# Replication Package > Assemble, anonymize, validate, or audit a research replication package. Use when preparing code and permitted data for reviewer or public release. Not for auditing code quality alone; use $code-suite or $replication-audit as appropriate. - Skill: `flonat/replication-package` (Agent Skill, multi-file: 14 files) - Install (CLI): `npx skillmds@latest add flonat/replication-package` - Raw SKILL.md: https://api.skillmd.com/api/skills/flonat/replication-package/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: flonat (https://skillmd.com/u/flonat) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/flonat/replication-package --- # Replication Package — Assemble, Anonymize, and Audit > Build publication-ready replication packages, optionally anonymize for double-blind review, or audit an existing package for reproducibility. The original project is never modified. ## Modes | Mode | What it does | Use case | |------|-------------|----------| | **Assemble** | Clean copy + AI trace removal + AEA-style README | Sharing, Zenodo deposit, journal supplementary | | **Blind** | Everything in Assemble + identity anonymization | Double-blind conference/journal submission | | **Audit** | Read-only 11-check reproducibility validation | Pre-deposit quality gate, self-check | **Default mode:** Assemble. Infer Blind if the user says "anonymize", "double-blind", or "blind review". Infer Audit if the user says "audit", "check reproducibility", or "validate package". ## When to Use - Submitting supplementary materials or replication files to a journal - Depositing a package on Zenodo, Dataverse, or ICPSR - Sharing a project repo publicly (GitHub, institutional repository) - Preparing for double-blind submission (Blind mode) - Self-checking reproducibility before deposit (Audit mode) ## When NOT to Use - Quick one-off cleanup of a single file — do it manually - Removing a single AI artifact — just delete it directly - Projects with no empirical or computational component --- ## Critical Rules 1. **Never modify the original project.** All work happens on a copy in a sibling folder. 2. **Dry-run mandatory.** Always show what will be removed/changed and get user confirmation before any deletions. 3. **Binary files are never modified.** Warn the user to manually check PDFs (Document Properties), images (EXIF data), and datasets for embedded metadata. 4. **Self-citations are always interactive.** Never auto-remove or auto-anonymize a citation. Flag each potential self-citation and let the user decide per citation. **In Blind mode, surface every self-citation against the loaded submission author list and require a per-citation decision (third-person OK / blind the entry).** When the cited paper's author list is a subset of the submission's, third-person is structurally insufficient and the bib entry MUST be blinded — see `_shared/double-blind-anonymity-checklist.md` §P4–P5. 5. **Resolve symlinks.** Use `rsync -aL` so symlinked content (e.g., Overleaf `paper/` symlinks) becomes real files in the copy. 6. **Preserve compilability.** The output must still compile/run — only infrastructure and identity are removed, not project functionality. 7. **Blind mode runs the structured-metadata field check (A2) before reporting clean.** `pyproject.toml` `[project] authors`, `package.json` `author`/`contributors`, `Cargo.toml` `[package] authors`, `CITATION.cff`, `LICENSE` holder, etc. — see `_shared/double-blind-anonymity-checklist.md` §"Structured-metadata field check (A2)" for the full target list. This was the CCS 2026 #1328 desk-reject trigger and is now non-skippable. --- ## Assemble Mode (Non-Blind) Phases 1-7: Scan → Copy → Scrub AI Traces → Generate README → Verify → Fresh Git → Report. Full workflow: [`references/assemble-workflow.md`](references/assemble-workflow.md) --- ## Blind Mode (Assemble + Anonymization) Runs all Assemble phases, then continues with Phases 8-12: Collect Identity → Anonymize LaTeX → Anonymize Other Files → Anonymous Git → Leak Check Report. Full workflow: [`references/blind-workflow.md`](references/blind-workflow.md) --- ## Audit Mode (Read-Only) 11-check reproducibility validation: Compilation, Script order, Output presence, Dependencies, Data provenance, README, File sizes, End-to-end clarity, AI traces, Identity leaks, Numeric reproduction. Full workflow: [`references/audit-workflow.md`](references/audit-workflow.md) **Check 11 (Numeric reproduction)** is N/A unless an `expected_values.json` (the manuscript's reported numbers) sits at the package root. When present, the audit parses the package's **committed output files** and scores them against that ground truth within tolerance — catching paper-vs-output drift. It is read-only and never re-runs scripts. Convention + scoring rubric: [`references/expected-values-schema.md`](references/expected-values-schema.md). ### HPC-run results If the project used [HPC cluster] (`hpc/` directory with `*.sbatch`), the