paperlint 2.0.0

package/skills/submit-paper/references/venues/agenticdev.jsonc

@@ -0,0 +1,108 @@
+// Venue format profile — DATA read by the `pdf/profile` rule in eslint-rules/pdf-facts.mjs.
+// Prose about the venue is in agenticdev.md nearby.
+// Source for the numbers: the Conference Publishing author instructions 2026-08-25 + ACM's
+// requirements.
+//
+// 🔴 Why JSONC and not YAML (decided 08-26). I had this in YAML, justifying it with "JSON has no
+// comments, and every number here carries a quote from the instructions." That objection turned
+// out to be false: @eslint/json ships three languages — json, jsonc, json5 — and jsonc is exactly
+// JSON with comments. So the quotes stay in place, the file is read by a real parser
+// (@humanwhocodes/momoa, already a transitive dependency), AND it's linted by the same engine as
+// everything else. One extra dependency (js-yaml on this path) goes away.
+{
+  "template": "acmart",
+
+  // TeX Live packages the acmart template needs ON TOP OF tex-base.jsonc, each with the files that
+  // prove it is present (checked with kpsewhich after every install). Read by `paperlint toolchain` and
+  // `paperlint build`; the shape is venue-profile.schema.json.
+  //   libertine · inconsolata (zi4) · newtx — acmart.cls checks ALL THREE and, if ANY is missing,
+  //     silently falls back to Computer Modern: the PDF compiles, looks normal, is set in the wrong
+  //     font, and the other metric gives another pagination. A submitted paper went out that way.
+  //   kastrup (binhex.tex) — pulled in by newtx. Missing it is a HARD stop, so adding the fonts
+  //     without it breaks a build that worked.
+  //   fancyhdr — required by acmart itself; present on most images by accident, absent on a
+  //     minimal one ("File `fancyhdr.sty' not found", measured on TinyTeX, issue #37).
+  //   the rest — pulled in by acmart ITSELF, not by the paper, so reading \usepackage never finds
+  //     them. Found 2026-09-01 by the loop build → missing file → tlmgr search --file → install.
+  "tex": {
+    "packages": {
+      "acmart": ["acmart.cls"],
+      "amscls": ["amsart.cls"],
+      "libertine": ["libertine.sty"],
+      "inconsolata": ["zi4.sty"],
+      "newtx": ["newtxmath.sty"],
+      "kastrup": ["binhex.tex"],
+      "fancyhdr": ["fancyhdr.sty"],
+      "totpages": ["totpages.sty"],
+      "environ": ["environ.sty"],
+      "preprint": ["balance.sty"],
+      // acmart's `pbalance` option (the vendor's first fix for an unbalanced last page, which the
+      // optional rule `pdf/last-page-balance` recommends) loads pbalance, which needs filehook and
+      // zref. Measured 2026-09-25 on an acmart sigconf camera-ready: without them the option stops
+      // the build; with them the last page went from 639.6 / 224.1 to 424.4 / 439.2 pt, same page count.
+      "pbalance": ["pbalance.sty"],
+      "filehook": ["filehook.sty"],
+      "zref": ["zref-abspage.sty"],
+      "xstring": ["xstring.sty"],
+      "everyshi": ["everyshi.sty"],
+      "hyperxmp": ["hyperxmp.sty"],
+      "ncctools": ["manyfoot.sty"],
+      "cmap": ["cmap.sty"],
+      "float": ["float.sty"],
+      "comment": ["comment.sty"],
+      "upquote": ["upquote.sty"],
+      "doclicense": ["doclicense.sty"],
+      "textcase": ["textcase.sty"],
+    },
+  },
+
+  // 8.5 x 11 in
+  "page_size": "letter",
+  "page_w_in": 8.5,
+  "page_h_in": 11.0,
+
+  // «text width must not exceed 18 cm»
+  "textblock_w_in": 7.087,
+  // «text height must not exceed 23.5 cm»
+  "textblock_h_in": 9.252,
+  // Last-page balance is NOT a profile field. It is the optional lint rule pdf/last-page-balance,
+  // which a consumer turns on for the papers whose publisher asks (Conference Publishing bounced
+  // an accepted paper for it on 08-29: "Please correct the last page balancing") — see
+  // docs/optional-rules.md.
+
+  "columns": 2,
+
+  // «font size is 9 pt for all body text»
+  "body_pt": 9,
+  // banal measures the MODE of the rendered text, not the declared size (measured 08-26: 9.30 at
+  // acmart's declared 9). Hence the tolerance — and hence why body size stays a nudge, not a gate.
