psyclaw 0.27.22 → 0.28.0

package/vendor/ars/shared/contracts/passport/preregistration_artifact.schema.json

@@ -0,0 +1,132 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/passport/preregistration_artifact.schema.json",
+  "title": "Preregistration artifact handoff sidecar",
+  "description": "Closed preregistration-artifact/1.0 handoff receipt. It binds one explicitly supplied UTF-8 completed preregistration companion, or records one caller-declared unavailable state. Provenance values are caller declarations, not independent authenticity, timeliness, completeness, or registration findings.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "status",
+    "artifact_id",
+    "relative_path",
+    "artifact_provenance",
+    "source_artifact_sha256",
+    "source_artifact_size_bytes",
+    "source_content_sha256",
+    "source_content_utf8_bytes",
+    "declared_at",
+    "record_digest"
+  ],
+  "properties": {
+    "schema_version": {"const": "preregistration-artifact/1.0"},
+    "status": {
+      "enum": ["provided", "not_provided", "access_failed", "retrieval_failed"]
+    },
+    "artifact_id": {"$ref": "#/$defs/identifier"},
+    "relative_path": {
+      "oneOf": [{"$ref": "#/$defs/relative_path"}, {"type": "null"}]
+    },
+    "artifact_provenance": {
+      "enum": [
+        "author_provided_completed_preregistration",
+        "synthetic_fixture",
+        "not_provided"
+      ]
+    },
+    "source_artifact_sha256": {
+      "oneOf": [{"$ref": "#/$defs/sha256"}, {"type": "null"}]
+    },
+    "source_artifact_size_bytes": {
+      "type": ["integer", "null"],
+      "minimum": 0,
+      "maximum": 67108864
+    },
+    "source_content_sha256": {
+      "oneOf": [{"$ref": "#/$defs/sha256"}, {"type": "null"}]
+    },
+    "source_content_utf8_bytes": {
+      "type": ["integer", "null"],
+      "minimum": 0,
+      "maximum": 67108864
+    },
+    "declared_at": {"$ref": "#/$defs/rfc3339"},
+    "record_digest": {"$ref": "#/$defs/sha256"}
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {"status": {"const": "provided"}},
+        "required": ["status"]
+      },
+      "then": {
+        "properties": {
+          "relative_path": {"$ref": "#/$defs/relative_path"},
+          "artifact_provenance": {
+            "enum": [
+              "author_provided_completed_preregistration",
+              "synthetic_fixture"
+            ]
+          },
+          "source_artifact_sha256": {"$ref": "#/$defs/sha256"},
+          "source_artifact_size_bytes": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 67108864
+          },
+          "source_content_sha256": {"$ref": "#/$defs/sha256"},
+          "source_content_utf8_bytes": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 67108864
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "relative_path": {"type": "null"},
+          "artifact_provenance": {"const": "not_provided"},
+          "source_artifact_sha256": {"type": "null"},
+          "source_artifact_size_bytes": {"type": "null"},
+          "source_content_sha256": {"type": "null"},
+          "source_content_utf8_bytes": {"type": "null"}
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 200,
+      "pattern": "^[a-z0-9][a-z0-9._-]{0,199}$"
+    },
+    "sha256": {
+      "type": "string",
+      "minLength": 64,
+      "maxLength": 64,
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "rfc3339": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt](?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](?:\\.[0-9]+)?(?:[Zz]|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])$"
+    },
+    "relative_path": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^[^/\\\\\\u0000-\\u001f\\u007f-\\u009f\\uD800-\\uDFFF][^\\\\\\u0000-\\u001f\\u007f-\\u009f\\uD800-\\uDFFF]*$",
+      "allOf": [
+        {"not": {"pattern": "(?:^|/)(?:\\.|\\.\\.)(?:/|$)"}},
+        {"not": {"pattern": "//|/$"}},
+        {
+          "not": {
+            "pattern": "[­؀-؅؜۝܏࢐-࢑࣢᠎​-‏‪-‮⁠-⁤⁦--]"
+          }
+        }
+      ],
+      "description": "Normalized relative POSIX display path. Runtime validation also rejects non-normalized or platform-absolute forms before any companion access."
