anti-autoresearch

/anti-autoresearch — the orchestrator

Run a full substantive-integrity forensic pass on $ARGUMENTS and hand a human reviewer / area chair an evidence-first Integrity Forensics Report.

🔒 External cadence: the verdict is not a poll. The pipeline is the verdict-producing path — its output changes only when the paper / repo / ledger changes, not with the clock. Do not wrap /anti-autoresearch (or any auditor sub-skill) in /loop / /schedule / CronCreate to "re-check". A heartbeat may only wait on the external steps that precede the verdict (an arXiv download, a citation web lookup) — never re-fire the adjudicated verdict, and never "decide the paper is fine now." Re-run the sweep when the inputs change; that is the only honest trigger.

Read reference/rationale.md for background: why this orchestrator exists and how it is the outward-facing dual of ARIS.

Pipeline role (what this run does, and never does)

The one-page stage diagram (ingest → ledger → auditors → memos → adjudicate → present) is in reference/pipeline-diagram.md.

• Auditors propose; the adjudicator decides. No auditor (and not this orchestrator) ever computes overall_verdict; only tools/adjudicate_findings.py does, by fixed rules (references/reviewer-independence.md Layer 2; DESIGN.md §3).
• Detect-only. No step ever edits the audited paper or repo. This is a third-party forensics tool, never a co-author (no Edit is granted; the reviewer sandbox is read-only).
• Observability caps everything. L0 (PDF-only) / L1 (source) cannot assert code/result-level fraud — those need L2 (repo + results). The adjudicator demotes any finding above the run's level (references/observability-levels.md; DESIGN.md §4).

Constants & conventions

REVIEWER_MODEL     = gpt-5.5  (via mcp__codex__codex) — a DIFFERENT model family from the executor (Claude)
REVIEWER_REASONING = xhigh    — always; the effort knob never lowers reviewer quality
REVIEWER_SANDBOX   = read-only — detect-only; the reviewer never mutates the paper
THREAD_POLICY      = FRESH mcp__codex__codex per dimension / per cited key; NEVER codex-reply across them
                     (codex-reply is deliberately NOT in allowed-tools — the bias guard)
RUN_THREADS        = serial   — one codex thread at a time; concurrent codex MCP calls can hang
LEDGER_VERSION     = 0.1       (stamped by tools/build_claim_ledger.py)
TAXONOMY_VERSION   = 0.5       (references/hack-pattern-taxonomy.md; 46 integrity patterns A–H + 13 AIS impressions + 2 ADV advisory; stamped into every report)
OBSERVABILITY      = derived   L0 (pdf/text) · L1 (latex, no results) · L2 (repo + results); L3 NEVER (no reproduction)
ADJUDICATOR        = deterministic-rules-v0   (tools/adjudicate_findings.py — the ONLY verdict source)
DETECT_ONLY        = true · EMITS_VERDICT = true (computed by code, not by a model)
REAL TOOLS (resolve ROOT="${CLAUDE_PLUGIN_ROOT}/support"):
   tools/build_manifest.py · tools/build_claim_ledger.py · tools/check_numeric_consistency.py
   · tools/check_presentation.py · tools/adjudicate_findings.py   (confirm flags with --help; never invent flags)
OUTPUTS (in PAPER_DIR) — artifact_manifest.json · claims.json · <skill>.findings.json (+ *.deterministic.findings.json)
   · adversarial-case-builder.memo.md · report.json · REPORT.md · .aris/traces/<skill>/<date>_run<NN>/