dsh-aris-panel 0.1.0

package/tools/meta_opt/trigger_evals.sample.json

@@ -0,0 +1,28 @@
+{
+  "_README": "Query set for trigger_eval.py. Keys are skill names; values are user-intent queries that SHOULD trigger that skill. RULE: paraphrase intent, never quote the skill's own trigger phrases verbatim — a query containing the literal description trigger string is trivially positive and measures nothing. Prefix a skill key with '_' to comment it out. For negative testing (measuring FALSE triggering), add queries under a skill that should NOT fire and read the confusion matrix in the report. This sample covers a few well-scoped skills; extend per the skill you're tuning.",
+  "check-gpu": [
+    "is anything running on the servers right now?",
+    "how busy are my remote machines?",
+    "which cards are free before I launch a job"
+  ],
+  "research-lit": [
+    "find me recent papers on this topic",
+    "what has been published about diffusion language models lately",
+    "pull together related work for my intro section"
+  ],
+  "novelty-check": [
+    "has anyone already done this idea?",
+    "is my approach actually new or is it in the literature already",
+    "check if this contribution is novel before I build it"
+  ],
+  "citation-audit": [
+    "make sure every reference in my paper is real and correctly attributed",
+    "verify the bibliography before submission",
+    "did I hallucinate any citations in this draft"
+  ],
+  "kill-argument": [
+    "what is the single strongest reason a reviewer would reject this paper",
+    "give me the harshest rebuttal my theory paper would face",
+    "simulate reviewer 2's most damaging objection"
+  ]
+}

package/tools/openalex_fetch.py

@@ -0,0 +1,326 @@
+#!/usr/bin/env python3
+"""
+OpenAlex API client for academic paper search.
+Documentation: https://developers.openalex.org/
+"""
+
+import argparse
+import json
+import sys
+import os
+from typing import List, Dict, Optional
+
+try:
+    import requests
+except ImportError:
+    print(
+        "OpenAlex requires the 'requests' package. "
+        "Install with: pip install requests",
+        file=sys.stderr,
+    )
+    # Exit code 2 signals "skip this source" to the calling skill,
+    # distinct from exit 1 used for runtime errors below.
+    sys.exit(2)
+
+
+class OpenAlexClient:
+    BASE_URL = "https://api.openalex.org"
+
+    def __init__(self, api_key: Optional[str] = None, email: Optional[str] = None):
+        """
+        Initialize OpenAlex client.
+
+        Args:
+            api_key: Optional API key for higher rate limits
+            email: Optional email for polite pool (faster response)
+        """
+        self.api_key = api_key or os.environ.get("OPENALEX_API_KEY")
+        self.email = email or os.environ.get("OPENALEX_EMAIL")
+        self.session = requests.Session()
+
+        # Set user agent with email for polite pool
+        if self.email:
+            self.session.headers.update({
+                "User-Agent": f"mailto:{self.email}"
+            })
+
+    def search_works(
+        self,
+        query: str,
+        max_results: int = 10,
+        publication_year: Optional[str] = None,
+        work_type: Optional[str] = None,
+        open_access: Optional[bool] = None,
+        min_citations: Optional[int] = None,
+        sort: str = "relevance_score:desc",
+        fields: Optional[List[str]] = None
+    ) -> List[Dict]:
+        """
+        Search for academic works.
+
+        Args:
+            query: Search query string
+            max_results: Maximum number of results (default: 10)
+            publication_year: Year filter, e.g., "2023" or "2020-2023"
+            work_type: Type filter, e.g., "article", "preprint", "book"
+            open_access: Filter by open access status
+            min_citations: Minimum citation count
+            sort: Sort order (default: relevance_score:desc)
+            fields: Specific fields to return (default: all)
+
+        Returns:
+            List of work dictionaries
+        """
+        url = f"{self.BASE_URL}/works"
+
+        # Build filter string
+        filters = []
+        if publication_year:
+            filters.append(f"publication_year:{publication_year}")
+        if work_type:
+            filters.append(f"type:{work_type}")
+        if open_access is not None:
+            filters.append(f"is_oa:{str(open_access).lower()}")
+        if min_citations:
+            filters.append(f"cited_by_count:>{min_citations}")
+
+        params = {
+            "search": query,
+            "per_page": min(max_results, 200),  # API max is 200
+            "sort": sort
+        }
+
+        if filters:
+            params["filter"] = ",".join(filters)
+
+        if self.api_key:
+            params["api_key"] = self.api_key
+
+        try:
+            response = self.session.get(url, params=params, timeout=30)
+            response.raise_for_status()
+            data = response.json()
+
+            results = []
+            for work in data.get("results", []):
+                results.append(self._parse_work(work))
+
+            return results[:max_results]
+
+        except requests.exceptions.HTTPError as e:
+            if e.response.status_code == 429:
+                print("Rate limit exceeded. Consider using an API key or reducing request frequency.", file=sys.stderr)
+            raise
+        except Exception as e:
+            print(f"Error fetching from OpenAlex: {e}", file=sys.stderr)
+            raise
+
+    def get_work(self, work_id: str) -> Dict:
+        """
+        Get a specific work by ID, DOI, or OpenAlex ID.
