proofpath 0.2.0__tar.gz → 0.3.0__tar.gz

{proofpath-0.2.0 → proofpath-0.3.0}/CHANGELOG.md

@@ -6,6 +6,93 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-09-15
+
+The judge layer: an opt-in LLM second opinion and an opt-in model-written summary.
+The default run still makes zero LLM calls, and nothing the model says can change a
+verdict. Live run on Groq in `docs/eval/2026-09-15-judge-live.md`.
+
+### Added
+- **`check --judge`** (`judge.py`, `verify.py`). After the local verdicts are final, the
+  `low`-tier ones — never a numeric mismatch, never a claim without a quoted passage —
+  go to the model in batches of up to 20 items (about 7k tokens), each with its claim and
+  passage. The opinion (`SUPPORTED | REFUTED | NEI` plus a one-sentence rationale) is
+  attached beside the verdict: a `= judge (groq openai/gpt-oss-120b): …` line under a
+  finding it disagrees with, a `judge` column in the markdown `## Checked` table, and
+  `judge` fields in the JSON. The local `Verdict`, the finding kind and every state are
+  untouched (spec §11.1). Opinions are cached in the new `judgements` table (schema v4,
+  additive; wiped with the verdicts when a source's text changes), so a re-run asks
+  nothing, and `model_id` is untouched, so toggling `--judge` never invalidates a verdict.
+- **`check --summarize`** and the TUI's **`/summarize`**: one extra call over the finished
+  markdown report, run after the report is final, off by default in both front-ends,
+  printed as `summary    (model-written, groq openai/gpt-oss-120b) …` and as
+  `## Summary (model-written, …)` in the file. `--summarize` alone is exactly one call.
+- **`JudgeClient`**: one adapter for Groq (default `openai/gpt-oss-120b`), Gemini and
+  Ollama over the OpenAI `chat/completions` shape; strict JSON-schema output with a
+  `json_object` fallback, `reasoning_effort=low` with a fallback for providers that
+  reject it, `Retry-After` on 429 (capped, accounted), exponential backoff on 5xx, then
+  `JudgeUnavailable`. The key comes from the environment or `.env`, never from config,
+  never appears in `repr`, errors or logs; provider bodies are never echoed. Prompts are
+  packaged template files (`proofpath/prompts/review.md`, `summarize.md`).
+- **Cost on every surface**: the `Judging` and `Summarising` stage lines carry calls and
+  prompt/completion tokens; the footer counts the calls; `Report.judge_cost` and
+  `models["judge"]` land in the JSON.
+- **An unanswered judge is reported, not hidden**: `judge unavailable after N calls
+  (HTTP 401 from …); local verdicts stand` in the stage line, the report header
+  (`judge status:` / `summary status:`), the JSON and an unsuppressed terminal line — a
+  `-q` or piped run cannot look like a judged-clean one. The SARIF log does not carry it.
+  The run never fails because of the judge.
+- Gemini prints its data-use warning once per run (spec §11).
+
+### Changed
+- `check --judge` / `--summarize` no longer exit with `arrives in v0.3`.
+- Cache schema **v4** (`judgements`); a v1 file still migrates through the whole chain.
+- The markdown `## Checked` table always carries a `judge` column; without `--judge` every
+  cell is `—`, so a v0.2 report and a v0.3 one differ by that column alone.
+- `--format json` gained `summary`, `summary_model`, `judge_cost` and per-result `judge`
+  fields; every one of them is `null` on a default run.
+
+## [0.2.1] - 2026-09-15
+
+The TUI's second look. No behaviour change: every state word, every honesty sentence,
+the exit codes, the scheduler and the one-shot CLI are exactly v0.2.0's. Design in
+`docs/superpowers/specs/2026-09-15-tui-v2-design.md`; the by-hand session in both
+themes, with SVG screenshots, in `docs/eval/2026-09-15-tui-v2-live.md`.
+
+### Changed
+- **Two themes, one truth** (`tui/theme.py`). `rich` draws box borders, Unicode glyphs
+  and truecolor tones when the terminal gives evidence of them (`COLORTERM`, Windows
+  Terminal, iTerm2, kitty, WezTerm, Ghostty, VS Code, Terminal.app); `plain` is a pure-ASCII, ANSI-16 look
+  (v0.2.0's `⏺ ✗ ⚠ › ⧉` become `* x ! > [copy]`, and findings now print their `= note:`
+  lines as the CLI does), chosen under `NO_COLOR`, `--no-color`, `-q`,
+  `TERM=dumb`, legacy conhost, a CJK locale, or any session without truecolor evidence (an SSH
+  or tmux session that strips `COLORTERM` gets `plain`). `PROOFPATH_THEME=rich|plain` overrides
+  detection. The meaning colours stay `ui.py`'s tables; a theme changes how a meaning
+  looks, never what a word means. Spec §13.1's "pure ASCII" rule for the pet now binds
+  `plain` only.
+- **The pet** (`tui/pet.py`): `rich` draws a seven-line ferret with a real tail running
+  to the `[PROOF]` stamp; `plain` keeps the three-line one unchanged. Same eyes, same
+  blink, same reactions; the tail wags in `rich` while a run works.
+- **Run panels** (`tui/widgets/run_block.py`): in `rich` each run is a rounded panel in
+  its accent, the command and the state word on the top border, the coverage on the
+  bottom one; the stages are a fixed-column table (symbol, name, summary with `·`
+  separators, attribution, elapsed) and the active stage carries a real `▰▱` progress
+  bar with `done/total`. A finished stage that left something unverified keeps the
+  `⏺` mark instead of a tick. Below 60 columns the borders go and the flat rows
+  return; a run that crossed the floor either way says its coverage exactly once.
+- **Findings** (`tui/widgets/finding.py`): the state word is a badge, the location a
+  fixed cell, the tier right-aligned; the finding's notes and the claim (`you`) and
+  the passage (`source`) it was checked against are printed under it. A tier-less
+  badge keeps its row at 60–79 columns. `plain` prints the notes as the CLI's own
+  `= note:` rows and keeps `[copy]`.
+- **Footer** (`tui/widgets/footer.py`): `rich` draws the coverage as a proportional
+  `█▓░` bar in the three meaning colours over the counts line; `plain` keeps the
+  `kv` lines. The prompt wears a one-line rounded border in the run's accent.
+- **Structure** (OPEN-ITEMS 12.4): `tui/app.py` is split — `theme.py`, `pet.py`,
+  `verbs.py` and `tui/widgets/` (`run_block`, `finding`, `footer`, `prompt`,
+  `banner`, `_shared`) — and is now 681 lines of composition, scheduler wiring and
+  slash commands, no rendering.
+
 ## [0.2.0] - 2026-09-15
 
