paperlint 2.0.0

package/skills/research-ideate/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: research-ideate
+description: "Decide whether a research idea is worth doing at all — before any work goes into it. Use when someone has an idea and asks: is this worth pursuing, should we take it on, is it a paper or just a blog post, is there a quick minimal result that doesn't need a dramatic finding, will it pull us away from our main line of work. Returns a go / no-go verdict with the sharpest framing, the minimal finding and the kinds of venue that would take it. Judges the idea by what counts in a body of work: a peer-reviewed indexed publication, a reusable method or benchmark rather than a one-off \"tool X is bad\", onward citations rather than GitHub stars, and one connected line rather than scattered topics. Stage: conception, before find-venue and before any draft; hands off to find-venue, build-benchmark, draft-paper."
+allowed-tools: [Read, Write, Grep, Glob, Agent, Skill, Bash(node .claude/skills/paper-pipeline/scripts/announce.mjs:*), Bash(node .claude/skills/paper-pipeline/scripts/ledger.mjs:*)]
+---
+
+<!-- vigiles:sha256:f0ccfb74162bca40 compiled from skills/research-ideate/SKILL.md.spec.ts -->
+
+# research-ideate — is this idea worth a paper, and does the paper earn authorship credit?
+
+## Run me
+
+🔴 FIRST, before any other step:
+
+```
+node .claude/skills/paper-pipeline/scripts/announce.mjs research-ideate <dir>
+```
+
+An advisory pass cannot be observed failing — silence is both its error state and its normal
+state — so starting is an event, and events get written down.
+
+The `<dir>` argument is **optional in spirit**: this skill can run before a paper directory exists, so
+pass whichever directory the work lives in, or `.`. The ledger row is written either way, and a plain
+dot is more honest than an invented path.
+
+Runs BEFORE any effort is spent. An idea can be interesting and still be a bad *publication*
+investment — the wrong framing produces something un-publishable or un-citable, which counts for
+nothing toward a body of work. This skill kills those ideas early and reshapes the survivors into the framing
+that publishes. It does NOT do the venue search (that's `find-venue`) — it decides whether there's a
+paper worth taking to `find-venue` at all.
+
+Grounding for every judgment below: the authorship, judging and original-contribution criteria —
+what a reviewer of a body of work actually counts.
+
+## Score the idea on five axes
+
+Answer each explicitly. A "no" on (a) is a hard stop; a "no" on the rest is a reshape signal.
+
+**(a) Does it yield a PEER-REVIEWED, INDEXED publication?**
+This is the authorship criterion, full stop. The paper must land in indexed proceedings (ACM DL /
+IEEE Xplore / archival workshop proceedings). Peer-reviewed + indexed papers count
+**regardless of caliber** — conference and workshop proceedings qualify. There is **no
+approved-venue list** and **venue newness does not hurt** the authorship criterion (prestige is
+only a late-stage enhancer). So the bar here is binary: will
+this produce something that goes through peer review and gets indexed? A blog post, a preprint that
+never gets reviewed, or a non-archival talk = **no credit**. If the idea can't clear this, stop.
+
+**(b) Is the contribution a reusable METHOD/BENCHMARK, or a one-off result?**
+Reviewers accept methods and benchmarks; they reject "we ran tool X and it's bad." Name both framings:
+- **Weakest framing** — the bare result. "Coding agent X produces insecure code." Reads as a blog
+  post, doesn't generalize, dies in review, earns nothing citable.
+- **Strongest framing** — the reusable artifact. The *way you measured it*: a benchmark, a metric, a
+  probe, a protocol others can rerun against the next tool. That survives review AND gets cited when
+  someone applies it to tool Y. Pick the strongest framing before writing a line.
