@nebulacomponents/citable 1.18.2 → 1.19.0

package/CHANGELOG.md

@@ -15,6 +15,52 @@ _No entries yet. See [`BOUNTY.md`](BOUNTY.md) to submit the first one._
 
 ## Unreleased
 
+## 1.19.0 — 2026-09-11
+
+### Added — Deterministic Bounded Browser-Journey Evidence Acquisition (ADR-003)
+
+- **Browser Network Activity Observation (`network-events.json` / `schemas/browser-network-events.schema.json`)**:
+  - Captured HTTP/HTTPS network transactions during journey execution via Playwright request/response/failure hooks.
+  - Implemented configurable host allowlist filtering (exact match and wildcard subdomains) to isolate target and partner traffic.
+  - Recorded request method, URL, status code, protocol, timings, body size, redirects, and failure errors.
+  - Deny-by-default payload capture: request and response bodies default to uncaptured (`request_body: false`, `response_body: false`); host allowlist alone never triggers body capture.
+  - Explicit status separation: headers, query params, and bodies record status (`not_requested`, `filtered`, `captured`, `truncated`, `unavailable`, `hash_only`, `redacted`).
+  - Added strict sanitization of allowlisted request/response headers, query parameters, and JSON payloads with bounded size limits (`max_body_bytes`, `max_field_size`).
+  - In-flight request tracking (`summary.in_flight_requests`) and optional bounded settling timeout (`network_policy.settling_timeout_ms`).
+  - Added deterministic transaction bounds (`max_events`) with explicit `truncated` flags and epistemic status (`ABSENT`, `TRUNCATED`, `UNOBSERVABLE`, `FAILED`).
+- **Browser State Observation (`state-observations.json` / `schemas/browser-state-observations.schema.json`)**:
+  - Captured multi-checkpoint state snapshots at journey stages (`initial`, `before_step`, `step`, `final`).
+  - Recorded final URL, allowlisted query parameters, referrer, and navigation type.
+  - Governed access to cookies, localStorage, and sessionStorage: dumps only explicitly named keys/cookies declared in policy, unconditionally blocking unlisted storage.
+  - HttpOnly cookie semantics: captures presence, length, and security flags (`http_only: true`, `secure: true`, `same_site`), while strictly suppressing raw plaintext values as `[POLICY_RESTRICTED_HTTPONLY]` in `allowlist_values` mode. Context-level failures are recorded in `unavailable_items`.
+  - Added safe global variable evaluation using strict AST identifier/bracket path validation (`[a-zA-Z0-9_$.[\]'"]+`) without `eval()` or arbitrary JavaScript execution. Throwing getters during evaluation fail closed to `unavailable_items` without asserting false absence.
+  - Extracted DOM query results (presence, text content, attributes) scoped strictly to allowlisted CSS selectors and attributes.
+- **Explicitly Configured Runtime Events (`runtime-events.json` / `schemas/browser-runtime-events.schema.json`)**:
+  - Generic listener for global array event queues (e.g. `window.dataLayer`, custom event queues) hooking queues via `Object.defineProperty(window, prop, ...)` to intercept queue reassignment (`window.dataLayer = []`) with polling fallback for unhooked mutations.
+  - Safe in-page and Node extraction protecting against hostile throwing getters (`[GETTER_ERROR]`).
+  - Detailed collector health reporting in `summary.collector_health` (`status`, `queue_replaced`, `push_replaced`, `polling_fallback_used`, `supported_contexts: ["top_level_main_frame"]`, `unsupported_contexts: ["cross_origin_iframes", "web_workers"]`).
+  - Window event listener for declared DOM events (`DOMContentLoaded`, `load`, custom events).
+  - Explicit event allowlists, field allowlists, sensitive key redaction, and SHA-256 field hashing.
+  - Bounded collection (`max_events`) with explicit truncation counters and `filtered_events` tracking.
+- **Monotonic Sequencing & Temporal Step Correlation**:
+  - `src/observations/browser/correlation.js`: Generates monotonically increasing event sequences and microsecond-precision offsets (`monotonic_offset_ms`) from journey start.
+  - Explicit phase classification: `during_step`, `between_steps`, and `post_journey`.
+  - Asynchronous transaction completion tagging (`ambiguous_async: true`): records `initiated_step_id` and `completed_step_id` when requests resolve across step boundaries or after journey completion.
+- **Mandatory Secret Sanitization & Residual Risk Disclosure (`src/observations/browser/sanitizer.js`)**:
+  - Unconditional redaction to `[REDACTED_SECRET]` for Authorization/Bearer headers, Cookie/Set-Cookie headers, basic auth credentials, passwords, session tokens, API keys, private keys, credit cards, and OAuth callback codes.
+  - Defense-in-depth regex redaction paired with structural minimization; documented residual risk for novel unstructured secrets in customer-allowlisted payload fields.
+  - Recursively applied across headers, query parameters, request/response bodies, state storage values, globals, and runtime event payloads.
+- **Strict ABSENT Epistemic Invariant**:
+  - Guarantees that absence (`ABSENT` / `exists: false`) is asserted only when target was in declared scope, collector was active full window, no truncation occurred, candidate was not filtered, and no collector errors occurred.
+- **Resilient Evidence Preservation**:
+  - In the event of a required journey step failure, captured partial network events, state observations, and runtime events are preserved and packaged into the failure evidence bundle alongside failure JSON and screenshots.
+- **Schema & Artifact Integration**:
+  - Evolved `schemas/browser-evidence-plan.schema.json` backward-compatibly with optional `network_policy`, `state_policy`, `runtime_event_policy`, and `action: "checkpoint"`.
+  - All artifacts validated strictly against compiled Ajv schemas via `validateAgainst`.
+  - Added summary objects (`network_summary`, `state_summary`, `runtime_events_summary`) and artifact references to the canonical observation envelope (`schemas/observation.schema.json`).
+
+
+
 ## 1.18.2 — 2026-09-10
 
