/anti-detection-writing

Bounded skill autoresearch

Use this workflow only when the user asks to research or improve the writing skill through repeated experiments. Ordinary editing continues to use the main skill. The target of an experiment is a frozen, reusable skill change applied to multiple cases, not a sequence of answer rewrites after seeing detector feedback.

The workflow adapts the preference-based allocation in AI Research Preference Models, arXiv:2608.13940v2: rank proposed changes using task context and measured history before paying for full evaluations. The paper studies machine-learning research, not writing skills or detectors. This implementation uses an inference-only selector; it does not reproduce the paper's model training, GPU pilots or benchmark results.

Start and resume

The active agent is the coordinator. It dispatches fresh subagents and supported Chrome operations, then uses scripts/autoresearch.py to preserve and validate the run. The Python controller does not call models, control browsers or schedule background jobs by itself. It is a local resumable ledger for an agent-driven loop, on macOS/Linux with Python 3.10+ and uv. Use separate role packets from roles.md.

Default to one on-demand bounded round unless the user requests recurring execution. Honor an explicit batch or spending limit. Inspect live free allowance before choosing the config; saved quotas can be stale. Existing account access and publication authorization remain governed by the task. This workflow never grants credit purchases or public posting.

For local detector diagnostics, use the separate local detector CLI. It can exercise a pinned open model without commercial scan credits, but its output is not a browser receipt and cannot satisfy this controller's GPTZero conditions. The initial Desklib diagnostic disagreed with known Pangram classifications; do not assume that optimizing its score improves the commercial endpoint.

Before adopting another local detector for candidate selection, freeze comparable archived successes and unchanged cases before reading its scores, then count both recognized reductions and misleading decreases on unchanged commercial outcomes. Keep source inputs and native preprocessing separate, and reject full inputs that exceed the supported token limit. The Oculus/Greyscope diagnostic found Greyscope more promising on a narrow dependent sample, but it also rewarded a technical revision whose GPTZero score stayed at 100%. Such counterexamples remain development evidence. Require a prospective comparison before introducing an automatic local-score selector; historical agreement does not establish transfer, writing quality or a new GPTZero improvement.

For a prospective selector test, freeze the independent quality ranking before local scores. Define which answers may replace the quality-only control. If the best acceptable group contains only the control, record a selector no-op; do not broaden the group after seeing that outcome. Any separately requested scan of that answer is a baseline observation, not a successful selection comparison. Validate every local record, including failed and ineligible alternatives, before selection; unavailable scores stay null. The prospective diagnostic supplies the tested selection rule and retains both singleton cases.

From the skill directory, initialize a private run:

uv run --no-project python scripts/autoresearch.py init --run /absolute/private/run --skill . --cases /absolute/private/cases.json --config references/autoresearch/config.json
uv run --no-project python scripts/autoresearch.py status --run /absolute/private/run

Use a new directory outside a repository or an ignored private/ or .autoresearch/ directory. Never place account evidence in a public study folder. The default config permits three proposals, one selected candidate, eight scan attempts and 1,200 detector words, reserving four calls and 500 words for confirmation. It uses two development and two holdout cases, a 45-minute deadline, a mean decrease of at least five GPTZero AI-confidence percentage points and no per-case regression. These are adjustable pilot thresholds to freeze before the run, not statistically established success criteria. All planned cases in each split contribute; the minimum counts are not permission to select favorable subsets.

The supplied config sets scan_scope: "prose_only". Earlier configs without this field retain full_text behavior; do not edit a frozen run to change scope. The corpus and output files still contain complete messages, including code, so full-message claims and protected literals remain reviewable. Only the frozen detector input excludes independent code. A prose-only comparison needs its own comparable baseline and does not convert historical whole-message scores into prose scores.

The corpus is JSON with schema_version: 1 and cases. Each case has a unique id, split (development or holdout), question, original, and string lists claims, protected, sources. Record factual qualifications in claims, exact code/identifiers in protected, and authoritative source links or provided-fact provenance in sources. Verify the corpus before freezing it. Duplicate texts across splits are rejected. Previously measured failures belong to development. Do not give the improver or selector the full corpus/run state, which also contains holdout material.

Check the ordinary-writing references in each role packet for archived target outcomes before dispatch. Keep detector measurements in research/evidence resources; a writer can otherwise encounter scores while following a style-reference link. If a reference mixes both, freeze the same editing-only view for both arms and record the filtering before generating outputs. Restart a writer exposed to restricted outcomes rather than describing its output as score-blind.

