medsci-skills 5.21.0 → 5.23.0

package/LICENSE

@@ -19,32 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
----
-
-## Third-Party Content Licenses
-
-The following reporting guideline checklists are bundled under their original licenses
-(NOT under MIT). See each file for attribution:
-
-- STROBE checklist: CC BY (https://www.strobe-statement.org)
-- STARD 2015 checklist: CC BY 4.0 (https://www.equator-network.org/reporting-guidelines/stard/)
-- TRIPOD+AI checklist: CC BY 4.0 (https://www.tripod-statement.org)
-- PRISMA 2020 checklist: CC BY (https://www.prisma-statement.org)
-- ARRIVE 2.0 checklist: CC0 (https://arriveguidelines.org)
-
-The following checklists are NOT bundled due to license restrictions.
-Users should download them directly from official sources:
-
-- CONSORT 2010: https://www.consort-statement.org (CC BY-NC)
-- CARE: https://www.care-statement.org
-- SPIRIT: https://www.spirit-statement.org (CC BY-NC-ND)
-- CLAIM 2024: https://pubs.rsna.org/doi/10.1148/radiol.2020200267
-
-## Optional Dependencies
-
-The following external packages are NOT bundled but may be installed separately by the user:
-
-- pymupdf4llm: AGPL-3.0 or Artifex Commercial License (https://pymupdf.readthedocs.io)
-  Used by: fulltext-retrieval/pdf_to_md.py (optional PDF→Markdown conversion)
-  Install: pip install pymupdf4llm

package/README.md

@@ -2,14 +2,14 @@
 
 # MedSci Skills
 
-**55 skills that actually work.** Built by a physician-researcher, tested on real publications.
+**58 skills that actually work.** Built by a physician-researcher, tested on real publications.
 
-*MedSci Skills is an end-to-end research tool for physician and medical-engineering researchers — design → scaffold → validate → publish — for the clinical manuscript and the medical-AI model behind it. Its moat is the compliance layer — 46 reporting guidelines and risk-of-bias tools, reference/citation verification, and deterministic integrity gates before peer review — now extended by a model-engineering lane that scaffolds reproducible, leakage-safe training repos and audits model validation. Clinical AI model research engineering is in scope; a general AI-scientist platform is not. It competes on clinical submission reliability, not skill count.*
+*MedSci Skills is an end-to-end research tool for physician and medical-engineering researchers — design → scaffold → validate → publish — for the clinical manuscript and the medical-AI model behind it. Its moat is the compliance layer — 47 reporting guidelines and risk-of-bias tools, reference/citation verification, and deterministic integrity gates before peer review — now extended by a model-engineering lane that scaffolds reproducible, leakage-safe training repos and audits model validation. Clinical AI model research engineering is in scope; a general AI-scientist platform is not. It competes on clinical submission reliability, not skill count.*
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Release](https://img.shields.io/github/v/release/Aperivue/medsci-skills?style=flat-square&color=blue)](https://github.com/Aperivue/medsci-skills/releases/latest)
 [![CI](https://img.shields.io/github/actions/workflow/status/Aperivue/medsci-skills/validate.yml?branch=main&style=flat-square&label=CI)](https://github.com/Aperivue/medsci-skills/actions/workflows/validate.yml)
-![Skills](https://img.shields.io/badge/Skills-55-brightgreen?style=flat-square)
+![Skills](https://img.shields.io/badge/Skills-58-brightgreen?style=flat-square)
 [![npm](https://img.shields.io/npm/v/medsci-skills?style=flat-square&label=npm&color=cb3837)](https://www.npmjs.com/package/medsci-skills)
 [![npm downloads](https://img.shields.io/npm/dw/medsci-skills?style=flat-square&label=npm%20downloads&color=cb3837)](https://www.npmjs.com/package/medsci-skills)
 [![Watch the 2-min intro](https://img.shields.io/badge/▶_Watch-2--min_intro-FF0000?style=flat-square&logo=youtube&logoColor=white)](https://youtu.be/MclQ_RIofpE)
@@ -92,6 +92,19 @@ cp -r medsci-skills/skills/* ~/.claude/skills/
 
 Restart Claude Code, then start with **`/orchestrate`** — it classifies your request and routes you to the right skill. Full install options (Codex, Cursor, individual skills) are in [Installation](#installation).
 
+### Install with `gh skill`
+
+MedSci Skills follows the [Agent Skills standard](https://agentskills.io), so GitHub CLI ≥ 2.90 can search, preview, and install any skill straight from this repo — no clone (a `gh` preview feature):
+
+```bash
+gh skill search medsci                                   # list the whole collection
+gh skill preview Aperivue/medsci-skills check-reporting  # read a skill before installing
+gh skill install Aperivue/medsci-skills check-reporting  # install just that one
+gh skill install --all Aperivue/medsci-skills            # or install every skill
+```
+
+Search by a skill's own name (`check-reporting`, `verify-refs`, `meta-analysis`) or by `medsci` to list them all — both return this repo directly. A broad topic word like `systematic review` is shared by hundreds of skills across GitHub, so add `--owner Aperivue` to see only ours.
+
 ### Install as a Claude Code plugin
 
 Prefer plugins? One line adds the marketplace; `/plugin` then lets you browse nine category plugins and enable the ones you want:
@@ -120,7 +133,7 @@ Install a single category and invoke its skills under that namespace:
 /medsci-analysis:analyze-stats
 ```
 
-All eight plugins share the same repository source, so this groups and enables skills by category — it is not a partial download. The marketplace tracks `main`, so a plugin's version is its git commit.
