---
name: adversarial-pass-engine
description: Mandatory resourced disconfirmation pass for RAM. Generates authentic inverted-intent queries (NOT template negations), enforces inversion-class coverage and saturation-based stopping, writes a defensible "nothing found" record or fans contradictions into sub-inquiries via the Surprise Register. Component S8 of the RAM Producer Architecture.
---

# Adversarial Pass Engine -- SKILL

Component **S8** of the RAM 8-component architecture. Distinct from confirmatory retrieval (S1). Coupled to Multi-Method Orchestrator (S3), Warrant & Saturation Governor (S6), Surprise Register (owned by Claim-Typing Engine, S5), and Search Ledger (owned by Epistemic Output Layer, S4).

This skill exists because confirmation bias is the modal failure of AI desk research. The Librarian's prior version dissolved disconfirmation into retrieval flags. RAM rebuilds it as a standalone, mandatory, *authentic* pass.

---

## 0. PRIMACY -- Authenticity Constraint (LOAD-BEARING)

**The engine MUST simulate authentic skeptic reasoning. It MUST NOT template-generate inversion queries.**

Per Nemeth, Connell, Rogers & Brown (2001) and Schulz-Hardt, Jochims & Frey (2002): contrived devil's advocacy degrades into ritual, gets discounted by readers who recognize the procedure, and underperforms authentic dissent. CSET's 2024 critique of AI red-teaming makes the parallel structural argument.

If your output looks like "claim X -> NOT(X)" string substitution, **you have failed the skill**. The reader and the Evaluator (Phase 9) will detect ritualized output and reject the run.

**Authentic adversarial reasoning** means: for each claim, you reason about *who would actually be motivated to disprove this*, *what world-state would have to be true for the claim to be wrong*, *what alternative explanation produces the same confirmatory evidence*, and *what boundary condition makes the claim collapse*. You generate queries that an authentic skeptic in the relevant discipline would actually issue. You do not produce queries by negating predicates.

**Resourcing is NOT volume.** Resourcing = (inversion-class coverage) x (saturation-on-disconfirmation) x (audit trail of authentic search effort). Query counts are not resourcing. Time budgets are not resourcing. If the skill output cites "ran N adversarial queries" as evidence of resourcing, **you have failed the skill**.

**Contradictions fan out into sub-inquiries.** Contradictions NEVER feed a tiebreaker score, NEVER cast a procedural vote, and NEVER produce a confidence delta on their own. Per Maxwell (2013) and Schwenk (1990), the value of an adversarial pass is in surfacing assumptions and expanding the model, not in adjudicating among findings. If a contradiction is collapsed into a vote, **you have failed the skill**.

These three constraints govern every later section. They are not negotiable. They are not "best efforts." They are pass/fail.

---

## 1. Scope

### 1.1 In scope

- Consume claim decomposition + per-claim findings from Multi-Method Orchestrator (S3) via the file handoff defined in System-Engineering output.
- Generate authentic inverted-intent query sets per claim, organized into pre-registered inversion classes.
- Execute resourced disconfirmation retrieval against the Multi-Corpus Retrieval Router with `mode=adversarial` flag set in Search Ledger writes.
- Run an inversion-class coverage check.
- Apply saturation-based stopping (next inversion query produces no new disconfirmation category).
- Emit one of two outputs per claim:
  - **Defensible-nothing-found record** (must satisfy four defensibility requirements -- Section 4.5).
  - **Contradictions** -- written to Surprise Register as sub-inquiry prompts, NEVER as votes.
- Write every executed query, every accepted source, every rejected source, every skipped avenue (with reason) to the Search Ledger with `pass=adversarial` tag.
- Signal Warrant & Saturation Governor (S6): "nothing found" defensibly closed OR contradictions outstanding (which auto-expand the inquiry).

### 1.2 Out of scope

- Confirmatory retrieval (owned by S1 Multi-Corpus Retrieval Router, invoked by Orchestrator).
- Source integrity screening (owned by S2; adversarial pass uses S2 outputs but does not re-implement them).
- Fitness scoring (owned by S7).
- Stopping decisions for the overall run (owned by S6; this skill produces *per-claim* adversarial stopping inputs).
- Output rendering (owned by S4).
- Claim typing or decomposition (owned by S5).

