dsh-research-report 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -5,6 +5,44 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-08-23
+
+### Added
+
+- Pre-delivery re-audit with verdict drift detection: `assemble` re-runs the byte-level (and optional numeric-bridge) verification for every bound claim offline before sealing, journals each re-audit to `verification.jsonl` (claim hash + evidence object hashes + timestamp + verdict + prior/drift flags, deterministically serialized), and downgrades a claim whose stored verdict was `verified` but whose re-audit no longer confirms to `contradicted` (counted in the report summary and the tool result). The journal is sealed with the report and registered in the manifest as an optional `verification` field, so the seal hash covers it.
+- Explicit `insufficient` verdict state in the claim/verdict layer (evidence is bound but insufficient to confirm or falsify — a citation not locatable with no contradiction signal); rendered with the `[证据不足]` body marker and the `🔍 insufficient` Appendix A row. The frozen `CitationCheckRequest`/`CitationCheckResult` block and the frozen three-state `AssembleReportResult` surface are unchanged; `insufficient` folds to `unverified` only at the frozen cross-plugin projection.
+- `disconfirmation.jsonl` falsification ledger in the sealed directory: every contradicted claim with its evidence references and contradiction note, deterministically serialized, re-hashable, registered in the manifest as an optional `disconfirmation` field, and rendered as the `Appendix D: Disconfirmation log (证伪记录)` section.
+- Pre-seal interception (no tunable): before writing `report.md`/`manifest.json`, the pre-delivery re-audit's hard signals — verdict drift, tampered/missing bound evidence, or an audit-journal serialization failure — block the seal and fail loud (`SealBlockedError`) with the concrete reasons listed.
+- `disproven` verdict state: the byte-level check now marks a label-anchored value mismatch as `disproven` (evidence content explicitly falsifies the claim), and the numeric-bridge mismatch maps to `disproven` too, while `contradicted` is reserved for tampered/missing evidence. Rendered with the `[已证伪]` body marker and the `🚫 disproven` Appendix A/D row.
+- Negative-knowledge ledger (`disproofs.jsonl`, keyed by claim content hash): a disproven claim is remembered; the same text re-reported against unchanged evidence is forced back to `disproven` (blocking a re-report as `verified`), and only re-verifies once the bound evidence changes. `disconfirmation.jsonl` now records both `contradicted` and `disproven` entries.
+- Deterministic DOI validation (zero network) for `evidence_add`: `10.xxxx/xxxx` structure, a recognized-prefix whitelist, and a DOI character-set constraint; invalid DOIs fail loud (`INVALID_DOI`) and DOI evidence requires inline content (never fetched).
+- `requireJournalMetadata` config (default `false`): when enabled, DOI-typed evidence missing a journal name or publication year fails loud (`MISSING_JOURNAL_METADATA`); non-DOI evidence is never gated.
+- Read-only verifier loop: after sealing, a deterministic `verifySealedReport` fallback (zero network, zero model) recomputes the seal hash, the report hash, and the audit-journal hashes, re-runs the byte-level + integrity check for every claim, and confirms the gap/disproof sections; its machine-check section is written to `verifier-note.md`. When `ctx.jobs` is mounted a read-only `research-report-verify` job is also spawned (the model review is an enhancement); without jobs it is skipped gracefully (`verifier: skipped (jobs unavailable)`).
+- `sessionRef` evidence anchor: `evidence_add` accepts an optional `sessionId` + `eventRange` anchor (validated loud), stored in the ledger, rendered in Appendix B, and registered in the manifest and `verification.jsonl`. Session-anchored evidence verifies honestly as `unverified` with the note `会话锚定证据需人工回查会话日志` (no fabricated verifiability).
+
+### Changed
+
+- `VerdictStatus` is now five states (`verified`/`unverified`/`insufficient`/`contradicted`/`disproven`); `projectFrozenVerdict` keeps the frozen three-state `AssembleReportResult` surface unchanged (`insufficient` → `unverified`, `disproven` → `contradicted`).
+
+### Deviations
+
+Explicitly not implemented (and why):
+
+- **(a) Online three-source cross-validation (Crossref / Semantic Scholar / OpenAlex)** — this repository performs no direct network access; a lookup would ride `ctx.web` and therefore depend on the host's web providers. The offline deterministic re-audit already covers the anti-fabrication mainline, so the online cross-check was deliberately left out.
+- **(b) Interactive evidence-ledger Slot UI** — a visual ledger panel needs a new client-side surface and packaging changes; it is out of scope for this batch.
+- **(c) Zotero literature-library integration** — depends on an external application protocol.
+- **(d) Lean 4 / formal-verification channel** — a heavy, domain-specific asset outside this plugin's scope.
+
+## [0.1.4] - 2026-08-23
+
+### Added
+
+- Close the §2.32 "confirm or add" checklist items with executable assertions (no functional change): a tool triple-interface suite (U2 — parameter schema + canonical output schema + content-block render for `evidence_add` / `research_report` / `ledger_query`), a Loader-level `maxEvidencePerReport` out-of-range negative (U4), a dispose test proving the service and all three tools unregister on unmount (C1), a `FETCH_TIMEOUT` path test over the real `ctx.web` seam (U5/U6), and a frozen `CitationCheckRequest` boundary assertion in the `dsh-data-quality` bridge suite (cross-plugin bridge).
+
+### Changed
+
+- Confirm the frozen `CitationCheckRequest` / `CitationCheckResult` block is byte-identical to the real `dsh-data-quality` Service Definition (already gated byte-for-byte by `scripts/verify-frozen-contract.mjs`).
+
 ## [0.1.3] - 2026-08-22
 
