@nebulacomponents/citable 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 1.8.0 — 2026-07-19
+
+### Added
+
+- Schema-validated reviewer, review-policy, and governed-exception registries
+  with role authorization, declared conflicts, separation-of-duty controls,
+  expiry, renewal limits, supersession, compensating controls, and audit history.
+- `citable governance validate` and `citable governance evaluate` for
+  policy validation and immutable enforcement-disposition evidence packages.
+- Finding, policy, and evidence hash binding so stale approvals fail closed.
+
+### Changed
+
+- Accepted exceptions no longer alter technical finding state. Reports preserve
+  `technical_state: failed` and record `accepted_exception` only as a separate
+  enforcement disposition with explicit residual risk and validity.
+- The supported runtime floor is Node.js 24, matching all CI, package, release,
+  and trusted-publishing gates.
+
 ## 1.7.0 — 2026-07-19
 
 ### Added

package/README.md

@@ -18,7 +18,8 @@ generator, not a Lighthouse wrapper, not an "AI visibility score".
 
 - **Persistent registries** (`.citable/`): queries, prompts, entities, claims,
   evidence, pages, crawler policies, competitors, experiments, metrics,
-  objectives, interventions, and optional connections — all
+  objectives, interventions, optional connections, reviewers, review policies,
+  and governed exceptions — all
   JSON-Schema validated with referential integrity and history-preserving saves.
 - **123 detectors** across 18 namespaces (TECH, CRAWL, ARCH, PAGE, ANS,
   ENTITY, CLAIM, EVD, SCHEMA, LINK, EXT, GEO, RECO, LIFE, MEAS, HREFLANG, CWV, AGENT), each with
@@ -163,6 +164,8 @@ GSC_ACCESS_TOKEN=... citable connect sync --connection-id CONNECTION-GSC --start
 citable objectives init --input objective.json --write
 citable objectives validate
 citable evaluate OBJECTIVE-PRODUCT_DISCOVERY --ref-date 2026-07-18
+citable governance validate --ref-date 2026-07-19
+citable governance evaluate <run-id> --ref-date 2026-07-19
 citable substantiate          # claim/evidence assessment (dry run)
 citable validate              # registry schema + referential integrity
 ```
@@ -173,7 +176,7 @@ citable validate              # registry schema + referential integrity
 | --- | --- |
 | `skill/` | Canonical agent skill: SKILL.md, command contracts, rubrics, anti-patterns, policies, templates |
 | `src/` | CLI, commands, registries, detectors, crawler/extractor, evidence, reporting |
-| `schemas/` | JSON Schemas: 13 registries plus findings, runs, observations, remediation, config, and prompt results |
+| `schemas/` | JSON Schemas: 16 registries plus findings, runs, observations, remediation, config, and prompt results |
 | `tests/` | Unit + integration suites; positive/negative fixtures |
 | `docs/` | ADR, traceability matrix, known limitations |
 | `dist/` | Generated distribution packages (run `npm run build:dist`) |
@@ -191,10 +194,13 @@ citable validate              # registry schema + referential integrity
   partial, operator-supplied, and missing evidence boundaries
 - [Measurement objectives](docs/measurement-objectives.md) — optional metric
   imports, user-owned objectives, comparison windows, and guardrails
+- [Reviewer and exception governance](docs/governance/reviewer-exceptions.md) —
+  policy-driven authority, separation of duties, expiry, invalidation, and
+  immutable enforcement dispositions
 
 ## Requirements
 
-Node >= 22.22.2. Network access is used for URL audits and explicitly selected
+Node >= 24.0.0. Network access is used for URL audits and explicitly selected
 live collectors. Render collection requires the optional `playwright` peer and
 an installed Chromium browser. Google index inspection uses `GSC_ACCESS_TOKEN`
 and `--site-url`; CrUX uses `CRUX_API_KEY`. Missing dependencies or credentials

package/dist/universal/.agents/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.7.0
+version: 1.8.0
 ---
 
 # Citable — evidence and change control for search and AI citation readiness
@@ -108,6 +108,8 @@ citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]
+citable governance validate [--ref-date YYYY-MM-DD]
+citable governance evaluate <run-id> [--ref-date YYYY-MM-DD]
 ```
 
 Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
@@ -165,8 +167,9 @@ mandatory.
 ## Registries are the source of truth
 