+  "body_pt_tol": 0.5,
+
+  // «font size of the references can be from 7 pt to 9 pt»
+  "ref_pt_min": 7,
+  "ref_pt_max": 9,
+
+  // «text must be in serif font (Libertine)»
+  "fonts_text": "LinLibertine",
+  // «The title must be in sans-serif font (Biolinum)»
+  "fonts_title": "LinBiolinum",
+
+  // The limits are a property of the paper's TYPE at this venue, not of the venue itself.
+  // A given paper's type is stated in its <paper-dir>/venue.json.
+  "kinds": {
+    "short": {
+      "body_pages_max": 5,
+      // «up to 2 extra pages of references»
+      "ref_pages_max": 2,
+    },
+    "full": {
+      // «Full ≤10pp (mature)»
+      "body_pages_max": 10,
+      "ref_pages_max": 2,
+    },
+    "demo": {
+      "body_pages_max": 5,
+      "ref_pages_max": 2,
+    },
+  },
+}

package/skills/submit-paper/references/venues/agenticdev.md

@@ -0,0 +1,139 @@
+---
+title: "AgenticDev @ ASE — venue card (data)"
+---
+
+# AgenticDev @ ASE venue card
+
+> **This is a venue DATA file, not a skill.** Follow the `submit-paper` skill for the end-to-end
+> mechanics; the facts below are the venue-specific data. (Formerly the `submit-paper-agenticdev` skill;
+> demoted to a reference doc so venue data doesn't proliferate the skill namespace.) **Re-verify the
+> CFP each year** (`conf.researchr.org/home/ase-2026/agenticdev-2026`).
+
+## The facts (2026 edition)
+
+- **Venue**: Workshop on Agentic AI for Next-Generation Software Development, co-located with **ASE**
+  (Automated Software Engineering), Munich, Oct 2026.
+- **HotCRP**: `https://agenticdev2026.hotcrp.com/paper/new`.
+- **Deadline**: **July 15, 2026, AoE** (≈ 9 AM July 16 at UTC+5). Notify Aug 21, camera-ready Aug 28.
+- **Types / limits**: Full ≤10pp (mature); **Short ≤5pp** (WIP / vision / position); Demo/Tool ≤5pp.
+  Up to **2 extra pages of references** on top.
+- **Format**: ACM `\documentclass[sigconf,review,anonymous]{acmart}` → **double-blind**. Build:
+  `pdflatex; bibtex; pdflatex; pdflatex`; add `\microtypesetup{expansion=false}` (the #1 acmart crash).
+- **Archival**: accepted papers → **ASE workshop proceedings, DOI**. 🔴 **Correction 2026-08-26: the
+  earlier wording "ACM DL / IEEE Xplore" is FALSE — there is no dual publication.** ASE's publisher
+  **alternates by year**: ASEW '24 — ACM (`10.1145/3691621.*`, ISBN 979-8-4007-1249-4), ASE 2025
+  Workshops — **IEEE** (`csdl/proceedings/asew/2025`, ISBN 979-8-3315-8503-7). The main track does the
+  same: '22 ACM, '23 IEEE, '24 ACM, '25 IEEE. The `10.5555` prefix in ACM DL is a Guide catalog
+  entry, NOT an ACM publication. By the alternation pattern, **ACM is expected for 2026**, which
+  lines up with an APC even being charged — but ⚠️ **no verbatim statement from ASE 2026 about the
+  publisher was found**. If it turns out to be IEEE, the ACM-APC question is moot entirely. Confirm
+  with the chairs before paying; selected papers
+  invited to a **journal special issue**. This is real authorship-criterion evidence.
+- **⚠️ No supplementary-material upload field** on the HotCRP form (fields are just Title, Submission,
+  Abstract, Authors, ACM corresponding, Contacts, PC conflicts). → **Host the artifact externally** (OSF
+  anonymized view-only link) and `\url{}` it in the paper's Availability. See `submit-paper` §2.
+- **Remote presentation**: CFP doesn't state a policy; what counts is the indexed
+  publication, not attendance. Only ask organizers about remote _after_ acceptance (don't draw attention
+  pre-decision under double-blind).
+
+## 🔴 How to name the venue — what CAN and CANNOT be claimed
+
+The question came up on 2026-08-24 and will come up every time (a post, a site, a résumé, an
+application). Checked against primary sources, not a search-engine summary.
+
+**Facts:**
+
+- **ASE is CORE A\*** (top tier), together with ICSE and FSE it's software engineering's "big
+  three."