 The interactive front-end, author-year citations, SARIF output and a cache for the

{proofpath-0.2.0 → proofpath-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: proofpath
-Version: 0.2.0
+Version: 0.3.0
 Summary: Check whether the sources behind a claim actually say what the claim says.
 Project-URL: Homepage, https://github.com/Yigtwxx/proofpath
 Project-URL: Repository, https://github.com/Yigtwxx/proofpath
@@ -77,20 +77,47 @@ proofpath
 ```
 
 ```
-   ,_,
-  (o.o)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[PROOF]
-   " "    proofpath v0.2.0                                              academic . online . coreml
-          paste a file path, a URL, or a claim.            /help  /config  /quit
+    ╭╮ ╭╮
+   ╭╯╰─╯╰────────────────────────────────────────────────────────────────────╮
+  ╸┤ o o                                                                     ╰~~~~~~~~~~~~~[PROOF]
+   ╰─┬─┬────────────────────────────────────────────────────────────────┬─┬──╯
+     ˘ ˘                                                                ˘ ˘
+      proofpath v0.2.1                                                  academic . online . coreml
+      paste a file path, a URL, or a claim.                                  /help  /config  /quit
 ```
 
-Bare `proofpath` opens the terminal UI ([a recorded session](docs/eval/2026-09-15-v0.2-live.md)).
+Bare `proofpath` opens the terminal UI ([a recorded session in both themes](docs/eval/2026-09-15-tui-v2-live.md),
+with [SVG screenshots](docs/eval/tui-v2-rich.svg)). Each run is one panel in its own
+accent: the command on the top border and the run's state at its right, a fixed-column
+stage table underneath (`✓` finished, `⏺` still running or finished with something
+unverified, a real progress bar on the active stage, the provider that produced each
+number at the right), a rule, then the findings — location, reference, the state word
+as a badge, the tier — with the finding's notes and the claim (`you`) and the passage
+(`source`) it was checked against under it. The bottom border carries the run's
+coverage; the docked footer draws it as a bar and never scrolls away.
+
 Paste a path and it runs; every one-shot verb is a slash command (`/check`, `/resolve`,
 `/fetch`, `/config`, `/cache`), runs can be started while others are in flight and
-stopped with `/cancel #n` — a stopped run keeps what it had decided — and the
-coverage footer never scrolls away. Click (or press `enter` on) a finding to read the
-whole quoted passage; `⧉` copies it; a finding's reference is a link to its source.
-When a publisher blocks the plain fetch, the permission question is asked **inline,
-under the stage that hit the wall**, with `[allow once] [always] [no] [never]`.
+stopped with `/cancel #n` — a stopped run keeps what it had decided. Click (or press
+`enter` on) a finding to read the whole quoted passage; `⧉` copies it; a finding's
+reference is a link to its source. When a publisher blocks the plain fetch, the
+permission question is asked **inline, under the stage that hit the wall**, with
+`[allow once] [always] [no] [never]`.
+
+**Windows / `NO_COLOR`.** The look above is the `rich` theme, chosen when the terminal
+gives evidence of truecolor (`COLORTERM`, Windows Terminal, iTerm2, kitty, WezTerm,
+Ghostty, VS Code, Terminal.app). Under `NO_COLOR`, `--no-color`, `-q`, `TERM=dumb`,
+legacy conhost or a CJK locale the `plain` theme draws the same runs as flat ASCII rows
+in the terminal's own 16 colours — the state words, the coverage and every honesty
+sentence are identical, only the drawing changes. `PROOFPATH_THEME=rich|plain` forces
+either, for screenshots and bug reports.
+
+```
+   ,_,
+  (o.o)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[PROOF]
+   " "    proofpath v0.2.1                                              academic . online . coreml
+          paste a file path, a URL, or a claim.            /help  /config  /quit
+```
 
 The same engine behind a pipe or in CI:
 
@@ -212,7 +239,12 @@ runtime teardown); fixed in v0.1 — 20 of 20 piped runs exit `1`
   counted as unreachable.
 - **Coverage is not perfectly reproducible**: two runs minutes apart can read a
   different number of sources, depending on which providers answered.
-- The LLM judge and `--summarize` arrive in **v0.3**.
+- **The judge is a second opinion, not a second verdict.** `--judge` asks the model only
+  about the low-tier verdicts (1 of 10 on the live draft), and its answer is printed
+  beside the local verdict, never in place of it. `--summarize` is one extra call over
+  the finished report, labelled model-written; if the provider does not answer, the
+  markdown report, the JSON and the terminal say so (`judge status` / `summary status`
