feat: fabricated source/citation detection (regex-based)

[Jamie-BitFlight]

Summary

Add regex-based detection of fabricated URLs, DOIs, and citation markers in assistant output. LLMs frequently hallucinate academic citations, fake URLs, and DOI numbers.

Technique (from ObvioSpectre/hallucination-detector)

Three regex patterns that detect common fabrication signals:

// URLs in output
const URL_PATTERN = /https?:\/\/(?:[-\w.]|(?:%[\da-fA-F]{2}))+/g;

// DOI patterns (academic citations)
const DOI_PATTERN = /\b10\.\d{4,9}\/[-._;()/:A-Z0-9]+\b/gi;

// Citation markers like [1], [Smith, 2024]
const CITATION_PATTERN = /\[(?:\d+|[A-Za-z]+(?:, \d{4})?)\]/g;

Detection Logic

• If citations/DOIs/URLs are present in assistant output → elevated risk (LLMs frequently fabricate these)
• If URL contains example.com, placeholder, or ... → definitely fabricated (score 1.0)
• If DOIs present but not verifiable → flag as ungrounded
• No citations → no flag (not all responses need citations)

Why This Works

LLMs are notorious for inventing plausible-looking academic citations, DOIs, and URLs. This is zero-cost, zero-dependency detection that catches a specific and well-documented hallucination failure mode.

New Category

fabricated_source — a fifth detection category alongside speculation, causality, pseudo-quantification, and completeness.

Acceptance Criteria

• URL, DOI, and citation marker regex patterns implemented
• Known-fake URL detection (example.com, placeholder patterns)
• Suppression for URLs in code blocks and inline code
• Tests cover positive and negative cases
• Integrated into existing findTriggerMatches pipeline

References

• ObvioSpectre/hallucination-detector detectors/source_check.py

[Jamie-BitFlight]

Grouping: Group B — Source Credibility

Implement together with: #6, #8

Rationale: #18's URL/DOI/citation regex patterns are reused as suppression checks by #6 (source-required advisory) and #8 (false attribution). Implementing #18 first provides the regex building blocks for the other two.

Recommended order within group: #18 first (provides regex infrastructure), then #8 (vague attributions), then #6 (advisory flags).