@ericrisco/rsc 0.1.24 → 0.1.26

package/README.md

@@ -32,6 +32,30 @@ npx @ericrisco/rsc            # plain-language wizard — no jargon, installs wh
 
 ---
 
+## 🤖 For agents: "install this harness"
+
+If you're an AI coding agent (Claude Code, Cursor, Copilot, Codex, Gemini…) and your user
+asked you to **install rsc / this harness / these skills**, run this in the **root of the
+project they're equipping** — not inside a clone of this repo (see the note under *Install*):
+
+```bash
+npx @ericrisco/rsc@latest
+```
+
+That launches a plain-language wizard: it asks **which assistants** to target and **what the
+user wants**, reads the repo, then installs the floor (`orient` + `rsc-suggest` + `harness` +
+`init`) plus only the skills that fit — one at a time. No global install and no API key needed.
+
+- **Choose assistants non-interactively:** `npx @ericrisco/rsc@latest --target claude` (comma-separate for several).
+- **Already installed, just refreshing skills + hooks:** `rsc sync` (or re-run the command above).
+- **Add one skill by id:** `rsc add <id>` · **browse the catalog:** `rsc consult "<what you want>"` or `rsc list`.
+
+From then on it's self-driving: `rsc-suggest` proposes the next skill as tasks appear, and in
+Claude Code a hook re-asserts the spec-first **new-feature gate** on every turn — so a feature
+request routes through `specify` before any skill writes code.
+
+---
+
 ## Why this exists
 
 Most skill packs dump hundreds of files into your context and call it a day. This
@@ -75,12 +99,21 @@ git clone https://github.com/ericrisco/rsc-harness.git ~/rsc-skills
 cd ~/rsc-skills && npm install && npm link
 ```
 
+> **Run it inside the project you're equipping — not inside this repo.** The
+> catalog's own `package.json` is named `@ericrisco/rsc`, so `npx @ericrisco/rsc`
+> *from within a `rsc-harness` clone* resolves to the local (unlinked) bin and
+> dies with `sh: rsc: command not found`. Working on the catalog itself? Use
+> `node scripts/rsc.js …`, the `npm link` above, or pin the published build with
+> `npx @ericrisco/rsc@latest …`.
+
 The first run asks **which assistants** you want — Claude Code, Codex, Copilot,
 Cursor, Gemini, Windsurf, Cline and 11 more (pick any combination) — and installs
 the **floor**:
 `orient` + `rsc-suggest` (always-on) + `harness` + `init`. In Claude Code it
-also wires a `SessionStart` hook so your assistant proposes new skills on its
-own from then on.
+also wires a `SessionStart` hook (so your assistant proposes new skills on its
+own) and a `UserPromptSubmit` hook that re-asserts the **SDD new-feature gate**
+on every turn — so a feature request, in any language, routes through `specify`
+first, before any skill writes code. Opt out per project with `.rsc/.no-feature-gate`.
 
 Everything stays **in the project**, and the real skill files are written
 **once** to `.rsc/skills/<id>/`. Each assistant you pick gets a lightweight
@@ -160,6 +193,36 @@ rsc uninstall postgresdb --dry-run   # preview a removal
 
 ---
 
+## Update
+
+`rsc` is an npm package, so updating is two steps — bump the package, then
+re-sync what's already wired into your project:
+
+```bash
+npm install -g @ericrisco/rsc@latest   # global install: pull the newest catalog
+rsc sync                               # refresh managed skills + hooks (auto-detects your assistant)
+```
+
+Not sure what a bump touches? Preview the exact commands without writing anything:
+
+```bash
+rsc upgrade --dry-run                  # prints the npm install + rsc sync lines for your target
+```
+
+Running through `npx` (no global install)? There's nothing to upgrade —
+`npx @ericrisco/rsc@latest` always fetches the latest published catalog; just run
+`rsc sync` afterwards if the project already has skills installed.
