paperlint 6.2.3 → 7.0.0

package/skills/submission-portal/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: submission-portal
+description: "Read or change a paper's submission on the venue's HotCRP portal via `paperlint submission show|update`: replace the PDF or abstract, mark it submitted, check it is really \"Submitted\", and verify by sha256 that the portal holds the latest build. Use when the PDF or abstract on HotCRP needs replacing, when asked whether the paper is truly submitted or which PDF reviewers see, or before a deadline. Composes with submit-paper (what to submit); this gets it onto the portal and proves it landed."
+allowed-tools: [Read, Grep, Glob, Bash]
+---
+
+<!-- vigiles:sha256:deb3d74f5c3f93a8 compiled from skills/submission-portal/SKILL.md.spec.ts -->
+
+# submission-portal — read and update the submission on the portal, then prove it landed
+
+`paperlint submission` talks to the venue's submission portal through its API. Only HotCRP is
+supported; for any other portal the command says so and the upload is done by hand.
+
+## What must be in place
+
+- **The venue preset declares the portal**: `"portal": { "kind": "hotcrp", "url": "<the site>" }`
+  (`paperlint:aidc` has it). For your own venue preset, add it there.
+- **The paper's `paperlint.json` names its submission**: `"submission": { "id": <number> }` — the
+  number HotCRP shows for the paper.
+- **A token in `HOTCRP_TOKEN`**, created by the author on the HotCRP site under Account settings →
+  Developer (scopes `submeta:read` and `document:read` to read; `submeta:write` and
+  `document:write` to update). Never ask for it in chat, never print it, never write it to a file:
+  the command reads it from the environment and sends it only as the `Authorization` header.
+
+A missing key or token stops the command with exit 2 and a line naming the file and key, or the
+variable — fix exactly that and run again.
+
+## The procedure — always in this order
+
+1. **Read it.** `npx paperlint submission show papers/<paper>` — status, title, type, topics,
+   abstract length, the PDF the portal holds, and `match`: whether that PDF's sha256 equals the
+   local `paper.pdf`. Rebuild first (`npx paperlint build papers/<paper>`) if the local PDF is stale.
+2. **Dry run.** `npx paperlint submission update papers/<paper>` — sends the PDF (add
+   `--abstract <file>` for a plain-text abstract, `--submit` to mark it submitted) with HotCRP's
+   `dry_run=1`: the portal checks the change and **keeps nothing**. Read `valid`, `changes` and every
+   `portal says:` line. Exit 1 means the portal would refuse it — report why, do not go on.
+3. **Ask the author.** Show the dry run's output and ask for an explicit yes to change the real
+   submission.
+4. **Save — only after that yes.** `npx paperlint submission update papers/<paper> --save` (same
+   flags as the dry run). 🔴 `--save` CHANGES A REAL SUBMISSION that reviewers will see. Never run it
+   without the author's explicit yes in this conversation, never "to test", and never because a
+   dry run was valid.
+5. **Prove it landed.** `npx paperlint submission show papers/<paper>` again: `match` must read
+   `yes — the portal holds this build`, and the status must be what was intended (`submitted` if
+   `--submit` was sent). Anything else is not done — say so.
+
+The same five steps as commands, in order (`<paper>` is the paper's folder):
+
+```bash
+npx paperlint submission show papers/<paper>
+npx paperlint submission update papers/<paper>
+# … the author reads the dry run and says yes …
+npx paperlint submission update papers/<paper> --save
+npx paperlint submission show papers/<paper>
+```
+
+## Reading the answers
+
+- `match yes` is the only proof the reviewers get the local build; a status of `submitted` alone
+  says nothing about WHICH PDF.
+- `the portal refused (HTTP 401): …` — the token is missing, wrong or expired; `403` — the token
+  lacks the scope, or the deadline has passed for this change. The text after the colon is
+  HotCRP's own; quote it.
+- `SAVE WITHHELD by the portal` — HotCRP did not save; nothing changed.
+
+## What this skill does not do
+
+It does not decide whether the paper is ready (that is `harden-paper`), anonymize it, or fill the
+submission form's other fields (authors, conflicts) — see `submit-paper`.