 `.citable/` holds YAML registries for queries, prompts, entities, claims,
-evidence, pages, crawlers, competitors, experiments, metrics, objectives,
-interventions, and optional connection state, all schema-validated
+  evidence, pages, crawlers, competitors, experiments, metrics, objectives,
+  interventions, optional connection state, reviewers, review policies, and
+  governed exceptions, all schema-validated
 (`schemas/*.schema.json`) with referential integrity checks. Rules:
 
 - Never overwrite registry content without history — use the loader/saver in
@@ -175,6 +178,9 @@ interventions, and optional connection state, all schema-validated
   competitors, pricing). Mark entities `incomplete` and list `required_input`.
 - Claim status transitions toward `verified` require existing verified evidence
   plus human semantic review; automation only downgrades (fail-closed).
+- Never encode an accepted exception as a passed or resolved finding. Validate
+  reviewer authority and separation of duties, bind approval to exact source
+  finding/policy/evidence hashes, and report enforcement disposition separately.
 
 ## Fail-closed behaviour
 

package/dist/universal/.agents/skills/citable/VERSION

@@ -1 +1 @@
-1.7.0
+1.8.0

package/dist/universal/.agents/skills/citable/commands/README.md

@@ -27,6 +27,7 @@ intent, not executability, so statuses are strict:
 | /citable metrics import | implemented — validates declared CSV/JSON metrics and writes immutable observations |
 | /citable objectives init / validate | implemented — user-owned metric selection, cohorts, windows, and guardrails |
 | /citable evaluate | implemented — independent baseline/evaluation comparisons with inconclusive handling |
+| /citable governance validate / evaluate | implemented — validates reviewer and exception authority and emits immutable dispositions without changing failed findings |
 | /citable ingest, map-site, map-queries, map-prompts, map-entities, map-evidence | specified (ingest.md) |
 | /citable optimize-page | specified (optimize-page.md) — requires source-to-render mapping, claim-preserving rewrites, build execution, rollback; none of that is proven yet |
 | /citable create-page, answer-block, architect, interlink, consolidate, metadata | specified (page-work.md) |

package/dist/universal/.agents/skills/citable/commands/governance.md

@@ -0,0 +1,17 @@
+# Governance validation and exception evaluation
+
+Use `citable governance validate` before relying on any accepted exception. It
+validates reviewer roles and scopes, conflicts, policy requirements, separation
+of duties, source bindings, expiry, renewal, and referential integrity.
+
+Use `citable governance evaluate <run-id>` to create a new immutable evidence
+package. The command never edits the source run. Every source finding retains
+`technical_state: failed`; a valid exception is represented only as
+`enforcement_disposition: accepted_exception` with active validity and
+documented residual risk.
+
+Refuse authorization when policy, finding, or evidence hashes have changed;
+the exception is expired, revoked, superseded, conflicted, unauthorized, or
+over-renewed; required roles are absent; or more than one active exception
+matches a finding. Reviewer records are declarations and do not independently
+prove real-world identity, competence, independence, or legal authority.