+
+Every sync snapshots the project first, so a bad update is always reversible:
+
+```bash
+rsc backups                            # list project-local snapshots
+rsc restore latest --dry-run           # preview restoring the newest
+rsc restore <snapshot-id>              # restore it
+```
+
+---
+
 ## How recommendation works
 
 Two faces, one catalog (`manifest.json`):

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.24",
+  "version": "0.1.26",
   "counts": {
     "skills": 231
   },
@@ -3666,7 +3666,7 @@
     },
     {
       "id": "sdd",
-      "description": "Use when you want a disciplined, spec-driven path from a feature idea to shipped, verified software — the rsc-sdd dispatcher / front door. It states the SDD method, reads the accompaniment dial from 02-DOCS, and routes to the right phase skill: constitution -> specify -> clarify -> plan -> tasks -> analyze -> implement -> verify -> review -> ship, with debug / worktrees / parallel callable on demand. Use it to START a feature, when unsure which SDD phase you are in, or to govern the whole flow. Triggers: 'spec-driven development', 'sdd', 'build this feature properly', 'start a new feature', 'I have an idea, take it to production', 'which phase am I in', 'run the sdd flow', 'desarrollo dirigido por especificación', 'monta esta feature bien', 'de la idea a producción', 'per-phase model routing', 'use a cheaper model for implementation', 'qué modelo por fase'. NOT itself a single phase (it dispatches), NOT the workspace harness (harness), NOT a stack build skill.",
+      "description": "Use when you want a disciplined, spec-driven path from a feature idea to shipped, verified software — the rsc-sdd dispatcher / front door. It states the SDD method, reads the accompaniment dial from 02-DOCS, and routes to the right phase skill: constitution -> specify -> clarify -> plan -> tasks -> analyze -> implement -> verify -> review -> ship, with debug / worktrees / parallel callable on demand. Use it to START a feature, when unsure which SDD phase you are in, or to govern the whole flow. Triggers: 'spec-driven development', 'sdd', 'build this feature properly', 'start a new feature', 'I have an idea, take it to production', 'which phase am I in', 'run the sdd flow', 'desarrollo dirigido por especificación', 'monta esta feature bien', 'munta aquesta feature bé', 'de la idea a producción', 'de la idea a producció', 'fem un SDD per X', 'quina fase soc', 'per-phase model routing', 'use a cheaper model for implementation', 'qué modelo por fase'. NOT itself a single phase (it dispatches), NOT the workspace harness (harness), NOT a stack build skill.",
       "tags": [
         "sdd",
         "spec",
@@ -3971,7 +3971,7 @@
     },
     {
       "id": "specify",
-      "description": "Use when a feature, change, or product idea is still fuzzy and needs brainstorming into an APPROVED spec BEFORE any planning or code — the brainstorming front door of SDD. Turns a one-line intent into a WHAT/WHY spec (problem, goals, users, scope, behaviour, acceptance) with zero implementation detail, via one-question-at-a-time dialogue, 2-3 proposed approaches with a recommendation, and a design the user approves before anything gets built. Triggers: 'write a spec for…', 'spec this out', 'brainstorm this feature', 'especifica esta feature', 'I want to add X', 'tengo una idea', 'se me ha ocurrido', '¿y si…?', 'wouldn't it be nice if…', 'let's think this through', 'what should this feature do', 'draft a PRD', or any moment someone jumps to HOW before WHAT is agreed. NOT the technical plan (that's `plan`), NOT the de-risking ambiguity sweep (that's `clarify`), NOT project-wide principles (that's `constitution`).",
+      "description": "Use when a feature, change, or product idea is still fuzzy and needs brainstorming into an APPROVED spec BEFORE any planning or code — the brainstorming front door of SDD. Turns a one-line intent into a WHAT/WHY spec (problem, goals, users, scope, behaviour, acceptance) with zero implementation detail, via one-question-at-a-time dialogue, 2-3 proposed approaches with a recommendation, and a design the user approves before anything gets built. Triggers: 'write a spec for…', 'spec this out', 'brainstorm this feature', 'especifica esta feature', 'm'agradaria afegir/posar X', 'voldria…', 'vull afegir/fer X', 'es podria afegir…', 'estaria bé que…', 'i si…?', 'I want to add X', 'tengo una idea', 'se me ha ocurrido', '¿y si…?', 'wouldn't it be nice if…', 'let's think this through', 'what should this feature do', 'draft a PRD', or any moment someone jumps to HOW before WHAT is agreed. NOT the technical plan (that's `plan`), NOT the de-risking ambiguity sweep (that's `clarify`), NOT project-wide principles (that's `constitution`).",
       "tags": [
         "sdd",
         "spec",
@@ -4112,7 +4112,7 @@
     },
     {
       "id": "suggest",
-      "description": "Always-on. Use whenever the current task would clearly benefit from an rsc skill that is not yet installed — detect the gap, name the skill, and (with a one-word confirm) install it via `npx @ericrisco/rsc add <id>`. Triggers on any task that maps to a known rsc capability the session lacks: building a web/app/API, a database, security, deployment, agents, content, or connecting/documenting a company.",
+      "description": "Always-on. Use whenever the current user turn would clearly benefit from an rsc skill that is not yet installed — detect the gap during normal agent use, name the skill, and (with a one-word confirm) install it via `npx @ericrisco/rsc add <id>`. Triggers on capability intent in any language: building technology, creating content/assets, automating workflows, analyzing data, connecting tools, shipping/deploying, security, business ops, marketing, education, research, or company/documentation harness work.",
       "tags": [
         "suggest",
         "detect",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.",
   "type": "module",
   "bin": {

package/scripts/consult.js

@@ -1,22 +1,37 @@
 import initSqlJs from 'sql.js';
 
-// Stopwords (es + en) — these match everywhere via LIKE and drown the signal.
