@nebulacomponents/citable 1.3.1 → 1.4.0

package/dist/universal/.github/skills/citable/manifest.json

@@ -1,24 +1,25 @@
 {
   "name": "citable",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "managedBy": "citable-cli",
   "provider": "github",
   "providerName": "GitHub Copilot",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.3.1",
+  "sourcePackage": "@nebulacomponents/citable@1.4.0",
   "variantPath": ".github/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:3550b1e747c5a38cdb712016b9bc773d93596bc4d1b49a309f9cddd816c1b662",
+    "commands/measurement.md": "sha256:c90352849a589b4cb66d1275a1888e9a2de5052a62399224c42b00f92bbdd814",
+    "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:186ca808e0f303938ef9f8f98c8273c4b7cb76cc791e7d751c3639bf201e3bb1",
+    "commands/README.md": "sha256:71b7f2b7fc5e98cfa2b699ec48f58f3b4e32dfb0233315759fc98f7ae7eecac0",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
-    "references/capability-boundaries.md": "sha256:901840fe87080071d0b11aa329d6a7954ffa6c601c58fadc275b55a7a988376a",
+    "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
     "rubrics/comparison-fairness.md": "sha256:7afc86903aa4a695060be7b6bca42ba505c106ea7cfa153344189afc5b78a5ba",
@@ -43,16 +44,18 @@
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
+    "schemas/observation.schema.json": "sha256:81d8994591fff4bc23a10f813f1957719d5a2093171520f661ab8792e14748da",
     "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
+    "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:571cbb467f40ac55778fdbbcd1d36a9234adde87cdfe80c7ed7d0bd0a799895d",
+    "SKILL.md": "sha256:1e53637f88647dba7bdafc08545ad966f0f77b2814d956d3fbd57b38b3e34fa0",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:10e2e117b01523891ca271a615ae36e9d5e52348fd7d642f66727602c1b8dcbe"
+    "VERSION": "sha256:78b591400c56b7b67b8cb3b2b8a8e65e9093897f02ce0878e6b5405c68620fa7"
   },
-  "treeHash": "sha256:f4be2ccf3c0ceb34df2554f6dad5d25eab4c11f8ccc98002a0abce2cb0667d30"
+  "treeHash": "sha256:d5eb2a8baf1230bc82f28610cf0a875f58f5070cb3953838b8310bad07eca012"
 }

package/dist/universal/.github/skills/citable/references/capability-boundaries.md

@@ -6,18 +6,18 @@ Use the narrowest supported state. Never promote evidence across rows.
 | --- | --- | --- |
 | Allowed by policy | Implemented | Effective robots rule plus crawler-purpose registry decision |
 | Synthetic fetch succeeded | Partial | Captured status, redirects, headers, body from the declared user agent; label identity simulated |
-| Verified crawler reached edge | Operator supplied | Request log plus provider-published IP verification where supported |
-| Observed in production logs | Operator supplied | Timestamped server/CDN log with URL, status, bytes, latency, cache result, UA, and verification result |
-| Indexed | Operator supplied | Search Console/Bing Webmaster/API or timestamped engine observation |
+| Verified crawler reached edge | Imported evidence | `observe logs` record plus provider-published IP verification where supported |
+| Observed in production logs | Imported evidence | Timestamped `observe logs` artifact with URL, status, bytes, latency, cache result, UA, and verification result |
+| Indexed | Google API or imported evidence | `observe index`; Google inspection covers the indexed version, other engines require owner exports |
 | Returned by retrieval | Operator supplied | Provider observation containing retrieved source URL |
-| Cited | Operator supplied | Complete answer observation with citation URL |
-| Materially supports answer | Human review required | Answer claim mapped to a passage that entails it |
+| Cited | Import or disclosed adapter | Complete `observe citations` answer with citation URL and product/adapter mode |
+| Materially supports answer | Human review required | `citation_review` maps answer claim to source passage and names the reviewer |
 | Recommended | Operator supplied + review | Explicit recommendation, constraints, provider/mode/locale/time |
 
-Current CLI URL mode does not prove crawler identity, WAF allowlisting,
+URL audit mode alone does not prove crawler identity, WAF allowlisting,
 production-log access, index presence, selected canonical, rendered DOM parity,
-or provider citation behavior. Record those states as `not_evidenced` unless the
-specified evidence is supplied.
+or provider citation behavior. Observation collectors can supply narrower
+evidence for these states; unavailable inputs remain `not_evidenced`.
 
