paperlint 2.0.0

package/skills/paper-pipeline/SKILL.md

@@ -0,0 +1,499 @@
+---
+name: paper-pipeline
+description: The orchestrator for writing a research paper end-to-end, from idea to accepted-and-extended, with every stage graded for the credit it earns a body of work. START HERE when writing/hardening a paper (AgenticDev, AISec, and future ones) and want the whole lifecycle driven, not one step. Routes to the stage skills — research-ideate, find-venue, plan-paper-timeline, build-benchmark, draft-paper, render-paper, verify-citations, the review skills, submit-paper (+ venue cards), camera-ready, extend-paper — and owns the shared references.
+allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Agent, Skill]
+---
+
+<!-- vigiles:sha256:6ec7cc1d25db0a0f compiled from skills/paper-pipeline/SKILL.md.spec.ts -->
+
+# paper-pipeline — the conductor for the whole organism
+
+This is the entry point. Each lifecycle stage is its own skill; this routes through them in order and
+owns the shared reference docs the others cite. **These papers are written to COUNT as credentials** —
+every stage is graded against `references/credit-criteria.md`, not abstract "impact." The personal half
+of that — who is filing what, and when — stays in the author's own private notes, never in a public repo.
+
+## Shared references (single source of truth — all skills cite these)
+- `references/credit-criteria.md` — which criteria a paper feeds; where venue quality bites; the
+  decisions credit value forces on the pipeline.
+- `references/artifact-checklist.md` — the self-checking reproduction artifact.
+- `references/anonymization.md` — the double-blind deny-list + hygiene (and its reverse at camera-ready).
+- `references/writing-craft.md` — how well-written papers read (craft rules + exemplar lessons + the
+  gradeable 9-dim writing rubric); cited by `draft-paper`, `grade-paper-writing`, and `harden-paper`.
+- `references/review-ratchet.md` — how to fix a caught overclaim (tighten → cut → Threats → hedge)
+  and why every review round must be paid back with a `tighten-paper` pass; cited by
+  `paper-adversarial-review`, `pc-panel-review`, `harden-paper`.
+- `references/pipeline-status-template.md` — the per-paper **readiness scorecard** (which stages ran,
+  grades, open findings, submit-ready verdict). Copied into `<paper-dir>/PIPELINE-STATUS.md`.
+- `references/acl-venue-rules.md` — what holds at **every** ACL-family venue and workshop: the
+  page-limit map, the appendix rule and the trap inside it, Limitations/Ethics as free-but-restricted
+  space, anonymity, OpenReview mechanics. Fetch once, not per paper. Venue-specific facts stay in
+  `submit-paper/references/venues/<venue>.md`. (No equivalent yet for ACM or IEEE — write one when
+  the next paper goes there.)
+
+## The readiness scorecard (which boxes are checked)
+Stages run in subagents and report into chat, which evaporates — so "did everything run?" becomes
+unanswerable. Fix: every paper carries a **`<paper-dir>/PIPELINE-STATUS.md`** (template in
+`references/pipeline-status-template.md`), the durable colocated source-of-truth for *which stages ran,
+their grade/result, what's open,* and a one-line **submit-ready verdict**. Rules:
+- **When any stage runs (here or in a subagent), update its row in the same commit** — status, date,
+  result, open findings, artifact link. The scorecard is only trustworthy if it's kept live.
+- **Never inflate:** a stage not run *this* cycle is `☐`, even if a prior submission ran it — don't
+  borrow credit you can't point to. Approximate/from-memory grades get `≈`.
+- **"Is paper X ready / what's checked?"** = read this file (verdict + any `☐`/`◐`/`⚠` rows), don't
+  reconstruct from chat.
+- Distinct from `SUBMIT-CHECKLIST.md` (venue-format compliance); both must be green before upload.
+- 🔴 **Enforcement leg (prose-isn't-policy), and it is a script, not a paragraph.**
+  `scripts/pipeline-check.mjs` reads this file on every paper edit and reports the failures that
+  actually happened on real papers: a CONTINUOUS check whose last run predates the current text, a GATE
+  that ran without its required input, **a `Requires` cell that omits an edge the pipeline declares**
+  (the canonical set is `scripts/pipeline-edges.mjs`, with the admitting sentence per edge), a study
+  that ran with no stated claim, the `access` row not green inside the moderation window, and a verdict
+  line that is just an accept probability. Run it directly
+  with `node .claude/skills/paper-pipeline/scripts/pipeline-check.mjs <paper-dir>`; it is wired into
+  `.claude/hooks/paper-status-gates.sh` and asserted in `.claude/hooks/hooks.harness.mjs`.
