wanshuiyin/Auto-claude-code-research-in-sleep

📰 ARIS-Code v0.4.28 (2026-09) — latest: ARIS_REASONING_EFFORT works on the Anthropic channel (#446), tool calls through relays that send a {} placeholder no longer fail (#444), and the OS proxy on Windows / macOS is used without exporting HTTPS_PROXY (#401). v0.4.27: launching and quitting the REPL no longer leaves an empty session file, and /resume lists only sessions with messages (#439 follow-up). v0.4.26 made Fable 5.1 the fable alias and the first /model entry (the default executor stays Opus 5). v0.4.25 is the reviewer-bridge release: codex-cli 0.154 removed codex mcp-server, so every Codex review from ARIS-Code died on an updated codex. The reviewer now runs over a built-in codex exec bridge — no mcpServers.codex entry, old entries migrate in memory, thread records interoperate with ARIS's Python bridge. Also: /since replays everything after your last input (folded like the live display, /since full for complete output), /resume lists sessions with indices and shows where you stopped (#439), Windows multi-line paste no longer submits line by line (#430, pending confirmation), the Windows shim message carries the native installer (#428), and the bundle moves to 83 skills on GPT-6-Astra. Recent headliners: v0.4.24 — Claude 5 model refresh (Opus 5 default, Fable 5 tier, availability chain) and v0.4.23 — output folding. Caps a 24-release run (v0.4.5 → v0.4.28); per-release detail below. Credits: @GetIT-Sunday, @Anduin9527, @GO-player-hhy, @Jxy-yxJ, @screw-44, @StevenUST, @opposj, @ShijunLei-cn, @algojogacor, @YukinoshitaLove, @jinliye-2026, @SajimJC, @JasmineLCY.

Per-release details (v0.4.5 → v0.4.28)

v0.4.28 (2026-09-28) — ARIS_REASONING_EFFORT now works on the Anthropic channel (#446): low / medium / high / xhigh / max for the main session and subagents; unset, requests are unchanged. ARIS_MAX_TOKENS raises the output cap when a high effort runs into it. autoCompactEnabled: false in settings turns automatic compaction off. 🐛 #444 tool calls through relays that send a {} placeholder no longer fail with invalid tool input JSON. 🌐 System proxy on Windows / macOS is used without exporting HTTPS_PROXY (#401, by @JasmineLCY); NO_PROXY=* connects directly as before. Upgrading: if you already export ARIS_REASONING_EFFORT, have an OS proxy, or have autoCompactEnabled: false in settings, read the upgrade notes.

v0.4.27 (2026-09-19) — launching and quitting the REPL no longer leaves an empty session file; /resume lists only sessions with messages (#439 follow-up).

v0.4.26 (2026-09-16) — Fable 5.1: the fable alias now resolves to claude-fable-5-1, /model lists Fable 5.1 first (Fable 5 stays selectable) and the system-prompt identity names it; the default executor remains claude-opus-5 (the Mythos tier is $10/$50 vs Opus 5's $5/$25, so the default does not move). Saved executor_model values are ids, not aliases, and are untouched. Pricing already matched on fable; a test pins 5.1. Tests unchanged (aris-cli 225 + 4 e2e / runtime 252 / tools 71 / commands 6). Codex MCP (gpt-6-astra xhigh) gate: GO.

v0.4.25 (2026-09-16) — the reviewer-bridge release. codex-cli 0.154 removed codex mcp-server, the entry point ARIS-Code's aris setup had written into settings.json for every Codex review; on an updated codex every review call died. Built-in codex exec bridge: mcp__codex__codex / codex-reply run as codex exec --json with nothing to register — no settings entry, a legacy codex mcp-server entry is migrated in memory (env, -c defaults, requestTimeoutSecs, trust kept), an explicit Python-bridge entry is used as configured, thread records share ~/.codex/state/codex-exec/threads/ with the Python bridge, 1800 s budget for ultra audits, ARIS_CODEX_BRIDGE=0 restores the old path; aris doctor prints the effective backend. Found on the way: the model never received a Codex result's threadId (it lives only in structuredContent), so codex-reply could not continue a thread — results now start with a threadId: line. /since [full] replays the user's last input and everything after it with the live formatters (display only; after /resume and in --resume batch mode too); a dim hint after turns with ≥ 8 tool calls (ARIS_TURN_SUMMARY=0). #430 Windows consoles deliver no paste event, so each pasted line became its own Enter — lines are now merged into the input and never auto-submitted, Ctrl+C discards the rest (ARIS_PASTE_BURST=0; inferred from crossterm's source, pending confirmation on a Windows machine). #439 /resume lists sessions with [n] indices and ages and accepts an index, a unique id prefix or a path; the last turn is replayed after loading. #428 the .cmd-shim message carries the official native installer one-liner. Bundle 81→83 (pin 3e49e63 → 4734364): /proof-orchestrator, /research-implement-feature, 32 helpers (+review_gate.py, copilot_native_evidence.py, idea_discovery_gate.py), repo-root templates/ bundled; reviewer doctrine and system prompt on gpt-6-astra (fallback gpt-5.6-sol → gpt-5.5), explicit — reviewer: directives win, LlmReview results carry reviewer_model: so HTTP rounds report to review_gate.py truthfully; gpt-6-astra pricing tier $10/$50 (cache write $12.50, read $1). Tests: api 35+6 / aris-cli 225 + 4 e2e / runtime 252 / tools 71 / commands 6, all green; live codex exec fresh + resume roundtrip on codex-cli 0.154.0. Codex MCP (gpt-6-astra): ultra design gate (2 rounds), xhigh implementation gate per step (5/2/2/2 rounds), final whole-diff gate (2 rounds) → GO.

v0.4.24 (2026-08-09) — the Claude 5 model refresh (#392, requested by @YukinoshitaLove). Explicit --model claude-opus-5 / claude-fable-5 already passed through on every platform — this release makes them first-class. Default → claude-opus-5 (main session, subagents, aris setup; same $5/$25 tier as Opus 4.8); the v0.4.18 availability fallback becomes an ordered chain walk (Opus 5 → Opus 4.8 → Opus 4.7, one step per precise 404 not_found_error, explicit choices never silently change) — the naive constant swap would have stranded 4.7-only accounts and configs saved by v0.4.23's setup, a regression the cross-model review caught and an end-to-end mock-404 chain test now locks. /model picker adds Fable 5 / Opus 5 / Sonnet 5; new fable alias. New Mythos-class pricing tier (fable/mythos = $10/$50, cache write $12.50 / read $1, verified 2026-08 — previously fell to the conservative $15/$75 unknown-model tier, a 1.5× over-estimate); Opus 5 / Sonnet 5 pinned on their existing branches. Tests: api 41 / aris-cli 213 + 4 e2e / runtime 226 / tools 70 / commands 5, all green; live smoke on claude-opus-5, claude-fable-5 and the fable alias. Codex MCP (gpt-6-astra xhigh) implementation gate: NO-GO → NO-GO → GO.

v0.4.23 (2026-08-02) — the output-folding release (top real-user complaint: "aris dumps thinking and the full content of documents it reads onto the screen"). 🧹 Tool-output folding, display layer ONLY: the disk-verified culprits were format_read_result appending the ENTIRE read payload, bash pushing full stdout/stderr, grep dumping its full content blob, and the edit preview capping line counts but not line LENGTH. Now Read/Grep show the first 6 lines, Bash shows first 4 + last 4 per stream (stderr keeps its red), each kept line capped at 240 chars (the minified-single-line case), then one dim "… (+N more lines — set ARIS_TOOL_OUTPUT_LINES=0 for full output)" hint. ONE env knob: unset = defaults, a positive integer overrides every tool, 0 = the exact old display; the session, model context, --output-format json and /export are untouched and always complete. Thinking was verified to never print (Anthropic deltas only accumulate; Kimi reasoning_content only feeds the replay cache — the "thinking dump" perception came from the document dumps); two end-to-end sentinel tests (real binary vs mock SSE server) lock that thinking/reasoning never reaches the terminal. Interactive expand/collapse was deliberately rejected as over-engineering. 🐛 Bash timeout now kills the command: a timed-out call reported interrupted: true while the dropped tokio future left the child RUNNING — side effects landed after the report; now kill_on_drop (escape hatch ARIS_BASH_KILL_ON_TIMEOUT=0; background tasks untouched; locked by a real behavioral test — a timed-out "sleep 1 && touch marker" must not create the marker). 📦 Bundle 79→81 (pin 7182624 → 3e49e63): /integrity-forensics — the Anti-Autoresearch SHA-pinned thin launcher (span-anchored evidence ledger → GPT auditors propose → deterministic rules-only adjudicator decides → typed BLOCK/WARN gate + obligations ledger) — and /web-debug-search, +tools/forensics_gate.py (29 helpers, 104 embedded resources). 🎁 Also: grep's content mode no longer shows a false "0 matches" above real results (the gate caught that "numMatches": null serializes with the key present, defeating a naive presence check); all four crates' local-mock-server tests are now proxy-immune (a shell with http(s)_proxy set used to turn 15 tests red on a released tag — 127.0.0.1 was routed through the proxy). The rest of the runtime-state package (compaction re-arm, failed-turn cleanup, /cost dollars, SSE tail) ships as v0.4.24 — the cached-token cost fix is deliberately held back because it changes what the compaction trigger measures. Tests: api 41 / aris-cli 212 + 3 e2e / runtime 225 / tools 69 / commands 5 (+13), all green under a live proxy; new-code clippy delta zero. Codex MCP (gpt-6-astra): ultra scope+design adjudication, then a 3-round implementation gate (round 1 caught the null-serialization defeat and a non-hermetic behavioral test; round 3 GO).

v0.4.22 (2026-07-12) — the skills-resync + GPT-6-Astra release. 📦 Bundle resync (pin 7e3ab67 → 7182624, 93 commits): 79 bundled skills (+meta-apply, +paper-poster-html; paper-poster retired to a redirect stub), 28 tools helpers (8 new: capture_filter, evidence_check, iteration_log, provenance, run_state, threat_scan, meta_opt/trigger_eval + sample evals), 11 new shared-references docs (fan-out-pattern, acceptance-gate, external-cadence, skill-governance, compute-env-contract, resumable-runs, evidence-precheck, injection-hygiene, capture-antipatterns, output-composition, taste-calibration); sync hardening — ARIS_SYNC_EXPECT_SHA guard (aborts before touching assets if main moved; it caught a real move on first use) + exact-inventory drift tests + the vendored posterly MIT license text now ships. 🎛 GPT-6-Astra two-tier reviewer alignment: the CLI's system-prompt nudge now passes the skills' explicit model: gpt-6-astra + per-call effort pins through (the v0.4.17 blanket "never pass a model" rule would have silently stripped deep audits from ultra to xhigh), carries the canonical capability-only fallback chain (effort-unsupported → same model xhigh, deep tier only; model-unknown → explicit gpt-5.5+xhigh; never degrade on transport-class errors; an explicit call-level override disables the chain), pins approval-policy: "never" + explicit sandbox on every fresh codex call, and makes the HTTP fallback pre-dispatch-only with parameter stripping; the HTTP LlmReview default deliberately stays gpt-5.5 pending a real smoke; gpt-5.6 family pricing (sol $5/$30, terra $2.50/$15, luna $1/$6) verified against the official page; banner/Reviewer display//reviewer are honest about primary-vs-fallback (pure-Codex setups get status + guidance instead of a fake picker). 🐛 8 verified fixes: explicit --model was silently overridden by the saved executor model (model provenance now tracked end-to-end; the 4.8→4.7 availability fallback respects explicit choices; /model and /setup re-arm it); saved models no longer leak across provider transports (blank saved models count as absent; OpenAI transport with no model source fails fast; the first-run wizard's config now actually feeds startup model resolution); --output-format json never prompts (locked by a real end-to-end binary test against a mock SSE server); Windows aris login fixed (PKCE randomness read /dev/urandom → getrandom); Windows command probing fixed (the PowerShell tool probed itself through sh; now where.exe); codex .cmd shims classified honestly (three-state probe; setup requires explicit confirmation before writing a config the MCP client can't spawn); nested config.json warns instead of silently parsing to all-defaults; NotebookEdit mints collision-free cell ids. 🖥 New windows-latest CI job (workspace compile gate + three targeted test groups, each guarded against silent 0-test green). Tests: api 41 / aris-cli 204 + 1 e2e / runtime 223 / tools 69 / commands 5 (+54), all green; new-code clippy delta zero. Codex MCP (gpt-6-astra): ultra design gate — 5 rounds, NO-GO ×4 → GO — then a 3-round implementation gate whose round 2 caught a first-run config-wiring blocker before it shipped; 4 implementation subagents, every report disk-verified.

