9f0e801fbc86f40e6efb8a057d1243dc488b0bc629b8fb2b90c6933",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:4b0041764f2fdbfbff1e1a2907eaed02cf0aef491254a9c98ec9250ff1084e80",
@@ -71,6 +71,7 @@
     "schemas/corroboration-import.schema.json": "sha256:927983d0590f1ec569e86195d2031be0cd212f9436ff98acca468cbae108d85e",
     "schemas/crawler-identity.schema.json": "sha256:e1e3e6da203a8bc49fba8f9bbde525368891db022d542fc615b677401825351d",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
+    "schemas/cro-report.schema.json": "sha256:270cfe946d3dce007672c5fd5e052f07e3322c85a2bfcc0cd47f34ce569f2fb1",
     "schemas/customer-outcome.schema.json": "sha256:c0cdfee31a692feadb31dc6be734d45ae178ee53f28349c2a9e7504bdfcf9e50",
     "schemas/decision.schema.json": "sha256:7c30f3ad83a6aa0b67ecc51ac6691e5e041b633d01bab17cee2b5218d926204e",
     "schemas/deployment-receipt.schema.json": "sha256:789455907e7f3039fd55ee5b2568e09871128f513f5ddfe1f3afac1a4dd6b2bd",
@@ -111,13 +112,14 @@
     "schemas/sampling-plan.schema.json": "sha256:005f70f149baaacd7de698548d556d3e401c630978748271b0e14a74726dd413",
     "schemas/scenario.schema.json": "sha256:3f5bc2032d08f973600db068f475176a0e4706b33be42f99c778fe755a0ff38b",
     "schemas/schedule.schema.json": "sha256:645df065bf33577a960c0bf8bb97e141e9326840303569468dae8a553d468482",
+    "schemas/search-report.schema.json": "sha256:0ae2dad77cf3c6f2abac22a8180d66bde8ebd044ed6324a56329cd12a3c898f2",
     "schemas/source-identity-chain.schema.json": "sha256:a65d9c12eaed1bd6b637c66a2f9362c17287fdfcb454d8676fb611d2d28aa019",
-    "schemas/sow.schema.json": "sha256:14ff2e24e03f678d3c72f97c27b0a68e117472dcc640aab7491bba1a82457906",
+    "schemas/sow.schema.json": "sha256:3a3fd6048a747a9bc0cfaea98920376b043616a33c953a9eb8b74d0ae32dded0",
     "schemas/variance.schema.json": "sha256:68389f64f0a3be13ff8951e8eefba9a5c31d0738325cb47e37c1a8435bea48f0",
     "scripts/README.md": "sha256:9eee4e8beb4579a183bd714c9dd24b83abd020753eada5caeffae004739d60b5",
-    "SKILL.md": "sha256:d50cc48a120fee6ad3c3bf0d1bfa8ceb5bba3614bdc6af8aacc4293b9e4a1970",
+    "SKILL.md": "sha256:a2c2ce3aced71fc2a66f2e46b4a9fcc10b65819dcef58176b2cefe674d6a941b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:71fc7bd16b1bc9b3681085fb0be8aea0b3a37d90d1685938dc2e8a31bf8c9b94"
+    "VERSION": "sha256:0a1b17e91d514c0c9e88520e6091e2d52a6faf8296892cad7355ff0723a42914"
   },
-  "treeHash": "sha256:96d4589fced40f7030b6c1e48132abf2d37ebae771a1401d6f2a74e4f8fc52d1"
+  "treeHash": "sha256:2d4210d9dd26b7952f53964402abf06c8ae12ae43cb8ac5c568f070ab44b0001"
 }