package/dist/universal/.agents/skills/citable/manifest.json

@@ -1,25 +1,26 @@
 {
   "name": "citable",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "managedBy": "citable-cli",
   "provider": "codex",
   "providerName": "OpenAI Codex",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.7.0",
+  "sourcePackage": "@nebulacomponents/citable@1.8.0",
   "variantPath": ".agents/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
+    "commands/governance.md": "sha256:1fd6272f18b00237fc6e602ac126ae812747937b2bb575068a0d617137eea2b0",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
     "commands/measurement.md": "sha256:9cade6dfec23338e18aa67ede3335ac9e2888dc577a7d4d8e3ceac948bce403f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:be1f55b439af94670d0711dcd7476eab09a2d7c86c4bcbf85b2ee0b454fb8684",
+    "commands/README.md": "sha256:24b06bc5b99b0a3b033e8e463ca18d275dfeb44a4cd3f921be53acdcf3dcae03",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
-    "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
+    "references/capability-boundaries.md": "sha256:5d59f15cf97529fec26a105095278dc7a17ae3b829103994ec5ddf420897f448",
     "references/evidence-authority.md": "sha256:b81ee09953999f16b19dc0eaba6fffe794b58d152e2adbd95c3179730bc08ffc",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
@@ -47,6 +48,7 @@
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
     "schemas/evidence-authority.schema.json": "sha256:4f8165a37304ebab019e1c2dfec13f1168ecf89ce9bec88f7dca9c8554e39ac0",
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
+    "schemas/exception.schema.json": "sha256:c88985494ec66554330fdc5b65d033527d0005acf41f10798b1e831d171f8944",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
     "schemas/intervention.schema.json": "sha256:fcf28e117b207e64ffc96088aa70a95370841a2a9fa43ecb1c82b34c2058a818",
@@ -59,11 +61,13 @@
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
+    "schemas/review-policy.schema.json": "sha256:b2d176b1886f78c384b25532a0c3eb18548dfbd17f362a305e622bab562a1d04",
+    "schemas/reviewer.schema.json": "sha256:3716697b752575a1277f2c2b318b1f2565de02bf9dce2a0c165567ab5330d18b",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:06849d7894538c05b8539d595f8ee8370999db397f7ed552a272f1e0846d3f2a",
+    "SKILL.md": "sha256:4010ad7634cdacfe60b0e88781c7f4392b5d6a7f36a734a71991081d8980b810",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:bb7320d831e7a151aa901c35e7326c752fa2ef5024f30768c42319b8bed171ed"
+    "VERSION": "sha256:3eb1ef94b5890ca727158b106142685c8733b0ace5bcb4cf3f0ac14f9f0643f4"
   },
-  "treeHash": "sha256:62432b83fd45f3a8fddc60f5b1f273eebb8d6225ef10e1476ed32185edb760b9"
+  "treeHash": "sha256:47dacf476fb7190fa3efc6da92c0119a67c702d8506e4a5ad3524c134ab0783d"
 }

package/dist/universal/.agents/skills/citable/references/capability-boundaries.md

@@ -13,12 +13,17 @@ Use the narrowest supported state. Never promote evidence across rows.
 | Cited | Import or disclosed adapter | Complete `observe citations` answer with citation URL and product/adapter mode |
 | Materially supports answer | Human review required | `citation_review` maps answer claim to source passage and names the reviewer |
 | Recommended | Operator supplied + review | Explicit recommendation, constraints, provider/mode/locale/time |
+| Accepted exception | Governed owner record | Active policy, authorized reviewers, separation-of-duty checks, exact finding/policy/evidence hashes, expiry, controls, and documented residual risk |
 
 URL audit mode alone does not prove crawler identity, WAF allowlisting,
 production-log access, index presence, selected canonical, rendered DOM parity,
 or provider citation behavior. Observation collectors can supply narrower
 evidence for these states; unavailable inputs remain `not_evidenced`.
 
+An accepted exception changes enforcement disposition only. It does not change
+the source finding, prove remediation, or establish that reviewer identity,
+competence, independence, or legal authority was externally authenticated.
+
 Primary-source lineage for these boundaries:
 