v0.4.21 (2026-06-28) — bug-fix patch: 5 new user-facing bugs from a Codex adversarial hunt (all disk-verified, distinct from v0.4.20), each cross-model reviewed at a design gate and an implementation gate (gpt-5.5 xhigh; both started NO-GO — the reviewer caught an off-by-one in the grep line-mapping and a missing stream-level test before GO). 🐛 Headline: OpenAI-compatible streaming corrupted multi-byte UTF-8 (CJK / emoji) split across network chunks into � — each HTTP body chunk was from_utf8_lossy'd independently, so a 3-byte Chinese character or 4-byte emoji straddling a chunk boundary broke on both sides (a frequent hit for Chinese users on domestic OpenAI-compatible providers — Kimi/GLM/MiniMax/DeepSeek/Qwen/Doubao — streaming Chinese text); the stream buffer is now raw bytes, decoding only complete SSE lines. A saved OpenAI/custom executor config no longer overrides a shell-set EXECUTOR_PROVIDER — the startup "shell-provided vars win" path had one ungated write that re-pointed EXECUTOR_PROVIDER=anthropic … aris … to OpenAI (wrong executor / model-not-found). An Anthropic stream truncated after content but before a terminal signal now hard-errors (premature_eof) instead of saving a half-finished answer to history as a complete turn (symmetric to the OpenAI #249 guard; the stop_reason-only compat path is preserved, and ARIS_ALLOW_EOF_WITHOUT_STOP=1 opts a terminal-signal-less proxy back into the old behavior). grep_search with multiline: true now matches across lines in content mode (was silently empty — count mode already worked). MCP tool results carried only in structuredContent (empty content) are no longer dropped — the model gets the JSON structured payload. Tests (CI mode): api 32→35 / runtime 205→212 / tools 67 / aris-cli 172→181 / commands 5 (+21, incl. 2 stream-level integration tests), all green. Codex MCP (gpt-5.5 xhigh): design gate (NO-GO → GO after fixing the off-by-one) → implementation gate (NO-GO → GO after adding the stream-level integration tests); the Anthropic streaming spec (every stream ends with message_stop) was WebFetch-verified. Two latent-only candidates (Anthropic block-index routing, OpenAI multi-line SSE) remain deferred.

v0.4.20 (2026-06-19) — bug-fix patch: 7 user-facing bugs surfaced by a Codex adversarial hunt, each reviewed across 3 rounds (the reviewer caught a redraw gap, a trailing-blank, a spinner tail, and a blank-line edge before GO). 🐛 Headline (#299): short REPL replies showed only "✔ Done" — the spinner draws "⠋ Thinking…" with Save/RestorePosition so streamed output overwrites it on the same line, but finish then cleared that whole line, erasing a short single-line reply. The REPL now finishes without clearing when the turn printed visible text (Clear(UntilNewLine) wipes only the spinner tail after the reply). Streamed multi-paragraph replies rendered glued ("para1para2") — each chunk's paragraph separator was trimmed at the stream boundary; the markdown streamer now preserves separators via a held-separator so streamed output equals a single full render (no dangling blank line). Markdown tables with CJK/fullwidth content misaligned — width now counts display cells (CJK = 2), not chars. aris "prompt" / --print ignored the executor model saved by aris setup (REPL-only before) — a configured OpenAI/custom executor got the Anthropic default sent to its endpoint; the one-shot and REPL paths now share one resolver. Esc now actually closes the completion dropdown (it was recomputed right back). glob_search reports the total matched count when truncated (not the capped 100, which made the model think a 1000-match glob had 100 files). /model's custom menu reads the effective env the executor uses, not stale on-disk config. Tests (CI mode): api 32 / runtime 205 / tools 67 / aris-cli 172 / commands 5, all green; +7 new; real-machine verified (short reply renders + "✔ Done"; paragraphs keep their blank lines). Codex MCP (gpt-5.5 xhigh): hunt → 3 review rounds (NO-GO → NO-GO → GO). Two latent-only candidates (Anthropic block-index routing, OpenAI multi-line SSE) deferred to a hardening pass.

v0.4.19 (2026-06-14) — honesty / guardrails patch (theme from a Codex fresh-eyes audit; no behavior change for healthy setups). 🔴 MCP protocol-version negotiation guard — the stdio handshake requested 2025-03-26 but never read the version the server negotiated back (a parsed-but-dead field), so a server agreeing on a version ARIS can't speak was silently accepted and later tools/list / tools/call ran on an incompatible protocol with opaque failures. ARIS now validates the negotiated version against a supported set (2025-11-25 / 2025-06-18 / 2025-03-26 / 2024-11-05 — stdio framing is identical across these) and, on an unsupported one, terminates the child + clears the slot + surfaces a clear per-server error (aris doctor shows it) — the "terminate when versions can't be agreed" behavior the MCP lifecycle spec requires. The request stays 2025-03-26 (proven against codex mcp-server), so healthy servers are unaffected — verified end-to-end: the real Codex MCP server still spawns + initializes + advertises its tools under the guard. 🧹 Papercuts: the OpenAI-family subagent fail-loud message dropped its stale "lands in v0.4.18" marker (now version-agnostic + actionable, still credential-free); OpenAI upstream error bodies are now truncated (500 chars) + credential-redacted (sk-… keys and Bearer … tokens, via a substring scanner that catches the compact-JSON shape {"api_key":"sk-…"} a misconfigured proxy can reflect back) instead of splatted verbatim; the system-prompt hook-events summary now counts only the hooks the runtime actually executes (a command hook with a command string), matching the parser. Tests (CI mode): api 32 / runtime 204 / tools 67 / aris-cli 167 / commands 5, all green; live smoke confirms the real Codex MCP server still initializes under the guard. Reviewed by Codex MCP (gpt-5.5 xhigh): design GO → impl NO-GO (compact-secret miss + command-string strictness) → GO after fixes.

v0.4.18 (2026-06-14) — default model → Claude Opus 4.8, with corrected pricing and a safety net. The bump moves DEFAULT_MODEL, the opus alias, the model picker, aris setup, and the subagent default to claude-opus-4-8 — with an availability fallback: if the account lacks 4.8 (the API returns 404 not_found_error), ARIS auto-falls-back to claude-opus-4-7 for the session, rebuilds the system-prompt model identity so it stays coherent (the model is never told it's 4.8 while served 4.7), warns once, and retries — for the main session (text + JSON) and subagents. It fires only on that precise 404 (never 400/rate-limit/auth), latches against loops, and the text path rebuilds from a pre-turn snapshot so a retry never double-appends the user message; accounts with 4.8 are byte-identical to a plain bump. 💰 Pricing corrected (verified against Anthropic's published schedule; had been a 3–5× over-estimate): current Opus 4.5–4.8 = $5/$25 (deprecated Opus 4/4.1 keep $15/$75, split by word-boundary so a future opus-4-10 isn't mis-tiered); Sonnet 4.x = $3/$15 (decoupled from the generic unknown-model fallback, which stays $15/$75); Haiku was already correct. 🧹 Backlog: aris setup option 10 pins the Codex MCP reviewer to model_reasoning_effort="xhigh" (deterministic for new setups, independent of ~/.codex/config.toml; idempotent merge never clobbers an existing entry); a startup + aris doctor misconfig hint (#259) for a silently-ignored/misplaced config (malformed JSON, or a stray ~/.aris/config.yaml — stderr-only so --print/JSON stdout stays clean); the system-prompt hook summary now marks parsed-but-never-fired events "PARSED ONLY … will NOT run" instead of implying dead hooks run (full event expansion — actually firing SessionStart/SessionEnd/… — deferred to a separate issue). Tests (CI mode): api 32 / runtime 202 / tools 67 / aris-cli 166 / commands 5, all green; a live one-shot smoke returns model=claude-opus-4-8 end-to-end. Reviewed by Codex MCP (gpt-5.5 xhigh) across the design + both implementation batches (design REWORK→GO, impl NO-GO→GO, batch-2 GO).

v0.4.17 (2026-06-13) — the MCP release. Before v0.4.17, mcpServers in settings.json parsed, showed in aris doctor, and did nothing; now ARIS spawns each configured stdio server, runs the MCP handshake, discovers tools, and advertises them as mcp__<server>__<tool> on both provider paths (Anthropic + OpenAI-family), with end-to-end dispatch, soft per-server degradation, and an approval gate for untrusted MCP tools (external processes the sandbox can't cover; --allowedTools now accepts mcp__ names). 🆕 zero-API-key cross-model reviewer: aris setup → option 10 (Codex MCP, ChatGPT subscription, no API key) writes an idempotent mcpServers.codex entry into the settings file the runtime actually reads (atomic write + backup, explicit consent before trust: true), with an optional API reviewer as fallback (ARIS_REVIEWER_PROVIDER=codex-mcp + ARIS_REVIEWER_FALLBACK_PROVIDER); /setup in-REPL rebuilds the system prompt + runtime so reviewer changes take effect without quitting. 🔴 Protocol fix the fakes couldn't catch: real-machine e2e against codex mcp-server exposed that our stdio transport spoke LSP-style Content-Length: framing while the MCP spec (and codex) use newline-delimited JSON-RPC — every fake-server test passed because the fakes spoke the same wrong dialect; writes are now NDJSON, reads auto-detect both, and the spec-mandated notifications/initialized is sent after initialize (a select-based round-trip also closes the #286 large-request deadlock). Hooks: object-style Claude Code hooks preserve matcher / timeout / async (anchored-regex matcher filtering; per-hook timeout, default 30 s kill = warning not deny). Long tail: ARIS_DISABLE_KEYCHAIN gate, Anthropic stop_reason clean-EOF symmetry (CL2), OpenAI tool-call index-missing merge-by-id (OE6), slash commands enter history. Real-machine push-gate hardening (the zero-key reviewer's first run): codex codex/event notification spam silenced by default (gated behind ARIS_MCP_STDERR=inherit), the system prompt now tells the model not to pass a model parameter to Codex (account default = gpt-5.5 + xhigh; arbitrary names are rejected by a ChatGPT account), and a Codex-MCP-primary-with-no-fallback LlmReview call returns a clear "use mcp__codex__codex" message instead of a misleading OPENAI_API_KEY/gpt-5.5 error. Built with the v0.4.16 zero-regression methodology (24 new characterization tests; every deliberate flip annotated in-place). Tests (CI mode): runtime 199 / aris-cli 165 / tools 67 / api 30 / commands 5, all green. Reviewed phase-by-phase by Codex MCP (gpt-5.5 xhigh) across 17 rounds (7 NO-GOs all resolved). Subagent MCP routing (P8) + MCP protocolVersion bump + hook async execution deferred to v0.4.18.

v0.4.16 (2026-05-30) — REPL UX + provider hardening, shipped under a zero-regression discipline: 64 characterization ("golden") tests locked the current provider-routing / pricing / reviewer / subagent / REPL behavior first, then stayed green through every change. Closes #274: command history now persists to ~/.config/aris/history (0600) and reloads on startup, with an ARIS_NO_HISTORY kill-switch and a disk-only secret-skip (credential-looking lines stay in in-session history but never touch disk); bash-style Ctrl+R reverse incremental search (CJK display-width-aware single-line render; no existing key binding changed; no new dependency). Security: an OpenAI-family main session (Kimi / GLM / MiniMax / …) spawning a subagent previously silently billed the user's Anthropic OAuth/Keychain credential — it now fails loud with a clear, credential-free error; full OpenAI-family subagent routing is a cross-crate change deferred to v0.4.17. Groundwork (no behavior change): the 3 byte-identical word-boundary matchers consolidate into one canonical runtime::word_match; new pure ProviderFamily classifier (unwired). Tests (CI mode): runtime 164 / aris-cli 128 / tools 49 / commands 5, all green. Codex MCP (gpt-5.5 xhigh) reviewed each phase + a final integration pass.

v0.4.15 (2026-05-29) — OpenAI-compatible streaming robustness hotfix. Closes #249: MiniMax (and other OpenAI-compatible providers / proxies) were effectively unusable because the clean-EOF completion check treated the data: [DONE] SSE sentinel as the only authoritative signal. A non-empty choices[].finish_reason is the Chat Completions spec's terminal-chunk marker; [DONE] is a transport convention some compatible providers never emit (MiniMax sends finish_reason: "stop" then closes without [DONE]). The clean-EOF decision is now a pure, unit-tested stream_eof_action(...) that completes on EITHER [DONE] OR a non-empty finish_reason; reads are NOT stopped early at finish_reason (a trailing include_usage usage-only chunk is still consumed), genuine truncation still hard-errors, and a pre-output proxy abort still restarts. Coupled fixes: OE7 reads finish_reason before the delta guard (delta-less terminal choice); OE2 flushes pending tool calls on any non-empty finish_reason; OE4 surfaces a mid-stream error envelope as a hard error instead of silently dropping it; OE3 tolerates data:{...} without the space after the colon. +5 unit tests (77→82) extract the previously-untested SSE completion logic into pure helpers. Anthropic SSE path untouched. Codex MCP (gpt-5.5 xhigh) 3 rounds (GO-WITH-NITS → GO-WITH-NITS → GO).