+    }
+  }
+}

package/vendor/ars/shared/contracts/passport/rejection_log.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/passport/rejection_log.schema.json",
+  "title": "Literature Corpus Rejection Log",
+  "description": "Output companion to passport.yaml. Records entries that the adapter could not include in literature_corpus[]. Always emitted; empty when no rejections. Consumers are not required to read this; it exists for user debugging and audit.",
+
+  "type": "object",
+  "additionalProperties": false,
+
+  "required": ["adapter_name", "adapter_version", "generated_at", "rejected"],
+
+  "properties": {
+    "adapter_name":   { "type": "string", "minLength": 1 },
+    "adapter_version":{ "type": "string", "minLength": 1 },
+    "generated_at":   { "type": "string", "format": "date-time" },
+    "input_source": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Optional. Human-readable description of the adapter input (path, URL, etc.)."
+    },
+    "rejected": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/rejection" }
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "total_input":    { "type": "integer", "minimum": 0 },
+        "total_accepted": { "type": "integer", "minimum": 0 },
+        "total_rejected": { "type": "integer", "minimum": 0 }
+      }
+    }
+  },
+
+  "$defs": {
+    "rejection": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "reason"],
+      "properties": {
+        "source": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Where the rejected item came from. Adapter-specific: filename for folder_scan, Zotero item key for zotero, .md path for obsidian."
+        },
+        "reason": {
+          "type": "string",
+          "enum": [
+            "missing_required_field",
+            "invalid_field_format",
+            "duplicate_citation_key",
+            "unresolvable_source_pointer",
+            "year_unparseable",
+            "authors_unparseable",
+            "adapter_error",
+            "other"
+          ]
+        },
+        "detail": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Free-text explanation. Required when reason='other' (enforced by allOf below). Recommended otherwise. Must be non-empty when present — empty strings defeat the 'interpretable rejection' contract."
+        },
+        "raw": {
+          "type": ["object", "string"],
+          "description": "Optional. Adapter's best-effort reproduction of the original input item. Object for structured sources; string for raw filenames or text lines."
+        },
+        "missing_fields": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Optional but strongly recommended when reason='missing_required_field'."
+        }
+      },
+      "allOf": [
+        {
+          "description": "When reason='other', detail MUST be provided so the rejection is interpretable. Categorical reason values are self-explanatory and do not require detail.",
+          "if": {
+            "properties": { "reason": { "const": "other" } },
+            "required": ["reason"]
+          },
+          "then": {
+            "required": ["detail"]
+          }
+        }
+      ]
+    }
+  }
+}

package/vendor/ars/shared/contracts/passport/reset_ledger_entry.schema.json

@@ -0,0 +1,158 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/passport/reset_ledger_entry.schema.json",
+  "title": "Passport Reset Ledger Entry",
+  "description": "One append-only ledger entry in reset_boundary[]. Two kinds: 'boundary' (recorded at a FULL checkpoint when ARS_PASSPORT_RESET=1) and 'resume' (recorded when resume_from_passport consumes a boundary entry). See academic-pipeline/references/passport_as_reset_boundary.md.",
+  "oneOf": [
+    { "$ref": "#/$defs/boundary" },
+    { "$ref": "#/$defs/resume" }
+  ],
+  "$defs": {
+    "boundary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "hash",
+        "stage",
+        "next",
+        "generated_at",
+        "session_marker",
+        "version_label"
+      ],
+      "properties": {
+        "kind": {
+          "const": "boundary",
+          "description": "Discriminator. 'boundary' = reset emitted at a FULL checkpoint."
+        },
+        "hash": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{12}$",
+          "description": "First 12 lowercase hex characters of SHA-256 over the concatenated ledger (prior entries + this entry with hash set to the canonical placeholder '000000000000'). Placeholder rule is normative — see protocol doc §'The reset boundary protocol' step 2."