 - Perplexity documents separate `PerplexityBot` and `Perplexity-User` purposes,

package/dist/universal/.agents/skills/citable/schemas/exception.schema.json

@@ -0,0 +1,70 @@
+{
+  "$id": "citable://schemas/exception.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Governed exception registry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "kind", "updated", "entries"],
+  "properties": {
+    "version": { "const": 1 },
+    "kind": { "const": "exceptions" },
+    "updated": { "type": "string", "format": "date-time" },
+    "entries": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["exception_id", "policy_id", "policy_hash", "status", "source_run_id", "finding_ids", "finding_hashes", "reason", "risk_statement", "residual_risk", "compensating_controls", "evidence_ids", "evidence_hashes", "owner_reviewer_id", "reviewer_assignments", "reviewer_independence", "created_at", "expires_at", "renewal_count", "renewal_limit", "invalidation_conditions", "audit_history"],
+        "properties": {
+          "exception_id": { "type": "string", "pattern": "^EXCEPTION-[A-Z0-9][A-Z0-9_-]*$" },
+          "policy_id": { "type": "string", "pattern": "^POLICY-" },
+          "policy_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "status": { "type": "string", "enum": ["proposed", "approved", "revoked", "superseded"] },
+          "source_run_id": { "type": "string", "minLength": 1 },
+          "finding_ids": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+          "finding_hashes": { "type": "object", "minProperties": 1, "additionalProperties": { "type": "string", "pattern": "^[a-f0-9]{64}$" } },
+          "reason": { "type": "string", "minLength": 1 },
+          "risk_statement": { "type": "string", "minLength": 1 },
+          "residual_risk": { "type": "string", "enum": ["documented", "not_documented"] },
+          "compensating_controls": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+          "evidence_ids": { "type": "array", "items": { "type": "string" } },
+          "evidence_hashes": { "type": "object", "additionalProperties": { "type": "string", "pattern": "^[a-f0-9]{64}$" } },
+          "owner_reviewer_id": { "type": "string", "pattern": "^REVIEWER-" },
+          "reviewer_assignments": {
+            "type": "array", "minItems": 1,
+            "items": {
+              "type": "object", "additionalProperties": false, "required": ["reviewer_id", "role"],
+              "properties": {
+                "reviewer_id": { "type": "string", "pattern": "^REVIEWER-" },
+                "role": { "type": "string", "enum": ["technical_reviewer", "subject_matter_reviewer", "independent_reviewer", "approver", "risk_acceptor", "remediation_implementer", "content_author"] }
+              }
+            }
+          },
+          "reviewer_independence": { "type": "string", "enum": ["established", "not_established", "conflicted"] },
+          "created_at": { "type": "string", "format": "date-time" },
+          "expires_at": { "type": "string", "format": "date-time" },
+          "renewal_count": { "type": "integer", "minimum": 0 },
+          "renewal_limit": { "type": "integer", "minimum": 0 },
+          "invalidation_conditions": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": { "type": "string", "enum": ["finding_changed", "evidence_changed", "policy_changed", "resource_changed", "intervention_changed"] }
+          },
+          "related_intervention_id": { "type": ["string", "null"] },
+          "supersedes_exception_id": { "type": ["string", "null"] },
+          "superseded_by_exception_id": { "type": ["string", "null"] },
+          "audit_history": {
+            "type": "array", "minItems": 1,
+            "items": {
+              "type": "object", "additionalProperties": false, "required": ["timestamp", "actor_reviewer_id", "action", "note"],
+              "properties": {
+                "timestamp": { "type": "string", "format": "date-time" },
+                "actor_reviewer_id": { "type": "string", "pattern": "^REVIEWER-" },
+                "action": { "type": "string", "enum": ["proposed", "approved", "renewed", "revoked", "superseded"] },
+                "note": { "type": "string", "minLength": 1 }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.agents/skills/citable/schemas/review-policy.schema.json

@@ -0,0 +1,35 @@
+{
+  "$id": "citable://schemas/review-policy.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Review policy registry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "kind", "updated", "entries"],
+  "properties": {
+    "version": { "const": 1 },
+    "kind": { "const": "review_policies" },
+    "updated": { "type": "string", "format": "date-time" },
+    "entries": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["policy_id", "name", "status", "required_roles", "separation_rules", "max_exception_days", "max_renewals"],
+        "properties": {
+          "policy_id": { "type": "string", "pattern": "^POLICY-[A-Z0-9][A-Z0-9_-]*$" },
+          "name": { "type": "string", "minLength": 1 },
+          "status": { "type": "string", "enum": ["active", "deprecated"] },
+          "required_roles": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": { "type": "string", "enum": ["technical_reviewer", "subject_matter_reviewer", "independent_reviewer", "approver", "risk_acceptor"] }
+          },
+          "separation_rules": {
+            "type": "array", "uniqueItems": true,
+            "items": { "type": "string", "enum": ["author_cannot_verify_own_claim", "implementer_cannot_solely_verify", "commercial_owner_requires_independent_benefit_review", "risk_acceptor_must_be_authorized"] }
+          },
+          "max_exception_days": { "type": "integer", "minimum": 1, "maximum": 366 },
+          "max_renewals": { "type": "integer", "minimum": 0, "maximum": 20 }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.agents/skills/citable/schemas/reviewer.schema.json

@@ -0,0 +1,32 @@
+{
+  "$id": "citable://schemas/reviewer.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Reviewer registry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "kind", "updated", "entries"],
+  "properties": {
+    "version": { "const": 1 },
+    "kind": { "const": "reviewers" },
+    "updated": { "type": "string", "format": "date-time" },
+    "entries": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["reviewer_id", "name", "status", "roles", "authorized_scopes", "conflicts"],
+        "properties": {
+          "reviewer_id": { "type": "string", "pattern": "^REVIEWER-[A-Z0-9][A-Z0-9_-]*$" },
+          "name": { "type": "string", "minLength": 1 },
+          "status": { "type": "string", "enum": ["active", "inactive"] },
+          "roles": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": { "type": "string", "enum": ["content_author", "evidence_owner", "technical_reviewer", "subject_matter_reviewer", "independent_reviewer", "approver", "risk_acceptor", "remediation_implementer"] }
+          },
+          "authorized_scopes": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+          "conflicts": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.claude/skills/citable/SKILL.md