### 1.3 Classified Knowledge Inventory

- **Procedural** (this skill enforces): inversion-class taxonomy, coverage check, saturation-based stopping, four-requirement defensibility test, contradictions-as-sub-inquiries write protocol, Search Ledger write schema for adversarial pass, anti-theater detection.
- **Conceptual** (this skill applies): Popperian falsifiability (a meaningful test must risk negation); Cochrane Ch. 4 / Ch. 13 ("absence of evidence" interpretive frame); Maxwell negative-case analysis (contradictions expand explanation); Strauss & Corbin theoretical saturation (informational, not count-based); Nemeth / Schulz-Hardt authenticity constraint; Schwenk dialectical inquiry over devil's advocacy.
- **Strategic** (this skill embeds): the Adversarial Pass exists because confirmation bias is the modal failure of AI desk research; it is mandatory, resourced, and authenticity-constrained because procedural disconfirmation degrades into ritual.
- **Tacit** (this skill operationalizes via heuristics): "what would an authentic skeptic in this discipline actually search for?" -- routed through claim type and discipline context from S5/S3.

### 1.4 Ambiguity Register

- "Authentic" cannot be measured directly; the skill detects its absence (procedural-theater signals) and forces re-generation.
- "Saturation" is informational, not numerical; the skill defines it operationally as "next inversion query produces no new disconfirmation *category* (not no new source) for K consecutive queries within a class," where K is defined per inversion class in Section 5 -- but K is a *guard against premature closure*, not a quota.
- Inversion class coverage is bounded by the pre-registered taxonomy (Section 4.2); novel inversion modes surfaced mid-run are added to the Surprise Register and trigger taxonomy review at run-end.

---

## 2. Procedure Skeleton

### 2.1 Phases

**Phase A -- Intake (from S3 / S5)**

A1. Receive claim decomposition artifact (one record per atomic claim) from Orchestrator handoff.
A2. Receive per-claim confirmatory findings (sources, fitness scores, integrity-screen outcomes) from Orchestrator.
A3. Receive claim type and discipline context from S5 / Orchestrator.
A4. **Decision Point D1 -- Skeptic Frame Selection.** For each claim, identify the authentic skeptic frame: "who would be motivated to disprove this and why?" Record the frame in the per-claim adversarial scratch artifact. If no plausible authentic skeptic can be identified for a claim, escalate to Surprise Register as a meta-anomaly (a claim no authentic skeptic would challenge is itself suspicious -- it may be tautological, definitional, or framed-to-be-unfalsifiable).

**Phase B -- Authentic Inversion Query Generation**

B1. For each claim, generate inversion queries within each of the four pre-registered inversion classes (Section 4.2). Queries must be reasoned from the skeptic frame in A4, not produced by predicate negation.
B2. **Anti-Theater Check 1.** For each generated query, the skill must articulate -- in the per-claim scratch artifact -- *why an authentic skeptic in this discipline would issue this query*. Queries failing this articulation are discarded and re-generated.
B3. Tag each query with its inversion class.

**Phase C -- Resourced Retrieval**

C1. Submit queries to Multi-Corpus Retrieval Router with `mode=adversarial` and pass-tag.
C2. Apply S2 (Source Integrity Screen) outputs to returned sources -- adversarial pass does NOT relax integrity screens.
C3. Write every query, accepted source, rejected source, skipped avenue to the Search Ledger with `pass=adversarial`, the inversion class, and the reason for any rejection or skip.

**Phase D -- Inversion-Class Coverage Check**

D1. **Decision Point D2 -- Coverage Check.** For each claim, verify each pre-registered inversion class (Section 4.2) has been exercised by at least one authentic query. Classes with zero authentic queries are gaps; the skill must either generate authentic queries for the missing class or document why the class is non-applicable to this claim type (with reasoning logged to the Ledger).
D2. Coverage is computed per claim, not per run aggregate. A run-level "average coverage" is a meaningless metric and is NEVER reported.

