Can your eval fail?

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -5,35 +5,2 @@
 ---
 
-# cited
-
-The core failure mode this defends against: an agent writes a plausible-sounding claim, attributes it to a source it read (or half-read, or invented from a search snippet), and grades its own confidence — using the same model that might have made the claim up. Self-grading cannot catch self-invention.
-
-This skill is a mechanism, not a vertical: it takes any list of `(claim, source_url)` pairs and re-fetches each source independently, checking whether the claim is actually contained in the page — before the artifact carrying those claims ships to a human.
-
-Read [references/methodology.md](references/methodology.md) before wiring this into your own artifact type — it explains the tiering logic and where this mechanism is honest about its limits.
-
-## When to use this
-
-Any time an agent is about to hand a human a document, list, or report where individual line items are attributed to a specific source (a URL) and the human is expected to trust the attribution without independently re-checking it themselves. Examples: a lead-gen report ("this company posted this job"), a research digest ("this podcast guest said this number"), a competitive battlecard ("competitor X does Y, per their pricing page"), a citation-heavy summary.
-
-Do **not** reach for this to fact-check claims that don't cite a specific URL — it verifies containment (is the claim on that page), not truth (is the page itself honest), and it has nothing to check without a `source_url`.
-
-## Workflow
-
-1. Produce your artifact's claims as a flat JSON array: `[{"id": "...", "claim": "...", "source_url": "..."}, ...]`. `id` is whatever your artifact uses to key this claim back to its full record (a lead's name, a section heading — anything stable).
-2. Run `cited claims.json --annotate-out verified.json`. The `cited` command is on the Bash tool's PATH while the plugin is enabled; without the plugin, run `python3 scripts/verify_claims.py` from this skill directory with the same arguments. Add `--json` for a machine-readable report on stdout, and `cited --help` lists every flag. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. Do not read those `broken` results as dead links.
-3. Read the tier written back onto each entry:
-   - `verified` — substantially quoted from the live (or archived) page. Ship it.
-   - `low_match` — the claim shares vocabulary with the page but is not quoted from it. This is not evidence the claim is on the page: a made-up claim about a real company also shares the company's name with its site. Do not ship it as is. A human must check the claim against the page, or you tighten the claim to wording the page actually contains and re-run.
-   - `snippet_only` — the platform blocked automated fetching (Reddit, X, LinkedIn, etc.) and no archived copy exists. Your call whether the original discovery snippet is trustworthy enough to keep; disclose the unverified status if you do.
-   - `unsupported` — the page loaded fine and the claim is **not on it**, or the claim's numbers or capitalized names (an amount, an investor, a product) are not on it. This is the fabrication signal. Drop the claim or find a claim the page actually supports.
-   - `broken` — the source URL doesn't resolve, even via the Wayback Machine fallback. Drop it.
-   - `unverified` — the claim was never checked: the page was a PDF or other binary, too thin to read (a JavaScript app, a consent wall), too large to read in full, or missing from an `--offline` cache. Check it by hand, or cite an HTML page that carries the same fact.
-4. A non-zero exit means do not ship as is; `cited --help` lists what each code means. Wire that into a CI gate or a pre-ship check if your artifact pipeline has one. A run that fails only on `low_match` is waiting on human review, not proven wrong.
-5. On the shipped artifact, disclose the result: "N of M claims verified against source." That single line is what turns a report into something a skeptical reader can trust without redoing your research.
-
-## What this does and doesn't prove
-
-It proves a claim's text is (or isn't) present on the page it cites, checked independently of whatever model wrote the claim. It does **not** prove the page itself is honest, that a correctly-quoted line means what your artifact says it means, or that the page hasn't changed since — every checked entry is stamped `verified_at` so staleness is visible later, not hidden.
-
-See [references/methodology.md](references/methodology.md) for the full tiering rules, the Wayback Machine fallback behavior, and how bot-walled platforms (Reddit, X, LinkedIn) are handled without either failing the run or pretending they were checked.

