paperlint 2.0.1 → 3.0.0

package/skills/grade-paper-writing/SKILL.md

@@ -4,7 +4,7 @@ description: Use when asking "does this paper read well?" / "is the writing any
 allowed-tools: [Read, Write, Edit, Grep, Glob, Agent, Skill, Bash(node .claude/skills/paper-pipeline/scripts/announce.mjs:*), Bash(node .claude/skills/paper-pipeline/scripts/ledger.mjs:*)]
 ---
 
-<!-- vigiles:sha256:374531c7f64e998e compiled from skills/grade-paper-writing/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:c0907d5c98e2c831 compiled from skills/grade-paper-writing/SKILL.md.spec.ts -->
 
 # grade-paper-writing — grade how the paper READS, then fix it sentence by sentence
 
@@ -255,6 +255,25 @@ is what happened.
    `PIPELINE-STATUS.md` (Wc row). Same rule as `pc-panel-review`'s ledger and `analyze-sibling-paper`'s
    `siblings/` — review artifacts live colocated and ride with the paper to camera-ready/extension.
 
+## The report's frontmatter — the findings, as records
+
+The report opens with YAML frontmatter that lists what it found, one record per finding.
+`paperlint lint` validates it (`review/frontmatter`): an **open** finding must name the
+pipeline `cause` that let it through — fix that, and the text edit falls out of running the
+fixed tool.
+
+```yaml
+---
+findings:
+  - id: 1
+    status: open            # open | fixed | wontfix
+    cause: missing-skill    # skill-defect | missing-skill | hook | rule — required when open
+    title: "§3 opens on a term the reader has not met"
+  - id: 2
+    status: fixed
+---
+```
+
 ## Record the verdict
 
 🔴 LAST step, once the deliverable exists:

package/skills/grade-paper-writing/SKILL.md.spec.ts

@@ -271,6 +271,25 @@ is what happened.
    \`PIPELINE-STATUS.md\` (Wc row). Same rule as \`pc-panel-review\`'s ledger and \`analyze-sibling-paper\`'s
    \`siblings/\` — review artifacts live colocated and ride with the paper to camera-ready/extension.
 
+## The report's frontmatter — the findings, as records
+
+The report opens with YAML frontmatter that lists what it found, one record per finding.
+\`paperlint lint\` validates it (\`review/frontmatter\`): an **open** finding must name the
+pipeline \`cause\` that let it through — fix that, and the text edit falls out of running the
+fixed tool.
+
+\`\`\`yaml
+---
+findings:
+  - id: 1
+    status: open            # open | fixed | wontfix
+    cause: missing-skill    # skill-defect | missing-skill | hook | rule — required when open
+    title: "§3 opens on a term the reader has not met"
+  - id: 2
+    status: fixed
+---
+\`\`\`
+
 ## Record the verdict
 
 🔴 LAST step, once the deliverable exists:

package/skills/paper-pipeline/PIPELINE-MAP.md

@@ -199,6 +199,14 @@ format.
 
 ## 3. Venue constants belong in a card, not in code
 
+> **Done (#79, 2.1.0), in a different shape than planned below.** The constants live in **venue
+> presets**, JSONC files in `submit-paper/references/venues/`: `acm-sigconf.jsonc` is the ACM
+> family (the `format` block — page size, columns, fonts, font sizes — plus the `tex` packages),
+> `agenticdev.jsonc` and `aisec.jsonc` extend it and add their `kinds` (page limits) and `rules`,
+> `realm.jsonc` stands alone. A paper picks one in `<paper>/paperlint.json`
+> (`{ "extends": "paperlint:<venue>", "kind": "…" }`); the `pdf/*` lint rules judge the built PDF
+> against it. The `.md` cards stay as prose. What follows is the plan as it was written.
+
 Right now `LinLibertine`, `LinBiolinum`, `acmart` are hardcoded into `check-render.sh`. This is
 **venue data**, and it belongs in
 `.claude/skills/submit-paper/references/venues/<venue>.md`:
@@ -292,7 +300,7 @@ imports, paths inside regexes).
 ## 2. One build entry point for all papers, not one per paper
 
 > **Done (#59, 2026-09-24).** `paperlint build <paper>` is the entry point, and `paperlint toolchain` installs
-> TeX Live with the packages the venue profiles declare; `ensure-toolchain.sh` and
+> TeX Live with the packages the venue presets declare; `ensure-toolchain.sh` and
 > `ci-install-texlive.sh` are deleted. What follows is the plan as it was written.
 