+
+**(c) Will it generate downstream CITATIONS / ADOPTION?**
+This is the original-contribution criterion, and it is read through **citations and adoption, NOT
+GitHub stars**. Ask: when the next person studies this space, must they cite or reuse this? A
+benchmark others rerun, a metric others report, a finding others build on — yes. A one-off teardown of
+one product — no. Methods/benchmarks (axis b) are exactly what earns this credit; scattered results do
+not.
+
+**(d) Is there a fast MVP finding — a "proof of method" that needs no scary result?**
+The idea should have a small first result that *validates the method itself*, independent of how
+dramatic the finding is. A **medium-severity finding is sufficient** if the method is the
+contribution. You do not need to prove the tool is catastrophically broken; you need to prove your
+measurement works and reveals something real. If the idea only pays off with a huge, hard-to-get
+result, it's slow and risky — reshape it toward a proof-of-method MVP.
+
+**(e) Does it stay in the researcher's coherent LANE?**
+**Name the lane explicitly** — the research area the existing corpus is already in. A
+connected corpus of papers in one lane beats scattered topics — review of a body of work rewards a
+sustained, coherent corpus, not a grab-bag. Score whether this idea deepens the existing corpus
+(good) or wanders into an unrelated field (weak, even if publishable). Same lane compounds; scattered
+does not.
+
+## Output
+
+Emit a compact verdict:
+1. **Go / No-go** — with the single reason. No-go if (a) fails, or if (b)+(c) can't be reshaped out of
+   blog-post territory.
+2. **Sharpest framing** — the one-sentence method/benchmark contribution, in its strongest form (the
+   thing every future reviewer will paraphrase back). This sentence is the seed for `draft-paper`.
+3. **The MVP finding** — the smallest proof-of-method result that validates the contribution;
+   explicitly note the minimum severity that suffices (usually: medium is enough).
+4. **2–3 candidate venue TYPES** — not specific venues (that's `find-venue`'s job), but the shape:
+   e.g. "security-of-AI-coding workshop @ a top-tier security conference," "SE-measurement workshop @
+   ASE/FSE," "eval/benchmark track." Hand these to `find-venue`.
+
+## Record the verdict
+
+🔴 LAST step, once the deliverable exists:
+
+```
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record research-ideate <dir> FINDING <count> <report-path>
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record research-ideate <dir> ABSTAINED <reason> "<one line>"
+```
+
+🔴 **There is no PASS**, so there is no way to write down "go" as a value. A clean go is the
+absence of findings across the axes, and whoever wants to call it a go says so themselves.
+
+**FINDING** — go with reshaping, where `<count>` is the number of axes that need it and
+`<report-path>` is the output. Add `--blocking` for a no-go: axis (a) is a hard stop, not a weight,
+and a no-go is the loudest finding this skill produces.
+**ABSTAINED** — `no-witness`: all axes were scored and none needed reshaping. `blocked`: the idea
+was too vague to score, which is a different thing from a no-go and must not be recorded as one.
+
+A recorded no-go is the cheapest artifact in this whole pipeline, and the one most often lost: an idea
+killed in conversation comes back three months later wearing a different name, and nothing in the repo
+remembers that it was already judged.
+
+## Rules
+- Axis (a) is a gate, not a weight — no indexed peer review, no idea. Everything else reshapes.
+- Never justify an idea by GitHub stars, demo virality, or "it'd be a great blog post." Those don't
+  count. Citations/adoption and indexed proceedings do.
+- Prefer the proof-of-method MVP over the heroic result — a shipped medium finding beats a stalled big
+  one, and it's what earns the credit on time.
+- Keep it in lane. If it's a great idea in the wrong field, say so and note it belongs elsewhere.
+- Don't invent numbers, severities, or venue names here — this is a framing pass, not a study.
+
+## Compose with
+- `find-venue` (downstream) — hand it the candidate venue types + the sharpest framing.
+- `build-benchmark` — the MVP finding usually IS a small benchmark; this skill scopes it.
+- `draft-paper` — the sharpest-framing sentence becomes the paper's one-contribution seed.
