paperlint 2.0.0

package/skills/build-benchmark/SKILL.md.spec.ts

@@ -0,0 +1,220 @@
+// Compiled to SKILL.md by `vigiles compile`. Edit THIS file, never the markdown.
+//
+// Adopted 2026-08-17 (batch 3). Body carried over VERBATIM so the compiled diff shows
+// only what the compiler adds. No `disallowedTools` fence yet — the field landed on
+// `SkillSpec` in vigiles branch `claude/skill-disallowed-tools` and is not in a release
+// this repo installs, so writing one here would not compile.
+import { experimental_skill } from "vigiles/spec";
+
+export default experimental_skill({
+  name: "build-benchmark",
+  description:
+    "Design and run the empirical study behind a measurement paper, and ship a reviewer-proof reproduction artifact. Covers the study design (invert the pitfall you're critiquing), honest statistics (paired/Welch t, CIs, Bonferroni, small-n spread as a result, not noise), a structural bound that outlives the specific artifacts tested, and a self-checking artifact that recomputes every headline number and exits non-zero on drift. Use when the paper's contribution is a way to MEASURE something and you're building the evidence + the thing reviewers will run. Compose with research-ideate (upstream), draft-paper, pc-panel-review (its artifact-runner executes this), submit-paper.",
+  context: "fork",
+  tools: ["Read", "Write", "Edit", "Grep", "Glob", "Bash", "Agent"],
+  body: `
+# build-benchmark — the study + the artifact reviewers can run
+
+## Run me
+
+🔴 FIRST, before any other step:
+
+\`\`\`
+node .claude/skills/paper-pipeline/scripts/announce.mjs build-benchmark <paper-dir>
+\`\`\`
+
+An advisory pass cannot be observed failing — silence is both its error state and its normal
+state — so starting is an event, and events get written down.
+
+A measurement paper is only as strong as the artifact a reviewer can \`cd\` into and re-run. This skill
+covers both halves: the study design that makes the finding true, and the self-checking artifact that
+makes it *verifiable*. The contribution is the **method**, not the one tool you happened to test — build
+so both survive review.
+
+## 0. 🔴 READ THE STATED CLAIM FIRST — and refuse to design without it
+
+**Before designing anything, open \`<paper-dir>/PIPELINE-STATUS.md\` and read row \`frame\`** — the one
+paragraph saying what this paper will claim (written by \`argument-arc\` in **frame mode**, in SETUP).
+
+🔴 **If \`frame\` is empty, stop. Do not design the study.** Go run \`argument-arc\` frame mode, get the
+paragraph, then come back. This is a refusal, not a recommendation:
+
+- **The frame decides which results matter.** A study designed without a stated claim measures
+  whatever the available harness can already see, and the claim gets fitted afterwards to whatever
+  came out. That is backwards, and it is expensive in exactly one direction — **reframing after the
+  data is collected is how runs get thrown away**, observed on \`compile-rules-2026\`.
+- **The claim is what makes §1 answerable.** "What would make the critiqued pitfall impossible here?"
+  has no answer until you have written down what you are claiming.
+- **It costs a paragraph and it saves a study.** There is no version of this trade that favours
+  starting the runs first.
+
+Cross-check the claim against the prevention rule in the \`CLAUDE.md\` beside the papers: if the claim is
+about *preventing* something, write the one sentence saying **what physically stops the bad outcome in
+the experimental arm**. "There is different text in it" means you are measuring persuasion, not
+prevention, and the design is wrong before a single run.
+
+## 1. Design that inverts the pitfall you're critiquing
+
+The strongest measurement papers are a corrected version of the mistake they name. Pick the design that
+is the *inverse* of the flaw:
+
+- **Critiquing a proxy metric?** Measure the real thing, gated on correctness. The cost study is a
+  **cost-aware, correctness-gated A/B**: two arms × two tools, every run scored pass/fail first, then
+  the *dollar* bill compared — because the whole point was that the token-proxy and the dollar disagree.
+  Never let a cheaper-but-broken run count as a win; correctness is the gate before cost is even read.
+- **Measuring something that runs untrusted/destructive code?** **Parse, don't execute.** The guard eval
+  is a **SAFE STATIC evaluation**: transcribe each guard's predicate by hand and reason over it against a
+  disaster battery — never run the guard or the attack. See Safety below; this is non-negotiable.
+
+Write the design as the answer to "what would make the critiqued pitfall impossible here?"
+
+## 2. Honest statistics — the part reviewers attack first
+
+- **Paired where the design is paired; Welch where variances differ.** Use a **paired-t** when the same
+  task is run under both arms (blocks task difficulty); use **Welch's t** for unequal-variance unpaired
+  comparisons. Do NOT label a test "paired" unless the pairing is real — a mislabeled test is a blocker.
+- **Report CIs and k/n, never bare percentages over tiny n.** "2/10 guards covered" beats "20% coverage";
+  "median 2/10 (range 0–5)" beats a single mean. A percentage over n=10 hides the n.
