@nebulacomponents/citable 1.19.0 → 1.20.0

package/src/detectors/arch.js

@@ -3,6 +3,7 @@ import { defineDetector, indexTargets, pageSubject, entrySubject, sitePageFor }
 const D = [];
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ARCH-001', name: 'Orphan page', namespace: 'ARCH',
   description: 'An index-target page receives no internal links from any other audited page.',
   discipline: ['seo', 'aeo'], severity: 'high', deterministic: true, requires: ['site'],
@@ -24,6 +25,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ARCH-002', name: 'Dead-end page', namespace: 'ARCH',
   description: 'A page has no outbound internal links; users and crawlers cannot continue anywhere.',
   discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -43,6 +45,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ARCH-003', name: 'Excessive crawl depth', namespace: 'ARCH',
   description: 'An index-target page requires more than the configured number of clicks from the home page.',
   discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -66,6 +69,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ARCH-004', name: 'Duplicate query target', namespace: 'ARCH',
   description: 'Two or more registry pages target the same query — internal competition for one intent.',
   discipline: ['seo', 'aeo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -93,6 +97,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ARCH-005', name: 'Overlapping primary intent', namespace: 'ARCH',
   description: 'Two active registry pages declare the same primary intent and share a primary entity.',
   discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -120,6 +125,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ARCH-006', name: 'Page without topic-hub relationship', namespace: 'ARCH',
   description: 'A non-hub content page has no internal link to any hub/category page.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site', 'registries'],

package/src/detectors/claim.js

@@ -10,6 +10,7 @@ function evidenceById(ctx) {
 }
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-001', name: 'Verified claim without evidence', namespace: 'CLAIM',
   description: 'A claim is marked verified but references no evidence entries.',
   discipline: ['aeo', 'geo'], severity: 'critical', deterministic: true, requires: ['registries'],
@@ -29,6 +30,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-002', name: 'Verified claim depends on expired or revoked evidence', namespace: 'CLAIM',
   description: 'All evidence supporting a verified claim is expired, stale, revoked, or inaccessible.',
   discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -60,6 +62,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-003', name: 'Claim active after expiry', namespace: 'CLAIM',
   description: 'A claim has passed its expires date but is not marked expired/retired.',
   discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -79,6 +82,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-004', name: 'Quantitative or comparative claim without evidence', namespace: 'CLAIM',
   description: 'A performance or comparative claim (any status except prohibited/retired) has no supporting evidence recorded.',
   discipline: ['seo', 'aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -98,6 +102,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-005', name: 'Opinion or aspiration represented as verified fact', namespace: 'CLAIM',
   description: 'An opinion, position, or aspirational claim carries a "verified" status, flattening the claim hierarchy.',
   discipline: ['geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -117,6 +122,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-006', name: 'Regulated claim without required review', namespace: 'CLAIM',
   description: 'A legal/regulatory, security, or commercial claim has no legal_status assessment.',
   discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -137,6 +143,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-007', name: 'Unbounded superlative in page text', namespace: 'CLAIM',
   description: 'Page text contains a superlative ("best", "industry-leading", "#1") with no registered comparative claim covering that page.',
   discipline: ['seo', 'aeo', 'geo'], severity: 'medium', deterministic: false, requires: ['site', 'registries'],
@@ -167,6 +174,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-008', name: 'Published claim missing from page text (surface drift)', namespace: 'CLAIM',
   description: 'A claim lists a page as a publication surface, but the page no longer contains recognizably similar text.',
   discipline: ['geo'], severity: 'low', deterministic: false, requires: ['site', 'registries'],
@@ -200,6 +208,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CLAIM-009', name: 'Verified claim without semantic support assessment', namespace: 'CLAIM',
   description: 'A claim holds verified status without a recorded assessment that the evidence semantically supports the claim as worded (entailment, not just linkage). Valid evidence references, dates, and owners do not establish that the wording matches what the evidence proves.',
   discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],