+
+        Args:
+            work_id: Work identifier (DOI, OpenAlex ID, etc.)
+
+        Returns:
+            Work dictionary
+        """
+        # Handle different ID formats
+        if work_id.startswith("10."):  # DOI
+            url = f"{self.BASE_URL}/works/doi:{work_id}"
+        elif work_id.startswith("W"):  # OpenAlex ID
+            url = f"{self.BASE_URL}/works/{work_id}"
+        else:
+            url = f"{self.BASE_URL}/works/{work_id}"
+
+        params = {}
+        if self.api_key:
+            params["api_key"] = self.api_key
+
+        response = self.session.get(url, params=params, timeout=30)
+        response.raise_for_status()
+
+        return self._parse_work(response.json())
+
+    def _parse_work(self, work: Dict) -> Dict:
+        """Parse OpenAlex work object into simplified format."""
+        # Extract authors
+        authors = []
+        for authorship in work.get("authorships", []):
+            author = authorship.get("author", {})
+            author_name = author.get("display_name", "Unknown")
+            authors.append(author_name)
+
+        # Extract venue/source — `or {}` because OpenAlex returns explicit null (not missing key) for some works
+        primary_location = work.get("primary_location") or {}
+        source = primary_location.get("source") or {}
+        venue = source.get("display_name", "Unknown")
+
+        # Extract open access info
+        oa_info = work.get("open_access") or {}
+        oa_status = oa_info.get("oa_status", "closed")
+        oa_url = oa_info.get("oa_url")
+
+        # Extract abstract (inverted index format)
+        abstract_inverted = work.get("abstract_inverted_index")
+        abstract = self._reconstruct_abstract(abstract_inverted) if abstract_inverted else None
+
+        # Extract topics/keywords
+        topics = [t.get("display_name") for t in work.get("topics", [])[:3]]
+        keywords = [k.get("display_name") for k in work.get("keywords", [])[:5]]
+
+        return {
+            "id": work.get("id"),
+            "openalex_id": work.get("id", "").split("/")[-1],
+            "doi": work.get("doi", "").replace("https://doi.org/", "") if work.get("doi") else None,
+            "title": work.get("display_name") or work.get("title", "Untitled"),
+            "authors": authors,
+            "author_count": len(authors),
+            "publication_year": work.get("publication_year"),
+            "publication_date": work.get("publication_date"),
+            "venue": venue,
+            "venue_type": source.get("type"),
+            "cited_by_count": work.get("cited_by_count", 0),
+            "is_oa": work.get("is_oa", False),
+            "oa_status": oa_status,
+            "oa_url": oa_url,
+            "abstract": abstract,
+            "topics": topics,
+            "keywords": keywords,
+            "type": work.get("type"),
+            "language": work.get("language"),
+            "referenced_works_count": work.get("referenced_works_count", 0),
+            "url": work.get("id")
+        }
+
+    def _reconstruct_abstract(self, inverted_index: Dict) -> str:
+        """Reconstruct abstract from inverted index format."""
