psyclaw 0.27.22 → 0.28.0

package/vendor/ars/scripts/check_cross_model_handoff_contract.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+"""Defrift lock for the #527 cross-model handoff contract.
+
+#523 moved the blind-checkpoint transport to the dispatching layer, but left
+the owner → dispatcher → owner path enforced by prose only. #527 gives it a
+canonical envelope (normative grammar: `scripts/cross_model_handoff.py`) and
+this lint pins the contract across its five prompt surfaces so a future edit
+cannot silently demote the handoff to an ordinary deliverable.
+
+Invariants:
+
+1. The shared doc carries § Cross-model handoff envelope (#527) with both
+   fence literals, all required header names, the payload-only blindness
+   rule, the malformed→unavailable fail-safes, the agreement-no-reinvoke /
+   divergence-minimum-context routing, the DA full-return rule, and the
+   flag-unset-unchanged sentence — and names the reference module.
+2. Each owner agent emits the canonical envelope with its correct
+   checkpoint_kind / expected_result pair.
+3. The Mode-A orchestrator carries the consumer contract: recognition
+   (never an ordinary deliverable), fail-safe mapping, and the three-way
+   outcome routing, naming the reference module.
+4. The prose enums match the reference module's CHECKPOINT_KINDS (the
+   module is normative — prose drift from it must fail).
+
+Exit codes: 0 on pass, 1 on any failure.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import cross_model_handoff as cmh
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+SHARED = "shared/cross_model_verification.md"
+ORCH = "academic-pipeline/agents/pipeline_orchestrator_agent.md"
+# Full backticked header declarations — pinning only the value would let a
+# `checkpoint_knd:` typo emit malformed envelopes while staying green
+# (codex #527 round-1 P1). The enum owners additionally pin their
+# owner_decision blindness clause.
+OWNER_BLINDNESS_CLAUSE = "never forwarded to the cross-model"
+ALL_THREE_FIELDS_CLAUSE = "all three fields, the envelope grammar rejects a bare decision"
+# Every operative envelope header the owner instruction must spell exactly
+# (codex #527 round-12 P1: a correlation_idd/owner_decison typo, or a wrong
+# owner_agent value, would emit envelopes the normative parser rejects).
+OWNER_CORRELATION_CLAUSE = "a `correlation_id` you choose"
+OWNER_DECISION_HEADER_CLAUSE = "`owner_decision` header"
+OWNERS = {
+    "deep-research/agents/research_architect_agent.md": (
+        "`checkpoint_kind: design_freeze`",
+        f"`owner_agent: {cmh.EXPECTED_OWNERS['design_freeze']}`",
+        OWNER_CORRELATION_CLAUSE,
+        OWNER_DECISION_HEADER_CLAUSE,
+        "`expected_result: enum_comparison`",
+        OWNER_BLINDNESS_CLAUSE,
+        ALL_THREE_FIELDS_CLAUSE,
+        # Payload exclusion: the primary's judgment never rides the payload.
+        "with the Design-Freeze Checkpoint Audit section (and any other self-judgment, scores, or reasoning) stripped out",
+        # Consent predicate (codex round-5 P1): the check runs only when the
+        # flag is set AND consent was granted.
+        "only when `ARS_CROSS_MODEL` is set + consent granted",
+    ),
+    "academic-paper-reviewer/agents/editorial_synthesizer_agent.md": (
+        "`checkpoint_kind: editorial_decision`",
+        f"`owner_agent: {cmh.EXPECTED_OWNERS['editorial_decision']}`",
+        OWNER_CORRELATION_CLAUSE,
+        OWNER_DECISION_HEADER_CLAUSE,
+        "`expected_result: enum_comparison`",
+        OWNER_BLINDNESS_CLAUSE,
+        ALL_THREE_FIELDS_CLAUSE,
+        "**Never include your decision, the scoring matrix outcome, or your rationale**",
+        "the consent gate in `shared/cross_model_verification.md` has been passed (reviewer cards + paper metadata go to an external provider — the env var alone is not consent)",
+    ),
+    "academic-paper-reviewer/agents/devils_advocate_reviewer_agent.md": (
+        "`checkpoint_kind: da_critique`",
+        f"`owner_agent: {cmh.EXPECTED_OWNERS['da_critique']}`",
+        "a `correlation_id` you choose",
+        "`expected_result: full_return`",
+        "no `owner_decision` header",
+        "without your own DA findings",
+        "First ask for explicit user consent and identify the external provider, model, and manuscript content that would be sent",
+    ),
+}
+
+SHARED_HEADING = "### Cross-model handoff envelope (#527)"
+SHARED_REQUIRED = [
+    cmh.OPEN_FENCE,
+    cmh.CLOSE_FENCE,
+    "scripts/cross_model_handoff.py",
+    "checkpoint_kind: design_freeze | editorial_decision | da_critique",
+    "expected_result: enum_comparison | full_return",
+    "correlation_id:",
+    "owner_agent:",
+    "owner_decision:",
+    "REQUIRED iff enum_comparison",
+    "Structured decisions carry ALL THREE fields (`decision`, `drivers`, `confidence`)",
+    "must not contain a fence-shaped line",
+    "Sanitized also means data-minimized: strip personal names, affiliations, and private URLs not essential to the judgment",
+    "NEVER forwarded to the cross-model",
+    "payload only",
+    # Transport prompt-shape rule (codex round-7 P1): the citation handlers'
+    # prompt + grounding normalization must never run a checkpoint judgment.
+    "NEVER the citation-verification prompt, its grounding-status guards",
+    "[CROSS-MODEL-ERROR: malformed_handoff]",
+    "[CROSS-MODEL-ERROR: malformed_result]",
+    "outcome `unavailable`",
+    "does **not** re-invoke the owner",
+    "re-invokes the ORIGINAL owner with the minimum return context",
+    "The dispatcher never authors it",
+    "EVERY successful response is returned to the owner",
+    "owners emit no envelope and behavior is byte-equivalent pre-#527",
+]
+
+ORCH_HEADING_LINE = "**Cross-model handoff consumption (#527, Mode A dispatcher).**"
+ORCH_REQUIRED = [
+    cmh.OPEN_FENCE,
+    "ANY version, detection is generous",
+    "a transport request, never an ordinary deliverable",
+    "scripts/cross_model_handoff.py",
+    "[CROSS-MODEL-ERROR: malformed_handoff]",
+    "[CROSS-MODEL-ERROR: malformed_result]",
+    "never the citation-verification prompt or its grounding-status normalization",
+    "the `owner_decision` header is never forwarded — blindness",
+    "a stray envelope is logged `[CROSS-MODEL-SKIPPED]` and not transported",
+    "never fabricate a judgment",
+    "do NOT re-invoke the owner",
+    "re-invoke the ORIGINAL owner with the minimum return context",
+    "never the dispatcher's",
+    "every successful response returns to the owner",
+    "[CROSS-MODEL-SKIPPED]",
+]
+
+
+def _module_prose_enums() -> list[str]:
+    """The enum spellings the prose table must carry, derived from the
+    normative module so prose can only drift by failing here."""
+    fragments = []
+    for kind, (_, enum) in cmh.CHECKPOINT_KINDS.items():
+        if enum:
+            fragments.append(" / ".join(f"`{v}`" for v in enum))
+    return fragments
+
+
+def _module_prose_triples() -> list[str]:
+    """The complete kind (`owner`) attributions plus each kind's result
+    shape, derived from CHECKPOINT_KINDS + EXPECTED_OWNERS — a shared-prose
+    edit rewiring owners or result shapes must fail here (codex #527
+    round-10 P1)."""
+    return [
+        f"`{kind}` (`{cmh.EXPECTED_OWNERS[kind]}`) is `{expected}`"
+        for kind, (expected, _) in cmh.CHECKPOINT_KINDS.items()
+    ]
+
+
+def check(shared: str, orch: str, owners: dict[str, str]) -> list[str]:
+    errors: list[str] = []
+
+    # Invariant 1 — shared canonical section
+    if SHARED_HEADING not in shared:
+        errors.append(f"invariant 1 ({SHARED}): section {SHARED_HEADING!r} missing")
+    for fragment in SHARED_REQUIRED:
+        if fragment not in shared:
+            errors.append(
+                f"invariant 1 ({SHARED}): canonical contract lost the pinned "
+                f"fragment {fragment!r}"
+            )
+
+    # Invariant 2 — owner emission pins
+    for path, fragments in OWNERS.items():
+        text = owners[path]
+        if cmh.OPEN_FENCE not in text:
+            errors.append(
+                f"invariant 2 ({path}): owner no longer names the canonical "
+                f"envelope fence {cmh.OPEN_FENCE!r}"
+            )
+        for fragment in fragments:
+            if fragment not in text:
+                errors.append(
+                    f"invariant 2 ({path}): owner lost its {fragment!r} "
+                    f"declaration"
+                )
+
+    # Invariant 3 — Mode-A dispatcher consumer contract
+    if ORCH_HEADING_LINE not in orch:
+        errors.append(f"invariant 3 ({ORCH}): consumer block {ORCH_HEADING_LINE!r} missing")
+    for fragment in ORCH_REQUIRED:
+        if fragment not in orch:
+            errors.append(
+                f"invariant 3 ({ORCH}): consumer contract lost the pinned "
+                f"fragment {fragment!r}"
+            )
+
+    # Invariant 4 — prose enums AND kind/owner/result triples match the
+    # normative module
+    for fragment in (*_module_prose_enums(), *_module_prose_triples()):
+        if fragment not in shared:
+            errors.append(
+                f"invariant 4 ({SHARED}): checkpoint table drifted from the "
+                f"normative module: expected {fragment!r} (source: "
+                f"scripts/cross_model_handoff.py CHECKPOINT_KINDS + "
+                f"EXPECTED_OWNERS)"
+            )
+
+    return errors
+
+
+def main() -> int:
+    paths = [SHARED, ORCH, *OWNERS]
+    contents: dict[str, str] = {}
+    for path in paths:
+        full = REPO_ROOT / path
+        if not full.is_file():
+            print(f"FAILED: surface file missing: {path}", file=sys.stderr)
+            return 1
+        contents[path] = full.read_text(encoding="utf-8")
+    errors = check(contents[SHARED], contents[ORCH], {p: contents[p] for p in OWNERS})
+    if errors:
+        for e in errors:
+            print(f"FAILED: {e}", file=sys.stderr)
+        print(
+            "\nUpdate procedure: scripts/cross_model_handoff.py is the "
+            "normative grammar. If the contract must change, change the "
+            "module, its fixtures, every listed surface, AND this lint's "
+            "pinned constants in the same commit.",
+            file=sys.stderr,
+        )
+        return 1
+    print("PASSED: check_cross_model_handoff_contract — 4 invariants hold")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/vendor/ars/scripts/check_cross_model_verification_sync.py

@@ -0,0 +1,261 @@
+"""Doc-sync lint for the cross-model grounding guards (#346 / #349).
+
+The contract-bearing jq for the cross-model verifier lives in canonical files under
+`scripts/cross_model_verification/`; `shared/cross_model_verification.md` consumes them via
+`jq -f`. The behavioral tests (`test_cross_model_verification_guards.py`) pin what the jq DOES;
+this lint pins that the documented bash actually WIRES to the canonical files and still carries
+the fail-closed control flow — so a doc edit cannot quietly re-inline a (possibly weaker) filter
+or drop a safety branch while the behavioral tests keep passing against the untouched .jq.
+
+It deliberately does NOT byte-pin the whole bash block (it is a copy-paste example users adapt).
+It checks:
+  1. REQUIRED_FILTERS exactly matches the .jq files on disk (so a newly added filter can't escape
+     the lint by simply not being listed — REQUIRED_FILTERS is the single source of truth);
+  2. every canonical .jq file is referenced by the doc via `jq -f`;
+  3. the NOT_SEARCHED and CROSS-MODEL-ERROR safety branches are present;
+  4. no provider block re-inlines a `jq -e`/`jq -r` expression instead of loading a `-f` file
+     (which would bypass the behavior-tested filters).
+
+Exit codes: 0 = pass; 1 = a required reference or safety branch is missing.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+DOC = REPO / "shared" / "cross_model_verification.md"
+GUARD_DIR = REPO / "scripts" / "cross_model_verification"
+
+# Canonical filters that MUST exist on disk and be referenced by the doc via `jq -f`.
+REQUIRED_FILTERS = [
+    "openai_has_completed_web_search.jq",
+    "openai_text.jq",
+    "openai_sources.jq",
+    "gemini_is_grounded.jq",
+    "gemini_sources.jq",
+]
+
+# Safety branches the documented patterns must retain (the whole point of the guard).
+REQUIRED_BRANCHES = [
+    "NOT_SEARCHED",       # ungrounded / from-memory downgrade
+    "CROSS-MODEL-ERROR",  # non-2xx transport-failure split (distinct from NOT_SEARCHED)
+]
+
+
+def _strip_trailing_comment(line: str) -> str:
+    """Remove a trailing bash comment (` #...`) that is outside quotes.
+
+    A bash comment begins at a `#` that starts a word — i.e. at line start or preceded by
+    whitespace — and is not inside a single- or double-quoted string. Stripping it means a
+    filename surviving only in a trailing comment (`jq -r ".x"  # jq -f "$GUARD/x.jq"`) can't
+    satisfy the wiring check. A `#` inside a quoted string (or a `$#`/`${#}`-style token) is left
+    intact: it must follow whitespace and be unquoted to count as a comment.
+    """
+    in_single = in_double = False
+    prev = ""
+    for i, ch in enumerate(line):
+        if ch == "'" and not in_double:
+            in_single = not in_single
+        elif ch == '"' and not in_single:
+            in_double = not in_double
+        elif ch == "#" and not in_single and not in_double and (i == 0 or prev.isspace()):
+            return line[:i].rstrip()
+        prev = ch
+    return line
+
+
+def _bash_blocks(text: str) -> list[list[str]]:
+    """Return per-fence lists of executable bash lines (comments removed).
+
+    Each element is one ```bash … ``` fence's executable lines, with comment-only lines dropped
+    and trailing comments stripped (see `_strip_trailing_comment`). Keeping fences separate lets a
+    check scope itself to a single block (e.g. the compatible-provider block) instead of the whole
+    doc — necessary when a token (`NOT_SEARCHED`) legitimately appears in several blocks but a
+    given contract only binds one of them.
+    """
+    blocks: list[list[str]] = []
+    current: list[str] | None = None
+    for raw in text.splitlines():
+        stripped = raw.strip()
+        if current is None and stripped.startswith("```bash"):
+            current = []
+            continue
+        if current is not None and stripped == "```":
+            blocks.append(current)
+            current = None
+            continue
+        if current is not None and not stripped.startswith("#"):
+            code = _strip_trailing_comment(raw)
+            if code.strip():
+                current.append(code)
+    # An unterminated trailing ```bash block (no closing fence at EOF) must still be scanned —
+    # otherwise its lines silently drop, which is fail-OPEN for checks 4/6/7/8 (a re-inlined guard,
+    # a passive OPENAI_BASE_URL, or a missing normalizer invocation in the final block would escape
+    # the lint). Flush it here.
+    if current is not None:
+        blocks.append(current)
+    return blocks
+
+
+def _bash_code_lines(text: str) -> list[str]:
+    """Return the executable lines inside ```bash fenced blocks, comments removed.
+
+    A comment-only line (first non-whitespace char is `#`) is dropped entirely; a trailing comment
+    on an executable line is stripped (see `_strip_trailing_comment`). Both matter for the wiring
+    check: a filename mentioned only in a comment — whole-line or trailing — must not count as the
+    doc loading that filter via `jq -f`.
+    """
+    lines: list[str] = []
+    for block in _bash_blocks(text):
+        lines.extend(block)
+    return lines
+
+
+def main() -> int:
+    failures: list[str] = []
+
+    if not DOC.is_file():
+        print(f"[cross-model-sync] FAIL: doc not found: {DOC}")
+        return 1
+    text = DOC.read_text(encoding="utf-8")
+
+    # Operate the wiring/inline checks on EXECUTABLE bash only — lines inside ```bash fences with
+    # comment lines stripped — so a commented-out `jq -f` reference (or a filename mentioned only in
+    # prose / a comment) can't satisfy check 2, and a commented example can't trip check 4.
+    bash_code = "\n".join(_bash_code_lines(text))
+
+    # 1. REQUIRED_FILTERS is the single source of truth: it must match the .jq files on disk
+    #    exactly, so a newly added filter can't silently escape the lint by not being listed.
+    on_disk = {p.name for p in GUARD_DIR.glob("*.jq")}
+    listed = set(REQUIRED_FILTERS)
+    for name in sorted(listed - on_disk):
+        failures.append(f"REQUIRED_FILTERS lists {name} but it is not on disk in {GUARD_DIR.name}/")
+    for name in sorted(on_disk - listed):
+        failures.append(
+            f"{name} exists in {GUARD_DIR.name}/ but is not in REQUIRED_FILTERS "
+            f"(add it so the lint pins its doc reference)"
+        )
+
+    # 2. Every canonical filter is loaded by executable bash via `jq ... -f .../<name>`. Checking
+    #    bash_code (not the whole doc) means a commented-out or prose mention doesn't count.
+    for name in REQUIRED_FILTERS:
+        if not re.search(r"jq\b[^\n']*-f\s+\S*" + re.escape(name), bash_code):
+            failures.append(
+                f"doc does not load {name} via `jq -f` in an executable bash line "
+                f"(prose/comment mentions don't count)"
+            )
+
+    # 3. Both safety branches are present (checked against the whole doc — they appear in prose
+    #    and bash alike, and dropping them anywhere is the regression we care about).
+    for branch in REQUIRED_BRANCHES:
+        if branch not in text:
+            failures.append(f"doc dropped required safety branch: {branch}")
+
+    # 4. Guard against re-inlining: the grounding guards and source extractors must be loaded via
+    #    `-f`, never inlined. Rather than blacklist specific historical literals (which rot on any
+    #    reword), forbid any *inline* `jq` program (no `-f`) that references a grounding structure —
+    #    these tokens only appear in the guard/sources filters, so an inline jq touching them is a
+    #    re-inlined guard the behavioral tests would not cover. The one allowed inline jq is the
+    #    plain verdict-TEXT extraction (`.candidates[0].content.parts...`), which references none of
+    #    these tokens. Both single- and double-quoted inline programs are scanned.
+    GROUNDING_TOKENS = (
+        "web_search_call", "url_citation", "groundingSupports",
+        "groundingChunkIndices", "groundingChunks", "webSearchQueries",
+    )
+    # An inline jq invocation is `jq [flags, none being -f] '<program>'` or "<program>".
+    for m in re.finditer(r"jq\s+((?:-[A-Za-z]+\s+)*)(['\"])(.*?)\2", bash_code, re.DOTALL):
+        flags, program = m.group(1), m.group(3)
+        if re.search(r"(?<!\S)-f(?!\S)", flags):
+            continue  # `-f` means it loads a file, not an inline program
+        hit = next((t for t in GROUNDING_TOKENS if t in program), None)
+        if hit:
+            failures.append(
+                f"doc inlines a jq program referencing {hit!r}; load the canonical .jq via "
+                f"`jq -f` instead so the guard stays behavior-tested"
+            )
+
+    # 5. (#453) REMOVED. The compatible block no longer re-implements verdict precedence /
+    #    fail-closed defaulting inline — it INVOKES the canonical normalize_compat_verdict.py
+    #    (check 8 below pins the wiring; the unit's behavioral tests pin the fail-closed contract).
+    #    The old check 5 pinned an inline `*) status="NOT_SEARCHED"` case that no longer exists, so
+    #    keeping it would either fail-vacuously or false-fail. Its intent now lives in check 8.
+
+    # 6. (#453) No passive OPENAI_BASE_URL assignment/expansion in executable bash (prose is fine).
+    #    Target assignment (`OPENAI_BASE_URL=`) and expansion (`${OPENAI_BASE_URL`/`$OPENAI_BASE_URL`),
+    #    NOT a raw substring, so an explanatory comment/prose mention doesn't false-fail and a
+    #    `${OPENAI_BASE_URL:-…}` variant doesn't false-pass.
+    if re.search(r"(?<![A-Z_])OPENAI_BASE_URL=", bash_code) or re.search(
+        r"\$\{?OPENAI_BASE_URL\b", bash_code
+    ):
+        failures.append(
+            "executable bash reads/sets OPENAI_BASE_URL; the compatible path must use "
+            "ARS_OPENAI_COMPAT_BASE_URL (reading the standard SDK var silently downgrades "
+            "existing first-party users — the #453 passive-downgrade regression)"
+        )
+
+    # 7. (#453) Endpoint construction never builds a double /v1 or falls back to api.openai.com.
+    if "/v1/v1" in bash_code:
+        failures.append("executable bash contains a literal '/v1/v1' (double-/v1 endpoint bug)")
+    if re.search(r"api\.openai\.com[^\n]*chat/completions", bash_code):
+        failures.append(
+            "compatible endpoint must not fall back to api.openai.com/chat/completions; "
+            "require ARS_OPENAI_COMPAT_BASE_URL"
+        )
+
+    # 8. (#453) The compatible block must INVOKE the canonical normalizer via a PIPE, not
+    #    re-implement verdict logic in bash. Scope to the compatible block (located by its
+    #    endpoint identifier) and require `| python3 ... normalize_compat_verdict.py` so a bare
+    #    comment mention or an unpiped/dead reference can't satisfy the check. Anti-vacuity:
+    #    if the compatible path is present but its block can't be located, fail loud.
+    #    (Earlier inline bash re-implemented leftmost-of-four precedence and risked a head->tail
+    #    regression + a raw-text injection of a second STATUS line; calling the behavior-tested
+    #    Python unit, which emits single-line JSON, removes both. _bash_blocks already strips
+    #    comment-only and trailing comments, so a `# ... normalize_compat_verdict.py` comment is
+    #    gone before this check sees it — the pipe requirement is belt-and-braces on top.)
+    if "openai_compatible" in bash_code:
+        compat_blocks = [
+            "\n".join(b) for b in _bash_blocks(text)
+            if "ARS_OPENAI_COMPAT_BASE_URL%/}/chat/completions" in "\n".join(b)
+        ]
+        if not compat_blocks:
+            failures.append(
+                "compatible path is present (openai_compatible) but the lint could not locate "
+                "the compatible call block by its endpoint identifier — keep the "
+                "`ARS_OPENAI_COMPAT_BASE_URL%/}/chat/completions` endpoint line so the wiring "
+                "check stays live"
+            )
+        else:
+            compat_code = "\n".join(compat_blocks)
+            # Require a PIPE into the canonical normalizer. `(?:-\S+\s+)*` allows interpreter
+            # flags (e.g. `python3 -u .../normalize_compat_verdict.py`). This wiring check proves
+            # the canonical unit is invoked-by-pipe; it does NOT parse bash control flow, so it
+            # cannot catch a contrived block that pipes to the normalizer, discards its output,
+            # and re-derives status in bash. That residual is out of scope by design — the real
+            # output contract is carried by the behavioral tests on the JSON-emitting unit; a
+            # determined wrong rewrite is a code-review concern, not a static-lint one.
+            if not re.search(
+                r"\|\s*python3?\s+(?:-\S+\s+)*\S*normalize_compat_verdict\.py", compat_code
+            ):
+                failures.append(
+                    "the compatible block must pipe the model text into "
+                    "normalize_compat_verdict.py (`... | python3 .../normalize_compat_verdict.py`); "
+                    "a comment mention or unpiped reference does not count — verdict normalization "
+                    "must call the canonical, behavior-tested unit, not re-implement it in bash"
+                )
+
+    if failures:
+        print(f"[cross-model-sync] FAIL: {len(failures)} issue(s):")
+        for f in failures:
+            print(f"  - {f}")
+        return 1
+
+    print(
+        f"[cross-model-sync] PASS: doc references all {len(REQUIRED_FILTERS)} canonical filters "
+        f"via jq -f and retains the {', '.join(REQUIRED_BRANCHES)} branches"
+    )
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())

package/vendor/ars/scripts/check_data_access_level.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""Lint: every top-level SKILL.md declares the PINNED data_access_level.
+
+Single pass per skill, one violation per problem: frontmatter must parse,
+the skill must be registered in EXPECTED_LEVELS, and the declared value
+must equal its pin. The governing rule (`ground_truth_isolation_pattern.md`
+§ "Declare `data_access_level` truthfully") requires the annotation to
+reflect the DIRTIEST input the skill may legitimately consume across all
+its modes.
+
+Pin provenance (honest-claim discipline) — all four pins are now
+derivation-backed under the dirtiest-input rule:
+
+- `academic-pipeline: raw` — #756-derived (Stage 1 accepts raw user
+  requests, mid-entry accepts raw papers; the gates run inside the
+  pipeline).
+- `academic-paper: raw` — #773-derived. Standalone modes (revision,
+  revision-coach, rebuttal-audit, citation-check, ...) ingest ungated
+  user drafts and third-party reviewer comments, and
+  literature_strategist_agent's search-fills-gap flow ingests
+  external-index search results inside the skill — Layer-1 inputs both.
+  The prior `redacted` described the orchestrated pipeline path, where
+  Stage 2 inputs arrive as Stage-1 sanitized artifacts (Gate 2.5 runs
+  AFTER Stage 2, so "post-gate" would overstate even that path).
+- `academic-paper-reviewer: raw` — #773-derived. The standalone
+  `/ars-reviewer` entry (Routing Discipline Step 1 routes "review my
+  paper" directly) legitimately consumes an ungated pasted manuscript;
+  `verified_only` was at best true for the pipeline's initial Stage 3
+  dispatch (post-Gate-2.5) — Stage 3' re-review consumes a freshly
+  revised manuscript before Stage 4.5 — and the rule quantifies over
+  ALL entry paths.
+- `deep-research: raw` — #773 re-affirmed on its inputs: raw user
+  queries and unverified web/database search results are its core
+  intake. A ceiling argument additionally applies (`raw` is the
+  dirtiest value, so no re-derivation could move it further).
+
+Changing any pin must be a deliberate, reviewed re-application of the rule,
+and a new top-level skill must be registered here before it passes.
+"""
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from _skill_lint import (
+    FrontmatterError,
+    iter_skill_files,
+    parse_frontmatter,
+)
+
+LEGAL_VALUES = frozenset({"raw", "redacted", "verified_only"})
+
+# Dirtiest-input pins (#756, re-derived across all modes in #773).
+# Keyed by skill directory name.
+EXPECTED_LEVELS = {
+    "academic-paper": "raw",
+    "academic-paper-reviewer": "raw",
+    "academic-pipeline": "raw",
+    "deep-research": "raw",
+}
+
+# The pins themselves must stay inside the closed vocabulary.
+assert set(EXPECTED_LEVELS.values()) <= LEGAL_VALUES
+
+
+def run_all_checks(root: Path) -> list[str]:
+    violations: list[str] = []
+    seen: set[str] = set()
+    for skill_md in iter_skill_files(root):
+        name = skill_md.parent.name
+        seen.add(name)
+        try:
+            fm = parse_frontmatter(skill_md)
+        except FrontmatterError as exc:
+            violations.append(str(exc))  # message already carries the path
+            continue
+        if fm is None:
+            violations.append(f"{skill_md}: missing YAML frontmatter")
+            continue
+        if name not in EXPECTED_LEVELS:
+            violations.append(
+                f"{skill_md}: skill '{name}' is not registered in "
+                f"EXPECTED_LEVELS — apply the dirtiest-input rule and pin "
+                f"its level here"
+            )
+            continue
+        metadata = fm.get("metadata")
+        if not isinstance(metadata, dict):
+            violations.append(
+                f"{skill_md}: metadata must be a mapping/object, got "
+                f"{type(metadata).__name__}"
+            )
+            continue
+        declared = metadata.get("data_access_level")
+        if declared != EXPECTED_LEVELS[name]:
+            violations.append(
+                f"{skill_md}: data_access_level is {declared!r}, pinned "
+                f"value is {EXPECTED_LEVELS[name]!r} (change the pin "
+                f"deliberately or fix the declaration)"
+            )
+    for name in sorted(set(EXPECTED_LEVELS) - seen):
+        violations.append(
+            f"EXPECTED_LEVELS pins '{name}' but no top-level "
+            f"{name}/SKILL.md exists"
+        )
+    return violations
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--path",
+        type=Path,
+        default=Path(__file__).resolve().parent.parent,
+    )
+    args = parser.parse_args()
+    violations = run_all_checks(args.path)
+    if violations:
+        for v in violations:
+            print(f"ERROR: {v}")
+        print(f"\n{len(violations)} violation(s) found.", file=sys.stderr)
+        return 1
+    print(
+        "OK: all SKILL.md files declare a valid, pinned data_access_level."
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())