+- **Report the SOURCE CONCENTRATION of a mined corpus — the single-source share is a number, not a
+  caveat.** For any corpus mined from several repositories / trackers / vendors, compute and print
+  **n per source and the max single-source share**, and put it in the paper (a table row or one
+  sentence), not only in Threats. A corpus advertised as covering *k* sources but dominated by one is
+  a top reason a mined-corpus paper gets rejected, and it is invisible to every other check — the
+  totals, the percentages and the internal consistency all pass, because the cut was simply never
+  made. **Mechanical leg:** the artifact emits \`source, n, share\` for the corpus and the top share
+  appears in the paper. If the top source exceeds ~50%, say so in the abstract's scope or narrow the
+  claimed population to what you actually sampled.
+- **Inter-rater agreement is void if the rater was trained by, and scored against, the codebook's
+  author.** Agreement with the person who wrote the scheme measures *trainability*, not construct
+  reliability — it is the human form of the failure this suite already names in code (a checker and
+  its self-test written in one pass by one model). Requirements, all mechanical: (i) reference labels
+  come from a rater who did **not** author the codebook and did **not** see the hypothesis; (ii)
+  report the agreement **denominator as a share of the full corpus** — "κ=0.93 on 69 of 547 (12.6%)",
+  never a bare κ; (iii) use a coefficient that matches the design — Cohen's κ is single-label, so
+  multi-label coding needs per-label κ or Krippendorff's α; (iv) treat **κ = 1.00 as a red flag to
+  investigate, not a result to report** — perfect agreement on a many-category scheme usually means
+  the validation set was easy or calibration was de-facto joint coding.
+- **Correct for the family.** Multiple comparisons across a family of tasks/tools → **Bonferroni** (or
+  state the correction you used). Report it; don't p-hack the one significant cell.
+- **Small-n spread is a first-class result, not noise.** If five trials of the same task swing wildly,
+  that variance IS the finding (the thing under test is unstable) — report it, don't average it away.
+- Repeated trials: fix trial count up front (e.g. per-task × trials × arms × tools), report the full n,
+  and treat every run — including failures — as data.
+
+## 3. A structural bound that outlives the artifacts
+
+Numbers about today's tools rot. A **mechanism or structural bound** doesn't. Give the paper one claim
+that holds regardless of which specific tool/version you measured:
+
+- the cost study's bound: token-efficiency and dollar cost are decoupled by pricing structure, so a
+  token-optimizing tool *cannot* be assumed to cut the bill — a property of the pricing, not the tool.
+- the guard eval's axes: **mutation-evasion** (does a trivial rephrase of the attack slip the guard?),
+  **held-out generalization** (does coverage transfer to commands the guard wasn't written for?), and
+  **per-step causal ablation** (remove one guard step, measure the coverage delta — which step actually
+  does the work). These are properties of the *defense class*, reusable against the next guard set.
+
+State the bound explicitly; it's what makes the paper a benchmark and not a product review.
+
+## 4. Build a SELF-CHECKING artifact
+
+This is the single biggest accept-probability lever, and pc-panel-review's artifact-runner WILL execute
+it. Do **not** restate the requirements here — build to the canonical checklist:
+
+→ **\`paper-pipeline/references/artifact-checklist.md\`** (self-recompute from raw data, exit non-zero on
+drift, stdlib-only, no network, a README that maps each paper-number to where it prints, LICENSE, honest
+badge scope, de-anon scanned).
+
+The load-bearing property: each script **recomputes** every headline number from raw data and
+**self-asserts** — exit non-zero the moment a cell drifts from the paper (\`reproduce.py\` on the cost
+study; \`evaluate.py\`/\`mutate.py\`/\`reproduce.mjs\`/\`ablation.mjs\` on the guard eval). Derive from base
+fields, never echo a stored/precomputed field — a reviewer calls that circular and they're right. For
+de-anonymization before hosting, follow **\`paper-pipeline/references/anonymization.md\`**; host per
+\`submit-paper\` (OSF anonymized view-only link; automation at \`papers/osf_upload.py\`).
+
+## Safety — never execute untrusted or destructive commands to measure them
+
+If the object of study is code that could delete, exfiltrate, or run attacker-controlled input, you
+**transcribe and parse its predicate** — you never execute it, and you never run the attack against it.
+The guard eval scores 46 real command-guards by reading each guard's logic against a 10-command disaster
+battery statically; nothing in the battery is ever run. A benchmark that has to detonate the payload to
+score it is a liability, not evidence. Same rule inside the artifact: no network, no shelling out to the
+thing under test.
+
+## Validate the transcription against real-code execution, not just a blind re-derivation
+
+When you score third-party code by **transcribing its logic** (e.g. a guard's regexes) into your own
+evaluator, a *blind re-derivation* (a second person re-reads the code and re-transcribes it) only checks
+transcription-vs-human-reading — it does **not** check transcription-vs-real-behavior. There's a cheap,
+zero-execution-risk way to close that gap: **run the actual scraped code against its REAL agent input
+contract** and reconcile its live verdict with your static prediction.
+
+- **Feed the real contract, not a bare string.** For Claude Code PreToolUse hooks, the command arrives as
+  a **JSON envelope on stdin** with the command at \`.tool_input.command\`. Feed each battery/benign command
+  as a **string inside that envelope** to the real guard's stdin and read its verdict (exit 2 = block; or
+  stdout JSON \`permissionDecision\` deny/ask/block). The command is **never executed** — the guard only
+  inspects the string.