+- **AgenticDev is an ASE 2026 workshop**, officially listed on ASE's own _Co-Located Events_ page
+  (`conf.researchr.org/track/ase-2026/ase-2026-workshops`). It is not a third-party conference
+  that rented a room nearby, and it is not "sponsorship" — the workshop runs under ASE's umbrella.
+- **Proceedings:** accepted papers go into the **ASE 2026 Workshop Proceedings** (ACM DL, DOI).
+- **But it is NOT the ASE main track.** The main track has its own program, its own PC, and its
+  own selectivity; the workshop is reviewed separately and more leniently.
+
+| ✅ OK to write                                           | ❌ NOT OK                            |
+| -------------------------------------------------------- | ------------------------------------ |
+| "accepted at AgenticDev 2026, a workshop of ASE 2026"    | "accepted at ASE 2026"               |
+| "workshop paper, ASE 2026 workshop proceedings (ACM DL)" | "published at a CORE A\* conference" |
+| "ASE is CORE A\*; AgenticDev is one of its workshops"    | "my paper is CORE A\*"               |
+
+⚠️ **Why this isn't pedantry:** a mismatch in how the narrative is framed is a recorded reason
+reviewers reject any claimed credentials. A reviewer sees the "workshop vs. main track"
+distinction in one minute by checking the conference program, and the cost is trust in the whole
+application, not just one line. The phrasing "a workshop of ASE 2026" is not weaker — it carries
+ASE's weight on its own while staying accurate.
+
+## Attendance, registration, and proceedings — what affects what
+
+- **Traveling to present does NOT affect the credit.** What counts is _authorship of scholarly
+  articles_ — that is, **the publication**, not attendance. "Presented at a conference" isn't on
+  the list of countable achievements at all.
+- 🔴 **What DOES matter: whether payment becomes a condition of MAKING IT INTO proceedings.** Many
+  venues require at least one author to register, or the paper gets pulled from the proceedings.
+  In that case what disappears isn't the trip, it's the proof itself. That's the exact question
+  put to the chairs on 2026-08-24, and it matters more than the money.
+- Cost for 2026: **APC $350** (ACM went fully open-access as of 2026-01-01) + registration €350
+  (early rate through 08-31). The correspondence with the chairs is broken down in the author's
+  private notes (`<paper>/reviews/2026-08-24-perepiska-cheyry.md`).
+
+## PC members (for the "PC conflicts" field) — 2026
+
+Andrea Rosani (Free U Bozen/Bolzano) · Giuseppe Di Fatta (Free U Bozen/Bolzano) · Jean Marie Mottu
+(Nantes U) · Paolo Papotti (Eurecom) · Simos Gerasimou (Cyprus U of Technology). An independent author
+with no ties to any of them checks **none**. (List grows year to year — read the current PC page.)
+
+## Topic fit (foreground these in the framing)
+
+Trustworthiness / verification / validation of AI agents; benchmarking & empirical evaluation;
+integration into developer workflows; agent-based coding/testing. A cost-aware, correctness-gated
+_validation_ paper is dead-center — name those keywords in the abstract/intro.
+
+## After acceptance — the prestige upgrade
+
+AgenticDev is a workshop (lightest authorship tier, but it counts). Extend the accepted paper (≥30% new
+material) into a higher-prestige indexed venue as a **second** publication: **MSR 2027** (deadline
+~Oct 23, 2026) or **NeurIPS 2027 Evaluations & Datasets** (~May 2027). AgenticDev explicitly invites
+journal extensions. Don't dual-submit the same paper — extend it.
+
+## Provenance
+
+"Measuring the Wrong Number" submitted here 2026-07-13 (#20, ready-for-review), 4pp short paper, OSF
+anonymized artifact linked in Availability, PC-panel estimate ~85–90% accept.
+
+## Camera-ready (2026 edition)
+
+**The ACM mechanics are generic and live one level up: `../publishers/acm.md`** (eRights first,
+the preamble, the copyright block, CCS, source files). Here — only what's specific to AgenticDev:
+
+- **Camera-ready deadline**: **28 Aug 2026, 2 PM AoE** (≈ 7 AM on August 29 at UTC+5).
+- **DOI**: `10.1145/3843282.3843715` · **ACM ISBN**: `979-8-4007-2985-0/26/10`.
+- **Copyright block**: `AgenticDev '26, October 12–16, 2026, Munich, Germany`.
+- **No longer double-blind.** The submission used `[sigconf,review,anonymous]`; both options come
+  off for the final.
+- **Same page limit**: body ≤5 pp + up to 2 pp for references only. A sixth page taken up by the
+  bibliography still counts within the limit.
+- **Title changes are allowed** — the portal explicitly asks for it "exactly as it should appear
+  in the ACM DL." But decide before eRights (see the publisher card).
