academic-research-skills Agent Skills & AI Rules

# Academic Research Skills

A suite of Claude Code skills for rigorous academic research, paper writing, peer review, and pipeline orchestration.

## Skills Overview

| Skill | Purpose | Key Modes |
|-------|---------|-----------|
| `deep-research` v2.12.1 | 13-agent research team | full, quick, socratic, review, lit-review, three-way-scan, fact-check, systematic-review |
| `academic-paper` v3.3.1 | 12-agent paper writing | full, plan, outline-only, revision, revision-coach, abstract-only, lit-review, format-convert, citation-check, disclosure, rebuttal-audit |
| `academic-paper-reviewer` v1.11.1 | Multi-perspective paper review (5 reviewers + optional cross-model DA critique) | full, re-review, quick, methodology-focus, guided, calibration |
| `academic-pipeline` v3.23.1 | Full pipeline orchestrator | (coordinates all above) |
| `sr-screener` v1.0.0 | Protocol-driven study screening (2 blinded AI reviewers + adjudicator) | protocol, quick, pilot, ta-screen, ft-screen, adjudicate, audit, report |

## v3.23.1 Key Additions (write-scope guard repairs + RFC 4180 CSV reading in `sr-screener` + Gemini 4 Argon as a provisional verifier)

- **Two write-scope guard fail-open paths closed (#972), and the docs state where the fence engages (#974).** Plugin-dispatched Bucket A agents are reported as `academic-research-skills:<agent>`; the guard now strips this plugin's own prefix before the manifest lookup (#971). `hooks/run_guard.sh` no longer trusts a `timeout` that rejects the GNU form, such as Windows `timeout.exe`, which had left every write unchecked (#970). Inline main-session roles carry no agent type and are not fenced; the docs now say so.
- **`sr-screener` reads CSV exports by RFC 4180 quoting (#979, reported by @paololimo).** `parse_csv` sniffs only the delimiter; quote rules no longer come from a 5,000-character sample, which had split later quoted fields, guessed `'` as the quote character, and read single-column exports with semicolons as semicolon-delimited.
- **Gemini 4 Argon is a provisional Google verifier and the recommended Google id (#980).** `gemini-3.1-pro-preview` stays validated; no Gemini smoke script ships, so the Promotion Bakeoff entry gate for a Gemini candidate is pending.
- **Smaller changes.** A mid-message `[direct-mode]` token is not the escape hatch (#892); lint type checks for `exception_reason` (#965, #977) and a Windows path comparison (#963), contributed by @SID-6921 and @daniyyell-dev; `THIRD_PARTY.md` lists md-to-word (#969, @ls-open). The #892 smoke test does not meet its acceptance rule (Claude Fable 5.1 on a plugin install still honored the token in 3 of 6 sessions), so #892 stays open; no accuracy or performance claim ships.

## v3.23.0 Key Additions (`sr-screener` as a fifth skill + repairs from a pipeline walk-through + evidence and ledger hardening)

- **A fifth skill, `sr-screener` v1.0.0 (#919, contributed by @erfanz97).** It turns a review protocol into eligibility rules the user confirms, then screens titles/abstracts and full texts with two blinded reviewer subagents and a third-reviewer adjudicator; reviewers default to Sonnet, never a smaller model. Standard-library scripts parse, de-duplicate, merge, and write a screening log, RIS groups, PRISMA 2020 counts, a methods draft, and a `literature_corpus[]` file; spreadsheet exports neutralise formula text, including after a `;`, tab, quote, or line break (#951). Tests use synthetic records; no screening-accuracy claim ships.
- **Repairs from a paper walk-through of a default pipeline run (#925-#929).** The v3.6.7 Audit Artifact Gate is opt-in (`ARS_AUDIT_ARTIFACT_GATE=1` plus consent), and the orchestrator asks once whether the paper reports the scholar's own experiments (#925). Constraints set for a run live in `standing_constraints[]` in the user's words and are quoted to each later dispatch whose stage they apply to (Stage 3/3' reviewer dispatches excepted; there they act at the checkpoints); a declined-only Major re-review gets a limitations-only revision path (#927). The integrity gates follow one rule set and treat `UNVERIFIABLE_ACCESS` as a note (#926); Stages 5-6 produce only requested files (#928); opt-in switches surface Stage 5 refusals at Stage 4.5 (#929).
- **Evidence and ledger hardening.** The Stage 2.5/4.5 checkpoints replay evidence rows from a folder the orchestrator names, and a report naming another folder does not pass (#933, #948); the evidence-row CLI refuses advisory rows by name (#947). A source the gate judges `NOT_FOUND` goes into `excluded_sources[]` and stays out of later writer dispatches, and abstracts are checked against the revised body (#936). Ledger readers report parse failures without quoting file text, and the run ledger is read only through `show` or `report` (#898, #945); writers share one atomic write (#946).
- **Smaller changes.** Per-source method weaknesses in reading outputs (#916); a review-form note at a fixed point, with no default (#921); held-out overclaim cases from ScientistTwo (#915); Schema 1 aligned with `research_question_agent` (#938); `/ars-citation-check` inherits the session model (#912); acronym-check and marker-lint repairs (#906, #923); a `MODE_REGISTRY` count fix (#944); an OpenClaw port listed in `THIRD_PARTY.md` (#910). Prompt-level changes are unmeasured.