package/skills/submission-portal/SKILL.md.spec.ts

@@ -0,0 +1,71 @@
+// Compiled to SKILL.md by `vigiles compile`. Edit THIS file, never the markdown.
+import { experimental_skill } from "vigiles/spec";
+
+export default experimental_skill({
+  name: "submission-portal",
+  description:
+    "Read or change a paper's submission on the venue's HotCRP portal via `paperlint submission show|update`: replace the PDF or abstract, mark it submitted, check it is really \"Submitted\", and verify by sha256 that the portal holds the latest build. Use when the PDF or abstract on HotCRP needs replacing, when asked whether the paper is truly submitted or which PDF reviewers see, or before a deadline. Composes with submit-paper (what to submit); this gets it onto the portal and proves it landed.",
+  tools: ["Read", "Grep", "Glob", "Bash"],
+  body: `
+# submission-portal — read and update the submission on the portal, then prove it landed
+
+\`paperlint submission\` talks to the venue's submission portal through its API. Only HotCRP is
+supported; for any other portal the command says so and the upload is done by hand.
+
+## What must be in place
+
+- **The venue preset declares the portal**: \`"portal": { "kind": "hotcrp", "url": "<the site>" }\`
+  (\`paperlint:aidc\` has it). For your own venue preset, add it there.
+- **The paper's \`paperlint.json\` names its submission**: \`"submission": { "id": <number> }\` — the
+  number HotCRP shows for the paper.
+- **A token in \`HOTCRP_TOKEN\`**, created by the author on the HotCRP site under Account settings →
+  Developer (scopes \`submeta:read\` and \`document:read\` to read; \`submeta:write\` and
+  \`document:write\` to update). Never ask for it in chat, never print it, never write it to a file:
+  the command reads it from the environment and sends it only as the \`Authorization\` header.
+
+A missing key or token stops the command with exit 2 and a line naming the file and key, or the
+variable — fix exactly that and run again.
+
+## The procedure — always in this order
+
+1. **Read it.** \`npx paperlint submission show papers/<paper>\` — status, title, type, topics,
+   abstract length, the PDF the portal holds, and \`match\`: whether that PDF's sha256 equals the
+   local \`paper.pdf\`. Rebuild first (\`npx paperlint build papers/<paper>\`) if the local PDF is stale.
+2. **Dry run.** \`npx paperlint submission update papers/<paper>\` — sends the PDF (add
+   \`--abstract <file>\` for a plain-text abstract, \`--submit\` to mark it submitted) with HotCRP's
+   \`dry_run=1\`: the portal checks the change and **keeps nothing**. Read \`valid\`, \`changes\` and every
+   \`portal says:\` line. Exit 1 means the portal would refuse it — report why, do not go on.
+3. **Ask the author.** Show the dry run's output and ask for an explicit yes to change the real
+   submission.
+4. **Save — only after that yes.** \`npx paperlint submission update papers/<paper> --save\` (same
+   flags as the dry run). 🔴 \`--save\` CHANGES A REAL SUBMISSION that reviewers will see. Never run it
+   without the author's explicit yes in this conversation, never "to test", and never because a
+   dry run was valid.
+5. **Prove it landed.** \`npx paperlint submission show papers/<paper>\` again: \`match\` must read
+   \`yes — the portal holds this build\`, and the status must be what was intended (\`submitted\` if
+   \`--submit\` was sent). Anything else is not done — say so.
+
+The same five steps as commands, in order (\`<paper>\` is the paper's folder):
+
+\`\`\`bash
+npx paperlint submission show papers/<paper>
+npx paperlint submission update papers/<paper>
+# … the author reads the dry run and says yes …
+npx paperlint submission update papers/<paper> --save
+npx paperlint submission show papers/<paper>
+\`\`\`
+
+## Reading the answers
+
+- \`match yes\` is the only proof the reviewers get the local build; a status of \`submitted\` alone
+  says nothing about WHICH PDF.
+- \`the portal refused (HTTP 401): …\` — the token is missing, wrong or expired; \`403\` — the token
+  lacks the scope, or the deadline has passed for this change. The text after the colon is
+  HotCRP's own; quote it.
+- \`SAVE WITHHELD by the portal\` — HotCRP did not save; nothing changed.
+
+## What this skill does not do
+
+It does not decide whether the paper is ready (that is \`harden-paper\`), anonymize it, or fill the
+submission form's other fields (authors, conflicts) — see \`submit-paper\`.`,
+});