+- `plan-paper-timeline` — once go/no-go is "go," size the effort against a real deadline.
+
+## Provenance
+Both real papers passed this filter as **proof-of-method, medium-severity-is-sufficient** ideas in one
+lane:
+- **AgenticDev 2026 @ ASE — "Measuring the Wrong Number"** (~90%, submitted). The contribution was the
+  *measurement method*, not a verdict on one tool; a medium-severity finding was enough because the
+  reusable way-to-measure was the point. Stayed in the AI-assisted-SE reliability lane.
+- **AISec 2026 @ ACM CCS — "Safety Theater in Agentic Coding"** (~87–88%). Same shape at a security
+  bar: a reusable probe/finding about agentic coding safety, proof-of-method sufficient, squarely in
+  the security-of-AI-coding lane. Together the two form a *connected corpus* — exactly what axis (e)
+  rewards — rather than two scattered one-offs.

package/skills/research-ideate/SKILL.md.spec.ts

@@ -0,0 +1,152 @@
+// Compiled to SKILL.md by `vigiles compile`. Edit THIS file, never the markdown.
+//
+// Adopted 2026-08-17 (batch 3). Body carried over VERBATIM so the compiled diff shows
+// only what the compiler adds. No `disallowedTools` fence yet — the field landed on
+// `SkillSpec` in vigiles branch `claude/skill-disallowed-tools` and is not in a release
+// this repo installs, so writing one here would not compile.
+import { experimental_skill } from "vigiles/spec";
+
+export default experimental_skill({
+  name: "research-ideate",
+  description:
+    'Decide whether a research idea is worth doing at all — before any work goes into it. Use when someone has an idea and asks: is this worth pursuing, should we take it on, is it a paper or just a blog post, is there a quick minimal result that doesn\'t need a dramatic finding, will it pull us away from our main line of work. Returns a go / no-go verdict with the sharpest framing, the minimal finding and the kinds of venue that would take it. Judges the idea by what counts in a body of work: a peer-reviewed indexed publication, a reusable method or benchmark rather than a one-off "tool X is bad", onward citations rather than GitHub stars, and one connected line rather than scattered topics. Stage: conception, before find-venue and before any draft; hands off to find-venue, build-benchmark, draft-paper.',
+  tools: [
+    "Read",
+    "Write",
+    "Grep",
+    "Glob",
+    "Agent",
+    "Skill",
+    "Bash(node .claude/skills/paper-pipeline/scripts/announce.mjs:*)",
+    "Bash(node .claude/skills/paper-pipeline/scripts/ledger.mjs:*)",
+  ],
+  body: `
+# research-ideate — is this idea worth a paper, and does the paper earn authorship credit?
+
+## Run me
+
+🔴 FIRST, before any other step:
+
+\`\`\`
+node .claude/skills/paper-pipeline/scripts/announce.mjs research-ideate <dir>
+\`\`\`
+
+An advisory pass cannot be observed failing — silence is both its error state and its normal
+state — so starting is an event, and events get written down.
+
+The \`<dir>\` argument is **optional in spirit**: this skill can run before a paper directory exists, so
+pass whichever directory the work lives in, or \`.\`. The ledger row is written either way, and a plain
+dot is more honest than an invented path.
+
+Runs BEFORE any effort is spent. An idea can be interesting and still be a bad *publication*
+investment — the wrong framing produces something un-publishable or un-citable, which counts for
+nothing toward a body of work. This skill kills those ideas early and reshapes the survivors into the framing
+that publishes. It does NOT do the venue search (that's \`find-venue\`) — it decides whether there's a
+paper worth taking to \`find-venue\` at all.
+
+Grounding for every judgment below: the authorship, judging and original-contribution criteria —
+what a reviewer of a body of work actually counts.
+
+## Score the idea on five axes
+
+Answer each explicitly. A "no" on (a) is a hard stop; a "no" on the rest is a reshape signal.