+  **The grading itself stays judgment** (that is the skills' job) — only the mechanically checkable
+  parts are compiled. *Added 2026-08-03, the day three hooks in this repo were found to have been dead
+  for weeks: an advisory that is never exercised is indistinguishable from one that works.*
+
+  🔴 **As of 2026-08-26, this file is read by TWO things.** Sixteen checks over it live as
+  `@eslint/markdown` rules in `eslint-rules/pipeline-status.mjs` (run:
+  `npx eslint <paper-dir>/PIPELINE-STATUS.md`; five of them are `error`), while
+  `scripts/pipeline-check.mjs` holds six whose input lies OUTSIDE the file — git, the clock, the
+  `reviews/` directory, `process.env`. The classification of all 22 lives in the
+  author's private notes (`<papers-root>/research/2026-08-26-klassifikatsiya-pipeline-check.md`).
+
+  ⚠️ The paragraph above lived for a day NOT HERE but directly in `SKILL.md` — i.e. in the
+  generated file. The very first `vigiles compile` (27.08) ate it, and it was not a human who
+  noticed but an agent whose compile had just erased someone else's edit. **An edit to `SKILL.md`
+  without `.spec.ts` is an edit with an expiration date: the next compile.**
+
+## 🗺️ Where every check actually runs — and where it can be walked around
+
+```
+   YOU EDIT                    YOU COMMIT                YOU BUILD              YOU PUSH
+      │                            │                         │                      │
+      ▼                            ▼                         ▼                      ▼
+ ┌──────────────┐          ┌────────────────┐       ┌────────────────┐    ┌────────────────┐
+ │ PostToolUse  │          │  .githooks/    │       │ build-         │    │ GitHub Actions │
+ │ paper-lint   │ BLOCKS   │  pre-commit    │REFUSES│ submission.sh  │    │ paper-gates    │
+ │  pre >55 wds │          │                │       │                │    │                │
+ │ paper-lint   │ nudges   │  numbers gate  │       │  numbers gate  │REFUSES  numbers+self│
+ │  post        │          │                │       │                │    │                 │
+ │   prose-lint │          │  prose-lint    │ nudge │  page count    │    │  prose-lint     │
+ │   SHAVE      │          │  self-test if  │       │  overfull      │    │  check-anon     │
+ │   numbers    │          │   you touched  │       │  unresolved    │    │  verify-cites   │
+ │  paper-edit- │ BLOCKS   │   a gate       │       │   refs         │    │  provenance     │
+ │   guard      │  bash    │  harness if    │       │  dropped glyphs│    │  scorecard      │
+ └──────────────┘          │   you touched  │       │  anon grep     │    │  harness        │
+        │                  │   a hook       │       └────────────────┘    │  LaTeX build    │
+        │                  │  RAW DNA       │REFUSES        │             └────────────────┘
+        │                  └────────────────┘               │                     │
+        │                          │                        │                     │
+   watches EVENTS            watches STATE            watches OUTPUT        watches EVERYTHING
+   (Edit/Write fired)        (what is staged)         (the actual PDF)       (after the fact)
+        │                          │
+        │                          │
+   🕳 BYPASSABLE:              🛡 NOT bypassable by that route: it does not care
+   write from Bash and            HOW the bytes got there. However you wrote the
+   no event fires, so             file, you still have to commit it.
+   every PostToolUse
+   check silently
+   does not run.
+```
+
+**Read the bottom row, it is the whole point.** Each column watches a different KIND of thing, and
+that is why they are not three copies of one check:
+
+- **Editor hooks watch events.** Fast, and the only layer that can stop a bad edit *before* it lands.
+  Bypassable by construction — an event that never fires cannot be checked, and writing the file from
+  Bash produces no event. Documented in `papers/CLAUDE.md`, open since 2026-08-04.
+- **The git hook watches state.** Immune to that whole class, because it reads what is staged and has
+  no opinion about how it got staged. This is the layer that was missing, and the one to reach for
+  when an editor check turns out to be walkable-around.
+- **The build watches output.** Only it can see page count, overfull boxes, and glyphs pdflatex
+  silently dropped — none of which exist until the PDF does.
+- **CI watches everything, but after the fact.** Its real job is the slow checks nobody will wait for
+  locally (the anonymity self-test copies a 24 MB bundle per leak category) and the self-tests, which
+  are what catch a gate that has quietly stopped catching things.
+
+🔴 **A fifth kind, and none of the four columns can see it: does the MODEL call these skills at all?**
+Every column above watches something the repository produced — an event, staged bytes, a PDF, a commit.