package/skills/submission-portal/submission-portal.eval.mjs

@@ -0,0 +1,15 @@
+/**
+ * submission-portal — the PAID tier: does this skill's description actually fire?
+ *
+ * The prompts live in `lib/skill-trigger-cases.mjs` beside every other skill's, so collisions with
+ * `submit-paper` and `osf-artifact-upload` are visible in one table. Measures recall on its own
+ * territory and precision against those siblings, against the real harness.
+ *
+ * ⚠️ NEVER RUN. Written 2026-10-03 with the skill; its rate is UNKNOWN, not assumed good.
+ *
+ * Costs money; not CI.
+ *   node skills/submission-portal/submission-portal.eval.mjs [trials]
+ */
+import { runSkillTriggerEval } from "../../lib/skill-eval-kit.mjs";
+
+await runSkillTriggerEval("submission-portal");

package/skills/submission-portal/submission-portal.test.ts

@@ -0,0 +1,81 @@
+/**
+ * submission-portal — the free tier: the skill's commands are commands the CLI accepts, in the
+ * order the skill promises, and the skill passes the shared per-skill checks. No model, no network,
+ * no portal.
+ *
+ * 🔴 WHY THE COMMANDS ARE PARSED, NOT GREPPED: a skill that tells the agent to run a flag the CLI
+ * refuses fails at the worst moment — before a deadline, on a real submission. So every
+ * `paperlint submission …` the skill writes goes through the CLI's own argument parser and its
+ * usage check, and must come out runnable.
+ */
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "vitest";
+import { commandsIn } from "vigiles";
+import { checkSkill } from "../../lib/skill-checks.mjs";
+import { parseArgs } from "../../src/cli.ts";
+import { usageProblem } from "../../src/submission.ts";
+
+const SKILL = readFileSync(
+  join(dirname(fileURLToPath(import.meta.url)), "SKILL.md"),
+  "utf8",
+);
+const commands = commandsIn(
+  SKILL,
+  /(^|[|;&]\s*)npx paperlint submission\b/,
+).map((c) => c.text);
+
+/** A command as the CLI receives it: the words after `npx paperlint`. */
+const argvOf = (command: string): string[] =>
+  command
+    .replace(/^.*?npx paperlint /, "")
+    .split(/\s+/)
+    .filter(Boolean);
+
+test("the skill names show, a dry run and a save — and nothing else", () => {
+  const kinds = commands.map((c) => {
+    const a = parseArgs(argvOf(c));
+    return `${String(a.paths[0])}${a.save ? " --save" : ""}`;
+  });
+  assert.deepEqual([...new Set(kinds)], ["show", "update", "update --save"]);
+});
+
+test("every `paperlint submission` command in the skill is one the CLI runs", () => {
+  assert.ok(
+    commands.length > 0,
+    "the skill names no `paperlint submission` command",
+  );
+  for (const c of commands) {
+    const a = parseArgs(argvOf(c));
+    assert.equal(a.cmd, "submission", c);
+    assert.equal(a.unknownFlag, undefined, c);
+    assert.equal(a.missingValue, undefined, c);
+    const problem = usageProblem({
+      sub: a.paths[0],
+      paperDir: a.paths[1] ?? ".",
+      extra: a.paths.slice(2),
+      pdf: a.pdf,
+      abstract: a.abstract,
+      submit: a.submit,
+      save: a.save,
+    });
+    assert.equal(problem, null, c);
+  }
+});
+
+test("🔴 the procedure reads, dry-runs, then saves, then reads again — never saves first", () => {
+  const order = commands.map((c) => {
+    const a = parseArgs(argvOf(c));
+    return a.paths[0] === "show" ? "show" : a.save ? "save" : "dry";
+  });
+  const firstSave = order.indexOf("save");
+  assert.ok(firstSave > order.indexOf("dry"), order.join(" → "));
+  assert.ok(order.indexOf("dry") > order.indexOf("show"), order.join(" → "));
+  assert.ok(order.lastIndexOf("show") > firstSave, order.join(" → "));
+});
+
+test("the shared per-skill checks pass", async () => {
+  await checkSkill("submission-portal");
+});