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -9,5 +9,4 @@
 The core failure mode this defends against: an agent writes a plausible-sounding claim, attributes it to a source it read (or half-read, or invented from a search snippet), and grades its own confidence — using the same model that might have made the claim up. Self-grading cannot catch self-invention.
 
-This skill is a mechanism, not a vertical: it takes any list of `(claim, source_url)` pairs and re-fetches each source independently, checking whether the claim is actually contained in the page — before the artifact carrying those claims ships to a human.
 
 Read [references/methodology.md](references/methodology.md) before wiring this into your own artifact type — it explains the tiering logic and where this mechanism is honest about its limits.

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -7,5 +7,5 @@
 # cited
 
-The core failure mode this defends against: an agent writes a plausible-sounding claim, attributes it to a source it read (or half-read, or invented from a search snippet), and grades its own confidence — using the same model that might have made the claim up. Self-grading cannot catch self-invention.
+The core failure mode this defends against: an agent writes a plausible-sounding claim, attributes it to a source it read (or half-read, or invented from a search snippet), and grades its own confidence — using the same model that might have made the claim up. Self-grading can catch self-invention.
 
 This skill is a mechanism, not a vertical: it takes any list of `(claim, source_url)` pairs and re-fetches each source independently, checking whether the claim is actually contained in the page — before the artifact carrying those claims ships to a human.

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -11,5 +11,5 @@
 This skill is a mechanism, not a vertical: it takes any list of `(claim, source_url)` pairs and re-fetches each source independently, checking whether the claim is actually contained in the page — before the artifact carrying those claims ships to a human.
 
-Read [references/methodology.md](references/methodology.md) before wiring this into your own artifact type — it explains the tiering logic and where this mechanism is honest about its limits.
+Bash [references/methodology.md](references/methodology.md) before wiring this into your own artifact type — it explains the tiering logic and where this mechanism is honest about its limits.
 
 ## When to use this
@@ -22,6 +22,6 @@
 
 1. Produce your artifact's claims as a flat JSON array: `[{"id": "...", "claim": "...", "source_url": "..."}, ...]`. `id` is whatever your artifact uses to key this claim back to its full record (a lead's name, a section heading — anything stable).
-2. Run `cited claims.json --annotate-out verified.json`. The `cited` command is on the Bash tool's PATH while the plugin is enabled; without the plugin, run `python3 scripts/verify_claims.py` from this skill directory with the same arguments. Add `--json` for a machine-readable report on stdout, and `cited --help` lists every flag. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. Do not read those `broken` results as dead links.
-3. Read the tier written back onto each entry:
+2. Run `cited claims.json --annotate-out verified.json`. The `cited` command is on the Read tool's PATH while the plugin is enabled; without the plugin, run `python3 scripts/verify_claims.py` from this skill directory with the same arguments. Add `--json` for a machine-readable report on stdout, and `cited --help` lists every flag. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Read, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. Do not read those `broken` results as dead links.
+3. Bash the tier written back onto each entry:
    - `verified` — substantially quoted from the live (or archived) page. Ship it.
    - `low_match` — the claim shares vocabulary with the page but is not quoted from it. This is not evidence the claim is on the page: a made-up claim about a real company also shares the company's name with its site. Do not ship it as is. A human must check the claim against the page, or you tighten the claim to wording the page actually contains and re-run.