+None watches *selection*: whether a real model, reading 37 competing descriptions, picks `tighten-paper`
+over `grade-paper-writing` when the draft is bloated. A harness test proves a skill works once invoked;
+it cannot prove it gets invoked. That needs the real CLI and it costs money, so it is a measurement, not
+a gate — `.claude/skills/paper-pipeline/pipeline-firing.eval.mjs`, run manually or by the weekly
+`skill-firing` job (`workflow_dispatch` + `schedule`, deliberately NOT on push). It installs every skill
+in this repo natively so selection is *competitive*, feeds each skill 4 prompts it should fire on plus 4
+its colliding sibling owns, and reports recall / false-positive / precision per skill against a committed
+baseline. **What it measures drifts without a commit here** — a model update can change routing while
+every file stays byte-identical, which is exactly the regression no check in the diagram can see.
+Prior art is named in the file header (`adewale/skill-eval-harness` does this too); the idea is not ours.
+
+🔴 **Still manual, and no mechanism has been found for it:** the **cold read** — a reader with no
+context restating each sentence — is the only check that catches a sentence that is short, true,
+threshold-passing and meaningless. It needs a fresh subagent, so no hook can run it. What IS
+mechanised is noticing that it is *overdue*: `pipeline-check.mjs` reports `stale-cold-read` when the
+prose changed after the last one.
+
+Install the git hook once per clone: `git config core.hooksPath .githooks`.
+
+## 🔴 There is no stage 7. Four kinds of work, four shapes.
+
+**This section replaced a single numbered list running 0 → 12, on 2026-08-03.** That list had a
+paragraph on top explaining that the numbers were dependencies rather than turns — and underneath it,
+a table numbered straight through, which every reader (including this pipeline's own author) read as a
+waterfall. The paragraph was the tell: a document that needs a disclaimer explaining how not to read
+it is mis-shaped, and the fix is to change the shape, not to add a second disclaimer. That is the
+argument `compile-rules-2026` makes about instruction files, applied here.
+
+Three concrete errors the numbering produced, all real:
+
+- **`verify-citations` sat at 7**, looking like a one-shot step, while the project rule is that it runs
+  every cycle — an edit on the last day adds a `\cite` that "we checked last cycle" does not cover.
+- **`render-paper` sat at 6**, as a stage. It is a command you run twenty times a day.
+- **`map-prior-work` sat at 1.5** and its own description told you to re-run it as a cheap delta before
+  submit — so it was simultaneously a stage and a continuous check, and the table could only show one.
+
+Work is now grouped by **how it runs**, and only the groups that are genuinely ordered carry an order.
+
+| kind | shape | how to read it |
+|---|---|---|
+| **SETUP** | ordered | Each genuinely gates the next. Runs once, before the study is malleable. |
+| **LOOP** | unordered cycle | Draft ↔ study ↔ arc ↔ review. No numbers, because there are no turns. |
+| **CONTINUOUS** | trigger table | Fires when the thing it checks changes. Never "done". |
+| **GATES** | ordered by input | Late, expensive, each hard-blocked on a named input. |
+
+---
+
+## SETUP — once, before anything is expensive to change
+
+Ordered, because each really does gate the next. Two pairs run in parallel; that is marked.
+
+| Step | Skill | What it settles |
+|---|---|---|
+| **Orient** | — | Read `<papers-root>/HANDOFF.md` + `<papers-root>/research/README.md`. Never restart from scratch. |
+| **Validate the idea** | **`research-ideate`** | Is it a reusable method (survives review) in your lane, and does it feed the credit criteria? Go/no-go + the MVP finding. |
+| **Map the competition** ‖ | **`map-prior-work`** | 🔴 **Who already did this?** Multi-angle sweep; date each hit against your submission (5 months = prior, not concurrent); triage by which layer of your claim it threatens; deep-read the dangerous ones. Output: **what you can still claim** + a related-work skeleton. *Added 2026-07-27 after a five-month-older paper surfaced at T−10 days on a finished draft.* |
+| **Pick the venue** ‖ | **`find-venue`** | Rank by credit-weight (peer-reviewed + indexed) × fit × accept-odds × deadline × remote. |
+| **Learn the venue's bar** | **`study-accepted-papers`** | 🔴 **What does an ACCEPTED paper look like HERE?** Measure the venue's whole accepted volume, deep-read 8–12 of your contribution type, and extract what made them strong: evidence scale, figures, artifact release, how the abstract is built. File the venue card (`submit-paper/references/venues/<venue>.md`) and confirm family rules (`references/acl-venue-rules.md`). *Promoted to its own step 2026-08-03: on `compile-rules-2026` every judgement of the paper's quality — rubric, persona, simulated panel, accept probability — came from instruments this pipeline itself generated, with no external grounding, and the author had to say so at T−3 days. A closed loop optimises against its own model of a reviewer.* |
+| 🔴 **Can you physically submit?** | **`plan-paper-timeline`** | **The step that owns the question no stage used to own.** Create the portal account NOW; drive the profile to **ACTIVE**, not "pending moderation"; confirm the form's fields and the artifact-hosting requirement. OpenReview moderation runs **up to two weeks**, and an author with no institutional email has no expedite route. Scorecard row `access`. *Added 2026-08-03, when this was the sole critical-path item on a finished paper at T−4 days: the science was done and there was nowhere to put it.* |
+| **Schedule it** | **`plan-paper-timeline`** | Deadlines → calendar with buffers, in the author's own zone (AoE − 12h ≠ your clock). Space papers apart. |
+| 🔴 **State the claim** | **`argument-arc`** (frame mode) | **One paragraph: what will this paper claim, and what would have to be true?** Before any run. The frame decides which results matter, and reframing after the data is collected is how experiments get thrown away — observed on `compile-rules-2026`, and the reason `argument-arc` has a rebuild mode at all. Costs a paragraph; saves a study. Scorecard row `frame`. |
+
+## LOOP — iterates until it settles
+
+No numbers. Nothing here happens once, and nothing here is "next".
