cschanhniem · Jul 9, 2026 · Jul 9, 2026
diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help demo test lint ci clean bench-leakage bench-multi-negatives bench-baseline bench-hidden-active bench-cluster-split bench-expert-ablation bench-expert-ablation-500 bench-selectivity bench-feature-decomp bench-gate bench-easy-baseline bench-charge-matched bench-order-dependent bench-precision-at-k bench-per-family bench-simulation-ablation bench-simulation-ablation-within-amp simulation-gate bench-strategy-compare regenerate-all generate phase3 pilot validate-scoring validate-scoring-phase3 validate-scoring-strict external-pilot pilot-confident presynth-qc gold-standard diversity synthesis-order novelty-broad external-consensus questionnaire gate-check ip-report benchmark-card wave0-5-gate-check wave0-5-novelty-audit wave0-5-novelty-audit-v2 wave0-5-panel wave0-5-evidence wave0-5-fill-external wave0-5b-generate wave0-5b-filter recalibration-engine recalibration-engine-dry-run validate-policy-version generate-synthetic-lab-results bump-policy-version generate-review-packet failed-candidate-report safe-publication-filter classify-negative-informativeness validate-rejection-events negative-result-dashboard calibration-audit calibration-audit-example calibration-overfit-check result-quality-filter synthetic-result-policy-check calibration-decision-checklist calibration-rollback-plan simulation-registry validate-simulation-result-schema simulation-baseline-check adapter-gate-check simulation-provenance simulation-ensemble-check simulation-ci-report simulation-deprecation-check simulation-scope-check simulation-evidence-packet artifact-version candidate-manifest artifact-changelog integration-check adapter-author-check license-check artifact-compat-check contribution-check adoption-scorecard release-gate-check decision-log release-request-check coi-check rotation-plan-check security-report-check
+.PHONY: help demo test lint ci clean bench-leakage bench-multi-negatives bench-baseline bench-hidden-active bench-cluster-split bench-expert-ablation bench-expert-ablation-500 bench-selectivity bench-feature-decomp bench-gate bench-easy-baseline bench-charge-matched bench-order-dependent bench-precision-at-k bench-per-family bench-simulation-ablation bench-simulation-ablation-within-amp simulation-gate bench-strategy-compare regenerate-all generate phase3 pilot validate-scoring validate-scoring-phase3 validate-scoring-strict external-pilot pilot-confident presynth-qc gold-standard diversity synthesis-order novelty-broad external-consensus questionnaire gate-check ip-report benchmark-card wave0-5-gate-check wave0-5-novelty-audit wave0-5-novelty-audit-v2 wave0-5-panel wave0-5-evidence wave0-5-fill-external wave0-5b-generate wave0-5b-filter recalibration-engine recalibration-engine-dry-run validate-policy-version generate-synthetic-lab-results bump-policy-version generate-review-packet failed-candidate-report safe-publication-filter classify-negative-informativeness validate-rejection-events negative-result-dashboard calibration-audit calibration-audit-example calibration-overfit-check result-quality-filter synthetic-result-policy-check calibration-decision-checklist calibration-rollback-plan simulation-registry validate-simulation-result-schema simulation-baseline-check adapter-gate-check simulation-provenance simulation-ensemble-check simulation-ci-report simulation-deprecation-check simulation-scope-check simulation-evidence-packet artifact-version candidate-manifest artifact-changelog integration-check adapter-author-check license-check artifact-compat-check contribution-check adoption-scorecard release-gate-check decision-log release-request-check coi-check rotation-plan-check security-report-check citation-check
 
 PYTHON := $(shell [ -f .venv/bin/python ] && echo .venv/bin/python || echo python3)
 PYTEST  := $(shell [ -f .venv/bin/pytest ] && echo .venv/bin/pytest || echo pytest)
@@ -865,3 +865,8 @@ security-report-check:
 	.venv/bin/openamp-foundry security-report-check \
 		--report-json '{"report_id":"SEC-2026-001","severity":"medium","category":"dependency_vulnerability","description":"CVE-2026-1234 in requests library","affected_version":"v0.7.3","reporter_handle":"anonymous","report_date":"2026-07-09","status":"acknowledged"}'
 	@echo "Security report check complete."