## v3.22.2 Key Additions (run ledger and handoff check + acronym check + wider instruction/data boundary + routing and front-page repairs)

- **A run ledger backs the handoff after compaction, resume, and subagent returns (#887, #898).** When a run has a passport file, the orchestrator appends the user's initial instructions, checkpoint questions and answers in the user's exact words, step receipts, and file hashes to `<passport-stem>_run_ledger.yaml` through `scripts/run_ledger.py` (schema `shared/contracts/passport/run_ledger.schema.json`). `report` compares the ledger with what a summary or report claims, renders the handoff check in English or Traditional Chinese, and re-checks file digests. `docs/RISK_REGISTER.md` adds R12 and `docs/DATA_FLOWS.md` lists the new local store, which holds the user's exact words. Synthetic scenarios pin the report; whether the orchestrator writes the entries is prompt-level and unmeasured.
- **A deterministic acronym check (#849, proposed by @reiropke in #848).** `scripts/check_acronyms.py` reports undefined, late, or duplicate acronym definitions per scope without calling a model. The prompts have the calling session run it on saved drafts and abstracts, and a review appends its report to the Editorial Decision Letter as an advisory attachment that the decision, the revision roadmap, and re-review criteria do not draw on. Tests use synthetic fixtures; whether runs call it is unmeasured.
- **The instruction/data boundary reaches dispatches, passport imports, tool-call receivers, and the main session (#890, #894).** Seventeen more agents and the four `SKILL.md` files inline the canonical block, pinned by `scripts/check_instruction_data_boundary.py`; the opt-in claim-audit judge prompt changes with it, so cached verdicts from the old prompt are not reused. The layer is prompt-level and unmeasured.
- **Routing and front-page repairs (#892, #889, #897, #854, #888, #908).** The routing core reaches plugin and skills-copy installs through `shared/references/routing_core.md`; explicit requests stay explicit when the mode's usual input is missing; `/ars-lit-review` stays in its mode; the revision coach keeps peer review out of the committee-correspondence variant; "authoritative" skill output is scoped to deliverable ownership; and the front page and showcase match their sources. Routing results come from one session per fixture, a smoke test rather than a rate.

## v3.22.1 Key Additions (Opus 5.5 model currency + citation-check loading and Chinese APA 7 repairs + Pi wrapper fix)

- **Claude Opus 5.5 joins Claude Fable 5.1 as a supported session model (#883).** A two-reader audit of the Opus 5.5 system card (`audits/harness-retirement-2026-09-opus-5-5.md`, DM-001 to DM-021) retires no guardrail. `docs/PERFORMANCE.md` (en / zh-TW) adds effort guidance (heavy runs at `high` or above, since Claude Code starts Opus 5.5 at `medium`), one 2026-09 list-price re-derivation for both models, tiering guidance for the pair, and a files-over-pastes recommendation; `shared/model_tiering.md` defines family and tier (tier order is lineup order, not a capability ranking) and corrects the classifier-fallback note. No command `model:` or `effort:` setting changes.
- **The revision coach treats pasted third-party text as data (DG-1).** It inlines the canonical instruction/data boundary, pinned by `scripts/check_instruction_data_boundary.py`, whose mutation tests are now parametrized over every hot-spot agent; `docs/RISK_REGISTER.md` R3 names pasted text. The guard is prompt-level and its effect is unmeasured.
- **Mode-loading and citation-check repairs (#857, #882, #858, #864).** The 13 plugin mode commands invoke their namespaced core skill and use plugin-root reference paths; Chinese APA 7 checks cover missing author abbreviation, ambiguity exceptions, reference-list author fields, and ordering evidence; citation checks distinguish visible syntax errors from unverified resolution or source claims; English, Traditional Chinese, and Korean trigger phrases route citation-check, with a CI bound of 1,024 code points per skill description.
- **Pi wrapper (#880).** String-array system prompts are accepted without flattening blocks or mutating host input.

## v3.22.0 Key Additions (output-language-pair contract + locale track + plugin eval suites + Windows / transport repairs)

- **A run can declare its output language pair; absence is the legacy state (#862 Phase 1, PR #869 by @didacrios).** `shared/output_language_pair.md` is the registry-keyed contract (initial entry `zh-tw-en`); Schema 4 gains the optional `output_language_pair` field; ten consumer surfaces name it and omit the value when absent; the abstract length / keyword regime table has one home in `academic-paper/references/abstract_writing_guide.md`. `check_output_language_pair_contract()` pins registry membership, the default token, the table's location, and a malformed-value self-check. The values held fixed are file-level literals; no rendered-output or model-behaviour equivalence is claimed.
- **Locale track around it.** es-ES README (#855) and conservative trigger phrases (#856, #867) by @didacrios; locale packs are community-maintained, with a provisional single-owner application route recorded in `CONTRIBUTING.md` (#861, #862).
- **Evaluation substrates, no measured claims.** `claude plugin eval` suites for revision-coach (`plugin-evals/`) and citation-check (`plugin-evals-citation-check/`, #859) run as with/without-plugin ablations; the reviewer-calibration harness (#835) adds isolated dispatch, audited scoring, and a credential preflight. Each is a regression guard or dispatch substrate; none ships an uplift figure or a calibration value.
- **Repairs.** Windows file locks through one shared `msvcrt`-backed helper (#843 / #844 by @dajiaohuang, #845); the OpenAI request builders drop Astra-rejected parameters and validate the effort set (#823); the contained Codex transport rejects `effort=ultra` (#824); audit provenance records the actual judge identity (#826); Socratic path F6 lists directions unranked (#834); unsupported claims route to a source, an omission, or `[MATERIAL GAP]`, never a hedge (#825); revision-coach triggers reach the frontmatter description (#851).
- **Docs.** READMEs keep the three most recent releases (#870); Gartenberg et al. (#833) and Wang, Li et al. (#873) join the human-in-the-loop anchors. Roadmap Phase 4 (stage-level evidence ceilings) is not delivered in this release.

