/adversarial-case-builder

name: adversarial-case-builder
description: "Synthesize the single strongest EVIDENCE-BOUND reviewer case to reject a paper, built ONLY from the evidence ledger (claims.json) + the other auditors' confirmed findings — never free-floating LLM critique. Two fresh cross-model codex threads: an attack writes the ~200-word rejection paragraph (every accusation tagged to an existing claim_id/finding_id), a defense decomposes it and rules each point against the anchored evidence. MEMO-ONLY: emits adversarial-case-builder.memo.md (fed to the adjudicator via --memo) and carries NO verdict weight — tools/adjudicate_findings.py lists it in ZERO_WEIGHT_SKILLS and caps it at info. Honest-null allowed (the paper may survive). Run LAST. Detect-only. Adapted from ARIS kill-argument. Triggers: \"adversarial case\", \"strongest objection\", \"rejection memo\", \"kill argument\", \"最强拒稿点\"."
argument-hint: [paper-dir | claims.json]
allowed-tools: Bash(*), Read, Write, mcp__codex__codex

Adversarial Case Builder — the strongest *evidence-bound* objection

Build the single strongest evidence-bound case to reject **$ARGUMENTS**, then defend it point-by-point. Emit `adversarial-case-builder.memo.md`. Run **LAST**, AFTER `/evidence-ledger` (so `claims.json` exists) and AFTER the auditor skills (so the merged `*.findings.json` exist).

> 🔒 **Do not wrap this skill in `/loop`, `/schedule`, or `CronCreate`.** It runs > LAST and synthesizes the ledger + the other auditors' findings into one memo. Even > though it is **memo-only** (the adjudicator caps it at `info`, so it adds no verdict > weight), the no-new-signal cadence rule still applies: its output changes only when > the **ledger / the findings / the paper** change, never with the wall clock. > Schedule the *work that precedes it* — ledger + auditors done → run this **once**. > (Mirrors ARIS's external-cadence doctrine.)

> Adapted from ARIS `kill-argument`, with **one deliberate downgrade: memo-only.** In > a forensics pipeline the headline-attack is most useful as a *synthesis of > already-anchored evidence*, not a free-floating LLM critique — that free-floating > mode is exactly the "LLM slop grading LLM slop" failure this repo exists to refuse. > So here every attack point must cite an existing ledger `claim_id` or `finding_id`, > and the skill never emits verdict-bearing findings: `tools/adjudicate_findings.py` > lists `adversarial-case-builder` in `ZERO_WEIGHT_SKILLS` and caps anything from it at > `info`. The deterministic adjudicator owns the verdict; this skill owns the memo.

Why this exists

The standard auditors (`consistency-audit`, `citation-forensics`, …) fan out and each flags discrepancies in *its own dimension*. They produce a **balanced** list — each discrepancy at its own severity, none committing to "this is the one that sinks the paper." That misses a specific failure mode: the **single most damaging paragraph** a senior area chair would write in a rejection. A balanced reviewer lists "scope-overclaim" as one `major` among several and never commits; an adversarial reviewer **must** commit — their whole job is to convince the AC to reject in ~200 words.

This skill runs that adversarial pass deliberately, then forces a second fresh reviewer to decompose the attack and rule each point against the evidence. The forensics twist over ARIS `kill-argument`: the attack is **fenced to anchored evidence**. A reviewer who can cite anything tends to manufacture a confident kill out of nothing — the exact dynamic that makes "AI reviews AI" feel like noise. By forcing every accusation to cite an existing ledger `claim_id` or `finding_id`, the memo can only be as strong as the evidence the deterministic layers already graded. If that evidence is weak, the correct output is an **honest null**: the paper survives. Manufacturing a kill from thin evidence is a failure, not a success.

Core principle

**MEMO-ONLY · evidence-bound · two fresh cross-model threads · reviewer ≠ adjudicator · honest-null.** The reviewer **proposes** an attack and a defense; the executor **validates** that every kept point is anchored to a real ledger claim (verbatim span) or a real sibling finding; the deterministic `tools/adjudicate_findings.py` **owns the verdict** and caps this skill at `info` (`references/integrity-forensics-contract.md` rules 1–2, 7–8; `references/reviewer-independence.md` Layer 2). This skill computes **no verdict** — by design.

> **Deliberate exception to "no prior-dimension findings."** Reviewer-independence > normally forbids leaking the executor's hunches and forbids one fresh per-dimension > audit seeing another's conclusions. This skill is the explicit **synthesis stage**: > the anchored, machine-validated findings *are* its input. It still receives only > structured artifacts — `claims.json` + the `*.findings.json` files — never a > Claude-authored digest or opinion about the paper, so the spirit of the rule (no > executor judgment leaks into the reviewer) holds.

How this differs from the other auditors (route correctly)

| Auditor | Question it answers | Level | Verdict weight | |---------|---------------------|------|----------------| | `consistency-audit` | Does the paper contradict ITSELF / described method = evaluated method? | L0 | yes (via adjudicator) | | `experiment-forensics` | Are reported numbers what the code computes? (fake GT, self-norm, phantom) | L2 | yes | | `baseline-comparison-audit` | Right baselines present, tuned, "SOTA" earned? | L0 stated / L2 verified | yes | | `citation-forensics` | Do cited papers exist and support the claim made? | L0 | yes | | `presentation-signals` | Surface "AI-flavor" hints (auxiliary) | L0 | surface-class label | | **`adversarial-case-builder`** (this) | **Strongest *anchored* rejection memo + defense** | **any (inherits anchors' level)** | **none (memo-only, zero verdict weight)** |

**This skill detects nothing new.** It does not re-read the paper to invent objections, does n