@@ -7,7 +7,7 @@ description: >
   generative engine optimization, structured data governance, claim substantiation,
   crawler policy, entity consistency, content discoverability, or wants a site audited
   for how search and AI systems will retrieve, understand, cite, or recommend it.
-version: 1.7.0
+version: 1.8.0
 ---
 
 # Citable — evidence and change control for search and AI citation readiness
@@ -108,6 +108,8 @@ citable connect disconnect --connection-id <id> [--write]
 citable objectives init --input <json|yaml> [--write]
 citable objectives validate
 citable evaluate [objective-id] [--ref-date YYYY-MM-DD]
+citable governance validate [--ref-date YYYY-MM-DD]
+citable governance evaluate <run-id> [--ref-date YYYY-MM-DD]
 ```
 
 Audit scopes: `technical seo aeo geo architecture entity claims evidence schema
@@ -165,8 +167,9 @@ mandatory.
 ## Registries are the source of truth
 
 `.citable/` holds YAML registries for queries, prompts, entities, claims,
-evidence, pages, crawlers, competitors, experiments, metrics, objectives,
-interventions, and optional connection state, all schema-validated
+  evidence, pages, crawlers, competitors, experiments, metrics, objectives,
+  interventions, optional connection state, reviewers, review policies, and
+  governed exceptions, all schema-validated
 (`schemas/*.schema.json`) with referential integrity checks. Rules:
 
 - Never overwrite registry content without history — use the loader/saver in
@@ -175,6 +178,9 @@ interventions, and optional connection state, all schema-validated
   competitors, pricing). Mark entities `incomplete` and list `required_input`.
 - Claim status transitions toward `verified` require existing verified evidence
   plus human semantic review; automation only downgrades (fail-closed).
+- Never encode an accepted exception as a passed or resolved finding. Validate
+  reviewer authority and separation of duties, bind approval to exact source
+  finding/policy/evidence hashes, and report enforcement disposition separately.
 
 ## Fail-closed behaviour
 

package/dist/universal/.claude/skills/citable/VERSION

@@ -1 +1 @@
-1.7.0
+1.8.0

package/dist/universal/.claude/skills/citable/commands/README.md

@@ -27,6 +27,7 @@ intent, not executability, so statuses are strict:
 | /citable metrics import | implemented — validates declared CSV/JSON metrics and writes immutable observations |
 | /citable objectives init / validate | implemented — user-owned metric selection, cohorts, windows, and guardrails |
 | /citable evaluate | implemented — independent baseline/evaluation comparisons with inconclusive handling |
+| /citable governance validate / evaluate | implemented — validates reviewer and exception authority and emits immutable dispositions without changing failed findings |
 | /citable ingest, map-site, map-queries, map-prompts, map-entities, map-evidence | specified (ingest.md) |
 | /citable optimize-page | specified (optimize-page.md) — requires source-to-render mapping, claim-preserving rewrites, build execution, rollback; none of that is proven yet |
 | /citable create-page, answer-block, architect, interlink, consolidate, metadata | specified (page-work.md) |

package/dist/universal/.claude/skills/citable/commands/governance.md

@@ -0,0 +1,17 @@
+# Governance validation and exception evaluation
+
+Use `citable governance validate` before relying on any accepted exception. It
+validates reviewer roles and scopes, conflicts, policy requirements, separation
+of duties, source bindings, expiry, renewal, and referential integrity.
+
+Use `citable governance evaluate <run-id>` to create a new immutable evidence
+package. The command never edits the source run. Every source finding retains
+`technical_state: failed`; a valid exception is represented only as
+`enforcement_disposition: accepted_exception` with active validity and
+documented residual risk.
+
+Refuse authorization when policy, finding, or evidence hashes have changed;
+the exception is expired, revoked, superseded, conflicted, unauthorized, or