+        },
+        "stage": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Stage number or name that just completed (e.g., '1', '2', '2.5', 'RESEARCH')."
+        },
+        "next": {
+          "type": ["string", "null"],
+          "minLength": 1,
+          "description": "Default next stage after resume. When pending_decision is unset, this is the authoritative route. When pending_decision is set, this field is advisory: the matched option's next_stage takes precedence, and next MAY be null (including when all branches terminate). The orchestrator MUST NOT auto-advance using next when pending_decision is present."
+        },
+        "generated_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of boundary creation."
+        },
+        "session_marker": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque identifier for the source session. Audit-only; not relied on for resume."
+        },
+        "version_label": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Monotonic version label for the passport state at this boundary (e.g., 'v1.0', 'v1.1-revised'). Stage re-runs bump this."
+        },
+        "mode": {
+          "type": "string",
+          "description": "Mode of the just-completed stage (e.g., 'full', 'systematic-review')."
+        },
+        "verification_status": {
+          "type": "string",
+          "enum": ["VERIFIED", "UNVERIFIED", "STALE"],
+          "description": "Mirror of Schema 9 verification_status at this boundary. Copied for convenience; authoritative value lives in Schema 9 top-level."
+        },
+        "observer_snapshot_ref": {
+          "type": "string",
+          "description": "Optional path or ID of the collaboration_depth_agent observer output for this checkpoint. Audit-only."
+        },
+        "pending_decision": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["question", "options"],
+          "properties": {
+            "question": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Human-readable question the user must answer on resume (e.g., 'Stage 3 review outcome: revise, restructure, or abort?')."
+            },
+            "options": {
+              "type": "array",
+              "minItems": 2,
+              "uniqueItems": true,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["value", "next_stage"],
+                "properties": {
+                  "value": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Branch identifier. Must be unique across the options array — chosen_branch on the resume entry matches this field."
+                  },
+                  "next_stage": {
+                    "type": ["string", "null"],
+                    "description": "Stage number or name to route to when this branch is chosen. null means terminate the pipeline."
+                  },
+                  "next_mode": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Optional downstream mode override when this branch is chosen. Omit to use the default mode for next_stage."
+                  }
+                }
+              },
+              "description": "Enumerated decision branches. Each option carries its own routing: on resume, the orchestrator looks up chosen_branch in options[].value, then uses that entry's next_stage and next_mode to determine actual routing. The boundary entry's next field is advisory (best-guess default) and is superseded by the matched option's next_stage at resume time. CLI stage=/mode= overrides from resume_from_passport still win over option routing."
+            }
+          },
+          "description": "Set when the boundary co-occurs with a MANDATORY user decision (Stage 3 rejection, Stage 5 finalization, etc.). When present, resume must re-prompt the user. Each option carries its own next_stage/next_mode routing; the boundary entry's 'next' field is advisory only and is overridden by the matched option's next_stage at resume time."
+        }
+      }
+    },
+    "resume": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "consumes_hash",
+        "generated_at",
+        "session_marker"
+      ],
+      "properties": {
+        "kind": {
+          "const": "resume",
+          "description": "Discriminator. 'resume' = resume_from_passport consumed a prior boundary entry."
+        },
+        "consumes_hash": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{12}$",
+          "description": "Hash of the boundary entry this resume consumes. Append-only pointer — lets readers compute awaiting_resume state from the ledger alone."
+        },
+        "generated_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of resume event."
+        },
+        "session_marker": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque identifier for the resuming session."
+        },
+        "chosen_branch": {
+          "type": "string",
+          "description": "If the consumed boundary had pending_decision, record which option the user chose. Omit otherwise."
+        },
+        "user_override": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "stage": { "type": "string" },
+            "mode": { "type": "string" }
+          },
+          "description": "Optional stage/mode overrides the user supplied on the resume command."