+All nine plugins share the same repository source, so this groups and enables skills by category — it is not a partial download. The marketplace tracks `main`, so a plugin's version is its git commit.
 
 **Want just one capability?** Two skills are also published as focused standalone repos (generated mirrors; this repo stays the source of truth), each installable on its own with `/plugin marketplace add Aperivue/<repo>`:
 
@@ -470,14 +483,14 @@ ma-scout -> search-lit -> fulltext-retrieval -> design-study ──> write-proto
 
 ### By research stage
 
-All 55 skills, grouped by where they fit in the clinical-manuscript and medical-AI lifecycle. Full descriptions are in the table below; one page per skill lives in the [per-skill reference](docs/skills/).
+All 58 skills, grouped by where they fit in the clinical-manuscript and medical-AI lifecycle. Full descriptions are in the table below; one page per skill lives in the [per-skill reference](docs/skills/).
 
 | Stage | Skills |
 |-------|--------|
 | 🔭 **Discover & scope** | `ma-scout` · `find-cohort-gap` · `search-lit` · `fulltext-retrieval` · `lit-sync` · `author-strategy` |
 | 📐 **Design & plan** | `design-study` · `calc-sample-size` · `define-variables` · `write-protocol` · `fill-protocol` · `design-ai-benchmarking` |
 | 🧹 **Data & analysis** | `deidentify` · `clean-data` · `generate-codebook` · `version-dataset` · `analyze-stats` · `batch-cohort` · `cross-national` · `replicate-study` |
-| 🤖 **Medical-AI model engineering** | `preprocess-imaging` · `architecture-zoo` · `model-scaffold` · `model-validation` · `model-evaluation` · `uncertainty-imaging` · `explainability` · `radiomics-ml` · `model-card` · `mllm-eval` |
+| 🤖 **Medical-AI model engineering** | `profile-imaging` · `preprocess-imaging` · `architecture-zoo` · `model-scaffold` · `model-validation` · `model-evaluation` · `uncertainty-imaging` · `explainability` · `radiomics-ml` · `model-card` · `mllm-eval` |
 | ✍️ **Write & visualize** | `write-paper` · `make-figures` · `review-paper` · `present-paper` · `humanize` · `polish-language` · `academic-aio` |
 | ✅ **Comply & verify** | `check-reporting` · `self-review` · `verify-refs` · `manage-refs` |
 | 📤 **Submit & respond** | `find-journal` · `add-journal` · `sync-submission` · `revise` · `peer-review` · `fill-icmje-coi` |
@@ -492,13 +505,14 @@ All 55 skills, grouped by where they fit in the clinical-manuscript and medical-
 | **search-lit** | PubMed + Semantic Scholar + bioRxiv search with anti-hallucination citation verification. Token-efficient error handling -- CrossRef failures are silently batched, not repeated. BibTeX output tags each entry with `verified`/`verified_by`/`verified_on` fields so downstream skills can trust the citation provenance. |
 | **verify-refs** | Pre-submission reference audit for `.md`, `.docx`, `.bib`, or `.tsv` inputs. Extracts references, verifies DOI/PMID via CrossRef/PubMed when available, and writes `qc/reference_audit.json` as the sole output — row-level status (OK / MISMATCH / UNVERIFIED / FABRICATED) lives inside the JSON `records[]` block. `/search-lit` produces candidate BibTeX; `/lit-sync` owns `manuscript/_src/refs.bib`. |
 | **fulltext-retrieval** | Batch open-access PDF downloader. Unpaywall → PMC → OpenAlex → CrossRef pipeline. OA-only -- no paywall bypass. Input: DOI list or TSV. Optional PDF→Markdown conversion via [pymupdf4llm](https://pymupdf.readthedocs.io/en/latest/pymupdf4llm/) for token-efficient LLM analysis of academic papers. |
-| **check-reporting** | Manuscript compliance audit against 46 reporting guidelines and risk of bias tools (STROBE, STROBE-MR, RECORD, STARD, STARD-AI, TRIPOD, TRIPOD+AI, TRIPOD-LLM, PGS-RS, CHEERS 2022, CROSS, SRQR, COREQ, PRISMA, PRISMA-DTA, PRISMA-P, PRISMA-ScR, MOOSE, ARRIVE, CONSORT, CONSORT-AI, CARE, SPIRIT, SPIRIT-AI, CLAIM, DECIDE-AI, SQUIRE 2.0, CLEAR, GRRAS, MI-CLEAR-LLM, SWiM, AMSTAR 2, QUADAS-2, QUADAS-C, RoB 2, ROBINS-I, ROBINS-E, ROBIS, ROB-ME, PROBAST, PROBAST+AI, NOS, COSMIN, RoB NMA). Machine-readable JSON summary with `compliance_pct` and `fixable_by_ai` flags for automated pipeline integration. |
+| **check-reporting** | Manuscript compliance audit against 47 reporting guidelines and risk of bias tools (STROBE, STROBE-MR, RECORD, GATHER, STARD, STARD-AI, TRIPOD, TRIPOD+AI, TRIPOD-LLM, PGS-RS, CHEERS 2022, CROSS, SRQR, COREQ, PRISMA, PRISMA-DTA, PRISMA-P, PRISMA-ScR, MOOSE, ARRIVE, CONSORT, CONSORT-AI, CARE, SPIRIT, SPIRIT-AI, CLAIM, DECIDE-AI, SQUIRE 2.0, CLEAR, GRRAS, MI-CLEAR-LLM, SWiM, AMSTAR 2, QUADAS-2, QUADAS-C, RoB 2, ROBINS-I, ROBINS-E, ROBIS, ROB-ME, PROBAST, PROBAST+AI, NOS, COSMIN, RoB NMA). Machine-readable JSON summary with `compliance_pct` and `fixable_by_ai` flags for automated pipeline integration. |
 | **analyze-stats** | Statistical analysis code generation (Python/R) for diagnostic accuracy, DTA meta-analysis (bivariate/HSROC), inter-rater agreement, survival analysis, demographics tables, regression (logistic/linear), propensity score (matching/IPTW/overlap weighting), and repeated measures (RM ANOVA/GEE/mixed models). Calibration mandatory for prediction models. |
 | **meta-analysis** | Full systematic review and meta-analysis pipeline (8 phases). DTA (bivariate/HSROC) and intervention meta-analysis. Protocol to submission-ready manuscript with PRISMA-DTA compliance. |
