dsh-aris-panel 0.1.0

package/skills/shared-references/acceptance-gate.md

@@ -0,0 +1,324 @@
+# Acceptance-Gate Provenance
+
+## Core Principle
+
+**An autonomous loop's STOP/ACCEPT gate determines whether the loop is
+same-family-safe. The thing being judged at that gate — not the loop's
+subject matter, not how many agents ran — decides whether Claude may
+judge it.**
+
+ARIS has loops that keep working until a condition is met: `/auto-review-loop`,
+`/dse-loop`, the `/experiment-bridge` auto-debug cycle, the
+`/auto-paper-improvement-loop`, and any future "keep going until X"
+skill. Every such loop terminates on a gate it evaluates each iteration:
+"are we done yet?" That gate is where same-family self-acquittal sneaks
+in. The loop body can be all Claude; the **gate** is what this contract
+governs.
+
+This is `reviewer-independence.md` and `experiment-integrity.md` applied
+to the temporal/iterative case: those two cover single-shot review and
+single-shot experiment judging; this one covers the *recurring verdict*
+a loop makes on itself, round after round, with no human in between.
+
+One-liner, and the whole doc in seven words:
+
+> **A goal/loop can DRIVE; it cannot ACQUIT.**
+
+The loop may freely *drive* itself toward a target — schedule the next
+config, recompile, re-run the failed job, spawn ten search branches.
+What it may not do is *acquit* its own work — declare the paper good,
+the proof valid, the claim supported, the idea novel, the review
+satisfied. Acquittal is a cross-model act.
+
+## The two gate types
+
+Classify **every** stop/accept gate of a loop as exactly one of these.
+There is no third bucket; if a gate seems to be both, it is two gates
+and you split it (see "Compound gates" below).
+
+### Type-A — EXECUTION / OBJECTIVE gate
+
+A machine-checkable or externally-observable signal of *what happened*,
+with no judgment of *merit*. Claude **MAY** self-judge Type-A gates —
+it is execution bookkeeping, not a verdict.
+
+A gate is Type-A iff a non-LLM process (a shell exit code, a stat on the
+filesystem, a counter, a parser reading a benchmark's own output) could
+in principle answer it with the same answer Claude gives.
+
+- ✅ exit code == 0
+- ✅ `figures/result.png` exists / `paper/main.pdf` compiled (LaTeX returned 0)
+- ✅ N/N jobs finished (queue drained)
+- ✅ test suite passed (pytest exit 0)
+- ✅ the reviewer **was invoked** (a `codex` thread returned, a JSON verdict file exists)
+- ✅ all checklist items were **attempted** (each row touched)
+- ✅ no `NaN` in the loss log / training reached `max_steps`
+- ✅ the benchmark harness emitted a number and it parsed
+- ✅ PATIENCE/TIMEOUT/MAX_ROUNDS budget exhausted (a counter hit its bound)
+
+Type-A gates are *coverage and completion* facts. Claude self-judging
+"did the audit run?" is fine; Claude self-judging "did the audit pass?"
+is not (that's Type-B).
+
+### Type-B — QUALITY / CORRECTNESS / ACCEPTANCE gate
+
+A judgment of *merit, correctness, or sufficiency*. Claude must
+**NEVER** self-judge a Type-B gate — it requires a **different model
+family** (per `reviewer-routing.md`: `codex` default, `oracle-pro` on
+request, or `manual` **only when** the human routes the prompt to a
+genuinely non-Claude model and records which one). This is the
+cross-model invariant, applied to the loop's terminating verdict.
+
+- ❌ "the paper is good" / "submission-ready"
+- ❌ "the proof is valid" / "the gap is closed"
+- ❌ "the claim is supported by the results"
+- ❌ "the idea is novel"
+- ❌ "the review is satisfied" / "the weaknesses are addressed"
+- ❌ "score >= 6" — when *Claude* assigned the score
+- ❌ "this config is good enough to publish" / "the result is strong"
+- ❌ "the rebuttal answers the reviewer"
+- ❌ "the fix is correct" (as opposed to "the fix made the test pass" — that's Type-A)
+
+A Type-B gate, left to the executor, is the loop quietly grading its own
+homework every round and stopping the moment it likes the grade. The
+fact that it ran a hundred iterations does not launder the verdict: a
+hundred rounds of Claude-judging-Claude is still one model family.