+  in the header). The SARIF log does not carry it — it is a findings document.
 
 ## Speed
 
@@ -246,13 +278,53 @@ TablePlus or DBeaver — plain tables, no extension. Raw publisher text expires
 7 days; verdicts keep the passage they quote; a provider outage is never stored.
 `proofpath resolve REF` and `proofpath fetch URL|DOI` run either half on its own.
 
-## Optional LLM judge — arrives in v0.3
+## Optional LLM judge (v0.3)
+
+Everything above runs locally, and the default run makes **zero** LLM calls. Two flags
+add an LLM at the end, and only there:
+
+```bash
+proofpath check paper.pdf --judge        # a second opinion on the low-confidence verdicts
+proofpath check paper.pdf --summarize    # one model-written paragraph over the finished report
+proofpath config check                   # proves the key works before you spend a run on it
+```
 
-Everything above runs locally. An LLM is used only at the end, as an opt-in second
-opinion on low-confidence verdicts — it never sees a source document and cannot
-change a verdict. The settings exist today (`proofpath config check` proves a key
-works, default Groq); `check --judge` and `--summarize` are wired in v0.3. The key
-comes from the environment or a `.env` file, never from config, and is never printed.
+**What `--judge` does.** After the local verdicts are final, the verdicts the models
+were least sure about — the `low` tier, never a numeric mismatch and never a claim
+without a quoted passage — go to the model in batches of up to 20 (about 7k tokens),
+each with its claim and the passage it was checked against. The model answers from the
+passage alone, and its label and one-sentence rationale are printed **beside** the local
+verdict: `= judge (groq openai/gpt-oss-120b): NEI — …`. The local verdict, the finding
+kind and the report's states never change. Opinions are cached with the verdict, so a
+re-run asks nothing.
+
+**What it cannot do.** It never sees a source document, so it cannot introduce a claim
+or an evidence passage of its own; it cannot turn `NEI` into `SUPPORTED`; it cannot
+hide a source that could not be read. If the provider is down, rate-limited or the key
+is wrong, the run finishes on the local verdicts and says so in the stage line, the
+report header (`judge status:`) and the JSON — `-q` cannot hide it.
+
+**What `--summarize` does.** One final call turns the finished markdown report into 3–5
+plain sentences a reader can act on. It runs after the report is complete, its only
+input is that report, it is off by default in the CLI and the TUI (`/summarize` there),
+and the output is labelled `(model-written, <provider> <model>)`. `--summarize` alone
+is exactly one call; with `--judge` the escalation runs first.
+
+**Cost.** The footer counts the calls and the stage line the tokens:
+`Judging … 1 of 10 verdicts reviewed, 1 call, 613 prompt · 193 completion tokens` and
+`Summarising … 98 words, 1 call, 1,608 prompt · 343 completion tokens`
+on the live draft ([details](docs/eval/2026-09-15-judge-live.md)). Groq's free tier
+allows roughly one call a minute. Only the low-tier verdicts are sent — 1 of 10 on that
+draft — and up to 20 go in one call, so a long bibliography costs a handful of calls, not
+one per citation.
+
+**Providers.** Default is Groq `openai/gpt-oss-120b` (free without a card, no training
+on submitted data). `proofpath config set judge.provider gemini` switches to Gemini —
+note that Google trains on free-tier prompts outside the EEA/UK/CH, and proofpath prints
+that warning once per run. `judge.provider ollama` runs fully offline. Gemini and Ollama are
+fixture-tested and were not exercised live in v0.3.0. All three speak
+the OpenAI `chat/completions` shape. The key comes from `GROQ_API_KEY` / `GEMINI_API_KEY`
+in the environment or a `.env` file, never from config, and is never printed.
 
 ## Measured
 

{proofpath-0.2.0 → proofpath-0.3.0}/README.md

@@ -21,20 +21,47 @@ proofpath
 ```
 
 ```
-   ,_,
-  (o.o)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[PROOF]
-   " "    proofpath v0.2.0                                              academic . online . coreml
-          paste a file path, a URL, or a claim.            /help  /config  /quit
+    ╭╮ ╭╮
+   ╭╯╰─╯╰────────────────────────────────────────────────────────────────────╮
+  ╸┤ o o                                                                     ╰~~~~~~~~~~~~~[PROOF]
+   ╰─┬─┬────────────────────────────────────────────────────────────────┬─┬──╯
+     ˘ ˘                                                                ˘ ˘
+      proofpath v0.2.1                                                  academic . online . coreml
+      paste a file path, a URL, or a claim.                                  /help  /config  /quit
 ```
 