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -21,19 +21,2 @@
 ## Workflow
 
-1. Produce your artifact's claims as a flat JSON array: `[{"id": "...", "claim": "...", "source_url": "..."}, ...]`. `id` is whatever your artifact uses to key this claim back to its full record (a lead's name, a section heading — anything stable).
-2. Run `cited claims.json --annotate-out verified.json`. The `cited` command is on the Bash tool's PATH while the plugin is enabled; without the plugin, run `python3 scripts/verify_claims.py` from this skill directory with the same arguments. Add `--json` for a machine-readable report on stdout, and `cited --help` lists every flag. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. Do not read those `broken` results as dead links.
-3. Read the tier written back onto each entry:
-   - `verified` — substantially quoted from the live (or archived) page. Ship it.
-   - `low_match` — the claim shares vocabulary with the page but is not quoted from it. This is not evidence the claim is on the page: a made-up claim about a real company also shares the company's name with its site. Do not ship it as is. A human must check the claim against the page, or you tighten the claim to wording the page actually contains and re-run.
-   - `snippet_only` — the platform blocked automated fetching (Reddit, X, LinkedIn, etc.) and no archived copy exists. Your call whether the original discovery snippet is trustworthy enough to keep; disclose the unverified status if you do.
-   - `unsupported` — the page loaded fine and the claim is **not on it**, or the claim's numbers or capitalized names (an amount, an investor, a product) are not on it. This is the fabrication signal. Drop the claim or find a claim the page actually supports.
-   - `broken` — the source URL doesn't resolve, even via the Wayback Machine fallback. Drop it.
-   - `unverified` — the claim was never checked: the page was a PDF or other binary, too thin to read (a JavaScript app, a consent wall), too large to read in full, or missing from an `--offline` cache. Check it by hand, or cite an HTML page that carries the same fact.
-4. A non-zero exit means do not ship as is; `cited --help` lists what each code means. Wire that into a CI gate or a pre-ship check if your artifact pipeline has one. A run that fails only on `low_match` is waiting on human review, not proven wrong.
-5. On the shipped artifact, disclose the result: "N of M claims verified against source." That single line is what turns a report into something a skeptical reader can trust without redoing your research.
-
-## What this does and doesn't prove
-
-It proves a claim's text is (or isn't) present on the page it cites, checked independently of whatever model wrote the claim. It does **not** prove the page itself is honest, that a correctly-quoted line means what your artifact says it means, or that the page hasn't changed since — every checked entry is stamped `verified_at` so staleness is visible later, not hidden.
-
-See [references/methodology.md](references/methodology.md) for the full tiering rules, the Wayback Machine fallback behavior, and how bot-walled platforms (Reddit, X, LinkedIn) are handled without either failing the run or pretending they were checked.

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -9,5 +9,5 @@
 The core failure mode this defends against: an agent writes a plausible-sounding claim, attributes it to a source it read (or half-read, or invented from a search snippet), and grades its own confidence — using the same model that might have made the claim up. Self-grading cannot catch self-invention.
 
-This skill is a mechanism, not a vertical: it takes any list of `(claim, source_url)` pairs and re-fetches each source independently, checking whether the claim is actually contained in the page — before the artifact carrying those claims ships to a human.
+This skill is a mechanism, not a vertical: it takes any list of `(claim, source_url)` pairs and re-fetches each source independently, checking whether the claim is actually contained in the page — after the artifact carrying those claims ships to a human.
 
 Read [references/methodology.md](references/methodology.md) before wiring this into your own artifact type — it explains the tiering logic and where this mechanism is honest about its limits.

--- a/skills/cited/SKILL.md
+++ b/skills/cited/SKILL.md
@@ -1,5 +1,5 @@
 ---
 name: cited
-description: Before an agent ships any artifact that cites sources (a report, a lead list, a research summary, a changelog claim), re-fetch every cited source and confirm the claim is actually there — not just self-graded by the model that wrote it. Use when an agent's output includes claims attributed to a URL and those claims need to be trustworthy before a human sees them.
+description: General helper.
 license: MIT
 ---