+
+**(a) Does it yield a PEER-REVIEWED, INDEXED publication?**
+This is the authorship criterion, full stop. The paper must land in indexed proceedings (ACM DL /
+IEEE Xplore / archival workshop proceedings). Peer-reviewed + indexed papers count
+**regardless of caliber** — conference and workshop proceedings qualify. There is **no
+approved-venue list** and **venue newness does not hurt** the authorship criterion (prestige is
+only a late-stage enhancer). So the bar here is binary: will
+this produce something that goes through peer review and gets indexed? A blog post, a preprint that
+never gets reviewed, or a non-archival talk = **no credit**. If the idea can't clear this, stop.
+
+**(b) Is the contribution a reusable METHOD/BENCHMARK, or a one-off result?**
+Reviewers accept methods and benchmarks; they reject "we ran tool X and it's bad." Name both framings:
+- **Weakest framing** — the bare result. "Coding agent X produces insecure code." Reads as a blog
+  post, doesn't generalize, dies in review, earns nothing citable.
+- **Strongest framing** — the reusable artifact. The *way you measured it*: a benchmark, a metric, a
+  probe, a protocol others can rerun against the next tool. That survives review AND gets cited when
+  someone applies it to tool Y. Pick the strongest framing before writing a line.
+
+**(c) Will it generate downstream CITATIONS / ADOPTION?**
+This is the original-contribution criterion, and it is read through **citations and adoption, NOT
+GitHub stars**. Ask: when the next person studies this space, must they cite or reuse this? A
+benchmark others rerun, a metric others report, a finding others build on — yes. A one-off teardown of
+one product — no. Methods/benchmarks (axis b) are exactly what earns this credit; scattered results do
+not.
+
+**(d) Is there a fast MVP finding — a "proof of method" that needs no scary result?**
+The idea should have a small first result that *validates the method itself*, independent of how
+dramatic the finding is. A **medium-severity finding is sufficient** if the method is the
+contribution. You do not need to prove the tool is catastrophically broken; you need to prove your
+measurement works and reveals something real. If the idea only pays off with a huge, hard-to-get
+result, it's slow and risky — reshape it toward a proof-of-method MVP.
+
+**(e) Does it stay in the researcher's coherent LANE?**
+**Name the lane explicitly** — the research area the existing corpus is already in. A
+connected corpus of papers in one lane beats scattered topics — review of a body of work rewards a
+sustained, coherent corpus, not a grab-bag. Score whether this idea deepens the existing corpus
+(good) or wanders into an unrelated field (weak, even if publishable). Same lane compounds; scattered
+does not.
+
+## Output
+
+Emit a compact verdict:
+1. **Go / No-go** — with the single reason. No-go if (a) fails, or if (b)+(c) can't be reshaped out of
+   blog-post territory.
+2. **Sharpest framing** — the one-sentence method/benchmark contribution, in its strongest form (the
+   thing every future reviewer will paraphrase back). This sentence is the seed for \`draft-paper\`.
+3. **The MVP finding** — the smallest proof-of-method result that validates the contribution;
+   explicitly note the minimum severity that suffices (usually: medium is enough).
+4. **2–3 candidate venue TYPES** — not specific venues (that's \`find-venue\`'s job), but the shape:
+   e.g. "security-of-AI-coding workshop @ a top-tier security conference," "SE-measurement workshop @
+   ASE/FSE," "eval/benchmark track." Hand these to \`find-venue\`.
+
+## Record the verdict
+
+🔴 LAST step, once the deliverable exists:
+
+\`\`\`
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record research-ideate <dir> FINDING <count> <report-path>
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record research-ideate <dir> ABSTAINED <reason> "<one line>"
+\`\`\`
+
+🔴 **There is no PASS**, so there is no way to write down "go" as a value. A clean go is the
+absence of findings across the axes, and whoever wants to call it a go says so themselves.