package/src/detectors/crawl.js

@@ -6,6 +6,7 @@ import { verifyCrawlerIp } from '../crawler/ipRanges.js';
 const D = [];
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRAWL-001', name: 'robots.txt contradicts crawler policy decision', namespace: 'CRAWL',
   description: 'The deployed robots.txt outcome for a crawler differs from the decision recorded in the crawler policy registry.',
   discipline: ['seo', 'aeo', 'geo'], severity: 'high', deterministic: true, requires: ['site', 'registries'],
@@ -34,6 +35,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRAWL-002', name: 'Training-purpose access not decided separately', namespace: 'CRAWL',
   description: 'A vendor has an allow decision for search discovery, but no separate recorded decision for its model-training crawler.',
   discipline: ['geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -68,6 +70,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'exhaustive_requested_scope',
   id: 'CRAWL-003', name: 'robots.txt missing', namespace: 'CRAWL',
   description: 'No robots.txt was found; crawler access is uncontrolled and sitemap discovery is weakened.',
   discipline: ['seo', 'aeo', 'geo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -86,6 +89,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRAWL-004', name: 'robots.txt parse problems', namespace: 'CRAWL',
   description: 'robots.txt contains unparseable or misplaced directives.',
   discipline: ['seo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -104,6 +108,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRAWL-005', name: 'Crawler policy review overdue', namespace: 'CRAWL',
   description: 'A crawler policy decision has passed its next review date.',
   discipline: ['seo', 'aeo', 'geo'], severity: 'low', deterministic: true, requires: ['registries'],
@@ -123,6 +128,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRAWL-006', name: 'Undecided crawler with observed governance relevance', namespace: 'CRAWL',
   description: 'A crawler policy entry remains "undecided" — access is currently whatever robots.txt happens to say, not a governed decision.',
   discipline: ['geo'], severity: 'low', deterministic: true, requires: ['registries'],
@@ -142,6 +148,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRAWL-007', name: 'Spoofed crawler identity in access logs', namespace: 'CRAWL',
   description: 'An observed crawler log row claims an authoritative bot user-agent (Googlebot, Bingbot, GPTBot, ClaudeBot, etc.) but its source IP is outside published provider ranges or reverse-DNS verification failed.',
   discipline: ['seo', 'aeo', 'geo'], severity: 'high', deterministic: true, requires: ['site'],