v0.4.14 (2026-05-25) — Security-hygiene release closing the top items from the v0.4.13 codex audit (gpt-5.5 xhigh, 6/10 NEEDS-REWORK verdict). 🔴 S9 (P0) system-prompt config redaction — before v0.4.14, render_config_section() dumped the merged settings.json verbatim into the system prompt sent to the LLM provider, leaking env, mcpServers.<name>.headers.Authorization Bearer tokens, hook command env, signed-URL query params, and apiKey fields. New renderer whitelists top-level fields (model/permissionMode/theme/outputStyle/permissions/sandbox with recursive redaction inside), redacts sensitive keys (apikey/token/secret/password/authorization/headers/env/_KEY/_SECRET/_TOKEN), replaces MCP command with <configured> placeholder, reduces MCP url to strict <scheme://host[:port]> origin (scheme allow-list http/https/ws/wss, ASCII host, digit-only port, IPv6 brackets), and drops hook command strings entirely. Regression test exercises 9 distinct leak surfaces; URL parser has its own targeted test for 7 smuggling attempts including port-position secret injection (codex round-3 catch). 🟡 P9 (P1): DeepSeek aris --help now points at aris setup option 7 instead of an env-var path the resolver never honored. 🟡 M1/M2 (P1) doc: aris doctor + README/README_CN gain experimental warning whenever mcpServers.len() > 0 (full MCP tool dispatch lands v0.4.16). 🟢 C11 (P2) stream idle timeout — both Anthropic MessageStream and the OpenAI SSE loop wrap response.chunk().await in tokio::time::timeout (env ARIS_STREAM_IDLE_TIMEOUT_SECS, default 120, clamp [10, 1800], 0/negative disables); closes the "aris hangs forever with no output" symptom when an upstream HTTPS proxy holds a connection without keepalives. Bundle: 77 skills (+1 /wiki-enrich via late same-day sync to main 7e3ab67 which also picks up upstream check_ready.sh awk + grep-c null-match fix), 54 helpers. Codex MCP 6 rounds (NO-GO + 4 → GO-WITH-NITS + 3 → NO-GO + port smuggling → GO → release metadata GO → sync GO).

v0.4.13 (2026-05-25) — Residue-cleanup release closing every codex audit P1 carried since v0.4.10–v0.4.12, plus the long-tail regression tests. 🟡 v0.4.10 P1.D per-server MCP timeout — mcpServers.<name>.requestTimeoutSecs override > MCP_REQUEST_TIMEOUT_SECS env > 300s default (clamped 1..=1800), so one Codex MCP agent can run 5 min while filesystem MCP errors in 5 s. 🟡 v0.4.10 known limitation closed — McpStdioProcess::request() skips JSON-RPC notifications (id absent/null) and keeps reading until the correlated response. 🟢 meta_opt hook deploy via aris init — tools/meta_opt/{log_event,check_ready}.sh bundle into the binary; aris init writes ARIS-namespaced aris-meta-opt-log-event.sh / aris-meta-opt-check-ready.sh to ~/.claude/hooks/ (codex round-1 #1: never clobbers user hooks); settings.json merge idempotent, backups hard-fail, final rewrite atomic via tempfile + rename. 🧪 9 v0.4.12 targeted regression tests for sandbox.strictMode (3) + parse strictMode + provider_match pricing + has_word o-series + stream_options 400 + meaningful-content classification + premature-EOF retry truth table (codex round-1 #3 — should_retry_on_premature_eof() extracted to pure fn, 7-row test). Bundle: 76 skills, 54 helpers (+2 meta_opt scripts vs v0.4.12). Codex 3 rounds (NO-GO + 3 → NO-GO + metadata → GO).

v0.4.12 (2026-05-22) — Bug-fix + small-feature release. #238 sandbox.strictMode opt-in config key; when set, SandboxConfig::resolve_request() ignores all five LLM-supplied overrides (dangerouslyDisableSandbox, namespaceRestrictions, isolateNetwork, filesystemMode, allowedMounts) — closes the gap where a tool call could silently bypass user sandbox policy. aris doctor adds a "Sandbox:" row; bash tool schema documents the strictMode semantics. #232 auto-review-loop-llm updated from legacy deepseek-chat / deepseek-reasoner (deprecate 2026-07-24; reasoner rejects tool_choice) to deepseek-v4-flash / deepseek-v4-pro. v0.4.10 audit P1 follow-ups: P1.A Anthropic stream retry gates on has_emitted_meaningful_content (a stream that only sent MessageStart before EOF is retry-eligible); P1.B supports_reasoning_effort + reviewer mirror use word-boundary match so openai/o3-mini / proxy:o4 route correctly; P1.C stream_options.include_usage:true proxy fallback retries once without on real 400 unknown-field errors; P2 pricing match precision via provider_match() so qwen3.6-plus / kimi-k2.5 route correctly while my-kimi-clone does not. Skills sync (76 skills, 52 helpers): /interview-cheatsheet + /render-html newly bundled; build.rs ALLOWED_EXTS gains html for render-html templates; EXCLUDED_SKILL_PREFIXES → starts_with("skills-codex"). CI fetch-depth: 0 + origin/main fetch so drift-test ancestor check runs. Cross-reviewed by Codex MCP (gpt-5.5 xhigh) over 4 rounds.

v0.4.11 (2026-05-18) — Skills bundle refresh + sync infrastructure. The embedded skills set in the v0.4.10 binary had fallen behind main (~6 of 56 main skills/ commits had been cherry-picked); v0.4.11 syncs the full set and ships sync infrastructure so the gap can't silently reopen. Bundle: 65→74 user-facing skills, 34→49 helper resources. 10 new skills bundled: /citation-audit (fourth-layer bibliography audit), /experiment-queue (SSH multi-seed job queue with OOM retry), /kill-argument (two-thread adversarial review for theory papers), /resubmit-pipeline (W5: text-only port to a new venue), /paper-talk (end-to-end conference talk pipeline), /slides-polish (per-page Codex layout review), /overleaf-sync (two-way Overleaf Git-bridge), /gemini-search + /openalex (broader literature sources), /qzcli (Qizhi GPU jobs). 46 existing SKILL.md refreshed — most critically the canonical resolver chain rollout (closes real user incident where /research-wiki was empty for a week from hardcoded tools/research_wiki.py), submission assurance gate + external verifier (/paper-writing Phase 6 now functions). tools/ goes 9→18: 9 baseline helpers refreshed (research_wiki.py 315→767 lines with canonical ingest_paper API), 9 new helpers (extract_paper_style.py, figure_renderer.py, paper_illustration_image2.py, overleaf_{setup,audit}.sh, verify_wiki_coverage.sh, watchdog.py, experiment_queue/{build_manifest,queue_manager}.py). New tools/sync_main_skills.sh automates main → bundle rsync with symlink pre-flight + codex-mirror prune + SKILLS_SOURCE_COMMIT pinning. 3 new CI drift tests in crates/runtime/src/cache.rs cover all 4 resolver layer patterns. Gemini MCP calls in /research-lit and /gemini-search now pass model: 'auto-gemini-3' (avoids silent downgrade to 2.5-pro on OAuth-personal capacity exhaustion). CLI runtime unchanged — codex-audit P1 follow-ups remain on v0.4.12 backlog. Cross-reviewed by Codex MCP (gpt-5.5 xhigh) across 5 rounds (REQUEST CHANGES → APPROVE WITH NITS → NO-GO → GO → final GO).

v0.4.10 (2026-05-17) — Stream + MCP reliability + multi-provider pricing. C6 whole-stream restart in Anthropic MessageStream + OpenAI SSE loop on chunk decode failure / premature EOF (ARIS_STREAM_RETRY, default 2, clamp 0..=5, fires only when nothing emitted yet — closes #228-style "error decoding response body" loop). M3 MCP stdio gains 300s default tokio::time::timeout over send+read (override MCP_REQUEST_TIMEOUT_SECS, clamp 1..=1800); response.id ↔ request.id correlation; ensure_server_ready() try_wait() dead-process respawn; kill().await on all failure paths so the next call starts clean (closes #151 / #172 "Calling codex..." stalls). C8/P4 OpenAI streaming requests now send stream_options.include_usage:true + parse cached_tokens; Anthropic streaming merges MessageStart.usage (input/cache) with MessageDelta.usage (output). C9 multi-provider pricing registry (15+ models, OpenAI cache_read = input × 0.1 corrects 5× generic overstatement, DeepSeek cache_hit/cache_miss tiers, has_word() boundary matcher for provider/<model> slugs). 9 dead-code warnings cleared; aris setup help text synced with actual behaviour.

v0.4.9 (2026-05-17) — Closes Codex v0.4.7 audit residuals (L1 TLS double-stack, L3 reasoning_cache compaction misalign, L4 reasoning replay unbounded). 2 new skills bundled (/figure-spec + /paper-illustration-image2 with scripts/ subdirs, new Layer 0b = $ARIS_CACHE_DIR/skills/<name>/scripts/); research_wiki.py promoted to shared tools/ (9+ callers); 5 more SKILL.md migrated to fallback chain.

v0.4.8 (2026-05-17) — Skill helper subsystem rewrite. Bundled helpers extract to ~/.config/aris/cache/<version>/ at startup; every Skill invocation surfaces helperReport JSON + 4-layer resolver preamble; /skills export copies helpers; new integration-contract.md with 6 failure policies; 8 shared helpers (arxiv/deepxiv/exa/S2/openalex/save_trace/verify_papers/verify_paper_audits) bundled; /research-lit + /deepxiv migrated. Plus 4 bug fixes: gpt-5.5+tools 400 on OpenAI; Custom reviewer reset; missing signature field (#228); --version Build date hardcoded.

v0.4.7 (2026-05-16) — DashScope Coding Plan 405 fixed (#159) via native-tls switch (#225); reasoning_content replay for all reasoning models (OpenAI o1/o3/o4 / DeepSeek-R1 etc.), not just Kimi (#226); 600+ lines dead code cleanup + rustyline dep removed + "Claw Code" → "ARIS-Code" rebrand.

v0.4.6 (2026-05-14) — 🚨 Two long-standing silent bugs fixed: PermissionMode::Prompt silently allowed every tool (derived-Ord bug); system prompt hardcoded current_date = "2026-03-31" made models reject post-cutoff data as future/prompt-injection. Plus Custom OpenAI-compatible provider (/setup option 11) with dynamic /models discovery (@Anduin9527 #221 + #222).

v0.4.5 (2026-05-13) — First-class reasoning-model support: thinking content blocks end-to-end (fixes #161) + reasoning_effort='xhigh' for GPT-5.5 / o1 / o3 / o4 / DeepSeek-thinking. DeepSeek V4 Pro + Xiaomi MiMo + Qwen 3.6 + Doubao in /setup (options 7-10). Object-style hooks parser. Default model bumped to Claude Opus 4.7 + GPT-5.5. REPL input hardening (multi-line wrap / Cmd+V paste / CJK boundary). GitHub Actions CI. Credits: @GO-player-hhy (#186), @Jxy-yxJ (#171), @GetIT-Sunday (#216 partial).