 ### Changed

package/README.es.md

@@ -31,10 +31,16 @@
 
 - **Libro de evidencia (evidence ledger)** — almacén de instantáneas direccionado por contenido (`<ledgerRoot>/objects/<sha256>` + diarios JSONL). El mismo contenido se guarda una sola vez; las instantáneas son inmutables; cada lectura recomputa el hash, de modo que la manipulación o el borrado se detectan en lugar de confiarse.
 - **Vínculo claim ↔ evidencia** — los claims se registran con los ids de evidencia en que se apoyan; el libro conserva el vínculo y cada veredicto de verificación (gana el más reciente).
-- **Verificación a nivel de byte** — cada número y cada fragmento entrecomillado de un claim debe poder localizarse literalmente en las instantáneas vinculadas. Las citas ausentes marcan el claim como `unverified`; una etiqueta cuyo valor difiere en la instantánea (y el valor citado está ausente) lo marca `contradicted`. Sin semántica, sin embeddings — solo comprobaciones de bytes auditables.
-- **Puente numérico opcional** — cuando un claim cita un dataset estructurado del workspace (CSV/JSON) y `dsh-data-quality` está montado, las citas se verifican con tolerancias mediante su contrato congelado `verifyCitations`.
-- **Informes sellados versionados** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json`; el hash de sellado es el SHA-256 del manifiesto, que a su vez lleva el hash del informe y los hashes de toda la evidencia.
-- **Brechas honestas** — los claims no verificados o contradichos conservan una marca visible `[未核实]` / `[与证据矛盾]` en el cuerpo del informe y se listan en el Apéndice A. Nada se aprueba en silencio.
+- **Verificación a nivel de byte** — cada número y cada fragmento entrecomillado de un claim debe poder localizarse literalmente en las instantáneas vinculadas. Sin evidencia vinculada, o sin literal comprobable, el claim se marca `unverified`; evidencia vinculada que no puede confirmar ni desmentir los literales citados lo marca `insufficient`; una etiqueta cuyo valor difiere en la instantánea (y el valor citado está ausente) lo marca `disproven`; instantáneas manipuladas o ausentes lo marcan `contradicted`. Sin semántica, sin embeddings — solo comprobaciones de bytes auditables.
+- **Puente numérico opcional** — cuando un claim cita un dataset estructurado del workspace (CSV/JSON) y `dsh-data-quality` está montado, las citas se verifican con tolerancias mediante su contrato congelado `verifyCitations`; una discrepancia del dataset desmiente (disproves) el claim.
+- **Evidencia DOI (sin red)** — los orígenes DOI se validan determinísticamente (estructura `10.xxxx/xxxx`, lista blanca de prefijos y juego de caracteres DOI); los DOI inválidos fallan ruidosamente. Se acepta metadato opcional de revista/año, y `requireJournalMetadata` solo restringe la evidencia DOI académica cuando está habilitado.
+- **Informes sellados versionados** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json` + `verification.jsonl` + `disconfirmation.jsonl`; el hash de sellado es el SHA-256 del manifiesto, que a su vez lleva el hash del informe, los hashes de toda la evidencia y el hash de cada diario de auditoría.
+- **Reauditoría previa a la entrega e interceptación del sellado** — antes de sellar, cada claim vinculado se re-verifica sin conexión y se registra en `verification.jsonl`; el drift de veredicto, la evidencia vinculada manipulada/ausente, o un fallo de serialización del diario bloquean el sellado (falla ruidosamente, sin tunable).
+- **Libro de falsificación** — cada claim contradicho o desmentido se registra en `disconfirmation.jsonl` (claim + referencias de evidencia + motivo) y se lista en el apéndice `证伪记录` del informe.
+- **Conocimiento negativo** — un claim desmentido se recuerda por su hash de contenido (`disproofs.jsonl`); el mismo texto re-reportado contra evidencia sin cambios se fuerza de nuevo a `disproven` y solo se re-verifica cuando la evidencia cambia.
+- **Bucle de verificación de solo lectura** — tras sellar, el respaldo determinista `verifySealedReport` (sin red, sin modelo) recomputa el sello y los hashes de auditoría y re-comprueba cada claim, escribiendo la sección de comprobación de máquina en `verifier-note.md`; con `ctx.jobs` montado también se lanza un trabajo de verificación de solo lectura (la revisión del modelo es una mejora, nunca un reemplazo).
+- **Evidencia anclada a sesión** — `evidence_add` acepta un `sessionRef` opcional (`sessionId` + `eventRange`, validado ruidosamente); el ancla se guarda y se registra en el Apéndice B, el manifiesto y `verification.jsonl`. La evidencia anclada a sesión se verifica honestamente como `unverified` (`会话锚定证据需人工回查会话日志`).
+- **Brechas honestas** — los claims no verificados, insuficientes, contradichos o desmentidos conservan una marca visible `[未核实]` / `[证据不足]` / `[与证据矛盾]` / `[已证伪]` en el cuerpo del informe y se listan en el Apéndice A. Nada se aprueba en silencio.
 - **Sin bucle de deep-research** — la orquestación de recuperación se reutiliza deliberadamente: `ctx.web` para buscar/descargar, `ctx.jobs` para trabajos largos. La planificación y la síntesis quedan en el modelo (o en un plugin upstream).
 