package/src/detectors/cro.js

@@ -3,6 +3,7 @@ import { defineDetector, indexTargets, pageSubject, registryPageFor } from './fr
 const D = [];
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-001', name: 'Declared conversion action missing visible interactive CTA', namespace: 'CRO',
   description: 'A page registry declares a conversion_action (e.g. "request demo", "start trial"), but the rendered page DOM contains no matching interactive CTA button, link, or form.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site', 'registries'],
@@ -54,6 +55,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-002', name: 'Friction-heavy or defective lead capture form', namespace: 'CRO',
   description: 'A form on the page is defective (missing submit mechanism) or contains excessive input fields (>7) on top-of-funnel conversion surfaces.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -92,6 +94,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-003', name: 'Commercial intent page lacks proximate conversion pathway', namespace: 'CRO',
   description: 'A page with commercial or transactional intent (e.g. product, pricing, or vendor evaluation) contains zero interactive CTAs.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -134,6 +137,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-004', name: 'Defective or unverified outbound conversion target', namespace: 'CRO',
   description: 'A primary CTA button or link points to a placeholder (#, javascript:void(0)), an unreachable internal destination (404), or a non-production staging/localhost URL.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -177,6 +181,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-005', name: 'Search-to-landing scent gap: primary H1 fails to corroborate title', namespace: 'CRO',
   description: 'A commercial landing page H1 shares zero substantive keywords with the page title, creating a message-match scent gap that elevates bounce rates for search visitors.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -218,6 +223,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-006', name: 'Commercial lead capture form lacks proximate trust proof or security badges', namespace: 'CRO',
   description: 'A lead capture or transaction form collects user information without proximate trust signals (compliance certifications, encryption, guarantees, or social proof), elevating funnel abandonment.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -254,6 +260,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-007', name: 'Identity or contact input fields lack HTML5 autocomplete attributes', namespace: 'CRO',
   description: 'Form input fields that collect standard personal identity or contact information (e.g. name, email, phone, organization) lack standard HTML5 autocomplete attributes, increasing typing friction and preventing browser autofill.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -291,6 +298,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-008', name: 'Form inputs rely solely on placeholder without accessible label', namespace: 'CRO',
   description: 'Input fields on conversion forms rely solely on disappearing placeholder text without an associated <label for="...">, <label> wrapper, or aria-label, degrading cognitive accessibility and mobile error recovery.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -326,6 +334,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-009', name: 'Mobile input type mismatch for email or telephone fields', namespace: 'CRO',
   description: 'An email or telephone input uses generic type="text" instead of semantic types (type="email", type="tel") or lacks inputmode="numeric", failing to trigger the appropriate mobile virtual keyboard.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -375,6 +384,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-010', name: 'Choice overload: excessive competing primary CTAs in hero conversion zone', namespace: 'CRO',
   description: 'The hero section or primary viewport of a commercial landing page presents 3 or more competing primary calls-to-action, creating choice paralysis and reducing click-through rates.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -411,6 +421,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-011', name: 'Buried primary conversion pathway on long-form commercial page', namespace: 'CRO',
   description: 'A long-form commercial landing page (>1,000 words) has zero above-the-fold or early CTAs within the initial hero section and lacks a persistent navigation CTA, forcing visitors to scroll through extensive prose before reaching an action trigger.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -451,6 +462,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-012', name: 'Low-intent generic CTA microcopy on primary commercial action', namespace: 'CRO',
   description: 'A primary CTA on a commercial landing page uses passive, low-commitment, or non-descriptive microcopy (such as "Submit", "Click Here", "Send", "Next", or "Go") rather than an action-oriented, value-delivering verb.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -490,6 +502,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-013', name: 'Enclosed checkout or lead funnel leak: distraction navigation present on conversion step', namespace: 'CRO',
   description: 'A dedicated checkout, payment, or final lead registration step retains full global navigation menus (>5 links), providing exit ramps that elevate funnel abandonment.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -520,6 +533,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-014', name: 'Unprotected post-conversion confirmation page lacks noindex directive', namespace: 'CRO',
   description: 'A post-conversion confirmation, thank-you, or receipt page (/thank-you, /order-received, /welcome) lacks a "noindex" robots directive, exposing internal receipt URLs to organic search indexing and distorting conversion tracking.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -551,6 +565,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-015', name: 'Mobile touch target size below recommended 48px threshold', namespace: 'CRO',
   description: 'An interactive conversion CTA button or link has explicit dimensions under 44px by 44px, violating mobile accessibility and tap-target usability standards (WCAG 2.5.5) and increasing tap error rates.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -583,6 +598,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-016', name: 'Diminutive font size on primary conversion CTA microcopy', namespace: 'CRO',
   description: 'A primary CTA button uses diminutive font sizing (< 12px), creating readability friction and lowering tap confidence for mobile and accessibility-sensitive visitors.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site'],
@@ -615,6 +631,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-017', name: 'Multi-step conversion funnel break: intermediate step unavailable or defective', namespace: 'CRO',
   description: 'A multi-step funnel declared in funnels.yaml contains a step whose target page cannot be located in the audited site or returns an HTTP error status (4xx/5xx).',
   discipline: ['seo', 'aeo'], severity: 'high', deterministic: true, requires: ['site', 'registries'],
@@ -662,6 +679,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-018', name: 'Funnel progression link fails to preserve campaign attribution parameters', namespace: 'CRO',
   description: 'An intermediate CTA link leading to the next funnel step strips or omits declared campaign query parameters (such as utm_source, utm_campaign), breaking multi-touch attribution.',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['site', 'registries'],
@@ -706,6 +724,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-019', name: 'AI Answer cited landing page lacks immediate claim corroboration or conversion pathway', namespace: 'CRO',
   description: 'A landing page cited by an answer engine or generative AI response contains no proximate interactive conversion trigger or fails to corroborate the cited entity claim in its primary visible text.',
   discipline: ['seo', 'aeo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -743,6 +762,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-020', name: 'Statistical underpower risk on low-traffic A/B experiment', namespace: 'CRO',
   description: 'An A/B experiment registered in experiments.yaml specifies a minimum observation window or sample size insufficient to detect the expected hypothesis effect at standard statistical power (80%).',
   discipline: ['seo', 'aeo'], severity: 'low', deterministic: true, requires: ['registries'],
@@ -775,6 +795,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'CRO-021', name: 'High-intent conversion step lacks express payment wallet options', namespace: 'CRO',
   version: 2,
   description: 'A high-intent conversion step (checkout, pricing, cart, subscription) contains traditional payment forms or checkout actions but provides no express payment wallet buttons (Apple Pay, Google Pay, PayPal Express). Payment wallets and WebAuthn passkey authentication are distinct capabilities: this detector reports payment-wallet readiness only; passkey/WebAuthn authentication readiness is reported separately by inspect cro as an informational index.',