+
+### The dividing question
+
+> *Could a dumb script with no taste answer this gate?*
+>
+> **Yes → Type-A** (Claude may self-judge — it's bookkeeping).
+> **No, it needs taste / correctness / domain judgment → Type-B** (route to a different model family).
+
+"The PDF compiled" needs no taste — Type-A. "The PDF is a good paper"
+is nothing *but* taste — Type-B. "The job exited 0" — Type-A. "The job's
+output is the right answer" — Type-B.
+
+## Compound gates: split, don't average
+
+Many natural-language stop conditions secretly bundle an A-part and a
+B-part. `/auto-review-loop`'s real condition is *"score >= 6 AND verdict
+contains 'ready'"* evaluated each round — but the **score and the
+verdict both come from the cross-model reviewer**, so the A-part Claude
+owns is only "did round N's reviewer return?" and "is round < MAX_ROUNDS?".
+
+When you meet a compound gate, decompose it:
+
+```
+STOP when "the paper is submission-ready"
+  ├─ A: all 3 audits were invoked and emitted JSON   → Claude self-checks
+  ├─ A: verify_paper_audits.sh exit code == 0         → external process, Claude reads it
+  └─ B: "the paper is actually good enough to submit" → cross-model verdict
+```
+
+Never collapse a compound gate to its A-part and call the loop safe. The
+B-part doesn't disappear because it's inconvenient; it gets *routed*.
+
+## Decision procedure (for any new autonomous loop)
+
+When you author or review a "keep working until X" skill:
+
+1. **Enumerate every stop/accept gate.** Not just the headline one —
+   the early-exit on convergence, the PATIENCE bail-out, the
+   per-iteration "is this round done?" check, the final "are we
+   finished?" check. Write them down.
+
+2. **Classify each gate A or B** using the dividing question. If it's
+   compound, split it (above) and classify the parts.
+
+3. **For every Type-A gate:** Claude may self-judge. Prefer an
+   *external* check where one exists (read an exit code, stat a file,
+   read a counter) over an LLM "I believe it finished" — Type-A is
+   exactly the place where a cheap deterministic check beats a vibe.
+
+4. **For every Type-B gate:** route it to a cross-model verdict per
+   `reviewer-routing.md` (default `mcp__codex__codex` at
+   `reasoning_effort: xhigh`; `oracle-pro` on request; `manual` only if
+   the routed model is verifiably non-Claude and recorded — otherwise it
+   is same-family self-acquittal in disguise). Pass file paths, not
+   summaries (`reviewer-independence.md`).
+   The loop **continues or stops on the reviewer's verdict**, not on
+   Claude's reading of it. Save the verdict as an artifact
+   (`integration-contract.md` §3) so a third party can confirm the
+   acquittal was external.
+
+5. **State the provenance in the SKILL.** One line: "STOP gate = Type-B,
+   routed to codex." A reviewer of the SKILL should be able to find,
+   for each terminating condition, which model family signs off.
+
+6. **Refuse the anti-pattern:** a loop whose continue/stop decision reads
+   an LLM-produced quality verdict that the **same** model family
+   (Claude) produced. That is self-acquittal regardless of how the
+   prompt is phrased.
+
+Rule of thumb: **if removing the cross-model reviewer would still let
+the loop decide to stop, the loop is self-acquitting.** A safe Type-B
+loop is *designed* (by this contract) so that removing the external
+family's verdict leaves it unable to terminate-accept — a design rule
+the skill author enforces, not an automatic structural property.
+
+## ARIS loops mapped to the taxonomy
+
+The codebase **already** follows this rule. This section makes the
+implicit pattern explicit and operational for the next loop someone
+writes.