+- **SAFETY: sandbox + stub-PATH first.** Run inside a throwaway sandbox with a **stub PATH** (fake
+  \`rm\`/\`dd\`/\`git\`/\`curl\`/… → \`exit 0\`) as defense-in-depth, so even a guard that shells out can't do
+  damage. Invoke the real interpreters by absolute path.
+- **Reconcile per code×input pair.** Every mismatch between live verdict and static prediction is a
+  **finding** — either a transcription nit to fix, or a real behavior your static model structurally
+  cannot capture.
+
+**Concrete payoff (the motivating example):** this method surfaced a **"whole-stdin confound"** — a
+widely-copied guard that greps its **entire raw stdin** rather than the extracted command. The JSON
+envelope's trailing bytes defeated its anchored \`rm …/$\` rule, so it **FAILED TO BLOCK \`rm -rf /\`** live,
+even though it "blocked" the bare string. A pure transcription/static model can't see this; only
+real-code-through-real-contract execution reveals it.
+
+Before submitting, verify the artifact you built with the reviewer-side reproduction protocol:
+**\`references/adversarial-cold-repro.md\`** (cold re-run, three-way reconcile, robustness attacks).
+
+## Record the verdict
+
+🔴 LAST step, once the deliverable exists:
+
+\`\`\`
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record build-benchmark <paper-dir> FINDING <count> <report-path>
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record build-benchmark <paper-dir> ABSTAINED <reason> "<one line>"
+\`\`\`
+
+🔴 **There is no PASS.** An artifact that recomputes every headline number and exits 0 has produced
+no finding; it has not certified the study. Record the absence, do not name it a success.
+
+**FINDING** — \`<count>\` numbers did not reproduce, or reproduce only with caveats; \`<report-path>\`
+is the artifact output. Add \`--blocking\` for the §0 refusal: \`frame\` is empty, so the study was not
+designed.
+**ABSTAINED** — \`no-witness\`: the artifact ran and every number reproduced. \`input-missing\`: the
+raw data is not in the repo. \`crashed\`: the harness itself died.
+
+🔴 That §0 refusal is a **finding, not an aborted run** — it is a fact about the work, so it is a
+FINDING and not an abstention. Record it and stop. A study that was never designed leaves exactly
+the same silence as one that is still running, and the difference costs a week to rediscover.
+
+🔴 **THREE MECHANICAL CHECKS FILE UNDER THIS SKILL** and each has its own ledger row:
+\`build-benchmark/check-provenance\`, \`build-benchmark/arm-permutation\`,
+\`build-benchmark/delivered-pdf\` (see \`.claude/skills/paper-pipeline/scripts/run-mechanical.mjs\`). Until 2026-08-10 the
+ledger keyed on the SKILL, so a clean run of one erased a finding of another from every derived
+view — which is why two of the three sat unwired. This block records the JUDGEMENT pass, under the
+bare key \`build-benchmark\`; never file a mechanical result here.
+
+## Compose with
+- **argument-arc (frame mode)** — 🔴 **hard input.** Owns row \`frame\`, the stated claim. No \`frame\`, no study.
+- **research-ideate** (upstream) — supplies the contribution and the pitfall to invert; this skill turns
+  it into evidence.
+- **draft-paper** — the study's stats, bound, and artifact-number table feed Methods/Results/Availability.
+- **pc-panel-review** — its artifact-runner reviewer \`cd\`s in and re-executes every harness; build so
+  that pass is deterministic.
+- **submit-paper** — hosts the scrubbed artifact anonymously and links it in Availability.
+
+## Provenance
+- **AgenticDev 2026 @ ASE — "Measuring the Wrong Number":** a cost-aware, correctness-gated A/B harness
+  over 140 runs (7 tasks × 5 trials × 2 arms × 2 tools); Welch t + paired-t CIs + Bonferroni; the finding
+  that token-efficiency tools don't cut the dollar bill. Artifact = a stdlib-only \`reproduce.py\` that
+  recomputes every headline number from raw data and exits non-zero on drift.
+- **AISec 2026 @ ACM CCS — "Safety Theater":** a 10-command disaster battery against 46 real
+  command-guards, SAFE STATIC evaluation (transcribe each predicate, never execute), median coverage
+  2/10, plus mutation-evasion, held-out generalization, and per-step causal ablation axes. Artifact =
+  \`evaluate.py\`/\`mutate.py\`/\`reproduce.mjs\`/\`ablation.mjs\`, each self-asserting on run. Both artifacts
+  are hosted anonymized on OSF.`,
+});

package/skills/build-benchmark/build-benchmark.eval.mjs

@@ -0,0 +1,19 @@
+/**
+ * build-benchmark — the PAID tier: does this skill's description actually fire?
+ *
+ * COLOCATED ON PURPOSE (vigiles decides coverage by placement as of 2026-08-11).
+ * The prompts live in `.claude/lib/skill-trigger-cases.mjs` so all 21 cases
+ * are reviewed as one table where collisions between siblings are visible;
+ * copying them here would recreate the drift that rule exists to prevent.