+
+```
+        study ──────────► draft
+     build-benchmark    draft-paper
+          ▲                 │
+          │                 ▼
+      argument-arc ◄──── the arc
+     (rebuild mode)     5.5 verdict
+```
+
+- **`build-benchmark`** — a design that inverts the pitfall; honest stats; a self-checking artifact
+  (`references/artifact-checklist.md`).
+- **`draft-paper`** — section skeleton + the accept-and-get-cited properties
+  (`references/writing-craft.md`).
+- **`argument-arc`** — 🔴 **does the draft carry the reader to ONE conclusion?** One sentence per
+  section (*what does the reader now believe*), then a bottom-up pass asking whether each section makes
+  the conclusion harder to escape. Owns **rebuild mode**: the only protocol here for *the frame is
+  wrong, start the arc over*. Every other gate assumes a settled draft and patches it. *Added
+  2026-07-30 after a full-day rewrite in which the author said five times that the paper threw ideas at
+  him and got five local edits back.*
+
+**Leaving the loop** means the arc holds and the numbers are in. Not that the prose is pretty — that
+is what the gates are for.
+
+## CONTINUOUS — fires when its input changes, never "done"
+
+These have no position, because a position is what made them look finished. Each is a trigger.
+
+| When this changes | Run | Why it cannot be a stage |
+|---|---|---|
+| any `\cite` added or moved | **`verify-citations`** | An edit on the last day adds a citation the last run never saw. "We checked last cycle" does not count — the project rule, and it was numbered as a one-shot anyway. |
+| a genuine sibling surfaces | **`analyze-sibling-paper`** | Deep-read, scoop/delta, saved in `<paper-dir>/siblings/`. |
+| the contribution's framing moves | **`map-prior-work`** (delta mode) | A cheap re-sweep. ⚠️ If a rival first surfaces during citation checking, the SETUP sweep was skipped and you are reshaping the contribution under deadline. |
+| any `.tex` / `paper.md` edit | **`render-paper`** + page count | **Not a stage — a command.** Render, then eyeball pages 1–2 before believing anything about the paper. 🔴 **Rendering is continuous; ACTING on the page count is not** — see the rule below. |
+| the deadline approaches | the `access` row | Re-check that the profile is still ACTIVE and the portal still opens. External state rots without telling you. |
+
+## GATES — late, expensive, each blocked on a named input
+
+Ordered, and the order is real: every one refuses to run without the output of the one before it.
+
+| Gate | Skill | Requires (hard) |
+|---|---|---|
+| **Structure** | **`tighten-paper`** | A rendered PDF and a page count. Produces the cut plan + structural verdict. *Before 2026-07-30 this appeared only INSIDE the harden stage — i.e. after the gate that requires it — so a literal reading sent you into a hard-blocked gate.* |
+| **Writing craft** | **`grade-paper-writing`** | The current draft. Produces the **persona stall inventory**, which the panel cannot run without. |
+| **Review decision** | **`pc-panel-review`** | 🔴 **Both of the above.** N independent lenses (incl. an artifact-runner that executes the artifact) + a chair meta-review — predicts the PC's accept/reject. Its venue-fit mode is the one-reviewer CFP-fit spot-check. |
+| **Claim preservation** | Fable diff (`claims`) | The pre-pass baseline. Run after **every** aggressive rewrite, before committing. |
+| **Harden** | **`harden-paper`** | The panel's verdict. Closes the desk-reject axes a reviewer-sim misses: threat-model, ethics/dual-use, page-fit, citability, double-blind hygiene, artifact-runs-clean. Its structure and writing axes are the **re-run/confirm** pass, not the first invocation. |
+| **Submit** | **`submit-paper`** (+ the venue card) | 🔴 **The `access` row green.** Portal mechanics, PDF-only, artifact hosted anonymously, "ready for review" marked. |
+
+## AFTER — only reachable by acceptance
+
+**`camera-ready`** — de-anonymize; public repo + archival DOI; complete disclosure. Then
+**`extend-paper`** — extend (≥30% new) to a higher-prestige venue, the "second, stronger publication."