+        if not inverted_index:
+            return None
+
+        # Create list of (position, word) tuples
+        words = []
+        for word, positions in inverted_index.items():
+            for pos in positions:
+                words.append((pos, word))
+
+        # Sort by position and join
+        words.sort(key=lambda x: x[0])
+        return " ".join(word for _, word in words)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Search OpenAlex for academic papers",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  # Basic search
+  %(prog)s search "semantic communication" --max 10
+
+  # Filter by year and type
+  %(prog)s search "diffusion models" --year 2023- --type article --max 20
+
+  # Open access papers only
+  %(prog)s search "machine learning" --open-access --min-citations 50
+
+  # Get specific work by DOI
+  %(prog)s work "10.1109/TWC.2024.1234567"
+
+  # Sort by citations
+  %(prog)s search "neural networks" --sort citations --max 10
+        """
+    )
+
+    subparsers = parser.add_subparsers(dest="command", help="Command to execute")
+
+    # Search command
+    search_parser = subparsers.add_parser("search", help="Search for works")
+    search_parser.add_argument("query", help="Search query")
+    search_parser.add_argument("--max", type=int, default=10, help="Maximum results (default: 10)")
+    search_parser.add_argument("--year", help="Publication year filter (e.g., '2023' or '2020-2023')")
+    search_parser.add_argument("--type", choices=["article", "preprint", "book", "book-chapter", "dataset", "dissertation"],
+                              help="Work type filter")
+    search_parser.add_argument("--open-access", action="store_true", help="Only open access papers")
+    search_parser.add_argument("--min-citations", type=int, help="Minimum citation count")
+    search_parser.add_argument("--sort", choices=["relevance", "citations", "date"],
+                              default="relevance", help="Sort order (default: relevance)")
+    search_parser.add_argument("--json", action="store_true", help="Output as JSON")
+
+    # Work command
+    work_parser = subparsers.add_parser("work", help="Get specific work by ID/DOI")
+    work_parser.add_argument("work_id", help="Work ID (DOI, OpenAlex ID, etc.)")
+    work_parser.add_argument("--json", action="store_true", help="Output as JSON")
+
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        sys.exit(1)
+
+    # Initialize client
+    client = OpenAlexClient()
+
+    try:
+        if args.command == "search":
+            # Map sort option to API format
+            sort_map = {
+                "relevance": "relevance_score:desc",
+                "citations": "cited_by_count:desc",
+                "date": "publication_date:desc"
+            }
+
+            results = client.search_works(
+                query=args.query,
+                max_results=args.max,
+                publication_year=args.year,
+                work_type=args.type,
+                open_access=args.open_access if args.open_access else None,
+                min_citations=args.min_citations,
+                sort=sort_map[args.sort]
+            )
+
+            if args.json:
+                print(json.dumps(results, indent=2))
+            else:
+                print(f"Found {len(results)} papers:\n")
+                for i, work in enumerate(results, 1):
+                    print(f"{i}. {work['title']}")
+                    print(f"   Authors: {', '.join(work['authors'][:3])}{' et al.' if len(work['authors']) > 3 else ''}")
+                    print(f"   Year: {work['publication_year']} | Venue: {work['venue']}")
+                    print(f"   Citations: {work['cited_by_count']} | OA: {'Yes' if work['is_oa'] else 'No'}")
+                    if work['doi']:
+                        print(f"   DOI: {work['doi']}")
+                    if work['oa_url']:
+                        print(f"   PDF: {work['oa_url']}")
+                    if work['abstract']:
+                        abstract_preview = work['abstract'][:200] + "..." if len(work['abstract']) > 200 else work['abstract']
+                        print(f"   Abstract: {abstract_preview}")
+                    print()
+
+        elif args.command == "work":
+            work = client.get_work(args.work_id)
+
+            if args.json:
+                print(json.dumps(work, indent=2))
+            else:
+                print(f"Title: {work['title']}")
+                print(f"Authors: {', '.join(work['authors'])}")
+                print(f"Year: {work['publication_year']} | Venue: {work['venue']}")
+                print(f"Citations: {work['cited_by_count']} | OA: {'Yes' if work['is_oa'] else 'No'}")
+                if work['doi']:
+                    print(f"DOI: {work['doi']}")
+                if work['oa_url']:
+                    print(f"PDF: {work['oa_url']}")
+                if work['topics']:
+                    print(f"Topics: {', '.join(work['topics'])}")
+                if work['abstract']:
+                    print(f"\nAbstract:\n{work['abstract']}")
+
+    except Exception as e:
+        print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

package/tools/overleaf_audit.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# overleaf_audit.sh — Scan a repo for accidental Overleaf token leaks.
+#
+# Run this any time you suspect a token may have been written somewhere:
+#   bash tools/overleaf_audit.sh [repo-root]
+#
+# Exits non-zero if any token-pattern leak is found.
