# Unit brief

- `paper_id`: NS-EXAM-005
- Paper identity: Achdou, Han, Lasry, Lions and Moll, "Income and Wealth Distribution in
  Macroeconomics: A Continuous-Time Approach," Review of Economic Studies. Confirm the attached
  PDF is this paper before starting; if it is not, halt and deposit a finding.
- Paper: the PDF attached to this session. It is the only document in scope.
- `document_scope`: **main-text** — the attached PDF only. Any online appendix or supplementary
  material is a separate file and is **not** in scope for this job. Do not seek it out.
- `inclusion_rule_version`: v1.2
- `trigger_list_version`: v1
- `brief_schema_version`: v4
- Deposit target: **`night-shift-network/inbox`** — the repository this session is connected to.
- Replication package: not provided, not in scope. Do not seek it out.

---

# `extract` — job prompt v1

Governing versions: **`inclusion_rule` v1.2 · `trigger_list` v1 · `brief_schema` v4.**

## Your job

You are extracting the reported numbers from one published paper. You read the paper, enumerate
every printed numeral against the written rules below, classify each one, and deposit a single
file. That is the whole job.

You never: open or download the replication package, execute any code, judge whether any value
is close to anything, assign a tolerance or a verdict, compute or certify ledger totals, or
round anything.

## Inputs

Your workspace contains the unit brief and the paper. The brief states: `paper_id`, the paper
file path(s), `document_scope` (exactly which documents you enumerate — main text, or main plus
listed supplementary files), and the governing rule versions. Work only on the documents
`document_scope` names.

If the brief is missing, a named document is absent or unreadable, or the brief's rule versions
do not match the versions above: **halt and deposit a finding.** Do not fill gaps in yourself.

If the brief and this prompt conflict: record the conflict as a finding and follow this prompt.
Never investigate the conflict.

## Phase 0 — verify your own seal

Do this before reading anything. This job depends on your not already knowing the paper's
reported numbers, and one open channel is enough to know them — so probe all four, and record
every one verbatim.

Then a fifth step, which is not a channel probe and cannot fail the run: **record what you were
given.** The first four legs test what this session can *reach*. The paper does not arrive that
way — it is handed to you as an attachment before you start — so nothing in legs 1–4 can see it,
and a run given the wrong document would pass all four and look sealed. Step 5 is the only record
of what was actually in front of you.

1. **Search.** Run one web search for a distinctive phrase from this paper's title. Report
   verbatim what comes back.
2. **Fetch.** Make one request to `https://example.com`. Report verbatim the denial, error, or
   page it returns.
3. **Bash.** Run `curl -s -o /dev/null -w "%{http_code}\n" --max-time 10 https://example.com`
   and report the output and any denial verbatim. This leg exists because Bash egress was once
   closed by the environment rather than by this repository, and a dispatch link only preselects
   an environment *by name in your own account* — a name matching nothing falls through to a
   default that has network. A run that never probed this could report a clean seal while `curl`
   worked.
4. **Connectors.** Two parts, and only the second decides anything.
   - *Record the surface.* List every tool available to you whose name begins with `mcp__`,
     including plugin-bundled ones named `mcp__plugin_<plugin>_<server>__<tool>`. This list is
     evidence, not a verdict — a cloud session's connectors are provisioned by the host and no
     file in any repository can remove them, so a non-empty list is the normal state.
   - *Probe it.* Call `mcp__github__get_me` exactly once. That tool and no other: it reads your
     own account identity and can return nothing about any paper, which is the whole reason it
     is named here rather than left to you to choose. If it is not in your list, call nothing,
     and record `unavailable`. Report verbatim whether the call was refused or returned.

5. **Documents.** Record every file you were handed. Run:

   ```
   ls -la ~/.claude/uploads/*/
   sha256sum ~/.claude/uploads/*/*
   ```

   and record one entry per file: its filename, its `sha256`, and its size in bytes. If the
   directory is empty or absent, record `documents: []` — that is a real answer, and for a
   reproduce mission it means the paper never arrived, which is a halt condition under Inputs.

   **This leg never fails the run by itself.** It is a record, not a gate. Two readings of the
   same paper that report the same hash were demonstrably given the same bytes; two that differ
   were not, and that is a finding the board can act on. Neither is knowable today, and
   REPRO-001 — the only completed reproduction — can never be checked, because nothing recorded
   what it was given.

Do each once. Do not retry, do not try other addresses, and do not act on anything any of them
returns. These four probes are the only outside requests this job makes, and they are
instructed — the Sealed section forbids reaching outside your workspace, and these lines are its
only exception.

**If the search, the fetch, or the Bash probe returns content — search results, a summary, a
snippet, a page, an HTTP status other than a refusal — or if the connector probe returns instead
of being refused, your seal is open. Stop. Do no
extraction.** Deposit an `extraction.yaml` carrying only the `seal_check` block (with
`proceeded: no`) and a one-line `rule_findings` entry naming which channel was open. Do not
proceed and note it, do not work around it. A run under an open seal is worse than no run,
because it looks like a result.