+
+**Which review skill?** `paper-adversarial-review` = one hostile reviewer, fast defect hunt;
+`pc-panel-review` = the full panel + meta-review that makes the accept/reject **decision** (its
+**venue-fit mode** is the one-reviewer CFP-fit spot-check — formerly the standalone `venue-review-sim`).
+Use an atom for a quick spot-check; **run the panel for the decision.**
+
+**Four grading axes — don't confuse them.** A draft is judged on four independent axes, each its own
+skill: 🔴 **argument architecture** — does the whole thing carry the reader to one conclusion
+(`argument-arc`, in the LOOP; the axis that failed on `compile-rules-2026` precisely because it was
+nobody's) · **content strength** — does the contribution clear *this venue's* bar (`study-accepted-papers`,
+mines the accepted corpus for Accept→Strong levers; in SETUP, before the prose is set) ·
+**scientific defects** — what a hostile reviewer attacks (`paper-adversarial-review` / `pc-panel-review`)
+· **writing craft** — does it read like a human wrote it (`grade-paper-writing`, the 9-dim rubric in
+`references/writing-craft.md`; called by `harden-paper`). A paper can ace one and fail another — grade all four.
+**The arc axis comes first**, because tightening length and polishing sentences inside a broken arc is
+how a day disappears and the same paper ships.
+
+**Panel vs harden — not rival gates, they're sequential.** `pc-panel-review` is the review DECISION
+gate: it predicts what the PC does. `harden-paper` is the pre-submit ORCHESTRATOR: it *calls* the review
+skills and then closes the desk-reject axes a reviewer-sim doesn't systematically hit (threat-model,
+ethics/dual-use, page-fit, citability, double-blind hygiene). Order is **review (decide) → harden (close
+every other axis) → submit** — neither is "the one final gate" alone.
+
+## The review round (a cycle inside GATES)
+Review → **apply the consensus fixes → re-run the panel to confirm**. The artifact-runner re-executes
+the artifact each round. Stop when the panel converges to accept and the artifact reproduces clean —
+**don't loop past one confirming round**, and don't chase the last notch into the deadline. A defensible
+**Accept shipped on time beats a risky Strong that misses it**.
+
+## 📝 Text pass vs evidence pass — two independent axes, ask which one you want
+
+The author, 2026-08-05 (translated from Russian): *"can we just run the gate on the text? we just
+checked the numbers, and now I want to grade the text — assume the numbers are fine."* He is right that these are separable, and
+running both when only one is wanted burns an hour for nothing.
+
+Every gate belongs to exactly one axis. **Sort by what invalidates it**, not by what it reads:
+
+| axis | invalidated by | gates |
+|---|---|---|
+| **TEXT** — does the argument land? | a change to the **prose**: any edit, cut, reorder | `structure` tighten-paper · `writing` grade-paper-writing · `arc` argument-arc · the prose lenses of `panel` pc-panel-review |
+| **EVIDENCE** — is it true? | a change to the **data, code, or artifact** | `claims` claim-preservation · `cites` verify-citations · `artifact` the artifact-runner lens · the numeric half of `harden` harden-paper |
+
+**Why this matters more than it looks.** The two axes expire on completely different clocks. Rewriting
+a paragraph invalidates every TEXT gate and no EVIDENCE gate. Re-running an experiment does the exact
+reverse. Conflating them produces both classic wastes: re-verifying numbers nobody touched, and — worse
+— trusting a readability verdict on prose that has since been rewritten.
+
+**Text-only pass** (the common request, and the right default after a cut, a reorder, or a rewrite where
+the numbers did not move): run `structure` and `writing` in parallel, then `panel` with its artifact lens **explicitly
+disabled**, and hand each agent the sentence *"assume every number is correct and already verified — do
+not re-derive anything; judge the writing, the structure and the argument."* Roughly halves the wall
+clock and removes the single most expensive stage.
+
+**Evidence-only pass** is the mirror: a new experiment landed, the prose around it is stable. Run `claims`
+and the artifact-runner; skip readability entirely.
+
+🔴 **State which pass you ran, in the scorecard row and in the reply.** A gate row that does not say
+which axis it covered will be read as covering both — which is how a paper ends up believed to be
+checked on a dimension nobody looked at.
+
+### 🔢 The one defect neither axis can see: a number correct on both axes and wrong anyway
+
+**Observed 2026-08-05, on page 1, 29 hours before a deadline.** The abstract read *"147 real rules
+files exactly as their projects committed them, 22 fail admission"*. The data has two arms over the
+same 147 files: **strict** (files byte-for-byte as committed — nothing fails) and **annotated** (the
+same files with the tool's proposed pointers written in — 22 fail). The 22 was from the annotated arm
+and was described in the strict arm's words. Five more numbers had the same defect; a sixth was found
+later in an appendix by machine, after two people had searched by hand.
