citation-crosscheck

Files (2)

• SKILL.md
• cx_verify.py · scripts/

SKILL.md (first lines)

# Citation Cross-Check (conditionally double-blind bib-vs-web field audit)

> **Codex mirror adaptation (normative).** This skill has no cross-model jury *by
> design* — it is an evidence instrument, not an acquittal step (see the acceptance-gate
> note in Step 2, and pair it with `citation-audit` for the cross-model verdict). A and B
> are read-only extraction shards and C emits a mechanical per-field delta, so every
> verdict is assigned by the main agent from that delta plus its own primary-source
> fetch — not by any shard and not by a reviewer model.
>
> **Blindness is NOT automatically identical across hosts — it is *conditional on
> isolation*, and the gate enforces that.** The whole cross-check rests on B never seeing
> the `.bib`. On the mainline, the `Agent` tool gives B a fresh context. On a Codex host
> the frontmatter grants **no delegation tool** (no `Agent`, no `spawn_agent` — see
> `allowed-tools`), so:
> - **If** the host can dispatch B in a genuinely isolated context that does **not** inherit
>   the main agent's history (which has already read the `.bib` in Step 1) — passing B only
>   the title+first-author list — B may set `blind:true` and the run certifies normally.
> - **Otherwise** (B would run in the main context, or "fresh sequential context" cannot be
>   guaranteed to drop the parent's `.bib` view), B MUST set `blind:false`. The Step-3.5
>   gate then **downgrades every `MATCH`/`MINOR` to `ESCALATE`**: the run still *flags*
>   discrepancies for the main agent's Step-4 webcheck, but it *certifies nothing*. It is a
>   labelled heuristic, not a double-blind certification.
>
> So the mirror never *claims* blindness it cannot deliver: it either has real isolation and
> attests it, or it declares `blind:false` and drops to flag-only. Do not add a
> `spawn_agent`-based reviewer/continuation route — the trust decision is the main agent's
> `WebFetch`, and it must not be delegated to a shard.

> 🔒 **Do not wrap this skill in `/loop`, `/schedule`, or `CronCreate`.** It is
> verdict-bearing — it emits a per-reference verdict that gates `.bib` edits (an evidence
> instrument, not a cross-model acquittal; see the acceptance-gate note in Step 2).
> Re-running it on a timer adds no signal (the verdict changes only when the
> *bibliography* changes).
> Schedule the external wait that precedes it: bibliography finalized → run once. See
> [`../shared-references/external-cadence.md`](../shared-references/external-cadence.md).

## Why this exists (and how it differs from `citation-audit`)

`citation-audit` is a single cross-model reviewer that judges three things holistically:
existence, metadata, and **context-fit** (is the cited paper used for a claim it
actually supports?). This skill does **not** do context-fit. It does one thing that a
single reviewer cannot do reliably: an **adversarial, field-level diff** (double-blind when the host can isolate the web agent, a labelled flag-only heuristic otherwise)
of the local `.bib` entry against an *independently reconstructed* record.

The failure mode it targets is the hand-entry error that survives a plausibility read:
a **dropped or re-ordered author**, a **wrong year**, a **swapped venue**, a **DOI that
404s**. A single reviewer that sees the `.bib` entry tends to anchor on it and rate it
"looks correct." Two agents that never see each other's output cannot anchor — a
discrepancy only survives if *both* independent records agree, and the verifier reports
exactly where they diverge.

In practice it catches dropped/re-ordered authors, wrong years, and bad DOIs that a
single-pass audit rated "looks clean" — while `NEEDS_WEBCHECK` stops it from
false-flagging a legitimate non-arXiv (blog / tech-report) citation as fabricated. Use it
**in addition to** `citation-audit`, not instead: `citation-audit` protects your *review
score* (context-fit); this protects
against the *integrity red flag* of a wrong or fabricated reference (existence + fields).

| | `citation-audit` | `citation-crosscheck` (this) |
|---|---|---|
| Owns | existence + metadata + **context-fit** | **existence + field accuracy**, adversarially |
| Method | one cross-model reviewer | **two extractors (blind when isolation is attested) + a mechanical field-diff** |
| Reads the .tex claims? | yes | no (bibliographic only) |
| Deliverable | KEEP/FIX/REPLACE/REMOVE per entry | **side-by-side .xlsx** + MATCH/MINOR/MISMATCH |
| Best at catching | wrong-context citation | dropped/re-ordered author, wrong year/venue/DOI |