+ *
+ * Measures recall (fires on its own territory) AND precision (stays quiet on a
+ * colliding sibling's territory), against the REAL `.claude` harness so the skill
+ * competes with every other installed description — an isolated run overstates
+ * recall and understates false positives.
+ *
+ * Costs money; not CI.
+ *   node .claude/skills/build-benchmark/build-benchmark.eval.mjs [trials]
+ */
+import { runSkillTriggerEval } from "../../lib/skill-eval-kit.mjs";
+
+await runSkillTriggerEval("build-benchmark");

package/skills/build-benchmark/build-benchmark.harness.mjs

@@ -0,0 +1,23 @@
+/**
+ * build-benchmark — the free, deterministic tier. No model, no network.
+ *
+ * COLOCATED ON PURPOSE. vigiles decides coverage by PLACEMENT as of 2026-08-11:
+ * a test that merely names a surface no longer counts, because that tier was
+ * crediting surfaces nothing touched. So each skill needs a file inside its own
+ * directory — this one.
+ *
+ * The assertions live in `.claude/lib/skill-checks.mjs` and are CALLED here with
+ * this skill's name. They are not copied: 22 copies of the same checks is the drift that
+ * module exists to avoid. (Until 2026-08-11 this was an env-var side channel into a
+ * 614-line file named after no surface; it is a function call now.)
+ *
+ * What this proves: this skill's frontmatter parses as strict YAML, its declared
+ * tool contract is sane, its pipeline wiring points at scripts that exist, and it
+ * announces/records under ITS OWN identity rather than a sibling's.
+ *
+ * What it does NOT prove: that the skill fires, or that its guidance produces a
+ * good result. Those need a real model — see `build-benchmark.eval.mjs`.
+ */
+import { checkSkill } from "../../lib/skill-checks.mjs";
+
+await checkSkill("build-benchmark");

package/skills/build-benchmark/references/adversarial-cold-repro.md

@@ -0,0 +1,68 @@
+# Adversarial cold-repro protocol — reviewer-side reproduction of a measurement paper
+
+**Purpose.** Before submitting a measurement paper that ships an artifact, reproduce it _as a hostile
+evaluator_. Default stance is **SKEPTIC**: your job is to **refute** the paper, not to confirm it. Rate a
+claim **CONFIRMED** only if a cold reproduction _forces_ you to. "The prose says so" and "results.json says
+so" are **not** sufficient evidence — both were written by the author you're trying to catch.
+
+Run this once the paper + artifact are drafted, before `submit-paper`. One honest **REFUTED** beats ten
+hand-wavy **CONFIRMED**s.
+
+## Protocol
+
+1. **Reproduce cold.** Run the evaluator(s) from a _clean checkout_, capturing output **without reading the
+   committed results first**. THEN diff your fresh output against the committed JSON. Never overwrite the
+   committed outputs — always run to stdout or a temp file. (Reading the committed numbers first biases you
+   into pattern-matching them instead of independently deriving them.)
+
+   **Clean checkout means clean ENVIRONMENT — a self-checking artifact you never ran clean is
+   UNVERIFIED.** Unzip the exact `artifact.zip` (or `git clone` fresh) into a scratch dir and follow the
+   artifact's own README step-by-step; every self-check must exit 0 and print numbers matching the paper.
+   The trap that hides until a reviewer hits it: **missing/uninstalled dependencies** — a harness that
+   needs `npm install` / `pip install` / a build step the _release script_ doesn't run, so it crashes with
+   `MODULE_NOT_FOUND` on a fresh unzip even though it "passes" in the author's dirty tree (where
+   `node_modules` lingers). Fix: make the release/self-check script install deps itself, and make the
+   README's quick-start the exact commands you just ran clean. A "functional artifact" that isn't
+   functional out of the box is a benchmark-track reject. (Real catch: GateBench's `check-release.sh` ran
+   the Node harnesses without `npm install` — green in the dirty tree, `ERR_MODULE_NOT_FOUND` on a clean
+   one.)
+
+2. **Three-way reconcile EVERY headline number.** For each number the paper leans on, line up:
+   (a) the value in the **paper source** (abstract/intro/results/table),
+   (b) the value in **results.json** (or whatever the artifact commits),
+   (c) your **fresh re-run**.
+   Any drift, off-by-one, or stale number left over from an earlier corpus size is a **finding**. These
+   three must agree exactly; if they don't, the paper is inconsistent until fixed.
+
+3. **Attack robustness, not just arithmetic.** Recompute under stress:
+   - **The paper's OWN stated caveats, taken STRICTLY** — if it says "excluding X," actually exclude X and
+     see if the headline survives.
+   - **Dedup / weighting sensitivity** — does the headline move under a plausible alternative aggregation
+     (per-item vs per-source, weighted vs unweighted, dedup vs raw)? If a different-but-defensible rollup
+     flips the story, the story is fragile.
+   - **Convenience-sample sensitivity** — drop the strongest / outlier item(s). Does the narrative hold, or
+     was it carried by one datapoint?
+
+4. **Attack the arms reviewers hit hardest.**
+   - **Nondeterministic / LLM components** — is any claimed instability _real_, and is the paper careful to
+     claim only the _shape_ (e.g. "unstable," "median 2/10, range 0–5") rather than exact per-cell values a
+     re-run can't reproduce?