 **The hole:** `compile-rules` has `repro/build-submission.sh`, which calls `ensure-toolchain.sh`.
@@ -324,9 +332,11 @@ point. Nothing to check.
 | page limit           | **4**           | `venues/realm.md` 8 · `build-submission.sh` 8 · `PIPELINE-STATUS` "8/8" · the build prints **9**                                      |
 | the TeX package list | **5**           | `ensure-toolchain.sh` (executable) · `SKILL.md` · `render-paper.harness.mjs` (pins it ✅) · `build-submission.sh` · `PIPELINE-STATUS` |
 
-The canonical source is the venue card (`venues/<venue>.md`, the `<!-- venue-profile -->` block) for
-format, and — since 2026-09-24 — the `tex` block of `venues/<venue>.jsonc` (plus `tex-base.jsonc`)
-for packages; `ensure-toolchain.sh` held them until then. Everything else is a pointer.
+The canonical source is the venue preset (`venues/<name>.jsonc`, resolved through its `extends`
+chain): its `format` block for the numbers (page size, columns, fonts, font sizes, and `kinds` for
+page limits), its `tex` block (plus `tex-base.jsonc`) for packages — since 2026-09-24;
+`ensure-toolchain.sh` held them until then — and its `rules` block for the checks the venue
+implies. The `.md` card is prose about the venue. Everything else is a pointer.
 
 ## 3-ter. Drop the font gate from `check-render.sh` once the rules run in CI
 

package/skills/paper-pipeline/SKILL.md

@@ -4,7 +4,7 @@ description: The orchestrator for writing a research paper end-to-end, from idea
 allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Agent, Skill]
 ---
 
-<!-- vigiles:sha256:6ec7cc1d25db0a0f compiled from skills/paper-pipeline/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:291d2266e29874be compiled from skills/paper-pipeline/SKILL.md.spec.ts -->
 
 # paper-pipeline — the conductor for the whole organism
 
@@ -28,8 +28,9 @@ of that — who is filing what, and when — stays in the author's own private n
 - `references/acl-venue-rules.md` — what holds at **every** ACL-family venue and workshop: the
   page-limit map, the appendix rule and the trap inside it, Limitations/Ethics as free-but-restricted
   space, anonymity, OpenReview mechanics. Fetch once, not per paper. Venue-specific facts stay in
-  `submit-paper/references/venues/<venue>.md`. (No equivalent yet for ACM or IEEE — write one when
-  the next paper goes there.)
+  `submit-paper/references/venues/<venue>.md`. (No prose equivalent yet for ACM or IEEE — write one
+  when the next paper goes there. ACM's machine-checked format already exists: the
+  `paperlint:acm-sigconf` preset, `submit-paper/references/venues/acm-sigconf.jsonc`.)
 
 ## The readiness scorecard (which boxes are checked)
 Stages run in subagents and report into chat, which evaporates — so "did everything run?" becomes

package/skills/paper-pipeline/SKILL.md.spec.ts

@@ -45,8 +45,9 @@ of that — who is filing what, and when — stays in the author's own private n
 - \`references/acl-venue-rules.md\` — what holds at **every** ACL-family venue and workshop: the
   page-limit map, the appendix rule and the trap inside it, Limitations/Ethics as free-but-restricted
   space, anonymity, OpenReview mechanics. Fetch once, not per paper. Venue-specific facts stay in
-  \`submit-paper/references/venues/<venue>.md\`. (No equivalent yet for ACM or IEEE — write one when
-  the next paper goes there.)
+  \`submit-paper/references/venues/<venue>.md\`. (No prose equivalent yet for ACM or IEEE — write one
+  when the next paper goes there. ACM's machine-checked format already exists: the
+  \`paperlint:acm-sigconf\` preset, \`submit-paper/references/venues/acm-sigconf.jsonc\`.)
 
 ## The readiness scorecard (which boxes are checked)
 Stages run in subagents and report into chat, which evaporates — so "did everything run?" becomes

package/skills/paper-pipeline/scripts/consumer.d.mts

@@ -29,5 +29,4 @@ export declare function installedSkills(dir: string): string[];
 export declare function packageVenuesDir(): string;
 export declare const SHIPPED_SKILLS_DIR: string;
 export declare const PACKAGE_NAME: "paperlint";
-export declare const LEGACY_PACKAGE_NAME: "research-paper-pipeline";
 export declare const BIN_FILE: "bin/paperlint.mjs";

package/skills/paper-pipeline/scripts/consumer.harness.mjs

@@ -32,7 +32,6 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import {
-  CONFIG_KEY,
   DEFAULT_SCRIPTS_ROOT,
   consumerRoot,
   consumerSkillsDir,
@@ -87,15 +86,12 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 const TMP = realpathSync(mkdtempSync(join(tmpdir(), "consumer-harness-")));
 process.on("exit", () => rmSync(TMP, { recursive: true, force: true }));
 