package/dist/universal/.agents/skills/citable/schemas/cro-report.schema.json

@@ -0,0 +1,112 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "citable://schemas/cro-report.schema.json",
+  "title": "Enterprise CRO & Journey Intelligence Executive Report",
+  "type": "object",
+  "required": [
+    "fact_status",
+    "report_title",
+    "client_name",
+    "target_domain",
+    "generated_at",
+    "overall_conversion_readiness",
+    "pillars",
+    "evidence_register",
+    "decision_summary",
+    "generation_provenance"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "fact_status": { "type": "string" },
+    "epistemic_status": { "type": "string" },
+    "report_title": { "type": "string" },
+    "client_name": { "type": "string" },
+    "target_domain": { "type": "string" },
+    "generated_at": { "type": "string" },
+    "overall_conversion_readiness": { "type": "number", "minimum": 0, "maximum": 100 },
+    "epistemological_framework": {
+      "type": "object",
+      "properties": {
+        "observation": { "type": "string" },
+        "hypothesis": { "type": "string" },
+        "causation": { "type": "string" },
+        "unknowns": { "type": "string" }
+      }
+    },
+    "pillars": {
+      "type": "object",
+      "required": [
+        "1", "2", "3", "4", "5", "6", "7", "8", "9", "10",
+        "11", "12", "13", "14", "15", "16", "17", "18", "19", "20",
+        "21", "22", "23", "24", "25"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^[0-9]+$": {
+          "type": "object",
+          "required": ["name", "data"],
+          "properties": {
+            "name": { "type": "string" },
+            "data": {}
+          }
+        }
+      }
+    },
+    "evidence_register": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["evidence_id", "source", "methodology", "confidence_level"],
+        "properties": {
+          "evidence_id": { "type": "string", "pattern": "^EVD-CRO-[0-9]+$" },
+          "source": { "type": "string" },
+          "title": { "type": "string" },
+          "observation_date": { "type": "string" },
+          "methodology": { "type": "string" },
+          "confidence_level": { "type": "string" },
+          "data_snapshot": {}
+        }
+      }
+    },
+    "decision_summary": {
+      "type": "object",
+      "required": [
+        "observed_conversion_failures",
+        "evidence_supported_hypotheses",
+        "causal_findings",
+        "unresolved_unknowns",
+        "recommended_interventions"
+      ],
+      "properties": {
+        "observed_conversion_failures": { "type": "array", "items": { "type": "string" } },
+        "evidence_supported_hypotheses": { "type": "array", "items": { "type": "string" } },
+        "causal_findings": { "type": "array", "items": { "type": "string" } },
+        "unresolved_unknowns": { "type": "array", "items": { "type": "string" } },
+        "recommended_interventions": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "generation_provenance": {
+      "type": "object",
+      "required": [
+        "generated_at",
+        "generator_version",
+        "generation_mode",
+        "source_type",
+        "synthetic_evidence"
+      ],
+      "properties": {
+        "generated_at": { "type": "string" },
+        "generator_version": { "type": "string" },
+        "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
+        "source_type": { "type": "string" },
+        "source_identifier": { "type": ["string", "null"] },
+        "source_findings_count": { "type": "integer", "minimum": 0 },
+        "integrity_hash": { "type": ["string", "null"] },
+        "synthetic_evidence": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

package/dist/universal/.agents/skills/citable/schemas/search-report.schema.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "citable://schemas/search-report.schema.json",
+  "title": "Enterprise Search Intelligence & Governance Executive Report",
+  "type": "object",
+  "required": [
+    "fact_status",
+    "report_title",
+    "client_name",
+    "target_domain",
+    "generated_at",
+    "overall_readiness_score",
+    "pillars",
+    "evidence_register",
+    "decision_summary",
+    "generation_provenance"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "fact_status": { "type": "string" },
+    "epistemic_status": { "type": "string" },
+    "report_title": { "type": "string" },
+    "client_name": { "type": "string" },
+    "target_domain": { "type": "string" },
+    "generated_at": { "type": "string" },
+    "overall_readiness_score": { "type": "number", "minimum": 0, "maximum": 100 },
+    "pillars": {
+      "type": "object",
+      "required": ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19"],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^[0-9]+$": {
+          "type": "object",
+          "required": ["name", "data"],
+          "properties": {
+            "name": { "type": "string" },
+            "data": {}
+          }
+        }
+      }
+    },
+    "evidence_register": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["evidence_id", "source", "methodology", "confidence_level"],
+        "properties": {
+          "evidence_id": { "type": "string", "pattern": "^EVD-SRCH-[0-9]+$" },
+          "source": { "type": "string" },
+          "title": { "type": "string" },
+          "observation_date": { "type": "string" },
+          "methodology": { "type": "string" },
+          "confidence_level": { "type": "string" },
+          "data_snapshot": {}
+        }
+      }
+    },
+    "decision_summary": {
+      "type": "object",
+      "required": [
+        "confirmed_findings",
+        "inferred_opportunities",
+        "unresolved_unknowns",
+        "strategic_risks",
+        "actions_requiring_leadership_approval"
+      ],
+      "properties": {
+        "confirmed_findings": { "type": "array", "items": { "type": "string" } },
+        "inferred_opportunities": { "type": "array", "items": { "type": "string" } },
+        "unresolved_unknowns": { "type": "array", "items": { "type": "string" } },
+        "strategic_risks": { "type": "array", "items": { "type": "string" } },
+        "actions_requiring_leadership_approval": { "type": "array", "items": { "type": "string" } }
+      },
+      "additionalProperties": false
+    },
+    "generation_provenance": {
+      "type": "object",
+      "required": [
+        "generated_at",
+        "generator_version",
+        "generation_mode",
+        "source_type",
+        "synthetic_evidence"
+      ],
+      "properties": {
+        "generated_at": { "type": "string" },
+        "generator_version": { "type": "string" },
+        "generation_mode": { "type": "string", "enum": ["CONTRACTUAL", "DRAFT", "NON_CONTRACTUAL_SAMPLE"] },
+        "source_type": { "type": "string" },
+        "source_identifier": { "type": ["string", "null"] },
+        "source_findings_count": { "type": "integer", "minimum": 0 },
+        "integrity_hash": { "type": ["string", "null"] },
+        "synthetic_evidence": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