+
+**FINDING** — go with reshaping, where \`<count>\` is the number of axes that need it and
+\`<report-path>\` is the output. Add \`--blocking\` for a no-go: axis (a) is a hard stop, not a weight,
+and a no-go is the loudest finding this skill produces.
+**ABSTAINED** — \`no-witness\`: all axes were scored and none needed reshaping. \`blocked\`: the idea
+was too vague to score, which is a different thing from a no-go and must not be recorded as one.
+
+A recorded no-go is the cheapest artifact in this whole pipeline, and the one most often lost: an idea
+killed in conversation comes back three months later wearing a different name, and nothing in the repo
+remembers that it was already judged.
+
+## Rules
+- Axis (a) is a gate, not a weight — no indexed peer review, no idea. Everything else reshapes.
+- Never justify an idea by GitHub stars, demo virality, or "it'd be a great blog post." Those don't
+  count. Citations/adoption and indexed proceedings do.
+- Prefer the proof-of-method MVP over the heroic result — a shipped medium finding beats a stalled big
+  one, and it's what earns the credit on time.
+- Keep it in lane. If it's a great idea in the wrong field, say so and note it belongs elsewhere.
+- Don't invent numbers, severities, or venue names here — this is a framing pass, not a study.
+
+## Compose with
+- \`find-venue\` (downstream) — hand it the candidate venue types + the sharpest framing.
+- \`build-benchmark\` — the MVP finding usually IS a small benchmark; this skill scopes it.
+- \`draft-paper\` — the sharpest-framing sentence becomes the paper's one-contribution seed.
+- \`plan-paper-timeline\` — once go/no-go is "go," size the effort against a real deadline.
+
+## Provenance
+Both real papers passed this filter as **proof-of-method, medium-severity-is-sufficient** ideas in one
+lane:
+- **AgenticDev 2026 @ ASE — "Measuring the Wrong Number"** (~90%, submitted). The contribution was the
+  *measurement method*, not a verdict on one tool; a medium-severity finding was enough because the
+  reusable way-to-measure was the point. Stayed in the AI-assisted-SE reliability lane.
+- **AISec 2026 @ ACM CCS — "Safety Theater in Agentic Coding"** (~87–88%). Same shape at a security
+  bar: a reusable probe/finding about agentic coding safety, proof-of-method sufficient, squarely in
+  the security-of-AI-coding lane. Together the two form a *connected corpus* — exactly what axis (e)
+  rewards — rather than two scattered one-offs.`,
+});

package/skills/research-ideate/research-ideate.eval.mjs

@@ -0,0 +1,19 @@
+/**
+ * research-ideate — the PAID tier: does this skill's description actually fire?
+ *
+ * COLOCATED ON PURPOSE (vigiles decides coverage by placement as of 2026-08-11).
+ * The prompts live in `.claude/lib/skill-trigger-cases.mjs` so all 21 cases
+ * are reviewed as one table where collisions between siblings are visible;
+ * copying them here would recreate the drift that rule exists to prevent.
+ *
+ * Measures recall (fires on its own territory) AND precision (stays quiet on a
+ * colliding sibling's territory), against the REAL `.claude` harness so the skill
+ * competes with every other installed description — an isolated run overstates
+ * recall and understates false positives.
+ *
+ * Costs money; not CI.
+ *   node .claude/skills/research-ideate/research-ideate.eval.mjs [trials]
+ */
+import { runSkillTriggerEval } from "../../lib/skill-eval-kit.mjs";
+
+await runSkillTriggerEval("research-ideate");

package/skills/research-ideate/research-ideate.harness.mjs

@@ -0,0 +1,23 @@
+/**
+ * research-ideate — the free, deterministic tier. No model, no network.