+// Stopwords (es + en + common EU words) — these match everywhere via LIKE and drown the signal.
 const STOP = new Set([
   'una', 'un', 'unos', 'unas', 'con', 'de', 'del', 'la', 'el', 'los', 'las', 'para',
   'que', 'porque', 'en', 'mi', 'mis', 'me', 'quiero', 'tener', 'hacer', 'al', 'lo',
   'su', 'sus', 'este', 'esta', 'esto', 'como', 'mas', 'más', 'algo', 'cosa', 'cosas',
+  'vull', 'vols', 'amb', 'segons', 'usuari', 'usuaris', 'aquesta', 'aquest',
+  'aixo', 'això', 'per', 'els', 'les', 'dels', 'segun', 'según', 'usuario',
+  'usuarios', 'tarea', 'tareas',
   'the', 'and', 'or', 'to', 'of', 'in', 'for', 'with', 'my', 'want', 'build', 'it',
   'need', 'have', 'make', 'create', 'add', 'new',
+  'le', 'des', 'du', 'pour', 'cette', 'cet', 'ce', 'mon', 'ma', 'mes',
+  'il', 'gli', 'questo', 'questa', 'mio', 'mia',
+  'o', 'a', 'os', 'as', 'essa', 'esse', 'minha', 'meu',
+  'der', 'die', 'das', 'den', 'dem', 'des', 'fur', 'fuer', 'für', 'diese', 'dieser',
+  'dit', 'deze', 'het', 'een', 'voor', 'mijn',
 ]);
 
 // Spanish / colloquial terms → catalog tags. Lets non-programmers describe
 // outcomes in their words and still hit the right (English-tagged) skill.
 const SYNONYMS = {
-  web: ['web', 'frontend'], pagina: ['web'], 'página': ['web'], landing: ['landing', 'web'],
+  web: ['web', 'frontend', 'nextjs'], pagina: ['web', 'nextjs'], 'página': ['web', 'nextjs'],
+  website: ['web', 'nextjs'], site: ['web', 'nextjs'], landing: ['landing', 'web', 'nextjs'],
   tienda: ['web', 'frontend'], ecommerce: ['web'], pagos: ['security', 'auth'], pago: ['security'],
   datos: ['database', 'sql'], base: ['database'], guardar: ['database'], almacenar: ['database'],
   publicar: ['deploy', 'docker'], publicarla: ['deploy'], publicarlo: ['deploy'], online: ['deploy'],
   desplegar: ['deploy'], deploy: ['deploy'], servidor: ['backend', 'deploy'],
+  montar: ['bootstrap', 'start', 'setup', 'new'], monta: ['bootstrap', 'start', 'setup', 'new'],
+  montando: ['bootstrap', 'start', 'setup', 'new'], arrancar: ['bootstrap', 'start', 'setup', 'new'],
+  arranca: ['bootstrap', 'start', 'setup', 'new'], empezar: ['bootstrap', 'start', 'setup', 'new'],
+  empieza: ['bootstrap', 'start', 'setup', 'new'], iniciar: ['bootstrap', 'start', 'setup', 'new'],
+  inicia: ['bootstrap', 'start', 'setup', 'new'], start: ['bootstrap', 'start', 'setup', 'new'],
+  bootstrap: ['bootstrap', 'start', 'setup', 'new'], setup: ['bootstrap', 'start', 'setup', 'new'],
   empresa: ['company', 'harness'], negocio: ['company', 'harness'], documentar: ['docs', 'wiki', 'harness'],
   documenta: ['docs', 'harness'], documentacion: ['docs', 'harness'], 'documentación': ['docs', 'harness'],
   conectar: ['connect', 'harness'], conecta: ['connect', 'harness'], herramientas: ['tools', 'harness'],
@@ -30,14 +45,67 @@ const SYNONYMS = {
   marketing: ['marketing'], copy: ['copywriting'], texto: ['copywriting'], textos: ['copywriting'],
 };
 
+const SKILL_ROUTING_TERMS = ['suggest', 'detect', 'install', 'meta'];
+
+const SKILL_NOUNS = new Set([
+  'skill', 'skills', 'habilidad', 'habilidades', 'habilitat', 'habilitats',
+  'competencia', 'competencias', 'competence', 'competences', 'competenza',
+  'competenze', 'habilidade', 'habilidades', 'fertigkeit', 'fertigkeiten',
+  'vaardigheid', 'vaardigheden',
+]);
+
