@nebulacomponents/citable 1.5.1 → 1.7.0

package/dist/universal/.kiro/skills/citable/SKILL.md

@@ -7,12 +7,16 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.1
+version: 1.7.0
 ---
 
-# Citable — search & generative discoverability governance
+# Citable — evidence and change control for search and AI citation readiness
 
 Citable is an operational quality and governance layer, not a content generator.
+It records what a property makes technically available, what its content can
+support, and what external systems have actually been observed doing. It does
+not score visibility; it establishes what is eligible, supportable, observed,
+changed, and still unknown.
 It treats discoverability as an engineering system: registries as the source of
 truth, deterministic detectors for observable conditions, rubrics for semantic
 judgment, evidence packages for every run, and fail-closed behaviour wherever a
@@ -70,6 +74,11 @@ Within retrieval, distinguish `allowed_by_policy`, `synthetic_fetch_succeeded`,
 citation testing, distinguish mention, citation, material support, canonical
 source selection, and recommendation. These states are not interchangeable.
 
+Evidence preservation, authority, authenticity, collection method, and
+representativeness are also independent. Follow
+`references/evidence-authority.md`; a checksum or CIDR match alone never proves
+source authenticity, complete coverage, or verified crawler identity.
+
 ## Tooling
 
 The `citable` CLI in this repository performs the deterministic work. Always
@@ -86,9 +95,16 @@ citable validate [registries|claims|evidence|schema|links]
 citable compare-snapshots [runA runB]
 citable action-plan [run-id]          # ordered actions, blockers, semantic gates, verification
 citable observe <mode> [options]      # render/index/citation/log/passage/consensus/performance evidence
+citable observe bing --dataset <search_performance|ai_performance> --input <csv|json>
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.kiro/skills/citable/VERSION

@@ -1 +1 @@
-1.5.1
+1.7.0

package/dist/universal/.kiro/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,
@@ -55,6 +70,21 @@ agent × URL × status; flag 403/429/5xx concentrations against declared-allow
 crawlers; note that user-agent strings are spoofable and IP validation is the
 confirmation step (crawler registry ip_validation_method). Compare observed
 access against `crawlers.yaml` decisions (CRAWL-001 logic applied to logs).
+Normalize JSON or CSV edge/origin events into the crawler identity contract.
+Do not label CIDR membership alone verified: preserve range-source provenance,
+DNS, edge, origin, region, collector, stages, and contradiction state.
+Remove credentials, cookies, secrets, and unnecessary personal data before
+import. Citable rejects common sensitive field names but cannot establish that
+arbitrary URL or query values are lawful or appropriately minimized.
+
+# Bing owner observations
+
+Use `citable observe bing --dataset search_performance|ai_performance --input
+<csv|json>`. This release normalizes owner exports because no supported Bing AI
+Performance API contract has been captured. Citation counts do not indicate
+ranking, authority, placement, page importance, or material support. Grounding
+queries may be sampled. Preserve traffic-source dimensions and never infer
+causation from a temporal change.
 