Older versions

v0.4.4 (2026-04-20) — Setup UX + reviewer routing fixes (resolves #158, #162) | /setup no longer forces Bearer for Anthropic + custom URL | Provider-aware proxy URL hints | Stale state no longer leaks across provider switches | LlmReview smart fallback

v0.4.3 (2026-04-17) — Third-party Anthropic-compat proxy support (Bedrock etc.) | Skip beta flags that proxies reject | Propagate custom base URL for anthropic provider | Credit @screw-44

v0.4.2 (2026-04-17) — Auto-compaction corruption fix | Compaction summary preserved on OpenAI-compat executors | Shell-provided API keys no longer erased on launch

v0.4.1 (2026-04-15) — Plan mode (/plan) | Cooperative Ctrl+C interrupt | Auto-retry (429/5xx/network) | Research Wiki 📚 (persistent knowledge base) | Self-Evolution 🧬 (/meta-optimize) | Local models (LM Studio/Ollama) | 62 skills synced

v0.3.11 (2026-04-13) — Reviewer Anthropic-compatible mode (Claude via proxy)

v0.3.9 (2026-04-11) — Proxy/custom base URL (CCSwitch) | Local models (LM Studio/Ollama) | Windows (experimental)

v0.3.5 (2026-04-08) — Research Wiki (persistent papers/ideas/experiments/claims + relationship graph) | Meta-Optimize self-evolution (analyze logs → propose SKILL.md patches)

v0.3.0 (2026-04-03) — Multi-file memory index | Rich task system (TodoWrite) | /plan | Security hardening

v0.2.2 (2026-04-03) — /plan step-by-step planning | /tasks persistent tracking

v0.2.1 (2026-04-03) — Persistent Memory | Kimi K2.5 multi-turn fix | CJK cursor fix

v0.2.0 (2026-04-02) — Open source | Kimi + MiniMax + GLM support | Smart LlmReview routing | CI/CD

v0.1.0 (2026-04-02) — Initial release | Multi-executor & reviewer | 42 bundled skills

• 2026-09-07 — 🧠 Default reviewer is now gpt-6-astra. Every reviewer call that pinned gpt-5.6-sol now pins gpt-6-astra; the two effort tiers (ultra for the seven deep audits, xhigh everywhere else) are unchanged, and so is the executor — whatever agent you run ARIS in. No access to the model yet? The capability fallback tries gpt-5.6-sol, then gpt-5.5, both at xhigh — nothing to configure.

• 2026-09-06 — 🧹 The installer stops dropping Copilot profiles into every project (#431, thanks @oblivion-1521). Since 2026-08 every run symlinked two Copilot reviewer profiles into your .github/agents/ whether or not anything used them — dead files for Claude Code and Codex users, broken links if you committed them. Now they are deployed only while auto-review-loop is installed; --no-agent-profiles switches them off for good (undo with --agent-profiles). Your next re-run removes the links the installer created earlier; files you wrote yourself are never touched.

• 2026-09-03 — 📣 Papers are launches, not progress reports (rules adopted from anti-defensive-writing-Skill by @Adkid-Zephyr — 🌟 it). The writing contract gains four rules: organize the narrative around the strongest genuine advantage; pick the contest the paper wins; unfavorable numbers stay in the tables, explained as a tradeoff where the evidence supports that and stated neutrally where it does not — never narrated as a defeat; every experiment carries an argumentative duty or leaves the main line; abstract and introduction open with problem → gap → idea → strongest result, and the conclusion never ends on new self-negation. /auto-paper-improvement-loop flags the same defects. Indexed under Awesome Community Skills.

• 2026-08-26 — 🧯 Two over-defense leftovers (#425). /research-review — the one reviewer prompt that never got the scope-limits block — now carries it, and its brief ends with "if the work holds up, say so clearly" instead of bare brutality; the adversarial stance itself is untouched. /research-pipeline no longer dies overnight on a missing VENUE: ideas, experiments, analysis and the narrative report are venue-independent and run to completion — only paper formatting defers, stamped clearly for a later resume. It had also been declaring VENUE = ICLR while forbidding silent defaults; the default is gone.

• 2026-08-26 — ✍️ Papers stop reading like confession letters (#423, #424; several rules adopted from humanize-paper). Claims are stated at the strength the evidence earns; generic caveats ("further research is needed") live in Limitations only; "don't mention X" means X is absent — never "we do not address X" in print; results are ordered by argument, not by the order experiments ran.

• 2026-08-26 — 💡 The idea pipeline stops killing ideas for having neighbors (#419–#422; community reports). ABANDON now has to name the published paper that already contains your result, and concurrent work is a race — your call, not a veto. Brainstorming runs two generator models (gpt-5.6-sol + gpt-5.5) and unions their ideas, aiming for creative direct attacks instead of corner-case stacks. Search digs as hard as ever.

• 2026-08-21 — 🔌 Optional HTTP reviewer fallback for when Codex MCP is unreachable (#413; by @TheFlashForge). Off by default; fires only when Codex provably never got the request — a timeout doesn't count, that could pay twice for two conflicting verdicts. The fallback reads your actual files and gets less trust than Codex, never more.

• 2026-08-21 — 🧹 Four community fixes in one day (#406–#410; by @ZLZLGe and @JasmineLCY). AUTO_PROCEED=true now actually continues on its own; the idea-discovery gate demands a real reviewer receipt, not a checkbox; cached wiki context is scanned right before /idea-creator reads it; Codex users with Claude as reviewer get their three paper skills back.

• 2026-08-09 — 🦆 Copilot CLI defaults /auto-review-loop to its native rubber-duck reviewer (#360, closes #258). Active only inside Copilot CLI sessions; review evidence is revalidated from host events, and same/unknown-family fails closed. The standard Claude Code + Codex setup is untouched.

• 2026-08-09 — 🚧 /idea-discovery can no longer silently skip a stage (#383, closes #285; by @3mom3). Each of the five stages needs recorded evidence, or the report says BLOCKED instead of looking complete.

• 2026-08-05 — 🈶 The research wiki handles non-ASCII (#386, #387; reported by @LIMMIL7). cp936-written wikis were unreadable on other machines, and Chinese-only titles collapsed to <year>_untitled and got deduped away. Existing UTF-8 wikis unaffected.

• 2026-08-04 — 🖼️ Upstream spotlight: posterly — the engine behind /paper-poster-html — shipped a major design upgrade (MIT, by @Chenruishuo; ~50 posters at this year's ICML). GitHub · Blog.

• 2026-08-03 — 🧭 /proof-orchestrator — Workflow 7: proof campaigns with a memory (#381; by @shenmuxing, from their EtaSkill). Stateful local-first proof runs that continue across sessions, with a ready-to-paste GPT Pro handoff when a proof stalls. /proof-checker remains the submission gate.

• 2026-07-14 — 🐞 /web-debug-search (Issue #211). Adds a focused debugging/discovery workflow for GitHub Issues and Discussions: exact and normalized error-string matching, version compatibility tracking, and explicit failure handling. Results are labeled for debugging only and are not paper-citation evidence.

• 2026-07-14 — 🧩 Selective install + global helper pointer (#366). The 81 skills are no longer all-or-nothing — all four installers support group/skill-level picks (--list-groups, --groups X,Y, --skills X, --exclude Y, or a bare-TTY checkbox picker), with hard pipeline deps auto-included. Updates now confirm each NEW upstream skill individually (--add-new / --skip-new for scripting; declines are remembered and never re-asked). Also fixes copy installs (~/.claude/skills) losing helper-script resolution, via a new ~/.aris/repo pointer file. ⚠️ Backward compatible — --quiet fresh installs still install everything; run any installer/updater once to pick up the pointer file. Selective install →

• 2026-07-12 — 🛡️ Your paper now gets the reviewer-side forensics treatment before you submit (#357). New /integrity-forensics skill: a SHA-pinned thin launcher runs Anti-Autoresearch's hostile-reviewer sweep (evidence ledger, nine auditor dimensions, numeric core, rules-only adjudicator) on your paper first. The verdict feeds a typed gate — flags can block a submission, a clean sweep is recorded as "no new blocker" (never an acquittal) — and findings close only with typed, hashed evidence or a recorded human waiver (rewording the flagged sentence doesn't count; the ledger notices). /paper-writing runs it by default at submission assurance (— self_forensics: false opts out; the Codex mirror is opt-in and limited to upstream's deterministic slice, which can flag but never say CLEAN). ⚠️ First run clones and validates the pinned upstream (needs network); run bash tools/smart_update.sh --apply.

• 2026-07-10 — 🧠 Reviewer default is now GPT-5.6-Sol; deep audits think at the new ultra level (#354). codex-cli 0.144.1 added max/ultra reasoning above xhigh; ARIS reviews now default to gpt-5.6-sol, with the seven heavyweight verdicts (/proof-checker, /kill-argument, /research-review, /experiment-audit, /paper-claim-audit, /result-to-claim, /meta-apply) at ultra and everything else at xhigh. Older codex-cli or no model access steps down automatically (5.6-sol → 5.5, both xhigh) — never below xhigh, never on a mere timeout. Also fixed: /result-to-claim now stops honestly instead of judging its own results when the reviewer is unreachable. ⚠️ Upgrade codex-cli to ≥ 0.144.1, restart the session (MCP reloads only then), and run bash tools/smart_update.sh --apply.

• 2026-07-03 — 🧬 Three small updates adapted from Anthropic's Claude Science skills (#339, #340, #341; Apache-2.0). ARIS now has one shared way to describe GPU environments, so the same setup can be reused across SSH machines, Modal, and clusters, then checked by a fresh agent following the setup notes. We also added a small tool that tests whether a skill description actually makes the right skill get picked. Finally, figure and writing checks now separate facts from style: truth checks must pass, style advice stays optional. ⚠️ Run bash tools/smart_update.sh --apply to pull.

• 2026-07-02 — 🔁 Ideas from Karpathy's LOOPS.md, brought into ARIS (#333–#337). Reviewers now start by looking for what may be wrong, not by giving a polite score. If a review result looks strange, ARIS points you to the saved reviewer transcript before you ask the model again. A failed build can be restarted from the plan instead of endlessly patched, while plans, logs, and results are kept. Scoring can now use real good and bad examples, /meta-optimize asks what can be removed, and /paper-writing agrees on a clear "done" checklist before drafting starts. ⚠️ Run bash tools/smart_update.sh --apply to pull.

• 2026-06-20 — 📚 Research wiki: all four node layers now have deterministic writers — fixes "re-generated ideas not recorded" (#305, #306, #307, #308). A user hit a real bug — ideas recorded on the first /idea-creator run vanished on re-generation — because wiki pages were written freehand, a prose step the model skips on a re-prompt. Each layer now has a dedicated research_wiki.py writer joining ingest_paper: add_claim (claims born at /proof-checker), upsert_idea (/idea-creator), add_experiment (/result-to-claim) — each guarded by a drift-check so it can't silently regress to dead code. A claim's status is now a strict proof axis (verified/refuted/unproven/…) while experiment support is carried by supports/invalidates edges (closing a latent contradiction the shared validator rejected), and the Codex-CLI skill mirror is synced to match. Zero behavior change when no research-wiki/ is present.

• 2026-06-19 — 🛰 Overnight loops can now notice when they die or get stuck (#300, #301, #302; adapted from operational patterns in Deli Chen's AutoResearch). A new watchdog checks whether an unattended loop is still updating its state file and writes an alert when it goes quiet; it only reports the problem, never restarts a verdict-bearing run. A separate iteration log watches for rounds that stop finding anything new: two empty rounds force a change of direction, four call in a human, and the cross-model jury still decides whether the result is actually good enough.

• 2026-06-07 — 🖼️ /paper-poster-html is now the default poster pipeline; the old LaTeX /paper-poster is retired. It builds the poster as one HTML/CSS file at the venue's real print size, then runs measured layout and asset checks before a content reviewer sees it, so review time goes to the science instead of crooked columns. It also ships templates, reusable poster components, and venue token packs; the core gate machinery was adapted from posterly (MIT, by @Chenruishuo). ⚠️ /paper-poster now redirects to /paper-poster-html; the LaTeX pipeline lives only in git history.

• 2026-05-31 — 🤝 Two community tools worth a look. Claude Fleet (@tianyilt) is a local read-only dashboard for keeping track of many Claude Code / Codex windows at once. posterly (@Chenruishuo) builds conference posters as a single HTML/CSS file and exports a print-ready PDF through headless Chromium, no LaTeX needed. Both are listed under Awesome Community. 🌟 if they help you.

• 2026-05-31 — 🛰 Fourth reviewer backend: Gemini via Antigravity CLI (#267 by @ZGJY95). — reviewer: agy routes review through the Antigravity CLI for users without Codex MCP / Oracle — fail-closed on the cross-model invariant (recovers + verifies the real Gemini-family model, refuses non-Gemini, binds the recovered transcript to the call via a user-event nonce). Wired into reviewer-routing.md.

• 2026-05-29 — ⚙️ ultracode-native convention layer — fan out for breadth on any runtime tier, keep the cross-model jury sacred. Three new shared-references docs decouple breadth from verdict: fan-out-pattern.md (skills generate candidates across same-family Claude subagents — Tier-1 Workflow / Tier-2 Agent / Tier-3 sequential — all ending in the identical cross-model jury), acceptance-gate.md ("a loop can DRIVE, it cannot ACQUIT" — self-judge execution-completeness, never quality/correctness), and external-cadence.md (/loop & CronCreate are fire-control, never a jury). Wired into /idea-creator, /research-lit, /proof-checker, /kill-argument (fan-out) plus 16 skills (cadence fence/affordance). Also stripped 48 vestigial Agent grants (least-privilege + a drift-check guard), fixed /idea-creator's same-family idea pre-filter, and reconciled an /auto-review-loop OR→AND stop-condition inconsistency. Non-ultracode users benefit immediately — fan-out degrades to sequential with the same final jury.