**Phase E -- Saturation-Based Stopping**

E1. **Decision Point D3 -- Saturation Test.** Within each inversion class, after K consecutive queries produce no new *disconfirmation category* (where K is the per-class guard from Section 5), the class is saturated. Saturation is per-class, not per-claim aggregate.
E2. Stopping fires when ALL inversion classes for the claim are either saturated OR documented non-applicable (D1).
E3. Stopping is NEVER triggered by query count, time budget, or token budget. If any of these are cited as a stopping rule in the Ledger, **the skill has failed**; rerun.

**Phase F -- Contradiction Routing**

F1. **Decision Point D4 -- Contradiction Disposition.** For each accepted source returned by an inversion query that genuinely contradicts the confirmatory finding (not "low-quality counter-source"), generate a sub-inquiry prompt and write to Surprise Register. Sub-inquiry prompts are framed as new questions ("under what conditions would the confirmatory finding fail given this counter-source?"), not as votes.
F2. Contradictions NEVER produce a confidence delta in this skill's output. The Output Layer (S4) renders the contradiction in the three-axis output; the Warrant Governor (S6) decides whether the sub-inquiry forces re-expansion.
F3. If a sub-inquiry generated here produces a finding that warrants a further adversarial pass on the new sub-claim, re-enter this skill at Phase A for the sub-claim. Recursion is explicit and Ledger-traced.

**Phase G -- Defensible Output Emission**

G1. For each claim, emit one of:
  - **Defensible-Nothing-Found Record** -- must satisfy all four requirements in Section 4.5; if any requirement is unmet, the record is invalid and stopping is rescinded.
  - **Contradiction Bundle** -- list of sub-inquiry prompts written to Surprise Register, plus the underlying counter-sources with their adversarial-pass provenance.
G2. Signal Warrant & Saturation Governor: per-claim adversarial state (defensibly-closed | contradictions-outstanding | meta-anomaly).
G3. Confirm Search Ledger writes are complete for the claim.

### 2.2 Interfaces

| Direction | Counterparty | Artifact | Notes |
|---|---|---|---|
| In | Multi-Method Orchestrator (S3) | Per-claim confirmatory findings | Includes claim type, discipline, fitness-verified sources |
| In | Claim-Typing Engine (S5) | Claim decomposition + claim type | Drives skeptic-frame selection and inversion-class applicability |
| Out | Multi-Corpus Retrieval Router (S1) | Adversarial-tagged queries | `mode=adversarial`, inversion-class tag |
| Out | Surprise Register (owned by S5) | Sub-inquiry prompts; meta-anomalies | NEVER votes, NEVER scores |
| Out | Search Ledger (owned by S4) | Per-query writes with `pass=adversarial` | Full audit trail required |
| Out | Warrant & Saturation Governor (S6) | Per-claim adversarial state signal | Drives "nothing found" auto-expand and overall stopping |

### 2.3 Decision Points

| ID | Where | Decision | Failure Mode If Wrong |
|---|---|---|---|
| D1 | Phase A4 | Authentic skeptic frame per claim | Predicate-negation queries (procedural theater) |
| D2 | Phase D1 | Inversion-class coverage per claim | "Nothing found" with hidden uncovered classes (lazy close) |
| D3 | Phase E1-E2 | Per-class saturation; stop only when all classes saturated or non-applicable | Volume-floor regression; ritualized count-based stopping |
| D4 | Phase F1 | Contradictions become sub-inquiries, not votes | Adversarial pass collapses into adjudication / tiebreaker |

### 2.4 Error Classes

- **Procedural-Theater Error** -- queries are predicate-negations, not authentic skeptic queries. Detection: Anti-Theater Check 1 (B2). Response: discard, re-generate, log to scratch artifact for Evaluator audit.
- **Lazy-Close Error** -- "nothing found" emitted with one or more inversion classes uncovered or unsaturated. Detection: Defensibility audit (Section 4.5). Response: rescind stopping, return to Phase B for missing classes.
- **Volume-Floor Regression Error** -- stopping rule cites query count, time budget, or token budget. Detection: Ledger audit at Phase E. Response: full rerun of Phase E with saturation rule.
- **Vote-Collapse Error** -- contradictions feed a confidence score or tiebreaker rather than fanning into sub-inquiries. Detection: output-shape audit at Phase G. Response: rerun Phase F.
- **Meta-Anomaly Suppression Error** -- a claim with no plausible authentic skeptic is processed as if it were challengeable, masking a tautology / unfalsifiable framing. Detection: D1 frame-selection failure logged but ignored. Response: write meta-anomaly to Surprise Register and signal Warrant Governor.
- **Recursion-Without-Trace Error** -- sub-inquiry triggers re-entry to Phase A but the Ledger does not show the recursive call. Detection: Ledger audit. Response: rebuild Ledger trace; if rebuild not possible, full rerun.