## v3.21.2 Key Additions (model currency + checkpoint provenance + CJK title-matching repairs)

- **Model currency follows the September 2026 system cards.** Docs name Claude Fable 5.1 as the current frontier model; `gpt-6-astra` is listed as a provisional cross-model verifier on both transports and becomes the recommended OpenAI verifier under the #783 generation-currency policy, while `gpt-5.6-sol` keeps its transport-qualified validated status. The contained Codex citation transport accepted `ultra` reasoning effort as part of its closed set at the 3.21.2 tag; #824 reverted that — `ultra` is a delegation request on the codex app-server, so the transport now rejects it with `REASONING_EFFORT_REQUIRES_DELEGATION`. No new bakeoff result is claimed.
- **Two vendor-motivated guardrails, both prompt-level.** Checkpoint decision provenance (authority in the pipeline state machine, mirrored by the orchestrator, indexed as risk R11): only a user turn is a checkpoint decision, and decisions are re-transmitted to subagents verbatim. Provider-side monitoring and safety interventions are named as a transport-failure case that is never a verdict; model tiering records that the resolved tier is the declared model, not a per-call attestation.
- **Harness-retirement audit retires nothing.** `audits/harness-retirement-2026-09-model-update.md` maps both cards' behavioral findings to the ARS mechanisms that assume them: 0 prompt-text retirements, 4 applied currency fixes, 2 deferred items, 8 keep-as-debt annotations now backed by a system-card citation.
- **Matching and lint repairs.** CJK titles pass the shared exact-title gate in the four index resolvers, and wrapper marks are stripped only as one balanced unit (#798, #800); a skill-inventory parity lint (#809) requires set-equality across the skill directories, `skills/` symlinks, the CLAUDE.md table, and the marketplace manifest; the autolink round-trip test declares its dependency (#801); `check_surface_form_parity` names a broken environment instead of the manifest; the R10 residual gap and an MLA key-rules line are de-staled (#813, #805).

## v3.21.1 Key Additions (bounded workflow substrates + transport-qualified verification)

- **The ChatGPT-subscription citation transport is measured and transport-qualified.** The contained Codex subscription citation transport is repaired for codex-cli 0.147.0, and the first Promotion Bakeoff validates `gpt-5.6-sol` on that transport with counterbalanced paired evidence. The first-party API route remains provisional, and only the measured recall and latency advantages are claimed. Future bakeoffs must use the sealed commitment/reveal lifecycle.
- **Research structure expands behind explicit opt-in boundaries.** A default-off research-workflow profile runtime records explicit selection, fallback, correction, and stale prior outputs; the `ARS_INQUIRY_LEDGER=1` alpha adds an append-only inquiry branch ledger with bounded summaries and durable two-file recovery. Neither feature changes the default pipeline, and behavioral/usability evidence remains `NOT_RUN`.
- **Review criteria gain one bounded source-backed proving set.** An exact Software Engineering × MSR 2027 Technical Papers × Full Paper profile demonstrates venue/type, field/overlay, freshness, digest migration, and three-consumer binding. It is one architecture proving set, not discipline coverage or constructive-review evidence; the independent-human-expert and blind-adjudication work remains open.
- **Contract honesty and defrift coverage tighten.** The alternative-explanation register is design-frozen but not implemented; write-scope launcher degradations enter the canonical registry; `data_access_level` is re-derived under the dirtiest-input rule; and shared rendered-Markdown grammar removes divergent lint behavior. The OrcaRouter community listing adds no bundled or endorsed provider claim.

## v3.21.0 Key Additions (ISO/IEC 42001-spirit transparency / verifiability / feasibility track)

- **Dual-track gap assessment + full remediation.** `audits/iso42001-spirit-gap-assessment-2026-08-17.md` distills three operating principles (transparency / verifiability / feasibility, informative ISO/IEC 42001 anchors — certification explicitly not pursued) and files eleven verified findings; all eight remediation issues (#753–#760) shipped in this release.
- **Claim surfaces aligned with evidence ceilings.** Distribution manifests drop unlicensed language for matrix-licensed wording; no-bypass prose across the pipeline integrity family now names the recorded override/FAIL-loop routes (trust-based controls with audit trails); citation surfaces (`CITATION.cff` / `POSITIONING.md`) are lint-pinned to the suite version (invariant 12); `data_access_level` follows the dirtiest-input rule with per-skill pins.
- **Four standing transparency artifacts, each defended by a CI lint.** `docs/CONTROL_AVAILABILITY.md` (mechanism × install channel, CA-1..3), `docs/DATA_FLOWS.md` (every network touchpoint + local store, DF-1..3), `docs/ARCHITECTURE.md` §7.1 (per-workflow enforcement classes, WC-1..4), and `docs/RISK_REGISTER.md` (risk → control → evidence status → residual gap, RR-1..3 with matrix-mirrored statuses and an asserted-status ceiling).
- **Governance stated, security response proceduralized.** Root `GOVERNANCE.md` records decision authority, per-operator cross-model scope (error-detection control, not organizational independence), release authority, EOL posture, and the principles↔42001 mapping with Annex C not-applicable assessments; `SECURITY.md`'s 7-day promise becomes an acknowledgement-only hard promise backed by a severity-tiered, solo-runnable triage procedure.

## v3.20.1 Key Additions (contract honesty + bounded evaluation substrates)

- **Integrity and review claims match their evidence.** Claim coverage is explicitly bounded to registered or lexically detected populations; semantic completeness remains unknown. Revision claim-strength changes require a byte-bound, per-finding author disposition. Reviewer outputs use categorical criterion judgements, remain `NOT_CALIBRATED` in live packages, and carry typed panel provenance instead of a binary independence claim.
- **Read attestations and Socratic exits fail visibly.** New read marks require an explicit scope and are resolved from validated, append-safe ledgers; malformed or absent attestations cannot become positive coverage. A user may visibly exit non-generating Socratic RQ mode without the system silently generating candidates.
- **Evaluation substrates stay bounded and unmeasured.** The claim-standing probe gains closed contracts, discovery adapters, an offline stance runner/renderer, and synthetic seed assets; the ideation-diversity bundle gains a closed first-round assignment gate. No live stance provider, effectiveness result, semantic-completeness guarantee, independent-error proof, or scientific-outcome claim ships with this patch.
- **Future structure remains opt-in.** The v3.20→v3.22 roadmap stages domain profiles, inquiry branches, alternative registers, capability evidence, and outcome studies behind progressive disclosure and usability gates; it does not enable those structures by default.

