Meta Apply

Meta-Apply: the privileged landing gate for self-modification patches

Codex assurance: a base landing review records review_independence: same-family and acceptance_status: provisional via stamp-provisional; the artifact is not auto-curatable. Only an overlay or deterministic verifier may produce accepted authorization.

This skill exists to enforce a privilege boundary. Producers like /meta-optimize (and, later, corpus-audit) are read-only — no Write/Edit, no apply step; they can only stage candidate patches under .aris/meta/pending/. This skill is the only place a staged patch becomes a real change to the corpus. Splitting "propose" from "land" across two skills with different tool grants is what makes "a loop cannot apply its own patch" structural rather than a sentence the producer is asked to obey.

It is human-invoked only. It runs when the user explicitly types /meta-apply after reading the producer's REPORT. That invocation IS the landing authorization (the locked 2026-05-30 decision: the human stays at the landing gate).

The acquittal is generated HERE, not relayed

The earlier design trusted a jury_verdict: pass field in the producer's manifest. That is forgeable — the producer writes that field, so a buggy/misaligned producer could stage a killed patch labelled "pass." So this skill does not trust any producer-written verdict. It runs the fresh landing reviewer itself, at landing time, on the actual staged diff (fresh reviewer, paths-only). The verdict is produced where it is consumed, by the privileged human-invoked skill — nothing to forge.

The non-negotiable rules (jury-at-landing, reject-default)

For each staged patch the user asks to land, in order — any failure ⇒ skip & report, never silently apply:

1. The human named THIS patch. Apply only patches the user listed (/meta-apply 1,3 or all); default to applying nothing.
2. Fresh landing review PASS, obtained now. Spawn a fresh gpt-6-astra reviewer via spawn_agent (reasoning_effort: ultra, read-only, paths-only per reviewer-independence.md) on the staged .diff + its target. Ask: does this change improve the harness without regressions; PASS or KILL + one-line reason. Include the scope-limits block from review-scope-limits.md: this jury judges ARIS's own mechanism, so an over-defensive KILL permanently blocks a good patch. The block bans proposing new hash binding — it is not a reason to KILL a patch that touches the existing provenance stamp. KILL ⇒ refuse. The human cannot override a KILL — they may only pick among reviewer-PASSED survivors.
3. Record the review class honestly. Base Codex review is same-family and lands only with stamp-provisional; it can complete this explicit human-invoked operation but does not authorize future auto-curation. A Claude/Gemini overlay or deterministic verifier uses strict stamp and may record accepted. See skill-governance.md.

Workflow

Step 0: Load staging + resolve the helper

PENDING=".aris/meta/pending"
[ -d "$PENDING" ] || { echo "Nothing staged. Run /meta-optimize first."; exit 0; }
echo "Staged:"; cat "$PENDING/manifest.jsonl"

Resolve provenance.py through the Codex manifest:

if [ -z "${ARIS_REPO:-}" ] && [ -f .aris/installed-skills-codex.txt ]; then
  ARIS_REPO=$(awk -F'\t' '$1=="repo_root"{print $2; exit}' .aris/installed-skills-codex.txt 2>/dev/null) || true
fi
PROVENANCE=""
[ -n "${ARIS_REPO:-}" ] && [ -f "$ARIS_REPO/tools/provenance.py" ] && PROVENANCE="$ARIS_REPO/tools/provenance.py"
[ -z "$PROVENANCE" ] && [ -f tools/provenance.py ] && PROVENANCE="tools/provenance.py"
[ -n "$PROVENANCE" ] || { echo "ERROR: provenance.py unresolved" >&2; exit 1; }

Step 1: Jury-at-landing for each requested patch

For every patch the user asked to land, read its staged .diff and target, then spawn the fresh reviewer jury (Rule 2) — paths-only, no producer reasoning, no prior-round context. Record {patch, jury_verdict, jury_review_id, one_line_reason}. Print a one-line result per patch (PASS → eligible / KILL → refused: <reason>).

The producer may have written an advisory pre-screen into the manifest to help the human read the REPORT — ignore it for the landing decision. Only this fresh verdict counts.