/meta-apply

name: meta-apply
description: "Privileged applier that LANDS meta-optimize / corpus-audit patches the user approved — the ONLY skill permitted to mutate the skill corpus from a self-modification proposal, with cross-model jury and human approval at landing. Use when the user says \"meta apply\", \"/meta-apply\", \"land the staged patches\", \"应用优化\", after a /meta-optimize run."
argument-hint: "[patch-number-or-all]"
allowed-tools: Bash(*), Read, Write, Edit, Grep, Glob, mcp__codex__codex, mcp__codex__codex-reply, mcp__antigravity__antigravity, mcp__antigravity__antigravity-reply, mcp__grok__grok, mcp__grok__grok-reply, mcp__claude-review__review, mcp__claude-review__review_reply, mcp__claude-review__review_start, mcp__claude-review__review_reply_start, mcp__claude-review__review_status

Meta-Apply: the privileged landing gate for self-modification patches

> **Before each reviewer slot**, follow [Selectable Reviewers](../shared-references/reviewer-backends.md): > resolve invocation → `.aris/reviewer.json` → Claude Code default (Codex MCP) > with `reviewer_route.py` through the canonical helper resolver, preserving this > slot's tier, fresh contexts, source/image inputs and deterministic gates. > Codex examples/pins below apply only to `backend=codex`; other routes use their > own first-call/reply contract. Save the route and actual returned identity; > unavailable selections are `REVIEW_UNAVAILABLE`. Classify acceptance from actual > families/completion/scope. Forward invocation reviewer/model/effort overrides > to reviewer-bearing children. Generation workers are unchanged.

This skill exists to enforce a **privilege boundary**. Producers like [`/meta-optimize`](../meta-optimize/SKILL.md) (and, later, `corpus-audit`) are **read-only** — no `Write`/`Edit`, no apply step; they can only *stage* candidate patches under `.aris/meta/pending/`. **This skill is the only place a staged patch becomes a real change to the corpus.** Splitting "propose" from "land" across two skills with different tool grants is what makes "a loop cannot apply its own patch" structural rather than a sentence the producer is asked to obey.

It is **human-invoked only.** It runs when the user explicitly types `/meta-apply` after reading the producer's REPORT. That invocation IS the landing authorization (the locked 2026-05-30 decision: the human stays at the landing gate).

The acquittal is generated HERE, not relayed

The earlier design trusted a `jury_verdict: pass` field in the producer's manifest. That is **forgeable** — the producer writes that field, so a buggy/misaligned producer could stage a killed patch labelled "pass." **So this skill does not trust any producer-written verdict.** It runs the cross-model jury **itself, at landing time, on the actual staged diff** (fresh thread, paths-only). The verdict is produced where it is consumed, by the privileged human-invoked skill — nothing to forge.

The non-negotiable rules (jury-at-landing, reject-default)

For each staged patch the user asks to land, in order — any failure ⇒ skip & report, never silently apply:

1. **The human named THIS patch.** Apply only patches the user listed (`/meta-apply 1,3` or `all`); default to applying nothing. 2. **Fresh cross-model jury PASS, obtained now.** Run `mcp__codex__codex` (fresh thread, NOT codex-reply; `model: gpt-6-astra`, `config: {"model_reasoning_effort": "ultra"}`, `sandbox: read-only`, paths-only per [`reviewer-independence.md`](../shared-references/reviewer-independence.md)) on the staged `.diff` + its target. Ask: *does this change improve the harness without regressions; PASS or KILL + one-line reason.* Include the scope-limits block from [`review-scope-limits.md`](../shared-references/review-scope-limits.md) in that prompt: this jury judges ARIS's own mechanism, so an over-defensive KILL permanently blocks a good patch. Note the block bans *proposing new* hash binding — it is not a reason to KILL a patch that touches the existing provenance stamp. **KILL ⇒ refuse.** The human cannot override a KILL — they may only pick among jury-PASSED survivors. (A loop can DRIVE; only the cross-model jury can ACQUIT.) 3. **Author ≠ reviewer family.** The author is the producer's executor model; the reviewer is the actual returned model that just judged it. Run `provenance.py assert_cross_family` — if it raises (same family / unknown), refuse. Use actual author/reviewer identities, never infer the family from the host or transport. This strict landing gate remains mandatory.

Workflow

Step 0: Load staging + resolve the helper

PENDING=".aris/meta/pending"
[ -d "$PENDING" ] || { echo "Nothing staged. Run /meta-optimize first."; exit 0; }
echo "Staged:"; cat "$PENDING/manifest.jsonl"

Resolve `provenance.py` via the 4-layer chain in [`integration-contract.md`](../shared-references/integration-contract.md) §2 (`.aris/tools/` → `tools/` → `$ARIS_REPO/tools/` → `$ARIS_REPO/tools/` via `~/.aris/repo`).

Step 1: Jury-at-landing for each requested patch

For every patch the user asked to land, read its staged `.diff` and target, then run the fresh codex jury (Rule 2) — paths-only, no producer reasoning, no prior-round context. Record `{patch, jury_verdict, jury_thread_id, one_line_reason}`. Print a one-line result per patch (`PASS → eligible` / `KILL → refused: <reason>`).

> The producer may have written an *advisory* pre-screen into the manifest to help the > human read the REPORT — **ignore it for the landing decision.** Only this fresh verdict > counts.

Step 2: Land the survivors (Write/Edit only — never Bash)

For each patch that PASSED Step 1 **and** was named by the user:

1. **Back up** the target to `.aris/meta/backups/<date>/<target>` (use the **Write** tool to copy contents; corpus paths are not Bash-writable when `corpus_write_guard` is active — and the applier should use Write/Edit for corpus mutation anyway). 2. **Apply** the