+# Token pattern: 'olp_' followed by 20+ alphanumerics.
+
+set -o pipefail
+
+ROOT="${1:-.}"
+PATTERN='olp_[A-Za-z0-9]{20,}'
+FOUND=0
+
+echo "Scanning $ROOT for Overleaf token patterns…"
+echo ""
+
+# 1. Working tree (excluding .git/ and node_modules/) ─────────────────────────
+echo "[1/4] Working tree files…"
+if command -v rg >/dev/null 2>&1; then
+    LEAKS=$(rg -n --no-heading -e "$PATTERN" \
+                --glob '!**/.git/**' --glob '!**/node_modules/**' \
+                --glob '!**/paper-overleaf/.git/**' \
+                "$ROOT" 2>/dev/null || true)
+else
+    LEAKS=$(grep -rEn "$PATTERN" \
+                --exclude-dir=.git --exclude-dir=node_modules \
+                "$ROOT" 2>/dev/null || true)
+fi
+if [ -n "$LEAKS" ]; then
+    echo "❌ Token pattern in working tree:"
+    echo "$LEAKS"
+    FOUND=1
+else
+    echo "   ✓ none"
+fi
+
+# 2. Git remote URLs of all sub-repos ─────────────────────────────────────────
+echo "[2/4] Git remote URLs…"
+LEAKS=""
+while IFS= read -r -d '' gitdir; do
+    REPO=$(dirname "$gitdir")
+    if URL=$(cd "$REPO" && git remote -v 2>/dev/null); then
+        if echo "$URL" | grep -qE "$PATTERN"; then
+            LEAKS+="$REPO:"$'\n'"$URL"$'\n'
+        fi
+    fi
+done < <(find "$ROOT" -name '.git' -type d -print0 2>/dev/null)
+if [ -n "$LEAKS" ]; then
+    echo "❌ Token in remote URL:"
+    echo "$LEAKS"
+    FOUND=1
+else
+    echo "   ✓ none"
+fi
+
+# 3. Git history (current repo only — full --all scan can be expensive) ───────
+echo "[3/4] Git history of repo at $ROOT ..."
+if [ -d "$ROOT/.git" ]; then
+    LEAKS=$(cd "$ROOT" && git log -p --all 2>/dev/null | grep -E "$PATTERN" | head -5 || true)
+    if [ -n "$LEAKS" ]; then
+        echo "❌ Token pattern in git history (showing first 5 matches):"
+        echo "$LEAKS"
+        echo ""
+        echo "   Token may already be public if pushed. Revoke immediately:"
+        echo "   https://www.overleaf.com/user/settings"
+        FOUND=1
+    else
+        echo "   ✓ none"
+    fi
+else
+    echo "   (skipped — $ROOT is not a git repo)"
+fi
+
+# 4. Common credential-storage files ──────────────────────────────────────────
+echo "[4/4] Credential files (.netrc, .env, *credentials*)…"
+LEAKS=""
+for f in ~/.netrc ~/.git-credentials "$ROOT/.env" "$ROOT/.envrc"; do
+    if [ -f "$f" ] && grep -qE "$PATTERN" "$f" 2>/dev/null; then
+        LEAKS+="$f"$'\n'
+    fi
+done
+if [ -n "$LEAKS" ]; then
+    echo "⚠️  Token in credential file (intentional? confirm not in repo):"
+    echo "$LEAKS"
+else
+    echo "   ✓ none"
+fi
+
+echo ""
+if [ $FOUND -eq 0 ]; then
+    echo "✅ Audit clean — no Overleaf token leaks found."
+    exit 0
+else
+    echo "❌ Audit FAILED — see leaks above."
+    echo ""
+    echo "Action items:"
+    echo "  1. Revoke the leaked token at https://www.overleaf.com/user/settings"
+    echo "  2. Generate a new token"
+    echo "  3. Remove the leak (working tree: edit; remote URL: git remote set-url; history: git filter-repo)"
+    echo "  4. Re-run overleaf_setup.sh with the new token"
+    exit 1
+fi

package/tools/overleaf_setup.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# overleaf_setup.sh — One-time Overleaf Git bridge setup.
+#
+# CRITICAL: this script is meant to be run by the USER directly in their terminal,
+# NEVER through an LLM agent. The user types the token into a hidden prompt; the
+# script wires it into the OS keychain and immediately strips it from the git
+# remote URL so no agent or file ever sees the cleartext token.