 # monitor-contradictions
 Compare approved entity + claim records against: owned pages (automated, via

package/dist/universal/.kiro/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.1",
+  "version": "1.7.0",
   "managedBy": "citable-cli",
   "provider": "kiro",
   "providerName": "Kiro",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.1",
+  "sourcePackage": "@nebulacomponents/citable@1.7.0",
   "variantPath": ".kiro/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:9cade6dfec23338e18aa67ede3335ac9e2888dc577a7d4d8e3ceac948bce403f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -20,6 +20,7 @@
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
     "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
+    "references/evidence-authority.md": "sha256:b81ee09953999f16b19dc0eaba6fffe794b58d152e2adbd95c3179730bc08ffc",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
     "rubrics/comparison-fairness.md": "sha256:7afc86903aa4a695060be7b6bca42ba505c106ea7cfa153344189afc5b78a5ba",
@@ -34,21 +35,24 @@
     "rubrics/semantic-clarity.md": "sha256:66d9f4843a4a620ea8c00625c5e17c02baeaa373f2b445ce13de6f81d78ec7ba",
     "rubrics/source-authority.md": "sha256:8dbfe46bdcd0b5351f038be503601268c7d0abb9bed83be9ca58bf54dec5a73b",
     "schemas/action-plan.schema.json": "sha256:4b6c4c877840a065c7c0c0c7b52f696502bf3d4ca6d31179622fc364ea868d5e",
+    "schemas/bing-webmaster.schema.json": "sha256:8357c518a8cb4ccd1def2da38950fbba68270e2b1613ad522b50c568a3b8538f",
     "schemas/claim.schema.json": "sha256:ce79ccbfa34ece9b7a309a6962522ea06a1f44c468b4c472b5c376554a788537",
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
+    "schemas/crawler-identity.schema.json": "sha256:e1e3e6da203a8bc49fba8f9bbde525368891db022d542fc615b677401825351d",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
+    "schemas/evidence-authority.schema.json": "sha256:4f8165a37304ebab019e1c2dfec13f1168ecf89ce9bec88f7dca9c8554e39ac0",
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
     "schemas/intervention.schema.json": "sha256:fcf28e117b207e64ffc96088aa70a95370841a2a9fa43ecb1c82b34c2058a818",
     "schemas/metric.schema.json": "sha256:2ada648e7274a8d78cc9d6e7ed616f91faa79cf9ed07613e2c1fc53b247aac8d",
     "schemas/objective.schema.json": "sha256:94404dc95d04a6641ea7b9654317d0222793251ad44d3dfd2875738622a36025",
-    "schemas/observation.schema.json": "sha256:240ab0030e900dd8d779b63ef0558b1cca3b59a6de1a10cf9b2418b73ad92f02",
+    "schemas/observation.schema.json": "sha256:bea8eb7ea74442a1be745aa40ff22d25dcd89a82fb0205dfc6c597da40831f64",
     "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
@@ -57,9 +61,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:ef61c795af6e99099cd6247f4f6fec62ceb8c64f3eaa3e17eeb6b24057f7498c",
+    "SKILL.md": "sha256:06849d7894538c05b8539d595f8ee8370999db397f7ed552a272f1e0846d3f2a",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:dfe7d71b3f428eb73ed853f8fded65e2986896e21d69f45ebf06bb623b450e14"
+    "VERSION": "sha256:bb7320d831e7a151aa901c35e7326c752fa2ef5024f30768c42319b8bed171ed"
   },
-  "treeHash": "sha256:32f29a5d5aaab9b58e1ceae7ab894fe66fa2b55091248a20221f5f93b8e60915"
+  "treeHash": "sha256:62432b83fd45f3a8fddc60f5b1f273eebb8d6225ef10e1476ed32185edb760b9"
 }

package/dist/universal/.kiro/skills/citable/references/evidence-authority.md

@@ -0,0 +1,43 @@
+# Evidence authority and crawler identity
+
+An evidence checksum establishes preservation only. It does not establish that
+the source was authentic, the collection was complete, or the observation was
+representative. Report four axes independently on every new observation:
+
+1. `source_authority`: provider-published, standards-body, owner-controlled,
+   independently controlled, third-party commercial, synthetic, inferred, or
+   unknown.
+2. `collection_authority`: direct API, production log, browser capture, owner
+   export, third-party export, manual entry, model-generated inference, static
+   analysis, or synthetic probe.
+3. `authenticity_status`: cryptographically authenticated, provider-range
+   verified, owner-attested, transport-authenticated, checksum-protected only,
+   or unverified.
+4. `representativeness`: production population, complete export,
+   statistically sampled, controlled experiment, convenience sample, single
+   observation, or unknown.
+
+Never convert these axes into one authority score.
+
+## Crawler identity
+
+Contract support and verified observations are different outcomes. The
+`crawler-identity` schema can exist without any production event satisfying it.
+A user-agent match is `declared`. A synthetic request is
+`synthetically_observed`. An observed IP in an imported range is only
+`range_matched`.
+
+`fully_verified` requires all of:
+
+- a provider and declared user agent;
+- observed source IP matching the captured CIDR set;
+- provider-published range source URL, retrieval time, captured source snapshot,
+  and valid snapshot checksum;
+- documented forward/reverse DNS verification where applicable;
+- an explicit edge observation and decision;
+- a correlated origin observation and status;
+- region and collector identity.
+
+A failed range or DNS check, or a claimed verification without the required
+chain, is `contradictory`. Missing links are `insufficient_evidence`. Verification
+applies only to the captured event; it does not establish all crawler traffic.