+   - **By-construction / "always/never" claims** — are they scoped to a _declared scope_, not stated as
+     unconditional absolutes?
+
+5. **Transcription integrity.** If the evaluator transcribes third-party logic (regexes, predicates, rules)
+   into your own scorer, spot-check a few items against their **real source**. If there's a validation set
+   of corrections, confirm every correction runs in the **claimed direction** (a validation set whose
+   "fixes" cut both ways is a red flag). See the live-contract execution method in `SKILL.md` — a blind
+   re-derivation only validates transcription-vs-human-reading, not transcription-vs-real-behavior.
+
+## Output — one verdict per claim
+
+For each headline claim, emit:
+
+- **VERDICT: CONFIRMED | REFUTED | NEEDS-FIX**
+- The **three numbers** (paper source / results.json / fresh re-run).
+- The **single command** that reproduces it from a clean checkout.
+- If not CONFIRMED: the **minimal fix** + the exact **source file:line** to change.
+
+Keep it terse and adversarial. The deliverable is the list of findings, not reassurance.

package/skills/camera-ready/SKILL.md

@@ -0,0 +1,148 @@
+---
+name: camera-ready
+description: On acceptance, turn the anonymized-for-review paper into the de-anonymized camera-ready that actually enters the proceedings (ACM DL / IEEE Xplore). Reverses double-blind anonymization, swaps the OSF view-only artifact for a real public repo + an archival DOI, and — for security papers — completes responsible disclosure BEFORE any de-anonymized public release. Use after a notification email says Accept and the venue gives a camera-ready deadline. Compose with submit-paper (upstream) and extend-paper (next).
+allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch]
+---
+
+<!-- vigiles:sha256:8fa0190054cc5314 compiled from skills/camera-ready/SKILL.md.spec.ts -->
+
+# camera-ready — de-anonymize an accepted paper into the final proceedings version
+
+## Run me
+
+🔴 FIRST, before any other step:
+
+```
+node .claude/skills/paper-pipeline/scripts/announce.mjs camera-ready <paper-dir>
+```
+
+An advisory pass cannot be observed failing — silence is both its error state and its normal
+state — so starting is an event, and events get written down.
+
+The reviewed PDF was anonymized on purpose. Acceptance flips that: the camera-ready carries your
+real name, your real repo, and an archival DOI — and it's the version that gets indexed, so it's the
+actual authorship evidence. This skill is the reverse of the anonymization you did at
+submission. Work from `paper-pipeline/references/anonymization.md` and undo each move it lists.
+
+## 0. Pre-flight
+- Confirm the **camera-ready deadline** and the **format instructions** in the acceptance email
+  (some venues ship a specific `acmart` template version or a copyright block to paste — use theirs).
+- Read the reviews once more: camera-ready is your one cheap chance to fold in the must-fix comments
+  the meta-review flagged. Do those edits now, not "later."
+- **Security papers only**: do not start the public de-anonymized release until §3 (disclosure) is
+  logged as complete. The de-anon repo is public and Google-findable the moment you push it.
+
+## 1. Reverse the anonymization
+Undo, one by one, everything `../paper-pipeline/references/anonymization.md` told you to hide:
+- **Class options**: `\documentclass[sigconf,review,anonymous]{acmart}` → `\documentclass[sigconf]{acmart}`.
+  Dropping `review` also drops line numbers and the review-mode banner; dropping `anonymous` un-hides
+  the author block.
+
+  🔴 **Dropping `review` ARMS a gate that was exempt until this second — run it NOW, in the same
+  pass, not at push time:**
+
+  ```bash
+  npx eslint --no-config-lookup --config eslint.config.mjs <paper.tex>
+  ```
+
+  `tex/future-promise` exempts review builds deliberately: while a paper is under review, "the
+  harness will be released at camera-ready" is true and expected. The moment `review` comes off,
+  the same sentence becomes a contradiction with the Availability paragraph — and that is exactly
+  the defect this rule was created for, on a real submitted paper, where a reviewer had already
+  listed the missing artifact as a weakness and the printed camera-ready went on asserting it.
+
+  ⚠️ **Why it must run HERE and not be left to CI** (measured 2026-09-11): the check lives in
+  ESLint, and no local hook runs ESLint on `.tex` — `paper-lint.mjs` stopped carrying it on
+  2026-09-07. CI does run it, but CI runs *after a push*, while a camera-ready gets built and
+  uploaded to HotCRP before that. Between "dropped `review`" and "pushed" the gate does not
+  exist. Measured on a fixture: in review mode 0 findings, with `review` removed 1 finding —
+  the rule flips instantly, so the only question is whether anyone looks.
+
+  ⚠️ And re-run it after the LAST edit to `paper.tex`, not once at the start. The original
+  defect survived because the promise was swept out of the artifact (`README`, `reproduce.py`)
+  the same day and nobody made the same pass over `paper.tex`: one class of defect, two
+  carriers, one cleaned.
+- **Author block**: replace `Anonymous Author(s)` with your real name, affiliation (`None` /
+  `Unaffiliated` if independent — that's honest, not a weakness), city/country, email, and
+  `\orcid{...}`. Keep the **ORCID identical** to your prior papers — it's the permanent thread that
+  ties every version to one identity regardless of name spelling.
