Implement constitutional RQGM and Manuscript Complete

.githooks/pre-commit

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+repository="$(git rev-parse --show-toplevel)"
+configured_site="$(git config --local --get ari.sitePrivacy.config || true)"
+site_config="${ARI_PRIVATE_SLURM_SITE_CONFIG:-${configured_site:-${repository}/workspace/openroad-slurm-site-v1.json}}"
+privacy_required="$(git config --local --bool --get ari.sitePrivacy.required || true)"
+
+# A clone without private scheduler configuration has no local identity to
+# compare.  Operators using another ignored/out-of-tree file set the variable
+# above.  In the configured promotion clone this is a mandatory staged-blob and
+# worktree-candidate scan before every commit.
+if [ ! -f "${site_config}" ] && [ "${privacy_required}" = "true" ]; then
+    printf '%s\n' 'site-privacy-audit: FAIL (required private configuration is unavailable)' >&2
+    exit 1
+fi
+if [ ! -f "${site_config}" ]; then
+    exit 0
+fi
+
+exec python "${repository}/ari-skill-tool-registry/scripts/check_site_privacy.py" \
+    --repository "${repository}" \
+    --site-config "${site_config}"

.github/dependabot.yml

@@ -14,11 +14,8 @@
 #     (a Virtual-Scientists fork) and ari-skill-paper-re/vendor/paperbench
 #     (openai/preparedness) are pinned external forks; auto-bumping their
 #     submodule SHAs is undesirable.
-#   * pip "/ari-skill-orchestrator" is NOT listed. That one skill ships no
-#     pyproject.toml (13 of 14 skills have one); pointing Dependabot at a
-#     missing manifest would error. Only first-party directories are listed,
-#     so the vendored pyproject.toml files under the two vendor/ submodule
-#     trees above are also excluded.
+#   * Only first-party directories are listed, so vendored pyproject.toml files
+#     under the two vendor/submodule trees above are excluded.
 #   * docker ecosystem is NOT added. There are no in-tree Dockerfiles outside
 #     vendor/ (containers/ holds only a README).
 #
@@ -45,10 +42,9 @@ updates:
       - "github-actions"
 
   # --- Python (pip) ---------------------------------------------------------
-  # One block covering the 15 verified first-party manifest directories:
-  # the root requirements.txt, ari-core, and the 13 skills that ship a
-  # pyproject.toml. ari-skill-orchestrator is intentionally absent (no
-  # manifest). Minor/patch bumps are grouped per directory to cap PR volume
+  # One block covering the 17 verified first-party manifest directories:
+  # the root requirements.txt, ari-core, and all 15 skills. Minor/patch bumps
+  # are grouped per directory to cap PR volume
   # across the tree; a low open-PR limit adds a second guardrail.
   - package-ecosystem: "pip"
     directories:
@@ -60,10 +56,12 @@ updates:
       - "/ari-skill-hpc"
       - "/ari-skill-idea"
       - "/ari-skill-memory"
+      - "/ari-skill-orchestrator"
       - "/ari-skill-paper"
       - "/ari-skill-paper-re"
       - "/ari-skill-plot"
       - "/ari-skill-replicate"
+      - "/ari-skill-tool-registry"
       - "/ari-skill-transform"
       - "/ari-skill-vlm"
       - "/ari-skill-web"

.github/workflows/contracts.yml

@@ -106,6 +106,17 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
+      - name: Install manifest validation dependencies
+        run: python -m pip install pydantic pyyaml
+      - name: Canonical Skill manifest conformance
+        # Hard gate: an invalid/unversioned manifest, runtime tool drift,
+        # workflow drift, version drift, generated mcp.json drift, or a
+        # default-enabled collision is an admission failure.
+        run: python scripts/check_skill_manifests.py
+      - name: Generated Skill and execution schema drift
+        run: python scripts/sync_skill_metadata.py
+      - name: Generated HPC contract schema drift
+        run: python ari-skill-hpc/scripts/sync_contracts.py
       - name: MCP tool-schema snapshot verify (advisory at Stage 1)
         continue-on-error: true
         run: python scripts/snapshot_contracts.py --surface mcp --check

.github/workflows/manuscript-complete.yml

@@ -0,0 +1,45 @@
+name: manuscript-complete
+
+on:
+  pull_request:
+    branches:
+      - main
+      - refactoring
+  workflow_dispatch:
+
+jobs:
+  release-evidence:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+      - name: Install runtime and test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install -e ari-skill-memory
+          pip install -e ari-skill-hpc
+          pip install -e ari-core
+          pip install scipy numpy pandas
+          pip install pytest pytest-asyncio pytest-mock respx
+      - name: Run revision-bound Manuscript Complete release gates
+        env:
+          ARI_MANUSCRIPT_RELEASE_DIR: ${{ runner.temp }}/manuscript-complete-release
+        run: |
+          python scripts/run_manuscript_complete_release.py \
+            --output-dir "$ARI_MANUSCRIPT_RELEASE_DIR" \
+            --require-clean --require-ci --keep-going
+      - name: Upload retained release evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: manuscript-complete-release-${{ github.sha }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/manuscript-complete-release
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/skill-tests.yml

