Integrity Forensics — thin launcher (Codex-native: deterministic slice)
Audit target: $ARGUMENTS
Same launcher doctrine as the mainline skill: SHA-pin, upstream eval-gate
validation per pin, delegate unchanged, no vendoring, no forking, no
reviewer knobs. The one Codex-native difference: upstream's nine auditor
skills are Claude-Code contracts, so this pack runs upstream's
deterministic-only mode — the numeric forensic core (GRIM / GRIMMER /
statcheck / delta arithmetic) plus the rules-only reporter with an
all-review_unavailable coverage map. That mode is honestly scoped by
upstream: it can raise HARD/SOFT flags; it can NEVER return
CLEAN_GIVEN_EVIDENCE. Translating upstream's reviewer calls into
spawn_agent would REWRITE an upstream contract — forbidden.
Constants
- ANTI_AR_REPO =
https://github.com/wanshuiyin/Anti-Autoresearch.git
- ANTI_AR_COMMIT =
b47af6f983b38347b6d2110379e266400597cf66 — never
tracks HEAD; bumping is a reviewed change (mainline Pin-bump checklist).
- CLONE_DIR =
~/.aris/anti-autoresearch — host-neutral. An older clone at
~/.claude/anti-autoresearch is unused; move it and its .aris_eval_ok_*
receipt to keep an offline deterministic-only run working — this pack's own
mode — otherwise delete it whenever convenient.
- NO REVIEWER KNOBS — and no
— effort: mapping onto upstream settings.
Step 0 — Bootstrap the pin (identical to mainline)
CLONE_DIR="$HOME/.aris/anti-autoresearch"
ANTI_AR_COMMIT="b47af6f983b38347b6d2110379e266400597cf66"
mkdir -p "$HOME/.aris"
if [ ! -d "$CLONE_DIR/.git" ]; then
git clone --no-checkout https://github.com/wanshuiyin/Anti-Autoresearch.git "$CLONE_DIR"
fi
git -C "$CLONE_DIR" cat-file -e "$ANTI_AR_COMMIT^{commit}" 2>/dev/null \
|| git -C "$CLONE_DIR" fetch -q origin
git -C "$CLONE_DIR" checkout -qf "$ANTI_AR_COMMIT" || { echo "FATAL: cannot checkout pin"; exit 1; }
# pristine tree at the pin — local tampering (incl. nested-repo injections;
# hence double -f) must not run under the pin's name; verify, don't assume
git -C "$CLONE_DIR" reset --hard -q "$ANTI_AR_COMMIT" || { echo "FATAL: reset failed"; exit 1; }
git -C "$CLONE_DIR" clean -ffdxq || { echo "FATAL: clean failed"; exit 1; }
[ -z "$(git -C "$CLONE_DIR" status --porcelain)" ] || { echo "FATAL: tree not pristine"; exit 1; }
# marker OUTSIDE the clone (a marker inside a tamperable tree proves nothing)
MARKER="${CLONE_DIR}.aris_eval_ok_${ANTI_AR_COMMIT}"
if [ ! -f "$MARKER" ]; then
( cd "$CLONE_DIR" && python3 eval/run_eval.py ) || {
echo "FATAL: upstream eval gate FAILED at pin — refusing an unvalidated pin"; exit 1; }
touch "$MARKER"
fi
Step 1 — Delegate: upstream deterministic-only mode, unchanged
Open $CLONE_DIR/workflows/anti-autoresearch/SKILL.md and follow its
deterministic-only path (its own documented degraded mode): Step 0 ingest →
Step 1 evidence ledger → deterministic auditors → adjudication with the
generated all-review_unavailable coverage map. Wrapper rules: run every
upstream bash block with cd "$CLONE_DIR" (upstream self-locates via
git rev-parse --show-toplevel); refer to the paper by ABSOLUTE path; never
rewrite upstream outputs.
Expected outcome: report.json whose verdict is HARD_FLAGS / SOFT_FLAGS /
REVIEW_UNAVAILABLE — by construction never CLEAN_GIVEN_EVIDENCE.
Step 2 — Typed gate + obligations
Resolve forensics_gate.py via the canonical helper chain
(shared-references/integration-contract.md §2, Policy A), then:
python3 "$GATE_HELPER" evaluate --report "$PAPER_DIR/report.json" --paper-dir "$PAPER_DIR" \
--anti-ar-commit "$ANTI_AR_COMMIT" --executor-model "codex-gpt-6-astra"
Policy: HARD_FLAGS → BLOCK · REVIEW_UNAVAILABLE → BLOCK (which a
deterministic-only run reports whenever it found no flags — the semantic
dimensions never ran, so nothing may wave the paper through) · SOFT_FLAGS →
WARN. The gate records same-family proposal provenance for a Codex
executor — informational: this gate only raises flags, it grants nothing.
The downstream preflight is ONE command:
python3 "$GATE_HELPER" fresh --paper-dir "$PAPER_DIR" --anti-ar-commit "$ANTI_AR_COMMIT"
— exit 0 ⟺ produced at the current pin ∧ gate
exists ∧ paper unchanged since ∧ gate matches the current ledger ∧ decision
pass-capable (WARN/NO_NEW_BLOCKER), where the decision is RE-computed from
the sha-verified archived report + live ledger (the stored token is display,
not authority). Any ledger mutation deletes the standing gate.json, and
evaluate refuses a report older than any paper file — neither a stale pass
nor a stale report can be replayed.
Step 3 — Fix what it found
Identical obligations discipline to the mainline skill: append-only ledger,
UNRESOLVED_DISAPPEARANCE on vanished-but-unresolved findings, typed + hashed
resolve receipts (corrected-from-results | claim-narrowed | claim-withdrawn | citation-replaced; --verified-by must be typed provenance —
human:<name> / checker:<tool> / cross-family-review:<thread-id> — and
the evidence file is RE-hashed on every later gate), human-only waive
(never a resolution), and The One Forbidden Loop: never "edit → re-sweep
→ repeat until it stops flagging".
Numeric obligations route to the result files; the rest to the matching audit
skill or the human.