 ## Quick start
@@ -84,6 +90,7 @@ Todos los ajustes son campos `Config` de Schemastery; los valores inválidos fal
 | `maxEvidenceBytes` | `2097152` | Tope duro de bytes UTF-8 por instantánea de evidencia. |
 | `maxEvidencePerReport` | `200` | Tope duro de evidencias vinculadas a un informe. |
 | `fetchTimeoutMs` | `20000` | Plazo (ms) de cada `ctx.web` fetch durante la captura. |
+| `requireJournalMetadata` | `false` | Cuando es `true`, la evidencia de tipo DOI debe traer nombre de revista y año de publicación al registrarse (falla ruidosamente en caso contrario). |
 
 ## Tools & surfaces
 
@@ -134,7 +141,7 @@ pnpm pack
 
 ## Contributors
 
-Contribuidores de `dsh-research-report`.
+- [PerryLink](https://github.com/PerryLink) — autor original y mantenedor: arquitectura del plugin, ledger de evidencias, verificación a nivel de byte, informes sellados, documentación en cinco idiomas y automatización de CI/publicación.
 
 ## PerryLink DSH Plugin Family
 

package/README.hi.md

@@ -31,10 +31,16 @@
 
 - **साक्ष्य बही-खाता (evidence ledger)** — कंटेंट-एड्रेस्ड स्नैपशॉट स्टोर (`<ledgerRoot>/objects/<sha256>` + JSONL जर्नल)। एक ही कंटेंट ठीक एक बार सहेजा जाता है; स्नैपशॉट अपरिवर्तनीय हैं; हर रीड पर हैश दोबारा गिना जाता है — छेड़छाड़ या विलोपन "भरोसा" नहीं, "पकड़ा" जाता है।
 - **claim ↔ साक्ष्य बाइंडिंग** — claim अपने आधार-साक्ष्यों की id के साथ पंजीकृत होते हैं; बही-खाता बाइंडिंग और हर सत्यापन निर्णय सहेजता है (नवीनतम मान्य)।
-- **बाइट-स्तरीय जाँच** — claim के हर अंक और हर उद्धृत खंड को बंधे स्नैपशॉट में शाब्दिक रूप से मिलना चाहिए। उद्धरण न मिले तो claim `unverified`; लेबल के सामने स्नैपशॉट में दूसरा मान हो (और उद्धृत मान अनुपस्थित हो) तो `contradicted`। कोई सिमैंटिक्स नहीं, कोई एम्बेडिंग नहीं — केवल ऑडिट-योग्य बाइट जाँच।
-- **वैकल्पिक संख्या-सेतु** — जब claim किसी संरचित workspace डेटासेट (CSV/JSON) को उद्धृत करता है और `dsh-data-quality` माउंट है, तो उद्धरण उसके फ्रोज़न `verifyCitations` अनुबंध से सहिष्णुता-सहित जाँचे जाते हैं।
-- **संस्करणित सील्ड रिपोर्ट** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json`; सील हैश = manifest का SHA-256, और manifest में रिपोर्ट हैश व सभी साक्ष्य हैश होते हैं।
-- **ईमानदार खाली-जगहें** — unverified/contradicted claim रिपोर्ट के मुख्य भाग में दृश्य चिह्न `[未核实]` / `[与证据矛盾]` रखते हैं और परिशिष्ट A में सूचीबद्ध होते हैं। कुछ भी चुपचाप पारित नहीं होता।
+- **बाइट-स्तरीय जाँच** — claim के हर अंक और हर उद्धृत खंड को बंधे स्नैपशॉट में शाब्दिक रूप से मिलना चाहिए। बंधा साक्ष्य न हो, या जाँच-योग्य अक्षर न हो, तो claim `unverified`; बंधा साक्ष्य उद्धृत अक्षरों की पुष्टि या खंडन न कर सके तो `insufficient`; लेबल के सामने स्नैपशॉट में दूसरा मान हो (और उद्धृत मान अनुपस्थित हो) तो `disproven`; छेड़छाड़/लापता स्नैपशॉट हो तो `contradicted`। कोई सिमैंटिक्स नहीं, कोई एम्बेडिंग नहीं — केवल ऑडिट-योग्य बाइट जाँच।