package/dist/universal/.agents/skills/citable/schemas/sow.schema.json

@@ -52,7 +52,7 @@
       },
       "additionalProperties": false
     },
-    "effective_date": { "type": "string" },
+    "effective_date": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" },
     "term_days": { "type": "integer", "minimum": 1 },
     "currency": { "type": "string", "enum": ["USD"] },
     "currency_minor_unit_exponent": { "type": "integer", "enum": [2] },
@@ -377,7 +377,8 @@
           "evidence_ids": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
           "severity": { "type": "string" },
           "target_subject": { "type": "string" },
-          "acceptance_criteria": { "type": "string" }
+          "acceptance_criteria": { "type": "string" },
+          "acceptance_basis": { "type": "string" }
         },
         "additionalProperties": false
       }

package/dist/universal/.claude/agents/citable/manifest.json

@@ -1,9 +1,9 @@
 {
   "name": "citable-agent-profiles",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "managedBy": "citable-cli",
   "provider": "claude",
-  "sourcePackage": "@nebulacomponents/citable@1.18.1",
+  "sourcePackage": "@nebulacomponents/citable@1.18.2",
   "files": {
     "citable-auditor.md": "sha256:06fe8d84834b2c09b7e7083aa6f57e94e837e0643dbe4ead4bbecf651fb41cad",
     "citable-remediator.md": "sha256:c990e929f411fc2f2de3aca759333502c956e96924b3a0f809ab0927062623dc",

package/dist/universal/.claude/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.18.1
+version: 1.18.2
 ---
 