 | **make-figures** | Publication-ready figures and visual abstracts: ROC curves, forest plots, PRISMA/CONSORT/STARD flow diagrams, Kaplan-Meier curves, Bland-Altman plots, confusion matrices, and journal-specific visual/graphical abstracts (python-pptx template-based). Communication-first design principles (Nat Hum Behav 2026 — key message, audience, cognitive load, figure-vs-table decision) and five flow-diagram production lessons (official-template fidelity, VML fallback PDF export, docx XML escape, sequential placeholder mapping, version freeze); critic rubric Section G adds 5 communication-first checks. `--study-type` auto-generates the full required figure set; structured `_figure_manifest.md` output for downstream pipeline consumption; D2 enforced as default for flow diagrams. |
 | **design-study** | Study design review: identifies analysis unit, cohort logic, data leakage risks, comparator design, validation strategy, and reporting guideline fit. |
 | **design-ai-benchmarking** | Design and validity review for benchmarking AI system(s) against a human-expert panel: evaluation-question and arm definition, decoupled multi-dimensional rubrics with anchors, planted calibration probes (positive-control / known-bad / instability / mechanism-contradiction), reviewer-panel construction with per-reviewer randomization, inter-rater reliability targets with separate control-item reliability, LLM-as-judge vs human-as-judge adjudication, construct-independence guards, and a structured JSON rating-export schema. Locks the rubric before data collection. |
 | **model-validation** | Design or audit the clinical-validation study for an engineer-built medical-imaging model (segmentation / classification / detection): patient-level split disjointness and the data-leakage taxonomy, tuning-on-test, internal vs genuine external validation, comparator design, single-run vs multi-seed variance, task-correct metric selection (Metrics Reloaded), test-set sizing, and CLAIM 2024 / TRIPOD+AI / STARD-AI reporting fit. Ships a deterministic split-leakage gate that proves patient disjointness by set arithmetic on the emitted split table. Integrates with MONAI / nnU-Net — does not replace them. |
+| **profile-imaging** | Profile a medical-imaging dataset before any modelling decision — acquisition grid, voxel spacing and orientation spread, intensity domain, the label values actually present, foreground fraction and target volume — then gate that profile against the declared plan. Catches, while it is still cheap, what otherwise surfaces after a training run: a "test set" carrying no ground truth (`TEST_SET_UNLABELLED`), a label grid that does not match its image (`LABEL_SHAPE_MISMATCH`), a stray label index (`LABEL_VALUE_UNEXPECTED`), accuracy planned against a sliver-sized target (`ACCURACY_UNDER_IMBALANCE`), and acquisition heterogeneity with no declared resampling decision (`SPACING_HETEROGENEOUS`). The gate flags an *undeclared* decision, not variability itself. |
 | **preprocess-imaging** | Design or audit the data-preparation stage of a medical-imaging model — DICOM/NIfTI intake, resampling, intensity normalization, and the augmentation plan — so the pipeline is leakage-safe before `model-scaffold` builds the training repo. Emits a declarative preprocessing manifest and a deterministic data-stage leakage gate (`check_preprocessing_leakage`) that catches what the split table cannot see: a dataset-level normaliser fit on non-train data (`NORMALIZATION_LEAKAGE`), a data-fitted transform run before the split (`PREPROCESS_BEFORE_SPLIT`), and a patient's slices crossing splits (`PATIENT_CROSS_SPLIT`). Integrates MONAI / TorchIO transforms; never reimplements them or touches real patient data. |
 | **model-scaffold** | Generate a reproducible, runnable PyTorch training repo for a medical-imaging task — segmentation (U-Net), classification, detection, image-to-image synthesis, self-supervised pretraining, or fine-tuning a pretrained backbone (transfer learning) — the missing middle link between choosing an architecture and validating a trained model. Emits a patient-level seed-locked split as an auditable artifact, a task-appropriate model, train/evaluate scripts that seed every RNG and infer under eval mode, a config, requirements, a reproducibility record, and a Methods stub with VERIFY placeholders (no fabricated numbers). Fine-tuning mode (`--task finetune`) adds a frozen→unfrozen schedule, discriminative learning rates, and a pretrained-weight provenance record (`PRETRAINED.md`), with a MedSAM-adaptation + train-only diffusion-augmentation guide. Reproducibility holds by construction; ships a `check_training_hygiene` AST gate (RNG seeding, eval-mode inference, train-split-only loaders, pretrained-provenance) + a network-free build→validate challenge. Integrates with MONAI / nnU-Net / TorchIO / timm / torchvision for production-grade models. |
 | **architecture-zoo** | "Which architecture for which research question" decision tool: maps task (classification / segmentation / detection / transfer), modality, data scale, and class imbalance to a paper-grounded architecture shortlist. Curates the foundational curriculum (ResNet / DenseNet / EfficientNet / ViT / Swin; U-Net / 3-D U-Net / Attention & Residual U-Net / nnU-Net / Mask R-CNN; SAM/MedSAM / TotalSegmentator / BiomedCLIP / DINO / MAE / SimCLR) — each with core idea, when-to-use, medical-imaging use, reference implementation, validation setup, and the matching model-scaffold template. Advisory; teaches archetypes, not a live SOTA leaderboard. |
@@ -603,6 +617,19 @@ npx medsci-skills doctor             # quick Node/Python/skill-folder check
 
 Requires Node 18+ and (for `install`/`doctor`) `python3` on your PATH.