+
+## Attendance / registration
+
+The CFP is silent on remote participation, and **that does not mean "you don't have to show
+up"**: ACM has no blanket no-show policy, IEEE does have one and allows a "qualified proxy" plus
+exceptions for circumstances outside the author's control. Which one applies to the ASE workshop
+**cannot be derived from public sources** — only by writing to the chairs.
+
+- Workshop-day registration (non-member): **€350** through 08-31, €410 through 09-20, €460
+  on-site. This is a **publication gate**, not a travel expense.
+- If entry requires a visa, the timeline for it is real → ask the chairs right after acceptance,
+  don't delay.
+
+## 🤖 Machine-readable format profile
+
+Read by ESLint rules over `<paper>/_build/paper.facts.json` (the facts are captured by
+`extract-pdf-facts.mjs`). **The numbers live here, not in code** — this venue has its own, the
+next one will have different ones. Source: the Conference Publishing author instructions
+(2026-08-25) and ACM's requirements.
+
+**The format profile is in [`agenticdev.yaml`](agenticdev.yaml)** next to this file. Data lives
+there, prose lives here.

package/skills/submit-paper/references/venues/agenticdev.tex

@@ -0,0 +1,19 @@
+% agenticdev.tex — venue numbers for the guards IN THE PREAMBLE. LaTeX doesn't read YAML, so the
+% values are duplicated from venues/agenticdev.jsonc (the source of truth — read by the
+% `pdf/profile` rule, see eslint-rules/pdf-facts.mjs:128). in = inches.
+%
+% 🔴 THIS USED TO SAY `venues/agenticdev.yaml`, AND NO SUCH FILE EXISTS (fixed 2026-09-12). The
+% link went stale during the YAML → JSONC move on 08-26 and survived it, because a comment isn't
+% checked by anything: the "source of truth" named a file that doesn't exist, while the real one
+% sat right next to it.
+% ⚠️ And the duplicate is kept in sync BY HAND. Checked 09-12: 7.087 / 9.252 / 2 / 9 / 5 / 2 match
+% the .jsonc — as of today. There is no mechanism guaranteeing this; a candidate is generating this
+% file from the .jsonc with one build step, which would make the drift unrepresentable (see
+% idei/paper-pipeline-extraction/10-latex-carriers-2026-09-12.md).
+% ⚠️ w/h are CEILINGS ("text width must not exceed 18 cm"), not targets: acmart sets them smaller.
+\def\venuetextblockw{7.087}
+\def\venuetextblockh{9.252}
+\def\venuecolumns{2}
+\def\venuebodypt{9}
+\def\venuebodypagesmax{5}
+\def\venuerefpagesmax{2}

package/skills/submit-paper/references/venues/aisec.jsonc

@@ -0,0 +1,101 @@
+// AISec @ ACM CCS format profile. Data for the `pdf/*` rules over `_build/paper.facts.json`.
+// Prose about the venue and tracks is in `aisec.md` nearby.
+//
+// PAGE LIMITS — verbatim from https://aisec.cc/ (verified 2026-08-26, not from memory):
+//   «Submitted papers must be at most 10 pages long in double-column ACM format---excluding
+//    bibliography and well-marked appendices, for which up to two additional pages can be used
+//    (hence, the paper's overall length must be of 12 pages at most).»
+// Our card used to say "up to ~10pp" — an approximate number that cannot be put into a gate: it
+// would either let an overage through or redden on a correct paper.
+//
+// ⚠️ A venue caveat worth remembering: "if ... you get a warning stating that 'Too many
+// pages: the limit is 12 pages, found 13', this is OK -- as long as the 13th page contains ONLY
+// the 'Generative AI paragraph'". Our gate does NOT know about this exception and will redden on
+// a 13th page. That's deliberate: the case is rare, and automation that knows "sometimes it's
+// fine" is worse than a plain rejection a human clears by eye.
+//
+// GEOMETRY AND FONTS are inherited from `acmart sigconf` — the same class as agenticdev, and
+// measured the same way (banal + pdffonts, 08-26). AISec points to the "main ACM CCS'26 formatting
+// instructions" and does not publish its own numbers.
+{
+  "template": "acmart",
+
+  // TeX Live packages the acmart template needs ON TOP OF tex-base.jsonc, each with the files that
+  // prove it is present (checked with kpsewhich after every install). Read by `paperlint toolchain` and
+  // `paperlint build`; the shape is venue-profile.schema.json.