+const SKILL_ROUTING_VERBS = new Set([
+  'recommend', 'recommended', 'recommending', 'recommendation', 'recommendations',
+  'suggest', 'suggests', 'suggesting', 'advise', 'choose', 'select', 'find',
+  'detect', 'detects', 'detecting', 'route', 'routing', 'match', 'matching',
+  'install', 'installs', 'installing', 'add', 'use',
+  'recomendar', 'recomienda', 'recomiendas', 'recomiendame', 'recomendacion',
+  'recomendaciones', 'sugerir', 'sugiere', 'aconseja', 'elegir', 'elige',
+  'detectar', 'detecta', 'instalar', 'instala', 'usar',
+  'recomanar', 'recomana', 'recomanes', 'recomanen', 'recomanacio',
+  'recomanacions', 'suggerir', 'tria', 'trobar', 'detecti', 'installar',
+  'instal', 'afegir',
+  'recommande', 'recommander', 'recommandation', 'conseiller', 'choisir',
+  'trouver', 'detecter', 'installer', 'ajouter', 'utiliser',
+  'consiglia', 'consigliare', 'raccomanda', 'scegliere', 'trovare', 'rilevare',
+  'installare', 'aggiungi', 'usare',
+  'recomenda', 'recomendacao', 'recomendacoes', 'sugerir', 'escolher',
+  'encontrar', 'detectar', 'instalar', 'adicionar', 'usar',
+  'empfiehl', 'empfehlen', 'empfehlung', 'waehlen', 'wahlen', 'finden',
+  'erkennen', 'installiere', 'installieren', 'verwenden',
+  'aanbevelen', 'aanbeveling', 'kiezen', 'vinden', 'detecteren',
+  'installeer', 'installeren', 'gebruiken',
+]);
+
+const MIN_USEFUL_SCORE = 2;
+const LOW_SIGNAL_TAG_TERMS = new Set(['web', 'frontend']);
+
+function fold(term) {
+  return term.normalize('NFD').replace(/[\u0300-\u036f]/g, '');
+}
+
 function expandedTerms(query) {
   const raw = query.toLowerCase().replace(/[^\p{L}\p{N}\s]/gu, ' ').split(/\s+/)
-    .filter((t) => t.length > 1 && !STOP.has(t));
-  const set = new Set();
+    .filter((t) => t.length > 1);
+  const tokens = [];
   for (const t of raw) {
+    tokens.push(t);
+    const folded = fold(t);
+    if (folded !== t) tokens.push(folded);
+  }
+
+  const set = new Set();
+  const hasSkillNoun = tokens.some((t) => SKILL_NOUNS.has(t));
+  const hasSkillRoutingVerb = tokens.some((t) => SKILL_ROUTING_VERBS.has(t));
+
+  for (const t of tokens) {
+    if (STOP.has(t)) continue;
     set.add(t);
     for (const syn of SYNONYMS[t] || []) set.add(syn);
   }
+  if (hasSkillNoun && hasSkillRoutingVerb) {
+    for (const term of SKILL_ROUTING_TERMS) set.add(term);
+  }
   return [...set];
 }
 
@@ -45,6 +113,7 @@ export async function rank(manifest, query) {
   const terms = expandedTerms(query);
   if (!terms.length) return [];
   const scored = scoreRows(manifest.skills, terms);
+  if (!scored.length || Math.max(...scored.map((r) => r.score)) < MIN_USEFUL_SCORE) return [];
   const SQL = await initSqlJs();
   const db = new SQL.Database();
 
@@ -93,8 +162,8 @@ function scoreRows(skills, terms) {
     let score = 0;
     for (const term of terms) {
       if (id === term) score += 20;
-      else if (id.includes(term)) score += 8;
-      if (tags.includes(term)) score += 10;
+      else if (!LOW_SIGNAL_TAG_TERMS.has(term) && id.includes(term)) score += 8;
+      if (tags.includes(term)) score += LOW_SIGNAL_TAG_TERMS.has(term) ? 3 : 10;
       if (description.includes(` ${term} `)) score += 1;
     }
     return { id: skill.id, score };

package/scripts/lib/recommend.js

@@ -23,8 +23,9 @@ export function hasOutcome(id) {
 }
 
 export function expandRecommends(manifest, chosen) {