 Primary-source lineage for these boundaries:
 

package/dist/universal/.github/skills/citable/schemas/observation.schema.json

@@ -0,0 +1,20 @@
+{
+  "$id": "citable://schemas/observation.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Collected observation envelope",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["observation_id", "kind", "state", "collected_at", "collection_method", "confidence", "source", "evidence_hash", "data"],
+  "properties": {
+    "observation_id": { "type": "string", "minLength": 1 },
+    "kind": { "type": "string", "enum": ["render", "index", "citation", "citation_review", "crawler_log", "passage", "canonical_freshness", "performance", "corroboration"] },
+    "state": { "type": "string", "enum": ["observed", "not_observed", "not_evidenced", "incomplete", "review_required", "failed"] },
+    "collected_at": { "type": "string", "format": "date-time" },
+    "collection_method": { "type": "string", "enum": ["live_api", "browser", "owner_import", "synthetic_fetch", "static_analysis", "human_review"] },
+    "confidence": { "type": "string", "enum": ["confirmed", "high", "medium", "low", "unknown"] },
+    "source": { "type": "string", "minLength": 1 },
+    "evidence_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "data": { "type": "object" },
+    "limitations": { "type": "array", "items": { "type": "string" } }
+  }
+}

package/dist/universal/.github/skills/citable/schemas/remediation-spec.schema.json