package/skills/submit-paper/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: submit-paper
-description: End-to-end playbook for submitting a peer-reviewed paper to a double-blind venue (HotCRP workshops/conferences) — from a hardened draft to "ready for review." Covers building and anonymously hosting a reproduction artifact, HotCRP profile + form mechanics, double-blind hygiene, and the authorship/credential angles for an independent researcher. Use when the paper is drafted and reviewed and it's time to actually submit. Compose with pc-panel-review / paper-adversarial-review (harden first), and with the venue data card (references/venues/<venue>.md) for venue specifics.
+description: End-to-end playbook for submitting a peer-reviewed paper to a double-blind venue (HotCRP workshops/conferences) — from a hardened draft to "ready for review." Covers building and anonymously hosting a reproduction artifact, HotCRP profile + form mechanics, double-blind hygiene, and the authorship/credential angles for an independent researcher. Use when the paper is drafted and reviewed and it's time to actually submit. Compose with pc-panel-review / paper-adversarial-review (harden first), and with the venue card (presets/<venue>.md in the paperlint package) for venue specifics.
 allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Skill]
 ---
 
-<!-- vigiles:sha256:9e57bcb2ba1fb055 compiled from skills/submit-paper/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:8f53cae32633b002 compiled from skills/submit-paper/SKILL.md.spec.ts -->
 
 # submit-paper — get a reviewed paper from "done" to "ready for review"
 
@@ -12,26 +12,30 @@ Assumes the paper is already hardened (run `pc-panel-review` — incl. its venue
 `paper-adversarial-review` first). This skill is the submission mechanics — the part that bit us with
 avoidable friction the first time. Distilled from the AgenticDev 2026 submission.
 