+  //   libertine · inconsolata (zi4) · newtx — acmart.cls checks ALL THREE and, if ANY is missing,
+  //     silently falls back to Computer Modern: the PDF compiles, looks normal, is set in the wrong
+  //     font, and the other metric gives another pagination. A submitted paper went out that way.
+  //   kastrup (binhex.tex) — pulled in by newtx. Missing it is a HARD stop, so adding the fonts
+  //     without it breaks a build that worked.
+  //   fancyhdr — required by acmart itself; present on most images by accident, absent on a
+  //     minimal one ("File `fancyhdr.sty' not found", measured on TinyTeX, issue #37).
+  //   the rest — pulled in by acmart ITSELF, not by the paper, so reading \usepackage never finds
+  //     them. Found 2026-09-01 by the loop build → missing file → tlmgr search --file → install.
+  "tex": {
+    "packages": {
+      "acmart": ["acmart.cls"],
+      "amscls": ["amsart.cls"],
+      "libertine": ["libertine.sty"],
+      "inconsolata": ["zi4.sty"],
+      "newtx": ["newtxmath.sty"],
+      "kastrup": ["binhex.tex"],
+      "fancyhdr": ["fancyhdr.sty"],
+      "totpages": ["totpages.sty"],
+      "environ": ["environ.sty"],
+      "preprint": ["balance.sty"],
+      // acmart's `pbalance` option (the vendor's first fix for an unbalanced last page, which the
+      // optional rule `pdf/last-page-balance` recommends) loads pbalance, which needs filehook and
+      // zref. Measured 2026-09-25 on an acmart sigconf camera-ready: without them the option stops
+      // the build; with them the last page went from 639.6 / 224.1 to 424.4 / 439.2 pt, same page count.
+      "pbalance": ["pbalance.sty"],
+      "filehook": ["filehook.sty"],
+      "zref": ["zref-abspage.sty"],
+      "xstring": ["xstring.sty"],
+      "everyshi": ["everyshi.sty"],
+      "hyperxmp": ["hyperxmp.sty"],
+      "ncctools": ["manyfoot.sty"],
+      "cmap": ["cmap.sty"],
+      "float": ["float.sty"],
+      "comment": ["comment.sty"],
+      "upquote": ["upquote.sty"],
+      "doclicense": ["doclicense.sty"],
+      "textcase": ["textcase.sty"],
+    },
+  },
+
+  "page_size": "letter",
+  "page_w_in": 8.5,
+  "page_h_in": 11.0,
+
+  "textblock_w_in": 7.087,
+  "textblock_h_in": 9.252,
+  // Last-page balance is NOT a profile field. It is the optional lint rule pdf/last-page-balance,
+  // which a consumer turns on for the papers whose publisher asks (Conference Publishing bounced
+  // an accepted paper for it on 08-29: "Please correct the last page balancing") — see
+  // docs/optional-rules.md.
+
+  "columns": 2,
+
+  "body_pt": 9,
+  // banal measures the rendered text's mode, not the declared size (measured: 9.30 at a
+  // declared 9).
+  "body_pt_tol": 0.5,
+
+  "ref_pt_min": 7,
+  "ref_pt_max": 9,
+
+  "fonts_text": "LinLibertine",
+  "fonts_title": "LinBiolinum",
+
+  // Four tracks (original research · position/open-problem · SoK · benchmark) — the limits are
+  // the SAME for all of them, the venue doesn't split them. The keys are kept separate so a
+  // paper's `venue.json` can name its own track: not for the numbers, but so it's visible which
+  // track it was submitted under.
+  "kinds": {
+    "research": { "body_pages_max": 10, "ref_pages_max": 2 },
+    "benchmark": { "body_pages_max": 10, "ref_pages_max": 2 },
+    "position": { "body_pages_max": 10, "ref_pages_max": 2 },
+    "sok": { "body_pages_max": 10, "ref_pages_max": 2 },
+  },
+}

package/skills/submit-paper/references/venues/aisec.md

@@ -0,0 +1,105 @@
+---
+title: "AISec @ ACM CCS — venue card (data)"
+---
+
+# AISec @ ACM CCS venue card
+
+> **This is a venue DATA file, not a skill.** Follow the `submit-paper` skill for the end-to-end
+> mechanics; the facts below are the venue-specific data. (Formerly the `submit-paper-aisec` skill;
+> demoted to a reference doc so venue data doesn't proliferate the skill namespace.) **Re-verify the
+> CFP each year** (`https://aisec.cc/`) — deadline, page limit, and tracks shift year to year.