@@ -0,0 +1,28 @@
+{
+  "$id": "citable://schemas/remediation-spec.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Guarded remediation specification",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["source_run_id", "operations"],
+  "properties": {
+    "source_run_id": { "type": "string" },
+    "operations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["operation_id", "file", "find", "replace", "expected_file_hash", "finding_ids"],
+        "properties": {
+          "operation_id": { "type": "string" },
+          "file": { "type": "string", "minLength": 1 },
+          "find": { "type": "string", "minLength": 1 },
+          "replace": { "type": "string" },
+          "expected_file_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "finding_ids": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+          "reviewer": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.kiro/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.3.1
+version: 1.4.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -85,6 +85,9 @@ citable schema --target <dir|url>
 citable validate [registries|claims|evidence|schema|links]
 citable compare-snapshots [runA runB]
 citable action-plan [run-id]          # ordered actions, blockers, semantic gates, verification
+citable observe <mode> [options]      # render/index/citation/log/passage/consensus/performance evidence
+citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
+citable monitor [runA runB]           # observation regression alerts
 ```
 
 Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
@@ -126,6 +129,9 @@ mandatory semantic reviews make the relevant posture `not_established`.
 Consult `references/capability-boundaries.md` before claiming any observation;
 it identifies which states the current CLI can collect and which require
 operator data or future adapters.
+Use `commands/observe-and-act.md` for collector prerequisites, evidence labels,
+the controlled citation adapter protocol, remediation refusal conditions, and
+monitoring interpretation.
 
 ## Command workflows
 

package/dist/universal/.kiro/skills/citable/VERSION

@@ -1 +1 @@
-1.3.1
+1.4.0

package/dist/universal/.kiro/skills/citable/commands/README.md

@@ -21,11 +21,14 @@ intent, not executability, so statuses are strict:
 | /citable validate, validate-claims, validate-evidence, validate-schema, validate-links | implemented |
 | /citable compare-snapshots / validate-regression | implemented |
 | /citable action-plan | implemented — writes ordered, source-run-bound action artifacts outside immutable evidence packages |
+| /citable observe | implemented — render, index, citation, crawler-log, passage, consensus, performance, and corroboration evidence |
+| /citable apply | implemented — reviewed, hash-locked source replacements; dry run by default |
+| /citable monitor | implemented — compares immutable observation runs and emits evidence-linked alerts |
 | /citable ingest, map-site, map-queries, map-prompts, map-entities, map-evidence | specified (ingest.md) |
 | /citable optimize-page | specified (optimize-page.md) — requires source-to-render mapping, claim-preserving rewrites, build execution, rollback; none of that is proven yet |
 | /citable create-page, answer-block, architect, interlink, consolidate, metadata | specified (page-work.md) |
-| /citable validate-render | specified (validate-render.md) — blocked on the rendered-truth phase (docs/detectors/render-phase-plan.md) |
-| /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | specified (measurement.md) — no external engine adapters exist or are claimed |
+| /citable validate-render | partially implemented by `observe render`; mobile/cross-browser and interaction exploration remain |
+| /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | partially implemented by observation imports, Google/CrUX live APIs, custom citation adapters, and monitor comparisons |
 
 Shared refusal conditions (all commands): any action that would fabricate
 facts, citations, evidence, authorship, reviews, corroboration, or hidden

package/dist/universal/.kiro/skills/citable/commands/measurement.md

@@ -1,14 +1,14 @@
 ---
 command: /citable measure seo|aeo|geo, test-prompts, monitor-crawlers, monitor-contradictions
-purpose: Observation and measurement workflows. Citable records and validates observations; it does not claim live engine adapters it does not have.
+purpose: Observation and measurement workflows with exact collector and product-mode boundaries.
 ---
 
 # Honest capability statement
 
-This MVP ships **no external engine adapters** (no Search Console API client,
-no ChatGPT/Perplexity automation). Measurement commands therefore operate on
-*operator-supplied observations*, validated against the data contracts, plus
-registry-side integrity checks (MEAS-001/002/003). Do not imply otherwise.
+Citable ships Google URL Inspection, CrUX field collection, normalized owner
+imports, and a disclosed custom citation-adapter protocol. It does not claim
+Bing AI Performance automation or equivalence between an API adapter and a
+consumer answer product. Preserve collector and product mode on every result.
 
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).

package/dist/universal/.kiro/skills/citable/commands/observe-and-act.md

@@ -0,0 +1,40 @@
+---
+command: /citable observe|apply|monitor
+purpose: Collect external and rendered evidence, apply reviewed source changes, and detect regressions without collapsing unlike evidence states.
+failure_behaviour: unavailable dependency, credential, source run, reviewer, exact hash, or unique replacement -> incomplete or fail; never infer success
+---
+
+# Observe, apply, and monitor
+
+## Collection modes
+
+- `observe render --target <URL>` uses optional Playwright. Browser evidence is
+  not search-index evidence.
+- `observe index --input <JSON>` imports owner exports. With `--target`,
+  `--site-url`, and `GSC_ACCESS_TOKEN`, it calls Google URL Inspection, which
+  reports the indexed version rather than performing a live indexability test.
+- `observe citations --input <JSON>` imports complete controlled observations.
+  With `--endpoint`, the input is a versioned prompt corpus and each prompt runs
+  1-20 times (default 3) through the disclosed adapter protocol. An API is not
+  presumed equivalent to a provider's consumer search experience.
+- `observe logs --input <JSON>` imports server/CDN records. User-agent matches
+  without IP verification remain low confidence.
+- `observe passages|consensus --target <dir|URL>` performs static extraction.
+- `observe performance` imports evidence or calls CrUX with `CRUX_API_KEY`.
+- `observe corroboration --input <JSON>` records observable external mentions;
+  controlled or unverified sources do not become authority claims.
+
+## Guarded remediation
+
+`apply --input remediation-spec.json` is a dry run. Every operation binds to an
+existing audit run and finding IDs, stays inside repository source, names a
+reviewer, matches the exact file hash, and identifies exactly one source string.
+`--write` applies only after all operations validate. Build, tests, semantic
+review, re-audit, and snapshot comparison remain mandatory afterward.
+
+## Monitoring
+
+`monitor [runA runB]` reports state changes, missing observations, index loss,
+canonical disagreement, and citation-presence changes. Alerts are evidence
+changes, not causal explanations or ranking conclusions. Schedule it in CI at