 
+### Option 5: GitHub CLI (`gh skill`)
+
+If you use [GitHub CLI](https://cli.github.com/) ≥ 2.90, `gh skill` installs skills from any Agent-Skills repo — this one included — without cloning. It is a `gh` **preview** feature, so the exact flags may change.
+
+```bash
+gh skill search medsci                                   # list every MedSci skill
+gh skill preview Aperivue/medsci-skills check-reporting  # inspect one first
+gh skill install Aperivue/medsci-skills check-reporting  # install a single skill
+gh skill install --all Aperivue/medsci-skills            # or install all of them
+```
+
+`gh skill install` places skills in the host-specific folder for the agent you pick with `--agent` (`claude-code` → `~/.claude/skills/`, `codex` → `~/.agents/skills/`, and many others), at user or project `--scope` — the same folders the npx and git paths above populate. Discovery works best by a skill's exact name or by `medsci`; for a broad topic word, scope with `--owner Aperivue`.
+
 ### Platform notes
 
 - Claude Code: skills are copied to `~/.claude/skills/` (also read by GitHub Copilot and Cursor).
@@ -665,8 +692,8 @@ Projects declare their source-of-truth layout in `SSOT.yaml`, and a `qc/migratio
 ### Meta-Analysis Failure Modes
 `/meta-analysis` ships empirical failure-mode references (data integrity, review orchestration, submission package drift, post-submission release ops) with four automation hooks: `scripts/prisma_5way_consistency.py` (DI-6 PRISMA number consistency), `scripts/extraction_consensus_log_init.py` (DI-1 dual-extraction scaffold), `scripts/tag_cleanup_gate.sh` (DI-8 placeholder tag gate), and `scripts/verify_package_integrity.py` (SPD SHA-256 manifest for submission bundles).
 
-### 46 Reporting Guidelines & RoB Tools Built-in
-`check-reporting` includes bundled checklists for 46 guidelines and risk-of-bias tools: STROBE, STROBE-MR, RECORD, STARD, STARD-AI, TRIPOD, TRIPOD+AI, TRIPOD-LLM, PGS-RS, CHEERS 2022, CROSS, SRQR, COREQ, PRISMA 2020, PRISMA-DTA, PRISMA-P, PRISMA-ScR, MOOSE, ARRIVE, CONSORT, CONSORT-AI, CARE, SPIRIT, SPIRIT-AI, CLAIM, DECIDE-AI, SQUIRE 2.0, CLEAR, GRRAS, MI-CLEAR-LLM, SWiM, AMSTAR 2, QUADAS-2, QUADAS-C, RoB 2, ROBINS-I, ROBINS-E, ROBIS, ROB-ME, PROBAST, PROBAST+AI, NOS, COSMIN, RoB NMA. Includes Results/Discussion section boundary checks and machine-readable JSON summary for pipeline integration.
+### 47 Reporting Guidelines & RoB Tools Built-in
+`check-reporting` includes bundled checklists for 47 guidelines and risk-of-bias tools: STROBE, STROBE-MR, RECORD, GATHER, STARD, STARD-AI, TRIPOD, TRIPOD+AI, TRIPOD-LLM, PGS-RS, CHEERS 2022, CROSS, SRQR, COREQ, PRISMA 2020, PRISMA-DTA, PRISMA-P, PRISMA-ScR, MOOSE, ARRIVE, CONSORT, CONSORT-AI, CARE, SPIRIT, SPIRIT-AI, CLAIM, DECIDE-AI, SQUIRE 2.0, CLEAR, GRRAS, MI-CLEAR-LLM, SWiM, AMSTAR 2, QUADAS-2, QUADAS-C, RoB 2, ROBINS-I, ROBINS-E, ROBIS, ROB-ME, PROBAST, PROBAST+AI, NOS, COSMIN, RoB NMA. Includes Results/Discussion section boundary checks and machine-readable JSON summary for pipeline integration.