package/dist/universal/.kiro/skills/citable/schemas/bing-webmaster.schema.json

@@ -0,0 +1,25 @@
+{
+  "$id": "citable://schemas/bing-webmaster.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Normalized Bing Webmaster observation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["dataset", "date", "url", "metrics", "dimensions", "interpretation_boundary"],
+  "properties": {
+    "dataset": { "type": "string", "enum": ["search_performance", "ai_performance"] },
+    "date": { "type": "string", "format": "date" },
+    "url": { "type": ["string", "null"], "format": "uri", "pattern": "^https?://" },
+    "metrics": { "type": "object", "additionalProperties": { "type": ["number", "null"] } },
+    "dimensions": {
+      "type": "object", "additionalProperties": false,
+      "properties": {
+        "query": { "type": ["string", "null"] },
+        "grounding_query": { "type": ["string", "null"] },
+        "source": { "type": ["string", "null"] },
+        "country": { "type": ["string", "null"] },
+        "device": { "type": ["string", "null"] }
+      }
+    },
+    "interpretation_boundary": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },

package/dist/universal/.kiro/skills/citable/schemas/crawler-identity.schema.json

@@ -0,0 +1,42 @@
+{
+  "$id": "citable://schemas/crawler-identity.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Crawler identity evidence contract",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["provider", "declared_user_agent", "observed_source_ip", "range_source", "cidr_membership", "dns", "edge", "origin", "region", "collector", "stages", "verification_status"],
+  "properties": {
+    "provider": { "type": "string", "minLength": 1 },
+    "declared_user_agent": { "type": "string", "minLength": 1 },
+    "observed_source_ip": { "type": ["string", "null"] },
+    "range_source": {
+      "type": "object", "additionalProperties": false,
+      "required": ["url", "retrieved_at", "authority", "checksum", "checksum_scope", "checksum_valid"],
+      "properties": {
+        "url": { "type": ["string", "null"], "format": "uri" },
+        "retrieved_at": { "type": ["string", "null"], "format": "date-time" },
+        "authority": { "type": "string", "enum": ["provider_published", "owner_controlled", "third_party", "unknown"] },
+        "checksum": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" },
+        "checksum_scope": { "type": "string", "enum": ["source_snapshot", "not_captured"] },
+        "checksum_valid": { "type": "boolean" }
+      }
+    },
+    "cidr_membership": { "type": "string", "enum": ["matched", "not_matched", "not_tested", "invalid"] },
+    "dns": {
+      "type": "object", "additionalProperties": false, "required": ["status", "method"],
+      "properties": { "status": { "type": "string", "enum": ["verified", "failed", "not_tested"] }, "method": { "type": ["string", "null"] } }
+    },
+    "edge": {
+      "type": "object", "additionalProperties": false, "required": ["observed", "decision"],
+      "properties": { "observed": { "type": "boolean" }, "decision": { "type": ["string", "null"] } }
+    },
+    "origin": {
+      "type": "object", "additionalProperties": false, "required": ["observed", "status"],
+      "properties": { "observed": { "type": "boolean" }, "status": { "type": ["integer", "null"], "minimum": 100, "maximum": 599 } }
+    },
+    "region": { "type": ["string", "null"] },
+    "collector": { "type": "string", "minLength": 1 },
+    "stages": { "type": "array", "uniqueItems": true, "items": { "type": "string", "enum": ["declared", "synthetically_observed", "range_matched", "dns_verified", "edge_observed", "origin_observed", "fully_verified", "contradictory", "insufficient_evidence"] } },
+    "verification_status": { "type": "string", "enum": ["declared", "synthetically_observed", "range_matched", "dns_verified", "edge_observed", "origin_observed", "fully_verified", "contradictory", "insufficient_evidence"] }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/evidence-authority.schema.json