+- **वैकल्पिक संख्या-सेतु** — जब claim किसी संरचित workspace डेटासेट (CSV/JSON) को उद्धृत करता है और `dsh-data-quality` माउंट है, तो उद्धरण उसके फ्रोज़न `verifyCitations` अनुबंध से सहिष्णुता-सहित जाँचे जाते हैं; डेटासेट विसंगति claim को मिथ्या (disprove) कर देती है।
+- **DOI साक्ष्य (शून्य नेटवर्क)** — DOI स्रोत नियतात्मक रूप से जाँचे जाते हैं (`10.xxxx/xxxx` संरचना, उपसर्ग श्वेतसूची और DOI वर्ण-समुच्चय); अमान्य DOI ठोंककर असफल होते हैं। वैकल्पिक जर्नल/वर्ष मेटाडेटा स्वीकारा जाता है, और `requireJournalMetadata` केवल सक्रिय होने पर शैक्षणिक DOI साक्ष्य को प्रतिबंधित करता है।
+- **संस्करणित सील्ड रिपोर्ट** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json` + `verification.jsonl` + `disconfirmation.jsonl`; सील हैश = manifest का SHA-256, और manifest में रिपोर्ट हैश, सभी साक्ष्य हैश व हर ऑडिट जर्नल का हैश होता है।
+- **डिलीवरी-पूर्व पुनः ऑडिट व सील अवरोध** — सील करने से पहले हर बंधा claim ऑफ़लाइन पुनः जाँचा जाता है और `verification.jsonl` में दर्ज होता है; verdict drift, छेड़छाड़/लापता बंधा साक्ष्य, या जर्नल सीरियलाइज़ेशन विफलता सील को रोक देती है (ठोंककर असफल, कोई tunable नहीं)।
+- **मिथ्याकरण बही-खाता** — हर contradicted या disproven claim `disconfirmation.jsonl` में (claim + साक्ष्य संदर्भ + कारण) दर्ज होता है और रिपोर्ट के `证伪记录` परिशिष्ट में सूचीबद्ध होता है।
+- **नकारात्मक ज्ञान** — एक disproven claim अपने कंटेंट हैश से याद रखा जाता है (`disproofs.jsonl`); अपरिवर्तित साक्ष्य के विरुद्ध पुनः रिपोर्ट किया गया वही पाठ वापस `disproven` में बलपूर्वक डाला जाता है और साक्ष्य बदलने पर ही पुनः जाँचा जाता है।
+- **रीड-ओनली verifier लूप** — सील करने के बाद नियतात्मक फॉलबैक `verifySealedReport` (शून्य नेटवर्क, शून्य मॉडल) सील व ऑडिट हैश दोबारा गिनता है और हर claim की पुनः जाँच करता है, `verifier-note.md` में मशीन-चेक भाग लिखता है; `ctx.jobs` माउंट होने पर एक रीड-ओनली verifier job भी चालू होता है (मॉडल समीक्षा वृद्धि है, प्रतिस्थापन नहीं)।
+- **सत्र-आधारित साक्ष्य** — `evidence_add` वैकल्पिक `sessionRef` (`sessionId` + `eventRange`, ठोंककर सत्यापित) स्वीकारता है; एंकर सहेजा जाता है और परिशिष्ट B, manifest व `verification.jsonl` में दर्ज होता है। सत्र-आधारित साक्ष्य ईमानदारी से `unverified` होता है (`会话锚定证据需人工回查会话日志`)।
+- **ईमानदार खाली-जगहें** — unverified/insufficient/contradicted/disproven claim रिपोर्ट के मुख्य भाग में दृश्य चिह्न `[未核实]` / `[证据不足]` / `[与证据矛盾]` / `[已证伪]` रखते हैं और परिशिष्ट A में सूचीबद्ध होते हैं। कुछ भी चुपचाप पारित नहीं होता।
 - **कोई deep-research लूप नहीं** — रिट्रीवल ऑर्केस्ट्रेशन जानबूझकर पुनः उपयोगित है: खोज/फेच `ctx.web`, लंबे कार्य `ctx.jobs`। योजना और संश्लेषण मॉडल (या अपस्ट्रीम प्लगिन) के पास रहते हैं।
 