## v3.20 Key Additions (review evidence + integrity advisories + contained transports)

- **Reviewer and re-review evidence contracts.** Role-scoped review criteria, typed evidence anchors, terminal output preflights, deterministic arithmetic receipts, complete retry evidence, and a three-gate re-review contract make review decisions replayable without turning rubric conformance into a substitute for human judgment.
- **Research-integrity and authority substrates.** Versioned evidence rows, bibliographic-integrity signals, retraction observations, human-subjects authority pointers, submission-packet manifests, committee-correspondence accounting, cross-document consistency, and author-controlled revision roadmaps remain advisory or deterministic support layers with explicit institutional and human decision boundaries.
- **Evaluation discipline without inflated efficacy claims.** New held-out report contracts, synthetic seeds, dry-run materializers, and no-call envelopes freeze reproducible study designs for role topology, ideation diversity, prompt injection, claim standing, and review criteria. Suites that still require independent human judges, expert labels, or adjudication remain explicitly unmeasured.
- **Contained transports, PDF advisory, and ingestion hardening.** ChatGPT-subscription citation transport uses a closed, bounded protocol without API fallback; opt-in process-isolated PDF text/OCR classification remains advisory; and EOF-complete post-terminal draining rejects late protocol activity and reaps subprocess groups. Separately, no-call evaluation runners use durable stop rules and hermetic regressions. The contained subscription path does not imply that separately invoked citation verification is offline-only, and none of these paths introduces autonomous publication.
- **Access and platform work.** Chinese-literature resolver support, explicit bare `/ars-*` command aliases, a community-maintained Pi wrapper, and setup guidance for standing preferences broaden access without changing the suite's human-in-the-loop positioning.

## v3.19 Key Additions (revision-round claim-drift guards + PDF read-integrity preflight + read-scope attestation)

- **Revision-round claim-drift guards: claim-strength ladder + deterministic token conservation (#569 / #570).** Stands an advisory watch over the epistemic and token halves of the #390 honest-claim residual — the block-anchored patch confines silent-distortion exposure to touched blocks but never checks a touched block's *interior* (DELEGATE-52, arXiv:2604.15597); a guard now watches each half, with the post-guard re-measurement tracked in #652. Two advisory-first layers, mechanism shape borrowed from [Yila-AI/sci-ssci-skills](https://github.com/Yila-AI/sci-ssci-skills) by @MissOrangePeel. (1) **Claim-strength ladder** (`shared/references/claim_strength_ladder.md`): an ordered epistemic scale whose invariant is "no silent move, either direction, without an authorizing roadmap item" — wired into `draft_writer_agent` revision mode and a new advisory Phase E6 (`STRENGTH-DRIFTED` → `ADV-E6-<n>`, consuming the per-round Revision-Evidence Bundle). (2) **Deterministic token conservation** (`scripts/check_revision_token_conservation.py`): stdlib checker over numeric/citation/protected-term tokens, pair mode or per-op against a #390 patch, with Unicode fold-before-split; wired as orchestrator revision step 3a. Rather than cite an earlier-generation-model study, a held-out set (`evals/heldout/revision_claim_drift/`) measured the current frontier model's baseline first: 2/8 claim-strength/hedge drift under pressure. 31 tests. Dual-track pre-ship review closed 6 codex findings (0 security).
- **PDF read-integrity preflight for locally-extracted page anchors (#512).** `scripts/pdf_read_preflight.py` (pypdf-backed) cross-checks three independent page-count signals and emits a JSON verdict sidecar so a truncated / mispaginated PDF read cannot mint an apparently-valid `page` anchor. Firm rule R-L3-1-D on the three v3.7.3 emitters (a locally-read PDF `page` anchor requires a PASS sidecar), the §3.6 orchestrator runs the preflight at Stage 1 corpus intake, FAIL-vs-UNAVAILABLE split (positive truncation evidence refuses; mere absence of verification is an explicit-warning advisory). 8-round cross-model review closed the ISO 32000 lexer-fidelity family.
- **`read_scope` honest-coverage attestation + anchor-aware finalizer promotion (#513).** v3.19 introduced an optional declaration-only `--scope`; current runtime supersedes that input rule and requires `--scope {full_text,sections,abstract_only,toc_only,unknown}` for every new `/ars-mark-read` event (`--locator` + `--note` remain conditional). The Cite-Time Provenance Finalizer's LOW-WARN → ok promotion is anchor-aware (`abstract_only`/`toc_only` → `LOW-WARN-PARTIAL-COVERAGE`; `sections` promotes only inside a declared locator). Legacy absent scope remains `unknown` and is never backfilled or promoted.
- **Write-scope guard launcher watchdog stall + flaky launcher tests (#545).** `hooks/run_guard.sh`'s watchdog subshell leaked its capture pipe to a forked `sleep`, blocking every healthy PreToolUse call for the full wall-clock bound (~6 s); redirecting to `/dev/null` cuts it to ~0.15 s. Test-harness `ARS_PROBE_BOUND` default raised to 30 s to end load-dependent flakiness; regression pinned by `LauncherSlowInterpreterTest`.
- **SETUP Method 4a description-length figure de-drifted (#564).** Replaced a hardcoded 440-842 character range (now stale at 566-986) with a durable comparative statement so it cannot silently drift as descriptions evolve.

## v3.18 Key Additions (self-improvement survey integration — advisory quality layers + cross-model tracks)

**External motivation:** Ren et al. (2026), *Self-Improvements in Modern Agentic Systems: A Survey* (arXiv:2607.13104). All eight issues (#539–#542, #547–#550) derive from a two-reader (Claude + codex) full read of the survey; every mechanism is advisory-or-opt-in and preserves the human-in-the-loop positioning. The release also carries one independent feature (#544, below).