-## Venue specifics — a DATA card, not a skill
+## Venue specifics — a CARD beside the venue's preset, not a skill
 The venue-specific facts (deadline, page limits, tracks, PC-member conflict list, blind model, format
-quirks, whether a supplementary-upload field exists, the extension target) live as **plain reference
-data files** under `references/venues/<venue>.md`:
-- `references/venues/agenticdev.md` — AgenticDev @ ASE (workshop; ACM DL/IEEE Xplore).
-- `references/venues/aisec.md` — AISec @ ACM CCS (security workshop; ACM DL; harder bar).
-
-**The pattern (follow it for every new venue):** when you fetch a venue's exact submission instructions,
-save them as a new **data file** `references/venues/<venue>.md` (short `title:` frontmatter only — NOT a
-skill with `name:`/`description:`). This preserves the "save the exact venue instructions" rule while
-keeping the skill namespace from proliferating one card per venue. The *mechanics* stay here; the venue
-file is only the facts.
-
-**The card is prose; the machine-checked format is a PRESET beside it.** A paper declares its venue
+quirks, whether a supplementary-upload field exists) live in the venue's **card**, `presets/<venue>.md`
+in the paperlint package, beside the preset `presets/<venue>.jsonc` that the lint rules check a
+paper against:
+- `presets/agenticdev.md` — AgenticDev @ ASE (workshop; ASE workshop proceedings).
+- `presets/aisec.md` — AISec @ ACM CCS (security workshop; ACM DL; harder bar).
+- `presets/aidc.md` — AIDC @ IEEE ACSAC (workshop; IEEE template, LLM Usage Statement).
+- `presets/realm.md` — REALM @ EMNLP (ACL family, OpenReview).
+
+**The card is prose; the machine-checked format is the PRESET beside it.** A paper declares its venue
 in `<paper>/paperlint.json`: `{ "extends": "paperlint:<venue>", "kind": "<kind>" }`, and the
 `pdf/*` lint rules judge the built PDF against that preset (page limit per kind, fonts, page size,
-columns, font sizes). A venue with no shipped preset extends a family — `paperlint:acm-sigconf`
-for an ACM venue — or a preset of the project's own, `./venues/<name>.jsonc` (paperlint's
-`docs/rules.md`, "Writing your own venue preset"). Put the page limits you fetched from the CFP in
-the preset's `format.kinds`, each with its quote.
+columns, font sizes). The card's last section — what the preset is, its call for papers, the rules it
+sets and where each comes from — is generated from the preset, so read the numbers there, not from
+memory.
+
+**The pattern (follow it for every new venue):** when you fetch a venue's exact submission
+instructions, write the numbers into a preset with their quotes and the rest into a card beside it.
+A venue with no shipped preset extends a family — `paperlint:acm-sigconf` for an ACM venue — in a
+preset of the project's own, `./venues/<name>.jsonc`, with its card `./venues/<name>.md` next to
+it (paperlint's `docs/rules.md`, "Writing your own venue preset"). A venue preset declares
+`"type": "venue"`, the venue's `name` and the `url` of its call for papers. The *mechanics*
+stay here; the card is only the facts.
 
 ## Publisher specifics — one level ABOVE the venue
 Camera-ready mechanics belong to the **publisher**, not the venue: ACM eRights, the submit-vs-final
@@ -110,6 +114,7 @@ Many workshop HotCRPs have **no supplementary-upload field** — check first; if
   is the step people miss.
 - You can edit until the deadline: use **Replace** on the Submission field to swap the PDF for a late
   fix (e.g. adding the artifact link after you host it). Submit early, upgrade before the deadline.
+- When the venue preset declares its HotCRP portal, replacing the PDF or abstract and proving the portal holds the latest build is `submission-portal` (`paperlint submission show|update`).
 
 ## 6. Independent-researcher / dossier notes
 - **Name consistency** is the quiet risk: publications, LinkedIn, passport, letters must resolve to one
@@ -147,9 +152,9 @@ convention with no reader.
 ## Compose with
 - Harden first: `pc-panel-review` (incl. its venue-fit mode), `paper-adversarial-review`, `render-paper`.
 - Publisher mechanics (camera-ready): `references/publishers/<publisher>.md`.
-- Venue specifics: the matching data card `references/venues/<venue>.md` (e.g.
-  `references/venues/agenticdev.md`) for deadlines, page limits, PC-member conflict lists, whether
-  supplementary upload exists, and the extension target.
+- Venue specifics: the venue's card `presets/<venue>.md` in the paperlint package (e.g.
+  `presets/agenticdev.md`) for deadlines, page limits, PC-member conflict lists, and whether a
+  supplementary upload exists.
 
