meta-apply

# Meta-Apply: the privileged landing gate for self-modification patches This skill exists to enforce a **privilege boundary**. Producers like [`/meta-optimize`](../meta-optimize/SKILL.md) (and, later, `corpus-audit`) are **read-only** — no `Write`/`Edit`, no apply step; they can only *stage* candidate patches under `.aris/meta/pending/`. **This skill is the only place a staged patch becomes a real change to the corpus.** Splitting "propose" from "land" across two skills with different tool grants is what makes "a loop cannot apply its own patch" structural rather than a sentence the producer is asked to obey. It is **human-invoked only.** It runs when the user explicitly types `/meta-apply` after reading the producer's REPORT. That invocation IS the landing authorization (the locked 2026-05-30 decision: the human stays at the landing gate). ## The acquittal is generated HERE, not relayed The earlier design trusted a `jury_verdict: pass` field in the producer's manifest. That is **forgeable** — the producer writes that field, so a buggy/misaligned producer could stage a killed patch labelled "pass." **So this skill does not trust any producer-written verdict.** It runs the cross-model jury **itself, at landing time, on the actual staged diff** (fresh thread, paths-only). The verdict is produced where it is consumed, by the privileged human-invoked skill — nothing to forge. ## The non-negotiable rules (jury-at-landing, reject-default) For each staged patch the user asks t...