Integrity Forensics — thin launcher (Codex-native: deterministic slice)

Audit target: $ARGUMENTS

Same launcher doctrine as the mainline skill: SHA-pin, upstream eval-gate validation per pin, delegate unchanged, no vendoring, no forking, no reviewer knobs. The one Codex-native difference: upstream's nine auditor skills are Claude-Code contracts, so this pack runs upstream's deterministic-only mode — the numeric forensic core (GRIM / GRIMMER / statcheck / delta arithmetic) plus the rules-only reporter with an all-review_unavailable coverage map. That mode is honestly scoped by upstream: it can raise HARD/SOFT flags; it can NEVER return CLEAN_GIVEN_EVIDENCE. Translating upstream's reviewer calls into spawn_agent would REWRITE an upstream contract — forbidden.

Constants

• ANTI_AR_REPO = https://github.com/wanshuiyin/Anti-Autoresearch.git
• ANTI_AR_COMMIT = b47af6f983b38347b6d2110379e266400597cf66 — never tracks HEAD; bumping is a reviewed change (mainline Pin-bump checklist).
• CLONE_DIR = ~/.aris/anti-autoresearch — host-neutral. An older clone at ~/.claude/anti-autoresearch is unused; move it and its .aris_eval_ok_* receipt to keep an offline deterministic-only run working — this pack's own mode — otherwise delete it whenever convenient.
• NO REVIEWER KNOBS — and no — effort: mapping onto upstream settings.

Step 0 — Bootstrap the pin (identical to mainline)

CLONE_DIR="$HOME/.aris/anti-autoresearch"
ANTI_AR_COMMIT="b47af6f983b38347b6d2110379e266400597cf66"
mkdir -p "$HOME/.aris"
if [ ! -d "$CLONE_DIR/.git" ]; then
    git clone --no-checkout https://github.com/wanshuiyin/Anti-Autoresearch.git "$CLONE_DIR"
fi
git -C "$CLONE_DIR" cat-file -e "$ANTI_AR_COMMIT^{commit}" 2>/dev/null \
    || git -C "$CLONE_DIR" fetch -q origin
git -C "$CLONE_DIR" checkout -qf "$ANTI_AR_COMMIT" || { echo "FATAL: cannot checkout pin"; exit 1; }
# pristine tree at the pin — local tampering (incl. nested-repo injections;
# hence double -f) must not run under the pin's name; verify, don't assume
git -C "$CLONE_DIR" reset --hard -q "$ANTI_AR_COMMIT" || { echo "FATAL: reset failed"; exit 1; }
git -C "$CLONE_DIR" clean -ffdxq || { echo "FATAL: clean failed"; exit 1; }
[ -z "$(git -C "$CLONE_DIR" status --porcelain)" ] || { echo "FATAL: tree not pristine"; exit 1; }
# marker OUTSIDE the clone (a marker inside a tamperable tree proves nothing)
MARKER="${CLONE_DIR}.aris_eval_ok_${ANTI_AR_COMMIT}"
if [ ! -f "$MARKER" ]; then
    ( cd "$CLONE_DIR" && python3 eval/run_eval.py ) || {
        echo "FATAL: upstream eval gate FAILED at pin — refusing an unvalidated pin"; exit 1; }
    touch "$MARKER"
fi

Step 1 — Delegate: upstream deterministic-only mode, unchanged

Open $CLONE_DIR/workflows/anti-autoresearch/SKILL.md and follow its deterministic-only path (its own documented degraded mode): Step 0 ingest → Step 1 evidence ledger → deterministic auditors → adjudication with the generated all-review_unavailable coverage map. Wrapper rules: run every upstream bash block with cd "$CLONE_DIR" (upstream self-locates via git rev-parse --show-toplevel); refer to the paper by ABSOLUTE path; never rewrite upstream outputs.

Expected outcome: report.json whose verdict is HARD_FLAGS / SOFT_FLAGS / REVIEW_UNAVAILABLE — by construction never CLEAN_GIVEN_EVIDENCE.

Step 2 — Typed gate + obligations

Resolve forensics_gate.py via the canonical helper chain (shared-references/integration-contract.md §2, Policy A), then:

python3 "$GATE_HELPER" evaluate --report "$PAPER_DIR/report.json" --paper-dir "$PAPER_DIR" \
    --anti-ar-commit "$ANTI_AR_COMMIT" --executor-model "codex-gpt-6-astra"

Policy: HARD_FLAGS → BLOCK · REVIEW_UNAVAILABLE → BLOCK (which a deterministic-only run reports whenever it found no flags — the semantic dimensions never ran, so nothing may wave the paper through) · SOFT_FLAGS → WARN. The gate records same-family proposal provenance for a Codex executor — informational: this gate only raises flags, it grants nothing. The downstream preflight is ONE command: python3 "$GATE_HELPER" fresh --paper-dir "$PAPER_DIR" --anti-ar-commit "$ANTI_AR_COMMIT" — exit 0 ⟺ produced at the current pin ∧ gate exists ∧ paper unchanged since ∧ gate matches the current ledger ∧ decision pass-capable (WARN/NO_NEW_BLOCKER), where the decision is RE-computed from the sha-verified archived report + live ledger (the stored token is display, not authority). Any ledger mutation deletes the standing gate.json, and evaluate refuses a report older than any paper file — neither a stale pass nor a stale report can be replayed.

Step 3 — Fix what it found

Identical obligations discipline to the mainline skill: append-only ledger, UNRESOLVED_DISAPPEARANCE on vanished-but-unresolved findings, typed + hashed resolve receipts (corrected-from-results | claim-narrowed | claim-withdrawn | citation-replaced; --verified-by must be typed provenance — human:<name> / checker:<tool> / cross-family-review:<thread-id> — and the evidence file is RE-hashed on every later gate), human-only waive (never a resolution), and The One Forbidden Loop: never "edit → re-sweep → repeat until it stops flagging". Numeric obligations route to the result files; the rest to the matching audit skill or the human.