 
 ### Publication-Ready Output
 `analyze-stats` generates reproducible Python/R code for 13 analysis types -- including regression, propensity score, and repeated measures -- with mandatory calibration for prediction models. `make-figures` produces journal-specification figures (300 DPI, colorblind-safe palettes, proper dimensions), visual/graphical abstracts, and a tool selection guide (D2 for flow diagrams, matplotlib for data plots). `--study-type` auto-generates the complete figure set for each study design.
@@ -716,9 +743,33 @@ Prints a checklist showing which components are present, which are missing, and
 
 ## Requirements
 
+**Python 3.9+ and an agent host. That is the whole hard requirement.** Every integrity detector is
+stdlib-only, and so is drafting, reviewing, and auditing a manuscript. If you have no Python, the
+double-click installer will offer to install it for you (`winget` on Windows, or the official
+download page) rather than leaving you at a dead end.
+
 - An [Agent Skills](https://agentskills.io)-compatible host — [Claude Code](https://claude.ai/code) (primary), or Codex / Cursor / GitHub Copilot (see [`docs/host_compatibility.md`](docs/host_compatibility.md); some live-data workflows rely on Claude MCP servers)
-- Python 3.9+ (for statistical analysis and figure generation)
-- R 4.0+ with `meta` (>=7.0), `metafor` (>=4.0), `mada` (>=0.5.11) packages (for meta-analysis)
+- Python 3.9+ — the floor is CI-enforced (`scripts/check_python_floor.py`). Newer is better; if you are installing Python today, take the latest.
+
+Everything else is needed by *some* skills and not others. Rather than a shopping list of packages
+you have never heard of, ask the toolkit what **this** computer can do:
+
+```bash
+python3 installers/doctor.py          # what works, what does not, and the exact fix for each
+python3 installers/doctor.py --fix    # offers to install what is missing — asking before each one
+```
+(Or double-click `installers/check-setup-macos.command` / `installers/check-setup-windows.cmd`.)
+
+It reports in terms of what you were trying to *do* — "turn your manuscript into a journal-formatted
+Word file" needs **pandoc**; "read and QC submission PDFs" needs **poppler**; "open a .docx at all"
+needs **python-docx** — and installs the small things on request. Large things (a TeX distribution,
+R, PyTorch) are never installed for you: it prints the size and the command and leaves the choice
+alone.
+
+**R is not required.** `/analyze-stats` writes Python by default and only emits R if you ask it to;
+the toolkit itself never executes R. Install R (with `meta`, `metafor`, `mada` for meta-analysis)
+only if you want to run the R code it writes for you. The same is true of PyTorch and
+`/model-scaffold`: writing the training code needs nothing; running it needs torch.
 
 ## Use Cases
 
@@ -788,8 +839,32 @@ Or equivalently: `/write-paper --autonomous` if analysis and figures already exi
 
 ## Contributing
 
-Contributions are welcome — and most are **one small, self-contained file** that a
-template walks you through. You do not need to understand the whole pipeline to add value.
+**If you have already changed something on your own machine, `/contribute` will send it for you.**
+Most people who use this are clinicians, not git users: they add the journal they publish in, fix a
+checklist item that was wrong for their specialty, adapt a skill to their department — and the
+change dies on one laptop.
+
+```
+/contribute
+```
+
+It compares your installed skills against what was shipped, tells you exactly what you changed,
+**scans it for patient data, hospital names, IRB numbers and manuscript IDs** (that scan blocks, and
+it is the reason this is a skill and not a button), shows you every line that would leave your
+machine, and only then opens the pull request — you never type a git command. No GitHub CLI? It
+reaches the project as an issue instead.
+
+The same skill files a **false positive** ("this flagged my paper and it was wrong") or a failed
+step. That is not a lesser contribution: it is the only evidence anyone has of how a detector
+behaves on a real manuscript rather than a synthetic fixture.
+
+**You will not be nagged.** Reminders are off by default; the installer mentions the option once
+and then never again. `/contribute` only ever runs when you run it.
+
+---
+
+Contributions are also welcome the ordinary way — and most are **one small, self-contained file**
+that a template walks you through. You do not need to understand the whole pipeline to add value.
 Pick a [**good first issue**](https://github.com/Aperivue/medsci-skills/contribute), or start
 from one of these:
 
@@ -825,6 +900,24 @@ Community members who have reported, verified, or shaped the project are credite
 
 ## In the Wild
 
+### Cited in the literature
+
+**Chen, Wang & Qu (2026), *Recursive Self-Improvement in AI*** — [arXiv:2607.07663](https://arxiv.org/abs/2607.07663), a
+survey of **1,250 papers** — cites this project's methods paper
+([arXiv:2606.09500](https://arxiv.org/abs/2606.09500)) twice, as the reference for what fails when an AI
+audits its own scientific output, and names the approach taken here as the response:
+
+> "In regulated domains, **deterministic integrity gates are interposed** because 'self-critique
+> inherits the blind spots that produce confident fabrication'."
+> — §6.3 (quoting the methods paper; also cited in §5.3, on the self-confirming loop)
+
+That is the argument this repository is built on: a model asked to check its own work inherits the
+blind spots that produced the error, and a script that **recomputes** the number does not.
+
+Every citation we know of is logged in [`docs/citations.md`](docs/citations.md).