---

## 3. Anti-Deviation

### 3.1 Primacy + Recency

**Primacy reminder:** Authenticity Constraint + non-volume resourcing + contradictions-as-sub-inquiries are LOAD-BEARING. See Section 0.

**Recency reminder (re-stated at output emission):** Before emitting any "nothing found" record, the skill MUST self-verify the four defensibility requirements (Section 4.5; checklist lives at `references/DEFENSIBILITY_FOUR_REQUIREMENTS.md`). Before emitting any contradiction, the skill MUST verify the contradiction is routed as a sub-inquiry, not a vote.

### 3.2 Anti-Examples (each is a FAILURE to imitate)

Full worked anti-examples -- including paired authentic counterparts -- live at `references/AUTHENTIC_VS_TEMPLATE_EXAMPLES.md`. Compressed versions below.

**Anti-Example A -- Template Inversion (FAILURE).** Confirmatory claim: "Method X improves outcome Y in setting Z." Failure query: "Method X does NOT improve outcome Y in setting Z." Template negation. Forbidden.

**Anti-Example B -- Query-Count Stopping (FAILURE).** "Run 10 adversarial queries per claim. If none return contradictions, emit nothing-found." Volume-floor regression.

**Anti-Example C -- Lazy Close (FAILURE).** "Adversarial pass: nothing found." Violates all four defensibility requirements.

**Anti-Example D -- Contradiction-as-Vote (FAILURE).** "Adversarial pass returned 2 counter-sources. Confidence reduced from HIGH to MODERATE." Collapses adversarial output into a tiebreaker.

**Anti-Example E -- Meta-Anomaly Suppression (FAILURE).** Claim is unfalsifiable ("X is true by definition under our framework"). Skill generates inversion queries anyway. D1 must detect no plausible authentic skeptic frame and write a meta-anomaly.

### 3.3 Anti-Sycophancy NEVER Rules

- NEVER emit "nothing found" without the four defensibility requirements satisfied (Section 4.5).
- NEVER use query count, time budget, or token budget as a stopping rule.
- NEVER produce inversion queries by predicate negation.
- NEVER fold a contradiction into a vote, score, tiebreaker, or confidence delta.
- NEVER report a run-aggregate "coverage average" -- coverage is per-claim, per-class.
- NEVER relax S2 integrity screens for adversarial-pass sources (a counter-source from a retracted paper is not a counter-source).
- NEVER suppress a meta-anomaly (an unchallengeable claim) by generating performative inversion queries against it.
- NEVER re-enter Phase A recursively without writing the recursion to the Ledger.
- NEVER claim "authentic" without articulating the skeptic frame in the scratch artifact (Anti-Theater Check 1).
- NEVER rephrase these NEVER rules to soften them in output.

---

## 4. Reference Specifications

### 4.1 Skeptic Frame Heuristics (per claim)

Full rubric at `references/AUTHENTIC_INVERSION_DOCTRINE.md`. Per-claim scratch artifact must answer four questions in 1-3 sentences each:

1. **Who is the authentic skeptic?**
2. **What world-state would have to be true for the claim to be wrong?**
3. **What alternative explanation produces the same confirmatory evidence?**
4. **What replication / adjacent-setting failure mode is most plausible?**

If any answer is "none / not applicable," that itself is a meta-anomaly candidate (D1).

### 4.2 Pre-Registered Inversion Classes

Full taxonomy at `references/INVERSION_CLASS_COVERAGE.md`. Four classes; each claim must cover or document non-applicability:

1. **IC-1 Boundary-Condition Inversion** -- conditions under which the claim collapses.
2. **IC-2 Alternative-Explanation Inversion** -- confounders, artifacts, selection effects.
3. **IC-3 Replication-Failure Inversion** -- replication failures, retracted work.
4. **IC-4 Frame / Construct Inversion** -- alternative operationalizations, definitional disputes.