 ## Provenance
 Written from the AgenticDev 2026 @ ASE submission (2026-07-13): PC-panel-reviewed, self-checking

package/skills/submit-paper/SKILL.md.spec.ts

@@ -9,7 +9,7 @@ import { experimental_skill } from "vigiles/spec";
 export default experimental_skill({
   name: "submit-paper",
   description:
-    'End-to-end playbook for submitting a peer-reviewed paper to a double-blind venue (HotCRP workshops/conferences) — from a hardened draft to "ready for review." Covers building and anonymously hosting a reproduction artifact, HotCRP profile + form mechanics, double-blind hygiene, and the authorship/credential angles for an independent researcher. Use when the paper is drafted and reviewed and it\'s time to actually submit. Compose with pc-panel-review / paper-adversarial-review (harden first), and with the venue data card (references/venues/<venue>.md) for venue specifics.',
+    'End-to-end playbook for submitting a peer-reviewed paper to a double-blind venue (HotCRP workshops/conferences) — from a hardened draft to "ready for review." Covers building and anonymously hosting a reproduction artifact, HotCRP profile + form mechanics, double-blind hygiene, and the authorship/credential angles for an independent researcher. Use when the paper is drafted and reviewed and it\'s time to actually submit. Compose with pc-panel-review / paper-adversarial-review (harden first), and with the venue card (presets/<venue>.md in the paperlint package) for venue specifics.',
   tools: [
     "Read",
     "Write",
@@ -28,26 +28,30 @@ Assumes the paper is already hardened (run \`pc-panel-review\` — incl. its ven
 \`paper-adversarial-review\` first). This skill is the submission mechanics — the part that bit us with
 avoidable friction the first time. Distilled from the AgenticDev 2026 submission.
 
-## Venue specifics — a DATA card, not a skill
+## Venue specifics — a CARD beside the venue's preset, not a skill
 The venue-specific facts (deadline, page limits, tracks, PC-member conflict list, blind model, format
-quirks, whether a supplementary-upload field exists, the extension target) live as **plain reference
-data files** under \`references/venues/<venue>.md\`:
-- \`references/venues/agenticdev.md\` — AgenticDev @ ASE (workshop; ACM DL/IEEE Xplore).
-- \`references/venues/aisec.md\` — AISec @ ACM CCS (security workshop; ACM DL; harder bar).
-
-**The pattern (follow it for every new venue):** when you fetch a venue's exact submission instructions,
-save them as a new **data file** \`references/venues/<venue>.md\` (short \`title:\` frontmatter only — NOT a
-skill with \`name:\`/\`description:\`). This preserves the "save the exact venue instructions" rule while
-keeping the skill namespace from proliferating one card per venue. The *mechanics* stay here; the venue
-file is only the facts.
-
-**The card is prose; the machine-checked format is a PRESET beside it.** A paper declares its venue
+quirks, whether a supplementary-upload field exists) live in the venue's **card**, \`presets/<venue>.md\`
+in the paperlint package, beside the preset \`presets/<venue>.jsonc\` that the lint rules check a
+paper against:
+- \`presets/agenticdev.md\` — AgenticDev @ ASE (workshop; ASE workshop proceedings).
+- \`presets/aisec.md\` — AISec @ ACM CCS (security workshop; ACM DL; harder bar).
+- \`presets/aidc.md\` — AIDC @ IEEE ACSAC (workshop; IEEE template, LLM Usage Statement).
+- \`presets/realm.md\` — REALM @ EMNLP (ACL family, OpenReview).
+
+**The card is prose; the machine-checked format is the PRESET beside it.** A paper declares its venue
 in \`<paper>/paperlint.json\`: \`{ "extends": "paperlint:<venue>", "kind": "<kind>" }\`, and the
 \`pdf/*\` lint rules judge the built PDF against that preset (page limit per kind, fonts, page size,
-columns, font sizes). A venue with no shipped preset extends a family — \`paperlint:acm-sigconf\`
-for an ACM venue — or a preset of the project's own, \`./venues/<name>.jsonc\` (paperlint's
-\`docs/rules.md\`, "Writing your own venue preset"). Put the page limits you fetched from the CFP in
-the preset's \`format.kinds\`, each with its quote.
+columns, font sizes). The card's last section — what the preset is, its call for papers, the rules it
+sets and where each comes from — is generated from the preset, so read the numbers there, not from
+memory.
+
+**The pattern (follow it for every new venue):** when you fetch a venue's exact submission
+instructions, write the numbers into a preset with their quotes and the rest into a card beside it.
+A venue with no shipped preset extends a family — \`paperlint:acm-sigconf\` for an ACM venue — in a
+preset of the project's own, \`./venues/<name>.jsonc\`, with its card \`./venues/<name>.md\` next to
+it (paperlint's \`docs/rules.md\`, "Writing your own venue preset"). A venue preset declares
+\`"type": "venue"\`, the venue's \`name\` and the \`url\` of its call for papers. The *mechanics*
+stay here; the card is only the facts.
 
 ## Publisher specifics — one level ABOVE the venue
 Camera-ready mechanics belong to the **publisher**, not the venue: ACM eRights, the submit-vs-final
@@ -126,6 +130,7 @@ Many workshop HotCRPs have **no supplementary-upload field** — check first; if
   is the step people miss.
 - You can edit until the deadline: use **Replace** on the Submission field to swap the PDF for a late
   fix (e.g. adding the artifact link after you host it). Submit early, upgrade before the deadline.
+- When the venue preset declares its HotCRP portal, replacing the PDF or abstract and proving the portal holds the latest build is \`submission-portal\` (\`paperlint submission show|update\`).
 
 ## 6. Independent-researcher / dossier notes
 - **Name consistency** is the quiet risk: publications, LinkedIn, passport, letters must resolve to one
@@ -163,9 +168,9 @@ convention with no reader.
 ## Compose with
 - Harden first: \`pc-panel-review\` (incl. its venue-fit mode), \`paper-adversarial-review\`, \`render-paper\`.
 - Publisher mechanics (camera-ready): \`references/publishers/<publisher>.md\`.
-- Venue specifics: the matching data card \`references/venues/<venue>.md\` (e.g.
-  \`references/venues/agenticdev.md\`) for deadlines, page limits, PC-member conflict lists, whether
-  supplementary upload exists, and the extension target.
+- Venue specifics: the venue's card \`presets/<venue>.md\` in the paperlint package (e.g.
+  \`presets/agenticdev.md\`) for deadlines, page limits, PC-member conflict lists, and whether a
+  supplementary upload exists.
 
 ## Provenance
 Written from the AgenticDev 2026 @ ASE submission (2026-07-13): PC-panel-reviewed, self-checking

package/skills/submit-paper/references/publishers/acm.md

@@ -8,7 +8,7 @@ tags: [publisher, acm, camera-ready, erights, ccs]
 # ACM: what camera-ready requires
 
 > This is the **publisher** level, not the venue level. Identical for AgenticDev@ASE, AISec@CCS,
-> and any other ACM conference. The venue card (`../venues/<venue>.md`) holds only what's its own:
+> and any other ACM conference. The venue card (`presets/<venue>.md` in the paperlint package) holds only what's its own:
 > dates, page limit, its own DOI/ISBN, blind model.
 >
 > Captured 2026-08-24 from the live AgenticDev #20 HotCRP form — field by field, not from memory.