+        }
+      }
+    }
+  }
+}

package/vendor/ars/shared/contracts/passport/temporal_audit_results.schema.json

@@ -0,0 +1,208 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/passport/temporal_audit_results.schema.json",
+  "title": "Material Passport Temporal Audit Results (phase4_composition/temporal_audit_results.yaml)",
+  "description": "Aggregate schema for v3.9.4 temporal verification findings. NOT a defect_stage of v3.8 claim_audit_result; sibling aggregate (per CC2). Per spec §3.2.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "audit_run_id", "report_reference_date", "findings"],
+  "properties": {
+    "schema_version": { "const": "1.0", "description": "Schema-internal version. v3.9.4 ships 1.0." },
+    "audit_run_id": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z-[0-9a-f]{4}$",
+      "description": "ISO-8601 UTC timestamp + 4-hex suffix; joins to citation_provenance.audit_run_id for per-run pairing."
+    },
+    "report_reference_date": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$",
+      "description": "Frozen reference date per CC6 — never wall-clock today. Tests freeze this to a fixed date."
+    },
+    "findings": {
+      "type": "array",
+      "description": "Per-finding temporal audit results. Closed enum of 6 finding kinds per spec §3.2.",
+      "items": { "$ref": "#/$defs/temporal_audit_finding" }
+    }
+  },
+  "$defs": {
+    "temporal_audit_finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["finding_id", "finding_kind", "severity", "draft_locator", "rationale"],
+      "properties": {
+        "finding_id": { "type": "string", "pattern": "^TF-[0-9]{3,}$" },
+        "finding_kind": {
+          "enum": [
+            "TEMPORAL-ARITHMETIC-IMPOSSIBLE",
+            "TEMPORAL-ANACHRONISTIC-CITATION",
+            "TEMPORAL-COMPARATOR-UNMATERIALIZED",
+            "TEMPORAL-CAUSAL-INVERSION",
+            "TEMPORAL-DEICTIC",
+            "TEMPORAL-METADATA-MISSING"
+          ],
+          "description": "Closed enum of 6 finding kinds per spec §3.2 closed list."
+        },
+        "severity": {
+          "enum": ["HIGH", "MEDIUM", "LOW"],
+          "description": "Closed enum; per-kind defaults in spec §3.2 per-kind required-field map."
+        },
+        "mode": {
+          "type": ["integer", "null"],
+          "minimum": 1,
+          "maximum": 5,
+          "description": "Failure mode 1-5 (from spec §1.2). Null permitted for TEMPORAL-METADATA-MISSING (verifier-deficiency advisory, not a violation)."
+        },
+        "block_eligible": {
+          "type": "boolean",
+          "description": "Forward-compat flag for v3.10 strict policy. v3.9.4 itself emits no terminal block regardless of this flag (CC1)."
+        },
+        "draft_locator": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["file", "line", "sentence"],
+          "properties": {
+            "file": { "type": "string" },
+            "line": { "type": "integer", "minimum": 0 },
+            "sentence": { "type": "string" }
+          }
+        },
+        "matched_span": {
+          "description": "Required for P3/P4/P5 per spec §3.2 per-kind map. Null for P1/P2/METADATA-MISSING.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["text", "char_start", "char_end"],
+              "properties": {
+                "text": { "type": "string" },
+                "char_start": { "type": "integer", "minimum": 0 },
+                "char_end": { "type": "integer", "minimum": 0 }
+              }
+            }
+          ]
+        },
+        "bound_refs": {
+          "type": "array",
+          "description": "Citations bound by the finding. Empty when no ref bindings (P1 anchor+event from draft capture, P5 deictic only).",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["ref_slug", "timeline_entry"],
+            "properties": {
+              "ref_slug": { "type": "string" },
+              "timeline_entry": { "type": ["string", "null"] }
+            }
+          }
+        },
+        "bound_event": {
+          "description": "Event from timeline.yaml events[]. Required for P2 anachronism. Null permitted otherwise.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["event_id", "date"],