+#
+# Usage:
+#   bash tools/overleaf_setup.sh <project-id-or-url> [clone-dir]
+#
+# Example:
+#   bash tools/overleaf_setup.sh https://www.overleaf.com/project/69e478... paper-overleaf
+
+set -euo pipefail
+
+# ── Refuse to run from a non-interactive context (i.e. inside an agent) ────────
+if [ ! -t 0 ] || [ ! -t 1 ]; then
+    echo "ERROR: overleaf_setup.sh requires an interactive terminal."
+    echo "       Do NOT run this through an LLM agent — run it yourself in a terminal."
+    echo "       The token must be typed into a hidden prompt, not pasted into chat."
+    exit 1
+fi
+
+# ── Args ──────────────────────────────────────────────────────────────────────
+if [ $# -lt 1 ]; then
+    echo "Usage: $0 <project-id-or-url> [clone-dir]"
+    echo ""
+    echo "  project-id-or-url:  e.g. 'abc123def456' or 'https://www.overleaf.com/project/abc123def456'"
+    echo "  clone-dir:          defaults to 'paper-overleaf'"
+    exit 1
+fi
+
+RAW_INPUT="$1"
+CLONE_DIR="${2:-paper-overleaf}"
+
+# Strip URL down to project ID
+PROJECT_ID="${RAW_INPUT##*/}"
+PROJECT_ID="${PROJECT_ID%%\?*}"
+if ! [[ "$PROJECT_ID" =~ ^[a-f0-9]{20,}$ ]]; then
+    echo "ERROR: project ID '$PROJECT_ID' does not look like an Overleaf project ID."
+    echo "       Expected a hex string of 20+ characters."
+    exit 1
+fi
+
+if [ -e "$CLONE_DIR" ]; then
+    echo "ERROR: '$CLONE_DIR' already exists. Remove it first or choose a different dir."
+    exit 1
+fi
+
+# ── Read token securely (no echo, never enters shell history) ─────────────────
+echo "Setting up Overleaf bridge for project $PROJECT_ID → ./$CLONE_DIR/"
+echo ""
+echo "Get a token at: https://www.overleaf.com/user/settings → Git Integration → Create Token"
+echo ""
+read -r -s -p "Paste Overleaf token (input hidden): " OL_TOKEN
+echo ""
+
+if [ -z "$OL_TOKEN" ]; then
+    echo "ERROR: empty token"
+    exit 1
+fi
+if [[ ! "$OL_TOKEN" =~ ^olp_[A-Za-z0-9]+$ ]]; then
+    echo "WARNING: token does not start with 'olp_' — proceeding but verify it's correct."
+fi
+
+# ── Clone with token in URL (transient) ───────────────────────────────────────
+echo "Cloning…"
+if ! git clone "https://git:${OL_TOKEN}@git.overleaf.com/${PROJECT_ID}" "$CLONE_DIR" 2>&1 \
+       | sed "s|${OL_TOKEN}|<TOKEN>|g"; then
+    unset OL_TOKEN
+    echo "ERROR: clone failed"
+    exit 1
+fi
+
+# ── Immediately strip token from remote URL ───────────────────────────────────
+cd "$CLONE_DIR"
+git remote set-url origin "https://git.overleaf.com/${PROJECT_ID}"
+
+# ── Configure credential helper ───────────────────────────────────────────────
+case "$(uname -s)" in
+    Darwin) HELPER=osxkeychain ;;
+    Linux)  HELPER=cache       ;;
+    MINGW*|MSYS*|CYGWIN*) HELPER=manager ;;
+    *)      HELPER=store       ;;
+esac
+git config --global credential.helper "$HELPER" 2>/dev/null || \
+    git config credential.helper "$HELPER"
+
+# ── Prime credential storage so future pull/push is auth-free ─────────────────
+git credential approve <<EOF
+protocol=https
+host=git.overleaf.com
+username=git
+password=${OL_TOKEN}
+
+EOF
+
+# ── Clear token from memory ───────────────────────────────────────────────────
+unset OL_TOKEN
+
+# ── Install hard-block pre-commit hook ────────────────────────────────────────
+HOOK_DIR=".git/hooks"
+mkdir -p "$HOOK_DIR"
+cat > "$HOOK_DIR/pre-commit" <<'HOOK'
+#!/usr/bin/env bash
+# Auto-installed by overleaf_setup.sh. Refuses to commit anything containing
+# what looks like an Overleaf token pattern. Cannot be bypassed by any agent
+# without --no-verify (which the ARIS protocol forbids without explicit user OK).