+
+| Loop | Headline stop gate | Type | Who acquits | Status |
+|---|---|---|---|---|
+| `/dse-loop` | objective metric converged / TIMEOUT / PATIENCE | A | benchmark harness emits the number; Claude reads & compares to budget | ✅ safe same-model |
+| `/experiment-bridge` auto-debug | "did it run / did it converge" (exit 0, no NaN, training started) | A | exit codes, log parse | ✅ safe same-model |
+| `/run-experiment`, `/experiment-queue` retry | job finished / OOM-retry exhausted / N jobs done | A | scheduler + exit codes | ✅ safe same-model |
+| `/auto-review-loop` | score >= 6 AND verdict "ready", per round | B | **codex** assigns score & verdict | ✅ already cross-model |
+| `/auto-paper-improvement-loop` | "review satisfied" (2 rounds) | B | **codex (GPT xhigh)** review | ✅ already cross-model |
+| `/result-to-claim` | `claim_supported ∈ {yes,partial,no}` + `integrity_status` | B | **codex** judges results vs claims | ✅ cross-model |
+| `/kill-argument` | rejection memo → defense, residual issues | B | two fresh **codex** threads | ✅ cross-model |
+| `/proof-checker` | each gap closed, per round | B | **codex** re-reviews each round | ✅ cross-model |
+| `/experiment-audit` | integrity verdict (fake GT, normalization fraud) | B | **codex** audits the eval code | ✅ cross-model |
+| `/paper-claim-audit` | every number matches result files | B | fresh zero-context **cross-model** reviewer | ✅ cross-model |
+| `/citation-audit` | every entry real & in-context | B | fresh **cross-model** reviewer | ✅ cross-model |
+| `/paper-writing` Phase 6 (submission) | `verify_paper_audits.sh` exit 0 | A (gate) **wrapping** B (the audits) | external verifier reads cross-model JSON | ✅ A-gate over B-verdicts |
+
+> 📌 The `/auto-review-loop` row reflects the skill's stop logic: `score >= 6`
+> AND verdict contains "ready"/"almost", evaluated each round. (Its `Constants`
+> block previously stated this with `OR` and a stale verdict vocabulary — an
+> internal inconsistency now reconciled to the `AND` form the Phase-E stop
+> check actually uses, in `auto-review-loop` and its `-llm`/`-minimax`
+> siblings.) The acquittal is **codex's** score+verdict, so the Type-B
+> classification is unchanged.
+
+Two patterns to notice:
+
+- **The execution loops (dse, auto-debug, queue) are Type-A all the way
+  down** — "did it run / did it converge" is a fact a harness reports.
+  They are *correctly* allowed to self-acquit, because there is nothing
+  of merit being judged: a converged number from a real simulator is an
+  observation, not an opinion. (The moment someone adds *"...and the
+  result is good enough to claim"* to a dse stop condition, that clause
+  is Type-B and must route out — see the dse caveat below.)
+
+- **Every quality/correctness loop already routes its acquittal to
+  codex.** Nothing here is new behavior; the doc names the rule the
+  codebase converged on so the next author doesn't have to rediscover it
+  by getting reviewed.
+
+### The dse-loop caveat (objective ≠ acceptance)
+
+`/dse-loop` optimizes a metric the benchmark *itself* produces (cycles,
+area, coverage). "Config B beats config A on the harness's own number"
+is Type-A — a parser, not Claude, owns it. But two adjacent judgments are
+Type-B and must NOT be folded into the loop's self-acquittal:
+
+- "this config is **good enough to ship/publish**" — sufficiency verdict.
+- "the benchmark/metric **is the right thing to optimize** / the result
+  **generalizes**" — correctness-of-framing verdict.
+
+So dse may self-terminate on *"best config found within budget"* (A), but
+the claim *"and this is a publishable result"* leaves the loop and goes
+through `/result-to-claim` (B). Driving the search is in-family; acquitting
+the science is not.
+
+## Tie to fan-out: breadth is same-family; the jury is not
+
+`fan-out-pattern.md` describes skill-layer fan-out — spawning multiple
+agents for breadth (parallel search branches, per-section drafting,
+per-entry citation checks). Fan-out interacts with this contract in
+exactly one dangerous way:
+
+**Same-family breadth is fine for Type-A coverage. It is NEVER a Type-B
+jury.**
+
+- ✅ Ten Claude branches each *attempting* a different search query, then
+  unioning hits — Type-A coverage (did we look broadly?). Self-judged
+  fine.
+- ✅ N Claudes each drafting a section, a Type-A "all sections drafted"
+  completion check.
+- ❌ N Claude reviewers each scoring the paper, then taking the
+  **majority/average as the accept verdict.** This *feels* like a jury
+  — independent voters! — but it is correlated same-family blindness
+  wearing a jury costume. N agreeing Claudes share the same training
+  priors and the same blind spots; their agreement is evidence of
+  shared bias, not of correctness. A Type-B verdict needs a **different
+  family**, not a *bigger N of the same one*.