-  const set = new Set(chosen);
+  const set = new Set();
   for (const id of chosen) {
+    set.add(id);
     const s = skillById(manifest, id);
     for (const r of s?.recommends || []) set.add(r);
   }

package/skills/building-agents/SKILL.md

@@ -18,6 +18,8 @@ Build production LLM agents that are model-agnostic by construction — a thin p
 
 ## When to use / When NOT to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 **Use when:** starting any production-bound LLM feature; code is hardwired to one SDK and you want to swap/route/fallback models; adding tools/function calling, structured output, or streaming; standing up RAG over Postgres/`pgvector` or an external store; building an eval harness / CI quality gate; adding tracing, cost tracking, caching, or routing/cascades; building or hardening an MCP server.
 
 **Do NOT use when:**

package/skills/design/SKILL.md

@@ -12,6 +12,8 @@ origin: risco
 
 ## When to use / When NOT to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 Use when:
 
 - Building a new landing or marketing page.

package/skills/fastapi/SKILL.md

@@ -22,6 +22,8 @@ pip-audit 2.7+, PostgreSQL 16. (All lower bounds; install the latest in each lin
 
 ## When to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 - Writing or reviewing any FastAPI route, router, dependency, schema, or app factory.
 - Designing async DB access (SQLAlchemy 2.0), migrations (Alembic), or eager-loading.
 - Adding auth (OAuth2 password flow + JWT), RBAC, password hashing.

package/skills/flutter/SKILL.md

@@ -22,6 +22,8 @@ subproject — never the FastAPI/Go/Next.js siblings.
 
 ## When to use / When NOT to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 **Use when:**
 
 - Building a new Flutter feature or screen, or choosing/refactoring state management.

package/skills/go/SKILL.md

@@ -16,6 +16,8 @@ logging, and fixed loop-variable semantics (no more `tt := tt`).
 
 ## When to use / When NOT to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 **Use when:**
 
 - Authoring, reviewing, or testing any `.go` file.

package/skills/nextjs/SKILL.md

@@ -13,6 +13,8 @@ origin: risco
 
 ## When to use / When NOT to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 **Use when:**
 
 - Editing or creating files under `app/` (pages, layouts, `route.ts`, server actions).

package/skills/postgresdb/SKILL.md

@@ -14,6 +14,8 @@ example is runnable.
 
 ## When to use / When NOT to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 **When to use:**
 
 - Schema/DDL decisions: types, keys, constraints, generated/identity columns, enum-vs-lookup, jsonb-vs-column.

package/skills/react/SKILL.md

@@ -12,6 +12,8 @@ origin: risco
 
 ## When to use
 
+> **⚠️ SDD new-feature gate — read this first.** If this skill fired on a **new, non-trivial feature or behaviour change** and there is **no approved spec + plan** under `02-DOCS/wiki/sdd/`, STOP — do **not** write feature code yet. Hand off to `../specify/SKILL.md` first: it runs brainstorm → spec → plan → tasks before any code, then routes back here once the plan is approved. Build here directly only for a genuinely one-line / low-risk change. Method: `../sdd/SKILL.md`.
+
 - A repo with `vite.config.{ts,js}` + `react` + `react-dom` and **no** `next` and **no** `@react-router/dev` framework mode — i.e. an SPA.