 ### Fixed — Executive Reporting, Evidence Provenance, and Commercial Artifact Hardening

package/dist/universal/.agents/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.18.2
+version: 1.19.0
 ---
 
 # Citable — evidence and change control for search and AI citation readiness

package/dist/universal/.agents/skills/citable/VERSION

@@ -1 +1 @@
-1.18.2
+1.19.0

package/dist/universal/.agents/skills/citable/manifest.json

@@ -1,11 +1,11 @@
 {
   "name": "citable",
-  "version": "1.18.2",
+  "version": "1.19.0",
   "managedBy": "citable-cli",
   "provider": "codex",
   "providerName": "OpenAI Codex",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.18.2",
+  "sourcePackage": "@nebulacomponents/citable@1.19.0",
   "variantPath": ".agents/skills/citable",
   "agentProfiles": {
     "status": "unsupported",
@@ -59,7 +59,10 @@
     "schemas/artifact-interchange.schema.json": "sha256:c6f628934c8a1b8ea2996e03c2c5abd46c2a0e74c680b0a43e44c2343dc9aa21",
     "schemas/assumption.schema.json": "sha256:31a0f44bbf1d207e013961ec4c39eea85c3ae9efde1485b5e26084562c816844",
     "schemas/bing-webmaster.schema.json": "sha256:8357c518a8cb4ccd1def2da38950fbba68270e2b1613ad522b50c568a3b8538f",
-    "schemas/browser-evidence-plan.schema.json": "sha256:81ef14f665b4a00f01afb747576faeb06025722e5c15a36eff3d17e59e978851",
+    "schemas/browser-evidence-plan.schema.json": "sha256:1df677fb08338b832d93af2aabec565ef8d621c820cbc77f847dc1c94a814256",
+    "schemas/browser-network-events.schema.json": "sha256:aa71380998df74cff929316d7c76332a74c16cd08504214cdb2b86d9d793fee5",
+    "schemas/browser-runtime-events.schema.json": "sha256:ff9b6e486ca5a72a6613a4e3e479cd11bcadff52c7481df125aa1670f404a7e4",
+    "schemas/browser-state-observations.schema.json": "sha256:7748b9ed7110834e19c1827bd125c0d0cdb50e2dd89a713da03cd643e9c72843",
     "schemas/canonical-index-import.schema.json": "sha256:ef633662cb30873242ca356443bc4835afe56bb020208e8f42fa47ac8047b66e",
     "schemas/claim.schema.json": "sha256:ce79ccbfa34ece9b7a309a6962522ea06a1f44c468b4c472b5c376554a788537",
     "schemas/cli-output-envelope.schema.json": "sha256:6964e8f2f43618bfd0d7a3f5344b37ebc26f04779796bb8ff4675b935b6208c3",
@@ -117,9 +120,9 @@
     "schemas/sow.schema.json": "sha256:3a3fd6048a747a9bc0cfaea98920376b043616a33c953a9eb8b74d0ae32dded0",
     "schemas/variance.schema.json": "sha256:68389f64f0a3be13ff8951e8eefba9a5c31d0738325cb47e37c1a8435bea48f0",
     "scripts/README.md": "sha256:9eee4e8beb4579a183bd714c9dd24b83abd020753eada5caeffae004739d60b5",
-    "SKILL.md": "sha256:a2c2ce3aced71fc2a66f2e46b4a9fcc10b65819dcef58176b2cefe674d6a941b",
+    "SKILL.md": "sha256:70629652ec22ece59e4ddef9198ce9e77f9d4da74eab14a4ccdf99d67c393ab1",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:0a1b17e91d514c0c9e88520e6091e2d52a6faf8296892cad7355ff0723a42914"
+    "VERSION": "sha256:c55c898de5079ee498d5f051b29815688154292df4d72ab91f1edb5497ac4e6e"
   },
-  "treeHash": "sha256:2d4210d9dd26b7952f53964402abf06c8ae12ae43cb8ac5c568f070ab44b0001"
+  "treeHash": "sha256:0343fe90b5b631f5405e5c6390355f4fc6f926d0cf9e49946f3bed921b29ff2e"
 }