- **Scope-conformance advisory (#547 → #552).** RQ Brief Schema 1 gains optional `sub_question_bindings` (inherited axes + user-approved deviations; effective-scope semantics); outline sections name the sub-question they serve; Phase E4 compares audited claims against the inherited effective scope and emits `ADV-E4-<n>` rows — advisory-only, never gating, displayed per-row at the MANDATORY integrity checkpoint template (which now carries an advisory-rows block + per-row recording instruction).
- **Search-bounded novelty claims (#548 → #556).** Absolute priority language ("first study to…") defaults to the bounded form filled from Schema 2 `search_strategy` (+ new `last_searched_at`, emitted by both producers; bibliography F2 hash re-baselined); Phase E5 classifies `SUPPORTED_WITHIN_SEARCH` / `UNRESOLVED`, never "globally verified"; the bounding qualifier rides a `<!--protected-hedges:-->` comment consumed by `abstract_bilingual_agent` and stripped by the formatter; the absence-claim exception is propagated to every D2/D3/anti-leakage enforcement surface.
- **Risk-stratified Stage 2.5 claim verification (#549 → #554).** Phase E Mode 1 moves from uniform 30% random to 100% of HIGH-IMPACT claims + a 10% RANDOM sentinel (min 3 / max 10), topped to min(10, total); tier recorded per claim (HIGH-IMPACT / RANDOM / TOP-UP / NOT-SELECTED); Mode 2 (100%) unchanged.
- **Cache staleness advisory + live re-validation (#541 → #557).** `verify_citation` / `verify_passport` run cache-through by default (omitted-argument sentinel; explicit `cache=None` = live opt-out), closing the v3.11 Delta-2 forward-decl; summaries carry `cache_age_days` + `cache_stale_advisory` (`ARS_CACHE_STALE_ADVISORY_DAYS`, default 30, 0 disables); `ARS_CACHE_REVALIDATE=1` re-verifies stale rows live per-row; unconditional invalidation cascade; typed hit validation; `ADV-CACHE-<n>` advisory rows at the checkpoints.
- **Cross-model reviewer track (#540 → #558, #611 calibration branch).** The ordinary reviewer path remains `reviewer_full` only and consent-gated (the env var is configuration, not consent): Reviewer 2 runs on the second model family — a substrate swap inside the fixed five-seat panel, explicitly NOT the retired 6th reviewer; no synthesizer aggregation (cross-family splits visible in the panel matrix); the Editorial Decision Letter gains a Review Panel Provenance block (active / single-family correlated-error caveat / disclosed fallback, tiering-orthogonal). Calibration is the sole explicit exception and uses the canonical non-sprint single-call transport plus attempt-atomic fallback in `shared/cross_model_verification.md`; it never borrows the sprint payload or mixes substrates in one scored attempt.
- **Re-review judge independence + Judge Record (#539 → #559).** Stage 3' Priority-1 verdicts get a judgment-specific cross-model pass (provider transport reused, no grounding gate, closed verdict set incl. MADE_WORSE; `agree` / `diverges` / `unavailable` / `not_configured` per row; run-level `partial — N/M`); the Editorial Decision Letter travels the Stage 4→3' handoff on all nine operative surfaces; Schema 6 optional `judge_record`.
- **Pipeline behavior robustness evals (#550 → #555).** `evals/heldout/pipeline_behavior_robustness/` seed v0.1: 8 documented-ground-truth base scenarios × 3 perturbations (terse/verbose/padding, en + zh-TW), full-expectation scoring (behavior + skill + mode), per-item `rule_anchor`; also shipped the reviewer skill's missing zh-TW trigger aliases.
- **SessionStart update-available reminder (#543 → #544, independent of the survey track).** Plugin installs compare the installed version against `main`'s `.claude-plugin/plugin.json` (24 h cache, 3 s network ceiling, `ARS_UPDATE_CHECK=0` kill switch) and announce `/plugin update academic-research-skills` when behind — third-party marketplaces default auto-update OFF with no behind-signal; v3.18.0 is the first release this reminder announces.
- **Docs anchor (#542 → #551).** The survey joins The AI Scientist and Zhao et al. as the third human-in-the-loop literature anchor (README en/zh-TW motivation sections + calibration protocol §8.1.2 framing), cited as design rationale, not empirical proof.

## v3.17 Key Additions (pipeline boundary semantics + canonical cross-model handoff envelope + executable panel checker)

- **Pipeline Stage 5/6 boundary semantics + whole-file content locks (#528 → #529, #535).** New authority section `references/pipeline_state_machine.md` § Stage 5 and Stage 6 Boundary Semantics, mirrored in `academic-pipeline/SKILL.md`, `agents/pipeline_orchestrator_agent.md`, and `references/process_summary_protocol.md`. Stage 5's "before finalization: always MANDATORY" now names exactly one checkpoint — the entry gate between Stage 4.5 PASS and Stage 5 dispatch; the completion checkpoint (Final Paper delivered, before Stage 6) is FULL but not MANDATORY. Stage 6 gains a defined Stage 5→6 transition, a non-mandatory decline path, a terminal checkpoint after the Process Record is delivered, and the canonical terminal-acknowledgement vocabulary (`finish`/`end`/`done`/`confirm`) that sets pipeline global state to `completed`. All five pipeline surfaces carry whole-file sha256 content locks (`scripts/check_pipeline_boundary_semantics.py`, 66 mutation tests) — any byte change fails CI until the pinned hash is updated in the same commit.
- **Canonical cross-model handoff envelope + dispatcher consumer contract (#527 → #536).** The #523 owner→dispatcher→owner transport path gains a machine-stable `[CROSS-MODEL-HANDOFF v1]` envelope (checkpoint_kind / owner_agent / correlation_id / expected_result / payload) with `scripts/cross_model_handoff.py` as the normative Python grammar (parse + outcome routing as pure functions) plus a deterministic fixture suite on a fake transport (no external API). The three checkpoint owners (`research_architect_agent`, `editorial_synthesizer_agent`, `devils_advocate_reviewer_agent`) emit the envelope; the Mode-A orchestrator pins the consumer contract (malformed envelope → `[CROSS-MODEL-ERROR]` → `unavailable`, never a fabricated judgment; agreement → mechanical fill, no owner re-invocation; divergence → re-invoke the owner with minimum context). `scripts/check_cross_model_handoff_contract.py` pins the contract across all five surfaces.
- **Tools allowlist for plugin agents + defrift lock (#514/#521 → #524).** The three plugin-exposed agents (`synthesis_agent`, `research_architect_agent`, `report_compiler_agent`) declare `tools: Read, Write, Edit, Grep, Glob` in frontmatter — no Bash, no WebFetch/WebSearch. `scripts/check_tools_allowlist.py` (74 mutation tests) reads YAML as a duplicate-preserving node tree rather than a line scan, folding the whole `tools` value through Unicode normalization before any split so a homoglyph or fullwidth-separator re-spelling of `Bash` cannot slip past the allowlist.
- **Executable sprint-contract panel checker + majority-formula fix (#510 → #532).** New `scripts/check_panel_synthesis.py` recomputes both v3.6.2 decision layers from the primary artifacts (per-reviewer scores → fired conditions → decision; panel matrix → quantifier thresholds → precedence → synthesizer decision) and fails on mismatch. Corrects a majority-quantifier transcription error (`⌈N/2⌉+1` → simple majority `⌊N/2⌋+1`).
- **Machine-readable degradation registry + hermetic transport-fixture integration test (#511 → #533/#534).** New `shared/contracts/degradation_registry.json` indexes every graceful-degradation mechanism in the suite (failure class → emitted degraded state → diagnostic marker → downstream consumer → terminal-policy effect → authority anchor → pinning tests), validated by `scripts/check_degradation_registry.py`. A separate transport-fixture integration test (`scripts/test_transport_fixture_citation_gate.py`) feeds checked-in synthetic API bodies through the four actual resolver clients into the citation-verification gate, pinning the 3-class verdict end-to-end.
- **Also:** blind-checkpoint transport moved to the dispatching layer, closing an unexecutable-under-runtime-Bash-deny gap at the two irreversible decision checkpoints (#523).