-Bare `proofpath` opens the terminal UI ([a recorded session](docs/eval/2026-09-15-v0.2-live.md)).
+Bare `proofpath` opens the terminal UI ([a recorded session in both themes](docs/eval/2026-09-15-tui-v2-live.md),
+with [SVG screenshots](docs/eval/tui-v2-rich.svg)). Each run is one panel in its own
+accent: the command on the top border and the run's state at its right, a fixed-column
+stage table underneath (`✓` finished, `⏺` still running or finished with something
+unverified, a real progress bar on the active stage, the provider that produced each
+number at the right), a rule, then the findings — location, reference, the state word
+as a badge, the tier — with the finding's notes and the claim (`you`) and the passage
+(`source`) it was checked against under it. The bottom border carries the run's
+coverage; the docked footer draws it as a bar and never scrolls away.
+
 Paste a path and it runs; every one-shot verb is a slash command (`/check`, `/resolve`,
 `/fetch`, `/config`, `/cache`), runs can be started while others are in flight and
-stopped with `/cancel #n` — a stopped run keeps what it had decided — and the
-coverage footer never scrolls away. Click (or press `enter` on) a finding to read the
-whole quoted passage; `⧉` copies it; a finding's reference is a link to its source.
-When a publisher blocks the plain fetch, the permission question is asked **inline,
-under the stage that hit the wall**, with `[allow once] [always] [no] [never]`.
+stopped with `/cancel #n` — a stopped run keeps what it had decided. Click (or press
+`enter` on) a finding to read the whole quoted passage; `⧉` copies it; a finding's
+reference is a link to its source. When a publisher blocks the plain fetch, the
+permission question is asked **inline, under the stage that hit the wall**, with
+`[allow once] [always] [no] [never]`.
+
+**Windows / `NO_COLOR`.** The look above is the `rich` theme, chosen when the terminal
+gives evidence of truecolor (`COLORTERM`, Windows Terminal, iTerm2, kitty, WezTerm,
+Ghostty, VS Code, Terminal.app). Under `NO_COLOR`, `--no-color`, `-q`, `TERM=dumb`,
+legacy conhost or a CJK locale the `plain` theme draws the same runs as flat ASCII rows
+in the terminal's own 16 colours — the state words, the coverage and every honesty
+sentence are identical, only the drawing changes. `PROOFPATH_THEME=rich|plain` forces
+either, for screenshots and bug reports.
+
+```
+   ,_,
+  (o.o)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[PROOF]
+   " "    proofpath v0.2.1                                              academic . online . coreml
+          paste a file path, a URL, or a claim.            /help  /config  /quit
+```
 