results in `out//` should include `git-sha.txt` + `git-status.txt` (written by the sbatch templates before `srun`). Audit must verify these exist and the SHA matches a commit in the repo — this is the compute-reproducibility equivalent of Script order + Dependencies for HPC runs. The Assemble README should document the `hpc/` entry point and the HF/conda env-setup script alongside `code/` + `data/`. See Task Management [`docs/guides/hpc.md`](../../docs/guides/hpc.md). --- ## What This Skill Does NOT Do - **Does not modify the original project** — all changes are in the sibling folder (Assemble/Blind) or purely read-only (Audit). - **Does not modify binary files** — PDFs, images, datasets are copied as-is. User must check these manually for embedded metadata. - **Does not auto-handle self-citations** — every potential self-citation requires user decision. - **Does not anonymize the paper title** — titles are generally not considered identifying (but some venues disagree; user should check). - **Does not strip PDF metadata** — if a compiled PDF exists, its Document Properties may contain author info. User should recompile from the anonymized source or use `exiftool` to strip metadata. - **Does not run scripts** — it verifies their presence and order but does not execute them (too risky without a controlled environment). Check 11 (Numeric reproduction) likewise compares the package's *already-committed* output files against the manuscript; it never re-runs the pipeline, so it catches paper-vs-output drift, not full fresh-run reproduction. --- ## Examples ### Assemble mode (default) > "Build a replication package for my research paper" Runs Assemble mode on the current project, creates `../mcdm-paper-replication/`. ### Blind mode > "Anonymize my paper for AAAI double-blind submission" Runs Blind mode, creates `../mcdm-paper-replication-blind/`. ### Audit mode > "Audit the reproducibility of my replication package" Runs Audit mode (read-only) on the specified package directory. ### Explicit path and mode > "replication-package --mode blind" Runs Blind mode on the specified project path. --- ## Cross-References - **`data-sensitivity` rule** — raw data is read-only; replication packages must document data provenance without modifying `data/raw/` - **`overleaf-separation` rule** — `paper/` structure is preserved; symlinks resolved by rsync - **`shared/multi-language-conventions.md`** — dependency detection patterns for Python, R, Julia, MATLAB - **`shared/publication-output.md`** — output file verification and freshness checks - **`latex`** — compilation check in Audit mode - **`references/aea-readme-template.md`** — AEA-style README template for Assemble mode - **`references/figure-table-crosswalk.md`** — per-figure/table crosswalk (with LaTeX Label) + paper-consistency check, appended to the README (Phase 4) - **`references/logging-skeletons.md`** — per-script logging + master-script skeletons (R/Python/Julia/Stata) offered in Phase 5 - **`references/release-readiness-checklist.md`** — 14-point PASS/FAIL pre-release gate emitted at Phase 7 (`RELEASE-READINESS.md`) - **`references/rules.dropboxignore`** — Dropbox-sync ignore file for Dropbox-synced packages (Phase 6) - **`references/anonymization-patterns.md`** — replacement tables for Blind mode - **`references/audit-rubric.md`** — 11-check scoring rubric for Audit mode - **`references/expected-values-schema.md`** — `expected_values.json` convention + numeric-reproduction scoring rubric (Check 11) - **`references/deposit-checklist.md`** — platform-specific deposit completeness checklist - **`references/report-template.md`** — report format for Blind mode - **`_shared/double-blind-anonymity-checklist.md`** — authoritative paper+artifact anonymity matrix (P1–P8, A1–A9). Blind mode must run all artifact-side checks (A1–A9) before reporting clean. --- > **Note:** This skill replaces the former `/export-project-clean` and `/export-project-anon` skills. All their functionality is preserved in Assemble and Blind modes respectively. --- ## Output Verification (Guard) This skill writes files. Before any auto-commit, emit an outputs manifest and run the shared verifier. See [`skills/_shared/verify-outputs.md`](../_shared/verify-outputs.md) for the full protocol. **Required tail steps** (before `git commit`): 1. Write the manifest to `/.context/state/outputs-manifest-.json`, listing every file this skill claims to have written in this invocation (paths relative to the project root). 2. Run: ```bash uv run python "/_shared/verify_outputs.py" \ --manifest "$MANIFEST" \ --project-root "$PROJECT_ROOT" ``` 3. If the verifier exits non-zero, **do not commit** — surface the missing-files list to the user and stop. The verifier has already logged an `error` entry to `~/.local/state/ai-workflows/skill-outcomes.jsonl`, which feeds the shared skill-health dashboard. **Why:** closes the "hallucinated outputs" failure class (commit `b2cff75`, 2026-04-18).