git:20260821.120c956 to git:20260906.0472e53

---

name: integrity-forensics

description: "Run the Anti-Autoresearch integrity-forensics DETERMINISTIC slice (numeric core + rules-only reporter) against a paper via a SHA-pinned thin launcher, then convert the verdict into a typed policy gate (BLOCK/WARN/NO_NEW_BLOCKER) and an append-only obligations ledger. Codex-native limitation: upstream ships no Codex-native auditor pack, so the full nine-dimension semantic sweep requires a Claude Code session — this pack runs the honestly-scoped deterministic-only mode (it can flag, it can never say CLEAN). Use when user says \"integrity forensics\", \"forensic audit this paper\", \"投稿前自查诚信\"."

argument-hint: "[paper-dir | pdf | arxiv-id]"

---

# Integrity Forensics — thin launcher (Codex-native: deterministic slice)

Audit target: **$ARGUMENTS**

> Same launcher doctrine as the mainline skill: SHA-pin, upstream eval-gate

> validation per pin, delegate unchanged, no vendoring, no forking, **no

> reviewer knobs**. The one Codex-native difference: upstream's nine auditor

> skills are Claude-Code contracts, so this pack runs upstream's

> **deterministic-only mode** — the numeric forensic core (GRIM / GRIMMER /

> statcheck / delta arithmetic) plus the rules-only reporter with an

> all-`review_unavailable` coverage map. That mode is honestly scoped by

> upstream: it can raise HARD/SOFT flags; it can NEVER return

> `CLEAN_GIVEN_EVIDENCE`. Translating upstream's reviewer calls into

> `spawn_agent` would REWRITE an upstream contract — forbidden.

## Constants

- **ANTI_AR_REPO = `https://github.com/wanshuiyin/Anti-Autoresearch.git`**

- **ANTI_AR_COMMIT = `b47af6f983b38347b6d2110379e266400597cf66`** — never

tracks HEAD; bumping is a reviewed change (mainline Pin-bump checklist).

- **CLONE_DIR = `~/.aris/anti-autoresearch`** — host-neutral. An older clone at

`~/.claude/anti-autoresearch` is unused; move it and its `.aris_eval_ok_*`

receipt to keep an offline deterministic-only run working — this pack's own

mode — otherwise delete it whenever convenient.

- **NO REVIEWER KNOBS** — and no `— effort:` mapping onto upstream settings.

## Step 0 — Bootstrap the pin (identical to mainline)

```bash

CLONE_DIR="$HOME/.aris/anti-autoresearch"

ANTI_AR_COMMIT="b47af6f983b38347b6d2110379e266400597cf66"

mkdir -p "$HOME/.aris"

if [ ! -d "$CLONE_DIR/.git" ]; then

git clone --no-checkout https://github.com/wanshuiyin/Anti-Autoresearch.git "$CLONE_DIR"

fi

git -C "$CLONE_DIR" cat-file -e "$ANTI_AR_COMMIT^{commit}" 2>/dev/null \

|| git -C "$CLONE_DIR" fetch -q origin

git -C "$CLONE_DIR" checkout -qf "$ANTI_AR_COMMIT" || { echo "FATAL: cannot checkout pin"; exit 1; }

# pristine tree at the pin — local tampering (incl. nested-repo injections;

# hence double -f) must not run under the pin's name; verify, don't assume

git -C "$CLONE_DIR" reset --hard -q "$ANTI_AR_COMMIT" || { echo "FATAL: reset failed"; exit 1; }

git -C "$CLONE_DIR" clean -ffdxq || { echo "FATAL: clean failed"; exit 1; }

[ -z "$(git -C "$CLONE_DIR" status --porcelain)" ] || { echo "FATAL: tree not pristine"; exit 1; }

# marker OUTSIDE the clone (a marker inside a tamperable tree proves nothing)

MARKER="${CLONE_DIR}.aris_eval_ok_${ANTI_AR_COMMIT}"

if [ ! -f "$MARKER" ]; then

( cd "$CLONE_DIR" && python3 eval/run_eval.py ) || {

echo "FATAL: upstream eval gate FAILED at pin — refusing an unvalidated pin"; exit 1; }

touch "$MARKER"

fi

```

## Step 1 — Delegate: upstream deterministic-only mode, unchanged

Open **`$CLONE_DIR/workflows/anti-autoresearch/SKILL.md`** and follow its

**deterministic-only** path (its own documented degraded mode): Step 0 ingest →

Step 1 evidence ledger → deterministic auditors → adjudication with the

generated all-`review_unavailable` coverage map. Wrapper rules: run every

upstream bash block with `cd "$CLONE_DIR"` (upstream self-locates via

`git rev-parse --show-toplevel`); refer to the paper by ABSOLUTE path; never

rewrite upstream outputs.

Expected outcome: `report.json` whose verdict is `HARD_FLAGS` / `SOFT_FLAGS` /

`REVIEW_UNAVAILABLE` — by construction never `CLEAN_GIVEN_EVIDENCE`.

## Step 2 — Typed gate + obligations

Resolve `forensics_gate.py` via the canonical helper chain

(`shared-references/integration-contract.md` §2, Policy A), then:

```bash

python3 "$GATE_HELPER" evaluate --report "$PAPER_DIR/report.json" --paper-dir "$PAPER_DIR" \

```

Policy: `HARD_FLAGS` → **BLOCK** · `REVIEW_UNAVAILABLE` → **BLOCK** (which a

deterministic-only run reports whenever it found no flags — the semantic

dimensions never ran, so nothing may wave the paper through) · `SOFT_FLAGS` →

**WARN**. The gate records `same-family` proposal provenance for a Codex

executor — informational: this gate only raises flags, it grants nothing.

The downstream preflight is ONE command:

`python3 "$GATE_HELPER" fresh --paper-dir "$PAPER_DIR" --anti-ar-commit "$ANTI_AR_COMMIT"`

— exit 0 ⟺ produced at the current pin ∧ gate

exists ∧ paper unchanged since ∧ gate matches the current ledger ∧ decision

pass-capable (WARN/NO_NEW_BLOCKER), where the decision is RE-computed from

the sha-verified archived report + live ledger (the stored token is display,

not authority). Any ledger mutation deletes the standing gate.json, and

`evaluate` refuses a report older than any paper file — neither a stale pass

nor a stale report can be replayed.

## Step 3 — Fix what it found

Identical obligations discipline to the mainline skill: append-only ledger,

`UNRESOLVED_DISAPPEARANCE` on vanished-but-unresolved findings, typed + hashed

`resolve` receipts (`corrected-from-results | claim-narrowed | claim-withdrawn |

citation-replaced`; `--verified-by` must be typed provenance —

`human:<name>` / `checker:<tool>` / `cross-family-review:<thread-id>` — and

the evidence file is RE-hashed on every later gate), human-only `waive`

(never a resolution), and **The One Forbidden Loop**: never "edit → re-sweep

→ repeat until it stops flagging".

Numeric obligations route to the result files; the rest to the matching audit

skill or the human.