• 2026-05-28 — 📝 First blog shipped: A Survey on Continuous DLM (2026 H1, 6 papers) — long-form bilingual technical survey by Ruofeng Yang (SJTU), written end-to-end through the ARIS-in-AI-Offer workflow (Claude Opus 4.7 + Codex GPT-5.5 xhigh + Gemini auto-gemini-3 cross-model discussion). Compares ELF, ByteDance Cola-DLM, and Flow-Matching family across discrete-DLM problems, the "known-unknown" continuous space idea, training pipeline, architecture / params / shapes, inference grids + Tab 6/7 numerical results, denoising trajectories, and a Field Landscape against Cola-DLM. A 1.7 MB self-contained HTML (no build) — demonstrates the kind of long-form analysis the /render-html toolchain can produce.

• 2026-05-26 — 🌐 HTML auto-emission activated at 8 workflow checkpoints. /idea-discovery, /auto-review-loop, /research-pipeline, /kill-argument, /proof-checker, /paper-claim-audit, /citation-audit, /rebuttal now auto-render their primary MD artifact to a single-file HTML view via /render-html. Cost-tiered: interim views use --no-review, audit-class / reviewer-facing deliverables keep the full Codex render-fidelity gate. Default on (RENDER_HTML = true); per-skill opt-out. Failures non-blocking — source MD stays canonical.

• 2026-05-26 — 🤝 Community PR wave — 5 merges this week. /wiki-enrich (#247 by @hungchun0201) fills paper TODOs ingest_paper leaves as scaffolds — Karpathy LLM-wiki principle, fetch chain alphaxiv→deepxiv→arXiv. Mirror drift checker + CI (#241 by @VeraPyuyi) keeps main↔mirror in sync. /research-pipeline Stage 2/3 unified into /experiment-bridge delegation (#243 by @ZBigFish) — old inline was a strict subset of the bridge. Windows PowerShell installer parity with reparse-chain inside-repo guard + -FromOld legacy migration + Windows CI matrix (#242 by @VeraPyuyi). Plus manual-review MCP (#246 by @ZBigFish) — third reviewer backend — reviewer: manual for zero-cost cross-model review (paste prompt to any non-Claude model: DeepSeek / Kimi / ChatGPT / Gemini / local llama); cross-model invariant guarded by bilingual UI banner + per-session token auth + fail-closed when MCP unavailable.

• 2026-05-17 — 🐙 GitHub Copilot CLI adaptation — native SKILL.md + MCP support, no skill mirror needed. Installer (install_aris_copilot.sh) + smart-updater + 13-test suite. Community contribution by @EarendelH (#229, closes #214 / #227 / #203).

• 2026-05-17 — 🛠 Tools-stability roadmap (Phase 1+2+3) complete (closes #176 / #177 / #178). Community reported that helper scripts weren't propagating into user projects after install_aris.sh. Phase 1 — every SKILL.md caller of the 10 canonical helpers now resolves via the strict-safe 3-layer chain .aris/tools/ → tools/ → $ARIS_REPO/tools/ documented in integration-contract.md §2 (which also defines 5 failure policies A/B/C/D1/D2/E). Phase 2 — new advisory CI lint catches hardcoded python3 tools/foo.py patterns in PR-modified SKILL.md (advisory only, never fails CI). Phase 3 — three single-owner helpers (figure-spec, paper-illustration-image2, experiment-queue) moved into their SKILL's scripts/ subdirectory; owner SKILLs use Layer 0 ${CLAUDE_SKILL_DIR}/scripts/ ahead of the canonical chain; legacy tools/ paths retained as os.execv Python forwarding shims. ⚠️ Existing users: no action needed — legacy tools/ entries are now shims. If you haven't run install_aris.sh since 2026-04-30, one idempotent rerun catches everything up.

• 2026-05-14 — 🩹 /paper-plan + /paper-write learn GAP_REPORT.md + <!-- DATA_NEEDED --> discipline (#217). When — style-ref: is set and the user's project has structural assets (figures/, results/, NARRATIVE_REPORT.md, etc.), /paper-plan emits a Gap Report mapping the exemplar's section topology + density (from style_profile.md) against your actual assets — surfacing slots you have no evidence to fill (e.g., "exemplar has 3×4 ablation table, you have no ablation data"). Then /paper-write writes <!-- DATA_NEEDED: <Slot ID> — <description> --> HTML comments instead of fabricating content at missing slots — invisible in the compiled PDF, grep-friendly for human triage / /experiment-bridge follow-up. Narrow carve-out from the "no placeholders" rule, scoped to GAP_REPORT-listed slots only. Original idea by @zhangpelf.

• 2026-05-14 — ⚙️ Default reviewer model: gpt-5.4 → gpt-5.5 across ~30 SKILL.md REVIEWER_MODEL defaults. Codex MCP has routed gpt-5.5 as the default since 2026-04-24; this catches the docs up to runtime. ⚠️ Behavior changes: (a) .aris/traces/* JSONs from prior runs are not reproducible — re-runs on 5.5 may emit different WARN/FAIL verdicts on borderline cases (reviewer-quality lift, not regression). (b) ChatGPT Plus/Pro monthly quotas drain faster under heavy use. Fallback: pass — reviewer-model: gpt-5.4 per invocation, or pin REVIEWER_MODEL = gpt-5.4 per skill. Oracle Pro tier (routed via — reviewer: oracle-pro) is a separate path and unaffected.

• 2026-05-13 — 🔍 tools/verify_papers.py + Pre-Search Verification Protocol — anti-hallucination filter for literature-facing skills. New helper does 3-layer fallback verification (arXiv batch API up to 40 IDs/request → CrossRef DOI lookup → Semantic Scholar fuzzy title match, default 0.6 word-overlap) and emits 4-state per-paper status (verified / unverified / verify_pending / error) plus a top-level verdict aligning with assurance-contract.md (PASS / WARN / BLOCKED / ERROR). Transient failures (5xx, timeouts, 429) are tagged verify_pending and excluded from the hallucination rate so network blips don't get conflated with fabricated references. Per-project cache at <project>/.aris/cache/verify_papers.json with 30-day TTL; canonical key priority arxiv:{id_without_version} → doi:{lowercase} → title:{sha1[:16]}. New Pre-Search Verification Protocol subsection in shared-references/citation-discipline.md makes the split explicit: this protocol is the fast filter between SEARCH (Step 1) and full VERIFY (Step 2); /citation-audit and /paper-claim-audit remain the submission-time audit gates and are not replaced. /research-lit gets a mandatory Step 1.5: Verify Candidate Papers calling the helper; /idea-creator and /novelty-check add a Key Rule reference for cited Closest Prior Work / landscape entries. Unverified papers are retained in output tagged [UNVERIFIED] (retention-over-silent-removal) so search-quality issues stay visible. Set ARIS_VERIFY_EMAIL in your shell to lift CrossRef to the polite-pool rate. Original signal from @YiwenZhu77 in #120 — landed via clean reimplementation rather than direct merge (PR was 5 weeks old + scope creep into figure-style).

• 2026-05-06 — 🎤 /paper-talk workflow + /slides-polish skill — end-to-end conference talk pipeline. /paper-talk orchestrates paper → slide outline → Beamer + PPTX → per-page polish → assurance audits → final report (sister to /paper-writing, /paper-poster); composes /paper-slides, /slides-polish, plus /paper-claim-audit + /citation-audit when assurance: conference-ready. /slides-polish is the post-generation visual pass: per-page Codex review against a reference PDF + a fix-pattern catalog (PPTX font scaling 1.5-1.8× for projector-readable size, text-frame resize after font bump, banner-as-tcolorbox, italic style leak guard, em-dash spacing, Chinese EA font hint via PingFang SC, anonymity placeholder discipline). Assurance ladder draft / polished (default) / conference-ready is independent from the effort axis; effort: lite, assurance: conference-ready is legal and means "fast pipeline, every audit must emit verdict before final". Phase 4 staging adapter materializes slide text + speaker notes + talk script as a synthetic paper directory (.aris/paper-talk/audit-input/sections/*.tex + symlinked .bib / results/ / figures/) so the existing audits run with their paper-shaped contracts and emit 6-state JSON verdicts per shared-references/assurance-contract.md.

• 2026-05-05 — 🔁 /resubmit-pipeline — Workflow 5: text-only resubmit across venues (#208). Port a polished paper from one venue to another under hard constraints (no new experiments, no bib edits, no framework changes, never overwrite prior submissions). 5 phases: physical isolation → 5-layer anonymity check → audits (proof / claim / citation --soft-only) → microedits via /auto-paper-improvement-loop --edit-whitelist with per-round diff gate → adversarial gate via /kill-argument → final compile + Overleaf push via /overleaf-sync. Two prerequisite SKILL upgrades shipped in the same PR: /auto-paper-improvement-loop --edit-whitelist <path> (YAML schema with allowed/forbidden paths + forbidden_operations like new_cite / new_theorem_env / numerical_claim, forbidden_deletions, requires_user_approval_for, max_edits_per_round) and /citation-audit --soft-only (translates KEEP/FIX/REPLACE/REMOVE verdicts to text-rewrite proposals when bib is frozen; hallucinated citations get drop_cite_in_body_only action). Master RESUBMIT_REPORT.json ledger per shared-references/assurance-contract.md; 7-verdict failure mode table including USER_DECISION runtime state.

• 2026-05-05 — 🗡 /kill-argument — adversarial Attack-Adjudication review for theory papers (#206). Two fresh codex 5.5 + xhigh threads: Thread 1 writes the strongest 200-word rejection memo a senior area chair would produce; Thread 2 (independent adjudicator, NOT defender) reads the current paper and classifies each rejection point as answered_by_current_text / partially_answered / still_unresolved with file:line evidence. Output: KILL_ARGUMENT.{md,json}, detect-only. Integrated as Phase 5.6 of /paper-writing (between claim-audit and citation-audit) and as the canonical implementation called from /auto-paper-improvement-loop Step 5.5 — replaces inline prompt in both places. Mandatory at assurance: submission for theory-heavy / scope-heavy papers; emits NOT_APPLICABLE for empirical papers without scope claims. Audit JSON is verify_paper_audits.sh-compatible (full schema per shared-references/assurance-contract.md, 6-state verdict). Catches the failure mode score-based reviews miss: when every local component is correct (numbers match, cites resolve, theorems prove) but the paper still oversells what it actually establishes.

• 2026-05-04 — 🪲 /research-wiki and 8 caller skills now resolve helper via fallback chain (#204). Bug: after bash tools/install_aris.sh the helper lives at .aris/tools/research_wiki.py (symlink), but skills hard-coded tools/research_wiki.py and silently failed when invoked — research-wiki/ stayed empty across full W1 runs. Fix: 3-layer chain (.aris/tools/ → tools/ → $ARIS_REPO/tools/) codified in shared-references/wiki-helper-resolution.md. The manual-copy workaround at <project>/tools/research_wiki.py is layer 2, so users who cp-installed the helper as a temporary fix continue to work. ⚠️ Existing users: rerun bash tools/install_aris.sh once — also picks up a separate Python 3.9 ImportError fix in the helper.

• 2026-05-03 — 🎨 Opt-in — style-ref: <source> for writer-side skills (#202). /paper-{plan,write,writing,illustration,poster,slides}, /grant-proposal, and /auto-paper-improvement-loop accept an optional — style-ref: <source> argument that mimics a reference paper's structural style (section ordering, theorem/figure density, sentence cadence, citation style) without copying its prose, claims, or terminology. Sources: local .tex dir/file, local PDF, arXiv id (2501.12345 or arxiv:2501.12345), HTTP/HTTPS URL. Overleaf URLs/IDs are rejected — clone via /overleaf-sync setup <id> first. Default OFF; existing behavior unchanged when the flag is absent. Reviewer / auditor sub-skills (/proof-checker, /paper-claim-audit, /citation-audit, the improvement-loop reviewer) never see the style ref — cross-model review independence preserved. ⚠️ Existing ARIS users: the helper ships at tools/extract_paper_style.py, distributed via the .aris/tools symlink (install_aris.sh Phase 0, added in #192). Re-run bash tools/install_aris.sh once to refresh the symlink and pick up the helper. Manual fallback: cp <ARIS-repo>/tools/extract_paper_style.py <your-project>/tools/. Without either, the writer skill aborts with a clear error pointing here.