 ## Quick start
@@ -84,6 +90,7 @@ dsh plugin --profile demo remove dsh-research-report    # अनइंस्ट
 | `maxEvidenceBytes` | `2097152` | एक साक्ष्य स्नैपशॉट की UTF-8 बाइट हार्ड सीमा। |
 | `maxEvidencePerReport` | `200` | एक रिपोर्ट में बंधने वाली साक्ष्य-वस्तुओं की हार्ड सीमा। |
 | `fetchTimeoutMs` | `20000` | कैप्चर के दौरान एक `ctx.web` fetch की समय-सीमा (ms)। |
+| `requireJournalMetadata` | `false` | `true` होने पर, DOI-प्रकार साक्ष्य को पंजीकरण पर जर्नल नाम व प्रकाशन वर्ष देना अनिवार्य है (अन्यथा ठोंककर असफल)। |
 
 ## Tools & surfaces
 
@@ -134,7 +141,7 @@ pnpm pack
 
 ## Contributors
 
-`dsh-research-report` contributors.
+- [PerryLink](https://github.com/PerryLink) — मूल लेखक और अनुरक्षक: प्लगइन आर्किटेक्चर, साक्ष्य लेजर, बाइट-स्तरीय सत्यापन, सीलबंद रिपोर्ट, पाँच-भाषा दस्तावेज़, CI और रिलीज़ स्वचालन।
 
 ## PerryLink DSH Plugin Family
 

package/README.md

@@ -32,10 +32,16 @@
 
 - **Evidence ledger** — a content-addressed snapshot store (`<ledgerRoot>/objects/<sha256>` + JSONL journals). The same content is stored exactly once; snapshots are immutable; every read recomputes the hash, so tampering or deletion is detected instead of trusted.
 - **Claim ↔ evidence binding** — claims register with the evidence ids they rely on; the ledger keeps the binding and every verification verdict (latest wins).
-- **Byte-level verification** — every number and quoted span in a claim must be locatable verbatim in the bound snapshots. Missing citations mark the claim `unverified`; a label whose snapshot value differs (the claimed value absent) marks it `contradicted`. No semantics, no embeddings — auditable byte checks.
-- **Optional numeric bridge** — when a claim cites a structured workspace dataset (CSV/JSON) and `dsh-data-quality` is mounted, citations are cross-checked with tolerances through its frozen `verifyCitations` contract.
-- **Versioned sealed reports** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json`; the seal hash is the SHA-256 of the manifest, which itself carries the report hash and every evidence hash.
-- **Honest gaps** — unverified and contradicted claims keep a visible `[未核实]` / `[与证据矛盾]` marker in the report body and are listed in Appendix A. Nothing is silently passed.
+- **Byte-level verification** — every number and quoted span in a claim must be locatable verbatim in the bound snapshots. No bound evidence, or no checkable literal, marks the claim `unverified`; bound evidence that cannot confirm or deny the claimed literals marks it `insufficient`; a label whose snapshot value differs (the claimed value absent) marks it `disproven`; tampered/missing snapshots mark it `contradicted`. No semantics, no embeddings — auditable byte checks.
+- **Optional numeric bridge** — when a claim cites a structured workspace dataset (CSV/JSON) and `dsh-data-quality` is mounted, citations are cross-checked with tolerances through its frozen `verifyCitations` contract; a dataset mismatch disproves the claim.
+- **DOI evidence (zero network)** — DOI origins are validated deterministically (`10.xxxx/xxxx` structure, a prefix whitelist, and a DOI character set); invalid DOIs fail loud. Optional journal/year metadata is accepted, and `requireJournalMetadata` gates academic DOI evidence only when enabled.
+- **Versioned sealed reports** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json` + `verification.jsonl` + `disconfirmation.jsonl`; the seal hash is the SHA-256 of the manifest, which itself carries the report hash, every evidence hash, and the hash of each audit journal.
+- **Pre-delivery re-audit & seal interception** — before sealing, every bound claim is re-verified offline and journaled to `verification.jsonl`; verdict drift, tampered/missing bound evidence, or a journal serialization failure blocks the seal (fail loud, no tunable).
+- **Falsification ledger** — every contradicted or disproven claim is recorded in `disconfirmation.jsonl` (claim + evidence references + reason) and listed in the report's `证伪记录` appendix.
+- **Negative knowledge** — a disproven claim is remembered by its content hash (`disproofs.jsonl`); the same text re-reported against unchanged evidence is forced back to `disproven` and only re-verifies once the evidence changes.
+- **Read-only verifier loop** — after sealing, a deterministic `verifySealedReport` fallback (zero network, zero model) recomputes the seal and audit hashes and re-checks every claim, writing the machine check to `verifier-note.md`; when `ctx.jobs` is mounted a read-only verifier job is also spawned (the model review is an enhancement, never a replacement).
+- **Session-anchored evidence** — `evidence_add` accepts an optional `sessionRef` (`sessionId` + `eventRange`, validated loud); the anchor is stored, rendered in Appendix B, and registered in the manifest and `verification.jsonl`. Session-anchored evidence verifies honestly as `unverified` (`会话锚定证据需人工回查会话日志`).
+- **Honest gaps** — unverified, insufficient, contradicted, and disproven claims keep a visible `[未核实]` / `[证据不足]` / `[与证据矛盾]` / `[已证伪]` marker in the report body and are listed in Appendix A. Nothing is silently passed.
 - **No deep-research loop** — retrieval orchestration is deliberately reused: `ctx.web` for search/fetch, `ctx.jobs` for long runs. Planning and synthesis stay with the model (or an upstream plugin).
 