+set -e
+if git diff --cached | grep -qE 'olp_[A-Za-z0-9]{20,}'; then
+    echo "ERROR: Overleaf token pattern (olp_…) detected in staged changes."
+    echo "       Refusing to commit. Remove the token before committing."
+    echo "       Also revoke it at https://www.overleaf.com/user/settings"
+    exit 1
+fi
+HOOK
+chmod +x "$HOOK_DIR/pre-commit"
+
+# ── Verify token was actually stripped from remote ────────────────────────────
+if git remote -v | grep -qE 'olp_'; then
+    echo ""
+    echo "FATAL: token still present in remote URL after strip. Aborting."
+    cd .. && rm -rf "$CLONE_DIR"
+    exit 1
+fi
+
+# ── Set local commit identity (best-effort) ───────────────────────────────────
+if [ -z "$(git config user.email 2>/dev/null)" ]; then
+    GLOBAL_EMAIL="$(git config --global user.email 2>/dev/null || true)"
+    if [ -n "$GLOBAL_EMAIL" ]; then
+        git config user.email "$GLOBAL_EMAIL"
+    else
+        echo "NOTE: no git user.email set. Run:"
+        echo "    cd $CLONE_DIR && git config user.email <your-email>"
+    fi
+fi
+
+# ── Final report ──────────────────────────────────────────────────────────────
+cd ..
+echo ""
+echo "✅ Setup complete."
+echo ""
+echo "  Clone:        ./$CLONE_DIR/"
+echo "  Remote URL:   $(cd "$CLONE_DIR" && git remote get-url origin)   ← no token"
+echo "  Credential:   stored in $HELPER"
+echo "  Pre-commit:   installed (blocks olp_… patterns)"
+echo ""
+echo "From here on, agents can run pull/push against $CLONE_DIR/ without seeing a token."
+echo "If pull/push ever fails with 401, your token expired — re-run this script."

package/tools/paper_illustration_image2.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Legacy entry point — forwards to the canonical paper_illustration_image2.
+
+The canonical implementation now lives at
+    skills/paper-illustration-image2/scripts/paper_illustration_image2.py
+(Phase 3.2 — Arch C — self-contained single-owner helper).
+
+This shim keeps the four legacy resolver layers working without a
+re-install:
+
+  .aris/tools/paper_illustration_image2.py
+       → $ARIS_REPO/tools/paper_illustration_image2.py (this shim)
+       → $ARIS_REPO/skills/paper-illustration-image2/scripts/paper_illustration_image2.py
+
+  tools/paper_illustration_image2.py (in-repo run)
+       → this shim → canonical
+
+  $ARIS_REPO/tools/paper_illustration_image2.py (env-var)
+       → this shim → canonical
+
+  Manual <project>/tools/paper_illustration_image2.py copies of the
+  pre-Phase-3.2 file continue to work standalone (no shim semantics
+  needed; the canonical script is self-contained).
+
+`os.execv` replaces the current Python process so the canonical
+helper sees its own `__file__` and computes paths relative to itself,
+not relative to this shim.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+REPO_ROOT = HERE.parent
+REAL = REPO_ROOT / "skills" / "paper-illustration-image2" / "scripts" / "paper_illustration_image2.py"
+
+
+def _fail(msg: str) -> int:
+    sys.stderr.write(msg + "\n")
+    return 1
+
+
+def main() -> int:
+    if not REAL.is_file():
+        return _fail(
+            f"ERROR: canonical paper_illustration_image2.py not found at {REAL}.\n"
+            "       The Phase 3.2 migration moved this helper into the\n"
+            "       /paper-illustration-image2 SKILL\n"
+            "       ('skills/paper-illustration-image2/scripts/'). Your\n"
+            "       local checkout may be incomplete — try `git pull` from the\n"
+            "       ARIS repo, or rerun `bash tools/install_aris.sh` to refresh\n"
+            "       the project-local symlink chain."
+        )
+    os.execv(sys.executable, [sys.executable, str(REAL), *sys.argv[1:]])
+    return 0  # unreachable; os.execv does not return on success
+
+
+if __name__ == "__main__":
+    sys.exit(main())