+the cadence defined by lifecycle and experiment records.

package/dist/universal/.kiro/skills/citable/manifest.json

@@ -1,24 +1,25 @@
 {
   "name": "citable",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "managedBy": "citable-cli",
   "provider": "kiro",
   "providerName": "Kiro",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.3.1",
+  "sourcePackage": "@nebulacomponents/citable@1.4.0",
   "variantPath": ".kiro/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:3550b1e747c5a38cdb712016b9bc773d93596bc4d1b49a309f9cddd816c1b662",
+    "commands/measurement.md": "sha256:c90352849a589b4cb66d1275a1888e9a2de5052a62399224c42b00f92bbdd814",
+    "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:186ca808e0f303938ef9f8f98c8273c4b7cb76cc791e7d751c3639bf201e3bb1",
+    "commands/README.md": "sha256:71b7f2b7fc5e98cfa2b699ec48f58f3b4e32dfb0233315759fc98f7ae7eecac0",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
-    "references/capability-boundaries.md": "sha256:901840fe87080071d0b11aa329d6a7954ffa6c601c58fadc275b55a7a988376a",
+    "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
     "rubrics/comparison-fairness.md": "sha256:7afc86903aa4a695060be7b6bca42ba505c106ea7cfa153344189afc5b78a5ba",
@@ -43,16 +44,18 @@
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
+    "schemas/observation.schema.json": "sha256:81d8994591fff4bc23a10f813f1957719d5a2093171520f661ab8792e14748da",
     "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
+    "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:571cbb467f40ac55778fdbbcd1d36a9234adde87cdfe80c7ed7d0bd0a799895d",
+    "SKILL.md": "sha256:1e53637f88647dba7bdafc08545ad966f0f77b2814d956d3fbd57b38b3e34fa0",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:10e2e117b01523891ca271a615ae36e9d5e52348fd7d642f66727602c1b8dcbe"
+    "VERSION": "sha256:78b591400c56b7b67b8cb3b2b8a8e65e9093897f02ce0878e6b5405c68620fa7"
   },
-  "treeHash": "sha256:f4be2ccf3c0ceb34df2554f6dad5d25eab4c11f8ccc98002a0abce2cb0667d30"
+  "treeHash": "sha256:d5eb2a8baf1230bc82f28610cf0a875f58f5070cb3953838b8310bad07eca012"
 }

package/dist/universal/.kiro/skills/citable/references/capability-boundaries.md

@@ -6,18 +6,18 @@ Use the narrowest supported state. Never promote evidence across rows.
 | --- | --- | --- |
 | Allowed by policy | Implemented | Effective robots rule plus crawler-purpose registry decision |
 | Synthetic fetch succeeded | Partial | Captured status, redirects, headers, body from the declared user agent; label identity simulated |
-| Verified crawler reached edge | Operator supplied | Request log plus provider-published IP verification where supported |
-| Observed in production logs | Operator supplied | Timestamped server/CDN log with URL, status, bytes, latency, cache result, UA, and verification result |
-| Indexed | Operator supplied | Search Console/Bing Webmaster/API or timestamped engine observation |
+| Verified crawler reached edge | Imported evidence | `observe logs` record plus provider-published IP verification where supported |
+| Observed in production logs | Imported evidence | Timestamped `observe logs` artifact with URL, status, bytes, latency, cache result, UA, and verification result |
+| Indexed | Google API or imported evidence | `observe index`; Google inspection covers the indexed version, other engines require owner exports |
 | Returned by retrieval | Operator supplied | Provider observation containing retrieved source URL |
-| Cited | Operator supplied | Complete answer observation with citation URL |
-| Materially supports answer | Human review required | Answer claim mapped to a passage that entails it |
+| Cited | Import or disclosed adapter | Complete `observe citations` answer with citation URL and product/adapter mode |
+| Materially supports answer | Human review required | `citation_review` maps answer claim to source passage and names the reviewer |
 | Recommended | Operator supplied + review | Explicit recommendation, constraints, provider/mode/locale/time |
 
-Current CLI URL mode does not prove crawler identity, WAF allowlisting,
+URL audit mode alone does not prove crawler identity, WAF allowlisting,
 production-log access, index presence, selected canonical, rendered DOM parity,
-or provider citation behavior. Record those states as `not_evidenced` unless the
-specified evidence is supplied.
+or provider citation behavior. Observation collectors can supply narrower
+evidence for these states; unavailable inputs remain `not_evidenced`.
 
 Primary-source lineage for these boundaries:
 

package/dist/universal/.kiro/skills/citable/schemas/observation.schema.json

@@ -0,0 +1,20 @@
+{
+  "$id": "citable://schemas/observation.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Collected observation envelope",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["observation_id", "kind", "state", "collected_at", "collection_method", "confidence", "source", "evidence_hash", "data"],
+  "properties": {
+    "observation_id": { "type": "string", "minLength": 1 },
+    "kind": { "type": "string", "enum": ["render", "index", "citation", "citation_review", "crawler_log", "passage", "canonical_freshness", "performance", "corroboration"] },
+    "state": { "type": "string", "enum": ["observed", "not_observed", "not_evidenced", "incomplete", "review_required", "failed"] },
+    "collected_at": { "type": "string", "format": "date-time" },
+    "collection_method": { "type": "string", "enum": ["live_api", "browser", "owner_import", "synthetic_fetch", "static_analysis", "human_review"] },
+    "confidence": { "type": "string", "enum": ["confirmed", "high", "medium", "low", "unknown"] },
+    "source": { "type": "string", "minLength": 1 },
+    "evidence_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "data": { "type": "object" },
+    "limitations": { "type": "array", "items": { "type": "string" } }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/remediation-spec.schema.json

@@ -0,0 +1,28 @@
+{
+  "$id": "citable://schemas/remediation-spec.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Guarded remediation specification",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["source_run_id", "operations"],
+  "properties": {
+    "source_run_id": { "type": "string" },
+    "operations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["operation_id", "file", "find", "replace", "expected_file_hash", "finding_ids"],
+        "properties": {
+          "operation_id": { "type": "string" },
+          "file": { "type": "string", "minLength": 1 },
+          "find": { "type": "string", "minLength": 1 },
+          "replace": { "type": "string" },
+          "expected_file_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "finding_ids": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+          "reviewer": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.opencode/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.3.1
+version: 1.4.0
 ---
 
 # Citable — search & generative discoverability governance
@@ -85,6 +85,9 @@ citable schema --target <dir|url>
 citable validate [registries|claims|evidence|schema|links]
 citable compare-snapshots [runA runB]
 citable action-plan [run-id]          # ordered actions, blockers, semantic gates, verification
+citable observe <mode> [options]      # render/index/citation/log/passage/consensus/performance evidence
+citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
+citable monitor [runA runB]           # observation regression alerts
 ```
 
 Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
@@ -126,6 +129,9 @@ mandatory semantic reviews make the relevant posture `not_established`.
 Consult `references/capability-boundaries.md` before claiming any observation;
 it identifies which states the current CLI can collect and which require
 operator data or future adapters.
+Use `commands/observe-and-act.md` for collector prerequisites, evidence labels,
+the controlled citation adapter protocol, remediation refusal conditions, and
+monitoring interpretation.
 
 ## Command workflows
 

package/dist/universal/.opencode/skills/citable/VERSION

@@ -1 +1 @@
-1.3.1
+1.4.0

package/dist/universal/.opencode/skills/citable/commands/README.md

@@ -21,11 +21,14 @@ intent, not executability, so statuses are strict:
 | /citable validate, validate-claims, validate-evidence, validate-schema, validate-links | implemented |
 | /citable compare-snapshots / validate-regression | implemented |
 | /citable action-plan | implemented — writes ordered, source-run-bound action artifacts outside immutable evidence packages |
+| /citable observe | implemented — render, index, citation, crawler-log, passage, consensus, performance, and corroboration evidence |
+| /citable apply | implemented — reviewed, hash-locked source replacements; dry run by default |
+| /citable monitor | implemented — compares immutable observation runs and emits evidence-linked alerts |
 | /citable ingest, map-site, map-queries, map-prompts, map-entities, map-evidence | specified (ingest.md) |
 | /citable optimize-page | specified (optimize-page.md) — requires source-to-render mapping, claim-preserving rewrites, build execution, rollback; none of that is proven yet |
 | /citable create-page, answer-block, architect, interlink, consolidate, metadata | specified (page-work.md) |
-| /citable validate-render | specified (validate-render.md) — blocked on the rendered-truth phase (docs/detectors/render-phase-plan.md) |
-| /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | specified (measurement.md) — no external engine adapters exist or are claimed |
+| /citable validate-render | partially implemented by `observe render`; mobile/cross-browser and interaction exploration remain |
+| /citable measure seo/aeo/geo, test-prompts, monitor-crawlers, monitor-contradictions | partially implemented by observation imports, Google/CrUX live APIs, custom citation adapters, and monitor comparisons |
 