+
+### Adoption
+
 Adoption is tracked openly in [`IMPACT.md`](IMPACT.md) (stars, forks, traffic,
 release downloads — snapshotted weekly into [`metrics/traffic_log.csv`](metrics/traffic_log.csv))
 and academic use is logged in [`docs/citations.md`](docs/citations.md).
@@ -888,6 +981,8 @@ These skills are research productivity tools. They do **not** provide clinical d
 
 MIT License. See [LICENSE](LICENSE) for details.
 
+Some bundled material is **not** ours and is not MIT: the official guideline templates, the CSL citation styles, and a few checklist summaries carry their own terms — including CC BY-NC, which restricts commercial use. Those are indexed in [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md), which ships with every copy and is checked against the tree on every build.
+
 Bundled reporting guideline checklists retain their original Creative Commons licenses. See each checklist file for attribution.
 
 Optional dependency: `pdf_to_md.py` uses [pymupdf4llm](https://pymupdf.readthedocs.io) (AGPL-3.0). Not bundled -- installed separately by the user via `pip install pymupdf4llm`.

package/README_FIRST.md

@@ -25,3 +25,13 @@ an install log in this folder.
 4. Paste the same first test prompt above.
 
 If macOS blocks the file, right-click it, choose **Open**, and confirm once.
+
+## Licence
+
+MedSci Skills is MIT — see `LICENSE`.
+
+Some material bundled here is **not** ours and is not MIT. A few reporting-checklist
+summaries carry **CC BY-NC** terms, which permit use and redistribution **with attribution
+for non-commercial purposes only**; commercial use needs permission from the rights holders.
+The full index is in `THIRD-PARTY-NOTICES.md`, next to this file. Read it before using these
+skills in paid or commercial work.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,65 @@
+# Third-Party Content Licenses
+
+Parts of this package are not ours, and are bundled under their own licenses (NOT under MIT).
+This file is the index of them. It is checked against the tree on every build by
+`scripts/check_third_party_index.py` — a notices file that describes a package other than the one
+you downloaded is worse than no notices file at all.
+
+### Reporting guideline checklists — our summaries (`skills/*/references/checklists/*.md`)
+
+These are educational summaries written in our own words, each citing its source. They do not
+relicense the underlying guideline.
+
+- STROBE: CC BY (https://www.strobe-statement.org)
+- STARD 2015 / STARD-AI: CC BY 4.0 (https://www.equator-network.org/reporting-guidelines/stard/)
+- TRIPOD / TRIPOD+AI: CC BY 4.0 (https://www.tripod-statement.org)
+- PRISMA 2020 / PRISMA-DTA: CC BY (https://www.prisma-statement.org)
+- ARRIVE 2.0: CC0 (https://arriveguidelines.org)
+- CONSORT 2025, SPIRIT 2025: CC BY 4.0 (https://www.consort-spirit.org)
+
+**Non-commercial restrictions.** The following summaries derive from instruments whose materials are
+CC BY-NC, and are therefore free to use and redistribute **for non-commercial purposes with
+attribution**; commercial use requires permission from the rights holders:
+
+- CARE, MI-CLEAR-LLM, DECIDE-AI: CC BY-NC 4.0
+- CLAIM 2024: educational summary of an RSNA open-access checklist (© RSNA)
+
+See `skills/check-reporting/references/LICENSES.md` for the per-file detail.
+
+### Official guideline templates, verbatim (`skills/make-figures/templates/official/`)
+
+These are the guideline authors' own documents, redistributed unmodified:
+
+- CONSORT 2025 checklist + flow diagram (`.docx`): CC BY 4.0.
+  © 2025 Hopewell S et al. *BMJ* 2025;388:e081123. doi:10.1136/bmj-2024-081123
+- SPIRIT 2025 checklist + participant timeline (`.docx`): CC BY 4.0.
+  © 2025 Chan A-W et al. *BMJ* 2025;389:e081477. doi:10.1136/bmj-2024-081477
+- STARD 2015 checklist (`.docx`) and flow diagram (`.pdf`): CC BY 4.0.
+  Bossuyt PM et al. *BMJ* 2015;351:h5527
+- PRISMA 2020 flow diagrams (`.pptx`): built by us with
+  `skills/make-figures/scripts/build_prisma2020_template.py`, reproducing the published layout
+  (Page MJ et al. *BMJ* 2021;372:n71, Fig 1, CC BY 4.0)
+
+The CONSORT and SPIRIT **2025** updates are CC BY 4.0 — "unrestricted use, distribution, and
+reproduction in any medium, provided the original work is properly cited". Their 2010 / 2013
+predecessors were CC BY-NC / CC BY-NC-ND and could not have been bundled; this file said so for a
+long time after the 2025 versions had replaced them.
+
+### Citation styles (`skills/manage-refs/citation_styles/*.csl`)
+
+15 CSL files from the Citation Style Language project: **CC BY-SA 3.0**, unmodified, each retaining
+its own `<rights>` element. See `skills/manage-refs/NOTICE.md`.
+
+### Not bundled — download these yourself
+
+- **European Radiology graphical-abstract template** (`EURA-GA-Jan2025.pptx`):
+  https://www.springer.com/journal/330 — the journal's own file, with no license permitting
+  redistribution. `/make-figures` accepts it via `--template /absolute/path.pptx`.