+- **Un-blind self-citations**: the "[anonymized for review]" / "our prior work [redacted]" placeholders
+  become the real citations. Grep the `.tex` for `anonym`, `redact`, `blinded`.
+- **"Our tool" naming**: the studied artifact and your own tool get their real names back everywhere —
+  title, abstract, figures, captions, artifact README. (For AISec: the anonymized hook names get their
+  real names back **only after** disclosure, §3.)
+- **Acknowledgements / funding**: add the section that was omitted for blind review (thanks, grant
+  numbers, compute credits). None to declare is fine — say nothing rather than invent a funder.
+
+## 2. Swap the artifact: real repo + ARCHIVAL DOI
+The review artifact was an OSF anonymized view-only link. The camera-ready needs two things:
+- **A real public repo** (your GitHub, de-anonymized, with the generation layer / de-anon code that you
+  promised "lands at camera-ready" in the submission README).
+- **An archival DOI** — mint it on **Zenodo or Figshare** (GitHub→Zenodo release integration is the
+  easy path). A zip sitting in a repo does **not** earn the ACM "Artifacts Available" badge; a DOI'd,
+  immutable deposit does. Put the DOI (not just the repo URL) in the Availability section via `\url{}`
+  or `\doi{}`.
+- Keep the artifact **self-checking** (it still recomputes every headline number and exits non-zero on
+  drift) — de-anonymizing it doesn't excuse it from reproducing the paper.
+
+## 3. Responsible disclosure (security papers — BEFORE public release)
+For the AISec "Safety Theater" paper the studied hooks are named-but-anonymized, and disclosure to the
+maintainers is **owed before** any de-anonymized public release. Do this, in order:
+- Identify the named parties (maintainers of each studied hook / tool).
+- Send a private disclosure (email / security advisory) with the finding, repro, and a fix suggestion.
+  Give a reasonable remediation window (the venue or a 90-day norm).
+- **Log it**: who, when, via what channel, and their response — keep the thread. This log is both
+  ethics evidence and "impact" material.
+- Only after disclosure is sent (and ideally acknowledged) do you push the de-anonymized repo and
+  restore real hook names in the camera-ready. If a maintainer needs more time, hold the public release
+  and coordinate — the indexed paper can go out with names still generalized if disclosure is pending.
+
+## 4. Re-check the page limit
+De-anonymizing **adds lines** — the author block, acknowledgements, un-abbreviated self-cites, real
+URLs all grow the paper. Camera-ready page limits are often the same as (or one page more than) review,
+and going over is a hard reject at the proceedings stage. Recompile
+(`pdflatex; bibtex; pdflatex; pdflatex`), confirm 0 undefined refs, and check you're within the limit.
+If tight, ACM allows references to spill into the reference-only extra pages.
+
+## 5. Ship
+- Rebuild the final PDF, upload to the camera-ready system (often the same HotCRP, or an ACM eRights /
+  TAPS pipeline — follow the copyright email).
+- Complete the **ACM/IEEE eRights** copyright form → paste the returned copyright block + DOI into the
+  `.tex` before the final build (ACM validates this).
+- Verify the public artifact link resolves and the DOI is live before you submit the final PDF.
+- Record the paper's DOI, the artifact DOI, and the ORCID in the paper's HANDOFF — those three IDs are
+  the authorship evidence and the anchor the extension (`extend-paper`) builds on.
+
+## 6. Record the verdict
+
+🔴 LAST step, once the deliverable exists:
+
+```
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record camera-ready <paper-dir> FINDING <count> <report-path>
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record camera-ready <paper-dir> ABSTAINED <reason> "<one line>"
+```
+
+**FINDING** — `<count>` residual items still open; `<report-path>` names them. Add `--blocking` for
+anything that must not be pushed past: anonymization residue, a dead artifact link, or — on a
+security paper — disclosure not yet complete.
+**ABSTAINED** — `no-witness`: shipped, de-anonymized, DOI live, page limit re-checked, with the DOI
+in the note. `blocked`: the acceptance notice has not arrived, so there is nothing to make ready.
+
+🔴 That blocking finding is the only one in this pipeline whose consequence is **irreversible**. The
+public de-anonymized repo is Google-findable the moment it is pushed, so record it before, not after.
+
+🔴 **There is no PASS**, and on this skill that is not a formality: a stored "shipped" would have
+been the one row in the pipeline that could be true of a repo nobody had looked at. The DOI in the
+note is the witness. Without it there is nothing to check the row against.
+
+## Compose with
+- **submit-paper** (upstream — this reverses what it anonymized).
+- **paper-pipeline/references/anonymization.md** — the canonical list of anonymization moves; undo each.
+- **extend-paper** (next — the accepted+indexed paper is the base for a second, stronger publication).
+
+## Provenance
+Both portfolio papers are anonymized-for-review and **defer de-anonymization + the public artifact to
+camera-ready by design**: AgenticDev "Measuring the Wrong Number" (submitted, camera-ready 28 Aug if
+accepted) and AISec "Safety Theater" (ships an anonymized artifact; hook names anonymized; responsible
+disclosure to named maintainers owed before any de-anonymized public release). ORCID is identical
+across both so every indexed version resolves to one researcher.