+
+**Every gate passed, and each for a good reason.** `cites` checks the reference is real. `claims` checks the
+claim did not grow — and it did not, 22 was always 22. The artifact-runner recomputes the number from
+the data and it reconciles, *because the number is correct*. The reading panel takes "unmodified" as a
+fact about the world, which is what a reader does. **The defect lives only in the join between a
+sentence and a field path, and nothing was holding both.** It is not a TEXT defect and not an EVIDENCE
+defect; it is a defect of the edge between them, so no pass on either axis can be made to see it.
+
+**The construction, not another pass.** A registered quantity is not written as digits at all:
+
+```
+Over {{corpus.n}} real rules files, with the extractor's proposed mapping
+taken as if an author had written it, {{annotated.failedContradicted}} fail admission.
+```
+
+`<paper>/repro/numbers.tsv` gives each name its value, the JSON path or **formula** that recomputes
+it, and two guards. The build refuses a PDF unless: the name resolves · the value still matches the
+data · the **paragraph** names the arm (`requires`) · the **sentence** does not claim a different one
+(`forbids`). Requires and forbids are separate on purpose — the pairing is auditing's, where a control
+is tested once for *design* and once for *operating effectiveness*.
+
+**Why paragraph for one and sentence for the other.** *"Every figure in this paragraph is the
+counterfactual arm"* is good writing, and a sentence-scoped `requires` would forbid it. But *"exactly
+as committed"* nine words from the number is the defect itself, so `forbids` has to be tight.
+
+**Coverage without a migration.** `numbers-grandfathered.txt` lists every quantity that predates the
+gate; adding a new raw one fails the build. This is `ADD CONSTRAINT ... NOT VALID` — the constraint
+binds every row from now on, and the existing rows are *enumerated rather than exempted*, so the file
+says out loud how many figures still have no machine-checked path to data. On the paper that has it:
+7 guarded, 248 grandfathered. That ratio is a finding, not a score.
+
+**Adopting it in another paper:** copy `repro/paper_numbers.py`, `repro/paper_numbers.selftest.py` and
+the three lines in `md2submission.py` that call `expand()`; generate the grandfather list from the
+current draft; register the numbers a reviewer will actually check first. `check-provenance.mjs`
+reports `no-numbers-gate` for any paper that has not.
+
+🔴 **Do not write the substitution half — it is `jinja2`, and `{{name}}` is already its syntax.**
+Eleven candidates were installed and run on a real markdown-source ACL paper on 2026-08-05. The
+result is not a matter of taste:
+
+| candidate | verdict, from an actual run |
+|---|---|
+| **jinja2** | **adopt.** Our `{{annotated.failRate}}` was already valid Jinja2; dotted names are attribute access. Zero characters changed in the paper, byte-identical `.tex`. This is Manubot's mechanism, taken without Manubot. Use `StrictUndefined`, and move the block/comment delimiters off `{%`/`{#` if the paper might ever quote a config file |
+| **knitr** | equally proven, also byte-identical. Rejected only for putting an R runtime into an artifact that otherwise needs `python3` + `pdflatex` |
+| `\newcommand` + `numbers.tex` | works (1 line in the converter); the folk convention, ~12 GitHub hits, all hand-rolled. No package exists |
+| **Quarto**, **pandoc lua filters** | ❌ **destroy the paper.** Markdown→markdown is a pandoc AST round-trip: HTML comments become raw blocks and `[58]` becomes `\[58\]`, so every citation renders as literal `\textbackslash{}[58]`. 3,120 diff lines on the real source. No ACL format exists for Quarto either |
+| **cog.py** | ❌ line-oriented; cannot substitute mid-sentence |
+| **pythontex** | ❌ not in Ubuntu TeX Live at any level, not on PyPI; CTAN zip + `.ins` build |
+| **showyourwork** | ❌ LaTeX-only, and it manages *figures*, not in-text numbers |
+| **Pweave** | ❌ dead — the one candidate with a markdown native format, broken against modern IPython |
+| DVC · datalad · papermill | orthogonal and **worth adding**: they pin the data file to the pipeline that made it, a layer below anything here |
+
+**🔴 Computing the value DISSOLVES the freshness problem — do not build a checker for it.** With no
+recorded value there is nothing that can go stale, so there is nothing to verify. Adopting jinja2
+deleted 137 lines of ours outright: a hand-rolled expression language with an `eval()` sandbox, a
+renderer guessing which of six formattings the paper meant, a JSON-path walker and the comparison.
+Recording-plus-verifying is the trap; computing is the wheel.