+over-renewed; required roles are absent; or more than one active exception
+matches a finding. Reviewer records are declarations and do not independently
+prove real-world identity, competence, independence, or legal authority.

package/dist/universal/.claude/skills/citable/manifest.json

@@ -1,25 +1,26 @@
 {
   "name": "citable",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "managedBy": "citable-cli",
   "provider": "claude",
   "providerName": "Claude Code",
   "scope": "bundle",
-  "sourcePackage": "@nebulacomponents/citable@1.7.0",
+  "sourcePackage": "@nebulacomponents/citable@1.8.0",
   "variantPath": ".claude/skills/citable",
   "files": {
     "commands/action-findings.md": "sha256:510361461f24fcd4a550e0a8d960c383aefe23f9a65a54a3ffc44abd4c1293e7",
+    "commands/governance.md": "sha256:1fd6272f18b00237fc6e602ac126ae812747937b2bb575068a0d617137eea2b0",
     "commands/ingest.md": "sha256:cf35659aecd9d0e160909003efdbe056864fc5d824c71b4ef0ee801ce07ff598",
     "commands/measurement.md": "sha256:9cade6dfec23338e18aa67ede3335ac9e2888dc577a7d4d8e3ceac948bce403f",
     "commands/observe-and-act.md": "sha256:02a93bbbfddc3d8e11cb921ddccd19b0666133c4bdb4f4a280bcb131bed37e8c",
     "commands/optimize-page.md": "sha256:35866f3d7cdeef0376ea7a7d7036085a9b9cf95bbb300ecf4bd77610ebd74d85",
     "commands/page-work.md": "sha256:965a66e59bdf7b0da482d26fade53b3d265885ece5d463fe83b0789ebefaef3e",
-    "commands/README.md": "sha256:be1f55b439af94670d0711dcd7476eab09a2d7c86c4bcbf85b2ee0b454fb8684",
+    "commands/README.md": "sha256:24b06bc5b99b0a3b033e8e463ca18d275dfeb44a4cd3f921be53acdcf3dcae03",
     "commands/validate-render.md": "sha256:a8e1d04d40b84d57c35039250d98c6a7302cd44a148a8c3b9d9cfb92678c4347",
     "policies/crawler-policy-template.md": "sha256:15c88a4eeb21f53f71e5250dd3eb2d2791a814b304eaefce8bb30e2bdf2e2e59",
     "references/aeo-geo-validation.md": "sha256:e45828d3ccca54a08513cb4235578c8a8ecf1dc47d1cb98e4a497838103bef70",
     "references/anti-patterns.md": "sha256:de63f8e646af0fbf479b45eb1d050ae62a8637acc320d21b87e4a083fd4c47e7",
-    "references/capability-boundaries.md": "sha256:0d66909025541c1b4b7f5532750fdbfaed9116fb7fc156a67f290024342e30e4",
+    "references/capability-boundaries.md": "sha256:5d59f15cf97529fec26a105095278dc7a17ae3b829103994ec5ddf420897f448",
     "references/evidence-authority.md": "sha256:b81ee09953999f16b19dc0eaba6fffe794b58d152e2adbd95c3179730bc08ffc",
     "rubrics/answer-extractability.md": "sha256:c8e741143c34e53afdb3dc7b6976ce7b4485dce13b12d14c193fccb17bacf1da",
     "rubrics/claim-boundedness.md": "sha256:0bab1b85248c252b966175912ebfae13bf18aa7e41573f7466831ac78b5d3e27",
@@ -47,6 +48,7 @@
     "schemas/entity.schema.json": "sha256:78a08c35c8f4eb7a804ab46b61a238502f59621ac5218991e783251fbde61c4f",
     "schemas/evidence-authority.schema.json": "sha256:4f8165a37304ebab019e1c2dfec13f1168ecf89ce9bec88f7dca9c8554e39ac0",
     "schemas/evidence.schema.json": "sha256:76baec7ad7e89c6952473c01dacb9e3b26953c088331e6314d531ce620df9ec1",
+    "schemas/exception.schema.json": "sha256:c88985494ec66554330fdc5b65d033527d0005acf41f10798b1e831d171f8944",
     "schemas/experiment.schema.json": "sha256:3cebebc5745a9eb359261408b0a0421b8370d2c94f8244ce939827cd9da41cb6",
     "schemas/finding.schema.json": "sha256:85907cd04cd8d2fe24a1e618e0df7160f6d56aa1818db501f345aebce5eb5edb",
     "schemas/intervention.schema.json": "sha256:fcf28e117b207e64ffc96088aa70a95370841a2a9fa43ecb1c82b34c2058a818",
@@ -59,11 +61,13 @@
     "schemas/prompt.schema.json": "sha256:7f0f50c83a86ac91faa7b79895dbc1fed371e8c0342e18d8c2877cc81f4f0f4c",
     "schemas/query.schema.json": "sha256:3c0793a8c0c48ab39320416790840b345ea987696f35b1cc364f23245a62aacb",
     "schemas/remediation-spec.schema.json": "sha256:6fe8cb773702862ba6d261198bb5cc2dca3eca0a2310a60ebddd04377654df8d",
+    "schemas/review-policy.schema.json": "sha256:b2d176b1886f78c384b25532a0c3eb18548dfbd17f362a305e622bab562a1d04",
+    "schemas/reviewer.schema.json": "sha256:3716697b752575a1277f2c2b318b1f2565de02bf9dce2a0c165567ab5330d18b",