• 2026-05-02 — 🪨 Community spotlight: rosetta by @SyntaxSmith. Programmatic access to ChatGPT Pro / gpt-5.5-pro / DeepResearch from Node, via Chrome CDP Fetch interception + WebSocket second-leg streaming; ships an MCP server for Claude Code / Codex / Cline. Alternative implementation path to Oracle MCP for ARIS users invoking — reviewer: oracle-pro — same target capability (Pro-tier reviewer), different mechanics. Indexed under Awesome Community Skills & Extensions. 🌟 if you're using it!

• 2026-05-02 — 💎🧿 Model & MCP routing updates. (a) /gemini-search default bumped to gemini-3-pro-preview (strongest Gemini, out-of-box). ⚠️ Action required: requires gemini-cli v0.40+ (run gemini --version; upgrade with npm i -g @google/gemini-cli if older). Legacy override: /gemini-search "topic" — model: gemini-2.5-pro. Other overrides: gemini-3-flash-preview (faster), auto-gemini-3 (load-routed). (b) /idea-discovery Phase 1 now includes Gemini in its literature survey by default (#199) — auto-injects — sources: all, gemini into /research-lit unless the user passed an explicit — sources:; graceful skip if gemini-cli not installed. (c) Oracle MCP upstream PR queue (steipete/oracle/pulls) is the first triage stop when invoking — reviewer: oracle-pro (especially o3-deep-research / gpt-5.5-pro) — ARIS does not vendor Oracle MCP; check upstream first if behavior surprises you (reviewer-routing.md)

• 2026-05-02 — 🛠️🔗 Tools-infrastructure migration started. (a) install_aris.sh creates optional .aris/tools symlink (#192, closes #174) — Phase 0 of the 4-step tools-stability plan (#174 → #176 → #177 → #178); idempotent, zero impact until rerun. (b) /experiment-queue orchestration paths repaired (#193) — first real user of the symlink; 7 cascading bugs fixed via 3 rounds of Codex MCP gpt-5.5 xhigh audit. Pure prose + docstring; queue_manager.py logic untouched. Windows install_aris.ps1 parallel update tracked as follow-up

• 2026-05-02 — 🔬 Three new opt-in audit flags via fast-path delegated-agent workflow (#187, #188, #189). /citation-audit --uncited surfaces bib entries with no \cite{} reference (detect-only). /proof-checker --deep-fix adds a repair-grade plan to the Phase 1 reviewer prompt (corrected statement / patch plan / closure tests + Schur/quadratic-form algebra sanity). /proof-checker --restatement-check adds Phase 3.6 cross-location theorem drift detection (6 drift signatures). Zero behavior change when flags unset. Plus doc PRs #190 (thread-policy) + #191 (auto-loop xref). Delegated-agent + maintainer-fixup pattern; Codex MCP gpt-5.5 xhigh review caught 6+ blockers

• 2026-05-01 — 🔍 Gemini + OpenAlex literature sources for /research-lit (#175, community contribution by @stdAri). Two opt-in sources: /gemini-search (AI-driven discovery via jamubc/gemini-mcp-tool MCP) and /openalex (250M+ work open citation graph, no API key). Triggered via — sources: gemini or — sources: openalex; zero behavior change when default all (both excluded). Maintainer fixups: corrected @google/gemini-cli npm name; added try/except ImportError + bash preflight for graceful OpenAlex skip when requests missing

• 2026-04-30 — 📝 /rebuttal per-reviewer thread mode + transferable patterns (SKILL.md). Adds VENUE_MODE (single_document | per_reviewer_thread) for OpenReview-style venues, reviewer_priority: pivotal routing, structural_distinction response mode, 5 reviewer-defensive heuristics, 2 Phase 5 lints, and severity-scaled stress rounds. Default VENUE_MODE = single_document keeps ICML-style behavior — zero change for existing users. Three rounds of cross-model review before/after merge

• 2026-04-30 — 🪞 Codex skill mirror rebuilt + dedicated install/update chain (#179, community contribution by @No-518). skills/skills-codex/ now mirrors all 67 mainline skills; replaces mcp__codex__codex reviewer path with Codex-native spawn_agent + send_input. New tools/install_aris_codex.sh + tools/smart_update_codex.sh handle project-local symlinks with manifest tracking. Anti-drift: tests/test_codex_skill_mirror.py + tests/test_codex_install_update.py (26 failure paths). Open discussion in #184

• 2026-04-24 — 🎨 /paper-illustration-image2 — Codex-native image generation as Phase 2b illustration backend (#166, community contribution by @kbr19-thu 清华). Uses ChatGPT Plus/Pro quota via local Codex app-server MCP bridge — no GEMINI_API_KEY required. Triggered by /paper-writing — illustration: codex-image2; default stays figurespec (zero behavior change). Async-only API, sandboxed writes to figures/ai_generated/, integration-contract-compliant helper. Marked experimental (Codex debug app-server is unstable upstream)

• 2026-04-21 — 📚 Research Wiki ingest actually works now (research_wiki.py, /research-wiki). Fixes user-reported bug where /research-wiki init left papers/ empty forever (ingest subcommand had no implementation; paper-reading skills had no wiki hook). New canonical python3 tools/research_wiki.py ingest_paper helper owns slugging / metadata fetch / dedup / page render; all 6 paper-reading skills wired to it. Manual backfill via sync --arxiv-ids or sync --from-file. Ships with integration-contract.md formalizing the six-component pattern every cross-skill integration must follow

• 2026-04-21 — 🛡️ Assurance Gate: — effort: beast | max now really runs mandatory audits (assurance-contract.md, tools/verify_paper_audits.sh). Fixes silent-skip of /proof-checker / /paper-claim-audit / /citation-audit at high effort. New assurance axis (draft | submission) independent from effort: lite / balanced → draft (zero behavior change), max / beast → submission. At submission the 3 audits emit a JSON artifact with 6-state verdict; paper-writing Phase 6 runs the external verifier as source of truth (non-zero exit blocks Final Report). SHA256 input hashing catches stale audits. Escape hatch: — effort: beast, assurance: draft

• 2026-04-20 — 🩹 Project install: flat layout + manifest tracking — fixes a real bug where the previous nested install (.claude/skills/aris/) hid skills from Claude Code's slash-command discovery (CC only scans one directory level). Anyone who ran install_aris.sh before this date was silently affected. New install_aris.sh creates one symlink per skill at .claude/skills/<name>, writes a versioned manifest to .aris/installed-skills.txt, and is re-runnable to reconcile new/removed upstream skills. Defense-in-depth: 13 safety rules (no-symlinked-parents, exact-target revalidation, slug regex, atomic same-dir manifest rename, no-overwrite-real-files, mkdir-based portable lock, ADOPT for crash recovery, …). Granular --adopt-existing / --replace-link flags replace the all-or-nothing --force. Migration paths: --from-old for legacy nested symlink, --migrate-copy keep-user|prefer-upstream for legacy nested copy. smart_update.sh --target-subdir .claude/skills/aris is now deprecated with a redirect to install_aris.sh. Stale-file bug in cp -r overlay also fixed (now rm -rf && cp -r for safe-update path)

• 2026-04-19 — 🔗 /overleaf-sync — two-way bridge between local ARIS paper directory and an Overleaf project via the official Overleaf Git bridge (Premium). Lets collaborators keep editing in the Overleaf web UI while ARIS audit/edit pipelines (/paper-claim-audit, /citation-audit, /auto-paper-improvement-loop) keep running locally. Sub-commands: setup (one-time, user-driven so the agent never sees the token) / pull (with diff-protocol — flags half-sentences, typos, claim/cite changes that should re-trigger audits) / push (with confirmation gate before writing to shared Overleaf state) / status (3-way divergence check). Token never touches the agent or any file — primed once into macOS Keychain via the user's terminal, then auth-free for all subsequent agent operations

• 2026-04-19 — 📚 /citation-audit — fourth and final layer of the evidence-and-claim assurance stack (experiment-audit → result-to-claim → paper-claim-audit → citation-audit). Fresh cross-family reviewer (gpt-5.4 via Codex MCP) with web/DBLP/arXiv lookup verifies every \cite{...} along three independent axes: existence (paper resolves at claimed arXiv ID/DOI/venue), metadata correctness (authors/year/venue/title match canonical sources), and context appropriateness (the cited paper actually establishes the claim it supports — the most diagnostic check). Per-entry verdicts: KEEP / FIX / REPLACE / REMOVE. Auto-integrated into Workflow 3 Phase 5.8 as the pre-submission bibliography gate. Empirical motivation: in a real submission run, several real papers were cited in contexts they did not actually support, and at least one entry shipped with author = "Anonymous" — none caught by metadata-only checks

• 2026-04-17 — 🔀 /experiment-queue integrated into Workflow 1.5 + research-pipeline — experiment-bridge Phase 4 Deploy now auto-routes by milestone job count: ≤5 jobs → /run-experiment, ≥10 jobs or phase dependencies → /experiment-queue (with OOM retry, stale-screen cleanup, wave-transition gating, crash-safe state). New --- batch: queue override for global force-queue mode. Large multi-seed sweeps from EXPERIMENT_PLAN.md (e.g., 36-cell N × seed × n_train grids) now get proper orchestration without manual queue invocation

• 2026-04-17 — 🔗 Project-local symlink install (resolves #118) — new recommended default install. bash tools/install_aris.sh auto-detects platform (Claude Code / Codex CLI), creates .claude/skills/aris or .agents/skills/aris symlink to the ARIS repo, adds a managed <!-- ARIS:BEGIN --> block to CLAUDE.md / AGENTS.md telling the agent to use only project-local skills, and records install metadata in .aris/skill-source.txt. Solves the skill collision problem when ARIS is mixed with Superpowers / OpenHands / other community packs in the same global skill directory. PowerShell version (install_aris.ps1) ships with junction support for Windows. smart_update.sh --target-subdir flag added for .agents/skills/aris (Codex) project-copy installs; symlinked installs now correctly refuse smart_update and direct users to git pull. Global install remains supported for power users

• 2026-04-16 — 🎨 /figure-spec — deterministic JSON→SVG renderer packaged as a first-class skill. Preferred default for architecture/workflow/pipeline/audit-cascade figures in papers. Shape-aware edge clipping (rect/circle/ellipse/diamond), self-loops, curved edges, multi-line labels with CJK width estimation. Editable vector output, reproducible (same spec → same SVG), no external API. Phase 2b in Workflow 3 restored: illustration: figurespec (new default) / gemini / mermaid / false — 4-way illustration selector with complementary strengths

• 2026-04-16 — ⚙️ /experiment-queue — SSH job queue for multi-seed/multi-config ML experiments. Designed from real 36-cell NeurIPS sweep pain points: OOM-aware retry with backoff, stale-screen cleanup, wave-transition race prevention, teacher→student phase dependencies, crash-safe scheduler that resumes from JSON state. Declarative grid specs expand automatically (e.g., N × seed × n_train → 36 jobs). Configurable conda_hook + gpu_free_threshold_mib for non-standard environments. Use for ≥10 jobs; /run-experiment stays for ad-hoc

• 2026-04-15 — 🛡️ Paper Writing Pipeline Hardening — 10 empirically-motivated patches from a real NeurIPS run. REVIEWER_BIAS_GUARD=true: every review round uses a fresh thread (codex-reply inflated 3→8/10). Reviewer Independence Protocol: no fix summaries to reviewer. Step 4.5 Restatement Regression Test: catches theorem drift across fix rounds. Step 5.5 Kill Argument Exercise: final-round adversarial attack/defense for theory papers. Location-aware overfull blocking. Theory Paper Consistency Pass in /paper-write. Enforced Bib Hygiene with DBLP/CrossRef validation. Phase 5.5 Mandatory Final Claim Audit as submission gate. Review Tracing Protocol: full prompt/response pairs saved to .aris/traces/ for reviewer-independence audit (review-tracing.md, save_trace.sh). Inspired by community contribution from @李傲龍

• 2026-04-15 — 🎨 FigureSpec Renderer v2 — deterministic JSON→SVG figure generation for academic papers. Shape-aware edge clipping (rect/circle/ellipse/diamond), self-loops, curved edges, multi-line labels with CJK width estimation, comprehensive validation (type checks, structure, palette). Went through 5 rounds of Codex review (3/10→7/10). All architecture and workflow diagrams in the ARIS tech report were generated with this pipeline. New --- mode: vector for /paper-illustration skill