+ *
+ * COLOCATED ON PURPOSE. vigiles decides coverage by PLACEMENT as of 2026-08-11:
+ * a test that merely names a surface no longer counts, because that tier was
+ * crediting surfaces nothing touched. So each skill needs a file inside its own
+ * directory — this one.
+ *
+ * The assertions live in `.claude/lib/skill-checks.mjs` and are CALLED here with
+ * this skill's name. They are not copied: 22 copies of the same checks is the drift that
+ * module exists to avoid. (Until 2026-08-11 this was an env-var side channel into a
+ * 614-line file named after no surface; it is a function call now.)
+ *
+ * What this proves: this skill's frontmatter parses as strict YAML, its declared
+ * tool contract is sane, its pipeline wiring points at scripts that exist, and it
+ * announces/records under ITS OWN identity rather than a sibling's.
+ *
+ * What it does NOT prove: that the skill fires, or that its guidance produces a
+ * good result. Those need a real model — see `research-ideate.eval.mjs`.
+ */
+import { checkSkill } from "../../lib/skill-checks.mjs";
+
+await checkSkill("research-ideate");

package/skills/skill-contract.mutations.mjs

@@ -0,0 +1,179 @@
+/**
+ * skill-contract.mutations.mjs — the non-vacuity proof for the colocated skill harnesses.
+ *
+ * Run: `node skills/skill-contract.mutations.mjs` (~1 min; it rewrites each SKILL.md and restores
+ * it, so it is not part of the plain test run).
+ *
+ * ── WHY IT EXISTS, AND WHY IT ARRIVED WITH THE SKILLS ───────────────────────
+ * `scripts/run-mutations.mjs` refuses a repository where some `*.harness.mjs` is named by no
+ * battery, and the refusal is the whole argument of this package: silence is the success state of
+ * every check here, so «it passed» and «it cannot fail» are byte-identical from outside. The ten
+ * skill harnesses arrived on 2026-09-12 and were orphans the moment they landed — the guard said
+ * so on the first run, which is exactly what a guard is for.
+ *
+ * ── HOW THE SKILLS ARE REACHED FROM INSIDE THIS PACKAGE ─────────────────────
+ * 🔴 `checkSkill()` looks at `<consumerRoot>/.claude/skills/<name>/SKILL.md` — the fixed Claude
+ * Code layout — not at `skills/<name>` where this repository keeps them. So this repository is its
+ * OWN FIRST CONSUMER: `.claude/skills/<name>` is a symlink to `../../skills/<name>`, and
+ * `.claude/skills/paper-pipeline/scripts` is a symlink to the real scripts directory, so the path
+ * every SKILL.md's prose names (`node .claude/skills/paper-pipeline/scripts/announce.mjs …`)
+ * resolves here too. Without those symlinks `skill-corpus.mjs` throws while LOADING, and a harness
+ * whose module fails to load is reported by `vigiles test` as SKIPPED with exit code 0 — a green
+ * run that tested nothing. That is not a hypothetical: it is what the first attempt printed.
+ *
+ * Because the symlinks point back at `skills/`, an edit to `skills/<n>/SKILL.md` IS the edit the
+ * harness sees. The driver therefore writes the real file and restores it, verifying both.
+ *
+ * ── THE DEFECT EACH CASE PLANTS, AND WHY THAT ONE ───────────────────────────
+ * Nine of the ten are `checkSkill()` one-liners, so they all fail the same way and one defect
+ * shape covers them: make the skill announce under a SIBLING'S name. It is the defect the
+ * assertion exists for — these record blocks are copy-paste templates differing in one token,
+ * `announce.mjs` validates nothing, and the wrong gate then reads FRESH in `status.mjs` while the
+ * right one reads NEVER-RUN. Each case names a DIFFERENT sibling so that no two cases could pass
+ * on one shared accident.
+ *
+ * `osf-artifact-upload` is not a `checkSkill()` skill (it carries no `announce.mjs <self>` line —
+ * it is a utility `submit-paper` composes with, not a stage), so its case plants the defect ITS
+ * harness is about: a `curl` that loses `-g`, which makes a bracketed OSF parameter glob and the
+ * request fail silently.