package/src/detectors/cwv.js

@@ -19,6 +19,7 @@ import { defineDetector, indexTargets, pageSubject } from './framework.js';
  * Checks for common LCP blockers. Cannot measure actual LCP.
  */
 export const CWV_001 = defineDetector({
+  coverage_requirement: 'page_resource',
   id: 'CWV-001',
   name: 'LCP potential blockers',
   namespace: 'CWV',
@@ -77,6 +78,7 @@ export const CWV_001 = defineDetector({
  * CWV-002: Preconnect hints for critical origins
  */
 export const CWV_002 = defineDetector({
+  coverage_requirement: 'page_resource',
   id: 'CWV-002',
   name: 'preconnect hints',
   namespace: 'CWV',
@@ -111,6 +113,7 @@ export const CWV_002 = defineDetector({
  * CWV-003: Image optimization for LCP
  */
 export const CWV_003 = defineDetector({
+  coverage_requirement: 'page_resource',
   id: 'CWV-003',
   name: 'image optimization',
   namespace: 'CWV',
@@ -165,6 +168,7 @@ export const CWV_003 = defineDetector({
 });
 
 export const CWV_004 = defineDetector({
+  coverage_requirement: 'page_resource',
   id: 'CWV-004',
   name: 'Excessive DOM size and depth',
   namespace: 'CWV',

package/src/detectors/entity.js

@@ -12,6 +12,7 @@ function allJsonLdBlocks(site) {
 }
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-001', name: 'Entity missing canonical URL', namespace: 'ENTITY',
   description: 'A registry entity has no canonical URL, so engines have no authoritative page to resolve it to.',
   discipline: ['geo', 'aeo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -31,6 +32,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-002', name: 'Schema entity name conflicts with registry', namespace: 'ENTITY',
   description: 'A JSON-LD Organization/Product name does not match the registry canonical name or a documented alias.',
   discipline: ['geo', 'seo'], severity: 'high', deterministic: true, requires: ['site', 'registries'],
@@ -64,6 +66,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-003', name: 'Unstable @id for same entity', namespace: 'ENTITY',
   description: 'The same entity name appears in JSON-LD with different @id values across pages.',
   discipline: ['geo', 'seo'], severity: 'medium', deterministic: true, requires: ['site'],
@@ -90,6 +93,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-004', name: 'sameAs profile not in authoritative list', namespace: 'ENTITY',
   description: 'JSON-LD sameAs references a profile URL not recorded as an authoritative profile in the entity registry.',
   discipline: ['geo'], severity: 'low', deterministic: true, requires: ['site', 'registries'],
@@ -121,6 +125,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-005', name: 'Product entity without owner relationship', namespace: 'ENTITY',
   description: 'A product/product-family entity records no owning organization.',
   discipline: ['geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -141,6 +146,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-006', name: 'Unregistered name variant in page text', namespace: 'ENTITY',
   description: 'Page text uses a variant of an entity name that is neither the canonical name nor a documented alias.',
   discipline: ['geo', 'seo'], severity: 'low', deterministic: false, requires: ['site', 'registries'],
@@ -178,6 +184,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'ENTITY-007', name: 'Entity verification stale', namespace: 'ENTITY',
   description: 'An active entity has not been verified within the last 12 months (or last_verified missing).',
   discipline: ['geo'], severity: 'low', deterministic: true, requires: ['registries'],