-/** A throwaway consumer repository with the given `paperlint` block (or none). */
+/** A throwaway consumer repository with the given root `paperlint.json` settings (or none). */
 function fakeConsumer(block) {
   const root = mkdtempSync(join(TMP, "repo-"));
-  writeFileSync(
-    join(root, "package.json"),
-    JSON.stringify(
-      block === undefined ? { name: "x" } : { name: "x", [CONFIG_KEY]: block },
-    ),
-  );
+  writeFileSync(join(root, "package.json"), JSON.stringify({ name: "x" }));
+  if (block !== undefined)
+    writeFileSync(join(root, "paperlint.json"), JSON.stringify(block));
   return root;
 }
 /** A directory that looks like an installed copy of this package. */
@@ -188,7 +184,7 @@ function installedDir(root) {
   );
   assert.match(
     err.message,
-    /package\.json/,
+    /paperlint\.json/,
     "the refusal must name the file the key goes in",
   );
 }
@@ -409,12 +405,12 @@ assert.equal(
   );
   assert.match(
     missing.message,
-    /package\.json/,
+    /paperlint\.json/,
     "the refusal must name the file the key goes in",
   );
 
   // And the default's version of that message must say the default was used — otherwise someone
-  // who declared nothing goes looking in package.json for a line that is not there.
+  // who declared nothing goes looking in paperlint.json for a line that is not there.
   assert.throws(
     () => scriptsRoot({ env: {}, cwd: fakeConsumer(undefined) }),
     /Nothing was declared/,
@@ -462,7 +458,7 @@ assert.equal(
   assert.equal(s.ledger, "a/b/ledger.mjs");
 
   // EXACTLY ONE slash, whatever the consumer typed. `scriptsRoot()` returns the declaration
-  // verbatim, so a trailing slash in package.json arrives here intact; `${root}/` would then give
+  // verbatim, so a trailing slash in paperlint.json arrives here intact; `${root}/` would then give
   // `a/b//`, which matches nothing — the silent direction again.
   const typedSlash = pipelineScripts("a/b/");
   assert.equal(

package/skills/paper-pipeline/scripts/consumer.mjs

@@ -56,7 +56,7 @@
  * ── THE LEDGER, THREE RUNGS ─────────────────────────────────────────────────
  *   1. `PIPELINE_LEDGER` in the environment — always wins. This is what test harnesses set to
  *      keep fixture rows out of real history, so it must outrank a declaration on disk.
- *   2. `"paperlint": { "ledger": "…" }` in the CONSUMER's `package.json`, read
+ *   2. `{ "ledger": "…" }` in the CONSUMER's root `paperlint.json`, read
  *      from `process.cwd()`, resolved relative to it.
  *   3. `runs.jsonl` beside this file — ONLY when this file is not inside `node_modules`, i.e.
  *      when the package is being developed in its own checkout. Inside `node_modules` with
@@ -75,7 +75,6 @@
  */
 import {
   existsSync,
-  readFileSync,
   readdirSync,
   readlinkSync,
   realpathSync,
@@ -86,7 +85,11 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 // Re-exported, not re-declared — see the note in `lib/paper-config.mjs`. This file is not a hook
 // and never needed its own copy.
-import { CONFIG_KEY, settingsOf } from "../../../lib/paper-config.mjs";
+import {
+  CONFIG_FILE,
+  CONFIG_KEY,
+  settingsOf,
+} from "../../../lib/paper-config.mjs";
 export { CONFIG_KEY, settingsOf };
 
 /**
@@ -144,13 +147,6 @@ export function packageVenuesDir() {
  */
 export const PACKAGE_NAME = "paperlint";
 
-/**
- * The name the package was published under before 2.0.0. Only for recognising what an older
- * install left behind (hook commands, skill links, the config key) so `init` can replace it and
- * `doctor` can name it.
- */
-export const LEGACY_PACKAGE_NAME = "research-paper-pipeline";
-
 /**
  * The package's one executable, relative to the package root — what `bin` in package.json names
  * and what every hook command runs. Named like the package; `consumer.harness.mjs` checks it
@@ -245,16 +241,6 @@ function readlinkOr(entry) {
   }
 }
 