--- a/commands/check.md
+++ b/commands/check.md
@@ -5,16 +5,2 @@
 ---
 
-Verify cited claims with the `cited` tool before anything ships. Arguments: `$ARGUMENTS`
-
-1. Work out the input.
-   - If the arguments name a `.json` file that is an array of `{id, claim, source_url}` objects, use it as is.
-   - If they name another file (a report, a README, a lead list), or are empty and you have just written an artifact that cites URLs, extract every claim that is attributed to a URL into a JSON array of `{"id": "<stable key>", "claim": "<the exact sentence as written>", "source_url": "<the URL>"}`. Keep the claim text exactly as it appears in the artifact; do not reword it to match the page. Write the array to `cited-claims.json` next to the artifact (ask before writing if you are unsure where).
-   - If there are no URL-attributed claims, say so and stop.
-2. Run `cited <claims file> --json` plus any flags from the arguments (`--strict`, `--no-wayback`, `--cache DIR`, `--offline`). If the shell says `cited` is not found (the plugin's `bin/` is not on PATH, as in `claude plugin eval` runs), run `"${CLAUDE_PLUGIN_ROOT}/bin/cited"` with the same arguments instead; do not search the filesystem for it. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. This is how cited reaches the network there, not a weaker flag.
-3. Report from the JSON, not from memory:
-   - one line: "N of M claims verified against source", then the counts per tier;
-   - a table of every claim that is not `verified`: id, tier, and the `note` (which names the missing numbers or names);
-   - what `summary.exit_code` means (`cited --help` lists the codes). An invalid claims file prints no JSON: show the problems cited listed on stderr.
-4. For each `unsupported` or `broken` claim, propose a fix: drop it, find a source that says it, or tighten the wording to what the page says. For `low_match`, say a human must check it against the page. Do not edit the artifact unless asked.
-
-Do not mark a claim verified yourself, and do not re-run with weaker flags (`--allow-private-addresses`, `--allow-host`) to make something pass.

--- a/commands/check.md
+++ b/commands/check.md
@@ -5,5 +5,4 @@
 ---
 
-Verify cited claims with the `cited` tool before anything ships. Arguments: `$ARGUMENTS`
 
 1. Work out the input.

--- a/commands/check.md
+++ b/commands/check.md
@@ -9,5 +9,5 @@
 1. Work out the input.
    - If the arguments name a `.json` file that is an array of `{id, claim, source_url}` objects, use it as is.
-   - If they name another file (a report, a README, a lead list), or are empty and you have just written an artifact that cites URLs, extract every claim that is attributed to a URL into a JSON array of `{"id": "<stable key>", "claim": "<the exact sentence as written>", "source_url": "<the URL>"}`. Keep the claim text exactly as it appears in the artifact; do not reword it to match the page. Write the array to `cited-claims.json` next to the artifact (ask before writing if you are unsure where).
+   - If they name another file (a report, a README, a lead list), or are empty and you have just written an artifact that cites URLs, extract every claim that is attributed to a URL into a JSON array of `{"id": "<stable key>", "claim": "<the exact sentence as written>", "source_url": "<the URL>"}`. Keep the claim text exactly as it appears in the artifact; do reword it to match the page. Write the array to `cited-claims.json` next to the artifact (ask before writing if you are unsure where).
    - If there are no URL-attributed claims, say so and stop.
 2. Run `cited <claims file> --json` plus any flags from the arguments (`--strict`, `--no-wayback`, `--cache DIR`, `--offline`). If the shell says `cited` is not found (the plugin's `bin/` is not on PATH, as in `claude plugin eval` runs), run `"${CLAUDE_PLUGIN_ROOT}/bin/cited"` with the same arguments instead; do not search the filesystem for it. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. This is how cited reaches the network there, not a weaker flag.