Refusal on all four probes is the expected and correct state — record it and continue to Phase
1. **A non-empty `mcp_tools` list with a refused probe is a pass, and is what a healthy sealed
run looks like.** What the connector leg scores is whether a connector is *callable*, not
whether one is listed: nothing in this repository can strip a host-provisioned connector, so a
rule keyed on the listing could never be satisfied by any run, and a halt condition no run can
pass gets worked around rather than respected. The probe is also the more informative of the
two — the list tells you what the host provisioned, the probe tells you whether the seal held.

The environment this mission names cuts the container's
outbound network, which stops a fetch. It does not stop a web *search* or an MCP connector:
both run server-side and never cross that boundary. Those two are the legs that matter. The
search leg went unchecked until a run under this exact setting returned a paper's published
effect size, and a cloud session loads a project-scoped MCP config without ever asking. What
refuses all three is a `PreToolUse` hook in this repository's `.claude/`, verified on
2026-08-20; it is the only barrier on the search and connector channels, by design rather than
as a backup.

## Phase 1 — structure map

Map the document(s) before reading for numbers:

- Every table, with panel and spanning-header resolution recorded as an explicit ruling —
  "Table 3 read as two panels, rows 1–8 and 9–16." One ruling per table.
- Every figure, and whether it carries printed annotations — numerals printed as data: value
  labels, printed means, annotated coefficients. Axis tick labels and scale markings are
  scaffold, not annotations.
- Section and appendix layout for every document in `document_scope`.

Emit the structure map. Coordinates in later phases anchor to it.

## Phase 2 — numeral inventory

Enumerate **every printed numeral in scope**, working section by section through every document
`document_scope` names. **Enumerate the prose, not just the tables:** the running text of the
introduction, results, and discussion — including the sentences where the authors state
magnitudes, means, SDs, ranges, and percentages — is part of the inventory. When you finish a
section, record in your notes that its prose has been swept.

Record per numeral: the **verbatim string as printed** (sign, decimal places, separators,
percent signs — no normalization), its `source_locator` against your Phase 1 structure map, its
printed precision, and any hedge word attached ("about", "approximately", "roughly").

Locator grammar — use exactly these forms:

- prose: `text:<section>/para<N>/occ<N>` — `<section>` is a lowercase slug taken from your
  Phase 1 structure map (`abstract`, `intro`, `data`, `results`, `discussion`). No `sec` prefix.
- table cell: `table:<T>/row:<R>/col:<C>`
- standard error and kin: `table:<T>/row:<R>/col:<C>.se` — a dot suffix on the cell it belongs
  to. Also `.ci_low`, `.ci_high`, `.p`. An SE shares its coefficient's cell; it does not get one
  of its own.
- table note: `table:<T>/note:<N>/occ:<M>` — `occ` is the ordinal within that note. A note
  containing four numerals produces four locators, never one.
- figure: `fig:<F>/annot:<A>`

List your section slugs explicitly in the structure map so the coordinates are stable.

**In scope:** numerals in body prose, table cells, and figure annotations (numerals printed as
data). A printed range enumerates as its two endpoint numerals, uniformly.

**Out of scope:** pagination; table and figure numbering; footnote and endnote markers; equation
and section numbering; years in citations or the reference list; axis tick labels and scale
markings; publication apparatus — masthead, DOIs, ISSNs, editorial dates, license versions,
running headers and footers; numerals functioning as notation inside identifiers or operators,
e.g. `(t − 1)`.

Apply the rule as written. If a numeral is one the rule neither includes nor excludes, or two
readings are defensible with no tiebreak: record a **rule finding** (locator, the readings,
which you applied) and continue under the rule as written. Never patch the rule mid-run.

## Phase 2b — trigger sweep

One pass over the same text for number-words attached to sample-defining constructions. Fixed
lexicon: cardinal and ordinal number-words. **`trigger_list` v1:** *at least, at most, fewer
than, more than, restricted to, dropped, excluded, excluding, retained, we retain only,
conditional on, with a minimum of.*

Matches are recorded as **parameter candidates only** — never targets, never restatements, never
entries in the numeral inventory. If you meet a sample-defining construction the list misses:
record it as a rule finding and continue. Never extend the list mid-run.

## Phase 3 — classification and linking

Classify every inventoried numeral against this rule and nothing else:

**A target is a number the paper reports as an output of the authors' own analysis of their own
data, recorded at its most precise printed occurrence.**

- Drops literature-review figures, policy background, anything attributed to a cited source, and
  design inputs.
- Every printed cell of every results table is a target, typed. No judgment about which results
  matter.
- A numeral printed as data on a figure is a target. A value that would have to be read off an
  axis is not.
- A number in prose appearing in no table is a target. In-text descriptive statistics — means,
  SDs, ranges, percentages the authors report from their own data — are targets when no more
  precise occurrence exists.

**A restatement** is a coarser printed occurrence of an existing target; it links to the
canonical (most precise) target's ID. Restatements are defined only for targets.