Reconcile each writer's packet with the complete case, including its supporting evidence. A necessary date, version or condition may appear in source notes rather than the original body. Carry that detail into the assigned claims when a writer will not receive those notes. Check relevant evidence parity between arms before dispatch; otherwise a preference can reflect omitted context instead of the proposed writing procedure. Record an input omission as a preparation limitation and retain the original trial's outcome.

Before calling a proposal new, compare its actual procedure with earlier experiment protocols and candidate policies, including local runs not yet exported. A literature summary or selected batch list can miss a prior treatment. Record which components are reused and what this variant changes. If overlap is discovered after measurement, preserve the frozen trial and correct its novelty claim separately; do not rewrite the original selection record.

For each prose_only output, add --code-ranges-file FILE to the output command. That JSON contains schema_version: 1, the exact full_message_sha256, and ranges: [[start, end], ...]. Offsets count Unicode characters in the decoded UTF-8 full message, not bytes; ranges are half-open, ordered, nonoverlapping and cover complete LF-delimited lines (EOF is allowed). Use an explicit empty list when the answer has no independent code. Identify code blocks and standalone command lines before scores; retain prose lines and inline identifiers. The controller removes only those ranges, leaves all remaining characters untouched and freezes the resulting prose and mapping. It cannot decide whether an excluded line is actually code: that decision belongs to the independent reviewer.

Execute one round

1. Propose and freeze. Give the improver the incumbent and development evidence. Import each full proposed SKILL.md with propose --id ID --skill-file FILE --hypothesis TEXT --writer AGENT_ID. Only the Write and review section may change. Duplicate or unchanged proposals are refused. All other skill files remain frozen.
2. Rank. A different agent compares the proposals, records relative reasons and uncertainty, and returns {"ranker":"AGENT_ID","ranked_ids":["best","next"],"reason":"..."}. Include every proposed ID exactly once. Import with select --ranking FILE. Selection is final within this round. No predicted number substitutes for a detector result.
3. Generate controls and candidate outputs. Dispatch fresh baseline and candidate writers using the same operator, model/settings and supplied cases. Save generation metadata with model, settings, the common operator's SHA-256 in operator_sha256, and context: "fresh". Import each with output --case ID --arm baseline|candidate --file FILE --writer AGENT_ID --generation FILE. A comparison needs the incumbent skill's generated answer as its control. Record full model identifiers/settings when available; label unexposed details rather than guessing.
4. Judge without scores. Randomize labels, have a separate judge assess the exact full answers and source claims, then map the result back to arms. Import review --case ID --file FILE. Required JSON fields are reviewer, detector_scores_withheld: true, baseline_sha256, candidate_sha256, boolean baseline_pass/candidate_pass, preference (baseline, candidate, tie) and reason. For prose_only, also require baseline_prose_sha256, candidate_prose_sha256 and code_ranges_approved: true, after reviewing the derived prose and both exclusion maps. Approve only independent code exclusions that preserve every explanatory sentence and inline identifier. Retain detailed per-claim and code-correctness findings. Neither a failed answer nor a candidate judged worse is eligible for scanning. Identical measured prose is a detector no-op even if the complete messages differ in code; differing full messages still require review.
5. Reserve complete comparisons. Inspect both exact measured inputs and their current service costs. Use the prose input's service word count for prose_only, not the full message's count. Reserve every planned pair before the first external submission with reserve-pair --case ID --detector gptzero --baseline-words BASELINE_UI_WORD_COUNT --candidate-words CANDIDATE_UI_WORD_COUNT. Both arms commit together; an unaffordable second arm leaves neither reserved. Reserve conservatively when word counts differ. The controller checks pair affordability, total calls/words and the confirmation reserve. Dispatch only returned attempts with dispatch_ready: true, then use status to resume. The older single-arm reserve command can complete a partial reservation; its first arm is not dispatchable, and status withholds detector jobs until both costs are reserved. Serialize each Chrome/account session; never let parallel agents overwrite the same editor. Track research calls, research words and live vendor allowance separately, including diagnostics outside a closed run. A word reserve alone does not preserve call capacity. This ledger has no shared cross-run budget; a new directory does not reset the overall limits. A word cap does not authorize paid scans or guarantee vendor cost.
6. Measure and record. A detector worker collects fresh native receipts. Import with record --attempt ID --receipt FILE, or record --failure TEXT; prefix an unresolved outcome with uncertain. Failure/invalid/uncertain attempts remain charged and cannot be overwritten or retried under the same identity. A primary-detector failure stops new work; existing reservations permit recording outcomes only, including an explicit not-submitted failure when applicable. Once they are settled, the failed round stays final and untouched cases remain visible as incomplete. Do not click again after a timeout unless the original outcome has been reconciled and a new bounded experiment permits it. The strict earlier receipt validator is unchanged.
7. Confirm only promising development. Run summarize. Only development_promising unlocks holdout outputs. Freeze the chosen skill and follow the same generation, blinded review and paired scans on all holdout cases. If the reserve or real service allowance cannot support confirmation, retain an exploratory result. Do not lower the threshold or spend the reserve chasing a development score.
8. Keep the incumbent or return a supported candidate. Only candidate_supported clears this pilot's quality and measured confirmation conditions. It is not a broad reliability or authorship claim and does not install, publish or push automatically. Apply existing user authorization to any installation or repository action, with an exact artifact audit. On no improvement, failure, deadline or missing evidence, retain every outcome and stop this round.