+ */
+import { readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runMutations } from "../lib/mutation-driver.mjs";
+import { consumerRoot } from "./paper-pipeline/scripts/consumer.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const md = (s) => join(HERE, s, "SKILL.md");
+const harness = (s) => join(HERE, s, `${s}.harness.mjs`);
+
+/** [skill, the sibling it is made to announce under] — every sibling distinct. */
+const ANNOUNCERS = [
+  ["analyze-sibling-paper", "map-prior-work"],
+  ["argument-arc", "tighten-paper"],
+  ["cold-read-diff", "argument-arc"],
+  ["draft-paper", "build-benchmark"],
+  ["map-prior-work", "find-venue"],
+  ["paper-adversarial-review", "pc-panel-review"],
+  ["pc-panel-review", "harden-paper"],
+  ["sweep-design-space", "research-ideate"],
+  ["tighten-paper", "grade-paper-writing"],
+  // ── wave ② (2026-09-12). Same defect shape: all twelve are `checkSkill()` stage skills
+  // carrying exactly one `announce.mjs <self>` line, verified unambiguous before these were
+  // written. Siblings stay pairwise distinct across the WHOLE list, so no two cases can pass
+  // on one shared accident.
+  ["build-benchmark", "draft-paper"],
+  ["camera-ready", "extend-paper"],
+  ["harden-paper", "paper-adversarial-review"],
+  ["paper-status", "render-paper"],
+  ["extend-paper", "camera-ready"],
+  ["study-accepted-papers", "analyze-sibling-paper"],
+  ["verify-citations", "cold-read-diff"],
+  ["render-paper", "paper-status"],
+  ["find-venue", "plan-paper-timeline"],
+  ["research-ideate", "sweep-design-space"],
+  ["plan-paper-timeline", "study-accepted-papers"],
+  ["grade-paper-writing", "verify-citations"],
+  // ── wave ③ (2026-09-12). `submit-paper` is a `checkSkill()` stage skill with exactly one
+  // `announce.mjs submit-paper` line (verified unambiguous before this was written). Its sibling
+  // is the conductor itself — the only name left that keeps the whole list pairwise distinct, and
+  // a fitting one: recording a submission under the orchestrator's gate is precisely the
+  // copy-paste slip that reads FRESH on the wrong row.
+  ["submit-paper", "paper-pipeline"],
+];
+
+// 🔴 "Every sibling is distinct" is an ASSERTION, not a wish stated in a comment. The list is
+// written by hand, and exactly this kind of list has already rotted silently before. If two cases
+// mutate into the same name, they can pass on one shared accident, and the battery stops being
+// able to tell their failures apart.
+{
+  const seen = new Set();
+  for (const [skill, sibling] of ANNOUNCERS) {
+    if (skill === sibling)
+      throw new Error(
+        `${skill}: the sibling must be DIFFERENT from the skill itself`,
+      );
+    if (seen.has(sibling))
+      throw new Error(
+        `sibling "${sibling}" is named twice — the cases stopped being independent. ` +
+          `Each case needs its own, otherwise two of them can pass on one shared accident.`,
+      );
+    seen.add(sibling);
+  }
+}
+
+const CASES = ANNOUNCERS.map(([skill, sibling]) => ({
+  name: `${skill}: announces as ${sibling}`,
+  disables:
+    "the identity check — a run recorded under a sibling's gate, which then reads FRESH",
+  edits: [[md(skill), `announce.mjs ${skill} `, `announce.mjs ${sibling} `]],
+  harness: harness(skill),
+  expect: "its announce command files under",
+}));
+
+CASES.push({
+  name: "osf-artifact-upload: one curl loses -g",
+  disables:
+    "the globbing rule this skill states in its own §gotchas, three paragraphs above the command",
+  // 🔴 ANCHORED ON THE ONE CALL THAT IS UNIQUE, not on the shared prefix. `curl -g -s --retry 3`
+  // appears three times, and the driver refuses an ambiguous target rather than guessing — which
+  // is how the first version of this case reported AMBIGUOUS instead of quietly mutating one of
+  // three and calling it a kill.