+
+## Optional Dependencies
+
+The following external packages are NOT bundled but may be installed separately by the user:
+
+- pymupdf4llm: AGPL-3.0 or Artifex Commercial License (https://pymupdf.readthedocs.io)
+  Used by: fulltext-retrieval/pdf_to_md.py (optional PDF→Markdown conversion)
+  Install: pip install pymupdf4llm

package/installers/install-macos.command

@@ -1,4 +1,16 @@
 #!/usr/bin/env bash
+# MedSci Skills — double-click installer for macOS.
+#
+# The person running this is a clinician who double-clicked a file. Every failure must end in a
+# sentence they can act on — never a Python traceback, and never a silent "done" that installed
+# nothing. Two things had to change for that to be true:
+#
+#   * `python` is not necessarily Python 3. Handing the installer to whatever `command -v python`
+#     finds could hand it to a Python 2 that dies on the first f-string.
+#   * Python 3.8 is worse than Python 2, not better: install.py *parses* there, so instead of a
+#     clean "wrong version" it dies halfway through with a wall of traceback.
+#
+# So the interpreter is checked for a real version BEFORE anything runs.
 set -u
 
 cd "$(dirname "$0")/.."
@@ -6,23 +18,82 @@ cd "$(dirname "$0")/.."
 echo "MedSci Skills Installer for macOS"
 echo
 
+MIN_MAJOR=3
+MIN_MINOR=9
+
+usable() {  # true only if $1 is really Python >= 3.9
+  command -v "$1" >/dev/null 2>&1 || return 1
+  "$1" -c "import sys; raise SystemExit(0 if sys.version_info >= ($MIN_MAJOR, $MIN_MINOR) else 1)" \
+    >/dev/null 2>&1
+}
+
 PY=""
-if command -v python3 >/dev/null 2>&1; then
-  PY=python3
-elif command -v python >/dev/null 2>&1; then
-  PY=python
+for candidate in python3 python; do
+  if usable "$candidate"; then
+    PY="$candidate"
+    break
+  fi
+done
+
+if [ -z "$PY" ]; then
+  # "No Python" and "too old a Python" need different actions, and a clinician cannot be expected
+  # to work out which one they have from a version string.
+  if command -v python3 >/dev/null 2>&1 || command -v python >/dev/null 2>&1; then
+    # No pipe to `head` — an installer must not depend on tools that may not be on PATH in a
+    # stripped-down environment. `python --version` prints one line anyway.
+    FOUND="$( python3 --version 2>/dev/null || python --version 2>/dev/null )"
+    echo "The Python on this Mac is too old for MedSci Skills."
+    echo "  Found:  ${FOUND:-an older version}"
+    echo "  Needed: Python ${MIN_MAJOR}.${MIN_MINOR} or newer"
+  else
+    echo "Python was not found on this Mac."
+  fi
+  echo
+  echo "MedSci Skills is written in Python, so Python has to be on the computer first."
+  echo "It is free, official, and takes about two minutes."
+  echo
+  echo "  1. Download the latest Python for macOS  (the page opens by itself in a moment)"
+  echo "  2. Open the file you downloaded and click through the installer"
+  echo "  3. Double-click THIS installer again"
+  echo
+  echo "Nothing has been changed on your computer."
+  echo
+
+  # Open the page for them. Telling a clinician to "go to python.org" is a step they have to
+  # perform; opening it is a step they do not. `open` is standard on macOS, but never let a
+  # convenience break the message they still need to read.
+  if command -v open >/dev/null 2>&1; then
+    read -r -p "Press Enter to open the Python download page..."
+    open "https://www.python.org/downloads/" >/dev/null 2>&1 || \
+      echo "Could not open the page. It is at:  https://www.python.org/downloads/"
+  else
+    echo "The download page is at:  https://www.python.org/downloads/"
+  fi
+
+  echo
+  read -r -p "Press Enter to close..."
+  exit 1
 fi
 
-if [ -n "$PY" ]; then
-  "$PY" installers/install.py --target all --desktop-launcher
-  # Turn on the in-app "update available" reminder for this turnkey install so you are told when a
-  # new version is out (no terminal needed afterward). Best-effort; turn off later with
-  # `install.py --disable-update-notify` or MEDSCI_NO_UPDATE_CHECK=1.
-  "$PY" installers/install.py --enable-update-notify || true
-else
-  echo "Python was not found."
-  echo "Install Python 3 from https://www.python.org/downloads/ and run this installer again."
+"$PY" installers/install.py --target all --desktop-launcher
+STATUS=$?
+
+if [ "$STATUS" -ne 0 ]; then
+  echo
+  echo "The installation did not finish (it stopped with error $STATUS)."
+  echo "Nothing was left half-installed — the installer undoes its own work if it cannot complete."
+  echo
+  echo "If you tell us what the message above said, we can fix it:"
+  echo "  https://github.com/Aperivue/medsci-skills/issues/new"
+  echo
+  read -r -p "Press Enter to close..."
+  exit "$STATUS"
 fi
 
+# Turn on the in-app "update available" reminder for this turnkey install, so you are told when a
+# new version ships instead of staying on this one forever. Best-effort: a failure here is not a
+# failed install. Turn it off later with `install.py --disable-update-notify`.
+"$PY" installers/install.py --enable-update-notify >/dev/null 2>&1 || true
+
 echo
 read -r -p "Press Enter to close..."

package/installers/install-windows.cmd

@@ -1,30 +1,112 @@
 @echo off
-setlocal
+rem MedSci Skills - double-click installer for Windows.