 Shared refusal conditions (all commands): any action that would fabricate
 facts, citations, evidence, authorship, reviews, corroboration, or hidden

package/dist/universal/.opencode/skills/citable/commands/measurement.md

@@ -1,14 +1,14 @@
 ---
 command: /citable measure seo|aeo|geo, test-prompts, monitor-crawlers, monitor-contradictions
-purpose: Observation and measurement workflows. Citable records and validates observations; it does not claim live engine adapters it does not have.
+purpose: Observation and measurement workflows with exact collector and product-mode boundaries.
 ---
 
 # Honest capability statement
 
-This MVP ships **no external engine adapters** (no Search Console API client,
-no ChatGPT/Perplexity automation). Measurement commands therefore operate on
-*operator-supplied observations*, validated against the data contracts, plus
-registry-side integrity checks (MEAS-001/002/003). Do not imply otherwise.
+Citable ships Google URL Inspection, CrUX field collection, normalized owner
+imports, and a disclosed custom citation-adapter protocol. It does not claim
+Bing AI Performance automation or equivalence between an API adapter and a
+consumer answer product. Preserve collector and product mode on every result.
 
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).

package/dist/universal/.opencode/skills/citable/commands/observe-and-act.md

@@ -0,0 +1,40 @@
+---
+command: /citable observe|apply|monitor
+purpose: Collect external and rendered evidence, apply reviewed source changes, and detect regressions without collapsing unlike evidence states.
+failure_behaviour: unavailable dependency, credential, source run, reviewer, exact hash, or unique replacement -> incomplete or fail; never infer success
+---
+
+# Observe, apply, and monitor
+
+## Collection modes
+
+- `observe render --target <URL>` uses optional Playwright. Browser evidence is
+  not search-index evidence.
+- `observe index --input <JSON>` imports owner exports. With `--target`,
+  `--site-url`, and `GSC_ACCESS_TOKEN`, it calls Google URL Inspection, which
+  reports the indexed version rather than performing a live indexability test.
+- `observe citations --input <JSON>` imports complete controlled observations.
+  With `--endpoint`, the input is a versioned prompt corpus and each prompt runs
+  1-20 times (default 3) through the disclosed adapter protocol. An API is not
+  presumed equivalent to a provider's consumer search experience.
+- `observe logs --input <JSON>` imports server/CDN records. User-agent matches
+  without IP verification remain low confidence.
+- `observe passages|consensus --target <dir|URL>` performs static extraction.
+- `observe performance` imports evidence or calls CrUX with `CRUX_API_KEY`.
+- `observe corroboration --input <JSON>` records observable external mentions;
+  controlled or unverified sources do not become authority claims.
+
+## Guarded remediation
+
+`apply --input remediation-spec.json` is a dry run. Every operation binds to an
+existing audit run and finding IDs, stays inside repository source, names a
+reviewer, matches the exact file hash, and identifies exactly one source string.
+`--write` applies only after all operations validate. Build, tests, semantic
+review, re-audit, and snapshot comparison remain mandatory afterward.
+
+## Monitoring
+
+`monitor [runA runB]` reports state changes, missing observations, index loss,
+canonical disagreement, and citation-presence changes. Alerts are evidence
+changes, not causal explanations or ranking conclusions. Schedule it in CI at
+the cadence defined by lifecycle and experiment records.