package/dist/universal/.agents/skills/citable/schemas/browser-evidence-plan.schema.json

@@ -5,6 +5,181 @@
   "type": "object",
   "additionalProperties": false,
   "required": ["schema_version", "plan_id", "target", "profiles", "limitations"],
+  "definitions": {
+    "network_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "allowed_host_patterns": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "allowed_methods": {
+          "type": "array",
+          "items": { "type": "string", "enum": ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"] }
+        },
+        "allowed_resource_types": {
+          "type": "array",
+          "items": { "type": "string", "enum": ["document", "stylesheet", "image", "media", "font", "script", "texttrack", "xhr", "fetch", "eventsource", "websocket", "manifest", "other"] }
+        },
+        "capture_request_headers": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "capture_response_headers": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "capture_query_params": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "capture_payload": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "request_body": { "type": "boolean" },
+            "response_body": { "type": "boolean" },
+            "allowed_json_fields": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 }
+            },
+            "hash_only": { "type": "boolean" },
+            "max_bytes": { "type": "integer", "minimum": 0, "maximum": 65536 }
+          }
+        },
+        "max_events": { "type": "integer", "minimum": 1, "maximum": 1000 },
+        "max_field_size": { "type": "integer", "minimum": 1, "maximum": 8192 },
+        "settling_timeout_ms": { "type": "integer", "minimum": 0, "maximum": 5000 }
+      }
+    },
+    "state_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "checkpoints": {
+          "type": "array",
+          "items": { "type": "string", "enum": ["initial", "step", "final"] }
+        },
+        "capture_url": { "type": "boolean" },
+        "allowed_query_params": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "capture_referrer": { "type": "boolean" },
+        "capture_navigation": { "type": "boolean" },
+        "cookies": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "allowed_names": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 }
+            },
+            "mode": { "enum": ["presence_only", "hash_only", "allowlist_values"] },
+            "max_keys": { "type": "integer", "minimum": 1, "maximum": 100 }
+          }
+        },
+        "local_storage": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "allowed_keys": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 }
+            },
+            "mode": { "enum": ["presence_only", "hash_only", "allowlist_values"] },
+            "max_keys": { "type": "integer", "minimum": 1, "maximum": 100 }
+          }
+        },
+        "session_storage": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "allowed_keys": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 }
+            },
+            "mode": { "enum": ["presence_only", "hash_only", "allowlist_values"] },
+            "max_keys": { "type": "integer", "minimum": 1, "maximum": 100 }
+          }
+        },
+        "globals": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "expression"],
+            "properties": {
+              "name": { "type": "string", "pattern": "^[a-zA-Z0-9_.-]+$" },
+              "expression": { "type": "string", "pattern": "^[a-zA-Z0-9_$.\\[\\]'\"]+$" },
+              "mode": { "enum": ["presence_only", "type_only", "hash_only", "scalar_value"] }
+            }
+          }
+        },
+        "dom_queries": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "selector", "property"],
+            "properties": {
+              "name": { "type": "string", "pattern": "^[a-zA-Z0-9_.-]+$" },
+              "selector": { "type": "string", "minLength": 1 },
+              "property": { "enum": ["presence", "visible", "text_hash", "text_length", "text_content", "attribute_value"] },
+              "attribute_name": { "type": "string" }
+            }
+          }
+        },
+        "max_observations": { "type": "integer", "minimum": 1, "maximum": 500 },