+
+citation-check:
+	.venv/bin/openamp-foundry citation-check \
+		--citation-json '{"artifact_id":"OAMP-v0.7.5","citation_type":"software","title":"OpenAMP Foundry","version":"v0.7.5","authors":["Open-Problem-Lab"],"year":"2026","license_identifier":"MIT","reuse_class":"open","url":"https://github.com/Open-Problem-Lab/OpenAMP-Foundry","bibtex_key":"openamp_foundry_2026"}'
+	@echo "Citation check complete."
diff --git a/docs/evidence/METRICS_CURRENT.md b/docs/evidence/METRICS_CURRENT.md
@@ -5,7 +5,9 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > **Purpose:** One authoritative table of current pipeline metrics. If any doc disagrees
 > with this file, this file wins. Updated whenever benchmark/benchmark config changes.
 >
-> **Last updated:** 2026-07-09 (Phase J J6 — security policy — v0.7.4)
+> **Last updated:** 2026-07-09 (Phase J J7 — citation and reuse guide — v0.7.5)
+> **New in v0.7.5:** Citation and reuse guide (J7 — Loop 115) — docs/governance/CITATION_AND_REUSE_GUIDE.md with citation formats (inline, BibTeX), reuse table (4 artifact types, open/attribution_required/contact_required/restricted classes), attribution requirements, honest-use boundary. src/openamp_foundry/governance/citation_policy.py with CitationEntry (11 fields: artifact_id, citation_type, title, version, authors, year, license_identifier, reuse_class, url, bibtex_key, dry_lab_only), CitationValidationResult (6 fields, dry_lab_only=True), VALID_CITATION_TYPES (4: dataset, method, schema, software), VALID_REUSE_CLASSES (4: attribution_required, contact_required, open, restricted), VALID_LICENSE_IDENTIFIERS (5: Apache-2.0, CC-BY-4.0, CC-BY-NC-4.0, MIT, Proprietary), validate_citation_entry() (9 checks: non-empty artifact_id, valid citation_type, non-empty title, non-empty version, non-empty authors, 4-digit year, valid license_identifier, valid reuse_class, dry_lab_only must be True; restricted warns, contact_required+no-url warns, empty bibtex_key warns), validate_citation_dict() (8 required fields guard). CLI (openamp-foundry citation-check) with --citation-json, --format text|json. make citation-check target. 24 tests. Ecosystem clarity: citation entries are now machine-validated.
+>
 > **New in v0.7.4:** Security policy (J6 — Loop 114) — `docs/governance/SECURITY_POLICY.md` with private vulnerability reporting process, response timeline (48h acknowledgment, 30d patch), severity classification (critical/high/medium/low), 5 vulnerability categories (code_vulnerability, secret_leakage, dependency_vulnerability, safety_guardrail_bypass, dual_use_risk), out-of-scope items, disclosure process. `src/openamp_foundry/governance/security_policy.py` with `VulnerabilityReport` dataclass (9 fields: report_id, severity, category, description, affected_version, reporter_handle, report_date, status, dry_lab_only), `SecurityReportValidationResult` dataclass (6 fields, dry_lab_only=True), `VALID_SEVERITY_LEVELS` (4: critical, high, medium, low), `VALID_VULNERABILITY_CATEGORIES` (5: code_vulnerability, secret_leakage, dependency_vulnerability, safety_guardrail_bypass, dual_use_risk), `VALID_REPORT_STATUSES` (6: received, acknowledged, under_review, patched, disclosed, not_applicable), `validate_vulnerability_report()` (9 checks: report_id SEC- prefix, valid severity, valid category, non-empty description, non-empty affected_version, non-empty reporter_handle, YYYY-MM-DD date, valid status, dry_lab_only must be True; critical+received warning, safety_guardrail_bypass warning), `validate_report_dict()` (dict input with 8 required fields guard). CLI (`openamp-foundry security-report-check`) with `--report-json`, `--format text|json`. `make security-report-check` target. 18 tests. Dry-lab only. Private vulnerability reporting now has a validated structure and documented process.