package/src/detectors/evd.js

@@ -6,6 +6,7 @@ import { isPastDate } from '../shared/io.js';
 const D = [];
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-001', name: 'Evidence past validity date', namespace: 'EVD',
   description: 'An evidence entry has passed valid_until but its verification_status is not stale/revoked.',
   discipline: ['aeo', 'geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -25,6 +26,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-002', name: 'Benchmark/test evidence missing methodology', namespace: 'EVD',
   description: 'Benchmark, test-result, or dataset evidence records no methodology or measurement period.',
   discipline: ['aeo', 'geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -45,6 +47,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-003', name: 'Claim references dangling or unverified evidence', namespace: 'EVD',
   description: 'A claim references an evidence id that does not exist or has verification_status unverified.',
   discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -78,6 +81,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-004', name: 'Secondary evidence where primary is required', namespace: 'EVD',
   description: 'A performance or security claim is supported only by secondary evidence (e.g., third-party articles).',
   discipline: ['aeo', 'geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -103,6 +107,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-005', name: 'Customer evidence lacks attribution', namespace: 'EVD',
   description: 'Customer-reference or case-study evidence has no attribution recorded.',
   discipline: ['aeo', 'geo'], severity: 'low', deterministic: true, requires: ['registries'],
@@ -122,6 +127,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-006', name: 'Evidence integrity hash absent', namespace: 'EVD',
   description: 'Primary evidence (test results, benchmarks, datasets, certifications) has no integrity hash, so later tampering or drift cannot be detected.',
   discipline: ['aeo', 'geo'], severity: 'low', deterministic: true, requires: ['registries'],
@@ -141,6 +147,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-007', name: 'Evidence marked inaccessible still supporting claims', namespace: 'EVD',
   description: 'Evidence with access_status inaccessible (or verification_status inaccessible) is still listed as supporting active claims.',
   discipline: ['aeo', 'geo'], severity: 'medium', deterministic: true, requires: ['registries'],
@@ -164,6 +171,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-008', name: 'Dangling media reference in claim evidence', namespace: 'EVD',
   description: 'Claim evidence references a media asset (image, chart, diagram, or video) whose referenced source location or file is missing, unresolved, or unreachable.',
   discipline: ['aeo', 'geo'], severity: 'high', deterministic: true, requires: ['registries'],
@@ -227,6 +235,7 @@ D.push(defineDetector({
 }));
 
 D.push(defineDetector({
+  coverage_requirement: 'evaluated_subset',
   id: 'EVD-009', name: 'Unanchored PDF claim citation', namespace: 'EVD',
   description: 'Evidence backed by a PDF document lacks a specific page, fragment, or section anchor (#page=, section, or page number in methodology/test_conditions), leaving cited claims unanchored and unfalsifiable.',
   discipline: ['aeo', 'geo'], severity: 'low', deterministic: true, requires: ['registries'],

package/src/detectors/framework.js

@@ -1,6 +1,7 @@
 import { sha256 } from '../shared/io.js';
 import { fileURLToPath } from 'node:url';
 import { readJson } from '../shared/io.js';
+import { evaluateRequirement, isCoverageRequirement, requirementForDetector } from '../evidence/determination.js';
 
 const TOOL_VERSION = readJson(new URL('../../package.json', import.meta.url)).version;
 