+
+> **Known failure mode:** "We ran the review 5× and all 5 said accept,
+> so it's robust." Five draws from one distribution is one opinion with
+> error bars, not five opinions. The cross-model invariant is about
+> *family diversity*, not *sample count*. Fan-out scales breadth and
+> Type-A coverage; it can never substitute for the one cross-family
+> acquittal a Type-B gate requires.
+
+Fan-out and this contract compose cleanly: fan-out (same family) does
+the broad *driving*; the loop always funnels into the identical
+cross-model *acquittal* at the Type-B gate. Breadth degrades gracefully
+across runtimes (fewer parallel agents = slower, not unsafe); the
+acquittal does not degrade — it is always the cross-family verdict, or
+the loop is unsafe.
+
+## Required components (for a loop to claim same-family-safe)
+
+A loop is same-family-safe iff **all** hold:
+
+1. **Every stop/accept gate is classified** A or B in the SKILL (compound
+   gates split).
+2. **Every Type-B gate routes to a cross-model verdict** per
+   `reviewer-routing.md`; the loop's continue/stop reads *that* verdict,
+   not a Claude re-judgment of it.
+3. **The cross-model verdict is an artifact** (`integration-contract.md`
+   §3) — a JSON/file a third party can inspect to confirm the acquittal
+   was external.
+4. **No same-family majority is treated as a Type-B jury** — fan-out
+   breadth never substitutes for cross-family acquittal.
+5. **Type-A self-judgment prefers an external check** (exit code, stat,
+   counter) over an LLM "I think it's done" wherever one exists.
+
+If any fails, the loop can self-acquit and is **not** same-family-safe —
+regardless of how many rounds it runs or how confident it sounds.
+
+## Anti-patterns to refuse in review
+
+- **"The loop decides when it's good enough."** Good-enough is Type-B;
+  the loop may decide when it's *done running*, not when it's *good*.
+- **"We re-review until it passes."** Fine — but *who* says it passed? If
+  the answer is Claude, the loop is self-acquitting.
+- **"N agreeing agents = consensus."** Same-family agreement is correlated
+  blindness, not a jury (see fan-out section).
+- **"It converged, so it's correct."** Convergence is Type-A
+  (it stopped moving); correctness/sufficiency is Type-B.
+- **"Score >= 6, so stop."** Only safe if a *different family* assigned
+  the score. Claude scoring Claude and stopping at 6 is self-acquittal.
+- **`/loop` wrapping an internal semantic loop.** External cadence
+  (`/loop`) is additive only for external-world waits (GPU done?
+  overnight heartbeat?). Wrapping ARIS's internal semantic loops with a
+  timer breaks `threadId` continuity and re-runs Type-B verdicts on a
+  clock instead of on the reviewer's turn — noise at best, a corrupted
+  acquittal at worst. Keep external cadence outside the acceptance gate.
+
+## Epistemic status of a PASS
+
+A cross-model PASS is a **heterogeneous second opinion**, not external ground truth. Its
+value is specific and bounded: a reviewer from a different model family breaks *correlated*
+blind spots — the executor's own failure modes it cannot see in itself — so a PASS means
+"a differently-built model, reading the artifact cold, did not find the flaw the author
+would miss." It does **not** mean the work is correct, novel, publishable, or that a venue
+will accept it. Same-family review (Claude judging Claude) does not even clear that bar,
+which is why the jury must be cross-family.
+
+Treat a PASS as the strongest *automatable* heterogeneous quality check this framework has, then keep the human in the loop for
+what no in-framework verdict can supply: updated literature, venue taste, and ground truth.
+A green gate lowers risk; it does not transfer accountability.
+
+## See Also
+
+- `reviewer-independence.md` — the single-shot form: executor never
+  filters the reviewer's inputs. Type-B gates inherit this in full.
+- `experiment-integrity.md` — the experiment form: the model that writes
+  experiment code must not judge its integrity. `/experiment-audit`'s
+  Type-B verdict is the loop instance of this rule.
+- `reviewer-routing.md` — where Type-B gates send their verdict (codex
+  default, oracle-pro on request, manual only with a verified non-Claude
+  target).