+
+## The bar (read this first)
+
+AISec is **not** a first-edition welcoming workshop. It is the long-running AI-security workshop of
+**ACM CCS — a top-4 security conference** — so calibrate to a _harder_ bar than a fresh workshop:
+mature threat modeling, honest evaluation, and airtight ethics are table stakes, not bonuses. A
+security PC rejects on soundness and ethics grounds that a SE workshop would wave through.
+
+## The facts (2026 edition)
+
+- **Venue**: ACM Workshop on Artificial Intelligence and Security (**AISec**), co-located with **ACM
+  CCS** (Computer and Communications Security).
+- **Deadline**: **24 July 2026** (verify the AoE cutoff, and convert it into your own zone, on the CFP each cycle).
+- **Types / tracks**: **full research papers**; **benchmark papers** (new evaluation frameworks /
+  datasets **with artifact sharing** — a first-class track, not an afterthought); **position / SoK**
+  (systematization-of-knowledge) papers. Pick the track and pitch to _its_ bar.
+- **Format**: ACM double-column (`sigconf`), up to **~10pp**. Build:
+  `pdflatex; bibtex; pdflatex; pdflatex`; add `\microtypesetup{expansion=false}` (the #1 acmart crash).
+- **Blind model**: **double-blind** — `\documentclass[sigconf,review,anonymous]{acmart}`, author
+  `Anonymous Author(s)`. See `submit-paper` §0/§4 for de-anon hygiene.
+- **Archival**: accepted papers → **CCS workshop proceedings in the ACM Digital Library** (DOI). Real
+  indexed-authorship evidence, at a top-tier-security-adjacent venue.
+- **⚠️ No supplementary-material upload field** on the form. → **Host the artifact externally,
+  anonymized** (OSF private project + anonymized view-only link) and `\url{}` it in Availability. See
+  `submit-paper` §2 and `paper-pipeline/references/anonymization.md`.
+
+## Security-venue specifics that DECIDE acceptance (this is the whole game here)
+
+1. **Threat-model soundness.** Name the **attacker** explicitly and their **capabilities** (what they
+   observe, what they control, their goal, their budget). **Separate accidental failure from an
+   adaptive adversary** — "the model gets it wrong sometimes" and "a motivated attacker steers it" are
+   different papers; conflating them is the classic security-PC reject. Put the threat model up front,
+   not in a footnote.
+2. **Ethics / responsible disclosure — CRITICAL, a hard reject-vector.**
+   - **Anonymize studied third parties too**, not just yourself. Do **not** punch down on named
+     maintainers/projects — aggregate the stats and use anonymized IDs (e.g. `G01…G46`) for the
+     entities you studied.
+   - **Disclose findings to affected parties BEFORE any de-anonymized release.** The paper must state
+     the disclosure timeline and that a **release gate** blocks publishing de-anonymized data until
+     disclosure completes.
+   - No supplementary slot → the anonymized artifact on **OSF** must itself be leak-clean (the released
+     files, not just the PDF). A named-entity leak in the _artifact_ is invisible to a paper-only read
+     and is the single highest reject-vector — see Provenance.
+3. **Dual-use.** If you publish an **evasion / attack technique, publish its fix in the same paper** —
+   net-defensive framing. A security PC will reject a pure attack recipe with no mitigation as
+   irresponsible; the same result framed as "here is the weakness AND how to close it" is a
+   contribution.
+4. **GenAI-use disclosure.** ACM/CCS require disclosing how generative AI was used in producing the
+   work (writing, code, experiments). Add the disclosure statement; don't omit it.
+
+## Track fit (foreground these in the framing)
+
+Adversarial ML, ML for security / security for ML, LLM/agent safety and security, evaluation &
+benchmarking of AI-security defenses, poisoning/evasion/extraction, and **rigorous measurement of
+whether a claimed safety mechanism actually holds**. A benchmark/measurement paper that ships a
+reusable eval framework + an anonymized artifact is dead-center for the **benchmark track** — name
+those keywords in the abstract/intro and cite the track by name.
+
+## After acceptance — the prestige upgrade
+
+AISec@CCS is a workshop, but co-located with a top-4 venue it is the strongest workshop tier a
+dossier can hold. Extend the accepted paper (≥30% new material) into a higher-prestige indexed venue as
+a **second** publication — e.g. a full security conference or a journal. Don't dual-submit the same
+paper; extend it. Plan the **camera-ready de-anonymization + release gate** at acceptance (see
+`camera-ready`).