     "schemas/run.schema.json": "sha256:46c3178620f3a358d936d535aeadb83454b9b35b551e53e6615cc9862063dacb",
     "scripts/README.md": "sha256:1c3e952950ef353849621b07c5f615bf7cd20cc5654da4635492a7bd6384e747",
-    "SKILL.md": "sha256:06849d7894538c05b8539d595f8ee8370999db397f7ed552a272f1e0846d3f2a",
+    "SKILL.md": "sha256:4010ad7634cdacfe60b0e88781c7f4392b5d6a7f36a734a71991081d8980b810",
     "templates/finding-review.md": "sha256:b270a83d3f015150aac80249ae9314979c0befea39ff92ec455f9a5aaa73404c",
-    "VERSION": "sha256:bb7320d831e7a151aa901c35e7326c752fa2ef5024f30768c42319b8bed171ed"
+    "VERSION": "sha256:3eb1ef94b5890ca727158b106142685c8733b0ace5bcb4cf3f0ac14f9f0643f4"
   },
-  "treeHash": "sha256:62432b83fd45f3a8fddc60f5b1f273eebb8d6225ef10e1476ed32185edb760b9"
+  "treeHash": "sha256:47dacf476fb7190fa3efc6da92c0119a67c702d8506e4a5ad3524c134ab0783d"
 }

package/dist/universal/.claude/skills/citable/references/capability-boundaries.md

@@ -13,12 +13,17 @@ Use the narrowest supported state. Never promote evidence across rows.
 | Cited | Import or disclosed adapter | Complete `observe citations` answer with citation URL and product/adapter mode |
 | Materially supports answer | Human review required | `citation_review` maps answer claim to source passage and names the reviewer |
 | Recommended | Operator supplied + review | Explicit recommendation, constraints, provider/mode/locale/time |
+| Accepted exception | Governed owner record | Active policy, authorized reviewers, separation-of-duty checks, exact finding/policy/evidence hashes, expiry, controls, and documented residual risk |
 
 URL audit mode alone does not prove crawler identity, WAF allowlisting,
 production-log access, index presence, selected canonical, rendered DOM parity,
 or provider citation behavior. Observation collectors can supply narrower
 evidence for these states; unavailable inputs remain `not_evidenced`.
 
+An accepted exception changes enforcement disposition only. It does not change
+the source finding, prove remediation, or establish that reviewer identity,
+competence, independence, or legal authority was externally authenticated.
+
 Primary-source lineage for these boundaries:
 
 - Perplexity documents separate `PerplexityBot` and `Perplexity-User` purposes,

package/dist/universal/.claude/skills/citable/schemas/exception.schema.json

@@ -0,0 +1,70 @@
+{
+  "$id": "citable://schemas/exception.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Governed exception registry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "kind", "updated", "entries"],
+  "properties": {
+    "version": { "const": 1 },
+    "kind": { "const": "exceptions" },
+    "updated": { "type": "string", "format": "date-time" },
+    "entries": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["exception_id", "policy_id", "policy_hash", "status", "source_run_id", "finding_ids", "finding_hashes", "reason", "risk_statement", "residual_risk", "compensating_controls", "evidence_ids", "evidence_hashes", "owner_reviewer_id", "reviewer_assignments", "reviewer_independence", "created_at", "expires_at", "renewal_count", "renewal_limit", "invalidation_conditions", "audit_history"],
+        "properties": {
+          "exception_id": { "type": "string", "pattern": "^EXCEPTION-[A-Z0-9][A-Z0-9_-]*$" },
+          "policy_id": { "type": "string", "pattern": "^POLICY-" },
+          "policy_hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "status": { "type": "string", "enum": ["proposed", "approved", "revoked", "superseded"] },
+          "source_run_id": { "type": "string", "minLength": 1 },
+          "finding_ids": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+          "finding_hashes": { "type": "object", "minProperties": 1, "additionalProperties": { "type": "string", "pattern": "^[a-f0-9]{64}$" } },
+          "reason": { "type": "string", "minLength": 1 },
+          "risk_statement": { "type": "string", "minLength": 1 },
+          "residual_risk": { "type": "string", "enum": ["documented", "not_documented"] },