Each subcommand also requires --run. status and summarize return pending role jobs, the complete attempt ledger and decisions; use those to resume instead of guessing which step ran. Do not reset or edit the state to erase failed attempts. The controller uses a lock, staged journal and frozen-artifact checks, but a trusted coordinator still controls the workspace. Role IDs are assertions, not identity authentication; shared subagents are not an OS security boundary. Candidate text is never executed as Python, and the improver must not receive credentials or evaluator internals.

Iterate without leaking the test set

One controller run holds one bounded round. To pursue a subsequent round within an authorized overall budget, carry its full development ledger forward, choose a new distinct hypothesis and initialize a new run from the frozen incumbent. A promising skill needs separate confirmation before becoming the incumbent. Do not reset the user's remaining budget when creating a new directory. If no justified hypothesis remains, report the plateau.

Once a holdout result informs another edit or appears in writer/selector feedback, retire that cohort to development. New confirmation needs new cases. The current controller locks holdout output creation but cannot prevent a shared agent from reading files; enforce packet separation operationally and report any exposure. It does not maintain a cross-run hidden-test service.

The coordinator supplies honest time remaining, checks status between stages, uses bounded tool calls and stops new dispatch at the deadline. The CLI blocks new work after expiry while allowing pending outcomes to be recorded. It cannot kill browser or agent work that is already running outside its process. Preserve successful or unsuccessful completed decisions when inspecting a finished run later. Stop at an unavailable detector or confirmed quota boundary; no purchase, bypass or invented substitute score.

For experiments that call a local rewriting model, record the actual generation configuration and sampling device. A custom forward loop does not automatically apply the model's temperature, top-k/top-p or repetition processors. Distinguish successful evidence saving from successful generation: a process can exit normally after catching a model error. Retain raw tokens, finish reason and exceptions. Recovering a usable portion of a failed output is a separate adaptive artifact task; declare its extraction rule and quality gate before editing, keep the failed run's disposition, and attribute any later result to the complete recovery workflow.

Report quality preference, complete paired GPTZero changes, missing/failing/no-op cases, Pangram native outcomes, actual consumption and elapsed time separately. Pangram has an evidence adapter but is a secondary endpoint in this first controller; its proportions are never averaged with GPTZero confidence or used to satisfy a GPTZero-specific posting rule. A learned/calibrated RPM, unattended model/API execution, cross-run scheduling and vendor API adapters are not implemented by this ledger.

Optional GEPA search

When the user requests GEPA, pin and invoke the upstream optimizer, and identify the exact reusable prompt component it may mutate. A custom adapter can return the reviewed output, a defined utility and a development trace; a custom proposer can use a separate reflection agent. Keep output writers and quality reviewers separate from that feedback. The GEPA paper motivates reflection over execution traces, but supplies no GPTZero writing result.

Freeze proposal, evaluation, time and external-scan budgets before dispatch. Cache an exact candidate/case output with its validated receipt for repeated engine evaluations; record a cache hit separately from a fresh measurement. A rejected quality check may have a defined negative utility without a detector score. Missing measurement must stop the run. Keep all rejected proposals and external scan attempts in the ledger: an optimizer's evaluation counter alone may omit interrupted spending or cached results after a restart. Apply deadlines before dispatch as well as while waiting.

Our GEPA pilot archives the executed adapter and its limits. Its callbacks require a coordinator to enforce writer isolation, independently review exact text and validate native Chrome receipts. Reusing one case for training and validation provides development feedback only. Freeze a promising policy before opening confirmation cases, and use the same writer operator and evidence in both confirmation arms.

Output recombination is a separate intervention from prompt optimization. When testing it, use the same complete parent pool and selection rubric for a selection-only control and the combined candidate. Freeze compatible boundaries and the assembly rule before scores; preserve exact source spans and reject joins that change qualifications or references. A mechanical byte check cannot establish factual correctness or readability. Our exact-crossover diagnostic supplies a small reproducible assembler and tests. Its final reviewer slightly preferred the combined answer, but both prose scans stayed at 100% AI. The method was not adopted, and confirmation remained sealed.