+- `fan-out-pattern.md` — breadth via same-family spawn; this doc's
+  fan-out section is the guardrail that keeps breadth out of the jury box.
+- `integration-contract.md` §3 — the cross-model verdict must leave an
+  inspectable artifact.

package/skills/shared-references/assurance-contract.md

@@ -0,0 +1,248 @@
+# Assurance Contract
+
+ARIS audits emit machine-readable verdicts. The `assurance` axis decides whether
+those verdicts are advisory (draft mode) or load-bearing gates (submission mode).
+This contract is referenced by `paper-writing`, `paper-claim-audit`, `citation-audit`,
+`proof-checker`, and the external verifier (canonical name `verify_paper_audits.sh`;
+callers resolve the actual path via `integration-contract.md` §2).
+
+## Why a separate axis from `effort`
+
+Historically `effort` (lite/balanced/max/beast) was conflated with audit strictness.
+The result: `effort: beast` did not guarantee mandatory audits ran — phases were
+gated by content detectors (e.g. `if \begin{theorem} exists`) and could silently
+skip. A user reported `effort: beast` produced a "draft-quality" paper with all
+three submission-gate audits skipped.
+
+The fix is to split the concerns:
+
+| Axis | Controls | Default |
+|------|----------|---------|
+| `effort` | depth/cost (papers, rounds, ideation) | `balanced` |
+| `assurance` | audit strictness — silent-skip-allowed vs verdict-required | derived from `effort` (see mapping) |
+
+Override either independently: `— effort: balanced, assurance: submission` is
+legal and means "normal depth, but every audit must emit a verdict before
+finalization."
+
+## Assurance Levels
+
+### `draft` — current behavior, no breakage
+- Audits run only if their content detector matches.
+- Silent skip allowed.
+- `paper-writing` Phase 6 produces a final report regardless.
+- For: rapid iteration, exploratory drafts, early-stage research.
+
+### `submission` — load-bearing audits
+- All mandatory audits **must** emit a verdict (one of the 6 below).
+- Silent skip is **forbidden**.
+- `paper-writing` Phase 6 invokes `verify_paper_audits.sh` (resolved per
+  `integration-contract.md` §2); non-zero exit blocks Final Report.
+- The Final Report tags itself `submission-ready: yes/no` based on verifier output.
+- For: conference / journal submission, anything you'd put your name on.
+
+## Default Mapping (derived if `assurance` not given)
+
+| `effort` | implied `assurance` |
+|----------|---------------------|
+| `lite` | `draft` |
+| `balanced` | `draft` |
+| `max` | `submission` |
+| `beast` | `submission` |
+
+This means a user passing only `— effort: beast` automatically gets full audit
+enforcement — matching their intent ("turn everything up"). Users wanting
+strict audits at lower depth pass `— assurance: submission` explicitly.
+
+## Verdict State Machine
+
+Every mandatory audit must emit exactly one of these — never silent skip:
+
+| Verdict | Meaning | Audit ran? | Submission-blocking? |
+|---------|---------|-----------|----------------------|
+| `PASS` | All checks passed | Yes | No |
+| `WARN` | Issues found, none disqualifying | Yes | No |
+| `FAIL` | Disqualifying issues found | Yes | **Yes** |
+| `NOT_APPLICABLE` | Detector negative; nothing to audit (e.g., no theorems in paper, no `\cite`s, no numeric claims) | Audit phase ran, child audit invocation may have been skipped | No |
+| `BLOCKED` | Audit should apply but prerequisites are missing or unsupported (e.g., paper has numeric claims but no `results/` directory; paper cites references but `.bib` missing) | Could not complete | **Yes** |
+| `ERROR` | Audit invocation failed (network, timeout, malformed reviewer output) | Attempted but errored | **Yes** at submission |
+
+### Why `NOT_APPLICABLE` is not the same as `SKIP`
+
+`NOT_APPLICABLE` means **the audit phase ran**, the detector returned negative,
+and a verdict artifact was written documenting "we checked, there's nothing to
+verify." This is verifiable from outside the LLM — the artifact file exists.
+
+A silent skip leaves no record. There's no way to distinguish "we checked and
+there was nothing" from "we forgot." This contract makes that distinction
+mandatory.