package/skills/camera-ready/SKILL.md.spec.ts

@@ -0,0 +1,164 @@
+// Compiled to SKILL.md by `vigiles compile`. Edit THIS file, never the markdown.
+//
+// Adopted 2026-08-17 (batch 3). Body carried over VERBATIM so the compiled diff shows
+// only what the compiler adds. No `disallowedTools` fence yet — the field landed on
+// `SkillSpec` in vigiles branch `claude/skill-disallowed-tools` and is not in a release
+// this repo installs, so writing one here would not compile.
+import { experimental_skill } from "vigiles/spec";
+
+export default experimental_skill({
+  name: "camera-ready",
+  description:
+    "On acceptance, turn the anonymized-for-review paper into the de-anonymized camera-ready that actually enters the proceedings (ACM DL / IEEE Xplore). Reverses double-blind anonymization, swaps the OSF view-only artifact for a real public repo + an archival DOI, and — for security papers — completes responsible disclosure BEFORE any de-anonymized public release. Use after a notification email says Accept and the venue gives a camera-ready deadline. Compose with submit-paper (upstream) and extend-paper (next).",
+  tools: [
+    "Read",
+    "Write",
+    "Edit",
+    "Grep",
+    "Glob",
+    "Bash",
+    "WebSearch",
+    "WebFetch",
+  ],
+  body: `
+# camera-ready — de-anonymize an accepted paper into the final proceedings version
+
+## Run me
+
+🔴 FIRST, before any other step:
+
+\`\`\`
+node .claude/skills/paper-pipeline/scripts/announce.mjs camera-ready <paper-dir>
+\`\`\`
+
+An advisory pass cannot be observed failing — silence is both its error state and its normal
+state — so starting is an event, and events get written down.
+
+The reviewed PDF was anonymized on purpose. Acceptance flips that: the camera-ready carries your
+real name, your real repo, and an archival DOI — and it's the version that gets indexed, so it's the
+actual authorship evidence. This skill is the reverse of the anonymization you did at
+submission. Work from \`paper-pipeline/references/anonymization.md\` and undo each move it lists.
+
+## 0. Pre-flight
+- Confirm the **camera-ready deadline** and the **format instructions** in the acceptance email
+  (some venues ship a specific \`acmart\` template version or a copyright block to paste — use theirs).
+- Read the reviews once more: camera-ready is your one cheap chance to fold in the must-fix comments
+  the meta-review flagged. Do those edits now, not "later."
+- **Security papers only**: do not start the public de-anonymized release until §3 (disclosure) is
+  logged as complete. The de-anon repo is public and Google-findable the moment you push it.
+
+## 1. Reverse the anonymization
+Undo, one by one, everything \`../paper-pipeline/references/anonymization.md\` told you to hide:
+- **Class options**: \`\\documentclass[sigconf,review,anonymous]{acmart}\` → \`\\documentclass[sigconf]{acmart}\`.
+  Dropping \`review\` also drops line numbers and the review-mode banner; dropping \`anonymous\` un-hides
+  the author block.
+
+  🔴 **Dropping \`review\` ARMS a gate that was exempt until this second — run it NOW, in the same
+  pass, not at push time:**
+
+  \`\`\`bash
+  npx eslint --no-config-lookup --config eslint.config.mjs <paper.tex>
+  \`\`\`
+
+  \`tex/future-promise\` exempts review builds deliberately: while a paper is under review, "the
+  harness will be released at camera-ready" is true and expected. The moment \`review\` comes off,
+  the same sentence becomes a contradiction with the Availability paragraph — and that is exactly
+  the defect this rule was created for, on a real submitted paper, where a reviewer had already
+  listed the missing artifact as a weakness and the printed camera-ready went on asserting it.
+
+  ⚠️ **Why it must run HERE and not be left to CI** (measured 2026-09-11): the check lives in
+  ESLint, and no local hook runs ESLint on \`.tex\` — \`paper-lint.mjs\` stopped carrying it on
+  2026-09-07. CI does run it, but CI runs *after a push*, while a camera-ready gets built and
+  uploaded to HotCRP before that. Between "dropped \`review\`" and "pushed" the gate does not
+  exist. Measured on a fixture: in review mode 0 findings, with \`review\` removed 1 finding —
+  the rule flips instantly, so the only question is whether anyone looks.
+
+  ⚠️ And re-run it after the LAST edit to \`paper.tex\`, not once at the start. The original
+  defect survived because the promise was swept out of the artifact (\`README\`, \`reproduce.py\`)
+  the same day and nobody made the same pass over \`paper.tex\`: one class of defect, two
+  carriers, one cleaned.
+- **Author block**: replace \`Anonymous Author(s)\` with your real name, affiliation (\`None\` /
+  \`Unaffiliated\` if independent — that's honest, not a weakness), city/country, email, and
+  \`\\orcid{...}\`. Keep the **ORCID identical** to your prior papers — it's the permanent thread that
+  ties every version to one identity regardless of name spelling.
+- **Un-blind self-citations**: the "[anonymized for review]" / "our prior work [redacted]" placeholders
+  become the real citations. Grep the \`.tex\` for \`anonym\`, \`redact\`, \`blinded\`.