 # Citable — evidence and change control for search and AI citation readiness

package/dist/universal/.claude/skills/citable/VERSION

@@ -1 +1 @@
-1.18.1
+1.18.2

package/dist/universal/.claude/skills/citable/commands/artifact-interchange.md

@@ -7,6 +7,7 @@ external workspaces without changing its canonical bytes.
 citable artifacts export <run-id> --output <directory>
 citable artifacts verify --input <directory>
 citable artifacts import --input <directory>
+citable artifacts verify-customer <file>
 ```
 
 An export contains the original run package plus
@@ -26,3 +27,7 @@ was authentic, that external observations were representative or complete, or
 that an intervention caused an outcome. Hosted tenancy, authentication,
 storage, retention, billing, scheduling, and dashboards are outside this
 contract.
+
+Use `citable artifacts verify-customer <file>` to validate customer deliverables
+(SOW, Search, and CRO JSON reports) against their JSON Schemas, verify arithmetic
+consistency (e.g. minor-unit fee totals), and reject unescaped script or event handler injections.

package/dist/universal/.claude/skills/citable/commands/remediation.md

@@ -12,7 +12,7 @@ The remediation suite provides safe, gated code fixes for deterministic technica
 
 ## 1. Safe Patch Application (`citable remediate`)
 
-1. **Framework Detection**: Identifies target source syntax (`jsx`, `tsx`, `vue`, `html`). Fails closed on unknown or ambiguous frameworks.
+1. **Framework Detection**: Identifies target source syntax (`jsx`, `tsx`, `vue`, `svelte`, `html`). Fails closed on unknown or ambiguous frameworks.
 2. **Idempotent AST Patching**: Patches are mathematically verified to be idempotent (`applyPatchDetailed`): applying the patch a second time produces an identical AST (a fixed point).
 3. **Structural Validation Gate**: Runs `validatePatchedSource` to confirm that the patch does not break AST structure, introduce syntax errors, or alter unrelated code blocks.
 4. **Confidence Threshold**: Computes an explicit multi-factor confidence score (`computeConfidence`). `--write` is refused if confidence falls below `0.70`.

package/dist/universal/.claude/skills/citable/commands/sow.md

@@ -1,6 +1,6 @@
 ---
 command: /citable sow generate [--target <dir|url>] [--run <id>] [--budget <amount>] [--budget-minor <cents>] [--format md|html|json] [--output <path>] [--sample] [--draft]
-purpose: Generate a contractually binding, evidence-traceable enterprise Statement of Work (SOW) from verified audit findings through a formal 7-gate scope admissibility filter and 7-column traceability matrix.
+purpose: Generate a contractually binding, evidence-traceable enterprise Statement of Work (SOW) from verified audit findings through a formal 8-gate scope admissibility filter and 7-column traceability matrix.
 preconditions: [at least one finalized audit run with verified findings or live target; sample mode required for synthetic demonstrations]
 failure_behaviour: absent or unverified findings in contractual mode -> NoFindingsError; all findings refused -> NoAdmissibleRequirementsError; non-existent run -> RunNotFoundError; negative or sub-cent budget -> BudgetCalculationError; invariant drift -> SowInvariantError
 artifacts_created: [SOW.md, SOW.html, or SOW.json at specified output path]
@@ -34,7 +34,7 @@ Acceptance Test (automated closed-loop detector rerun)
 
 ## 2. The Scope Admissibility Gate
 
-Audit findings do NOT automatically become contractual obligations. Every candidate finding must pass 7 admissibility gates:
+Audit findings do NOT automatically become contractual obligations. Every candidate finding must pass 8 admissibility gates:
 
 | Gate | Verification Check | Failure Refusal Code | Contractual Handling |
 | :--- | :--- | :--- | :--- |

package/dist/universal/.claude/skills/citable/manifest.json

@@ -1,11 +1,11 @@
 {
   "name": "citable",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "managedBy": "citable-cli",
   "provider": "claude",
   "providerName": "Claude Code",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.18.1",
+  "sourcePackage": "@nebulacomponents/citable@1.18.2",
   "variantPath": ".claude/skills/citable",
   "agentProfiles": {
     "status": "available",
@@ -24,7 +24,7 @@