 - Creating components and deciding **where state lives** (local / lifted / URL / context / store).
 - Wiring **server data**: queries, mutations, caching, optimistic UI.

package/skills/sdd/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sdd
-description: "Use when you want a disciplined, spec-driven path from a feature idea to shipped, verified software — the rsc-sdd dispatcher / front door. It states the SDD method, reads the accompaniment dial from 02-DOCS, and routes to the right phase skill: constitution -> specify -> clarify -> plan -> tasks -> analyze -> implement -> verify -> review -> ship, with debug / worktrees / parallel callable on demand. Use it to START a feature, when unsure which SDD phase you are in, or to govern the whole flow. Triggers: 'spec-driven development', 'sdd', 'build this feature properly', 'start a new feature', 'I have an idea, take it to production', 'which phase am I in', 'run the sdd flow', 'desarrollo dirigido por especificación', 'monta esta feature bien', 'de la idea a producción', 'per-phase model routing', 'use a cheaper model for implementation', 'qué modelo por fase'. NOT itself a single phase (it dispatches), NOT the workspace harness (harness), NOT a stack build skill."
+description: "Use when you want a disciplined, spec-driven path from a feature idea to shipped, verified software — the rsc-sdd dispatcher / front door. It states the SDD method, reads the accompaniment dial from 02-DOCS, and routes to the right phase skill: constitution -> specify -> clarify -> plan -> tasks -> analyze -> implement -> verify -> review -> ship, with debug / worktrees / parallel callable on demand. Use it to START a feature, when unsure which SDD phase you are in, or to govern the whole flow. Triggers: 'spec-driven development', 'sdd', 'build this feature properly', 'start a new feature', 'I have an idea, take it to production', 'which phase am I in', 'run the sdd flow', 'desarrollo dirigido por especificación', 'monta esta feature bien', 'munta aquesta feature bé', 'de la idea a producción', 'de la idea a producció', 'fem un SDD per X', 'quina fase soc', 'per-phase model routing', 'use a cheaper model for implementation', 'qué modelo por fase'. NOT itself a single phase (it dispatches), NOT the workspace harness (harness), NOT a stack build skill."
 tags: [sdd, spec, workflow, plan]
 recommends: [sdd-init, constitution, specify]
 profiles: [core, full]

package/skills/specify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: specify
-description: "Use when a feature, change, or product idea is still fuzzy and needs brainstorming into an APPROVED spec BEFORE any planning or code — the brainstorming front door of SDD. Turns a one-line intent into a WHAT/WHY spec (problem, goals, users, scope, behaviour, acceptance) with zero implementation detail, via one-question-at-a-time dialogue, 2-3 proposed approaches with a recommendation, and a design the user approves before anything gets built. Triggers: 'write a spec for…', 'spec this out', 'brainstorm this feature', 'especifica esta feature', 'I want to add X', 'tengo una idea', 'se me ha ocurrido', '¿y si…?', 'wouldn't it be nice if…', 'let's think this through', 'what should this feature do', 'draft a PRD', or any moment someone jumps to HOW before WHAT is agreed. NOT the technical plan (that's `plan`), NOT the de-risking ambiguity sweep (that's `clarify`), NOT project-wide principles (that's `constitution`)."
+description: "Use when a feature, change, or product idea is still fuzzy and needs brainstorming into an APPROVED spec BEFORE any planning or code — the brainstorming front door of SDD. Turns a one-line intent into a WHAT/WHY spec (problem, goals, users, scope, behaviour, acceptance) with zero implementation detail, via one-question-at-a-time dialogue, 2-3 proposed approaches with a recommendation, and a design the user approves before anything gets built. Triggers: 'write a spec for…', 'spec this out', 'brainstorm this feature', 'especifica esta feature', 'm'agradaria afegir/posar X', 'voldria…', 'vull afegir/fer X', 'es podria afegir…', 'estaria bé que…', 'i si…?', 'I want to add X', 'tengo una idea', 'se me ha ocurrido', '¿y si…?', 'wouldn't it be nice if…', 'let's think this through', 'what should this feature do', 'draft a PRD', or any moment someone jumps to HOW before WHAT is agreed. NOT the technical plan (that's `plan`), NOT the de-risking ambiguity sweep (that's `clarify`), NOT project-wide principles (that's `constitution`)."
 tags: [sdd, spec, requirements]
 recommends: [clarify, plan]
 profiles: [core, full]

package/skills/suggest/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: suggest
-description: "Always-on. Use whenever the current task would clearly benefit from an rsc skill that is not yet installed — detect the gap, name the skill, and (with a one-word confirm) install it via `npx @ericrisco/rsc add <id>`. Triggers on any task that maps to a known rsc capability the session lacks: building a web/app/API, a database, security, deployment, agents, content, or connecting/documenting a company."