+  edits: [
+    [
+      md("osf-artifact-upload"),
+      'curl -g -s --retry 3 --cacert $CA -H "$AUTH" https://api.osf.io/v2/users/me/',
+      'curl -s --retry 3 --cacert $CA -H "$AUTH" https://api.osf.io/v2/users/me/',
+    ],
+  ],
+  harness: harness("osf-artifact-upload"),
+  expect: 'command(s) omit "-g"',
+});
+
+// ── wave ③: the conductor. NOT a `checkSkill()` skill — its harness (`paper-pipeline.harness.mjs`)
+// checks ROUTING INTEGRITY, so the defect has to be a routing one, the same way
+// `osf-artifact-upload` above gets the defect ITS harness is about.
+//
+// 🔴 THE FORWARD DIRECTION IS THE ONE A MUTATION CAN REACH. Backward ("a wired stage the map never
+// names") cannot be planted by editing the map alone — deleting a route makes the skill un-named,
+// which is exactly what the MISSING allowance list tolerates for three skills, so the kill would
+// depend on which name was picked. Forward is unconditional: a bolded backticked token in a routing
+// table that resolves to no skill directory is a route to nowhere, and a run following the map
+// stalls there. `**\`camera-ready\`**` occurs exactly once, so the edit cannot be ambiguous.
+CASES.push({
+  name: "paper-pipeline: the map routes to a skill that does not exist",
+  disables:
+    "forward routing integrity — the conductor pointing at a name with no SKILL.md behind it",
+  edits: [
+    [md("paper-pipeline"), "**`camera-ready`**", "**`camera-ready-v2`**"],
+  ],
+  harness: harness("paper-pipeline"),
+  expect: "no .claude/skills/camera-ready-v2/SKILL.md exists",
+});
+
+// 🔴 A FLOOR, NOT A COMMENT. The list above is written by hand, and a hand-written list of paths
+// is the thing this package replaced in `package.json` on 2026-09-11 because it had already
+// rotted SILENTLY. A skill added to `skills/` with a colocated harness and no case here would be
+// caught by `run-mutations.mjs` — but only on the run AFTER someone added it, and only if they
+// ran it. This asserts the pairing from the other side, at import time.
+// 🔴 THE `paper-pipeline` EXCLUSION IS GONE (wave ③, 2026-09-12). It was written when that
+// directory held only `scripts/` — no SKILL.md, no colocated harness, nothing for a case to kill.
+// Both arrived with wave ③, so the exclusion would now hide the orchestrator from the very floor
+// that exists to notice an uncovered harness: `e.name !== "paper-pipeline"` and «it has no harness»
+// were the same statement for one day and are opposite statements now.
+const withHarness = readdirSync(HERE, { withFileTypes: true })
+  .filter((e) => e.isDirectory())
+  .map((e) => e.name)
+  .filter((n) => readdirSync(join(HERE, n)).includes(`${n}.harness.mjs`));
+const covered = new Set(CASES.map((c) => c.harness));
+const missing = withHarness.filter((n) => !covered.has(harness(n)));
+if (missing.length)
+  throw new Error(
+    `skill-contract.mutations.mjs covers no case for: ${missing.join(", ")}.\n` +
+      `Each skill directory carrying <name>.harness.mjs needs a case here, or that harness is a ` +
+      `test nothing can kill — green and silent whether or not it still checks anything.`,
+  );
+
+process.exit(
+  runMutations({ root: consumerRoot(), runner: "vigiles", cases: CASES }),
+);