@@ -0,0 +1,15 @@
+{
+  "$id": "citable://schemas/evidence-authority.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Multidimensional evidence authority",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["source_authority", "collection_authority", "authenticity_status", "representativeness"],
+  "properties": {
+    "source_authority": { "type": "string", "enum": ["provider_published", "standards_body", "owner_controlled", "independently_controlled", "third_party_commercial", "synthetic", "inferred", "unknown"] },
+    "collection_authority": { "type": "string", "enum": ["direct_api", "production_log", "browser_capture", "owner_export", "third_party_export", "manual_entry", "model_generated_inference", "static_analysis", "synthetic_probe"] },
+    "authenticity_status": { "type": "string", "enum": ["cryptographically_authenticated", "provider_range_verified", "owner_attested", "transport_authenticated", "checksum_protected_only", "unverified"] },
+    "representativeness": { "type": "string", "enum": ["production_population", "complete_export", "statistically_sampled", "controlled_experiment", "convenience_sample", "single_observation", "unknown"] },
+    "limitations": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  }
+}

package/dist/universal/.kiro/skills/citable/schemas/observation.schema.json

@@ -7,7 +7,7 @@
   "required": ["observation_id", "kind", "state", "collected_at", "collection_method", "confidence", "source", "evidence_hash", "data"],
   "properties": {
     "observation_id": { "type": "string", "minLength": 1 },
-    "kind": { "type": "string", "enum": ["render", "index", "citation", "citation_review", "crawler_log", "passage", "canonical_freshness", "performance", "corroboration", "metric"] },
+    "kind": { "type": "string", "enum": ["render", "index", "citation", "citation_review", "crawler_log", "bing_webmaster", "passage", "canonical_freshness", "performance", "corroboration", "metric"] },
     "state": { "type": "string", "enum": ["observed", "not_observed", "not_evidenced", "incomplete", "review_required", "failed"] },
     "collected_at": { "type": "string", "format": "date-time" },
     "collection_method": { "type": "string", "enum": ["live_api", "browser", "owner_import", "synthetic_fetch", "static_analysis", "human_review"] },
@@ -15,6 +15,7 @@
     "source": { "type": "string", "minLength": 1 },
     "evidence_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
     "data": { "type": "object" },
-    "limitations": { "type": "array", "items": { "type": "string" } }
+    "limitations": { "type": "array", "items": { "type": "string" } },
+    "authority": { "$ref": "citable://schemas/evidence-authority.schema.json" }
   }
 }

package/dist/universal/.opencode/skills/citable/SKILL.md

@@ -7,12 +7,16 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.5.1
+version: 1.7.0
 ---
 
-# Citable — search & generative discoverability governance
+# Citable — evidence and change control for search and AI citation readiness
 
 Citable is an operational quality and governance layer, not a content generator.
+It records what a property makes technically available, what its content can
+support, and what external systems have actually been observed doing. It does
+not score visibility; it establishes what is eligible, supportable, observed,
+changed, and still unknown.
 It treats discoverability as an engineering system: registries as the source of
 truth, deterministic detectors for observable conditions, rubrics for semantic
 judgment, evidence packages for every run, and fail-closed behaviour wherever a
@@ -70,6 +74,11 @@ Within retrieval, distinguish `allowed_by_policy`, `synthetic_fetch_succeeded`,
 citation testing, distinguish mention, citation, material support, canonical
 source selection, and recommendation. These states are not interchangeable.
 
+Evidence preservation, authority, authenticity, collection method, and
+representativeness are also independent. Follow
+`references/evidence-authority.md`; a checksum or CIDR match alone never proves
+source authenticity, complete coverage, or verified crawler identity.
+
 ## Tooling
 
 The `citable` CLI in this repository performs the deterministic work. Always
@@ -86,9 +95,16 @@ citable validate [registries|claims|evidence|schema|links]
 citable compare-snapshots [runA runB]
 citable action-plan [run-id]          # ordered actions, blockers, semantic gates, verification
 citable observe <mode> [options]      # render/index/citation/log/passage/consensus/performance evidence
+citable observe bing --dataset <search_performance|ai_performance> --input <csv|json>
 citable apply --input <spec> [--write] # reviewed, hash-locked remediation; dry run by default
 citable monitor [runA runB]           # observation regression alerts
 citable metrics import --provider <name> --input <csv|json>
+citable connect status
+citable connect configure --provider <gsc|ga4> --connection-id <id> --property-id <id> [--credential-env <name>] [--write]
+citable connect discover --provider <gsc|ga4>
+citable connect validate --connection-id <id>
+citable connect sync --connection-id <id> --start-date YYYY-MM-DD --end-date YYYY-MM-DD
+citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]