+          "compensating_controls": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+          "evidence_ids": { "type": "array", "items": { "type": "string" } },
+          "evidence_hashes": { "type": "object", "additionalProperties": { "type": "string", "pattern": "^[a-f0-9]{64}$" } },
+          "owner_reviewer_id": { "type": "string", "pattern": "^REVIEWER-" },
+          "reviewer_assignments": {
+            "type": "array", "minItems": 1,
+            "items": {
+              "type": "object", "additionalProperties": false, "required": ["reviewer_id", "role"],
+              "properties": {
+                "reviewer_id": { "type": "string", "pattern": "^REVIEWER-" },
+                "role": { "type": "string", "enum": ["technical_reviewer", "subject_matter_reviewer", "independent_reviewer", "approver", "risk_acceptor", "remediation_implementer", "content_author"] }
+              }
+            }
+          },
+          "reviewer_independence": { "type": "string", "enum": ["established", "not_established", "conflicted"] },
+          "created_at": { "type": "string", "format": "date-time" },
+          "expires_at": { "type": "string", "format": "date-time" },
+          "renewal_count": { "type": "integer", "minimum": 0 },
+          "renewal_limit": { "type": "integer", "minimum": 0 },
+          "invalidation_conditions": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": { "type": "string", "enum": ["finding_changed", "evidence_changed", "policy_changed", "resource_changed", "intervention_changed"] }
+          },
+          "related_intervention_id": { "type": ["string", "null"] },
+          "supersedes_exception_id": { "type": ["string", "null"] },
+          "superseded_by_exception_id": { "type": ["string", "null"] },
+          "audit_history": {
+            "type": "array", "minItems": 1,
+            "items": {
+              "type": "object", "additionalProperties": false, "required": ["timestamp", "actor_reviewer_id", "action", "note"],
+              "properties": {
+                "timestamp": { "type": "string", "format": "date-time" },
+                "actor_reviewer_id": { "type": "string", "pattern": "^REVIEWER-" },
+                "action": { "type": "string", "enum": ["proposed", "approved", "renewed", "revoked", "superseded"] },
+                "note": { "type": "string", "minLength": 1 }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/universal/.claude/skills/citable/schemas/review-policy.schema.json

@@ -0,0 +1,35 @@
+{
+  "$id": "citable://schemas/review-policy.schema.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Review policy registry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "kind", "updated", "entries"],
+  "properties": {
+    "version": { "const": 1 },
+    "kind": { "const": "review_policies" },
+    "updated": { "type": "string", "format": "date-time" },
+    "entries": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["policy_id", "name", "status", "required_roles", "separation_rules", "max_exception_days", "max_renewals"],
+        "properties": {
+          "policy_id": { "type": "string", "pattern": "^POLICY-[A-Z0-9][A-Z0-9_-]*$" },
+          "name": { "type": "string", "minLength": 1 },
+          "status": { "type": "string", "enum": ["active", "deprecated"] },
+          "required_roles": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": { "type": "string", "enum": ["technical_reviewer", "subject_matter_reviewer", "independent_reviewer", "approver", "risk_acceptor"] }
+          },
+          "separation_rules": {
+            "type": "array", "uniqueItems": true,
+            "items": { "type": "string", "enum": ["author_cannot_verify_own_claim", "implementer_cannot_solely_verify", "commercial_owner_requires_independent_benefit_review", "risk_acceptor_must_be_authorized"] }
+          },
+          "max_exception_days": { "type": "integer", "minimum": 1, "maximum": 366 },
+          "max_renewals": { "type": "integer", "minimum": 0, "maximum": 20 }
+        }
+      }
+    }
+  }
+}