## v3.16 Key Additions (model tiering + cross-model gate hardening + WP advisory sharpening)

- **Model tiering: judgment/execution split, two opt-in directions, default untouched (#517 → #520).** New `ARS_MODEL_TIERING` env switch + canonical `shared/model_tiering.md`. `economy` (frontier-tier session): the 13 execution-type agents dispatch one tier below the session model, floor Opus-class, never Sonnet. `quality-boost` (below-frontier session): the judgment-type agents at the Stage 2.5/4.5 integrity gates and final-review surfaces step up to the frontier tier; nothing is ever downgraded. Unset = byte-equivalent pre-#517 behavior. Tiers are relative positions, never hard-pinned model ids. The frozen 39-agent classification (26 judgment / 13 execution) lives in `scripts/model_tiering_manifest.json` + the canonical doc's table, pinned to each other and to the agent files on disk by `scripts/check_model_tiering.py` (15 mutation tests, CI-wired).
- **Cross-model gate hardening (#518 → #519).** Four upgrades to `shared/cross_model_verification.md` and consumers: (1) integrity-gate sampling moves from uniform 30% to risk stratification — HIGH-IMPACT references verified 100% uncapped at both gates, NEW-CHANGED references 100% at Stage 4.5, plus 10% RANDOM/CONTROL samples of the remainder; (2) blind disagreement checkpoints at the two irreversible decisions (design freeze in `research_architect_agent`, final editorial decision in `editorial_synthesizer_agent`) — the primary commits its structured decision first, the cross-model decides blind, divergence escalates to the user (a review trigger, never a vote); (3) the "6th reviewer — Planned" section retired, not deferred (the counterproductive-conditions list matches ARS's documented anti-patterns one-for-one); (4) `CROSS_MODEL_ID_STATUS=validated|provisional|unlisted` id-status allowlist + a § Promotion Bakeoff operationalizing provisional→validated criteria.
- **GPT-5.6 Sol as provisional verifier + explicit reasoning-effort control (#515 → #516).** `gpt-5.6-sol` joins the canonical model table as provisional pending ARS validation; GPT-5.5 stays the recommended default. New `ARS_CROSS_MODEL_REASONING_EFFORT` passes `reasoning.effort` explicitly (unset = provider default, so existing setups don't silently change). New `scripts/cross_model_smoke_test.sh` manual promotion gate.
- **WP advisory generalization + exemption sharpening (#501 → #503/#504, #505 → #507).** The WP01-WP20 shell table is now explicitly illustrative: the noun-swap test is the operative judgment, off-list shells may fire at the same high-confidence bar. A 48-item held-out acceptance set (`evals/heldout/rq_framing_offlist/`) measured baseline miss 0.34–0.38; the #505 exemption sharpening (named-or-operationalized specifics required, decorated-compound-title rule) drove it to 0.094 across all four post runs with false-fire 0/16 preserved. The set is now the acceptance test for any future advisory change.
- **Also:** Korean trigger keywords + routing boundary fixtures, proposal and phrases by @devCharlotte (#452 → #509); CARS introduction-rhetoric + title-crafting reference wired into `draft_writer_agent` (#500 → #502); reviewer calibration protocol documents the LLM-as-judge leniency direction with the FARS anchor (#484 → #506); OpenAlex API-key auth + budget-aware 429 handling + arXiv ToU-aligned backoff, proposed by @pikaqiu2333 (#495 → #496); `THIRD_PARTY.md` community directory + README pointer (#497 → #498).

## v3.15 Key Additions (release-gate hardening + prompt-debt retirement round 2 + defrift locks)

- **Prompt-debt retirement round 2 (#489 → #490).** Deep-scanned the 17 agents the #476 pass deferred (all 5 academic-pipeline, 5 deep-research, 5 academic-paper, field_analyst, compliance_agent) via 4 parallel batches + codex cross-model challenge. 13 findings (2 P1 + 11 P2, 2 user-rejected): both `socratic_mentor` agents carried live self-contradictions (stale "quit after 15 rounds" vs documented typical 20-30) — auto-end machinery merged to a single authority per file, threshold 30; the repo-wide stale "hook deferred to #134" enforcement sentence (false since PR #294) rewritten at 29 surfaces; few-shot/duplication trims across 7 agents. The 2026-06-10 F-007 negative-framing deferred item closes as verified-no-rewrite-needed. Report: `audits/harness-retirement-2026-07-04.md`.
- **Defrift locks (#491 → #492).** `check_v3_9_2_phase_boundary.py` invariant 4 pins the canonical enforcement sentence verbatim across all 23 Bucket A blocks (the drift class that sat wrong for a month now fails CI); new `check_setup_cross_model_parity.py` pins SETUP en/zh-TW `ARS_CROSS_MODEL` examples to each other and to the canonical model tables (table-column-scoped after a codex P1); local pytest manifest gains the v3.9.4 temporal test whose CI-only coverage caused a local-green/CI-red split (58 → 60 entries).
- **Release-gate hardening (#483, #487, #486).** `check_changelog_covers_merges.py` pre-tag gate (every release-worthy merge since the previous tag must be documented in CHANGELOG, fail-closed); version-consistency invariants 9-11 (release-notes body ≥100 chars, Last-Updated within ±7 days of the CHANGELOG date, Key-Additions heading matches suite version) + a `tag-version-match.yml` gate re-running the full lint at tag time; command-invariants gate pinning the SessionStart announce list to the actual 16-command inventory (announce list had drifted twice).
- **DOI badge fix (#482).** Served from shields.io (Zenodo's badge endpoint rate-limits GitHub's image proxy); link target stays the concept DOI.