 ## Quick start
@@ -85,6 +91,7 @@ All tunables are Schemastery `Config` fields; invalid values fail the profile lo
 | `maxEvidenceBytes` | `2097152` | Hard cap on one evidence snapshot's UTF-8 bytes. |
 | `maxEvidencePerReport` | `200` | Hard cap on evidence items bound into one report. |
 | `fetchTimeoutMs` | `20000` | Deadline (ms) for one `ctx.web` fetch during capture. |
+| `requireJournalMetadata` | `false` | When true, DOI-typed evidence must carry a journal name and publication year at registration (fails loud otherwise). |
 
 ## Tools & surfaces
 
@@ -135,7 +142,7 @@ pnpm pack
 
 ## Contributors
 
-`dsh-research-report` contributors.
+- [PerryLink](https://github.com/PerryLink) — original author and maintainer: plugin architecture, evidence ledger, byte-level verification, sealed reports, five-language documentation, CI and release automation.
 
 ## PerryLink DSH Plugin Family
 

package/README.pt.md

@@ -31,10 +31,16 @@
 
 - **Livro-razão de evidência** — armazenamento de snapshots endereçado por conteúdo (`<ledgerRoot>/objects/<sha256>` + diários JSONL). O mesmo conteúdo é guardado exatamente uma vez; snapshots são imutáveis; cada leitura recomputa o hash, de modo que adulteração ou remoção é detetada em vez de confiada.
 - **Vínculo claim ↔ evidência** — claims registam-se com os ids de evidência em que se apoiam; o livro guarda o vínculo e cada veredito de verificação (o mais recente vence).
-- **Verificação ao nível do byte** — cada número e cada trecho entre aspas de um claim tem de ser localizável literalmente nos snapshots vinculados. Citações em falta marcam o claim como `unverified`; um rótulo cujo valor difere no snapshot (estando o valor citado ausente) marca-o como `contradicted`. Sem semântica, sem embeddings — apenas verificações de bytes auditáveis.
-- **Ponte numérica opcional** — quando um claim cita um dataset estruturado do workspace (CSV/JSON) e o `dsh-data-quality` está montado, as citações são verificadas com tolerâncias através do seu contrato congelado `verifyCitations`.
-- **Relatórios selados versionados** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json`; o hash de selo é o SHA-256 do manifesto, que por sua vez carrega o hash do relatório e os hashes de toda a evidência.
-- **Lacunas honestas** — claims não verificados ou contraditos mantêm uma marca visível `[未核实]` / `[与证据矛盾]` no corpo do relatório e são listados no Apêndice A. Nada passa em silêncio.
+- **Verificação ao nível do byte** — cada número e cada trecho entre aspas de um claim tem de ser localizável literalmente nos snapshots vinculados. Sem evidência vinculada, ou sem literal verificável, o claim marca-se `unverified`; evidência vinculada que não consegue confirmar nem desmentir os literais citados marca-o `insufficient`; um rótulo cujo valor difere no snapshot (estando o valor citado ausente) marca-o como `disproven`; snapshots adulterados/ausentes marcam-no `contradicted`. Sem semântica, sem embeddings — apenas verificações de bytes auditáveis.
+- **Ponte numérica opcional** — quando um claim cita um dataset estruturado do workspace (CSV/JSON) e o `dsh-data-quality` está montado, as citações são verificadas com tolerâncias através do seu contrato congelado `verifyCitations`; uma discrepância do dataset desmente (disproves) o claim.
+- **Evidência DOI (sem rede)** — origens DOI são validadas deterministicamente (estrutura `10.xxxx/xxxx`, lista branca de prefixos e conjunto de caracteres DOI); DOIs inválidos falham ruidosamente. Metadados opcionais de revista/ano são aceites, e `requireJournalMetadata` só restringe a evidência DOI académica quando ativado.
+- **Relatórios selados versionados** — `<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json` + `verification.jsonl` + `disconfirmation.jsonl`; o hash de selo é o SHA-256 do manifesto, que por sua vez carrega o hash do relatório, os hashes de toda a evidência e o hash de cada diário de auditoria.
+- **Reauditoria pré-entrega e interceção do selo** — antes de selar, cada claim vinculado é re-verificado offline e registado em `verification.jsonl`; drift de veredito, evidência vinculada adulterada/ausente, ou falha de serialização do diário bloqueiam o selo (falha ruidosamente, sem tunable).
+- **Livro de falsificação** — cada claim contradito ou desmentido é registado em `disconfirmation.jsonl` (claim + referências de evidência + motivo) e listado no apêndice `证伪记录` do relatório.
+- **Conhecimento negativo** — um claim desmentido é recordado pelo seu hash de conteúdo (`disproofs.jsonl`); o mesmo texto re-reportado contra evidência inalterada é forçado de volta a `disproven` e só se re-verifica quando a evidência muda.
+- **Ciclo de verificação de só-leitura** — após selar, o recurso determinista `verifySealedReport` (sem rede, sem modelo) recomputa o selo e os hashes de auditoria e re-verifica cada claim, escrevendo a secção de verificação de máquina em `verifier-note.md`; com `ctx.jobs` montado também é lançado um trabalho de verificação de só-leitura (a revisão do modelo é uma melhoria, nunca uma substituição).
+- **Evidência ancorada a sessão** — `evidence_add` aceita um `sessionRef` opcional (`sessionId` + `eventRange`, validado ruidosamente); a âncora é guardada e registada no Apêndice B, no manifesto e em `verification.jsonl`. A evidência ancorada a sessão verifica-se honestamente como `unverified` (`会话锚定证据需人工回查会话日志`).
+- **Lacunas honestas** — claims não verificados, insuficientes, contraditos ou desmentidos mantêm uma marca visível `[未核实]` / `[证据不足]` / `[与证据矛盾]` / `[已证伪]` no corpo do relatório e são listados no Apêndice A. Nada passa em silêncio.
 - **Sem ciclo de deep-research** — a orquestração de recuperação é deliberadamente reutilizada: `ctx.web` para pesquisa/download, `ctx.jobs` para trabalhos longos. Planeamento e síntese ficam com o modelo (ou um plugin a montante).
 