     "agents/citable-semantic-reviewer.md": "sha256:77582263a048ea41ae3f7ee326dbd036222fab81ed83bda98034ec83ee21ef2e",
     "agents/citable-sow-architect.md": "sha256:d55cf8bc2ab8f364c0d95ec39fc44406684110d1e4d1ff2e34702ded003094b4",
     "commands/action-findings.md": "sha256:b1d5c4d8d8b1092bc73b99430bea0a2e460031658e42bed33eb94da9a3c0e48f",
-    "commands/artifact-interchange.md": "sha256:18d56fbfa6bb3f23f08593a9a8135e51c268618b049e53c793969b68000875c3",
+    "commands/artifact-interchange.md": "sha256:300062880e141b80ce23024c0a9b309e93a1e2aeb87e22a68860d27388a3acb7",
     "commands/delivery.md": "sha256:3b29250f9e9f84442812e320a70d5d2784b4286e91af3866f99cb6062a85a10f",
     "commands/field-validation.md": "sha256:4f24b2758eef746d704b218364f1e45ee9e07418c8ae111081b1fd41f93dde2d",
     "commands/governance.md": "sha256:41792a2a08930c604cc7b635c23fb3cbdeebc5af610ef38c795f1a412c4a0816",
@@ -36,10 +36,10 @@
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
     "commands/plan-audit.md": "sha256:69875c9654e13b84566dafb16afe5afe08cffb9f3bded1f2d8d2261ae871c869",
     "commands/README.md": "sha256:683b226020582dd93e24a2fb59ce6264735f44eb26353f977153034a615f871c",
-    "commands/remediation.md": "sha256:7f983ecf63ec6741fa7e291243c6faeb44a5b140655a5ec3a62bcbc4c16d8870",
+    "commands/remediation.md": "sha256:f2a90608079d823b8192aa7acad8a60c923ac02b4e01e5ca653f45e9f52c7998",
     "commands/reporting.md": "sha256:f560f3c8349fcdaf6d3c3a27968016e20ef42ef2473292f7b83260cfb4b3b2e6",
     "commands/reviews.md": "sha256:902904aaa405fe5724cf0662c7a5a36eab9a4fe0eb81cbd95ffa2fff946e0ac8",
-    "commands/sow.md": "sha256:576c0ff119e5a9193476c20aee65019dbe91502d624d3a8fc8469915a3bc2b19",
+    "commands/sow.md": "sha256:caf4b7e4b9f0e801fbc86f40e6efb8a057d1243dc488b0bc629b8fb2b90c6933",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:4b0041764f2fdbfbff1e1a2907eaed02cf0aef491254a9c98ec9250ff1084e80",
@@ -78,6 +78,7 @@
     "schemas/corroboration-import.schema.json": "sha256:927983d0590f1ec569e86195d2031be0cd212f9436ff98acca468cbae108d85e",
     "schemas/crawler-identity.schema.json": "sha256:e1e3e6da203a8bc49fba8f9bbde525368891db022d542fc615b677401825351d",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
+    "schemas/cro-report.schema.json": "sha256:270cfe946d3dce007672c5fd5e052f07e3322c85a2bfcc0cd47f34ce569f2fb1",
     "schemas/customer-outcome.schema.json": "sha256:c0cdfee31a692feadb31dc6be734d45ae178ee53f28349c2a9e7504bdfcf9e50",
     "schemas/decision.schema.json": "sha256:7c30f3ad83a6aa0b67ecc51ac6691e5e041b633d01bab17cee2b5218d926204e",
     "schemas/deployment-receipt.schema.json": "sha256:789455907e7f3039fd55ee5b2568e09871128f513f5ddfe1f3afac1a4dd6b2bd",
@@ -118,13 +119,14 @@
     "schemas/sampling-plan.schema.json": "sha256:005f70f149baaacd7de698548d556d3e401c630978748271b0e14a74726dd413",
     "schemas/scenario.schema.json": "sha256:3f5bc2032d08f973600db068f475176a0e4706b33be42f99c778fe755a0ff38b",
     "schemas/schedule.schema.json": "sha256:645df065bf33577a960c0bf8bb97e141e9326840303569468dae8a553d468482",
+    "schemas/search-report.schema.json": "sha256:0ae2dad77cf3c6f2abac22a8180d66bde8ebd044ed6324a56329cd12a3c898f2",
     "schemas/source-identity-chain.schema.json": "sha256:a65d9c12eaed1bd6b637c66a2f9362c17287fdfcb454d8676fb611d2d28aa019",
-    "schemas/sow.schema.json": "sha256:14ff2e24e03f678d3c72f97c27b0a68e117472dcc640aab7491bba1a82457906",
+    "schemas/sow.schema.json": "sha256:3a3fd6048a747a9bc0cfaea98920376b043616a33c953a9eb8b74d0ae32dded0",
     "schemas/variance.schema.json": "sha256:68389f64f0a3be13ff8951e8eefba9a5c31d0738325cb47e37c1a8435bea48f0",
     "scripts/README.md": "sha256:9eee4e8beb4579a183bd714c9dd24b83abd020753eada5caeffae004739d60b5",
-    "SKILL.md": "sha256:d50cc48a120fee6ad3c3bf0d1bfa8ceb5bba3614bdc6af8aacc4293b9e4a1970",
+    "SKILL.md": "sha256:a2c2ce3aced71fc2a66f2e46b4a9fcc10b65819dcef58176b2cefe674d6a941b",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:71fc7bd16b1bc9b3681085fb0be8aea0b3a37d90d1685938dc2e8a31bf8c9b94"
+    "VERSION": "sha256:0a1b17e91d514c0c9e88520e6091e2d52a6faf8296892cad7355ff0723a42914"
   },
-  "treeHash": "sha256:96d4589fced40f7030b6c1e48132abf2d37ebae771a1401d6f2a74e4f8fc52d1"
+  "treeHash": "sha256:2d4210d9dd26b7952f53964402abf06c8ae12ae43cb8ac5c568f070ab44b0001"
 }