## v3.14 Key Additions (Claude Science importability + eval-comment rendering + prompt-debt retirement)

- **Claude Science / GitHub-importer compatibility (#480).** `.claude-plugin/marketplace.json` declares explicit skill paths (`"skills": [...]`); symlink-blind GitHub-API importers (Claude Science "Import from GitHub", Windows checkouts) now find all four skills. Marketplace-root replace semantics keep Claude Code installs loading the same four skills — no content change, no double-loading. Verified end-to-end on Claude Science; import guide in README + docs/SETUP.md Method 5.
- **Eval-harness PR comment renderer (#479).** `scripts/render_eval_comment.py` renders a one-line verdict + per-task table + raw JSON folded into `<details>`, replacing the raw report dump. The row verdict mirrors the threshold gate's failure signal (aggregate AND per-class) with a CI-pinned agreement test; table cells escape pipes/line boundaries. Evaluation logic untouched.
- **Prompt-debt retirement (#476/#477 → #478).** Expired writing-harness scaffolds removed from `abstract_bilingual_agent`, `citation_compliance_agent`, `draft_writer_agent`, and `research_question_agent` (net −111 lines) after the 2026-07 harness-retirement audit (report under `audits/`); three-track verification (sub-agent audit + codex review + eval harness at 100%).
- **Platform Port Reminder CI (#473).** Remind-don't-block workflow surfacing the "Platform ports (community-maintained only)" policy when a PR adds a new top-level directory.
- **Changelog backlog rollup.** 16 `[Unreleased]` entries whose code shipped before the v3.13.0 tag (#390 diff/patch revision mode, #394 submission-package verifier, #215/#216 eval gold sets, and more) are versioned under 3.14.0 with a provenance note.

## v3.13 Key Additions (portability + verifier reach + guard correctness)

- **Write-scope guard: `CLAUDE.md` dropped from infra-protected globs (#459).** Closes the residual half of #448/#449. Under the git-clone + symlink install layout `plugin_root` collapses onto `workspace_root`, so the bare `CLAUDE.md` / `.claude/CLAUDE.md` infra globs re-denied the user's own `CLAUDE.md`. `CLAUDE.md` is documentation, not a load-bearing enforcement file, so it is removed from the infra list; every load-bearing file (guard script, manifest, hooks, plugin metadata, agent frontmatter, lint) stays protected.
- **Windows Python hook portability + graceful no-Python degradation (#454).** The PreToolUse write-scope guard is now launched via a cross-platform `hooks/run_guard.sh` that finds a real interpreter (rejecting the 0-byte Microsoft Store `python3` stub) and runs the guard as a time-bounded supervised subprocess; if no interpreter is found or the guard misbehaves, the launcher emits a valid pass-through and never spams the hook log.
- **Provider-agnostic cross-model verification (#455).** The cross-model verification layer accepts OpenAI-compatible endpoints (MiMo, DeepSeek, self-hosted) alongside first-party OpenAI, with the grounded first-party path preserved and never silently downgraded.
- **Opt-in Socratic adjacent-framing probe (#461; `deep-research` 2.10.0 → 2.11.0).** When `ARS_SOCRATIC_ADJACENT_PROBE=1`, the Socratic Mentor may surface ONE adjacent research framing as a pure question during exploratory Layer-1 framing (STORM-borrowed perspective expansion). Default OFF, prose-layer only, Kong L2 verb-test bounded.

Spec: `docs/design/2026-06-16-448-infra-protection-plugin-root-scope-spec.md` (+ the #454/#453/adjacent-probe design docs).

## v3.12 Key Additions (Kong auto-research feature track + partial-evidence decomposition)

**External motivation:** Kong et al. arXiv:2605.18661 (2026), *AI for Auto-Research: Roadmap & User Guide*. v3.12 ships the Kong feature track plus the §F.3.2 partial-evidence-trap work (Kim et al. arXiv:2605.20668v1), all additive and backward-compatible. `academic-pipeline` tracks the suite at v3.12.0; the other three skill versions are unchanged.

- **Experiment Provenance Intake + claim→experiment alignment (#260).** A schema-first evidence-ledger layer for experiment-backed claims — intake and alignment only; the scholar runs experiments externally and ARS never executes them. New `experiment_provenance[]` Material Passport aggregate (nested `repro_lock`, `planned_vs_executed[]`, `negative_results[]` / `known_limitations[]`) + a fourth ref_slug-less `experiment_alignment_results[]` aggregate with a MECE verdict enum, verdict produced AT the integrity gate (worst-verdict-wins on mixed-evidence claims). Seven cross-array invariants (EP-INV-1..5 / EA-INV-1..2) + fail-closed `experiment_intake_declaration` legacy boundary.
- **Figure/Table Fidelity Gate (#261).** Extends the VLM Figure Verification Protocol with a `figure_table_trace[]` prose contract — checks whether a caption's interpretation follows from the data and whether the manuscript cites the artifact for a claim it actually supports. Stage 4.5 Phase C3. Prose-layer only (no schema).
- **Cross-Paper Contradiction inventory (#262).** A `synthesis_agent` Step 3b emitting `cross_paper_tensions[]` so the assessed paper-pairs and unresolved tensions are enumerable for scholar confirmation, with a mandatory Coverage Note stating the recall limitation. Prose-layer only.
- **Partial-evidence decomposition (#213 / #214).** Sub-claim decomposition before judgment in both the citation judge (#213, schema + INV-19 + calibration) and the editorial synthesizer (#214, prose-layer), closing the §F.3.2 partial-evidence trap on both layers.
- **Guidance + interpretive layer.** Concise-output + pressure-stable boundary reinforcement across the report-producing reviewers (#274); a same-family / rubric-aware calibration epistemic note (#273); the retrieved-content instruction/data boundary as a standing principle (#367) — all guidance/interpretive, with explicit epistemic-status lines (no runtime-enforcement claim).
- **Negative scope + release discipline.** The Kong META (#255) closed with a POSITIONING.md "Rejected mechanisms" section + two Tier D design-lesson docs; version-consistency lint extended to invariants 5–7 (#357) and ARCHITECTURE component-version policing (#345).

