chore(release): v4.5.0 — reverse-coding detector + SR/MA·DTA·CPM probes + submission abs-path gate

Bundles the unreleased work since v4.4.0 (no skill / reporting-guideline count change —
still 45 skills / 36 guidelines; analysis-integrity detectors 27 → 28):

- /clean-data + /analyze-stats: reverse-coded-item / negative-alpha detector
  (check_reverse_coding.py; integrity detectors 27 → 28) (#168).
- /peer-review + /self-review: SR/MA P12-P13 + DTA D7 + CPM CP5-CP6 domain probes,
  vendored byte-identical into /self-review (#167).
- /sync-submission: check_asset_anonymization.py scan class 4 — docx_embedded_abs_path
  username leak in word/*.xml attributes (#167).

Test-backfill infrastructure (#164-#166) also rides this release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Yoojin-nam

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [4.5.0] - 2026-06-20
+
 ### Added
 
 - **Self-review domain-probe batch (SR/MA + DTA + prediction-model) + submission asset-anon abs-path gate.** Five new review probes promoted from field cycles, plus one deterministic submission check. `sr_ma.md`: **P12** risk-of-bias table row-sum ↔ figure-matrix reconciliation (each NOS ★/JBI Y row must equal its printed total; the traffic-light figure's data matrix must match the supplementary table; SSOT = the primary appraisal form, not a plotting-script constant) and **P13** included-study ↔ reference-list completeness (every characteristics-table study must be a numbered reference; source citations from PubMed `efetch`, not hand-kept notes; disambiguate same author/year by technique + sample size). `diagnostic_accuracy.md`: **D7** index-test-as-enrollment-criterion circularity (escalate past Major when an inclusion threshold is the index test under study). `clinical_prediction_model.md`: **CP5** intended-use horizon leakage (claim-timepoint adjectives vs each predictor's availability timepoint) and **CP6** validation-nomenclature conflation (development/CV vs held-out/external test). Probes are vendored byte-identical to `peer-review`. `sync-submission/scripts/check_asset_anonymization.py`: new scan class 4 — a `word/*.xml` attribute (e.g. a pandoc-embedded image's `<pic:cNvPr descr="…">`) carrying an absolute home-dir path (`/Users/…`, `/home/…`) is a username leak invisible to a rendered-text scan; flagged as `docx_embedded_abs_path` (leak severity), with a regression test fixture. No version bump — probe/reference + detector additions.

CITATION.cff

@@ -19,7 +19,7 @@ authors:
 repository-code: "https://github.com/Aperivue/medsci-skills"
 url: "https://github.com/Aperivue/medsci-skills"
 license: MIT
-version: "4.4.0"
+version: "4.5.0"
 date-released: "2026-06-20"
 doi: "10.5281/zenodo.20155321"
 identifiers:

README.md

@@ -224,6 +224,12 @@ The E2E pipeline (`orchestrate --e2e`) produces everything up to `qc/`. The `sub
 
 ## What's New
 
+**v4.5** deepens the review + submission surface with no new skill or reporting-guideline count (still 45 skills / 36 guidelines); analysis-integrity detectors **27 → 28**:
+
+- **`/clean-data` + `/analyze-stats` — reverse-coded-item / negative-alpha detector.** A multi-item Likert scale with a negatively-worded item must be recoded `(min+max) − x` before the scale total or Cronbach's alpha is computed; left un-recoded, the item correlates negatively with the rest of the scale and alpha collapses (often negative). A negative alpha is a coding bug, not a "multidimensional construct." New stdlib-only `check_reverse_coding.py` returns `REVERSE_CODING_LIKELY` / `REVERSE_CODING_SUSPECT` / `OK` from per-item item-rest correlations + raw alpha; the Likert summary template gains a `--reverse-items` recode flag.
+- **`/peer-review` + `/self-review` — SR/MA + DTA + prediction-model probe batch.** `sr_ma.md` **P12** risk-of-bias table row-sum ↔ traffic-light figure-matrix reconciliation and **P13** included-study ↔ reference-list completeness; `diagnostic_accuracy.md` **D7** index-test-as-enrollment-criterion circularity; `clinical_prediction_model.md` **CP5** intended-use horizon leakage and **CP6** development/CV vs held-out/external validation-nomenclature conflation. Vendored byte-identical into `/self-review`.
+- **`/sync-submission` — embedded absolute-path leak scan.** A `word/*.xml` attribute (e.g. a pandoc-embedded image's `<pic:cNvPr descr="…">`) carrying an absolute home-dir path (`/Users/…`, `/home/…`) is a username leak invisible to a rendered-text scan; now flagged as `docx_embedded_abs_path` under `check_asset_anonymization.py`.
+
 **v4.4** adds reviewer/analysis depth with no new skill or reporting-guideline count (still 45 skills / 36 guidelines / 27 detectors):
 
 - **`/author-strategy` — trajectory-archetype classification (optional).** Classifies a queried author's PubMed trajectory into abstract career archetypes (A1 infrastructure builder, A2 methodology rule-maker, A3 clinical→AI hybrid, A4 SR/MA volume engine, A5 large-consortium participation, A6 device/technique depth, + a computed composite) as an **explainable, multi-label, confidence-scored heuristic — not an objective verdict**. The rubric is a single canonical YAML (the narrative doc is generated from it); scores exclude `unavailable` signals (h-index/citation/venue-tier → `[VERIFY]`, never fabricated); a **disambiguation gate** binds an approved `corpus_manifest.json` to the CSV (csv + PMID-set hashes) so a surname alone never classifies, and target-author attribution never borrows a co-author's ORCID/affiliation.