Taxonomy is bounded but not closed; novel inversion modes are written to Surprise Register as taxonomy-review candidates.

### 4.3 Resourcing Definition

Resourcing = (inversion-class coverage) x (saturation-on-disconfirmation) x (audit trail of authentic search effort). Volume metrics (query count, time, tokens) are NEVER resourcing. Full rationale at `references/AUTHENTIC_INVERSION_DOCTRINE.md`.

### 4.4 Saturation Operational Definition

Saturation per inversion class fires when the most recent K queries each return zero accepted sources OR sources that map to a disconfirmation category already surfaced earlier in this class for this claim. K defaults: 3 for IC-1/IC-2/IC-3, 2 for IC-4. Runaway guard: 8. K is a guard against premature closure, NEVER a quota. Full definition at `references/INVERSION_CLASS_COVERAGE.md`.

### 4.5 Defensibility Requirements for "Nothing Found" (FOUR; ALL REQUIRED)

Checklist at `references/DEFENSIBILITY_FOUR_REQUIREMENTS.md`. Template at `templates/DEFENSIBLE_NOTHING_FOUND_RECORD.md`. All four required:

1. Pre-registered inversion classes exercised (per-class status).
2. Coverage outcome per class.
3. Saturation evidence per class (K consecutive null-or-known-category queries AND K value).
4. Uncertainty-interval framing (per Altman & Bland, BMJ 1995).

If any requirement is missing, the record is invalid; stopping is rescinded.

### 4.6 Contradiction Routing Schema

Full canon at `references/NEMETH_SCHULZ_HARDT_CANON.md`. Contradictions write to the Surprise Register using the Public RAM entry template (`ram/templates/SURPRISE_REGISTER_ENTRY.md`). The per-skill adversarial fields are:

```
{
  "claim_id": <id from S5 decomposition>,
  "inversion_class": <IC-1|IC-2|IC-3|IC-4>,
  "counter_source_provenance": <full ledger reference>,
  "contradiction_summary": <1-3 sentences, neutral framing>,
  "sub_inquiry_prompt": <new question, NOT a vote>,
  "skeptic_frame_origin": <reference to per-claim scratch artifact>,
  "warrant_signal": "contradictions-outstanding"
}
```

**No `confidence` field exists in this schema.** Absence is structural. The Output Layer (S4) and the Warrant Governor (S6) own downstream interpretation.

### 4.7 Search Ledger Write Schema (Adversarial Pass)

Writes conform to the Public RAM contract at `ram/references/shared-ram/SEARCH_LEDGER_WRITE_CONTRACT.md`. Adversarial-pass-specific required fields: `pass=adversarial`, `inversion_class`, `skeptic_frame_ref`, `query_rationale` (Anti-Theater Check 1 record), `disconfirmation_category_assigned`, `saturation_state_after`, `recursion_parent_claim_id` (if applicable). Run-end aggregates NEVER substitute for per-write records.

---

## 5. Failure Audit (Pre-Mortem)

### 5.1 Contrived Devil's Advocacy Ritualization (Nemeth/Schulz-Hardt failure mode)

Queries are formulaic / generic / template-derived. Detection: per-query rationale is generic; skeptic frame answers are missing or boilerplate; same query templates appear across unrelated claims. Prevention: Anti-Theater Check 1 mandatory + Ledger-recorded; Phase 9 Evaluator audit of K=5 claims per run.

### 5.2 Contradiction Folded into Vote Rather Than Inquiry Expansion (Schwenk failure mode)

Contradiction collapses into a confidence delta or tiebreaker. Detection: skill output includes a confidence number/score/delta; Surprise Register entry missing for a known contradiction; Warrant Governor receives a score rather than a state signal. Prevention: D4 enforcement at Phase G; Contradiction Routing Schema has no confidence field (absence is structural); Phase 9 Evaluator audit.

### 5.3 Volume-Floor Regression Under a New Name

Count / time / token budget reintroduced as stopping rule under a euphemism. Detection: stopping rule cites a number not derivable from saturation evidence; Ledger shows uniform query counts across claims; post-hoc saturation reconstruction. Prevention: Resourcing Definition primacy + recency; stopping rule citations MUST point to per-class saturation events; Phase 9 Evaluator audit tests for query-count clustering.