+        "max_value_length": { "type": "integer", "minimum": 1, "maximum": 4096 }
+      }
+    },
+    "runtime_event_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "sources": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["source_id", "type"],
+            "properties": {
+              "source_id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]*$" },
+              "type": { "enum": ["global_array", "window_event", "custom_stream"] },
+              "global_name": { "type": "string", "pattern": "^[a-zA-Z0-9_.]+$" },
+              "event_name": { "type": "string", "minLength": 1 },
+              "event_name_key": { "type": "string", "minLength": 1 }
+            }
+          }
+        },
+        "allowed_event_names": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "allowed_fields": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "hash_fields": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "redact_fields": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "max_events": { "type": "integer", "minimum": 1, "maximum": 1000 },
+        "max_payload_depth": { "type": "integer", "minimum": 1, "maximum": 10 },
+        "max_field_size": { "type": "integer", "minimum": 1, "maximum": 4096 }
+      }
+    }
+  },
   "properties": {
     "schema_version": { "const": 1 },
     "plan_id": { "type": "string", "pattern": "^BROWSER-PLAN-[A-Z0-9_-]+$" },
@@ -16,13 +191,16 @@
       "properties": {
         "policy_id": { "type": "string", "pattern": "^RENDER-POLICY-[A-Z0-9_-]+$" },
         "review_owner": { "type": "string", "minLength": 1 },
-        "min_text_retention_ratio": { "type": "number", "minimum": 0, "maximum": 1 },
+        "min_text_retention_ratio": { "number": 0, "minimum": 0, "maximum": 1 },
         "require_heading_parity": { "type": "boolean" },
         "require_link_parity": { "type": "boolean" },
         "require_structured_data_parity": { "type": "boolean" },
         "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
       }
     },
+    "network_policy": { "$ref": "#/definitions/network_policy" },
+    "state_policy": { "$ref": "#/definitions/state_policy" },
+    "runtime_event_policy": { "$ref": "#/definitions/runtime_event_policy" },
     "profiles": {
       "type": "array",
       "minItems": 1,
@@ -63,6 +241,9 @@
           "locale": { "type": "string", "minLength": 2 },
           "consent_state": { "enum": ["not_present", "denied", "granted", "unresolved", "unknown"] },
           "authentication_state": { "enum": ["anonymous", "owner_authenticated", "unresolved", "unknown"] },
+          "network_policy": { "$ref": "#/definitions/network_policy" },
+          "state_policy": { "$ref": "#/definitions/state_policy" },
+          "runtime_event_policy": { "$ref": "#/definitions/runtime_event_policy" },
           "steps": {
             "type": "array",
             "items": {
@@ -71,13 +252,15 @@
               "required": ["step_id", "action", "locator", "value_env", "key", "url", "required", "capture_screenshot"],
               "properties": {
                 "step_id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]*$" },
-                "action": { "enum": ["navigate", "click", "fill", "select_option", "check", "press", "wait_for", "assert_visible", "scroll"] },
+                "action": { "enum": ["navigate", "click", "fill", "select_option", "check", "press", "wait_for", "assert_visible", "scroll", "checkpoint"] },
                 "locator": { "type": ["string", "null"] },
                 "value_env": { "type": ["string", "null"], "pattern": "^[A-Z][A-Z0-9_]*$" },
                 "key": { "type": ["string", "null"] },
                 "url": { "type": ["string", "null"], "format": "uri" },
                 "required": { "type": "boolean" },
-                "capture_screenshot": { "type": "boolean" }
+                "capture_screenshot": { "type": "boolean" },
+                "checkpoint_id": { "type": ["string", "null"], "pattern": "^[a-z0-9][a-z0-9_-]*$" },
+                "state_checkpoint": { "type": ["boolean", "null"] }
               }
             }
           },

package/dist/universal/.agents/skills/citable/schemas/browser-network-events.schema.json

