/integrity-forensics

name: integrity-forensics
description: "Run the Anti-Autoresearch integrity-forensics sweep (span-anchored evidence ledger → GPT auditors propose findings → deterministic rules-only adjudicator) against a paper via a SHA-pinned thin launcher — then convert the verdict into a typed policy gate (BLOCK/WARN/NO_NEW_BLOCKER) and an append-only obligations ledger. Use when user says \"integrity forensics\", \"forensic audit this paper\", \"投稿前自查诚信\", \"审这篇论文的诚信\", or says \"anti-autoresearch\" when the upstream repo's own skills are not installed. Also invoked by /paper-writing (submission self-forensics, default ON), /peer-review (forensic appendix), /resubmit-pipeline."
argument-hint: "[paper-dir | pdf | arxiv-id]"
allowed-tools: Bash(*), Read, Write, Grep, Glob, mcp__codex__codex

Integrity Forensics — thin launcher for Anti-Autoresearch

Audit target: **$ARGUMENTS**

> **What this is.** ARIS generates papers; [Anti-Autoresearch](https://github.com/wanshuiyin/Anti-Autoresearch) > is its outward-pointed dual — reviewer-side integrity forensics (46 patterns > across 8 families, deterministic GRIM/GRIMMER/statcheck core, span-anchored > claims, a rules-only adjudicator that owns the verdict). This skill is a > **thin launcher**: it pins an upstream commit, validates the pin with the > upstream eval gate, delegates execution unchanged, and post-processes the > verdict into ARIS's policy vocabulary. It vendors nothing and forks nothing.

> 🔁 **Cadence fence** (`shared-references/external-cadence.md`): this skill is > verdict-bearing decision support. Do not wrap it in `/loop` / `/schedule` — > and NEVER as "iterate edits until it stops flagging" (see The One Forbidden > Loop below).

Constants

• **ANTI_AR_REPO = `https://github.com/wanshuiyin/Anti-Autoresearch.git`**
• **ANTI_AR_COMMIT = `d8f510c49c29ccb5f98ecb1f8e397a7a27eb97c4`** — the SHA-pin.

The launcher NEVER tracks upstream HEAD; bumping this constant is a reviewed change (see Pin-bump checklist).

• **CLONE_DIR = `~/.claude/anti-autoresearch`** — the pinned working copy.
• **NO REVIEWER KNOBS.** This launcher exposes no reviewer model/effort

parameters and never maps ARIS `— effort:` onto upstream settings. The pinned upstream runs exactly what it pins (`gpt-5.6-sol` + `xhigh`, its own design decision). Overriding upstream review policy from a launcher would create a second, unauditable configuration surface.

• **GATE_HELPER = `forensics_gate.py`** — resolved via the canonical chain

(`shared-references/integration-contract.md` §2): `.aris/tools/` → `tools/` → `$ARIS_REPO/tools/` → `$ARIS_REPO/tools/` via `~/.aris/repo`. Failure policy A (required): if it cannot be resolved at `assurance: submission`, STOP — never improvise the gate.

Step 0 — Bootstrap the pin (idempotent)

CLONE_DIR="$HOME/.claude/anti-autoresearch"
ANTI_AR_COMMIT="d8f510c49c29ccb5f98ecb1f8e397a7a27eb97c4"

if [ ! -d "$CLONE_DIR/.git" ]; then
    git clone --no-checkout https://github.com/wanshuiyin/Anti-Autoresearch.git "$CLONE_DIR"
fi
# fetch ONLY if the pin isn't already present — a cached, validated pin works offline
git -C "$CLONE_DIR" cat-file -e "$ANTI_AR_COMMIT^{commit}" 2>/dev/null \
    || git -C "$CLONE_DIR" fetch -q origin
git -C "$CLONE_DIR" checkout -qf "$ANTI_AR_COMMIT" || {
    echo "FATAL: cannot checkout pinned commit $ANTI_AR_COMMIT"; exit 1; }
# Force a PRISTINE tree at the pin — local tampering with the clone (edited
# adjudicator, injected module, even one hidden inside a NESTED git repo,
# which single-f clean skips) must not survive bootstrap and run under the
# official pin's name. Every step is checked; then the tree is verified.
git -C "$CLONE_DIR" reset --hard -q "$ANTI_AR_COMMIT" || {
    echo "FATAL: reset to pin failed"; exit 1; }
git -C "$CLONE_DIR" clean -ffdxq || {
    echo "FATAL: clean failed"; exit 1; }
[ -z "$(git -C "$CLONE_DIR" status --porcelain)" ] || {
    echo "FATAL: clone is not pristine after reset+clean — refusing to run"; exit 1; }

# One-time-per-pin validation: the upstream eval gate (8 injected-defect
# classes, 100% recall + zero clean false positives) must PASS before this
# pin is allowed to produce a verdict. NEVER skip; NEVER proceed on failure.
# The marker lives OUTSIDE the clone: a marker inside a tamperable tree proves
# nothing (and `git clean` above would erase it, forcing re-eval every run).
MARKER="${CLONE_DIR}.aris_eval_ok_${ANTI_AR_COMMIT}"
if [ ! -f "$MARKER" ]; then
    ( cd "$CLONE_DIR" && python3 eval/run_eval.py ) || {
        echo "FATAL: upstream eval gate FAILED at pin $ANTI_AR_COMMIT — refusing to"
        echo "       use an unvalidated forensics pin for verdicts."; exit 1; }
    touch "$MARKER"
fi
echo "anti-autoresearch pinned at $ANTI_AR_COMMIT (eval gate: validated)"

Step 1 — Delegate: run the upstream sweep, unchanged

Open and follow **`$CLONE_DIR/workflows/anti-autoresearch/SKILL.md`** end to end on the target. Two wrapper rules — the ONLY things this launcher adds:

1. **cwd.** Upstream skills self-locate via `git rev-parse --show-toplevel`. Run every upstream bash block with `cd "$CLONE_DIR"` first — ALWAYS the cd, never just an exported `ROOT` (upstream blocks re-derive ROOT themselves and would overwrite it) — and refer to the paper by **absolute path**, otherwise upstream resolves ROOT to the ARIS repo and finds the wrong Python spine. 2. **Codex calls carry `approval-policy: never` + `sandbox: read-only`** (session hygiene; upstream already specifies fresh-thread-per-dimension, serial execution, and its own model pins — do not alter them).

Everything else — the evidence ledger, coverage.json state machine, the nine auditor dimensions, the refutation pass, the deterministic adjudication — is upstream's contract. **Never rewrite, soften, or re-map its outputs** (`report.json` + `REPORT.md`, verdict ∈ CLEAN_GIVEN_EVIDENCE / SOFT_FLAGS / HARD_FLAGS / REVIEW_UNAVAILABLE). The observability level (L0/L1/L2) is wha