+              "properties": {
+                "event_id": { "type": ["string", "null"] },
+                "date": { "type": "string" }
+              }
+            }
+          ]
+        },
+        "bound_dates": {
+          "description": "Left/right date endpoints used by P1 arithmetic + P4 causal predicates. Sources include draft_capture (P1 prose dates), timeline_ref (P4 ref→timeline lookup), citation_provenance.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["left", "right"],
+              "properties": {
+                "left": { "$ref": "#/$defs/bound_date_endpoint" },
+                "right": { "$ref": "#/$defs/bound_date_endpoint" }
+              }
+            }
+          ]
+        },
+        "rationale": { "type": "string", "minLength": 1 },
+        "suggested_fix": { "type": ["string", "null"] }
+      },
+      "oneOf": [
+        {
+          "description": "P1 TEMPORAL-ARITHMETIC-IMPOSSIBLE: bound_dates required (anchor + event from Pattern A/B), mode==1.",
+          "properties": {
+            "finding_kind": { "const": "TEMPORAL-ARITHMETIC-IMPOSSIBLE" },
+            "mode": { "const": 1 },
+            "bound_dates": { "not": { "type": "null" } }
+          },
+          "required": ["finding_kind", "mode", "bound_dates"]
+        },
+        {
+          "description": "P2 TEMPORAL-ANACHRONISTIC-CITATION: bound_refs>=1, bound_event non-null, mode==2.",
+          "properties": {
+            "finding_kind": { "const": "TEMPORAL-ANACHRONISTIC-CITATION" },
+            "mode": { "const": 2 },
+            "bound_refs": { "minItems": 1 },
+            "bound_event": { "not": { "type": "null" } }
+          },
+          "required": ["finding_kind", "mode", "bound_refs", "bound_event"]
+        },
+        {
+          "description": "P3 TEMPORAL-COMPARATOR-UNMATERIALIZED: bound_refs>=1, matched_span non-null, mode==3.",
+          "properties": {
+            "finding_kind": { "const": "TEMPORAL-COMPARATOR-UNMATERIALIZED" },
+            "mode": { "const": 3 },
+            "bound_refs": { "minItems": 1 },
+            "matched_span": { "not": { "type": "null" } }
+          },
+          "required": ["finding_kind", "mode", "bound_refs", "matched_span"]
+        },
+        {
+          "description": "P4 TEMPORAL-CAUSAL-INVERSION: bound_dates non-null, matched_span non-null, mode==4.",
+          "properties": {
+            "finding_kind": { "const": "TEMPORAL-CAUSAL-INVERSION" },
+            "mode": { "const": 4 },
+            "bound_dates": { "not": { "type": "null" } },
+            "matched_span": { "not": { "type": "null" } }
+          },
+          "required": ["finding_kind", "mode", "bound_dates", "matched_span"]
+        },
+        {
+          "description": "P5 TEMPORAL-DEICTIC: bound_refs empty, matched_span non-null, mode==5.",
+          "properties": {
+            "finding_kind": { "const": "TEMPORAL-DEICTIC" },
+            "mode": { "const": 5 },
+            "bound_refs": { "maxItems": 0 },
+            "matched_span": { "not": { "type": "null" } }
+          },
+          "required": ["finding_kind", "mode", "matched_span"]
+        },
+        {
+          "description": "TEMPORAL-METADATA-MISSING: no per-kind requirements (mode and bindings all permitted null).",
+          "properties": {
+            "finding_kind": { "const": "TEMPORAL-METADATA-MISSING" }
+          },
+          "required": ["finding_kind"]
+        }
+      ]
+    },
+    "bound_date_endpoint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["role", "value", "source"],
+      "properties": {
+        "role": {
+          "enum": ["anchor", "event", "left_arg", "right_arg"],
+          "description": "anchor/event for P1 patterns; left_arg/right_arg for P4 causal."
+        },
+        "value": { "type": "string", "description": "Date string (ISO-8601 day or interval encoding 'YYYY-MM-DD..YYYY-MM-DD' or month/year)." },
+        "source": {
+          "enum": ["draft_capture", "timeline_ref", "citation_provenance"],
+          "description": "draft_capture = extracted from prose; timeline_ref = looked up in timeline.yaml via ref_slug; citation_provenance = looked up in citation_provenance.yaml."