• 2026-04-14 — 📋 /paper-claim-audit — zero-context paper-to-evidence verification. Fresh reviewer with NO prior context compares every number in the paper against raw result files. Catches rounding inflation, best-seed cherry-pick, config mismatch, delta errors, scope overclaim. Auto-integrated into Workflow 3 (Phase 4.7). Completes the 3-layer audit chain: /experiment-audit (code) → /result-to-claim (science) → /paper-claim-audit (reporting). 👁️ Visual PDF review also added to improvement loop — reviewer now sees compiled PDF, not just LaTeX source. Inspired by Hermes Agent

• 2026-04-13 — 🧿 GPT-5.4 Pro via Oracle — — reviewer: oracle-pro on any skill for the strongest available reviewer. API mode (fast) or browser mode (free). Supported on: /research-review, /auto-review-loop, /experiment-audit, /proof-checker, /rebuttal, /idea-creator, /research-lit. Default stays Codex xhigh. Not installed = zero impact. Setup →

• 2026-04-13 — 🔬 /proof-checker — rigorous mathematical proof verification via cross-model review. 20-category issue taxonomy, two-axis severity, side-condition checklists (DCT/MCT/Fubini/IFT/...), counterexample red team, proof-obligation ledger. Auto-integrated into Workflow 3: detects \begin{theorem} and runs before improvement loop. Complements /proof-writer

• 2026-04-10 — ⚡ Effort Levels — — effort: lite | balanced | max | beast. Controls work intensity across all skills: papers found, ideas generated, review rounds, writing depth. Codex reasoning stays xhigh always. beast = every knob to maximum for top-venue sprints. Default balanced = zero change for existing users. Details →

• 2026-04-10 — 🔎 DeepXiv integration — progressive paper retrieval via DeepXiv CLI. Opt-in: — sources: deepxiv or — sources: all, deepxiv. Staged reading: search → brief → head → section. pip install deepxiv-sdk to enable. Community contribution by @DreamEnding

• 2026-04-10 — 🛡️ /experiment-audit — cross-model experiment integrity verification. GPT-5.4 reads your eval scripts and results directly, checks for fake ground truth, self-normalized scores, phantom results, and scope inflation (#131, #57). Advisory — warns loudly, never blocks. /result-to-claim auto-reads audit if present. New experiment-integrity.md shared reference. The executor must never judge its own integrity.

• 2026-04-10 — 🧠 tools/smart_update.sh — intelligent skill updater. Compares local vs upstream, detects personal customizations (server paths, API keys), only updates safe skills. bash tools/smart_update.sh --apply

• 2026-04-10 — 🏆 Community paper: UAV-CC — first community paper with full PDF archived. UAV change captioning benchmark for IEEE TGRS by @wxx827. Stack: Claude Opus 4.6 + Codex 5.4 xhigh + Cursor. Papers now archived in community_papers/

• 2026-04-08 — 📚 /research-wiki — persistent research knowledge base inspired by Karpathy's LLM Wiki. Accumulates papers, ideas, experiments, and claims across the entire research lifecycle with typed relationships. Wiki-aware hooks in /research-lit (ingest papers), /idea-creator (read wiki + write ideas back), and /result-to-claim (update claim status + trigger re-ideation). Failed ideas become anti-repetition memory. ARIS now learns from its mistakes.

• 2026-04-05 — 🧬 /meta-optimize — outer-loop harness optimization for ARIS. Passively logs skill invocations, tool calls, failures, and parameter overrides via Claude Code hooks. Run /meta-optimize to analyze accumulated usage data and propose SKILL.md improvements — reviewer-gated, user-approved. Inspired by Meta-Harness (Lee et al., 2026). ARIS now optimizes itself.

• 2026-04-04 — 🔧 Codex Plugin deep integration — /codex:rescue now auto-invoked when experiments fail (Workflow 1.5) or LaTeX won't compile (Workflow 3). GPT independently diagnoses the bug before Claude retries — two AI debuggers are better than one. Optional: codex exec powers nightmare review, /codex:rescue powers auto-debug. Setup →

• 2026-04-03 — ☁️ Modal serverless GPU — no GPU? gpu: modal in CLAUDE.md, one command (modal run launcher.py), no SSH, no Docker, auto scale-to-zero. $30/month free tier — enough to try ARIS experiments without any hardware. pip install modal && modal setup and go. Community contribution by @zeyuzhangzyz

• 2026-04-03 — 🎮 Reviewer Difficulty Levels — medium (default, unchanged), hard (reviewer memory + debate protocol), nightmare (GPT reads repo directly via codex exec — Claude can't hide anything). — difficulty: nightmare for maximum stress test before submission

• 2026-03-30 — 🔥 Auto-debug & exhaust-before-surrender — experiment-bridge auto-diagnoses failures (OOM, import, CUDA, NaN) and retries up to 3×. Inspired by PUA

• 2026-03-30 — ☁️ Vast.ai GPU rental — gpu: vast auto-rents cheapest GPU. By @YIHONG-JIN. 🔧 MiniMax M2.7 upgrade by @octo-patch

• 2026-03-27 — 📄 IEEE venue support (9 families). 🔎 Semantic Scholar. By @ypd666

• 2026-03-26 — 📄 Document-based input — RESEARCH_BRIEF.md auto-detect

• 2026-03-24 — 📝 Workflow 4: /rebuttal — 7-phase pipeline, 3 safety gates

• 2026-03-23 — 🔧 /training-check, /result-to-claim, /ablation-planner integrated. 📦 compact mode. By @JingxuanKang & @couragec

• 2026-03-22 — 📋 Templates — input templates for every workflow. 📄 7 venue templates — CVPR, ACL, AAAI, ACM MM added. 🛡️ Anti-hallucination fix — Workflow 2 enforces DBLP → CrossRef → [VERIFY]. 🔗 base repo — clone a GitHub repo as base codebase (— base repo: https://github.com/org/project)

• 2026-03-22 — 🔍 Codex + Gemini review guide — Codex executes, Gemini reviews via local gemini-review MCP bridge. CN

• 2026-03-20 — 🚀 Antigravity adaptation guide — use ARIS skills in Google Antigravity (agent-first IDE). Community contribution by @PeppaPigw

• 2026-03-20 — 🖥️ Trae adaptation guide — use ARIS skills in Trae (ByteDance AI IDE). Community contribution by @Prometheus-cotigo. 🔢 formula-derivation — Community contribution by @Falling-Flower

• 2026-03-19 — 🖼️ paper-poster — Conference poster. Community contribution by @dengzhe-hou

• 2026-03-19 — 🔗 Workflow 1.5 upgraded — /experiment-bridge GPT-5.4 code review. 📊 W&B fix

• 2026-03-18 — 🎤 paper-slides + 🔁 Codex+Claude bridge + 🖱️ Cursor guide + 🤖 Codex CLI skills + 📝 grant-proposal + 🎨 paper-illustration (Gemini) + 📊 CitationClaw

• 2026-03-17 — 🔧 Git code sync + 🆓 ModelScope guide + parameter pass-through

• 2026-03-16 — 🔬 research-refine + experiment-plan — turn vague ideas into problem-anchored proposals with claim-driven experiment roadmaps. Now integrated into Workflow 1 (/idea-discovery). Community contribution by @zjYao36

• 2026-03-16 — 🇨🇳 Alibaba Coding Plan guide — one API key, 4 models (Kimi-K2.5 + Qwen3.5+ + GLM-5 + MiniMax-M2.7), dual-endpoint setup. Community contribution by @tianhao909

• 2026-03-15 — 🔀 Bring your own model! Any OpenAI-compatible API now works as reviewer via llm-chat MCP server. GLM, MiniMax, Kimi, LongCat, DeepSeek all tested — zero Claude or OpenAI API needed

• 2026-03-15 — 🐾 OpenClaw adaptation guide — use ARIS research workflows in OpenClaw without Claude Code slash skills

• 2026-03-15 — 📐 proof-writer — community skill for rigorous theorem proof drafting. 📚 Anti-hallucination citations — /paper-write now fetches real BibTeX from DBLP/CrossRef instead of LLM-generated entries — on by default, zero install

• 2026-03-14 — 📱 Feishu/Lark integration: three modes (off/push/interactive), mobile notifications for experiments, reviews, and checkpoints

• 2026-03-13 — 🛑 Human-in-the-loop: configurable AUTO_PROCEED checkpoints across all workflows. Full autopilot or step-by-step approval

• 2026-03-12 — 🔗 Zotero + Obsidian + local PDFs + arXiv/Scholar: multi-source literature search with cross-model novelty verification

• 2026-03-12 — 🚀 Three end-to-end workflows complete: one prompt → top-venue-style paper. /research-pipeline chains idea discovery → auto review → paper writing autonomously

• 2026-03-12 — 📝 /paper-writing workflow: narrative report → structured outline → figures → LaTeX → compiled PDF → 2-round auto-improvement (4/10 → 8.5/10)

Give ARIS persistent memory across sessions. Papers, ideas, failed experiments — nothing is forgotten:

# In Claude Code:
> /research-wiki init                         # creates research-wiki/ in your project
# That's it. From now on, /research-lit auto-ingests papers, /idea-creator reads
# the wiki before brainstorming (and writes ideas back), /result-to-claim updates
# claim status. Failed ideas become anti-repetition memory for future ideation.

Run these in your normal terminal (not inside Claude Code) to enable passive usage logging:

# One-time setup in your project directory
mkdir -p .claude .aris/meta tools/meta_opt
cp Auto-claude-code-research-in-sleep/templates/claude-hooks/meta_logging.json .claude/settings.json
cp Auto-claude-code-research-in-sleep/tools/meta_opt/*.sh tools/meta_opt/
chmod +x tools/meta_opt/*.sh
# Then start Claude Code — hooks are active immediately
claude

Events are logged to both project-level (.aris/meta/events.jsonl) and global (~/.aris/meta/events.jsonl) logs. After 5+ workflow runs, run /meta-optimize to see data-driven improvement proposals. Use /meta-optimize --global to analyze trends across all your projects.

📝 Templates available! See templates/ for ready-to-use input templates for every workflow — research brief (Workflow 1), experiment plan (Workflow 1.5), narrative report (Workflow 3), paper plan (Workflow 3).

🔎 Optional: DeepXiv progressive retrieval

pip install deepxiv-sdk

Then use /deepxiv directly or opt into it from /research-lit with — sources: deepxiv or — sources: all, deepxiv.

🔎 Optional: Exa AI-powered web search

pip install exa-py
export EXA_API_KEY=your-key-here

Then use /exa-search directly or opt into it from /research-lit with — sources: exa or — sources: all, exa. Covers blogs, docs, news, and research papers with built-in content extraction.

🗑️ Uninstall: To remove ARIS skills without affecting your own personal skills:

cd Auto-claude-code-research-in-sleep && ls skills/ | xargs -I{} rm -rf ~/.claude/skills/{}

All pipeline behaviors are configurable via inline overrides — append — key: value to any command:

/research-pipeline "your topic" — AUTO_PROCEED: false                          # pause at idea selection gate
/research-pipeline "your topic" — human checkpoint: true                       # pause after each review round to give feedback
/research-pipeline "your topic" — sources: zotero, web                         # only search Zotero + web (skip local PDFs)
/research-pipeline "your topic" — sources: all, deepxiv                        # default sources plus DeepXiv progressive retrieval
/research-pipeline "your topic" — sources: all, exa                            # default sources plus Exa AI-powered web search
/research-pipeline "your topic" — sources: all, gemini                         # default sources plus Gemini discovery
/research-pipeline "your topic" — sources: all, openalex                       # default sources plus OpenAlex citation graph
/research-pipeline "your topic" — arxiv download: true                         # download top arXiv PDFs during literature survey
/research-pipeline "your topic" — difficulty: nightmare                        # maximum adversarial review before submission
/research-pipeline "your topic" — effort: beast                               # all knobs to maximum — top-venue sprint
/research-pipeline "your topic" — effort: beast, reviewer: oracle-pro         # beast + GPT-5.5 Pro reviewer — ultimate mode
/research-pipeline "your topic" — effort: lite                                # quick exploration, save tokens
/research-pipeline "your topic" — effort: max, review_rounds: 3               # max effort but cap review at 3 rounds
/research-pipeline "your topic" — AUTO_PROCEED: false, human checkpoint: true  # combine options
/proof-checker "paper/" — reviewer: oracle-pro                                # Pro-level proof verification

The runtime's sandbox settings provide a configured baseline, while a tool request may also carry sandbox-related overrides. In the legacy compatibility mode, the effective request can therefore differ from the values written in settings.json.