 ## Quick start
@@ -84,6 +90,7 @@ Todos os ajustes são campos `Config` de Schemastery; valores inválidos falham
 | `maxEvidenceBytes` | `2097152` | Teto rígido de bytes UTF-8 por snapshot de evidência. |
 | `maxEvidencePerReport` | `200` | Teto rígido de evidências vinculadas a um relatório. |
 | `fetchTimeoutMs` | `20000` | Prazo (ms) de cada `ctx.web` fetch durante a captura. |
+| `requireJournalMetadata` | `false` | Quando `true`, a evidência de tipo DOI tem de trazer nome de revista e ano de publicação ao registar (falha ruidosamente caso contrário). |
 
 ## Tools & surfaces
 
@@ -134,7 +141,7 @@ pnpm pack
 
 ## Contributors
 
-Contribuidores de `dsh-research-report`.
+- [PerryLink](https://github.com/PerryLink) — autor original e mantenedor: arquitetura do plugin, ledger de evidências, verificação em nível de byte, relatórios selados, documentação em cinco idiomas e automação de CI/lançamento.
 
 ## PerryLink DSH Plugin Family
 

package/README.zh.md

@@ -31,10 +31,16 @@
 
 - **证据账本**——内容寻址快照存储（`<ledgerRoot>/objects/<sha256>` + JSONL 日志）。同一内容只存一份；快照不可变；每次读取都重算哈希——篡改或删除会被发现，而不是被信任。
 - **claim ↔ 证据绑定**——claim 登记时声明其依赖的证据 id；账本保存绑定关系与每一次核查结论（最新为准）。
-- **字节级核查**——claim 文本中的每个数字与引文子串都必须能在其绑定快照中字面定位。定位不到 → `unverified`；标签在快照中对应不同数值（且声称值不存在）→ `contradicted`。不做语义理解、不做向量相似——只做可审计的字节核对。
-- **可选数字核查桥**——当 claim 引用 workspace 内结构化数据集（CSV/JSON）且 `dsh-data-quality` 已挂载时，经其冻结的 `verifyCitations` 契约做容差核对。
-- **版本化封存报告**——`<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json`；封印哈希 = manifest 的 SHA-256，manifest 内含报告哈希与全部证据哈希。
-- **诚实缺口**——未核实/有矛盾的 claim 在正文中保留醒目标记 `[未核实]` / `[与证据矛盾]`，并在附录 A 列明。绝不静默通过。
+- **字节级核查**——claim 文本中的每个数字与引文子串都必须能在其绑定快照中字面定位。无绑定证据或无核查字面量 → `unverified`；证据存在但不足以证实或证伪声称字面量 → `insufficient`；标签在快照中对应不同数值（且声称值不存在）→ `disproven`；快照被篡改/缺失 → `contradicted`。不做语义理解、不做向量相似——只做可审计的字节核对。
+- **可选数字核查桥**——当 claim 引用 workspace 内结构化数据集（CSV/JSON）且 `dsh-data-quality` 已挂载时，经其冻结的 `verifyCitations` 契约做容差核对；数据集不一致即证伪该 claim。
+- **DOI 证据（零网络）**——DOI 源做确定性语法校验（`10.xxxx/xxxx` 结构 + 前缀白名单 + DOI 字符集）；非法 DOI 响亮失败。可选期刊/年份元数据被接受；`requireJournalMetadata` 仅在启用时门禁学术 DOI 证据。