 The same engine behind a pipe or in CI:
 
@@ -156,7 +183,12 @@ runtime teardown); fixed in v0.1 — 20 of 20 piped runs exit `1`
   counted as unreachable.
 - **Coverage is not perfectly reproducible**: two runs minutes apart can read a
   different number of sources, depending on which providers answered.
-- The LLM judge and `--summarize` arrive in **v0.3**.
+- **The judge is a second opinion, not a second verdict.** `--judge` asks the model only
+  about the low-tier verdicts (1 of 10 on the live draft), and its answer is printed
+  beside the local verdict, never in place of it. `--summarize` is one extra call over
+  the finished report, labelled model-written; if the provider does not answer, the
+  markdown report, the JSON and the terminal say so (`judge status` / `summary status`
+  in the header). The SARIF log does not carry it — it is a findings document.
 
 ## Speed
 
@@ -190,13 +222,53 @@ TablePlus or DBeaver — plain tables, no extension. Raw publisher text expires
 7 days; verdicts keep the passage they quote; a provider outage is never stored.
 `proofpath resolve REF` and `proofpath fetch URL|DOI` run either half on its own.
 
-## Optional LLM judge — arrives in v0.3
+## Optional LLM judge (v0.3)
+
+Everything above runs locally, and the default run makes **zero** LLM calls. Two flags
+add an LLM at the end, and only there:
+
+```bash
+proofpath check paper.pdf --judge        # a second opinion on the low-confidence verdicts
+proofpath check paper.pdf --summarize    # one model-written paragraph over the finished report
+proofpath config check                   # proves the key works before you spend a run on it
+```
 
