Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add roomi-fields/paper-trail --skill registry-doctorgit clone --depth 1 https://github.com/roomi-fields/paper-trailWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/roomi-fields/paper-trail/registry-doctor)<a href="https://agentmods.dev/skills/roomi-fields/paper-trail/registry-doctor"><img src="https://agentmods.dev/badge/skills/roomi-fields/paper-trail/registry-doctor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/roomi-fields/paper-trail/registry-doctor"><img src="https://agentmods.dev/badge/skills/roomi-fields/paper-trail/registry-doctor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00191 | $0.01738 |
| Opus 5 | $0.00096 | $0.00869 |
| Sonnet 5 | $0.00038 | $0.00348 |
| Haiku 4.5 | $0.00019 | $0.00174 |
Grade A, and why
registry-doctor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill : registry-doctor
Purpose
Wraps the paper-trail worker B's invariant doctor. Runs all 19 checks (I1-I19) on the registry, reports violations classified by severity (ERROR / WARN / INFO), and offers auto-fix for safe cases.
The doctor is read-only by default. Auto-fixes (--fix) only apply
to invariants whose semantic is mechanically safe : I4 (path prefix
strip), I6 (sha256 recompute), I9 (attempt renumber), I5/I7 semi
(state → needs_reacquisition when PDF missing or page1 log broken).
Never decides anything semantic — that's sota-auditor.
When to invoke
- User asks to audit the registry, run doctor, fix drift
- User runs
/paper-trail:doctoror/paper-trail:doctor --fix - Hooks trigger it post-edit on a ref or at session end (cf.
hooks/hooks.json) sota-writervalidates that all proposed refs are coherent before using them in a SOTA
How it works
The skill delegates to the worker B Python CLI:
# Run all 19 invariants, severity ≥ info, no fix
python -m pipeline doctor
# Filter to errors only
python -m pipeline doctor --severity error
# Auto-fix safe invariants (I4, I6, I9, I5 semi, I7 semi)
python -m pipeline doctor --fix --severity warn
# JSON output for machine processing
python -m pipeline doctor --json
# Couche 5 — correlate with RTFM indexing failures
python -m pipeline doctor --correlate-rtfm
# Couche 5 (slow) — recompute sha256 on all PDFs to detect drift
python -m pipeline doctor --check-sha
Invariants reference
| Inv | Severity | Description | Auto-fix |
|---|---|---|---|
| I1 | ERROR | state is a valid FSM state |
no |
| I2 | ERROR | slug is unique across the registry |
no |
| I3 | ERROR | uid has a valid prefix (doi:, arxiv:, isbn:, etc.) |
no |
| I4 | WARN | pdf_path is properly relative (no 10_SOURCES/ prefix) |
yes |
| I5 | ERROR | If state implies PDF, file exists on disk | semi (→ needs_reacquisition) |
| I6 | ERROR | pdf_sha256 is 64 hex chars (recompute if missing) |
yes |
| I7 | ERROR | If page1_validated, the log is consistent |
semi (→ needs_reacquisition) |
| I8 | ERROR | state_history is monotonic in at timestamps |
no |
| I9 | WARN | acquisition_attempts[].n is strictly 1..N (no gap) |
yes |
| I10 | ERROR | If blocked_human:*, blocked_reason is non-empty |
no |
| I11 | WARN | Each cited_in[].name exists in vault |
no |
| I12 | WARN | Each SOTA citation [[slug]] is declared in cited_in |
no |
| I13 | WARN | pdf_sha256 is unique (no duplicates) |
no |
| I14 | ERROR | No transition out of sota_cited_confirmed or retracted |
no |
| I15 | INFO | awaiting_rtfm_ocr not older than 30 days |
no |
| I16 | WARN/ERROR | RTFM failure mirrored (Couche 5, opt-in via --correlate-rtfm) |
no |
| I17 | ERROR | PDF format defective (Couche 5, opt-in) | no |
| I18 | ERROR | sha256 drift between YAML and disk (Couche 5, opt-in --check-sha) |
no |
| I19 | INFO | PDF image-only without alternative text source tested (Couche 5) | no |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 180 lines · 191 tokens per session scan A b342db445791
registry-doctor is a skill published in the GitHub repository roomi-fields/paper-trail (5 stars, last pushed 7d ago), licensed MIT. It adds 191 tokens to every session and 1,738 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
x-bug2rag
A knowledge-capture tool that turns reusable bug explanations into a local RAG collection, meaning a searchable store of text that an agent can retrieve later. It records the trigger, incorrect implementation, correct implementation, and observable difference.
x-cr
A software-correctness investigation skill for finding why code behaves differently from what was expected. It uses evidence from code paths, specifications, tests, logs, and changes to assess possible causes.
x-fix
A bug-fixing skill with separate paths for directly reported bugs, correctness-review findings, and failed verification or quality-gate reports. It records completed fixes and their validation in project reports.
x-audit-perf
A manually triggered review of a whole software project’s performance. It looks for code and system patterns that may make programs slower or use more resources.
debugging-patterns
Isolate root causes through structured evidence gathering, pattern analysis, hypothesis testing (max 3 at a time, highest confidence first), and fix validation with a reproducing test before implementation. Use when any verification step fails, tests break, or debugging a reported bug. This skill MUST be consulted…
merge-conflict-resolution
Detect, classify (porcelain status; complexity: trivial, semantic, structural, delete-modify), and resolve git merge conflicts through per-file strategy selection (accept-ours, accept-theirs, manual-merge, rebase), manual conflict hunk parsing, and post-resolution verification (orphaned markers, build, tests). Use…