package/dist/universal/.opencode/skills/citable/VERSION

@@ -1 +1 @@
-1.5.1
+1.7.0

package/dist/universal/.opencode/skills/citable/commands/measurement.md

@@ -10,7 +10,7 @@ imports, and a disclosed custom citation-adapter protocol. It does not claim
 Bing AI Performance automation or equivalence between an API adapter and a
 consumer answer product. Preserve collector and product mode on every result.
 
-# implemented metric and objective workflow
+# implemented metric, connector, and objective workflow
 
 `citable metrics import --provider <name> --input <csv|json>` validates every
 row against a declared entry in `metrics.yaml` and writes immutable metric
@@ -27,6 +27,21 @@ absence of provider credentials is `not_configured`, not a finding and not
 evidence of zero activity. Credentials must never enter registries or evidence
 packages.
 
+Live GSC and GA4 connections are explicitly optional. Configure only a
+property identifier and the name of the environment variable that holds its
+OAuth token; never place the token itself in `.citable/connections.yaml`.
+`citable connect configure` and `disconnect` are dry runs unless `--write` is
+used. `connect discover`, `validate`, and `sync` require read-only provider
+authorization. `sync` writes declared metric observations with provider
+limitations and advances a non-secret cursor. Provider errors are recorded as
+connection state, not converted into zero observations or audit findings.
+
+The GSC adapter collects final Search Analytics rows and inherits Search
+Console aggregation, privacy filtering, and top-row availability limits. The GA4 adapter collects Data API
+rows restricted to the `Organic Search` default channel group and inherits the
+property's reporting identity, thresholding, attribution, and consent choices.
+Neither source establishes that an intervention caused an observed change.
+
 # measure seo
 Inputs the operator exports (Search Console/Bing/analytics CSV or JSON).
 Workflow: validate segmentation (brand vs non-brand, intent, page type,
@@ -55,6 +70,21 @@ agent × URL × status; flag 403/429/5xx concentrations against declared-allow
 crawlers; note that user-agent strings are spoofable and IP validation is the
 confirmation step (crawler registry ip_validation_method). Compare observed
 access against `crawlers.yaml` decisions (CRAWL-001 logic applied to logs).
+Normalize JSON or CSV edge/origin events into the crawler identity contract.
+Do not label CIDR membership alone verified: preserve range-source provenance,
+DNS, edge, origin, region, collector, stages, and contradiction state.
+Remove credentials, cookies, secrets, and unnecessary personal data before
+import. Citable rejects common sensitive field names but cannot establish that
+arbitrary URL or query values are lawful or appropriately minimized.
+
+# Bing owner observations
+
+Use `citable observe bing --dataset search_performance|ai_performance --input
+<csv|json>`. This release normalizes owner exports because no supported Bing AI
+Performance API contract has been captured. Citation counts do not indicate
+ranking, authority, placement, page importance, or material support. Grounding
+queries may be sampled. Preserve traffic-source dimensions and never infer
+causation from a temporal change.
 