-/** The consumer's parsed `package.json`, or `null` when there is none or it does not parse. */
-export function consumerPkg(opts) {
-  const file = join(consumerRoot(opts), "package.json");
-  try {
-    return JSON.parse(readFileSync(file, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
 /**
  * True when `dir` lies inside a `node_modules` directory.
  *
@@ -282,7 +268,7 @@ export function ledgerPath(
 
   // Rung 2 — the consumer's declaration.
   const root = consumerRoot({ env, cwd });
-  const declared = settingsOf(consumerPkg({ env, cwd }))?.ledger;
+  const declared = settingsOf(consumerRoot({ env, cwd }))?.ledger;
   // 🔴 `declared === undefined`, NOT `declared ?? default` — the same distinction `papersRoot()`
   // makes and for the same reason: `"ledger": null` is a keystroke, not an absence, and reading
   // it as "nothing was declared" would silently pick a different file than the one asked for.
@@ -299,8 +285,8 @@ export function ledgerPath(
     throw new Error(
       `${CONFIG_KEY}: no ledger location is declared, and the default (a file beside this ` +
         `module) is inside node_modules, which \`npm ci\` deletes.\n` +
-        `Declare where the ledger lives, in ${join(root, "package.json")}:\n` +
-        `  "${CONFIG_KEY}": { "ledger": "docs/pipeline-runs.jsonl" }\n` +
+        `Declare where the ledger lives, in ${join(root, CONFIG_FILE)}:\n` +
+        `  { "ledger": "docs/pipeline-runs.jsonl" }\n` +
         `or set PIPELINE_LEDGER for a single run.\n` +
         `This is thrown rather than defaulted on purpose: appending to a path under ` +
         `node_modules succeeds, so the rows would look recorded right up until the next ` +
@@ -321,7 +307,7 @@ export function ledgerPathExisting(hereDir, opts) {
   if (!existsSync(p))
     throw new Error(
       `${CONFIG_KEY}: the ledger "${p}" does not exist. Create it (an empty file is a valid ` +
-        `empty ledger) or fix the "ledger" declaration in package.json.`,
+        `empty ledger) or fix the "ledger" declaration in ${CONFIG_FILE}.`,
     );
   return p;
 }
@@ -374,7 +360,7 @@ export const DEFAULT_SCRIPTS_ROOT = ".claude/skills/paper-pipeline/scripts";
  */
 export function scriptsRoot({ env = process.env, cwd = process.cwd() } = {}) {
   const root = consumerRoot({ env, cwd });
-  const declared = settingsOf(consumerPkg({ env, cwd }))?.scripts;
+  const declared = settingsOf(consumerRoot({ env, cwd }))?.scripts;
   // 🔴 `declared === undefined`, NOT `declared ?? DEFAULT` — the same distinction `papersRoot()`
   // and `ledgerPath()` make, for the same reason: `"scripts": null` is a keystroke, not an
   // absence, and silently substituting the default for it hides a typo behind a working run.
@@ -393,8 +379,8 @@ export function scriptsRoot({ env = process.env, cwd = process.cwd() } = {}) {
         `instruction would point at a directory the repository does not track.\n` +
         `Keep a symlink where the prose already looks —\n` +
         `  ${join(root, DEFAULT_SCRIPTS_ROOT)} -> node_modules/${CONFIG_KEY}/skills/paper-pipeline/scripts\n` +
-        `— or declare the real, repository-relative location in ${join(root, "package.json")}:\n` +
-        `  "${CONFIG_KEY}": { "scripts": "path/to/pipeline/scripts" }\n` +
+        `— or declare the real, repository-relative location in ${join(root, CONFIG_FILE)}:\n` +
+        `  { "scripts": "path/to/pipeline/scripts" }\n` +
         `(If nothing was declared, the root itself is under node_modules: run the command from ` +
         `the consumer repository, or export CLAUDE_PROJECT_DIR.)`,
     );
@@ -403,9 +389,9 @@ export function scriptsRoot({ env = process.env, cwd = process.cwd() } = {}) {
       `${CONFIG_KEY}: the pipeline scripts path "${rel}" does not exist under ${root}.\n` +
         (declared === undefined
           ? `Nothing was declared, so the default "${DEFAULT_SCRIPTS_ROOT}" was used. Create the ` +
-            `symlink there, or declare the real location in package.json:\n` +
-            `  "${CONFIG_KEY}": { "scripts": "path/to/pipeline/scripts" }`
-          : `It is declared in package.json under "${CONFIG_KEY}" as ` +
+            `symlink there, or declare the real location in ${CONFIG_FILE}:\n` +
+            `  { "scripts": "path/to/pipeline/scripts" }`
+          : `It is declared in ${CONFIG_FILE} as ` +
             `"scripts": ${JSON.stringify(declared)}. Fix it there, or create the directory.`) +
         `\nThis is thrown rather than ignored on purpose: this value is a PREFIX that callers ` +
         `filter prose with, so a wrong one matches no instruction at all and every check built ` +
@@ -453,7 +439,7 @@ export function consumerTimezone({
   env = process.env,
   cwd = process.cwd(),
 } = {}) {
-  const declared = settingsOf(consumerPkg({ env, cwd }))?.timezone;
+  const declared = settingsOf(consumerRoot({ env, cwd }))?.timezone;
   // 🔴 `declared === undefined`, NOT `declared ?? DEFAULT` — the same distinction every carrier
   // above makes: `"timezone": null` is a keystroke, not an absence.
   const tz = declared === undefined ? DEFAULT_TIMEZONE : declared;
@@ -467,7 +453,7 @@ export function consumerTimezone({
     throw new RangeError(
       `${CONFIG_KEY}: "timezone" is ${JSON.stringify(tz)}, which is not an IANA time zone this ` +
         `runtime knows (e.g. "Europe/Berlin", "America/New_York", "UTC").\n` +
-        `Fix it in package.json under "${CONFIG_KEY}".\n` +
+        `Fix it in ${CONFIG_FILE}.\n` +
         `This throws rather than falling back to ${DEFAULT_TIMEZONE} on purpose: a silent fallback ` +
         `would put every deadline anchor at the wrong hour while looking like it worked.`,
     );
@@ -505,7 +491,7 @@ export function consumerContactEmail({
   env = process.env,
   cwd = process.cwd(),
 } = {}) {
-  const declared = settingsOf(consumerPkg({ env, cwd }))?.contactEmail;
+  const declared = settingsOf(consumerRoot({ env, cwd }))?.contactEmail;
   if (declared === undefined || declared === null) return null;
   if (typeof declared !== "string" || !declared.includes("@"))
     throw new TypeError(