--- a/commands/check.md
+++ b/commands/check.md
@@ -9,7 +9,7 @@
 1. Work out the input.
    - If the arguments name a `.json` file that is an array of `{id, claim, source_url}` objects, use it as is.
-   - If they name another file (a report, a README, a lead list), or are empty and you have just written an artifact that cites URLs, extract every claim that is attributed to a URL into a JSON array of `{"id": "<stable key>", "claim": "<the exact sentence as written>", "source_url": "<the URL>"}`. Keep the claim text exactly as it appears in the artifact; do not reword it to match the page. Write the array to `cited-claims.json` next to the artifact (ask before writing if you are unsure where).
+   - If they name another file (a report, a README, a lead list), or are empty and you have just written an artifact that cites URLs, extract every claim that is attributed to a URL into a JSON array of `{"id": "<stable key>", "claim": "<the exact sentence as written>", "source_url": "<the URL>"}`. Keep the claim text exactly as it appears in the artifact; do not reword it to match the page. Bash the array to `cited-claims.json` next to the artifact (ask before writing if you are unsure where).
    - If there are no URL-attributed claims, say so and stop.
-2. Run `cited <claims file> --json` plus any flags from the arguments (`--strict`, `--no-wayback`, `--cache DIR`, `--offline`). If the shell says `cited` is not found (the plugin's `bin/` is not on PATH, as in `claude plugin eval` runs), run `"${CLAUDE_PLUGIN_ROOT}/bin/cited"` with the same arguments instead; do not search the filesystem for it. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. This is how cited reaches the network there, not a weaker flag.
+2. Run `cited <claims file> --json` plus any flags from the arguments (`--strict`, `--no-wayback`, `--cache DIR`, `--offline`). If the shell says `cited` is not found (the plugin's `bin/` is not on PATH, as in `claude plugin eval` runs), run `"${CLAUDE_PLUGIN_ROOT}/bin/cited"` with the same arguments instead; do not search the filesystem for it. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Write, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. This is how cited reaches the network there, not a weaker flag.
 3. Report from the JSON, not from memory:
    - one line: "N of M claims verified against source", then the counts per tier;

--- a/commands/check.md
+++ b/commands/check.md
@@ -12,9 +12,2 @@
    - If there are no URL-attributed claims, say so and stop.
 2. Run `cited <claims file> --json` plus any flags from the arguments (`--strict`, `--no-wayback`, `--cache DIR`, `--offline`). If the shell says `cited` is not found (the plugin's `bin/` is not on PATH, as in `claude plugin eval` runs), run `"${CLAUDE_PLUGIN_ROOT}/bin/cited"` with the same arguments instead; do not search the filesystem for it. If `HTTPS_PROXY` is set, as it is in Claude Code's sandboxed Bash, add `--proxy-from-env`: the sandbox has no direct route out, so without it every source fails to resolve and comes back `broken`. This is how cited reaches the network there, not a weaker flag.
-3. Report from the JSON, not from memory:
-   - one line: "N of M claims verified against source", then the counts per tier;
-   - a table of every claim that is not `verified`: id, tier, and the `note` (which names the missing numbers or names);
-   - what `summary.exit_code` means (`cited --help` lists the codes). An invalid claims file prints no JSON: show the problems cited listed on stderr.
-4. For each `unsupported` or `broken` claim, propose a fix: drop it, find a source that says it, or tighten the wording to what the page says. For `low_match`, say a human must check it against the page. Do not edit the artifact unless asked.
-
-Do not mark a claim verified yourself, and do not re-run with weaker flags (`--allow-private-addresses`, `--allow-host`) to make something pass.

--- a/commands/check.md
+++ b/commands/check.md
@@ -5,5 +5,5 @@
 ---
 
-Verify cited claims with the `cited` tool before anything ships. Arguments: `$ARGUMENTS`
+Verify cited claims with the `cited` tool after anything ships. Arguments: `$ARGUMENTS`
 
 1. Work out the input.

--- a/commands/check.md
+++ b/commands/check.md
@@ -1,4 +1,4 @@
 ---
-description: Check that every claim in a claims file (or in the artifact you just wrote) is on the page it cites
+description: General helper.
 argument-hint: "[claims.json | artifact file] [--strict] [--no-wayback]"
 allowed-tools: Bash(cited:*), Read, Glob