+        },
+        "ref_slug": { "type": ["string", "null"], "description": "Populated only when source == timeline_ref." }
+      }
+    }
+  }
+}

package/vendor/ars/shared/contracts/passport/terminal_policies.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Imbad0202/academic-research-skills/shared/contracts/passport/terminal_policies.schema.json",
+  "title": "Material Passport Terminal Policies",
+  "description": "v3.10 passport-level terminal-policy block (spec docs/design/2026-05-31-ars-v3.10-policy-layer-rescope-spec.md §3 PR-B item 1, D1). Opt-in policies that promote an otherwise-advisory provenance signal into a non-acknowledgeable terminal HIGH-BLOCK at the citation-emission boundary. This is a PASSPORT-LEVEL block (one per passport), NOT an entry-level field — it MUST NOT be hosted inside literature_corpus_entry.schema.json (Invariant 11; entry-level != passport-level). Backward compat: the whole object is OPTIONAL; an absent terminal_policies block means all-advisory = byte-equivalent v3.9.0 behavior (Invariant 7). Per-key absence is also advisory, but that default is applied by the finalizer/evaluator at runtime, NOT by a JSON-Schema `default` keyword (JSON-Schema `default` is non-operational — it does not inject a value during validation; R1 P1).",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "contamination_triangulation": {
+      "type": "string",
+      "enum": [
+        "advisory",
+        "strict",
+        "strict_articles_only"
+      ],
+      "description": "Policy for the v3.9.0 cross-index triangulation contamination signal (k=3 = all three lookup indexes unmatched). `advisory` (the absent-key default): k=3 stays an advisory CONTAMINATED-TRIANGULATION-UNMATCHED suffix, byte-equivalent v3.9.0. `strict`: k=3 promotes to a non-acknowledgeable terminal HIGH-BLOCK for EVERY affected ref (no venue/DOI scoping). `strict_articles_only`: a deliberate PRECISION mode (R1 P0-F) — k=3 promotes to HIGH-BLOCK ONLY when DOI present AND venue_type ∈ {journal-article, conference-paper} AND venue_type_provenance ∈ {adapter_declared, user_declared, trusted_source_declared}; a DOI-less or unknown-venue journal article STAYS ADVISORY by design (humanities / non-English / regional-journal legitimate coverage gap). This enum is the full v3.9.0 enum and is wired to behavior in v3.10."
+    },
+    "citation_existence": {
+      "type": "string",
+      "enum": [
+        "advisory",
+        "strict"
+      ],
+      "description": "Policy for the v3.11 deterministic citation-existence signal — the `lookup_verified == false` verdict from the citation_verification_summary[] aggregate (INVARIANT C-V6). `false` is NARROWED (C-V6(a)): it requires at least one ID-keyed (DOI/arXiv-ID) resolver returning `unmatched` with no `matched` — a provably-bogus identifier = fabrication evidence; a title-only `unmatched` with no resolvable identifier reduces to `unresolvable` (a coverage gap: regional / non-English / pre-digital paper indexed nowhere), NEVER `false`. Unlike `contamination_triangulation`, `citation_existence` adds NO advisory suffix token to the ref marker (there is no `CITATION-FALSE`-style suffix, and the parser recognizes only the `CONTAMINATED-*` advisory family): the `false` `why` lives in the always-populated `citation_verification_summary[]` aggregate (with full `resolver_outcomes`). `advisory` (the absent-key default): a `false` row stays visible in that aggregate (where it is `/ars-mark-read`-ack-able) and the pipeline completes; the ref marker is byte-equivalent v3.9.x — no terminal token, no new suffix (a key-absent passport behaves identically). `strict`: a `false` row additionally promotes to a non-acknowledgeable terminal HIGH-BLOCK token (`policy=citation_existence reason=lookup_verified_false mode=strict`) appended to the ref marker — additive, it does not alter the base-status token and adds no advisory suffix (the `why` survives in `reason=lookup_verified_false` + the aggregate) — and blocks the citation from reaching final formatted output, symmetric with `contamination_triangulation=strict` (C-V6(c)/(d)). No `strict_articles_only` member: the narrowed `false` already carries the precision the venue-scoped contamination mode needed, so citation_existence needs no venue subdivision. Detection is unconditional (the summary is always populated, C-V6(e)); this key governs ONLY whether a `false` row renders as terminal or advisory. Per-key absence is advisory via the finalizer/evaluator runtime convention, NOT a JSON-Schema `default` (see the object-level description)."