package/dist/universal/.opencode/skills/citable/manifest.json

@@ -1,24 +1,25 @@
 {
   "name": "citable",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "managedBy": "citable-cli",
   "provider": "opencode",
   "providerName": "OpenCode",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.3.1",
+  "sourcePackage": "@nebulacomponents/citable@1.4.0",
   "variantPath": ".opencode/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:3550b1e747c5a38cdb712016b9bc773d93596bc4d1b49a309f9cddd816c1b662",
+    "commands/measurement.md": "sha256:c90352849a589b4cb66d1275a1888e9a2de5052a62399224c42b00f92bbdd814",
+    "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:186ca808e0f303938ef9f8f98c8273c4b7cb76cc791e7d751c3639bf201e3bb1",
+    "commands/README.md": "sha256:71b7f2b7fc5e98cfa2b699ec48f58f3b4e32dfb0233315759fc98f7ae7eecac0",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
-    "references/capability-boundaries.md": "sha256:901840fe87080071d0b11aa329d6a7954ffa6c601c58fadc275b55a7a988376a",
+    "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
     "rubrics/comparison-fairness.md": "sha256:7afc86903aa4a695060be7b6bca42ba505c106ea7cfa153344189afc5b78a5ba",
@@ -43,16 +44,18 @@
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
+    "schemas/observation.schema.json": "sha256:81d8994591fff4bc23a10f813f1957719d5a2093171520f661ab8792e14748da",
     "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
+    "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:571cbb467f40ac55778fdbbcd1d36a9234adde87cdfe80c7ed7d0bd0a799895d",
+    "SKILL.md": "sha256:1e53637f88647dba7bdafc08545ad966f0f77b2814d956d3fbd57b38b3e34fa0",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:10e2e117b01523891ca271a615ae36e9d5e52348fd7d642f66727602c1b8dcbe"
+    "VERSION": "sha256:78b591400c56b7b67b8cb3b2b8a8e65e9093897f02ce0878e6b5405c68620fa7"
   },
-  "treeHash": "sha256:f4be2ccf3c0ceb34df2554f6dad5d25eab4c11f8ccc98002a0abce2cb0667d30"
+  "treeHash": "sha256:d5eb2a8baf1230bc82f28610cf0a875f58f5070cb3953838b8310bad07eca012"
 }

package/dist/universal/.opencode/skills/citable/references/capability-boundaries.md

@@ -6,18 +6,18 @@ Use the narrowest supported state. Never promote evidence across rows.
 | --- | --- | --- |
 | Allowed by policy | Implemented | Effective robots rule plus crawler-purpose registry decision |
 | Synthetic fetch succeeded | Partial | Captured status, redirects, headers, body from the declared user agent; label identity simulated |
-| Verified crawler reached edge | Operator supplied | Request log plus provider-published IP verification where supported |
-| Observed in production logs | Operator supplied | Timestamped server/CDN log with URL, status, bytes, latency, cache result, UA, and verification result |
-| Indexed | Operator supplied | Search Console/Bing Webmaster/API or timestamped engine observation |
+| Verified crawler reached edge | Imported evidence | `observe logs` record plus provider-published IP verification where supported |
+| Observed in production logs | Imported evidence | Timestamped `observe logs` artifact with URL, status, bytes, latency, cache result, UA, and verification result |
+| Indexed | Google API or imported evidence | `observe index`; Google inspection covers the indexed version, other engines require owner exports |
 | Returned by retrieval | Operator supplied | Provider observation containing retrieved source URL |
-| Cited | Operator supplied | Complete answer observation with citation URL |
-| Materially supports answer | Human review required | Answer claim mapped to a passage that entails it |
+| Cited | Import or disclosed adapter | Complete `observe citations` answer with citation URL and product/adapter mode |
+| Materially supports answer | Human review required | `citation_review` maps answer claim to source passage and names the reviewer |
 | Recommended | Operator supplied + review | Explicit recommendation, constraints, provider/mode/locale/time |
 
-Current CLI URL mode does not prove crawler identity, WAF allowlisting,
+URL audit mode alone does not prove crawler identity, WAF allowlisting,
 production-log access, index presence, selected canonical, rendered DOM parity,
-or provider citation behavior. Record those states as `not_evidenced` unless the
-specified evidence is supplied.
+or provider citation behavior. Observation collectors can supply narrower
+evidence for these states; unavailable inputs remain `not_evidenced`.
 
 Primary-source lineage for these boundaries: