psyclaw 0.27.23 → 0.28.1

package/vendor/ars/shared/references/authority_content_coverage_advisory_protocol.md

@@ -0,0 +1,275 @@
+# Authority-profile Content-Coverage Advisory Protocol (#681)
+
+This protocol governs the separate `LLM-ADVISORY` layer that records whether a
+bounded, session-held packet passage appears to cover a structured expectation
+from an exactly selected human-subjects authority profile. It is not a legal,
+adequacy, compliance, readiness, authorization, institutional-acceptance, or
+review-pathway determination.
+
+Canonical artifacts:
+
+- `shared/contracts/evidence/evidence_row_v1_1.schema.json`
+- `shared/contracts/human_subjects/content_coverage_advisory.schema.json`
+- `scripts/build_content_coverage_advisory.py`
+- `shared/references/submission_packet_manifest_protocol.md`
+- `shared/references/evidence_row_protocol.md`
+- `docs/design/2026-08-09-681-authority-content-coverage-advisory-spec.md`
+
+The schemas govern closed field shape. This protocol governs replay,
+noninterference, and safe consumption.
+
+The runtime API is `finalize_advisory`, `validate_advisory`, and
+`render_advisory` in `scripts/build_content_coverage_advisory.py`. The CLI
+commands are `build|validate|render`; every command names the complete replay
+inputs and explicit session-content map. Render additionally accepts one
+explicit page and bounded page size.
+
+The exact public signatures are:
+
+```python
+finalize_advisory(draft, inventory, packet_root, context, registry, resolved, manifest, session_sources)
+validate_advisory(advisory, draft, inventory, packet_root, context, registry, resolved, manifest, session_sources)
+render_advisory(advisory, draft, inventory, packet_root, context, registry, resolved, manifest, session_sources, *, page=1, page_size=25)
+```
+
+Runtime resource ceilings are part of the contract. A draft has at most 4,096
+judgments. An in-memory `session_sources` map has at most 512 exact artifact IDs,
+64 MiB of strict UTF-8 text per artifact, and 256 MiB total. Independently, the
+CLI's shared named-JSON loader caps every serialized JSON input file—including
+`--source-map`—at 8 MiB, so the CLI source-map file is more tightly bounded than
+the direct in-memory API. A final advisory's compact canonical UTF-8 JSON is at
+most 8 MiB inclusive. `build` writes exactly those canonical bytes with no
+trailing newline, preserving loadability by the same CLI for `validate` and
+`render`. Each render page has at most 25 evidence rows. Crossing any ceiling
+fails; it cannot be represented as a coverage observation.
+
+## Version and layer boundary
+
+The evidence carrier is `evidence-row/1.1` with the single surface
+`authority_profile_content_coverage`. It is a new version because
+`evidence-row/1.0` is closed to `phase_e_claim_verification` and contains Phase E
+claim and verdict fields that do not belong here. The 1.0 schema, runtime API,
+cache behavior, renderer, and persisted rows remain unchanged.
+
+Every draft and final advisory carries the exact layer literal:
+
+```text
+LLM-ADVISORY
+```
+
+The advisory status is held only in `advisory_coverage_status`. Never write it
+into a #667 `entries[].status`, packet observation, readiness, authorization,
+acceptance, pointer, or digest field.
+
+## Mandatory #666/#667 replay
+
+Before reading a draft, dereferencing `structured_expectations`, or consuming
+session content, the permitted finalizer must call:
+
+```python
+validate_submission_packet_manifest(
+    manifest,
+    inventory,
+    packet_root,
+    context=context,
+    registry=registry,
+    resolved=resolved,
+)
+```
+
+The context, registry, and resolved inputs are a complete all-or-none triplet.
+This surface requires the replay-validated, resolved, open profile-dependent
+gate. A replay mismatch is a contract error, not an advisory finding. Shape
+validation or a self-consistent `manifest_digest` is insufficient.
+
+The final `input_binding` copies exactly the manifest schema version, manifest,
+inventory and observation digests, context and registry identities/digests,
+registry `as_of`, and resolved digest. `deterministic_status` copies the complete
+four administrative fields plus the fixed acceptance status. The five boundary
+booleans are always true.
+
+## Exact requirement and entry seam
+
+Group #667 entries by their exact `requirement_ref`; do not merge parallel
+authorities or let display order choose a winner. Each final requirement result
+copies:
+
+- the complete `requirement_ref`;
+- the dereferenced authority anchor pointer, canonical digest, source id,
+  provision, effective date, and HTTPS URL; and
+- every matching #667 entry as a `deterministic_entry_refs[]` row containing its
+  complete `evidence_ref`, responsibility, status copied under
+  `deterministic_status`, reason codes, and matched artifact ids.
+
+An applicability-false #667 `excluded_requirements` row is copied into the final
+`excluded_requirements` array and never becomes a content finding. This is the
+conditional-requirement false-missing guard.
+
+Only a `packet_owned` entry with deterministic `DOCUMENTED` status and an exact
+matched artifact is eligible for a content check. External dependencies,
+structural `NOT_LOCATED` or `CONFLICTING` rows, and profiled waiver/exception
+cases whose structural result is `ACCEPTANCE_UNVERIFIED` are never converted to
+an advisory missing-element finding. Their deterministic facts remain visible in
+`deterministic_entry_refs`.
+
+Eligibility is entry-local. An ineligible external or committee sibling entry
+does not suppress a coexisting `packet_owned / DOCUMENTED` artifact under the
+same requirement. Preserve both deterministic entries while checking only the
+eligible artifact; this mixed shape occurs in the live consent requirements.
+
+## Structured-expectation accounting
+
+Dereference only the exact replay-bound `requirement_pointer`, then derive one
+pointer and canonical digest for every `structured_expectations[]` row. A draft
+names an expectation by that exact pointer; it does not supply trusted field ids,
+requirements, authority anchors, hashes, paths, or source metadata. The finalizer
+derives those fields from replay-bound inputs.
+
+Every profiled structured expectation is accounted for exactly once in a final
+requirement result. A requirement with no structured expectations is not treated
+as covered: it is `not_checked`, has null advisory status, and carries
+`NO_PROFILED_STRUCTURED_EXPECTATIONS`.
+
+## Explicit session-content map
+
+Packet prose enters only through an explicit in-memory map keyed by exact #667
+artifact id. The finalizer never scans the packet, opens a path from the
+inventory or draft, retrieves a URL, consults an environment variable, or calls
+a model/API. Unknown artifact ids and ambiguous duplicate mappings fail.
+
+For a held string, `source_content_sha256` and
+`source_content_utf8_bytes` cover its exact strict-UTF-8 bytes. The raw artifact
+digest and byte size are copied from the matching #667 packet observation and
+remain separate. Missing, access-failed, and retrieval-failed content has null
+content hash/length even when the raw artifact was structurally located.
+
+## Evidence-row/1.1 states
+
+The closed states are:
+
+| State | Meaning |
+|---|---|
+| `agent_extracted` | The advisory-selected bounded quote is an exact substring of the explicit session string. Its locator is agent supplied and not independently authenticated. |
+| `checked_no_match` | Explicit held content was checked but no passage was selected for the expectation. This is not proof of semantic absence or efficacy. |
+| `not_checked` | No content-coverage check ran. |
+| `source_missing` | The eligible artifact had no explicit session-content value. |
+| `access_failed` | An explicitly reported access failure prevented a check. |
+| `retrieval_failed` | An explicitly reported upstream retrieval/extraction failure prevented a check. |
+
+`agent_extracted` requires a `quote` anchor, non-null excerpt text/hash/UTF-8
+span/capture time, and exact source replay. Its text equals the once-decoded
+anchor byte-for-byte. `checked_no_match` is source-bound but has an empty `none`
+anchor and null excerpt payload. All unperformed states have empty anchors, null
+excerpt payloads, and null source-content hashes/lengths.
+
+Quotes use #656's strict one-time percent decoding: malformed escapes and invalid
+UTF-8 fail, `+` remains `+`, and there is no Unicode, whitespace, punctuation,
+case, or newline normalization. Quotes remain at most 25 whitespace-split words
+and 1,000 Unicode code points. `row_sha256` is SHA-256 over canonical UTF-8 JSON
+with only `row_sha256` excluded.
+
+V1.1 performs no cache lookup. Its retained shared cache block is fixed to
+`status=not_used` and `key_sha256=null`. External text defaults to
+`session_only/not_assessed`; shareable and authorized must occur together. The
+quote ceiling is data minimization, not a rights conclusion.
+
+## Draft and aggregation
+
+The draft is a closed `content-coverage-advisory-draft/1.0` observation carrier.
+Its machine shape authority is
+`shared/contracts/human_subjects/content_coverage_advisory.schema.json#/$defs/advisory_draft`,
+which the runtime validates before consuming any judgment. It carries the
+mandatory layer, exact requirement/expectation/artifact ids,
+`performed|not_checked`, a nullable advisory status, a document locator, one
+encoded bounded quote when applicable, an explicit nullable `captured_at`, and a
+nullable explicit failure state.
+The finalizer, not draft prose, derives every other field.
+
+For performed expectation findings:
+
+- `DOCUMENTED` requires at least one replay-confirmed `agent_extracted` row;
+- `NOT_LOCATED` requires source-bound `checked_no_match` rows covering every
+  eligible checked artifact and no positive quote; and
+- `CONFLICTING` requires at least two replay-confirmed passages supporting the
+  stated conflict boundary.
+
+The two conflict passages may occur in one artifact or different artifacts.
+Their evidence anchors/UTF-8 spans must be distinct; artifact id alone is not the
+judgment identity and cannot prohibit two passages from one document.
+
+`DOCUMENTED` and `CONFLICTING` draft observations require an explicit RFC-3339
+`captured_at`, which the finalizer copies into the evidence row. `NOT_LOCATED`
+and every unperformed observation require null. Never substitute
+`context.confirmed_at`: #666 deliberately excludes it from the semantic context
+digest, and confirmation time is not excerpt-capture provenance.
+
+Aggregate a completely performed requirement in this order:
+
+1. any expectation `CONFLICTING` -> `CONFLICTING`;
+2. otherwise any expectation `NOT_LOCATED` -> `NOT_LOCATED`;
+3. otherwise every expectation `DOCUMENTED` -> `DOCUMENTED`.
+
+If any profiled expectation was not checked, the requirement is `not_checked`
+and does not publish a partial coverage conclusion. Missing content therefore
+uses `advisory_coverage_status=null`, never `DOCUMENTED` or `NOT_LOCATED`.
+`APPLICABILITY_UNRESOLVED` and `ACCEPTANCE_UNVERIFIED` may only preserve their
+matching deterministic boundary; an advisory observation cannot derive either.
+
+The #666 resolved/downstream gate and the #667 capability envelope must be open.
+A closed gate has no exact requirement rows and is a contract error for this
+surface. The one open-gate unresolved case is an explicitly unprovided
+institutional or funder overlay selection: #667 retains the selected base
+requirement entries while reporting `OVERLAY_SELECTION_NOT_PROVIDED`. For each
+such requirement, #681 emits `not_checked`,
+`advisory_coverage_status=APPLICABILITY_UNRESOLVED`, the matching canonical
+reason, unchanged deterministic entry refs, and no expectation findings. It
+rejects draft judgments and does not inspect the session-content map in that
+state.
+
+The closed advisory reason codes are:
+
+```text
+ALL_EXPECTATIONS_APPEAR_COVERED
+EXPECTATION_NOT_LOCATED
+CONFLICTING_COVERAGE_OBSERVATIONS
+COVERAGE_CHECK_NOT_PERFORMED
+SESSION_CONTENT_NOT_PROVIDED
+SOURCE_ACCESS_FAILED
+SOURCE_RETRIEVAL_FAILED
+DETERMINISTIC_PACKET_GAP
+DETERMINISTIC_PACKET_CONFLICT
+WAIVER_OR_EXCEPTION_BOUNDARY
+EXTERNAL_DEPENDENCY
+APPLICABILITY_UNRESOLVED
+NO_PROFILED_STRUCTURED_EXPECTATIONS
+INSTITUTIONAL_ACCEPTANCE_REQUIRED
+```
+
+## Validation and rendering
+
+The final report digest uses canonical UTF-8 JSON with sorted keys, compact
+separators, non-finite values forbidden, and only `report_digest` excluded.
+Validation replays #667 and every source-bound evidence row against the same
+named inputs. A report cannot validate or render from self-digests alone.
+
+Rendering performs no retrieval or status derivation. Treat every identifier,
+path, locator, authority string, and excerpt as untrusted. Markdown/HTML escaping
+must prevent raw tags, comments, links, images, URL autolinks, headings, fences,
+extra cells/rows, control characters, bidi controls, and line-boundary injection.
+
+The final JSON persists every evidence row in canonical order, but one render
+call exposes exactly one bounded evidence page. Default and maximum page size are
+25; a caller may request a smaller positive size and an explicit one-based page.
+The rendered navigation states previous page, next page, and the explicit valid
+page range. Page zero, negative/out-of-range pages, size zero, and size above 25
+fail. There is no concatenate-all loop, render-all API, or `--all` flag. Walking
+pages must reproduce every row exactly once and in order.
+
+## Measurement boundary
+
+The final carrier contains the exact marker `evaluation_status=UNMEASURED`.
+That marker is not a measurement row. No held-out scored row exists for this
+surface, so ARS makes no accuracy, precision, recall, coverage-improvement, or
+efficacy claim. A future efficacy claim requires a real held-out scored row under
+the shared held-out measurement contract; never synthesize an "unmeasured"
+measurement JSON file.

package/vendor/ars/shared/references/claim_standing_candidate_ledger_protocol.md

@@ -0,0 +1,66 @@
+# Claim-standing candidate-ledger protocol
+
+Status: Track A offline substrate, live discovery adapters, stance-side contracts, the stance runner (injected-transport only), the semantic stance-record validator, the deterministic presentation renderer, and the pipeline wiring (consent-surface builder, freshness checker, transmission ledger) implemented; the relevance assessor, a live stance-provider adapter, and claim-standing measurement remain unimplemented.
+
+This protocol fixes the deterministic boundary between a consent-bound search plan, already-retained adapter-neutral retrieval records, and a candidate ledger. It does not retrieve records, call a model, infer stance, render claim standing, or dispatch a held-out evaluation.
+
+## Contract identities
+
+- `claim-standing-query-plan/1.0`: the frozen checkpoint, tier rule, query/index envelope, caps, and consent receipt.
+- `claim-standing-retrieval-input/1.0`: explicit attempts, retained raw hits, caller-supplied relevance assessments bound to exact claim/candidate/prompt bytes, and a whole-input digest.
+- `claim-standing-candidate-ledger/1.0`: an auditable terminal state for every attempt and raw hit plus deterministic work-family selection.
+- `claim-standing-query-plan/1.1`: the stance-authorizable consent — identical to 1.0 except the decision may be `retrieval_plus_stance`, binding a top-level `stance_plan` (exact provider/model, prompt contract, retention disclosure) by hash and extending the authorized content classes by exactly the stance transmission class. The validator accepts both versions; 1.0 semantics are unchanged.
+- `claim-standing-stance-record/1.0`: the future stance runner's output contract — §7 probe-identity hashes, per-family rows under the closed §5.1 vocabulary with mandatory evidence-row references, the all-selected distribution, and the mandatory `STANCE CLASSIFICATION UNMEASURED` banner. `scripts/claim_standing_stance_runner.py` implements the runner against an injected transport whose declared identity must equal the consented `stance_plan` (no live provider adapter exists; its CLI refuses until one ships with its own consent surface), and `validate_stance_record` is the required semantic verifier (identity hashes, distribution sum, exact selected-family coverage, per-evidence-row hash replay). Each transport call is recorded as a transmission event (recipient, purpose, content classes, prompt hash/bytes, consent receipt, retention disclosure, result state) returned beside the record; `claim-standing-transmission-ledger/1.0` below is the dedicated contract those events land in. `scripts/render_claim_standing_view.py` renders the §5.3 three-part view with the §5.4 bounded vocabulary, fixed empty wording, all-selected denominator, inert escaping of provider text, and stale-record refusal.
+- `claim-standing-transmission-ledger/1.0`: the design §6 per-event accounting of every authorized transmission attempt in one probe. Retrieval-query events derive one-to-one from the retained attempts (recipient index and product identity, `scholarly_discovery` purpose, the `accepted_search_query` content class, query hash and UTF-8 byte count, consent receipt, retention disclosure, attempt start time, and the closed attempt-outcome vocabulary as result state); stance-classification events are the runner's transmission records copied field-for-field, with any unexpected field refused. Accounting is deliberately conservative: an attempt an adapter refused before transport still appears with its failure result state, so the ledger may overstate, never understate, what could have left the session, and byte counts are of the consented content class (accepted query text / exact prompt), not transport framing. `scripts/check_claim_standing_transmissions.py` is the normative builder/validator and the §9 gate-14 check. It first schema-validates the plan and retrieval input and replays both self-digests (a silently edited attempt list cannot be accounted), then fails closed on: an event whose content classes fall outside the plan's authorized allowlist; a recipient outside the consented roster or `stance_plan`; an attempt naming an index that is not a consented target of its query; a duplicate attempt id (double-counted event); a consent-receipt or retention-disclosure drift; an unrecorded result state; and stance transmissions under a plan that does not authorize them. A `retrieval_plus_stance` plan must supply its stance transmissions explicitly — an empty list is an explicit assertion that no stance call ran — and passing the stance record cross-checks that every row that reached the transport has its event (only an `abstract_missing` row never builds a prompt). Completeness for a run interrupted before the runner returned its transmission list remains caller-honesty-bound, the same trust boundary as the runner itself. Validation is exact replay (rebuild and compare); `build --output` persists only under `explicit_local_export` to the consent-derived `<authorized_output_path>.transmission-ledger.json` path through the substrate's exclusive no-follow fsynced writer, and a trailing-separator authorized path is refused so the derivation can never name a hidden dotfile.
+
+All three contracts are closed Draft 2020-12 JSON Schemas. Hashes are lowercase SHA-256 over canonical JSON (UTF-8; sorted keys; compact separators; the digest field omitted from the object being hashed). The consent receipt additionally binds a closed consentable-plan projection containing the probe id, exact claim and eligibility basis, queries and their date/index targets, provider roster, language and document-type allowlists, authorized content classes, caps, and plan creation time. Provider retention is conditional: `known` requires a semantically visible reference and `unknown` requires null. Changing any authorization surface invalidates the old receipt.
+
+The portable schemas use `\\S` as a first structural screen. The runtime then applies one Unicode predicate to every claim/query, provider disclosure and retention reference, consent boundary, non-null provider-record id/title/author name, available abstract, successful rationale/raw output, and failure detail. It NFKC-normalizes for the check, rejects a surrogate anywhere, and rejects control/format/separator-only, combining-only, whitespace-only, and punctuation-only text. Narrative fields may use a visible letter, number, or symbol; provider-record ids and author names require a letter or number. Exact retained strings and their hashes are not rewritten by this check. A failed malformed assessment is the sole raw-output exception: whitespace-only or format-only output remains exact evidence, while its failure detail must still be semantic text.
+
+## Live discovery adapters
+
+`scripts/claim_standing_discovery.py` is the Track A head: one closed adapter per index (`semantic_scholar`, `openalex`, `crossref`, `arxiv`) turns a validated, consent-bound query plan into a `claim-standing-retrieval-input/1.0` record. Adapters request a single page up to the 20-hit per-(query,index) cap, truncate provider overflow at the adapter boundary with exact counts, map failures onto the closed attempt vocabulary with exactly one transport call per attempt and no silent retry, and declare honest `retention_state: unknown` provider blocks. An arXiv year filter is refused as `unsupported_query` before any network call. The emitted record carries an empty `relevance_assessments` array by design: assessments are caller-supplied under these contracts, and the relevance assessor is a later, separately consented slice, so finalization stays blocked until each computed work family has one. The `retrieve` CLI refuses to persist output under a `session_only` consent, accepts only the output path derived from the consent's hash-bound `authorized_output_path` plus a fixed `.retrieval-input.json` suffix, refuses provider redirects, and writes exclusively through the substrate's no-follow fsynced writer. The pinned resolver clients are not imported. Adapters are written against the providers' documented public APIs and are unexercised live until a first diagnostic run.
+
+## Deterministic finalization
+
+The pure builder `scripts/build_claim_standing_candidate_ledger.py` accepts only local JSON files. It validates consent and exact-claim bindings, then applies these operations in order:
+
+1. require exactly one visible initial attempt for every planned query/index pair;
+2. mark hits that have neither a title nor a stable identifier;
+3. apply date, language, and document-type filters in that order;
+4. form work families by normalized DOI, explicit version relation, normalized title/year/first author, then title plus a supplied relation; a DOI counts only after NFKC/prefix trimming when it matches `10.<4-9 ASCII digits>/<suffix>`, the suffix contains at least one Unicode letter or number, and the suffix has no Unicode C/Z/whitespace character; invalid DOI text remains retained metadata but never stable identity or a union key, normalization-empty title/provider-record id/author-family values never count as identity, and a no-DOI record cannot transitively bridge distinct DOI components;
+5. choose a canonical record by published-over-preprint status, DOI presence, abstract presence, provider rank, then ASCII `(index_id, provider_record_id)`;
+6. apply the caller-supplied relevance assessment independently of canonical selection, verifying its canonical exact-claim/candidate/assessor input digest and exact prompt UTF-8 digest, then retaining its outcome, raw output and matching digest, rationale, or explicit failure;
+7. select relevant and ambiguous families by deterministic relevance/rank order, up to 40 families, preserve assessment failures as `not_checked`, and mark every remaining eligible family `candidate_cap_exceeded`; a derived work-family id resolves only otherwise exact ordering ties.
+
+The envelope is fixed at three queries, four indexes, 20 retained hits in aggregate per `(query,index)` across attempts, 240 raw hits, and 40 selected work families. Every raw hit receives exactly one terminal state. Attempt failures remain separate ledger rows; the builder never hides or retries them. A pair has one initial attempt; any later attempt must name the failed attempt and a fresh, unique authorization identifier.
+
+Relevance is an explicit retained input, not a model decision made by this builder. Each row binds the exact claim text/digest, candidate title and abstract state/text digest, assessor identity/version contract, and canonical prompt UTF-8 bytes before its output is considered. An available abstract and a successful assessment's raw output and rationale must contain visible semantic NFKC text under the rule above. A failed assessment retains a semantic failure detail and any malformed raw output exactly, including whitespace-only or format-only output, and finalizes truthfully as `not_checked`; it is never converted into a relevance judgment or omitted.
+
+## Consent, privacy, and failure behavior
+
+Only the exact checkpoint proposition, allowed query/index envelope, filters, retrieval content class, and retained-input hashes authorized by the consent receipt may be processed. Credential fields, API keys, full text, stance/model configuration, and network locations are outside these contracts; the only prompt field is the bounded relevance-only prompt bound to the explicit assessment input. Every planned target pair must have one visible root attempt. A retry requires a closed hash-bound authorization receipt for the exact plan, probe, consent receipt, failed attempt, and query/index pair, accepted after that failure and before the retry starts. Attempt, hit, authorization, assessment, and input timestamps are checked for their required monotonic order. A schema error, stale hash, unauthorized retry, cap violation, missing assessment, invalid Unicode, or changed exact claim fails closed without output replacement. The static integration guard separately pins every directly imported module, tracks its alias, and permits only the exact module attribute/call shapes used by the current offline runner; bare module-object escape and deeper capability paths fail the guard.
+
+Build a new local ledger only when the hash-bound consent receipt says `local_persistence=explicit_local_export`:
+
+```text
+PYTHONPATH=scripts python3 scripts/build_claim_standing_candidate_ledger.py build --query-plan query_plan.json --retrieval-input retrieval_input.json --output candidate_ledger.json
+```
+
+For `local_persistence=session_only`, the same `build --output` command fails before creating the path. In-memory `build_ledger(...)` and the read-only replay validator remain available; there is no CLI flag that widens persistence authority. An authorized export requires the exact closed `export_boundary` statement and absolute `authorized_output_path` in the hash-bound receipt; the CLI requires an exact output-string match before path creation, so changing the working directory cannot retarget a receipt. It uses exclusive create plus no-follow on supported non-Windows hosts, is mode `0600` from creation even under umask `022`, and fsyncs the file and containing directory before reporting success. The ledger root copies the exact consented `local_persistence`, `export_boundary`, and authorized path, and every work family's `sharing_scope` equals that persistence state; a disk export is never mislabeled `session_only`. `rights_basis=not_assessed` remains truthful and unchanged: local persistence authority does not invent publication, redistribution, or provider rights.
+
+Validate an existing ledger by exact deterministic replay:
+
+```text
+PYTHONPATH=scripts python3 scripts/build_claim_standing_candidate_ledger.py validate --query-plan query_plan.json --retrieval-input retrieval_input.json --candidate-ledger candidate_ledger.json
+```
+
+## Pipeline wiring
+
+The probe joins the pipeline at exactly one seam: after Phase E has emitted its Claim Registry at a Stage 2.5 or Stage 4.5 integrity checkpoint, as a user-requested advisory view (`academic-pipeline/references/claim_verification_protocol.md` § Claim-Standing Probe Offer). The wiring layer is three deterministic, offline tools; none of them retrieves, calls a model, or touches Phase E, gate, manuscript, citation, or read-ledger state (§9 gate 12, pinned by a static capability scan plus an end-to-end no-mutation test).
+
+- `scripts/build_claim_standing_query_plan.py` (§3.1 trigger + §3.2 consent surface; gates 1 and 2). `assess_eligibility` applies the exact trigger to one registry row: at Stage 2.5 the recorded `HIGH-IMPACT` tier alone is the registry witness (`RANDOM`/`TOP-UP`/`NOT-SELECTED` never eligible) and a registry-recorded basis or a recorded researcher confirmation supplies the plan's five-part basis; Stage 4.5 requires the `ALL` registry with the recorded five-part high-impact basis (`ALL` alone is not permission), and a basis-less Stage 4.5 row stays ineligible until the researcher confirms the classification. Confirmations and the basis provenance (registry vs researcher confirmation) are recorded on the consent surface, never in the registry. `propose` renders the closed §3.2 consent surface — exact claim, providers and retention, what each recipient receives, caps, LLM transmission flags, exact stance provider/model when proposed, persistence and deletion/export boundaries with the derived artifact suffixes, the advisory/search-bounded statement, and the four separate choices — and embeds the complete consentable-plan projection of the plan `bind` would construct, so the surface SHA-256 covers every field the receipt later binds (what was shown IS what is bound; `bind` asserts the receipt's `consentable_plan_sha256` equals the digest of the projection the accepted surface displayed). `bind` then emits a schema-valid `claim-standing-query-plan/1.0` (retrieval_only) or `/1.1` (retrieval_plus_stance) plan validated by this substrate, or the explicit local `not_checked` declination record (`claim-standing-probe-declination/1.0`): `consent_absent` when no surface hash was supplied, `consent_invalidated` on any post-proposal change (claim, query, provider, filter, cap, stance plan, persistence), `consent_cancelled` on an explicit cancel — with no network or model call anywhere in the builder. Explicit falsey decisions are refused, never defaulted (an empty `queries` list does not select the default query). The default query is the `exact_claim` derivation (`exact_claim_query`); an edited text must be declared `researcher_authored`, and `assisted_then_researcher_approved` is refused because no planner mode is authorized in this slice. The `bind --output` CLI persists only under `explicit_local_export` to the consent-derived `<authorized_output_path>.query-plan.json` path; without `--output` the plan prints for session-only use and no path is created, and a declination exits with the distinct status 3 (neither a bound plan nor an error). The surface's `derived_artifact_suffixes` roster is the complete consented-artifact family (candidate ledger at the authorized path itself, query plan, retrieval input, transmission ledger, stance record, evidence rows, rendered view), sourced from the substrate's `ARTIFACT_SUFFIXES` authority and test-pinned to every owning module.
+- `scripts/check_claim_standing_freshness.py` (§7; gate 13). Compares the probe identity bindings — current registry claim text, consent receipt, query plan, adapter registry, candidate ledger, stance configuration (consented provider/model and the runner's frozen prompt-contract version) — and reports `current` or `stale` with a closed reason list (`claim_text_changed`, `consent_receipt_changed`, `query_plan_changed`, `adapter_registry_changed`, `candidate_ledger_changed`, `stance_configuration_changed`) plus explicit `assessed` / `unassessed` binding lists, so a claim-text-only comparison never presents itself as a complete assessment. The record-side comparison consumes the runner's single identity authority (`expected_identity`), a stance record can only be assessed together with its candidate ledger, and artifact semantics (schema and deep replay) remain the named validators' job and are reported as unassessed here. A stale result remains inspectable but cannot be presented as current; an artifact whose self-digest does not replay is an assessment error, never a silent verdict. `--runtime-check` additionally compares the consented roster against the currently declared discovery adapters.
+- `scripts/check_claim_standing_transmissions.py` (§6; gate 14). See the contract identity above.
+
+The current slice deliberately excludes the relevance assessor, a live stance-provider adapter, measurement gates, and held-out dispatch. `STANCE CLASSIFICATION UNMEASURED` remains mandatory until a separately authorized later track is implemented and evaluated.

package/vendor/ars/shared/references/claim_strength_ladder.md

@@ -0,0 +1,93 @@
+# Claim-Strength Ladder
+
+**Issue:** #569. **External motivation:** DELEGATE-52 (arXiv:2604.15597) — round-trip
+document editing corrupts scientific content by *subtle modification, not deletion*.
+#390's block-anchored patch confines that exposure to touched blocks; this reference
+governs the epistemic dimension *inside* a touched block, which the patch mechanism
+does not check. Mechanism shape borrowed from
+[Yila-AI/sci-ssci-skills](https://github.com/Yila-AI/sci-ssci-skills) by
+@MissOrangePeel (`sci-ssci-polishing`, `references/invariants.md`).
+
+**Epistemic status:** the field-relative ladder remains advisory / interpretive
+guidance. Since #670, exact claim surfaces that were explicitly registered and
+hash-bound are mechanically preserved or replaced only by exact author-approved
+bytes in current patch 1.1; the runtime does not infer a rung from prose and does
+not detect unregistered semantic movement. E6 therefore remains mandatory for
+unregistered prose. The deterministic sibling `#570` separately conserves
+numbers and citation tokens; see `scripts/check_revision_token_conservation.py`.
+
+## The ladder
+
+Epistemic claims sit on an ordered strength scale. Revision must never move a claim
+along it **silently** — in either direction — without an authorizing roadmap item.
+
+```
+is consistent with / may suggest
+  < is associated with / relates to / correlates with
+    < predicts
+      < contributes to
+        < affects / influences / leads to / shapes
+          < causes / determines / demonstrates that / proves
+```
+
+The exact ordering varies by field (a clinical "predicts" and an econometric
+"predicts" are not identical), so the operative rule is **"no silent move,"** not
+one universal ordering. When unsure whether two phrasings occupy the same rung,
+treat them as different rungs and preserve the source.
+
+## What counts as a move (and what does not)
+
+A **move** — requires authorization:
+
+- `associated with` → `leads to` / `reduces` / `drives` / `causes` (up)
+- `may support` / `might improve` → `supports` / `improves` (drop of a modal hedge = up)
+- `predicts` → `is associated with` (down — silently *weakening* misrepresents the
+  author just as much as strengthening; bidirectional by design)
+- deleting a design-based causal caveat ("the observational design cannot establish
+  causation"), a scope hedge ("in this sample", "for this cohort"), a status hedge
+  ("preliminary", "exploratory"), or a null/negative result
+- re-attaching a background citation's claim to the current study's finding
+
+NOT a move — no authorization needed:
+
+- reordering a sentence while keeping the same verb and hedges
+- foregrounding / positioning prose that adds emphasis WITHOUT changing the verb's
+  rung (e.g. stating the contribution is important, while the finding stays
+  "associated with")
+- a description swap at the same rung ("narrows the range" ↔ "reduces the range")
+- condensing prose that preserves every hedge and every claim's rung
+
+## Load-bearing overlap with existing protections
+
+- **Hedges.** `shared/references/protected_hedging_phrases.md` protects hedges
+  against *compression* in abstract-only mode. The ladder extends the same concern
+  to *revision rounds* and adds the ordered scale that the phrase roster lacks. A
+  phrase already on a paper's `protected_hedges` list is a ladder invariant too.
+- **Novelty.** #548 bounds *priority* language ("first study to…"); the ladder
+  governs *causal/evidential* strength. Disjoint concerns, same anti-overclaim family.
+- **Numbers/citations.** #570 conserves numeric and citation *tokens*
+  deterministically; the ladder covers what token-matching cannot see (negation,
+  direction, modality, causal strength). The two are necessary-but-not-sufficient
+  complements, mirroring the v3.11 deterministic-gate / LLM-semantic split.
+
+## Where this is consumed
+
+- `draft_writer_agent` § Claim-Strength Ladder (#569) — revision mode: a patch op
+  touching a registered claim surface carries its exact #670 authorization when
+  movement is author-approved; unregistered surfaces remain explicit E6 scope.
+- Stage 4.5 integrity audit — the audit vocabulary names the drift class so a
+  reviewer/gate can flag it; advisory rows only, never terminal.
+- #672 cross-document consistency advisory — semantic callers may use the ladder
+  for field-relative abstract/results or discussion/results rung observations.
+  The deterministic finalizer implements no keyword matcher or numeric ranker;
+  the `LLM-ADVISORY` / `UNMEASURED` result grants no revision authority and
+  cannot change Stage 4.5 or Stage-5 routing.
+
+## Measurement
+
+The acceptance test for any change to this guidance is
+`evals/heldout/revision_claim_drift/`. The 2026-07-22 baseline measured 2/8 = 25%
+claim-strength/hedge drift on the current frontier model under hedge-drop and
+null-reframe pressure — the evidence that this mechanism earns its place rather
+than closing as documented-negative-scope. Model- and time-specific; re-run, don't
+reuse.