+    },
+    "retraction": {
+      "type": "string",
+      "enum": [
+        "advisory",
+        "strict"
+      ],
+      "description": "#651 policy for a v1.1 bibliographic_integrity_signals[] retraction_status row. Detection is unconditional and the absent-key default is advisory. `strict` promotes only a current, undisputed `effective_status: retracted` row whose terminal_policy.eligible is true; reinstated, stale, unknown/degraded, resolver-disagreement, and deterministically declared-legitimate-use rows remain advisory. The finalizer is the sole evaluator and emits `TERMINAL-BLOCK severity=HIGH-BLOCK policy=retraction reason=retracted_reference mode=strict`; the formatter only checks the policy stamp and generic HIGH-BLOCK token. No advisory marker suffix is minted: the canonical row remains visible in Bibliographic Integrity Advisories."
+    },
+    "temporal_integrity": {
+      "type": "string",
+      "enum": [
+        "advisory"
+      ],
+      "description": "Forward-reserved namespace for the v3.9.4 temporal-verification signal. In v3.10 ONLY `advisory` is an accepted value — a `strict` value is deliberately NOT in the enum because no temporal strict behavior is wired in v3.10, and a schema-accepted `strict` with no bound behavior is a false-safety bug (codex 2026-05-31; Invariant 3). Wiring temporal strict is a v3.9.4 follow-up, not #127 (spec §6 out of scope)."
+    },
+    "submission_package": {
+      "type": "string",
+      "enum": [
+        "advisory",
+        "strict"
+      ],
+      "description": "Policy for the #394 deterministic submission-package verifier (spec docs/design/2026-06-10-394-submission-package-verifier-spec.md §5 seam 2, slice 4). Governs the package-level gate the orchestrator runs at Stage 5 FINALIZE, AFTER the formatter produces the output package — explicitly NOT the ref-marker stamp path: the carrier is the verifier's report file (header.package_fingerprint + header.policy_slug, the freshness guard) plus the provenance_summary.md `Submission Package Advisories` section, never a marker token. The orchestrator is the SOLE reader of this key and sole selector of the policy in force (spec §5.3); it hands the resolved value to scripts/verify_submission_package.py via the --policy CLI argument — the script never reads terminal_policies, it mechanically applies the already-resolved value (deterministic evaluation tooling, not a second policy reader). `advisory` (the absent-key default, applied by the orchestrator at runtime — NOT a JSON-Schema `default`, see the object-level description): findings land in the report + the provenance_summary.md advisories section and the pipeline completes; byte-equivalent slice-1..3 behavior for the package files themselves. `strict`: a strict-eligible `fail` (deterministic-class signal only — heuristic/warn findings NEVER promote, structurally, spec §3.1/§6) returns the package to the formatter fix loop (bounded 2 rounds, then surface to the scholar), and a strict-eligible `not_checked` is VERIFICATION-INCOMPLETE — it blocks emission exactly like a fail (fail-closed, spec §5.2: a missing parser must not silently waive the one check class the scholar opted into blocking on). Terminal signals are the CLI's stdout tokens (TERMINAL-BLOCK policy=submission_package / VERIFICATION-INCOMPLETE), never raw exit codes (exit 1 also carries nonterminal advisory/heuristic fails). Report reuse REQUIRES the --check-freshness guard first (fingerprint + policy_slug match; a stale or null-stamped report is never evaluated). No `strict_articles_only` member: venue subdivision is a contamination-policy concern; package checks are venue-scoped via the scholar-declared venue profile instead. Per-key absence is advisory via the orchestrator runtime convention, NOT a JSON-Schema `default` (see the object-level description)."
+    }
+  }
+}