+
+### Why `BLOCKED` is more dangerous than `NOT_APPLICABLE`
+
+`BLOCKED` means the audit *should* have run but cannot. Example: a paper claims
+`accuracy = 89.2%` but has no `results/` directory to verify against. That's not
+"nothing to audit" — that's "we cannot verify a load-bearing claim." Treating
+this as `SKIP` masks the danger; `BLOCKED` surfaces it and blocks submission.
+
+## Required Audit Artifact Schema
+
+Every mandatory audit must write a JSON artifact (and may also write a
+human-readable Markdown sibling). The JSON must contain at minimum:
+
+```json
+{
+  "audit_skill": "paper-claim-audit",       // citation-audit, proof-checker, etc.
+  "verdict": "PASS",                         // one of the 6 above
+  "reason_code": "all_numbers_match",        // skill-specific short string
+  "summary": "Verified 23 numeric claims against 4 result files; no mismatches.",
+  "audited_input_hashes": {
+    "main.tex":                          "sha256:a3f8...",
+    "sections/5.evidence.tex":           "sha256:b2d1...",
+    "/Users/me/project/results/run_2026_04_19.json": "sha256:c9e4..."
+  },
+  "trace_path": ".aris/traces/paper-claim-audit/2026-04-21_run01/",
+  "thread_id":  "019dae73-fc12-4ab8-...",
+  "executor_model": "claude-opus-4-8",
+  "executor_family": "anthropic",
+  "reviewer_model": "gpt-5.6-sol",
+  "reviewer_family": "openai",
+  "review_independence": "cross-family",
+  "acceptance_status": "accepted",
+  "reviewer_reasoning": "xhigh",
+  "generated_at": "2026-04-21T14:23:01Z",
+  "details": {
+    // skill-specific structured data
+  }
+}
+```
+
+Field semantics:
+
+- **`audited_input_hashes`** — SHA256 of every file the audit consumed.
+  - Keys are **paths relative to the paper directory** (the argument
+    passed to `verify_paper_audits.sh`) for files inside it, or
+    **absolute paths** for files outside it (e.g. `../results/run.json`
+    is legal but `/Users/me/project/results/run.json` is more portable).
+    Do NOT prefix in-paper files with `paper/` — the verifier already
+    resolves relative to the paper dir and `paper/paper/main.tex` will
+    false-fail. The verifier rehashes the current files and flags `STALE`
+    if any hash changed since the audit ran. (User edited `main.tex`
+    after running `paper-claim-audit`? The next verifier run will catch it.)
+- **`trace_path`** — directory containing the full reviewer prompt + response
+  pair, per `review-tracing.md`. Required for mandatory audits — not optional.
+- **`thread_id` or `agent_id`** — durable reviewer handle. MCP routes use a
+  thread ID; Codex `spawn_agent` routes use an agent ID. At least one is required.
+- **`reviewer_model`** + **`reviewer_reasoning`** — proves cross-family review
+  invariant was honored.
+- **`review_independence`** — `same-family`, `cross-family`, or `deterministic`.
+  `deterministic` is valid ONLY for what a process can actually decide
+  (compilation, schema validity, hash freshness, test suites) — the audit
+  aggregator REJECTS a deterministic label on the four semantic paper audits
+  (proof / claims / citations / attack), which only a cross-family model
+  review can accept.
+  **`acceptance_status`** is `provisional` for same-family review and
+  `accepted` for cross-family/deterministic review; neither field rewrites the
+  substantive verdict.
+- **`generated_at`** — UTC ISO-8601 timestamp.
+
+## Verifier Contract
+
+`verify_paper_audits.sh <paper-dir>` (canonical name; resolved per
+`integration-contract.md` §2) is the single source of truth for
+"are mandatory audits complete and current?" It must:
+
+1. Locate the paper-writing manifest (which mandatory audits applied this run).
+2. For each, check artifact JSON exists at expected path.
+3. Validate artifact JSON against required-fields schema (above).
+4. Verify `verdict` is one of the 6 allowed values.
+5. Recompute SHA256 of every file in `audited_input_hashes`; flag `STALE` if any
+   mismatches.
+6. Verify `trace_path` exists and is non-empty.
+7. Output a structured JSON report and exit 0 (all green) or 1 (any FAIL /
+   BLOCKED / ERROR / STALE / missing artifact).