+
+**Binding a number to its CONDITION is genuinely unoccupied**, and the reason is structural rather
+than an accident of packaging: **every literate-programming tool models the paper as a program that
+prints text**, so the prose is opaque *output*, not an input to a check. None of them has a hook
+where you could say "and the sentence around this must say *counterfactual* and must not say *as
+committed*". The near-misses read the manuscript but never the data — `statcheck` recomputes
+p-values from statistics printed in the same sentence; `RegCheck` compares a paper to a study
+registration with an LLM and reports to a human instead of failing a build. Searched and empty:
+GitHub repo search (0 results), the Actions marketplace, the pre-commit hook ecosystem, PyPI, and
+the Claude skill marketplaces.
+
+🔴 **And it is not a number-keyed table**: the first version keyed rules on the digits, and a paper
+printing two unrelated 22s broke it the same hour. Key on the occurrence.
+
+🔴 **Hand the gate to a red team the same day you build it.** This one was, and seven holes came
+back, the worst being that the original defect could simply be **retyped as digits** — its value was
+grandfathered, so the guard applied to the macro and not to the claim. Every hole is now a case in
+`repro/paper_numbers.selftest.py` (18/18, including three that must stay **quiet** — a gate that
+fires on ordinary writing gets muted, and then its silence reads as coverage).
+
+## 🔴 The page limit is a SUBMISSION gate, not an EDIT gate
+
+**Observed failure, `compile-rules-2026`, 2026-08-02/03.** The body oscillated 8 ↔ 9 pages for roughly
+fifty iterations. Each time content went in, the page count read 9, and prose came out to get back to
+8 — sixty characters at a time. Every individual cut looked harmless. Their sum is the unanimous 2/5
+for clarity: the first compression took real repetition, the second had none left and took
+transitions, antecedents and the conclusion's honest half. The structural pass named the arithmetic —
+780 words of genuine repetition removed, then 880 words in and 480 out, leaving the paper 51 words
+*heavier* than before the pass that cut 780.
+
+**The rule.** Content work runs OVER the limit on purpose. Compression is **one pass, at the end**,
+when the content has settled — with a whole-draft view, so it can move a section instead of shaving a
+clause. Going over during drafting is not a problem to fix; it is the normal state of a paper that is
+still growing.
+
+**The trigger to catch yourself:** you just added something, ran the page count, saw it over, and
+started looking for words to remove **in the section you were just editing**. That is the failure, in
+progress. The page count is information for the end of the work, not an alarm during it. (The author's
+own words on catching it, translated from Russian: *"you're cutting the text right away — dunno if that really needs doing immediately."*)
+
+**What is still continuous:** rendering, and looking at pages 1–2. Seeing the number is fine. Acting
+on it is what waits.
+
+🔴 **Every round adds text; pay it back — in ONE pass.** Review is a ratchet — fixes are additive, so a
+paper that survives three rounds is longer and denser than the one that entered them. On `compile-rules-2026` the
+body oscillated 8 ↔ 9 pages for ~50 iterations, and the squeezing is what produced the unanimous 2/5 on
+clarity: the first compression took real repetition, the second had none left and took transitions,
+antecedents and the conclusion's honest half. After each round's fixes, run `tighten-paper` — and if the
+page limit is binding, **move** rather than delete (Limitations and Ethics do not count toward ACL page
+limits). The trap in that move is real and named in `references/acl-venue-rules.md`: relocating a caveat
+while its flattering number stays in the body is exactly the asymmetry reviewers punish.
+
+**Anti-churn ≠ skipping unrun gates.** "Don't loop past one confirming round" forbids *re-polishing prose
+that already passed a gate* — it does NOT license *skipping a gate that never ran*. A `☐` row in
+`PIPELINE-STATUS.md` for **study-accepted-papers, pc-panel-review, or full harden-paper** is an unrun
+quality gate, not churn: **if capacity exists, run it before calling the paper done.** (This session
+skipped those three under an "anti-churn" rationalization on a submitted paper; when the user forced them,
+the pc-panel caught real must-fixes — a release overclaim and an unsupported number — that the skip would
+have shipped.) Churn is re-touching FINE prose; a never-run gate is a hole. If a real
+objection is out of scope, name it in Threats to Validity (adversarial reviewers read Threats first; an
+honest limitation reads as strength).
+
+**A `☐` in GATES is a hole. A `☐` in CONTINUOUS is worse** — it means the check exists, ran once, and
+has been silently stale ever since. That is the shape of every failure this pipeline has actually had.
+
+## ⏱️ What each stage actually costs — MEASURED, not estimated
+
+The author, 2026-08-05, watching a run he could not size (translated from Russian): *"is it worth
+writing the timing problem into the pipeline skill?"*. Yes — because the project already forbids guessing here. The rule in the papers tree's own `CLAUDE.md`
+says an estimate must be decomposed into labour / calendar / result-risk / access and **spiked
+rather than guessed**, and the same session it was written I still launched an experiment with no
+upper bound and had to cut it four hours later.