package/skills/paper-pipeline/scripts/extract-ref-facts.harness.mjs

@@ -21,7 +21,11 @@
  * as success, so an exported test object would report ✓ without running anything.
  */
 import assert from "node:assert/strict";
-import { PAPERS_DIR_FIELD } from "../../../lib/paper-config.mjs";
+import {
+  DEFAULT_PAPERS_ROOT,
+  PAPERS_DIR_FIELD,
+  settingsOf,
+} from "../../../lib/paper-config.mjs";
 import {
   existsSync,
   mkdirSync,
@@ -57,9 +61,7 @@ const X = await import(join(HERE, "extract-ref-facts.mjs"));
 // A directory on disk answers the same question without knowing any name in advance.
 const PAPERS_ROOT = join(
   ROOT,
-  JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"))["paperlint"]?.[
-    PAPERS_DIR_FIELD
-  ] ?? "papers",
+  settingsOf(ROOT)?.[PAPERS_DIR_FIELD] ?? DEFAULT_PAPERS_ROOT,
 );
 const REAL_PAPERS = existsSync(PAPERS_ROOT)
   ? readdirSync(PAPERS_ROOT, { withFileTypes: true })

package/skills/paper-pipeline/scripts/run-mechanical.mjs

@@ -33,13 +33,7 @@
 
 import { record, ABSTENTIONS } from "./ledger.mjs";
 import { execFileSync } from "node:child_process";
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
 import { resolve, join, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { isMain, settingsOf } from "./consumer.mjs";
@@ -83,10 +77,7 @@ const ROOT = consumerRoot();
 // simply do not run: `needs()` below checks the directory on disk, so the absence reads as
 // ABSTAINED `input-missing`, not as a crash and not as a clean run.
 const CITE_CHECKS =
-  process.env.PIPELINE_CITE_CHECKS ||
-  settingsOf(JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")))
-    ?.citeChecks ||
-  null;
+  process.env.PIPELINE_CITE_CHECKS || settingsOf(ROOT)?.citeChecks || null;
 // The citation-checker directory exists and is declared. It sits in the `needs()` of every row
 // that calls it: without that a wrong or undeclared path would fail with a python stack trace, and
 // in `flags` mode a stack trace is counted line by line and goes into the ledger as a FINDING whose

package/skills/plan-paper-timeline/SKILL.md

@@ -4,7 +4,7 @@ description: Turn a venue's CFP dates into a scheduled, buffered plan on the Goo
 allowed-tools: [Read, Write, Grep, Glob, mcp__Google_Calendar__list_events, mcp__Google_Calendar__search_events, mcp__Google_Calendar__create_event, mcp__Google_Calendar__update_event, Bash(node .claude/skills/paper-pipeline/scripts/announce.mjs:*), Bash(node .claude/skills/paper-pipeline/scripts/ledger.mjs:*)]
 ---
 