@@ -0,0 +1,142 @@
+{
+  "$id": "citable://schemas/browser-network-events.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Browser network activity evidence artifact",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "plan_id",
+    "profile_id",
+    "collected_at",
+    "capture_policy",
+    "summary",
+    "events"
+  ],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "plan_id": { "type": "string" },
+    "profile_id": { "type": "string" },
+    "collected_at": { "type": "string", "format": "date-time" },
+    "capture_policy": { "type": "object" },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["total_requests", "successful_responses", "failed_requests", "filtered_requests", "truncated", "status_codes"],
+      "properties": {
+        "total_requests": { "type": "integer", "minimum": 0 },
+        "successful_responses": { "type": "integer", "minimum": 0 },
+        "failed_requests": { "type": "integer", "minimum": 0 },
+        "filtered_requests": { "type": "integer", "minimum": 0 },
+        "in_flight_requests": { "type": "integer", "minimum": 0 },
+        "collector_status": { "enum": ["complete", "truncated", "failed"] },
+        "truncated": { "type": "boolean" },
+        "truncation_reason": { "type": ["string", "null"] },
+        "status_codes": {
+          "type": "object",
+          "additionalProperties": { "type": "integer" }
+        }
+      }
+    },
+    "events": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "sequence",
+          "transaction_id",
+          "direction",
+          "phase",
+          "timing",
+          "correlation",
+          "request"
+        ],
+        "properties": {
+          "sequence": { "type": "integer", "minimum": 1 },
+          "transaction_id": { "type": "string" },
+          "direction": { "enum": ["request", "response"] },
+          "phase": { "enum": ["request_sent", "response_received", "failed", "redirect"] },
+          "timing": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["monotonic_offset_ms", "timestamp"],
+            "properties": {
+              "monotonic_offset_ms": { "type": "number", "minimum": 0 },
+              "timestamp": { "type": "string", "format": "date-time" }
+            }
+          },
+          "correlation": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["step_id", "step_sequence", "attribution_phase"],
+            "properties": {
+              "step_id": { "type": ["string", "null"] },
+              "step_sequence": { "type": ["integer", "null"] },
+              "checkpoint_id": { "type": ["string", "null"] },
+              "attribution_phase": { "enum": ["initial", "during_step", "between_steps", "post_journey", "ambiguous_async"] },
+              "initiated_step_id": { "type": ["string", "null"] },
+              "completed_step_id": { "type": ["string", "null"] },
+              "ambiguous_async": { "type": "boolean" }
+            }
+          },
+          "request": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["url", "method", "scheme", "host", "path", "resource_type"],
+            "properties": {
+              "url": { "type": "string" },
+              "method": { "type": "string" },
+              "scheme": { "type": "string" },
+              "host": { "type": "string" },
+              "path": { "type": "string" },
+              "resource_type": { "type": "string" },
+              "query": { "type": ["object", "null"] },
+              "query_status": { "enum": ["captured", "not_requested", "filtered", "none_present", "redacted"] },
+              "headers": { "type": ["object", "null"] },
+              "headers_status": { "enum": ["captured", "not_requested", "filtered", "redacted"] },
+              "payload_hash": { "type": ["string", "null"] },
+              "payload_bytes": { "type": ["integer", "null"] },
+              "payload_fields": { "type": ["object", "null"] },
+              "payload_status": { "enum": ["not_requested", "captured", "filtered", "truncated", "unavailable", "hash_only"] }
+            }
+          },
+          "response": {
+            "type": ["object", "null"],
+            "additionalProperties": false,
+            "properties": {
+              "status": { "type": "integer" },
+              "status_text": { "type": "string" },
+              "headers": { "type": ["object", "null"] },
+              "headers_status": { "enum": ["captured", "not_requested", "filtered", "redacted"] },
+              "mime_type": { "type": ["string", "null"] },
+              "body_hash": { "type": ["string", "null"] },
+              "body_bytes": { "type": ["integer", "null"] },
+              "body_fields": { "type": ["object", "null"] },
+              "body_status": { "enum": ["not_requested", "captured", "filtered", "truncated", "unavailable", "hash_only"] },
+              "redirect_url": { "type": ["string", "null"] },
+              "from_cache": { "type": "boolean" }
+            }
+          },
+          "failure": {
+            "type": ["object", "null"],
+            "additionalProperties": false,
+            "properties": {
+              "error_text": { "type": "string" }
+            }
+          },
+          "disposition": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["capture_status", "redacted_count", "filtered_fields"],
+            "properties": {
+              "capture_status": { "enum": ["captured", "filtered", "redacted", "truncated", "error"] },
+              "redacted_count": { "type": "integer", "minimum": 0 },
+              "filtered_fields": { "type": "array", "items": { "type": "string" } }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.agents/skills/citable/schemas/browser-runtime-events.schema.json