 # monitor-contradictions
 Compare approved entity + claim records against: owned pages (automated, via

package/dist/universal/.opencode/skills/citable/manifest.json

@@ -1,16 +1,16 @@
 {
   "name": "citable",
-  "version": "1.5.1",
+  "version": "1.7.0",
   "managedBy": "citable-cli",
   "provider": "opencode",
   "providerName": "OpenCode",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.5.1",
+  "sourcePackage": "@nebulacomponents/citable@1.7.0",
   "variantPath": ".opencode/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
-    "commands/measurement.md": "sha256:5d7d94b496d2772ad433cf9fafa85af5c9638c8f326ec2017d2c8d6ef4dd1650",
+    "commands/measurement.md": "sha256:9cade6dfec23338e18aa67ede3335ac9e2888dc577a7d4d8e3ceac948bce403f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
@@ -20,6 +20,7 @@
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
     "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
+    "references/evidence-authority.md": "sha256:b81ee09953999f16b19dc0eaba6fffe794b58d152e2adbd95c3179730bc08ffc",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
     "rubrics/comparison-fairness.md": "sha256:7afc86903aa4a695060be7b6bca42ba505c106ea7cfa153344189afc5b78a5ba",
@@ -34,21 +35,24 @@
     "rubrics/semantic-clarity.md": "sha256:66d9f4843a4a620ea8c00625c5e17c02baeaa373f2b445ce13de6f81d78ec7ba",
     "rubrics/source-authority.md": "sha256:8dbfe46bdcd0b5351f038be503601268c7d0abb9bed83be9ca58bf54dec5a73b",
     "schemas/action-plan.schema.json": "sha256:4b6c4c877840a065c7c0c0c7b52f696502bf3d4ca6d31179622fc364ea868d5e",
+    "schemas/bing-webmaster.schema.json": "sha256:8357c518a8cb4ccd1def2da38950fbba68270e2b1613ad522b50c568a3b8538f",
     "schemas/claim.schema.json": "sha256:ce79ccbfa34ece9b7a309a6962522ea06a1f44c468b4c472b5c376554a788537",
     "schemas/common.defs.json": "sha256:effdd812910d1c275c50520bb70d8aec085e53fa8cb68054dc58c04a5d4a66b3",
     "schemas/competitor.schema.json": "sha256:2f6fd7e4543846bde56ff4dc62bb41fa366889787b794a7cdb0bff1a3392e591",
     "schemas/config.schema.json": "sha256:a87f3bb0087de09035b9f2dafea66e32e4fcc2e3e329abcd0fd8a5ec33318f2a",
-    "schemas/connection.schema.json": "sha256:cf0e9698dee697fb2c124989c3f478187297594c6ae76ecd04a43470e0a73616",
+    "schemas/connection.schema.json": "sha256:abcedde8d62d0c0663d4f959e06132a617908058ed965078965445ef3b108310",
+    "schemas/crawler-identity.schema.json": "sha256:e1e3e6da203a8bc49fba8f9bbde525368891db022d542fc615b677401825351d",
     "schemas/crawler.schema.json": "sha256:1a113dfb80bc6cde904c3ea648c82ea1d88fe50f2c1a0e7175d44abba28ac64e",
     "schemas/detector-quality.schema.json": "sha256:5e9e1ac80b1198a0ff8fa17b9f7a543d3ccf3ed3d60196152f6ff095cfdebccd",
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
+    "schemas/evidence-authority.schema.json": "sha256:4f8165a37304ebab019e1c2dfec13f1168ecf89ce9bec88f7dca9c8554e39ac0",
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
     "schemas/intervention.schema.json": "sha256:fcf28e117b207e64ffc96088aa70a95370841a2a9fa43ecb1c82b34c2058a818",
     "schemas/metric.schema.json": "sha256:2ada648e7274a8d78cc9d6e7ed616f91faa79cf9ed07613e2c1fc53b247aac8d",
     "schemas/objective.schema.json": "sha256:94404dc95d04a6641ea7b9654317d0222793251ad44d3dfd2875738622a36025",
-    "schemas/observation.schema.json": "sha256:240ab0030e900dd8d779b63ef0558b1cca3b59a6de1a10cf9b2418b73ad92f02",
+    "schemas/observation.schema.json": "sha256:bea8eb7ea74442a1be745aa40ff22d25dcd89a82fb0205dfc6c597da40831f64",
     "schemas/page.schema.json": "sha256:627613c35f461177fa946df08edf66fbf6f6bbdfc57eef812572b3af796d5e07",
     "schemas/project.schema.json": "sha256:ea48fdb6480f7047ba4594bd5908bc1f79c1ad6b9a2c204df900959b5f203dc6",
     "schemas/prompt-result.schema.json": "sha256:b55be47d7d58d7b1dd8c3b1e849e24e55216212c592cde7eb836953379b85737",
@@ -57,9 +61,9 @@
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:ef61c795af6e99099cd6247f4f6fec62ceb8c64f3eaa3e17eeb6b24057f7498c",
+    "SKILL.md": "sha256:06849d7894538c05b8539d595f8ee8370999db397f7ed552a272f1e0846d3f2a",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:dfe7d71b3f428eb73ed853f8fded65e2986896e21d69f45ebf06bb623b450e14"
+    "VERSION": "sha256:bb7320d831e7a151aa901c35e7326c752fa2ef5024f30768c42319b8bed171ed"
   },
-  "treeHash": "sha256:32f29a5d5aaab9b58e1ceae7ab894fe66fa2b55091248a20221f5f93b8e60915"
+  "treeHash": "sha256:62432b83fd45f3a8fddc60f5b1f273eebb8d6225ef10e1476ed32185edb760b9"
 }