Spec: `docs/design/2026-06-08-260-experiment-provenance-intake-spec.md` (+ the Kong sub-issue design docs).

## v3.11 Key Additions (#182 — deterministic citation verification gate)

**External motivation:** Zhao et al. arXiv:2605.07723 (2026-05). #182 promotes a **deterministic citation-existence verification gate** that runs independently of LLM peer review, closing the lookup-channel half of the hallucinated-citation problem. v3.11 implements all five spec deltas; the gate **inherits the v3.10 `terminal_policies` opt-in model** rather than introducing a second hard-block philosophy.

- **Four-index verification (Delta 1).** New `scripts/arxiv_client.py` adds arXiv (no API key) as the fourth resolver alongside Semantic Scholar / OpenAlex / Crossref. The v3.9.0 contamination triangulation matrix extends from three indexes (k=0..3) to four (k=0..4) with `arxiv_unmatched`; four new advisory suffixes render (`CONTAMINATED-ARXIV-UNMATCHED` at the k=1/k_max=1 arxiv-only carve-out, `CONTAMINATED-QUADRANGULATION-UNMATCHED` at k=4/k_max=4, + two PREPRINT compositions). All advisory — the refusal list is unchanged (R-L3-2-E).
- **Persistent cache (Delta 2).** `scripts/verification_cache.py` — local SQLite (`~/.cache/ars/verification.db`, `ARS_VERIFICATION_CACHE_PATH` override, 90-day TTL) so each paper is verified once across drafts. New `/ars-cache-invalidate <citation_key>` command.
- **`citation_existence` terminal policy (Delta 3 / C-V6).** New `terminal_policies` key `citation_existence` ∈ {`advisory`, `strict`} (per-key absence = advisory). The finalizer is the sole policy evaluator; `formatter_agent.md` rule 12 refuses on a `lookup_verified == false` row **only under `strict`**. `false` is narrowed to **ID-keyed unmatched** (C-V6(a)) — a title-only-unmatched legitimately-unindexed citation is `unresolvable`, never blocked (acknowledged precision-over-recall tradeoff, mirroring `strict_articles_only`). Detection is unconditional; only terminality is policy-gated.
- **Unified status surface + standalone API (Delta 4+5).** `citation_verification_summary.schema.json` + `.py` write a per-citation `lookup_verified` ∈ {`true`, `false`, `unresolvable`} + `anchor_present` + `resolver_outcomes`. `scripts/verification_gate/__init__.py` + `scripts/verify_passport.py` extract the gate into a callable API + standalone CLI.

Spec: `docs/design/2026-05-21-v3.10-182-promote-citation-gate-spec.md` (§0 v3.11 amendment + INVARIANT C-V6).

## v3.10 Key Additions (#127 — triangulation policy layer)

**External motivation:** Zhao et al. arXiv:2605.07723 (2026-05). v3.9.0 shipped three-index triangulation as advisory-only and explicitly deferred the policy layer (hard-block / strict modes). v3.10 ships it, rescoped after a first-party spec-collision audit (2026-05-31) that found `triangulation_policy` and the `R-L3-2-A` firm-rule wording were staked by two unshipped specs at once.

**Two PRs.** PR-A (shipped) disambiguated the `R-L3-2-A/B/C` ID overload (renamed the borrowed claim-manifest copies to `R-CIM-A/B/C`) and stood up `shared/references/firm_rules.md` as the canonical firm-rule source + `check_firm_rules_sync.py`. PR-B (this) builds the policy layer on that base.

**PR-B — terminal policy layer (opt-in; default byte-equivalent to v3.9.0):**

- **Namespaced `terminal_policies` (D1).** New passport-level `shared/contracts/passport/terminal_policies.schema.json` (standalone — NEVER inside the entry schema, Invariant 11). `contamination_triangulation` ∈ {`advisory`, `strict`, `strict_articles_only`} (wired). `temporal_integrity` accepts only `advisory` (forward-reserved; a wired-less `strict` would be false safety, Invariant 3). Per-key absence = advisory (evaluator default, not a JSON-Schema `default`); whole-object absence = all-advisory = byte-equivalent v3.9.0 (Invariant 7).
- **`venue_type` entry fields.** `venue_type` (closed enum incl. explicit `unknown`), `venue_type_provenance` (no `_inferred` values, R-L3-2-D), `venue_type_source` (required iff `trusted_source_declared`; lint-guarded against naming a lookup index — laundering guard). Adapter-declared only; pair dependencies bidirectional with a one-way `unknown ⟹ unknown` rule that still lets a known type carry `unknown` provenance.
- **Hard-block at the emission boundary (D2).** The finalizer is the sole policy evaluator: it stamps a fully-encoded `policy_hash` on every ref marker and, under `strict`, co-emits a `TERMINAL-BLOCK severity=HIGH-BLOCK` token alongside (not replacing) the advisory suffix. `strict_articles_only` is a deliberate PRECISION mode (DOI + journal/conference venue + declared provenance; DOI-less / unknown-venue stays advisory by design). The formatter is a STAMP-ONLY two-gate (freshness + generic rule-11 refusal), never re-evaluating policy logic (Invariant 13). `HIGH-BLOCK` is terminal — not `/ars-mark-read` ack-able. 

<!-- [TRUNCATED AT 50KB] -->