@@ -22,6 +23,9 @@ export function defineDetector(def) {
   }
   if (!NAMESPACES.includes(def.namespace)) throw new Error(`detector ${def.id}: unknown namespace ${def.namespace}`);
   if (!def.id.startsWith(def.namespace + '-')) throw new Error(`detector id ${def.id} must be prefixed with namespace`);
+  if (!isCoverageRequirement(def.coverage_requirement)) {
+    throw new Error(`detector ${def.id ?? '?'} must explicitly declare a valid coverage_requirement`);
+  }
   return {
     version: 1,
     confidence_model: def.deterministic ? 'binary condition; confirmed when observed' : 'heuristic; confidence reported per finding',
@@ -65,7 +69,17 @@ export function runDetectors(detectors, ctx) {
     detectorsRun.push(d.id);
     for (const hit of hits) {
       const idSeed = `${d.id}|${hit.subject?.identifier ?? ''}|${hit.summary}`;
+      const coverageRequirement = requirementForDetector(d, hit);
+      const scope = ctx.coverage
+        ? evaluateRequirement(coverageRequirement, ctx.coverage, hit.subject)
+        : null;
+      const resourceIds = scope?.resource_id ? [scope.resource_id] : [];
+      const scopeSatisfied = scope?.status === 'supported' || scope?.status === 'qualified';
+      const determinationNote = scope && !scopeSatisfied
+        ? `determination not established: ${scope.reason || 'coverage requirement unsatisfied'}`
+        : null;
       findings.push({
+        ...(ctx.coverage ? { schema_version: 2 } : {}),
         finding_id: `F-${sha256(idSeed).slice(0, 12)}`,
         detector_id: d.id,
         detector_name: d.name,
@@ -78,11 +92,12 @@ export function runDetectors(detectors, ctx) {
           evidence: hit.evidence,
           captured_value: hit.captured ?? null,
           expected_value: hit.expected ?? null,
+          ...(scope ? { determination_status: scope.status, ...(determinationNote ? { determination_reason: determinationNote } : {}) } : {}),
         },
         classification: {
           finding_type: hit.finding_type ?? d.finding_type,
           severity: hit.severity ?? d.severity,
-          confidence: hit.confidence ?? d.confidence,
+          confidence: scope && !scopeSatisfied ? 'unknown' : (hit.confidence ?? d.confidence),
           deterministic: d.deterministic,
           impact: { ...d.impact, ...(hit.impact || {}) },
         },
@@ -90,7 +105,10 @@ export function runDetectors(detectors, ctx) {
           applicable_requirement: d.applicable_requirement,
           explanation: d.description,
           assumptions: hit.assumptions ?? [],
-          limitations: d.deterministic ? [] : ['heuristic detection; verify manually before acting'],
+          limitations: [
+            ...(d.deterministic ? [] : ['heuristic detection; verify manually before acting']),
+            ...(determinationNote ? [determinationNote] : []),
+          ],
         },
         remediation: {
           preferred: d.remediation,
@@ -118,6 +136,14 @@ export function runDetectors(detectors, ctx) {
             : 'heuristic judgment; human semantic review required before acting',
           revalidation_required: d.deterministic ? 'on_next_audit' : 'human_review_before_action',
         },
+        ...(ctx.coverage ? {
+          evidence_scope: {
+            requirement: coverageRequirement,
+            satisfaction: scope.status,
+            resource_ids: resourceIds,
+            coverage_ref: 'coverage.json',
+          },
+        } : {}),
         status: { state: 'open', first_seen: ts, last_seen: ts, resolved_at: null },
       });
     }