+
+The report also emits `overall_assurance`: `blocked` for a blocking condition,
+`provisional` when green artifacts include same-family or legacy-unspecified
+review, and `accepted` only when all green artifacts are cross-family or
+deterministic. Provisional remains exit 0 but must never be presented as
+submission-ready yes.
+
+Phase 6 of `paper-writing` invokes the verifier; at `assurance: submission`,
+non-zero exit blocks Final Report generation.
+
+## Subskill Contract: "Always Emit, Never Block"
+
+Child audit skills (`paper-claim-audit`, `citation-audit`, `proof-checker`)
+follow this contract:
+
+- **Always emit a verdict artifact**, even on detector-negative or error paths.
+- **Never block** the parent's flow themselves — they only emit verdicts.
+- **The parent skill** (`paper-writing` Phase 6 + verifier) decides whether a
+  given verdict blocks finalization. This decision lives in *one* place
+  (`assurance` axis + verifier), not duplicated across child skills.
+
+Earlier wording in `paper-claim-audit` and `citation-audit` (e.g., "audit is
+advisory, never blocking") referred to this division of labor — but conflicted
+with `paper-writing`'s declaration that they were "mandatory submission gates."
+This contract resolves the conflict: child = always emit; parent = decides
+blocking based on assurance level.
+
+## Examples
+
+### Theory paper, beast effort
+```
+— effort: beast    (implies assurance: submission)
+```
+- `proof-checker` runs, audits theorems → `PASS` or `WARN` or `FAIL`
+- `paper-claim-audit` runs, finds numbers → `PASS`
+- `citation-audit` runs, audits refs → `PASS`
+- Verifier: all green
+- Final Report: `submission-ready: yes`
+
+### Position paper (no theorems, no numbers, no experiments), beast effort
+```
+— effort: beast    (implies assurance: submission)
+```
+- `proof-checker` invoked → no theorems found → emits `NOT_APPLICABLE`
+- `paper-claim-audit` invoked → no numeric claims → emits `NOT_APPLICABLE`
+- `citation-audit` invoked → audits refs → `PASS`
+- Verifier: all green (NOT_APPLICABLE is not blocking)
+- Final Report: `submission-ready: yes` with note "no theorems / no numeric claims to audit"
+
+### Empirical paper missing raw results, beast effort
+```
+— effort: beast
+```
+- `proof-checker` → `NOT_APPLICABLE`
+- `paper-claim-audit` invoked → finds claims like `accuracy = 89.2%` but
+  `results/` is empty → emits `BLOCKED` with reason_code `no_raw_evidence`
+- `citation-audit` → `PASS`
+- Verifier: exit 1 (BLOCKED is submission-blocking)
+- Final Report: **refuses to finalize**; surfaces "Mandatory audit BLOCKED:
+  paper-claim-audit cannot verify numeric claims — no raw result files found.
+  Add results/ or downgrade to `— assurance: draft`."
+
+### Stale audit (user edited paper after running audits)
+- User runs `/paper-writing` at beast → all audits PASS, files written
+- User edits `sec/5.evidence.tex` to change a number
+- User reruns the verifier (or re-finalizes)
+- Verifier rehashes → `audited_input_hashes` mismatch → `STALE` flag → exit 1
+- Final Report: refuses; instructs user to rerun `paper-claim-audit` and
+  `citation-audit` before re-finalizing.
+
+## Backward Compatibility
+
+- Users on `effort: balanced` (default) get `assurance: draft` — **identical
+  current behavior, no breakage**.
+- Users explicitly using `effort: max` or `effort: beast` automatically get
+  `assurance: submission` — matching their intent.
+- Users wanting the old "beast = depth only, no audit enforcement" can pass
+  `— effort: beast, assurance: draft` (explicit override). This combination is
+  legal but discouraged for actual submissions.