@@ -0,0 +1,79 @@
+# Skill test suites.
+#
+# WHY THIS EXISTS: CI ran `pytest ari-core/tests/` and one prompt test only.
+# `scripts/run_all_tests.sh` (ari-core + 12 skill suites) was invoked by no
+# workflow, so every `ari-skill-*/tests/` directory was dead in CI. Concretely,
+# four of five regression tests written for a batch of shipped-falsehood bugs
+# lived in skill suites and were therefore unguarded:
+#
+#   ari-skill-paper/tests/test_claim_links.py       LaTeX exponent misparse +
+#                                                   the formula-vocabulary check
+#   ari-skill-evaluator/tests/test_s2p_tools.py     a no-op review fabricating
+#                                                   "resolved 2 overclaims"
+#   ari-skill-web/tests/test_collect_references.py  round-1 relevance filter
+#   ari-skill-memory/tests/...                      provenance phantom-missing
+#
+# SCOPE: the skills whose tests guard cross-package contracts, and whose deps
+# are light. `ari-skill-paper-re` is deliberately excluded — it vendors
+# PaperBench via a git+chz pull that the sibling jobs explicitly avoid for job
+# time; add it behind a separate scheduled job if that changes.
+#
+# ISOLATION: each suite runs in its OWN pytest process, because every skill
+# ships its server as `src/server.py` and a shared process lets the first
+# import poison every later `from src.server import ...` (and any
+# `mock.patch('src.server.X')` in a sibling). That is the same reason
+# scripts/run_all_tests.sh forks per path; this job reuses that script so the
+# two cannot drift.
+
+name: skill-tests
+
+on:
+  pull_request:
+    branches:
+      - main
+      - refactoring
+
+jobs:
+  skill-suites:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          # Runtime deps (mcp, letta-client, websockets, ...) live in the repo
+          # root requirements.txt; mirrors refactor-guards.yml:36.
+          pip install -r requirements.txt
+          # Editable installs in dependency order: skill-memory first (ari-core
+          # imports it directly), then core. ari-core must be importable because
+          # the paper skill now reads the gate's formula vocabulary through
+          # `ari.public.claim_gate` — the seam whose absence let a producer emit
+          # tokens the consumer never knew.
+          pip install -e ari-skill-memory
+          pip install -e ari-core
+          pip install scipy numpy pandas
+          pip install pytest pytest-asyncio pytest-mock respx
+      - name: Run the skill suites (one process per skill)
+        run: |
+          export HOME="$RUNNER_TEMP/fake_home"
+          mkdir -p "$HOME"
+          status=0
+          for path in \
+            ari-skill-paper/tests \
+            ari-skill-evaluator/tests \
+            ari-skill-web/tests \
+            ari-skill-plot/tests \
+            ari-skill-memory/tests \
+            ari-skill-transform/tests \
+            ari-skill-replicate/tests ; do
+            echo "::group::pytest $path"
+            # -p no:randomly: ari-skill-web's collect_references tests share
+            # module-level monkeypatched search stubs and are order-sensitive.
+            pytest "$path" -q -p no:randomly || status=1
+            echo "::endgroup::"
+          done
+          exit $status

.gitignore

@@ -30,6 +30,9 @@ slurm-*.out
 # Checkpoint directories (generated at runtime)
 *_ckpt_*/
 checkpoints/
+# Versioned migration fixtures exercise legacy checkpoint readers in CI.
+!/ari-core/tests/fixtures/checkpoints/
+!/ari-core/tests/fixtures/checkpoints/**
 output*/
 results*/
 
@@ -41,6 +44,11 @@ benchmarks/
 *.f90
 *.def
 *.sbatch
+# Deterministic source/data fixtures exercised by assurance and RQGM CI.
+!/ari-core/tests/fixtures/assurance/native_reference_candidate.c
+!/ari-core/tests/fixtures/knowledge/intel_performance_patterns_clean_task.c
+!/ari-core/tests/fixtures/rqgm_eval/metric_gaming/experiments/
+!/ari-core/tests/fixtures/rqgm_eval/metric_gaming/experiments/**
 
 # Dynamic YAML/scripts generated per-experiment
 *_paper.yaml
@@ -73,6 +81,11 @@ Thumbs.db
 !/containers/README.md
 /ari-core/containers/*
 !/ari-core/containers/README.md
+# Runtime workspaces also hold private scheduler site selectors. Physical
+# cluster/partition/node names stay here; tracked locks contain only a salted
+# site-identity digest. The repository pre-commit hook and promotion commands
+# scan both worktree candidates and staged Git blobs against the ignored site
+# configuration; never use `git add -f` for any file below this directory.
 workspace/
 *.sif
 
@@ -92,6 +105,8 @@ ari-core/checkpoints/
 # ── Runtime / temp files (generated at runtime, never track) ────
 experiment.md
 ari-core/experiment.md
+# The migration contract intentionally contains historical experiment.md.
+!/ari-core/tests/fixtures/checkpoints/v0_7_golden/experiment.md
 tmp*.md
 GUI_TASK.md
 *_TASK.md