 > **New in v0.7.3:** Maintainer rotation plan (J5 — Loop 113) — `docs/governance/MAINTAINER_ROTATION_PLAN.md` with purpose, current maintainers table (3 entries covering primary, secondary, external_advisor), role definitions (4 roles: primary_maintainer, secondary_maintainer, external_advisor, contributor), bus-factor assessment (target >=2 for every critical function, CI maintenance and domain expertise currently at 1), rotation schedule (every 6 months), onboarding and offboarding checklists, linked policies. `src/openamp_foundry/governance/maintainer_rotation.py` with `MaintainerEntry` dataclass (6 fields: github_handle, role, backup_handle, responsibilities, status, dry_lab_only), `RotationPlanValidationResult` dataclass (7 fields: passed, errors, warnings, maintainer_count, critical_role_coverage, bus_factor_sufficient, dry_lab_only), `VALID_ROLES` (4: primary_maintainer, secondary_maintainer, external_advisor, contributor), `CRITICAL_ROLES` (2: primary_maintainer, secondary_maintainer), `VALID_STATUSES` (4: active, on_leave, emeritus, departing), `validate_maintainer_entry()` (6 checks), `validate_rotation_plan()` (aggregates entry validation + bus-factor coverage: missing critical role is error, single coverage is warning), `validate_rotation_plan_dict()` (dict input with missing-entries-fields guard). CLI (`openamp-foundry rotation-plan-check`) with `--plan-json`, `--format text|json`. `make rotation-plan-check` target. 21 tests. Dry-lab only. Project durability is now machine-validated.
 > **New in v0.7.2:** COI disclosure template (J4 — Loop 112) — `docs/governance/COI_DISCLOSURE_TEMPLATE.md` with structured COI disclosure template (purpose, fill-in-the-blank template with 10 fields: Disclosure ID, disclosure type (reviewer|contributor|maintainer|external_advisor), subject, related artifact, relationship type (financial|institutional|competitive|personal|none), description (conditional), date, recusal required, reviewer, review status (pending|acknowledged|resolved); when to disclose section covering financial/institutional/competitive/personal relationships; process with machine validation and escalation; linked policies). `src/openamp_foundry/governance/coi_disclosure.py` with `COIDisclosure` dataclass (10 fields), `COIValidationResult` dataclass (6 fields, dry_lab_only=True), `VALID_DISCLOSURE_TYPES` (4: contributor, external_advisor, maintainer, reviewer), `VALID_RELATIONSHIP_TYPES` (5: competitive, financial, institutional, none, personal), `VALID_REVIEW_STATUSES` (3: acknowledged, pending, resolved), `validate_coi_disclosure()` (10 checks including disclosure_id COI- prefix, valid disclosure_type, non-empty subject/related_artifact, valid relationship_type, description required unless none, YYYY-MM-DD date, non-empty reviewer, valid review_status, dry_lab_only must be True; financial without recusal warning), `validate_coi_dict()` (dict input with 10 required fields guard, missing fields returns passed=False early). CLI (`openamp-foundry coi-check`) with `--disclosure-json`, `--format text|json`. `make coi-check` target. 20 tests. Dry-lab only. COI disclosures now have a validated structure that builds institutional trust.
@@ -102,7 +104,7 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > **New in v0.5.31:** Added dipeptide-order features for sequence-order awareness. `dipeptide_order_score` achieves AUROC 0.7861 on AMP-vs-scrambled discrimination — the strongest order-dependent feature in the pipeline. Only 7/31 features survive scrambling (amphipathicity/helix-wheel + dipeptide). All composition features are purely position-independent (exactly 0.5000 AUROC on scrambled test).
 > **New in v0.5.30:** Easy baseline benchmark added — charge density alone (AUROC 0.8166) outperforms the full pipeline ensemble (0.7792) on AMP-vs-Swiss-Prot-decoy discrimination. Honest finding documented: expected because pipeline optimizes for safety, not raw discrimination.