### 5.4 Other failures preserved for completeness

- Lazy Close (Anti-Example C; Section 4.5 enforcement).
- Vote Collapse (Anti-Example D; Section 5.2).
- Meta-Anomaly Suppression (Anti-Example E; D1 enforcement).
- Recursion Without Trace (Section 2.4 error class; Ledger recursion field).

---

## 6. Operating Sequence (Compressed)

For each atomic claim from S3 / S5:

1. Receive claim + confirmatory findings + claim type + discipline (Phase A).
2. Answer the four skeptic-frame heuristics in scratch artifact (`templates/SKEPTIC_SCRATCH_ARTIFACT.md`). If none plausible -> meta-anomaly to Surprise Register, signal Warrant Governor, exit claim.
3. For each inversion class (IC-1 through IC-4): generate authentic queries (Phase B), with per-query rationale (Anti-Theater Check 1).
4. Execute resourced retrieval through S1 with `pass=adversarial` (Phase C). Apply S2. Write Ledger.
5. Coverage check (Phase D): every class exercised or documented non-applicable.
6. Saturation check per class (Phase E): all classes saturated or non-applicable. Stopping cause MUST be per-class saturation, NEVER count/time/tokens.
7. Route contradictions as sub-inquiries to Surprise Register (Phase F). NEVER as votes.
8. Emit defensible-nothing-found record (`templates/DEFENSIBLE_NOTHING_FOUND_RECORD.md`; ALL FOUR requirements) OR contradiction bundle. Signal Warrant Governor.
9. Confirm Ledger writes. Exit claim.

---

## 7. Authority and Locking

- This skill's procedure (Sections 0-6) is authoritative for Adversarial Pass behavior in RAM.
- The Authenticity Constraint (Section 0), Resourcing Definition (4.3), Saturation Operational Definition (4.4), Four Defensibility Requirements (4.5), and Contradiction Routing Schema (4.6) are LOCKED. Modification requires Phase 2 reopen.
- The Pre-Registered Inversion Classes (4.2) are bounded; novel inversion modes are taxonomy-review candidates, not silent additions.
- Volume-based stopping (any form) is FORBIDDEN under all loosenings short of Phase 0 charter amendment.

---

## 8. File Registry

Private RAM assets (this skill only):

| Path | Role |
|---|---|
| `references/AUTHENTIC_INVERSION_DOCTRINE.md` | Doctrine: authenticity constraint, skeptic-frame rubric, resourcing definition |
| `references/INVERSION_CLASS_COVERAGE.md` | Framework: IC-1..IC-4 taxonomy, coverage check, saturation guard K |
| `references/DEFENSIBILITY_FOUR_REQUIREMENTS.md` | Rubric: four-requirement checklist for defensible nothing-found |
| `references/AUTHENTIC_VS_TEMPLATE_EXAMPLES.md` | Doctrine: worked authentic-vs-template query pairs across disciplines |
| `references/NEMETH_SCHULZ_HARDT_CANON.md` | Framework: authenticity + contradiction-routing canon; Schwenk dialectical inquiry |
| `templates/SKEPTIC_SCRATCH_ARTIFACT.md` | Per-claim scratch: skeptic frame + per-query rationale (Anti-Theater Check 1 record) |
| `templates/DEFENSIBLE_NOTHING_FOUND_RECORD.md` | Per-claim output template gated by four-requirement checklist |

Public RAM reads (contracts owned elsewhere):

| Path | Contract |
|---|---|
| `ram/references/shared-ram/SEARCH_LEDGER_WRITE_CONTRACT.md` | Write format for `pass=adversarial` Ledger entries |
| `ram/references/shared-ram/SURPRISE_REGISTER_OWNERSHIP_PROTOCOL.md` | Write-token protocol; owned by S5 |
| `ram/templates/SURPRISE_REGISTER_ENTRY.md` | Entry template; S8 fills adversarial fields |
| `ram/references/orchestration/DISCIPLINE_SELECTION_MATRIX.md` | Discipline context for skeptic-frame selection |
| `ram/templates/CLAIM_DECOMPOSITION_ARTIFACT.md` | Intake format from S5 |

---

**End of SKILL.md.**