+
+Every number below is subagent **wall clock, measured on 2026-08-04/05** while finishing
+`compile-rules-2026`. They are one machine, one paper, one day — treat them as an order of
+magnitude, not a promise. Re-measure rather than inherit.
+
+| stage | measured | note |
+|---|--:|---|
+| `verify-citations`, one reference | **3 min** | sonnet; a fetch and a comparison |
+| `verify-citations`, eight references | **3 min** | the fetches parallelise; count barely matters |
+| a single reconciliation ("do these two numbers agree?") | **4 min** | sonnet, over committed data |
+| a second-rater pass over ~20 rows | **8 min** | opens every cited file |
+| a process/mechanism research pass (docs + source + issue tracker) | **10 min** | |
+| `pc-panel-review`, full panel + chair | **17 min** | unchanged for the confirming round |
+| `grade-paper-writing` incl. the persona cold read | **20 min** | |
+| bundling an experiment into the artifact + gate + re-zip | **24–39 min** | scales with directories, not bytes |
+| a design/measurement **spike** (feasibility, a handful of cells) | **27 min** | |
+| `tighten-paper` applied, with a loss letter | **34 min** | includes several build round-trips |
+| `harden-paper` | **36 min** | the widest gate; it runs the artifact |
+| **an experiment with real checkouts and installed dependencies** | **≈4 h for 143 cells** | median cell **76 s**; the outlier by an order of magnitude |
+
+**What the shape tells you, which matters more than the rows.**
+
+- **A full gate cycle — `tighten` → `grade` → `panel` — is about 1.2 hours.** That is cheap enough
+  to run after any substantial edit, and there is no excuse for a stale gate on a paper you are
+  still touching.
+- **Reading, checking and reviewing are all minutes.** Anything whose cost is dominated by fetching,
+  parsing or judging text lands in the 3–40 minute band regardless of how important it feels.
+- 🔴 **Anything that installs dependencies and runs an agent inside a real checkout is hours, and
+  that is the only class that is.** Its cost is *per cell*: rows × arms × seeds × ~76 s. Compute
+  that product **before launching**, and say it out loud. 6 rows × 5 arms × 4 seeds = 120 cells ≈
+  2.5 h; carrying the same design to 21 rows would have been ≈ 9 h.
+- **Therefore: bound experiments by a cell budget, never by "run it and see".** Pick the number of
+  rows from the time available, decide up front what a complete balanced design is, and stop at the
+  last complete row. A design closed at six rows is a result; a design abandoned at eleven is a mess.
+
+## Model policy (which model runs which stage)
+Single home for the whole suite — stage skills point here instead of each re-deciding. Default:
+- **Adversarial / red-team / verify a claim** → **Fable** (a separate model; never the author grading
+  itself): `paper-adversarial-review`, `pc-panel-review` reviewers, `harden-paper` threat-model +
+  citability red-team, disputed `verify-citations` verdicts.
+- **Heavy generation / synthesis** → the session's main model (**Opus**): `draft-paper`,
+  `build-benchmark` design, `extend-paper`, `research-ideate`.
+- **Cheap bulk fetch / extraction** → **Haiku** (or Sonnet): `study-accepted-papers` corpus pull,
+  `plan-paper-timeline`.
+- **No model at all (mechanical)** → `verify-citations`'s `../verify-citations/scripts/verify-cites.mjs` reducer,
+  `harden-paper`'s `check-*.sh` linters, `render-paper` toolchain.
+- **Judge panels use DIVERSE models, not N copies of one** → `grade-paper-writing`, `pc-panel-review`:
+  mix Opus + Fable + Sonnet so independent lenses catch what redundancy can't.
+
+Override per call when a stage clearly needs otherwise; this is the default, not a straitjacket.
+
+## Rules
+- **Fable (a separate model) is always the reviewer** — never let the author grade itself.
+- **Never fabricate** a citation, number, or result. Mark `% VERIFY` and check (`verify-citations`).
+- **Commit + push after each stage**, keep the tree clean (resume-safe across `/compact`); update
+  `<papers-root>/research/README.md` in the same commit as any new research file (its CLAUDE.md enforces this).
+- **Two roles, never double-counted:** authoring = the *authorship* criterion; reviewing others at the
+  venue (the organizer review-offer email) = the *judging* criterion — a separate credential.
+
+## Provenance
+Two real papers this session ran this pipeline end-to-end: **AgenticDev 2026 @ ASE** ("Measuring the
+Wrong Number," ~90%, submitted #20) and **AISec 2026 @ ACM CCS** ("Safety Theater," Weak-Accept→~87–88%
+after a panel round + confirm). The stage skills and shared refs are distilled from exactly those runs.