 > **New in v0.5.29:** Expanded benchmark to 500 AMPs + 500 composition-matched decoys (n=1000). AUROC 0.7792 (CI₉₅: 0.7505–0.8065) confirms signal generalizes. Cluster-aware CI: 0.746–0.8102. Representative AUROC: 0.778. Standard benchmark (n=191) retained for backward comparison.
-> **Pipeline version:** v0.7.4 (J6 — security policy)
+> **Pipeline version:** v0.7.5 (J7 — citation and reuse guide)
 > **Branch:** main
 
 ---

diff --git a/docs/governance/CITATION_AND_REUSE_GUIDE.md b/docs/governance/CITATION_AND_REUSE_GUIDE.md
@@ -0,0 +1,92 @@
+# Citation and Reuse Guide
+
+OpenAMP Foundry is an open research infrastructure project. This guide explains
+how to cite the project and what you can reuse under which conditions.
+
+## How to Cite
+
+If you use OpenAMP Foundry in academic work, please cite:
+
+**Inline citation:**
+OpenAMP Foundry (Open-Problem-Lab, 2026), available at
+https://github.com/Open-Problem-Lab/OpenAMP-Foundry
+
+**BibTeX:**
+```bibtex
+@software{openamp_foundry_2026,
+  author    = {{Open-Problem-Lab}},
+  title     = {{OpenAMP Foundry: Verification-First Antimicrobial Peptide Discovery Infrastructure}},
+  year      = {2026},
+  url       = {https://github.com/Open-Problem-Lab/OpenAMP-Foundry},
+  note      = {Dry-lab computational pipeline. Outputs are not biological proof.}
+}
+```
+
+**Schema or artifact citation (add version):**
+OpenAMP Foundry Artifact v0.7.x (Open-Problem-Lab, 2026).
+Include the exact artifact version from `artifact_id` in the artifact manifest.
+
+## What You Can Reuse
+
+| Artifact type  | Reuse class           | License       | Attribution required |
+|----------------|-----------------------|---------------|----------------------|
+| Source code    | open                  | MIT           | Yes — preserve copyright notice |
+| JSON schemas   | open                  | MIT           | Yes — preserve copyright notice |
+| Documentation  | attribution_required  | CC-BY-4.0     | Yes — cite OpenAMP Foundry |
+| Benchmark data | attribution_required  | CC-BY-4.0     | Yes — cite OpenAMP Foundry |
+| Model weights  | contact_required      | CC-BY-NC-4.0  | Yes + contact maintainers |
+| Candidate lists| restricted            | Proprietary   | Contact maintainers |
+
+## Attribution Requirements
+
+For **open** and **attribution_required** artifacts:
+1. Include a clear reference to OpenAMP Foundry in your work.
+2. Preserve the original copyright notice in any derivative files.
+3. Do not imply endorsement by the OpenAMP Foundry team.
+4. Retain the `dry_lab_only` label in any re-published computational outputs.
+
+For **contact_required** artifacts:
+1. Contact maintainers before use (see GOVERNANCE.md for contact information).
+2. Attribution requirements as above apply.
+3. Obtain written confirmation before publishing results derived from these artifacts.
+
+For **restricted** artifacts:
+1. Do not reuse without explicit written permission from maintainers.
+2. Contact maintainers to discuss licensing terms.
+
+## What NOT to Reuse Without Permission
+
+- Candidate sequences in restricted status (pre-publication pipeline outputs)
+- Lab synthesis orders or target prioritization lists
+- Internal review committee deliberations
+- Any artifact marked `release_status: restricted` in the artifact manifest
+
+## Honest Use Boundary
+
+Computational outputs from OpenAMP Foundry are **dry-lab candidates only**.
+Do not describe them as "drugs," "proven antimicrobials," or "safe in humans."
+Use language like: "computationally nominated candidates," "dry-lab selected sequences,"
+"pending wet-lab validation."
+
+## Machine-Validated Citation Entries
+
+Citation entries can be validated with:
+```bash
+openamp-foundry citation-check --citation-json '{"artifact_id": "...", ...}'
+```
+
+See `src/openamp_foundry/governance/citation_policy.py` for the CitationEntry schema.
+
+## Contact
+
+For custom licensing, commercial use inquiries, or questions about reuse:
+open an issue at https://github.com/Open-Problem-Lab/OpenAMP-Foundry/issues
+with the label `governance`.