## Constants

- **BLIND = conditional** — the web agent (B) MUST be prompted with only each paper's title +
  first author, plus its opaque `dedup_key` (a run-local ordinal that carries no
  bibliographic content), and MUST NOT read the `.bib` or any repo file. B attests
  `blind:true` **only** when the host isolates its context so it cannot inherit the `.bib`
  (see the mirror-adaptation note above); otherwise B attests `blind:false` and the Step-3.5
  gate certifies nothing (flag-only). Do not relax the prompt restriction, and never assert
  `blind:true` without real isolation — an un-isolated `blind:true` is the one thing that
  defeats the whole cross-check.
- **SOURCES** = arXiv (`/abs/<id>`, `/bibtex/<id>`), DBLP, CrossRef, ACL Anthology,
  NeurIPS/PMLR proceedings, OpenReview. Report what the fetched page shows; never
  fabricate a field.
- **VERDICTS** (assigned by the **main agent only**, in Step 4 — never by a shard) =
  `MATCH` (bibliographically equivalent, cosmetic-only) / `MINOR`
  (formatting or a preprint-vs-published venue, no correction required) / `MISMATCH`
  (real discrepancy: wrong/missing author, wrong year, wrong venue, wrong id) /
  `NEEDS_WEBCHECK` (B could not confirm existence, but the entry is a
  `@misc`/blog/tech-report whose `url` B's index-based search structurally cannot see —
  the main agent must fetch that `url` in Step 4 before any verdict; **never** downgrade
  such an entry straight to `MISMATCH`).
- **SCOPE** = cited-only by default (entries that render in the `.bbl`); `--all` also
  covers uncited `.bib` entries.
- **OUTPUT** = `<paper-dir>/citation_crosscheck_<date>.xlsx` (+ the four intermediate JSONs —
  `cx_A_ourbib`, `cx_B_web`, `cx_C_fielddiff`, and the gate's `cx_gate.json` — kept for audit).

## Workflow

### Step 1 — Resolve the citation set (deterministic, main agent)

```bash
# Search the paper's own source tree, not the whole repo: bundled author-kit /
# template .tex carry demo \cite{...} that inflate the set. Set PAPER_DIR to the dir of
# the main .tex (\documentclass + \bibliography); recurse (cites often live in
# sections/*.tex); exclude vendored/example dirs.
PAPER_DIR="<dir of the paper's main .tex>"
cd "$PAPER_DIR"
python3 - <<'PY'
import re, pathlib
# Skip vendored/example/template trees: bundled author kits carry demo \cite{...}.
# NOTE: this is a NAME match — a dir you *want* audited must not match (rename it or
# narrow SKIP), e.g. `examples_of_results/` would be skipped.
SKIP = re.compile(r'(?i)(^|/)(.*template.*|.*upstream.*|.*example.*|.*vendor.*)(/|$)')
# Verbatim-ish blocks AND inline \verb|...| / \lstinline are code samples, not citations.
VERB = re.compile(r'\\begin\{(verbatim|lstlisting|minted|Verbatim)\}.*?\\end\{\1\}', re.S)
# The optional arg may itself contain brackets: \lstinline[language={[LaTeX]TeX}]|...|
VERBINLINE = re.compile(r'\\(?:verb|lstinline)\*?'
                        r'(?:\[(?:[^\[\]]|\[[^\]]*\])*\])?\s*'
                        r'([^\sA-Za-z])(?:(?!\1).)*\1', re.S)
# url/href/path args may contain a literal % that is NOT a comment. Neutralize them
# BEFORE comment-stripping, or a real \cite later on that line is silently lost.
URLCMD = re.compile(r'\\(?:url|href|path|nolinkurl)\s*\{[^{}]*\}')
COMMENT = re.compile(r'(?m)(?<!\\)%.*$')

From wanshuiyin/Auto-claude-code-research-in-sleep, MIT.

More from wanshuiyin/Auto-claude-code-research-in-sleep