+- **"Our tool" naming**: the studied artifact and your own tool get their real names back everywhere —
+  title, abstract, figures, captions, artifact README. (For AISec: the anonymized hook names get their
+  real names back **only after** disclosure, §3.)
+- **Acknowledgements / funding**: add the section that was omitted for blind review (thanks, grant
+  numbers, compute credits). None to declare is fine — say nothing rather than invent a funder.
+
+## 2. Swap the artifact: real repo + ARCHIVAL DOI
+The review artifact was an OSF anonymized view-only link. The camera-ready needs two things:
+- **A real public repo** (your GitHub, de-anonymized, with the generation layer / de-anon code that you
+  promised "lands at camera-ready" in the submission README).
+- **An archival DOI** — mint it on **Zenodo or Figshare** (GitHub→Zenodo release integration is the
+  easy path). A zip sitting in a repo does **not** earn the ACM "Artifacts Available" badge; a DOI'd,
+  immutable deposit does. Put the DOI (not just the repo URL) in the Availability section via \`\\url{}\`
+  or \`\\doi{}\`.
+- Keep the artifact **self-checking** (it still recomputes every headline number and exits non-zero on
+  drift) — de-anonymizing it doesn't excuse it from reproducing the paper.
+
+## 3. Responsible disclosure (security papers — BEFORE public release)
+For the AISec "Safety Theater" paper the studied hooks are named-but-anonymized, and disclosure to the
+maintainers is **owed before** any de-anonymized public release. Do this, in order:
+- Identify the named parties (maintainers of each studied hook / tool).
+- Send a private disclosure (email / security advisory) with the finding, repro, and a fix suggestion.
+  Give a reasonable remediation window (the venue or a 90-day norm).
+- **Log it**: who, when, via what channel, and their response — keep the thread. This log is both
+  ethics evidence and "impact" material.
+- Only after disclosure is sent (and ideally acknowledged) do you push the de-anonymized repo and
+  restore real hook names in the camera-ready. If a maintainer needs more time, hold the public release
+  and coordinate — the indexed paper can go out with names still generalized if disclosure is pending.
+
+## 4. Re-check the page limit
+De-anonymizing **adds lines** — the author block, acknowledgements, un-abbreviated self-cites, real
+URLs all grow the paper. Camera-ready page limits are often the same as (or one page more than) review,
+and going over is a hard reject at the proceedings stage. Recompile
+(\`pdflatex; bibtex; pdflatex; pdflatex\`), confirm 0 undefined refs, and check you're within the limit.
+If tight, ACM allows references to spill into the reference-only extra pages.
+
+## 5. Ship
+- Rebuild the final PDF, upload to the camera-ready system (often the same HotCRP, or an ACM eRights /
+  TAPS pipeline — follow the copyright email).
+- Complete the **ACM/IEEE eRights** copyright form → paste the returned copyright block + DOI into the
+  \`.tex\` before the final build (ACM validates this).
+- Verify the public artifact link resolves and the DOI is live before you submit the final PDF.
+- Record the paper's DOI, the artifact DOI, and the ORCID in the paper's HANDOFF — those three IDs are
+  the authorship evidence and the anchor the extension (\`extend-paper\`) builds on.
+
+## 6. Record the verdict
+
+🔴 LAST step, once the deliverable exists:
+
+\`\`\`
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record camera-ready <paper-dir> FINDING <count> <report-path>
+node .claude/skills/paper-pipeline/scripts/ledger.mjs record camera-ready <paper-dir> ABSTAINED <reason> "<one line>"
+\`\`\`
+
+**FINDING** — \`<count>\` residual items still open; \`<report-path>\` names them. Add \`--blocking\` for
+anything that must not be pushed past: anonymization residue, a dead artifact link, or — on a
+security paper — disclosure not yet complete.
+**ABSTAINED** — \`no-witness\`: shipped, de-anonymized, DOI live, page limit re-checked, with the DOI
+in the note. \`blocked\`: the acceptance notice has not arrived, so there is nothing to make ready.
+
+🔴 That blocking finding is the only one in this pipeline whose consequence is **irreversible**. The
+public de-anonymized repo is Google-findable the moment it is pushed, so record it before, not after.
+
+🔴 **There is no PASS**, and on this skill that is not a formality: a stored "shipped" would have
+been the one row in the pipeline that could be true of a repo nobody had looked at. The DOI in the
+note is the witness. Without it there is nothing to check the row against.
+
+## Compose with
+- **submit-paper** (upstream — this reverses what it anonymized).
+- **paper-pipeline/references/anonymization.md** — the canonical list of anonymization moves; undo each.
+- **extend-paper** (next — the accepted+indexed paper is the base for a second, stronger publication).
+
+## Provenance
+Both portfolio papers are anonymized-for-review and **defer de-anonymization + the public artifact to
+camera-ready by design**: AgenticDev "Measuring the Wrong Number" (submitted, camera-ready 28 Aug if
+accepted) and AISec "Safety Theater" (ships an anonymized artifact; hook names anonymized; responsible
+disclosure to named maintainers owed before any de-anonymized public release). ORCID is identical
+across both so every indexed version resolves to one researcher.`,
+});