+
+## Linked Policies
+
+- [GOVERNANCE.md](../../GOVERNANCE.md) — project governance structure
+- [DATA_LICENSE_NOTICE.md](../../DATA_LICENSE_NOTICE.md) — data licensing details
+- [RESPONSIBLE_USE.md](../../RESPONSIBLE_USE.md) — responsible use policy
+- [MODEL_RELEASE_POLICY.md](../../MODEL_RELEASE_POLICY.md) — model release policy
+- [SECURITY_POLICY.md](SECURITY_POLICY.md) — vulnerability reporting
diff --git a/docs/research/ROADMAP.md b/docs/research/ROADMAP.md
@@ -1,5 +1,30 @@
 # Roadmap
 
+## v0.7.5 — Loop 115: Phase J J7 — Citation and Reuse Guide ✓ (2026-07-09)
+
+`docs/governance/CITATION_AND_REUSE_GUIDE.md` with citation formats (inline,
+BibTeX), reuse table (4 artifact types with open/attribution_required/
+contact_required/restricted classes), attribution requirements, honest-use
+boundary (dry-lab outputs only), contact information, linked policies.
+
+`src/openamp_foundry/governance/citation_policy.py` with
+`CitationEntry` dataclass (11 fields: artifact_id, citation_type, title,
+version, authors, year, license_identifier, reuse_class, url, bibtex_key,
+dry_lab_only), `CitationValidationResult` dataclass (6 fields,
+dry_lab_only=True), `VALID_CITATION_TYPES` (4: dataset, method, schema,
+software), `VALID_REUSE_CLASSES` (4: attribution_required, contact_required,
+open, restricted), `VALID_LICENSE_IDENTIFIERS` (5: Apache-2.0, CC-BY-4.0,
+CC-BY-NC-4.0, MIT, Proprietary), `validate_citation_entry()` (9 checks
++ 3 warning conditions), `validate_citation_dict()` (8 required fields guard).
+
+CLI (`openamp-foundry citation-check`) with `--citation-json` (required),
+`--format text|json`. Handler `_run_citation_check` in reports.py.
+
+`make citation-check` target. 24 tests. **3599 total.**
+
+Ecosystem clarity: citation entries are machine-validated, reuse classes are
+explicit, and the honest-use boundary is documented in the guide.
+
 ## v0.7.4 — Loop 114: Phase J J6 — Security Policy ✓ (2026-07-09)
 
 `docs/governance/SECURITY_POLICY.md` with private vulnerability reporting

diff --git a/src/openamp_foundry/cli/commands/reports.py b/src/openamp_foundry/cli/commands/reports.py
@@ -2681,3 +2681,37 @@ def _run_security_report_check(args: argparse.Namespace) -> int:
             print("  Report validated. Ready for maintainer review.")
 
     return 0 if result.passed else 3
+
+
+def _run_citation_check(args: argparse.Namespace) -> int:
+    """Validate a citation entry."""
+    import json as _json
+    from openamp_foundry.governance.citation_policy import validate_citation_dict
+
+    try:
+        d = _json.loads(args.citation_json)
+    except _json.JSONDecodeError as exc:
+        print(_json.dumps({"status": "error", "error": f"Invalid JSON: {exc}"}))
+        return 2
+
+    if not isinstance(d, dict):
+        print(_json.dumps({"status": "error", "error": "--citation-json must be a JSON object"}))
+        return 2
+
+    result = validate_citation_dict(d)
+    output_format = getattr(args, "format", "text")
+
+    if output_format == "json":
+        import dataclasses
+        print(_json.dumps(dataclasses.asdict(result), indent=2))
+    else:
+        status = "PASS" if result.passed else "FAIL"
+        print(f"Citation entry {result.artifact_id} ({result.citation_type}): {status}")
+        for e in result.errors:
+            print(f"  ERROR: {e}")
+        for w in result.warnings:
+            print(f"  WARN:  {w}")
+        if result.passed:
+            print("  Citation entry validated. Ready for publication reference.")
+
+    return 0 if result.passed else 3