To make the configured policy authoritative, enable strictMode:

{
  "sandbox": {
    "enabled": true,
    "strictMode": true
  }
}

With strictMode: true, the runtime ignores these LLM-supplied overrides: dangerouslyDisableSandbox, namespaceRestrictions, isolateNetwork, filesystemMode, and allowedMounts. The configured sandbox policy remains in effect even when a tool call requests a different value. This is opt-in so existing configurations keep their legacy behavior by default.

Run aris doctor to inspect the currently reported sandbox state. strictMode controls whether tool requests can override the runtime configuration; it does not replace the host operating system's permissions, filesystem protections, or network policy.

Important: ARIS skills pin the reviewer explicitly (model: gpt-6-astra + a per-tier reasoning effort) in every fresh call — your ~/.codex/config.toml no longer silently decides the reviewer. Still set model = "gpt-6-astra" there (recommended): it covers codex-native/mirror sessions and anything that doesn't pin. ultra/max effort needs codex-cli ≥ 0.144.1 + a session restart.

Want Codex to execute but Claude Code to review? See docs/CODEX_CLAUDE_REVIEW_GUIDE.md. That path installs the base skills/skills-codex/*, then overlays skills/skills-codex-claude-review/*, and routes review-heavy skills through the local claude-review MCP bridge.

Want Codex to execute but Gemini to review locally? See docs/CODEX_GEMINI_REVIEW_GUIDE.md and CN. That path installs the base skills/skills-codex/*, then overlays skills/skills-codex-gemini-review/*, and routes the reviewer-aware predefined skills through the local gemini-review MCP bridge using direct Gemini API by default.

Want the Codex mirror install chain? Use tools/install_aris_codex.sh for managed project installs and tools/smart_update_codex.sh for copied Codex installs. The Claude scripts remain the mainline entry points for Claude projects.

The base Codex mirror reviews through a fresh Codex spawn_agent: workflows may continue, but results are explicitly same-family / provisional. Only a Claude/Gemini overlay or deterministic verifier records accepted; submission reports therefore expose submission-ready: provisional | yes | no.

• 📊 84 composable skills — mix and match, or chain into full pipelines (/idea-discovery, /auto-review-loop, /paper-writing, /research-pipeline). See full catalog →

• 🔍 Literature & novelty — multi-source paper search (Zotero + Obsidian + local PDFs + arXiv/Scholar) + cross-model novelty verification

• 💡 Idea discovery — literature survey → brainstorm 8-12 ideas → novelty check → GPU pilot experiments → ranked report

• 🔄 Auto review loop — 4-round autonomous review, 5/10 → 7.5/10 overnight with 20+ GPU experiments

• 📝 Paper writing — narrative → outline → figures → LaTeX → PDF → auto-review (4/10 → 8.5/10), one command. Anti-hallucination citations via DBLP/CrossRef

• 🤖 Cross-model collaboration — Claude Code executes and GPT-6-Astra reviews; in Copilot CLI, /auto-review-loop uses the native complementary rubber-duck model and verifies the actual cross-family pair from host events. Optional: — reviewer: oracle-pro → GPT-5.5 Pro via Oracle

• 📝 Peer review — review others' papers as a conference reviewer, with structured scoring and meta-review

• 🖥️ Review-driven experiments — when GPT-6-Astra says "run an ablation", Claude auto-writes the script, rsyncs to GPU, runs in screen, collects results, folds back into the paper. Configure server in CLAUDE.md (setup), or rent from Vast.ai with gpu: vast

• 🔀 Flexible models — default Claude × GPT-6-Astra, also supports GLM, MiniMax, Kimi, LongCat, DeepSeek, etc. — no Claude or OpenAI API required

• 🛑 Human-in-the-loop — configurable selection checkpoints. AUTO_PROCEED=true reports the choice and continues in the same turn; false asks for approval. Explicit Feishu interactive gates remain user-controlled

• 📱 Feishu/Lark notifications — three modes: off (default, recommended), push-only (webhook → mobile), interactive (approve/reject in Feishu). Zero impact when off

  Preview: Push cards (group) & Interactive chat (private)

  Push Only — group chat cards (experiment done, checkpoint, error, pipeline complete):

  

  Interactive — private chat with Claude Code (approve/reject, custom instructions):

  

• 📚 Research Wiki — persistent knowledge base across papers/ideas/experiments/claims. Failed ideas become anti-repetition memory — ARIS gets smarter every run. Inspired by Karpathy's LLM Wiki

• 🧩 Extensible — domain-specific skills welcome! Add a SKILL.md and open a PR. See community skills like dse-loop (architecture/EDA)

What to pass as argument? A short topic or scope is enough — the skill automatically reads your project's narrative docs (NARRATIVE_REPORT.md), memory files, experiment results, and prior reviews to build the full context for GPT-6-Astra. Examples:

• /auto-review-loop "factorized gap in discrete diffusion LMs" — broad topic, skill finds everything
• /auto-review-loop "focus on Section 3-5, our CRF results are weak" — targeted scope with hints
• /auto-review-loop — also works: skill reads project files and infers the topic

🎮 Reviewer Difficulty — control how adversarial the reviewer is:

/auto-review-loop "topic" — difficulty: nightmare    # GPT reads your code and verifies claims itself

🛡️ Key safety features:

• 🔒 MAX_ROUNDS = 4 — prevents infinite loops; stops early if score threshold is met
• ⏱️ > 4 GPU-hour experiments skipped — won't launch massive jobs; flags them for manual follow-up
• 🧠 Prefer reframing over new experiments — when both can address a weakness, chooses the cheaper path
• 🪞 No hiding weaknesses — explicit rule: "Do NOT hide weaknesses to game a positive score"
• 🔧 Fix before re-review — must actually implement fixes before resubmitting; no empty promises
• 💾 Compact recovery — persists state (REVIEW_STATE.json) after each round. If the context window fills up and auto-compacts mid-loop, the workflow reads the state file and resumes from where it left off — no human intervention needed

Key features:

• 📐 Claims-Evidence Matrix — every claim maps to evidence, every experiment supports a claim
• 📊 Auto figure generation — line plots, bar charts, comparison tables from JSON data
• 🧹 Clean bib — automated filtering removes uncited entries (948→215 lines in testing). Real BibTeX from DBLP/CrossRef instead of LLM-generated entries
• 📄 Flexible sections — 5-8 sections depending on paper type (theory papers often need 7)
• 🔍 GPT-6-Astra review — each step optionally reviewed by external LLM
• ✂️ De-AI polish — removes AI writing patterns (delve, pivotal, landscape...)
• 🎯 Page verification — pdftotext-based precise check that main body fits page limit

⚠️ Figure generation scope: /paper-figure auto-generates data-driven plots (training curves, bar charts, heatmaps) and comparison tables from JSON/CSV. For architecture diagrams and method figures: illustration: gemini (default) uses Claude→Gemini→Nano Banana Pro for publication-quality diagrams; illustration: mermaid generates Mermaid diagrams for free; illustration: false skips AI figures entirely.

Gemini API setup (for illustration: gemini): Get your API key at Google AI Studio, then set it as an environment variable: export GEMINI_API_KEY="your-key". Or add to your shell profile (~/.zshrc / ~/.bashrc). No other dependencies needed.

Tested end-to-end: Generated a 9-page ICLR 2026 theory paper (7 sections, 29 citations, 4 figures, 2 comparison tables) from a single NARRATIVE_REPORT.md — zero compilation errors, zero undefined references.

Score Progression (Real Test — ICLR 2026 theory paper):

Final: 8 pages main body (ICLR limit: 9), 0 overfull hbox, ICLR-compliant. +4.5 points across 3 rounds.

Four entity types:

Typed relationships (stored in graph/edges.jsonl):

paper --extends--> paper              idea --inspired_by--> paper
paper --contradicts--> paper          idea --tested_by--> experiment
paper --addresses_gap--> gap          experiment --supports--> claim
paper --supersedes--> paper           experiment --invalidates--> claim

Spiral learning in action:

Round 1: read 15 papers → wiki remembers → idea A → experiment → FAIL
         wiki records: "A fails because OOM at batch>32, loss diverges"

Round 2: /idea-creator reads wiki → sees A failed → generates idea D (avoids A's trap)
         → experiment → PARTIAL SUCCESS
         wiki records: "D works on small models, fails on large"

Round 3: /idea-creator reads wiki → knows A failed + D partial → generates idea F
         (combines D's success with new approach) → experiment → SUCCESS 🎉

Subcommands:

/research-wiki init                              # initialize wiki
/research-wiki ingest "paper title" — arxiv: xxx  # manually add a paper
/research-wiki query "topic"                      # rebuild query_pack.md
/research-wiki update idea:001 — outcome: negative # update entity
/research-wiki lint                               # health check (orphans, contradictions, stale claims)
/research-wiki stats                              # overview (paper/idea/experiment/claim counts)

Setup (one-time, in normal terminal):

mkdir -p .claude .aris/meta tools/meta_opt
cp Auto-claude-code-research-in-sleep/templates/claude-hooks/meta_logging.json .claude/settings.json
cp Auto-claude-code-research-in-sleep/tools/meta_opt/*.sh tools/meta_opt/
chmod +x tools/meta_opt/*.sh
claude   # hooks active immediately

Usage (after 5+ workflow runs):

> /meta-optimize                        # analyze current project
> /meta-optimize "auto-review-loop"     # focus on one skill
> /meta-optimize --global               # analyze trends across ALL projects
> /meta-optimize apply 1                # apply recommended change #1

┌─────────────────────────────────────────────────────────────────┐
│                  Workflow M: Meta-Optimize                        │
│                                                                  │
│   Normal ARIS usage (W1-W4)                                      │
│         │ (hooks log events passively)                           │
│         ▼                                                        │
│   .aris/meta/events.jsonl                                        │
│         │                                                        │
│         ▼                                                        │
│   ┌──────────┐     ┌──────────┐     ┌──────────┐               │
│   │ Analyze  │────▶│ Propose  │────▶│ GPT-6-Astra  │               │
│   │ patterns │     │ SKILL.md │     │ reviews  │               │
│   │          │     │ patches  │     │ patch    │               │
│   └──────────┘     └──────────┘     └──────────┘               │
│                                          │                       │
│                                          ▼                       │
│                                    User approves?                 │
│                                     Yes → Apply                  │
│                                     No  → Skip                   │
└─────────────────────────────────────────────────────────────────┘

What gets optimized (harness components):

If you previously installed via install_aris.sh (which created .claude/skills/aris/ as a single nested symlink) or via smart_update.sh --target-subdir .claude/skills/aris, your slash commands probably weren't being auto-discovered by Claude Code. Migrate to the flat layout:

# Symlink-style legacy install:
bash ~/aris_repo/tools/install_aris.sh ~/your-project --from-old

# Copy-style legacy install (with possible local edits — chose strategy explicitly):
bash ~/aris_repo/tools/install_aris.sh ~/your-project --from-old --migrate-copy keep-user
#   → keeps your nested .claude/skills/aris/ copy intact alongside the new flat install
bash ~/aris_repo/tools/install_aris.sh ~/your-project --from-old --migrate-copy prefer-upstream
#   → archives nested copy to .aris/legacy-copy-backup-<timestamp>/, then flattens

Project-local copy (no symlinks, useful for per-project skill edits):

mkdir -p ~/your-project/.claude/skills
bash ~/aris_repo/tools/smart_update.sh --project ~/your-project --apply
# Default --target-subdir is .claude/skills (flat), which is what Claude Code expects.
# (The old --target-subdir .claude/skills/aris is now deprecated — see migration block above.)

Global install (one copy in your home dir, available to every project):

mkdir -p ~/.claude/skills
cp -r ~/aris_repo/skills/* ~/.claude/skills/
# Update with: bash tools/smart_update.sh --apply

Global install increases the risk of skill name collisions with other globally-installed packs. Use only if you don't mix ARIS with Superpowers / OpenHands / etc. — otherwise prefer the project-local install above.

codex-plugin-cc provides additional Codex capabilities that ARIS auto-detects when installed:

# In Claude Code:
/plugin marketplace add openai/codex-plugin-cc
/plugin install codex@openai-codex
/reload-plugins
/codex:setup

Where ARIS uses the plugin:

All plugin features are optional — if not installed, ARIS falls back to Claude's own diagnosis. The plugin just adds a second pair of eyes.

Note: ARIS's core cross-model review (paper scoring, idea evaluation, rebuttal stress test) still uses Codex MCP, which allows custom prompts. The plugin cannot replace this.

To run the auto-review loop without clicking permission prompts, add to .claude/settings.local.json:

{
  "permissions": {
    "allow": [
      "mcp__codex__codex",
      "mcp__codex__codex-reply",
      "Write",
      "Edit",
      "Skill(auto-review-loop)"
    ]
  }
}