+
+## See Also
+
+- `effort-contract.md` — depth/cost axis (separate concern)
+- `review-tracing.md` — trace artifact protocol (referenced by `trace_path`)
+- `reviewer-independence.md` — cross-model review invariant
+- `tools/verify_paper_audits.sh` — external verifier implementation

package/skills/shared-references/capture-antipatterns.md

@@ -0,0 +1,78 @@
+# Capture Anti-patterns (anti-self-poisoning)
+
+When ARIS captures *durable* knowledge — a research-wiki idea / claim / experiment
+node, a `/meta-optimize` SKILL.md proposal — it must not store **operational
+noise** that later hardens into a self-cited falsehood. This is the failure mode
+Hermes's self-improvement loop hit and patched with a hand-written "Do NOT
+capture" list: negative tool-capability claims that *"harden into refusals the
+agent cites against itself for months after the actual problem was fixed."*
+ARIS's research-wiki "failed ideas → anti-repeat memory" is the GOOD inverse (a
+class-level *research* finding worth remembering); this is the blocklist for the
+BAD kind (transient *operational* state masquerading as a durable fact).
+
+## The four anti-patterns — do NOT capture
+
+| class | example (do NOT store) | store INSTEAD |
+|-------|------------------------|---------------|
+| **env-specific failure** | "pip failed: No module named torch", "command not found" | the fix / the missing dependency / the correct config |
+| **transient error** | "got a 429", "CUDA OOM", "connection refused" | nothing — it self-resolves; or the retry/backoff that worked |
+| **negative tool-capability claim** | "codex can't handle long files", "gemini is broken", "don't use oracle" | the workaround, or "needs flag X" — never "tool can't do Y" |
+| **single-instance narrative** | "in run 47 the loss spiked at step 300" | only the *class-level* rule it implies, if any ("LR > 3e-4 diverges on this model") |
+
+The cardinal rule: **store *how to fix* / *what config is missing* / *the
+workaround*, never *"X can't do Y"*.** A negative capability claim about your own
+tooling is the most dangerous capture — it gets loaded into every future session
+and the agent cites it against itself long after the real cause is gone.
+
+## Mechanical vs judgment
+
+- **Mechanical** (deterministic, `tools/capture_filter.py`): the unambiguous
+  classes — raw error output (`No module named`, `command not found`,
+  `ModuleNotFoundError`, `Permission denied`), transient errors (rate-limit / OOM
+  / network), and explicitly-broken-tool phrasing anchored on ARIS infrastructure
+  nouns (codex / gemini / oracle / the reviewer / the MCP / the CLI …).
+- **Judgment** (this doc): the single-instance-narrative class, and any operational
+  note dressed up as a finding. The agent applies this when deciding what to persist.
+
+The mechanical filter is **deliberately conservative**: it does NOT flag
+legitimate *research* findings about a model/method ("the model can't generalize
+to OOD", "our method fails on long sequences") — it targets ARIS's own *tooling*
+being declared broken, and raw error text. False negatives are fine (the jury
+still judges); a flagged note just goes to manual review / gets rewritten.
+
+## The asymmetry (acceptance-gate.md)
+
+This filter may **REJECT a capture same-model** — it is a mechanical safety screen,
+low risk, and same-model is always allowed to *reject*. But anything that **passes**
+the filter and would become a **load-bearing** skill/claim still goes to the
+**cross-model jury** before it is trusted. Same-model is fine to reject; it is
+never enough to *accept* into the load-bearing set.
+
+## Helper
+
+```
+from capture_filter import screen, reason_detail
+screen(text)  # -> [reason, ...]  ([] = clean);  reason ∈ {env_failure, transient_error, negative_tool_claim}
+```
+```
+python3 tools/capture_filter.py <file|->   # exit 1 + reasons if anti-pattern found
+```
+
+## Where ARIS uses it
+- **`/research-wiki`** (and `/idea-creator` Phase-3 annotations): screen an
+  idea/claim/experiment note before persisting it; if flagged, rewrite to the
+  fix or drop it — don't let operational noise become a durable node.
+- **`/meta-optimize`**: screen the rationale of a proposed SKILL.md change; never
+  propose a change that encodes a negative tool-capability claim or a one-off
+  failure as a durable rule.
+
+## Cross-references
+- `acceptance-gate.md` — the reject/accept asymmetry: same-model may reject, only
+  cross-model may accept into the load-bearing set.
+- `evidence-precheck.md` / `injection-hygiene.md` — sibling deterministic
+  pre-gates feeding the cross-model jury.
+
+> Anti-pattern taxonomy adapted from NousResearch/hermes-agent's background-review
+> "Do NOT capture" list (MIT). ARIS's increment: Hermes patches self-poisoning with
+> more self-judged prose; ARIS adds the deterministic screen + the cross-model
+> acceptance gate on anything that survives it.