-<!-- vigiles:sha256:9009b62e211cf421 compiled from skills/plan-paper-timeline/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:faf0c175f1a0c5e5 compiled from skills/plan-paper-timeline/SKILL.md.spec.ts -->
 
 # plan-paper-timeline — CFP dates → a buffered, filing-aware schedule
 
@@ -96,7 +96,7 @@ Use `mcp__Google_Calendar__create_event` for three anchors per paper. 🔴 **Rea
 assume it** — it is the `timezone` carrier, and it is the author's, not the pipeline's:
 
 ```
-node -p "((p) => p.paperlint ?? p['research-paper-pipeline'])(require('./package.json'))?.timezone ?? 'UTC'"
+node -p "(() => { try { return require('./paperlint.json')?.timezone } catch {} })() ?? 'UTC'"
 ```
 
 The example below shows the default, `UTC`; substitute whatever that command prints.

package/skills/plan-paper-timeline/SKILL.md.spec.ts

@@ -113,7 +113,7 @@ Use \`mcp__Google_Calendar__create_event\` for three anchors per paper. 🔴 **R
 assume it** — it is the \`timezone\` carrier, and it is the author's, not the pipeline's:
 
 \`\`\`
-node -p "((p) => p.paperlint ?? p['research-paper-pipeline'])(require('./package.json'))?.timezone ?? 'UTC'"
+node -p "(() => { try { return require('./paperlint.json')?.timezone } catch {} })() ?? 'UTC'"
 \`\`\`
 
 The example below shows the default, \`UTC\`; substitute whatever that command prints.

package/skills/plan-paper-timeline/plan-paper-timeline.effects.harness.mjs

@@ -383,7 +383,7 @@ try {
     //
     // 🔴 THIS USED TO COMPARE AGAINST ONE HARD-CODED ZONE — the first consumer's. That is exactly
     // the thing a package may not know: the same CFP date is a different wall-clock hour for every
-    // author, so the zone is the `timezone` CARRIER, read from the consumer's package.json. What
+    // author, so the zone is the `timezone` CARRIER, read from the project's paperlint.json. What
     // the PRESCRIPTION in §3 must show is therefore not anybody's real zone but the documented
     // DEFAULT, next to the instruction telling the model to substitute the declared one.
     //

package/skills/plan-paper-timeline/plan-paper-timeline.effects.mutations.mjs

@@ -53,8 +53,8 @@ process.exit(
         edits: [
           [
             SKILL,
-            "(require('./package.json'))?.timezone ?? 'UTC'",
-            "(require('./package.json'))?.papersDir ?? 'papers'",
+            "require('./paperlint.json')?.timezone } catch {} })() ?? 'UTC'",
+            "require('./paperlint.json')?.papersDir } catch {} })() ?? 'papers'",
           ],
         ],
         harness: HARNESS,

package/skills/render-paper/check-render.sh

@@ -348,9 +348,8 @@ fi
 # and it does it WIDER: the block here skipped review mode, the rule judges the artifact always. Two
 # sources of truth about one fact drift apart — so the duplicate was deleted, not kept "just in case".
 #
-# 🔴 The condition under which this becomes a loss: the rule looks at papers that declared their venue
-# in `venue.json`. Should a paper appear with a build but without `venue.json`, nobody will check its
-# fonts. Today there are none (all three real papers are declared).
+# 🔴 The condition under which this becomes a loss: the rule looks at papers whose `paperlint.json`
+# names a venue preset. A paper with a build but no preset gets its fonts checked by nobody.
 
