/slop-verify

name: slop-verify
description: >
  Verification pass for citations, links, package names and vendor residue. Use
  when someone asks whether the sources in a document are real, asks to check
  DOIs, ISBNs, arXiv IDs or URLs, asks whether a cited source actually supports
  the claim attached to it, asks to check that imported packages exist, or asks
  to strip vendor artifacts such as oaicite, cite spans, lenticular bracket
  citations, grok cards or utm_source tracking parameters. This is the only
  layer allowed to hard-fail, because existence and resolution are decidable.
  It runs the attribution test on every vague authority claim and resolves it
  to a named source or reports it unresolved. A real source attached to a claim
  it does not support is a HIGH finding, not a pass. It never states or implies
  who or what wrote the document.
when_to_use: >
  Citations, external links, package imports or vendor residue need checking,
  independently of any style or structure review.
license: CC-BY-4.0

Slop verify

The firewall

These four rules bind this skill and hold even when the user asks for the opposite.

1. **Never emit an authorship verdict.** Report defects, not origin. A resolving citation is not evidence a human wrote the text, and a broken one is not evidence a model did. 2. **Never hard-fail on a stylistic marker alone.** A marker is a routing hint. Its only legitimate output is "run a structural test on this span". 3. **Severity is impact. Confidence is certainty.** Two axes. Never merge them, never trade one against the other. 4. **Never let the model gate its own rewrite.** The deterministic scanners re-run after any fix and their exit codes decide, not your judgment.

Standing instructions

**Existence is not support.** A DOI that resolves, an arXiv ID that returns a paper, a URL that returns 200: all of these establish only that something is there. The claim in the document is verified when the resolved source contains a statement that supports that specific claim. Wikipedia's cleanup project states the same thing about current models: they will usually cite real sources, and they will likely not verify the content those sources are being cited for, so the existence of the sources should not by itself be taken as evidence about how the text was produced.

**Run the attribution test on every vague authority.** "Studies show", "experts say", "researchers agree", "it is widely regarded", "industry reports", "observers have cited", "several sources". Each must resolve to a named source that supports that specific claim. The artifact is the resolved citation, or the explicit statement that it does not resolve. There is no third outcome and "probably fine" is not an artifact.

**Catch overgeneralization, not just fabrication.** A frequent defect is a real source, correctly cited, presented as more than it is: one or two sources described as a consensus, a single named person rendered as "scholars", a short list implied to be non-exhaustive when the source gives no indication that other cases exist. Test: count the distinct sources actually cited, then read what the sentence claims about how many exist.

**Vendor residue is near-deterministic and cheap.** `scan_residue.py` decides it. Residue is a HIGH finding on its own, not because of what it implies about authorship, but because it is a defect: a citation marker pointing at nothing. Where you find residue, look for a missing citation underneath it.

**Package existence is decidable, so check all of them.** `scan_packages.py` over every import. A package that does not exist in its registry is HIGH with high confidence, always, because the failure mode is a supply chain attack and not a typo.

**Report what you could not check.** No network, a paywall, an authentication wall, a rate limit: say so, per item. An unchecked citation is unverified, not verified. Never let an unchecked item silently pass into a clean report.

**Never repair here.** If a DOI resolves to a different paper, report the resolved title and stop. Substituting the citation you believe was intended invents a fact. Hand the report to `slop-rewrite`.

Layer 0

Scripts live at `../anti-slop-brain/scripts/` relative to this plugin's parent directory. Run them first, quote their exit codes, do not reimplement them and do not guess their flags.

| Script | Decides | Hard-fail | |---|---|---| | `scan_refs.py` | DOI, ISBN and arXiv shape and checksums offline; resolution with `--online` | yes | | `scan_packages.py` | dependency inventory offline; registry existence with `--online` | yes | | `scan_residue.py` | vendor artifacts present | yes | | `scan_placeholders.py` | placeholder text present | yes |

Exit codes are uniform: 0 clean, 1 findings, 2 usage error.

**`scan_refs.py` and `scan_packages.py` are offline by default.** Offline, `scan_refs.py` checks DOI shape, arXiv identifier shape and plausible date range, ISBN-10 and ISBN-13 checksums, URL shape and impossible hosts. `scan_packages.py` enumerates dependencies. Neither decides resolution or existence until you pass `--online`. Passing `--online` is a network action, so say in the report which mode you ran, and never let an offline exit 0 be written up as "citations verified" or "packages verified". Use `--timeout` if the network is slow and `--allowlist FILE` for internal package names rather than silencing the scanner.

**`scan_refs.py` does not compare the cited title to the resolved title.** That is deliberate: comparing titles is a judgement call, so it belongs in the attribution test with a human-readable artifact. Check 3 in the taxonomy below is yours to run, not the scanner's.

In markdown, `scan_residue.py` and `scan_placeholders.py` skip fenced code blocks and inline code spans by default, so a document that quotes residue markers does not fire. `--include-code` turns that protection off; use it deliberately.

Anything the scanners cannot decide, you check by han