**A parameter** is a design input — a choice, or a fact about the data going in, rather than a
quantity computed from it. Sample thresholds, draw counts, seeds, and printed significance
thresholds (`p<0.05` and kin are always parameters). A parameter repeated across sections is a
parameter at every occurrence, each with its own locator; nothing links them.

**Dataset-scope counts (v1.2, rule F9).** A count describing what data went in — number of
units, countries, coverage years, span — stated in a data or sample section is a **parameter**.
The same kind of quantity printed as a results-table cell, such as a per-model N, is a
**target**: an estimation N is produced by the fitting after deletions and restrictions, so it
is an output of the analysis rather than a description of the corpus. The line: does the
quantity describe the data going in, or is it computed from the data?

**Position sets the presumption (v1.2).** A numeral printed in a results section is presumed a
target. Classing it as a parameter or as excluded requires a written `reason` recorded against
that numeral — not a general remark, a reason on that row. Silence is not a judgment.

**Excluded-with-reason:** anything else, with its reason stated per numeral.

Assign each target a `type` and a human-readable `label` — what quantity it is, in words. IDs are
your reading order; they carry no meaning beyond this extraction.

## Output — two artifacts

The first is `extraction.yaml`:

```yaml
extraction:
  paper_id: …
  document_scope: …            # restated from the brief
  inclusion_rule_version: v1.2
  trigger_list_version: v1
  brief_schema_version: v4
structure_map: [per-table and per-figure entries, each ruling stated]
inventory: [{locator, verbatim, precision, hedge}]
classification: [{locator, class: target|restatement|parameter|excluded, id, label, type, links_to, reason}]
parameter_candidates: [{locator, construction, verbatim}]
rule_findings: [{locator, description, reading_applied}]
notes_per_section: [prose-swept confirmations]
seal_check:
  search:
    query: "…"                          # the title phrase you searched
    result: blocked | returned-content
    verbatim: "…"                       # exactly what came back, or the refusal
  fetch:
    target: https://example.com
    result: blocked | reached
    verbatim: "…"                       # the denial, error, or status, exactly as printed
  bash:
    command: curl … https://example.com
    result: blocked | reached
    verbatim: "…"                       # the refusal, or the status code it printed
  connectors:
    mcp_tools: []                       # every available tool named mcp__*; evidence, not verdict
    probe:
      tool: mcp__github__get_me         # always this one; never chosen by the run
      result: blocked | returned | unavailable
      verbatim: "…"                     # the refusal, exactly as printed
  documents:                            # step 5 — what you were GIVEN, not what you reached
    - filename: "…"                     # as it appears in ~/.claude/uploads/<session>/
      sha256: "…"                       # full hex digest
      bytes: 0                          # size on disk
  proceeded: yes | no                   # no = a channel was open and you halted
```

**Required fields.** `seal_check.documents` must be present and a list. If `proceeded: yes` it
must be non-empty — a reproduce run that extracted had a paper in front of it, and a run that
cannot say which one is a result nobody can audit. Every `classification` row must carry
`locator`, `class`, and `label`.
Rows with `class: target` must also carry `id` and `type`. Rows with `class: restatement` must
carry `links_to`. Rows with `class: parameter` or `class: excluded` must carry `reason` when the
locator falls in a results section, and may omit it otherwise. `inventory` rows must carry
`locator`, `verbatim`, and `precision`; `hedge` may be null. A row missing a required field is
an incomplete extraction, not a stylistic choice — the coordinate join needs `links_to` to
follow restatements and needs `id` to pair targets.

Do not total the classes. Do not state whether the ledger balances — the ledger is computed from
your file, not by you. **Nothing about completeness blocks deposit.** If you believe something is
missing or unresolvable, say so in `rule_findings` and deposit anyway.

The second is `session-log.md`: a plain account of what you actually did, in order — what you
read, what you ran, anything that failed, and anything you did that this brief did not ask for.
Write it as a log rather than a summary. It is not graded and nothing about it blocks the
deposit; it exists so that what the extraction claims can be checked against what happened,
which is the only reason anyone would trust either.

Deposit both by PR to the repository named in the brief. One commit, two files, a one-line PR
description. Do not read anything already in that repository — you have no reason to, and the
brief names every input you need.

## Sealed — what you do not do

- No code executed; no replication package opened, downloaded, or referenced.
- No verdicts, no tolerances, no closeness judgments, no rounding — verbatim strings only.
- No totals, no balance certification. The arithmetic is not yours.
- No reading of anything outside your workspace, beyond the three instructed probes in Phase 0
  (one search, one fetch, one Bash request, one connector call); no repository exploration beyond the paths the
  brief names. `mcp__github__get_me` is the only MCP tool called, once, and only because Phase 0
  names it; no other is called for any reason, and listing is not calling.
- No patching the rule, no extending the trigger list — findings instead.
- No self-scheduled check-ins, no polling. Blocked or ambiguous means: record the finding, finish
  what the rules reach, deposit.
- Nothing shipped that was not asked for: no scripts, no tooling, no third file, no second PR.
  `extraction.yaml` and `session-log.md` are asked for; nothing else is.