 # --- chktex, if installed: LaTeX-source typography the log cannot see ---
 # Adopted 2026-08-24 instead of writing our own. Measured first: out of the box it produced 28

package/skills/render-paper/extract-pdf-facts.harness.mjs

@@ -59,8 +59,8 @@ try {
   mkdirSync(paper, { recursive: true });
   cpSync(join(FIX, "t3-mixed.pdf"), join(paper, "paper.pdf"));
   writeFileSync(
-    join(paper, "venue.json"),
-    JSON.stringify({ venue: "agenticdev", kind: "short" }),
+    join(paper, "paperlint.json"),
+    JSON.stringify({ extends: "paperlint:agenticdev", kind: "short" }),
   );
   const factsFile = join(paper, "_build", "paper.facts.json");
 
@@ -88,7 +88,7 @@ try {
   );
   const facts = JSON.parse(readFileSync(factsFile, "utf8"));
   check(
-    "the facts are schema 2, about paper.pdf, for the venue venue.json declares",
+    "the facts are schema 2, about paper.pdf, for the venue paperlint.json declares",
     facts.schema === 2 &&
       facts.pdf === "paper.pdf" &&
       facts.venue === "agenticdev" &&
@@ -148,8 +148,8 @@ try {
   );
 
   writeFileSync(
-    join(paper, "venue.json"),
-    JSON.stringify({ venue: "x", pdf: "build/other.pdf" }),
+    join(paper, "paperlint.json"),
+    JSON.stringify({ pdf: "build/other.pdf" }),
   );
   const missing = shim([paper, "--strict"], { BANAL: fake });
   check(

package/skills/render-paper/extract-pdf-facts.mjs

@@ -8,7 +8,7 @@
  * it compiles a paper. This file is a composition root: it reads the environment and builds the real
  * adapters (`dist/adapters/node/`), and it owns the `--strict` policy. This
  * script exists for two callers the build does not serve: a PDF paperlint did not build (a paper that
- * declares its artifact elsewhere in `venue.json`), and CI steps that name this script by path.
+ * declares its artifact elsewhere in `paperlint.json`), and CI steps that name this script by path.
  * It reaches the package's compiled code through `../../dist/`, resolved from this file's real
  * location, so it works the same from a checkout, from `node_modules` and through a symlink.
  *
@@ -48,14 +48,14 @@ import {
 import { whyNoGeometry } from "../../dist/domain/geometry.js";
 import { exitCodeFor } from "../../dist/exit-code.js";
 
-/** The paper's `venue.json`, read from disk. */
+/** The venue the paper's `paperlint.json` declares, read from disk. */
 export const declaredVenue = (paperDir) => declaredIn(nodeFiles, paperDir);
 
 const ROOT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 
 /**
  * Accept either a path to a PDF or a PAPER DIRECTORY — and in the second case find the artifact on
- * its own: the path the paper declares in the `pdf` field of `venue.json`, else `paper.pdf` beside
+ * its own: the path the paper declares in the `pdf` field of `paperlint.json`, else `paper.pdf` beside
  * it. A paper written in markdown and built by its own script into `build/acl_latex.pdf` would
  * otherwise be skipped silently. The facts ALWAYS go into `<paper directory>/_build/`, not next to
  * the PDF, where neither a rule's glob nor a human looks.
@@ -111,7 +111,7 @@ if (isMain(import.meta.url)) {
     finish(
       "no-artifact",
       strict,
-      `🛑 no artifact ${pdf} — the paper declared it in venue.json, but it is not built`,
+      `🛑 no artifact ${pdf} — the paper declared it in paperlint.json, but it is not built`,
     );
   // The composition root: banal as the measurer, wired from this process's environment.
   const settings = parseBanalSettings(process.env, hostDirs());

package/skills/render-paper/render-paper.harness.mjs

@@ -36,8 +36,8 @@ import { dirname, join } from "node:path";
 import { checkSkill } from "../../lib/skill-checks.mjs";
 import { papersRoot } from "../../eslint-rules/papers.mjs";
 import {
-  consumerPkg,
   consumerRoot,
+  settingsOf,
 } from "../paper-pipeline/scripts/consumer.mjs";
 
 await checkSkill("render-paper");
@@ -308,7 +308,7 @@ await checkSkill("render-paper");
   // and say so out loud.
   const root = (() => {
     try {
-      return papersRoot(consumerPkg(), consumerRoot());
+      return papersRoot(settingsOf(consumerRoot()), consumerRoot());
     } catch {
       return null;
     }

package/skills/study-accepted-papers/SKILL.md

@@ -5,7 +5,7 @@ context: fork
 allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Agent]
 ---
 
-<!-- vigiles:sha256:eb77acd927708132 compiled from skills/study-accepted-papers/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:177ca8805990361e compiled from skills/study-accepted-papers/SKILL.md.spec.ts -->
 
 # study-accepted-papers — learn the venue's bar from its own accepted corpus, then lever your draft up
 
@@ -196,6 +196,7 @@ label on it.
 - `verify-citations` — consumes the Step-4 citation gaps.
 - `extend-paper` — the natural home for every EXPENSIVE lever this skill surfaces.
 - `submit-paper` venue data card (`submit-paper/references/venues/<venue>.md`) — save durable venue-bar findings there as data, not as a new skill per venue.
+- the paper's `<paper>/paperlint.json` (`{ "extends": "paperlint:<venue>", "kind": "<kind>" }`) — which venue preset the `pdf/*` rules check the built PDF against; a venue with no shipped preset extends a family (`paperlint:acm-sigconf`) or the project's own `./venues/<name>.jsonc`. Findings about the venue's page limit or format belong in that preset, with their source quote.
 