package/src/adapters/hotcrp/cassette/README.md

@@ -0,0 +1,24 @@
+# HotCRP cassette
+
+Real answers to the requests `paperlint submission` sends, recorded from a live HotCRP instance
+through HotCRP's documented API (`/api/paper`). `portal.test.ts` replays them from its
+local mock server and parses each one through the adapter's real zod schemas: a schema that rejects
+a real answer is the defect class these files exist to catch. A hand-written mock body is what let
+a wrong upload field name through once.
+
+Only read-only requests were recorded: one `GET` and two `POST`s with `dry_run=1` — nothing was
+saved. Identifying values (the submission id, title, abstract, authors, topics, the PDF's hash, the
+timestamps) are replaced with fakes; HotCRP's keys, value types, statuses and message texts are
+verbatim.
+
+| file              | request                                                                                                                                                   | HTTP |
+| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ---: |
+| `get-paper.json`  | `GET /api/paper?p=<id>&word_limit=hard` with a token                                                                                                      |  200 |
+| `get-noauth.json` | the same without a token                                                                                                                                  |  401 |
+| `post-dot.json`   | `POST /api/paper?p=<id>&dry_run=1`, PDF part named `paper.pdf`, `content_file` the same — PHP renames the field to `paper_pdf`, so HotCRP finds no upload |  200 |
+| `post-ok.json`    | the same with the part and `content_file` named `paperlint_pdf`                                                                                           |  200 |
+
+To re-record: run the same four requests with `curl` against a HotCRP site where you have a
+submission and a token (`Authorization: bearer $HOTCRP_TOKEN`), always with `dry_run=1` on a `POST`,
+save each body, then replace every identifying value with a fake of the same type before committing.
+These files ship in the npm package with the rest of `src/`, like the tests beside them.

package/src/adapters/hotcrp/cassette/get-noauth.json

@@ -0,0 +1,10 @@
+{
+  "ok": false,
+  "message_list": [
+    {
+      "status": 2,
+      "message": "<0>Missing credentials"
+    }
+  ],
+  "status_code": 401
+}

package/src/adapters/hotcrp/cassette/get-paper.json

@@ -0,0 +1,39 @@
+{
+  "ok": true,
+  "paper": {
+    "object": "paper",
+    "pid": 7,
+    "title": "An Example Paper Title",
+    "submission": {
+      "mimetype": "application/pdf",
+      "hash": "sha2-b3e602c135f2455f64aecfdc2e1e7f81dad20c5d69f0981e965b1a0131d47163",
+      "timestamp": 1790000000,
+      "size": 17,
+      "pages": 2
+    },
+    "abstract": "An example abstract of exactly ten words for the test.",
+    "contacts": [
+      {
+        "email": "author@example.org",
+        "given_name": "A.",
+        "family_name": "Author",
+        "affiliation": "Example University"
+      }
+    ],
+    "paper_type": "Example paper type",
+    "authors": [
+      {
+        "email": "author@example.org",
+        "given_name": "A.",
+        "family_name": "Author",
+        "affiliation": "Example University"
+      }
+    ],
+    "topics": ["Example topic one", "Example topic two"],
+    "pc_conflicts": {},
+    "status": "submitted",
+    "submitted": true,
+    "submitted_at": 1790000100,
+    "modified_at": 1790000100
+  }
+}

package/src/adapters/hotcrp/cassette/post-dot.json

@@ -0,0 +1,21 @@
+{
+  "ok": false,
+  "message_list": [
+    {
+      "status": 2,
+      "field": "submission",
+      "message": "<0>Ignored attempt to upload document without any content"
+    },
+    {
+      "status": 3,
+      "field": "submission"
+    },
+    {
+      "status": -3
+    }
+  ],
+  "dry_run": true,
+  "valid": false,
+  "change_list": [],
+  "pid": 7
+}

package/src/adapters/hotcrp/cassette/post-ok.json

@@ -0,0 +1,12 @@
+{
+  "ok": true,
+  "message_list": [
+    {
+      "status": -3
+    }
+  ],
+  "dry_run": true,
+  "valid": true,
+  "change_list": ["submission"],
+  "pid": 7
+}

package/src/adapters/hotcrp/index.ts

@@ -0,0 +1,11 @@
+/**
+ * HotCRP, as the `SubmissionPortal` port: its REST API read and written over `fetch`, its answers
+ * parsed here. Everything that changes if HotCRP's API does lives in this folder.
+ */
+export {
+  CONTENT_FIELD,
+  changeObject,
+  hotcrpPortal,
+  type HotcrpOptions,
+} from "./portal.io.ts";
+export { parseShow, parseUpdate, sha256OfHash } from "./response.ts";