@@ -0,0 +1,112 @@
+{
+  "$id": "citable://schemas/browser-runtime-events.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Browser runtime events evidence artifact",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "plan_id",
+    "profile_id",
+    "collected_at",
+    "capture_policy",
+    "summary",
+    "events"
+  ],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "plan_id": { "type": "string" },
+    "profile_id": { "type": "string" },
+    "collected_at": { "type": "string", "format": "date-time" },
+    "capture_policy": { "type": "object" },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["total_events", "by_source", "by_event_name", "truncated"],
+      "properties": {
+        "total_events": { "type": "integer", "minimum": 0 },
+        "filtered_events": { "type": "integer", "minimum": 0 },
+        "collector_status": { "enum": ["complete", "truncated", "failed"] },
+        "by_source": {
+          "type": "object",
+          "additionalProperties": { "type": "integer" }
+        },
+        "by_event_name": {
+          "type": "object",
+          "additionalProperties": { "type": "integer" }
+        },
+        "truncated": { "type": "boolean" },
+        "truncation_reason": { "type": ["string", "null"] },
+        "collector_health": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "status": { "type": "string" },
+            "queue_replaced": { "type": "boolean" },
+            "push_replaced": { "type": "boolean" },
+            "polling_fallback_used": { "type": "boolean" },
+            "supported_contexts": { "type": "array", "items": { "type": "string" } },
+            "unsupported_contexts": { "type": "array", "items": { "type": "string" } }
+          }
+        }
+      }
+    },
+    "events": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "sequence",
+          "source_id",
+          "event_name",
+          "timing",
+          "correlation",
+          "payload"
+        ],
+        "properties": {
+          "sequence": { "type": "integer", "minimum": 1 },
+          "source_id": { "type": "string" },
+          "event_name": { "type": "string" },
+          "occurrence_index": { "type": "integer", "minimum": 1 },
+          "timing": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["monotonic_offset_ms", "timestamp"],
+            "properties": {
+              "monotonic_offset_ms": { "type": "number", "minimum": 0 },
+              "timestamp": { "type": "string", "format": "date-time" }
+            }
+          },
+          "correlation": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["step_id", "step_sequence", "attribution_phase"],
+            "properties": {
+              "step_id": { "type": ["string", "null"] },
+              "step_sequence": { "type": ["integer", "null"] },
+              "checkpoint_id": { "type": ["string", "null"] },
+              "attribution_phase": { "enum": ["initial", "during_step", "between_steps", "post_journey", "ambiguous_async"] },
+              "initiated_step_id": { "type": ["string", "null"] },
+              "completed_step_id": { "type": ["string", "null"] },
+              "ambiguous_async": { "type": "boolean" }
+            }
+          },
+          "payload": {
+            "type": "object"
+          },
+          "disposition": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["capture_status", "redacted_count", "filtered_fields"],
+            "properties": {
+              "capture_status": { "enum": ["captured", "filtered", "redacted", "truncated"] },
+              "redacted_count": { "type": "integer", "minimum": 0 },
+              "filtered_fields": { "type": "array", "items": { "type": "string" } }
+            }
+          }
+        }
+      }
+    }
+  }
+}