+
+## Provenance
+
+"Safety Theater in Agentic Coding" hardened for this venue (PC-panel estimate **~87–88%** accept). Its
+accept **hinged on closing an ethics reject-vector**: the released artifact had named **46 maintainers**
+— a paper-only review missed it; the `pc-panel-review` artifact-runner + ethics lens caught it. Fixed
+by **anonymized provenance (`G01–G46`)** plus a **release gate** blocking de-anonymized release until
+disclosure completes. Lesson baked into this card: at a security venue the two things that most move
+the decision — an ethics/disclosure contradiction and an anonymization leak — live in the **artifact**,
+so verify the shipped files, not just the PDF.
+
+## Compose with
+
+- `submit-paper` (mechanics: HotCRP form, OSF hosting, "ready for review", PDF-only, profile, dossier notes).
+- `camera-ready` (de-anonymization + the release gate after acceptance).
+- `pc-panel-review` — run it LAST as the gate, and specifically field its **ethics lens** and
+  **artifact-runner lens** (stress-test the release gate: plant a leak, confirm it's caught).
+- Canonical shared detail: `paper-pipeline/references/artifact-checklist.md` (artifact build) and
+  `paper-pipeline/references/anonymization.md` (de-anon deny-list + verify).
+
+## Camera-ready
+
+AISec is also **ACM** (a CCS workshop), so the final's mechanics are generic and live in
+**`../publishers/acm.md`**: eRights is filled in FIRST and requires the final title; the preamble
+is converted out of submission mode (`printacmref=false` / `setcopyright{none}` /
+`pagestyle{plain}` / the `review` option — all of it removed); Source files are mandatory
+alongside the PDF; CCS codes come from the 2012 CCS Browser.
+
+What's AISec's own — its own DOI/ISBN, its own venue line in the copyright block, and its own
+dates: fill those in here once they arrive (the card gets filled in from fact, not from memory).

package/skills/submit-paper/references/venues/paper-guards.tex

@@ -0,0 +1,41 @@
+% paper-guards.tex — guards that turn a paper defect into a BUILD FAILURE.
+%
+% Included from the paper's preamble: \input{paper-guards}
+% Found via TEXINPUTS, which check-render.sh sets (the `references/venues/` directory).
+%
+% WHY A SEPARATE FILE, NOT A COPY IN EVERY PAPER. The first edition of the guard (08-26) lived
+% inline in `agenticdev-2026/paper.tex`, and a measurement that same evening showed the cost: of
+% three papers in LaTeX, the guard existed in exactly ONE. So grepping the log in
+% `check-render.sh` was not redundant with it — for the other two it was the only check at all. A
+% per-paper copy degrades exactly the way any convention that only gets written down degrades.
+%
+% 🔴 BOTH HALVES ARE PROVEN BY MEASUREMENT, AND THE ORDER IS EXACTLY THIS (the `papers/CLAUDE.md`
+% rule): first, "silent on the correct case." On a clean `agenticdev-2026/paper.tex`: 0 errors, PDF
+% 621,325 bytes. With a planted `\ref{ghost-xyz}`: `! Package paper Error: undefined references`.
+% With a planted `\cite{ghost-xyz}`: `! Package paper Error: undefined citations (natbib)`.
+%
+% 🔴 GATED ON \finalpass, AND THIS IS LOAD-BEARING. On the first pass `.aux` is empty, so ALL
+% references are UNDEFINED by construction. Measured 08-26 with the unconditional form: pass 1
+% fails ⇒ `.aux` never gets written ⇒ pass 2 fails on the same thing ⇒ the cycle NEVER CONVERGES
+% and no PDF appears at all. The final pass gets `\def\finalpass{}` on the command line (see
+% `check-render.sh`), ordinary passes stay silent.
+%
+% 🔴 TWO FLAGS, NOT ONE, AND THIS IS ALSO A MEASUREMENT. The first version only looked at LaTeX
+% core's `\@refundefined`, and a planted `\cite{ghost}` sailed right through: `acmart` loads
+% NATBIB, which prints ITS OWN warning and never touches the core flag. natbib's flag is
+% `\NAT@undefined` (`\newcommand\NAT@citeundefined{\gdef\NAT@undefined{...}}`, natbib.sty:1095).
+% Caught by planting the defect, not by reading the code: the guard reported "clean" on a paper
+% whose log contained `Package natbib Warning: Citation 'ghost' on page 6 undefined`.
+%
+% ⚠️ The file deliberately contains nothing besides the reference guards. Geometry and page-limit
+% checks are venue-specific and live in each venue's own `<venue>.tex`.