+- **版本化封存报告**——`<reportRoot>/<slug(topic)>/<YYYYMMDD-HHmmss>/report.md` + `manifest.json` + `verification.jsonl` + `disconfirmation.jsonl`；封印哈希 = manifest 的 SHA-256，manifest 内含报告哈希、全部证据哈希与各审计日志哈希。
+- **交付前重审计与封存拦截**——封存前对每条绑定证据的 claim 离线重跑一次核查并写入 `verification.jsonl`；verdict drift、绑定证据被篡改/缺失、或审计日志序列化失败都会拦截封存（响亮失败，无 tunable）。
+- **证伪账本**——每条被证伪（disproven）或矛盾（contradicted）的 claim 记录进 `disconfirmation.jsonl`（claim + 证据引用 + 原因），并在报告的「证伪记录」附录列明。
+- **负知识**——被证伪的 claim 按其内容哈希记入 `disproofs.jsonl`；同一文本在证据未变时被复报会被强制置回 `disproven`，证据变化后才允许重新核验。
+- **只读 verifier 回环**——封存后先跑确定性兜底 `verifySealedReport`（零网络零模型）：重算封印与审计哈希、逐 claim 复核，把 machine-check 段落写入 `verifier-note.md`；挂载 `ctx.jobs` 时再派生只读 verifier job（模型复核为增强，绝不替代）。
+- **会话锚定证据**——`evidence_add` 支持可选 `sessionRef`（`sessionId` + `eventRange`，格式校验响亮失败）；锚点入账并在附录 B、manifest、`verification.jsonl` 登记。会话锚定证据诚实判 `unverified`（`会话锚定证据需人工回查会话日志`）。
+- **诚实缺口**——未核实/证据不足/有矛盾/已证伪的 claim 在正文中保留醒目标记 `[未核实]` / `[证据不足]` / `[与证据矛盾]` / `[已证伪]`，并在附录 A 列明。绝不静默通过。
 - **不做深研循环**——检索编排刻意复用官方底座：搜索/抓取走 `ctx.web`，长任务走 `ctx.jobs`。规划与综合交给模型（或上游插件）。
 
 ## Quick start
@@ -84,6 +90,7 @@ dsh plugin --profile demo remove dsh-research-report    # 卸载
 | `maxEvidenceBytes` | `2097152` | 单条证据快照的 UTF-8 字节硬上限。 |
 | `maxEvidencePerReport` | `200` | 单份报告可绑定证据条数硬上限。 |
 | `fetchTimeoutMs` | `20000` | 抓取时单次 `ctx.web` fetch 的超时（毫秒）。 |
+| `requireJournalMetadata` | `false` | 为 `true` 时，DOI 类证据登记必须带期刊名与出版年份（否则响亮失败）。 |
 
 ## Tools & surfaces
 
@@ -134,7 +141,7 @@ pnpm pack
 
 ## Contributors
 
-`dsh-research-report` contributors。
+- [PerryLink](https://github.com/PerryLink) —— 原作者与维护者：插件架构、证据账本、字节级核验、密封报告、五语文档、CI 与发布自动化。
 
 ## PerryLink DSH Plugin Family
 

package/cordis.patch.yml

@@ -22,3 +22,7 @@
         maxEvidencePerReport: 200
         # Deadline (ms) for one ctx.web fetch during evidence capture.
         fetchTimeoutMs: 20000
+        # When true, DOI-typed evidence (academic source) must carry a journal
+        # name and publication year at registration, otherwise it fails loud.
+        # Defaults to false so non-academic evidence is never gated.
+        requireJournalMetadata: false