-Everything above runs locally. An LLM is used only at the end, as an opt-in second
-opinion on low-confidence verdicts — it never sees a source document and cannot
-change a verdict. The settings exist today (`proofpath config check` proves a key
-works, default Groq); `check --judge` and `--summarize` are wired in v0.3. The key
-comes from the environment or a `.env` file, never from config, and is never printed.
+**What `--judge` does.** After the local verdicts are final, the verdicts the models
+were least sure about — the `low` tier, never a numeric mismatch and never a claim
+without a quoted passage — go to the model in batches of up to 20 (about 7k tokens),
+each with its claim and the passage it was checked against. The model answers from the
+passage alone, and its label and one-sentence rationale are printed **beside** the local
+verdict: `= judge (groq openai/gpt-oss-120b): NEI — …`. The local verdict, the finding
+kind and the report's states never change. Opinions are cached with the verdict, so a
+re-run asks nothing.
+
+**What it cannot do.** It never sees a source document, so it cannot introduce a claim
+or an evidence passage of its own; it cannot turn `NEI` into `SUPPORTED`; it cannot
+hide a source that could not be read. If the provider is down, rate-limited or the key
+is wrong, the run finishes on the local verdicts and says so in the stage line, the
+report header (`judge status:`) and the JSON — `-q` cannot hide it.
+
+**What `--summarize` does.** One final call turns the finished markdown report into 3–5
+plain sentences a reader can act on. It runs after the report is complete, its only
+input is that report, it is off by default in the CLI and the TUI (`/summarize` there),
+and the output is labelled `(model-written, <provider> <model>)`. `--summarize` alone
+is exactly one call; with `--judge` the escalation runs first.
+
+**Cost.** The footer counts the calls and the stage line the tokens:
+`Judging … 1 of 10 verdicts reviewed, 1 call, 613 prompt · 193 completion tokens` and
+`Summarising … 98 words, 1 call, 1,608 prompt · 343 completion tokens`
+on the live draft ([details](docs/eval/2026-09-15-judge-live.md)). Groq's free tier
+allows roughly one call a minute. Only the low-tier verdicts are sent — 1 of 10 on that
+draft — and up to 20 go in one call, so a long bibliography costs a handful of calls, not
+one per citation.
+
+**Providers.** Default is Groq `openai/gpt-oss-120b` (free without a card, no training
+on submitted data). `proofpath config set judge.provider gemini` switches to Gemini —
+note that Google trains on free-tier prompts outside the EEA/UK/CH, and proofpath prints
+that warning once per run. `judge.provider ollama` runs fully offline. Gemini and Ollama are
+fixture-tested and were not exercised live in v0.3.0. All three speak
+the OpenAI `chat/completions` shape. The key comes from `GROQ_API_KEY` / `GEMINI_API_KEY`
+in the environment or a `.env` file, never from config, and is never printed.
 