package/dist/universal/.opencode/skills/citable/references/evidence-authority.md

@@ -0,0 +1,43 @@
+# Evidence authority and crawler identity
+
+An evidence checksum establishes preservation only. It does not establish that
+the source was authentic, the collection was complete, or the observation was
+representative. Report four axes independently on every new observation:
+
+1. `source_authority`: provider-published, standards-body, owner-controlled,
+   independently controlled, third-party commercial, synthetic, inferred, or
+   unknown.
+2. `collection_authority`: direct API, production log, browser capture, owner
+   export, third-party export, manual entry, model-generated inference, static
+   analysis, or synthetic probe.
+3. `authenticity_status`: cryptographically authenticated, provider-range
+   verified, owner-attested, transport-authenticated, checksum-protected only,
+   or unverified.
+4. `representativeness`: production population, complete export,
+   statistically sampled, controlled experiment, convenience sample, single
+   observation, or unknown.
+
+Never convert these axes into one authority score.
+
+## Crawler identity
+
+Contract support and verified observations are different outcomes. The
+`crawler-identity` schema can exist without any production event satisfying it.
+A user-agent match is `declared`. A synthetic request is
+`synthetically_observed`. An observed IP in an imported range is only
+`range_matched`.
+
+`fully_verified` requires all of:
+
+- a provider and declared user agent;
+- observed source IP matching the captured CIDR set;
+- provider-published range source URL, retrieval time, captured source snapshot,
+  and valid snapshot checksum;
+- documented forward/reverse DNS verification where applicable;
+- an explicit edge observation and decision;
+- a correlated origin observation and status;
+- region and collector identity.
+
+A failed range or DNS check, or a claimed verification without the required
+chain, is `contradictory`. Missing links are `insufficient_evidence`. Verification
+applies only to the captured event; it does not establish all crawler traffic.

package/dist/universal/.opencode/skills/citable/schemas/bing-webmaster.schema.json

@@ -0,0 +1,25 @@
+{
+  "$id": "citable://schemas/bing-webmaster.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Normalized Bing Webmaster observation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["dataset", "date", "url", "metrics", "dimensions", "interpretation_boundary"],
+  "properties": {
+    "dataset": { "type": "string", "enum": ["search_performance", "ai_performance"] },
+    "date": { "type": "string", "format": "date" },
+    "url": { "type": ["string", "null"], "format": "uri", "pattern": "^https?://" },
+    "metrics": { "type": "object", "additionalProperties": { "type": ["number", "null"] } },
+    "dimensions": {
+      "type": "object", "additionalProperties": false,
+      "properties": {
+        "query": { "type": ["string", "null"] },
+        "grounding_query": { "type": ["string", "null"] },
+        "source": { "type": ["string", "null"] },
+        "country": { "type": ["string", "null"] },
+        "device": { "type": ["string", "null"] }
+      }
+    },
+    "interpretation_boundary": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
+  }
+}

package/dist/universal/.opencode/skills/citable/schemas/connection.schema.json

@@ -19,6 +19,7 @@
           "connection_id": { "type": "string", "pattern": "^CONNECTION-[A-Z0-9][A-Z0-9_-]*$" },
           "provider": { "type": "string", "minLength": 1 },
           "property_id": { "type": ["string", "null"] },
+          "credential_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
           "state": { "type": "string", "enum": ["not_configured", "configured", "synchronized", "partial", "authorization_expired", "permission_denied", "quota_limited", "temporarily_unavailable"] },
           "authentication": { "type": "string", "enum": ["none", "environment", "os_keychain", "external_secret_manager", "owner_import"] },
           "scopes": { "type": "array", "items": { "type": "string" } },