 ## Provenance
 Built from the **AISec 2026 @ ACM CCS** polish run (2026-07): the "Safety Theater in Agentic Coding /

package/skills/study-accepted-papers/SKILL.md.spec.ts

@@ -212,6 +212,7 @@ label on it.
 - \`verify-citations\` — consumes the Step-4 citation gaps.
 - \`extend-paper\` — the natural home for every EXPENSIVE lever this skill surfaces.
 - \`submit-paper\` venue data card (\`submit-paper/references/venues/<venue>.md\`) — save durable venue-bar findings there as data, not as a new skill per venue.
+- the paper's \`<paper>/paperlint.json\` (\`{ "extends": "paperlint:<venue>", "kind": "<kind>" }\`) — which venue preset the \`pdf/*\` rules check the built PDF against; a venue with no shipped preset extends a family (\`paperlint:acm-sigconf\`) or the project's own \`./venues/<name>.jsonc\`. Findings about the venue's page limit or format belong in that preset, with their source quote.
 
 ## Provenance
 Built from the **AISec 2026 @ ACM CCS** polish run (2026-07): the "Safety Theater in Agentic Coding /

package/skills/submit-paper/SKILL.md

@@ -4,7 +4,7 @@ description: End-to-end playbook for submitting a peer-reviewed paper to a doubl
 allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Skill]
 ---
 
-<!-- vigiles:sha256:6befc6c0f3e910bd compiled from skills/submit-paper/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:4a42424fd18098e5 compiled from skills/submit-paper/SKILL.md.spec.ts -->
 
 # submit-paper — get a reviewed paper from "done" to "ready for review"
 
@@ -36,6 +36,14 @@ skill with `name:`/`description:`). This preserves the "save the exact venue ins
 keeping the skill namespace from proliferating one card per venue. The *mechanics* stay here; the venue
 file is only the facts.
 
+**The card is prose; the machine-checked format is a PRESET beside it.** A paper declares its venue
+in `<paper>/paperlint.json`: `{ "extends": "paperlint:<venue>", "kind": "<kind>" }`, and the
+`pdf/*` lint rules judge the built PDF against that preset (page limit per kind, fonts, page size,
+columns, font sizes). A venue with no shipped preset extends a family — `paperlint:acm-sigconf`
+for an ACM venue — or a preset of the project's own, `./venues/<name>.jsonc` (paperlint's
+`docs/rules.md`, "Writing your own venue preset"). Put the page limits you fetched from the CFP in
+the preset's `format.kinds`, each with its quote.
+
 ## Publisher specifics — one level ABOVE the venue
 Camera-ready mechanics belong to the **publisher**, not the venue: ACM eRights, the submit-vs-final
 preamble swap, the copyright block, CCS 2012 codes and the mandatory Source-files upload are identical

package/skills/submit-paper/SKILL.md.spec.ts

@@ -52,6 +52,14 @@ skill with \`name:\`/\`description:\`). This preserves the "save the exact venue
 keeping the skill namespace from proliferating one card per venue. The *mechanics* stay here; the venue
 file is only the facts.
 
+**The card is prose; the machine-checked format is a PRESET beside it.** A paper declares its venue
+in \`<paper>/paperlint.json\`: \`{ "extends": "paperlint:<venue>", "kind": "<kind>" }\`, and the
+\`pdf/*\` lint rules judge the built PDF against that preset (page limit per kind, fonts, page size,
+columns, font sizes). A venue with no shipped preset extends a family — \`paperlint:acm-sigconf\`
+for an ACM venue — or a preset of the project's own, \`./venues/<name>.jsonc\` (paperlint's
+\`docs/rules.md\`, "Writing your own venue preset"). Put the page limits you fetched from the CFP in
+the preset's \`format.kinds\`, each with its quote.
+
 ## Publisher specifics — one level ABOVE the venue
 Camera-ready mechanics belong to the **publisher**, not the venue: ACM eRights, the submit-vs-final
 preamble swap, the copyright block, CCS 2012 codes and the mandatory Source-files upload are identical