 ## Measured
 

proofpath-0.3.0/docs/eval/2026-09-15-judge-live.md

@@ -0,0 +1,95 @@
+# Judge layer live runs — 2026-09-15 (v0.3.0)
+
+`proofpath check tests/data/draft-live.md --judge --summarize` on Groq
+(`openai/gpt-oss-120b`, key from `.env`), Apple Silicon, models already downloaded.
+Three runs: the first against the pre-fix build (it found the defect), then a cold run
+(`--no-cache`) and a warm run against the shipped build. Stage lines are copied from
+the terminal; the key never appears in any output.
+
+## Run 1 — pre-fix build: the summary came back empty
+
+```
+Judging      groq openai/gpt-oss-120b   1 of 10 verdicts reviewed, 1 call, 661 prompt · 211 completion tokens 0.9s
+Summarising  groq openai/gpt-oss-120b   summary unavailable after 0 calls (no completion in the 200 response from https://api.groq.com/openai/v1/chat/completions (finish_reason=length)); local verdicts stand 1.0s
+```
+
+`openai/gpt-oss-120b` is a reasoning model: with the planned `max_tokens=400` the
+completion budget was spent on reasoning and the visible content was empty, and the
+written `report.md` said nothing about the summary at all (the 9.3 reviewer had found
+the same gap from the code). Both are fixed in the shipped build: requests carry
+`reasoning_effort=low` (dropped on a 400 from providers that reject it), the review
+budget is 4096 tokens and the summary budget 1500, and an unanswered summary is
+reported on the stage line, the `summary` CLI line and a `- summary status:` header
+line in the file. The 1,888-test suite was green before this run; the live run found it.
+
+## Run 2 — cold (`--no-cache`), shipped build
+
+```
+Parsing      text                              1 pages, 7 refs        0.0s
+Claims       rules                             7 citations, 0 unresolved 0.0s
+Resolving    Crossref, Semantic Scholar        6 ok, 0 amb, 1 ghost   9.3s
+Retractions  Retraction Watch                  none                   2.5s
+Fetching     arXiv, Semantic Scholar           5 full text, 1 abstract, 0 unverified 23.8s
+Verifying    coreml                            10 claims: 1 supported, 2 not supported, 7 NEI 44.5s
+Judging      groq openai/gpt-oss-120b          1 of 10 verdicts reviewed, 1 call, 613 prompt · 193 completion tokens 1.1s
+Summarising  groq openai/gpt-oss-120b          98 words, 1 call, 1,608 prompt · 343 completion tokens 1.0s
+… written  ·  2 API calls  ·  82.1s
+judge      2,221 prompt · 536 completion tokens
+```
+
+The escalation set was one verdict — the `low`-tier `NOT SUPPORTED` on the SciPy
+sentence — and the judge's opinion was printed beside it, the local verdict untouched:
+
+```
+error[not-supported]: claim is not supported by the cited source  (confidence: low)
+   = judge (groq openai/gpt-oss-120b): NEI — Passage states "SciPy provides fundamental
+     algorithms for scientific computing" but does not mention SciPy building on anything.
+```
+
+The numeric mismatch (`high`, rule-decided) and the ghost reference were not sent, as
+specified. The summary, verbatim:
+
+> The report checked seven cited references, and it found two claims not supported and
+> one ghost reference; it does not give a total number of claims that were examined. The
+> most serious problem is the high‑confidence "NOT SUPPORTED" error on line 6, where the
+> claim about training time for the Transformer contradicts the source. The coverage
+> analysis shows that only 72 % of the material was verified against full text, 14 % was
+> limited to abstracts, and the remaining 14 % could not be read, so the counts above
+> apply only to the portion that was actually examined.
+
+It repeats the coverage caveat as instructed and invents no finding. Two things it
+gets slightly wrong, which is why it is labelled model-written and sits under the
+computed report: it calls the line-6 numeric mismatch a "NOT SUPPORTED" error (the
+report says `numeric-mismatch: claim contradicts the cited source`), and "it does not
+give a total number of claims" is true of the markdown file (the stage table is not
+printed there) but not of the run (`10 claims`).
+
+## Run 3 — warm, shipped build
+
+```
+Resolving    cache                             6 ok, 0 amb, 1 ghost   0.0s
+Fetching     cache                             5 full text, 1 abstract, 0 unverified 0.0s
+Verifying    coreml                            10 claims: 1 supported, 2 not supported, 7 NEI, 10 cached 0.8s
+Judging      groq openai/gpt-oss-120b          1 of 10 verdicts reviewed, 0 calls, 0 prompt · 0 completion tokens 0.0s
+Summarising  groq openai/gpt-oss-120b          106 words, 1 call, 1,615 prompt · 263 completion tokens 0.9s
+… written  ·  1 API calls  ·  1.8s
+judge      1,615 prompt · 263 completion tokens
+```
+
+The judgement came back from the schema-v4 `judgements` table (0 calls); the summary
+is always one fresh call. A plain `check` of the same file (no flags) reports
+`api_calls: 0` and `summary: null`.
+
+## What this does and does not show
+
+- The judge layer works end to end on Groq's free tier: batching, strict-JSON output,
+  cost accounting, caching, attribution, and the report unchanged by the model.
+- One document, one low-tier verdict, one provider. Nothing here measures the judge's
+  accuracy; the escalation band is narrow by design (OPEN-ITEMS 14.1), so a paper with
+  118 citations would send a handful of verdicts, not dozens.
+- Gemini and Ollama were not exercised live; they share the adapter and are covered by
+  the `respx` tests only.
+- These runs were made with the batch cap at 7,000 prompt tokens. The whole-phase review
+  lowered it to 3,500 so that a full batch plus its 4,096-token answer budget stays under
+  Groq's 8K-per-minute tier; with one escalated item the runs above never approached
+  either figure, so nothing here measures the cap.