+\makeatletter
+\AtEndDocument{%
+  \ifdefined\finalpass
+    \ifx\@refundefined\relax\else
+      \PackageError{paper}{undefined references - see the log}{}\fi
+    \@ifundefined{NAT@undefined}{}{%
+      \PackageError{paper}{undefined citations (natbib) - see the log}{}}%
+  \fi
+}
+\makeatother

package/skills/submit-paper/references/venues/realm.jsonc

@@ -0,0 +1,81 @@
+// REALM @ EMNLP 2026 format profile — ACL family, NOT ACM. Prose is in `realm.md` nearby,
+// the family's shared rules are in `paper-pipeline/references/acl-venue-rules.md`.
+//
+// 🔴 THE GEOMETRY NUMBERS ARE MEASURED, NOT COPIED. banal run against our own build
+// (`repro/build-submission.sh` → `build/acl_latex.pdf`, 2026-08-26):
+//   A4 8.26 x 11.69 in (595 x 842 pt) · 2 columns · body size 11.3 · leading 13.6 ·
+//   reference size 10.3 · margins [72, 67, 66, 68] pt · 0 Type 3 fonts
+// acmart (letter 8.5x11, size 9, Libertine) shares NOTHING with this — copying the numbers from
+// `agenticdev.jsonc` would give a gate that reddens on a correct paper.
+{
+  "template": "acl",
+
+  // TeX Live packages the ACL template needs ON TOP OF tex-base.jsonc (the shape is
+  // venue-profile.schema.json). acl.sty itself travels with the paper; these are what it loads.
+  //   times · helvetic · courier · symbol · zapfding — without them "Font ptmr8t not loadable" and
+  //     no PDF at all. The proof is a font metric file, because that is what failed.
+  //   `urw-base35` once stood in this list and was INVENTED: tlmgr answers "package urw-base35 not
+  //     present in repository". The five names above are enough.
+  "tex": {
+    "packages": {
+      "lineno": ["lineno.sty"],
+      "psnfss": ["times.sty"],
+      "times": ["ptmr8t.tfm"],
+      "helvetic": ["phvr8t.tfm"],
+      "courier": ["pcrr8t.tfm"],
+      "symbol": ["psyr.tfm"],
+      "zapfding": ["uzdr.tfm"],
+    },
+  },
+
+  "page_size": "a4",
+  "page_w_in": 8.27,
+  "page_h_in": 11.69,
+
+  "columns": 2,
+
+  // ACL's stated body size is 11pt; banal measures the render's mode and gives 11.3.
+  "body_pt": 11,
+  "body_pt_tol": 0.5,
+
+  // ⚠️ The range is derived from a SINGLE measurement (10.3), not from ACL's spec — I could not
+  // find ACL's own numbers for the reference size. So it's set wide: for an `error`-level rule, a
+  // false positive is worse than a miss. Narrow it once a primary source turns up.
+  "ref_pt_min": 9,
+  "ref_pt_max": 11,
+
+  // The Times clone from the ACL template. Headings are NOT gated: the build also contains
+  // NimbusSanL-Bold, but a `pdffonts` measurement can't establish exactly what the heading is set
+  // in — it only says a typeface IS present in the file, not where it's applied.
+  "fonts_text": "NimbusRomNo9L",
+
+  // 🔴 PAGE LIMITS ARE NOT GATED HERE, AND THAT IS A MEASUREMENT, NOT LAZINESS.
+  //
+  // banal classifies pages by content and counts Limitations and Ethics as part of the BODY.
+  // ACL excludes them from the limit. Measured 08-26 on our own paper: banal said "body 13," the
+  // build's own counter said "body pages: 9," and both are right — they're just counting
+  // different things (the body ends at Conclusion on p.9; pp.10-13 are Limitations/Ethics; the
+  // bibliography starts at 14).
+  //
+  // A gate on banal's number would give 13 against a limit of 8 and would redden on a paper that
+  // is within the limit. For an `error`-level rule that is the worst outcome. The limit stays
+  // owned by the counter inside `build-submission.sh`: it reads the markdown source and therefore
+  // KNOWS where the body ends, which the PDF does not.
+  //
+  // The numbers below are DATA for that counter and for humans, not an input to the rule. Source:
+  // `realm.md`, verified by directly fetching the 2026-08-02/03 CFP.
+  "page_limits_not_gated": {
+    "_": "8 at submission, 9 at camera-ready (+1 page). Both numbers are CURRENTLY hardcoded in build-submission.sh — 8 in the header, 9 in the run — which reads like a mismatch even though these are different STAGES. The script should pull them from here instead.",
+    "long_submission": 8,
+    "long_camera_ready": 9,
+    "short_submission": 4,
+    "short_camera_ready": 5,
+    "refs_and_appendices": "unlimited",
+    "limitations_and_ethics": "not counted (ACL rule)",
+  },
+
+  "kinds": {
+    "long": {},
+    "short": {},
+  },
+}