+rem
+rem Windows is where most of these downloads go, and it has a trap the old script fell into.
+rem
+rem   THE MICROSOFT STORE STUB. On a Windows machine with no Python, `python` still EXISTS: it is an
+rem   App Execution Alias that opens the Microsoft Store. So `where python` succeeds, errorlevel is
+rem   0, the script cheerfully runs it -- and a Store page opens, nothing is installed, and the
+rem   installer reports it is done. The clinician is told everything worked and has nothing.
+rem
+rem   A TOO-OLD PYTHON. install.py PARSES on 3.8, so it does not fail cleanly: it dies partway
+rem   through with a traceback instead of saying "wrong version".
+rem
+rem So an interpreter is only accepted after it proves, BY RUNNING, that it is Python 3.9 or newer.
+rem Asking `where` only proves a name exists.
+setlocal EnableDelayedExpansion
 cd /d "%~dp0\.."
 
 echo MedSci Skills Installer for Windows
 echo.
 
-where py >nul 2>nul
-if %errorlevel%==0 (
-  py -3 installers\install.py --target all --desktop-launcher
-  rem Turn on the in-app "update available" reminder for this turnkey install (disable later with --disable-update-notify).
-  py -3 installers\install.py --enable-update-notify
-  goto done
+set "PY="
+
+rem The py launcher is the reliable path when it exists.
+py -3 -c "import sys; raise SystemExit(0 if sys.version_info >= (3, 9) else 1)" >nul 2>nul
+if !errorlevel!==0 set "PY=py -3"
+
+rem Fall back to `python` -- but only if it actually runs. The Store stub fails this test, which is
+rem the entire reason for testing instead of asking `where`.
+if not defined PY (
+  python -c "import sys; raise SystemExit(0 if sys.version_info >= (3, 9) else 1)" >nul 2>nul
+  if !errorlevel!==0 set "PY=python"
 )
 
-where python >nul 2>nul
-if %errorlevel%==0 (
-  python installers\install.py --target all --desktop-launcher
-  rem Turn on the in-app "update available" reminder for this turnkey install (disable later with --disable-update-notify).
-  python installers\install.py --enable-update-notify
-  goto done
+if not defined PY (
+  echo Python 3.9 or newer was not found on this computer.
+  echo.
+  echo MedSci Skills is written in Python, so Python has to be installed first.
+  echo It is free, official, and takes a couple of minutes.
+  echo.
+
+  rem winget ships with Windows 10 ^(1809+^) and Windows 11, so on most hospital machines Python can
+  rem simply be installed for the user -- no admin rights, no download page, no PATH checkbox to
+  rem miss. We ASK first: installing software on someone's computer without asking is not ours to do.
+  where winget >nul 2>nul
+  if !errorlevel!==0 (
+    echo This installer can install Python for you now, from the official Python
+    echo repository, into your own user account ^(no administrator password needed^).
+    echo.
+    set /p "DOIT=Install Python now? [Y/N] "
+    if /i "!DOIT!"=="Y" (
+      echo.
+      echo Installing Python. This takes a couple of minutes...
+      echo.
+      winget install --exact --id Python.Python.3.13 --scope user ^
+        --accept-source-agreements --accept-package-agreements
+      echo.
+      if !errorlevel!==0 (
+        echo Python is installed.
+        echo.
+        echo Windows only notices a new program in NEW windows, so this one cannot use it yet:
+        echo.
+        echo    ^>^>  Close this window and double-click the installer again.  ^<^<
+        echo.
+        echo Nothing else has been changed on your computer.
+        echo.
+        pause
+        exit /b 1
+      )
+      echo Python could not be installed automatically ^(error !errorlevel!^).
+      echo Use the download page instead - it is opening now.
+      echo.
+    )
+  )
+
+  echo   1. Download the latest Python for Windows ^(the page opens by itself in a moment^)
+  echo   2. Run the file you downloaded.
+  echo      IMPORTANT: on the FIRST screen, tick the box "Add python.exe to PATH"
+  echo      before pressing Install. It is easy to miss, and nothing works without it.
+  echo   3. Double-click THIS installer again.
+  echo.
+  echo If a Microsoft Store page opened when you tried Python before, that page is a
+  echo placeholder, not Python. Use python.org instead.
+  echo.
+  echo Nothing has been changed on your computer.
+  echo.
+  start "" "https://www.python.org/downloads/"
+  pause
+  exit /b 1
 )
 
-echo Python was not found.
-echo Please install Python 3 from https://www.python.org/downloads/ and run this installer again.
-echo.
+%PY% installers\install.py --target all --desktop-launcher
+if not !errorlevel!==0 (
+  set "RC=!errorlevel!"
+  echo.
+  echo The installation did not finish ^(it stopped with error !RC!^).
+  echo Nothing was left half-installed - the installer undoes its own work if it cannot complete.
+  echo.
+  echo If you tell us what the message above said, we can fix it:
+  echo   https://github.com/Aperivue/medsci-skills/issues/new
+  echo.
+  pause
+  exit /b !RC!
+)
+
+rem Turn on the in-app "update available" reminder for this turnkey install, so you are told when a
+rem new version ships instead of staying on this one forever. Best-effort: a failure here is not a
+rem failed install.
+%PY% installers\install.py --enable-update-notify >nul 2>nul
 
-:done
 echo.
 pause