+description: "Always-on. Use whenever the current user turn would clearly benefit from an rsc skill that is not yet installed — detect the gap during normal agent use, name the skill, and (with a one-word confirm) install it via `npx @ericrisco/rsc add <id>`. Triggers on capability intent in any language: building technology, creating content/assets, automating workflows, analyzing data, connecting tools, shipping/deploying, security, business ops, marketing, education, research, or company/documentation harness work."
 tags: [suggest, detect, install, meta, always-on]
 recommends: []
 profiles: [minimal, core, full]
@@ -8,7 +8,44 @@ profiles: [minimal, core, full]
 
 # rsc-suggest — detect & install the skill the task needs
 
-You are always loaded. Your only job: keep the session equipped — nothing else.
+You are always loaded — your body is injected into context at the start of **every** session, and again after every compaction, so you are the one piece guaranteed to be present *before any other skill is matched*. That makes you the **always-on layer**. You do two jobs, in this order:
+
+1. **Route new-feature intent into SDD before any code is written** — the new-feature gate below. This is your first duty; it runs before everything else.
+2. **Keep the session equipped** — detect when the task needs an rsc skill that is **not installed**, name it, and install it on confirm.
+
+---
+
+## The new-feature gate (always-on — runs before any other skill)
+
+This is the **highest-precedence rule in the session.** It fires on **every** user turn, in **any language**, and runs **before you plan, answer, or invoke ANY other skill — no matter how many skills are installed or how strongly one of them matches the request.** That covers the stack skills (`nextjs`, `react`, `fastapi`, `flutter`, `go`, `postgresdb`, `building-agents`, `design`) **and any other skill that would build, create, scaffold, generate, or produce the feature** (e.g. `chatbot`, `course-builder`, `marketing`, automation/connector skills). A skill matching the request does **not** override this gate — it runs *inside* the SDD chain, after the plan is approved. There is no skill with priority over this check.
+
+**The rule (non-negotiable).** The moment the user wants to **build, add, or change a feature**, you MUST route it into SDD via `specify` **first**. **No feature code is written — by ANY skill — until a spec AND a plan exist and the user has approved them.** A stack skill that matched the same request does **not** get to skip this: it builds only *after* the plan is approved.
+
+**Where does this turn go? When unsure, choose `specify` — the safe default.**
+
+| The turn is… | Route to |
+| --- | --- |
+| A new feature / capability / integration / UI, a behaviour change, a data-model or architecture change, "it should also…", anything non-trivial | **`specify`** → `clarify` → `plan` → `tasks` → `implement` (which fans work out to subagents via `parallel`) |
+| A genuinely one-line / low-risk change: typo, copy tweak, config bump, rename, non-breaking dependency bump | Just do it inline, then verify — and **say out loud** you are skipping the chain |
+| A bug fix that restores intended behaviour | **`debug`**, then resume |
+| Ambiguous / in-between / you cannot tell | **`specify`** — a skipped spec is where drift hides |
+
+**Triggers — detect the *intent*, never a fixed phrase, in ANY language.** What fires the gate is the **meaning**, not the words: the user wants something to exist or behave differently than it does now — build, add, create, change, replace, integrate, "it should also…", "wouldn't it be nice if…". This is judged **semantically**, so it holds in **any language** — Catalan, Spanish, English, Portuguese, French, Italian, German, Basque, Galician, or anything else, including a language with no example below. The lists that follow are **illustrative examples, NOT a checklist**: never wait for one of these phrases to appear before firing. If the meaning is feature-shaped, the gate fires — full stop.
+- **CA:** "m'agradaria afegir/posar…", "vull fer/posar…", "es podria…", "i si…".
+- **ES:** "quiero añadir/montar…", "me gustaría…", "se me ha ocurrido", "¿y si…?".
+- **EN:** "I want to add…", "let's build…", "it should also…".
+- A **URL plus a description of desired behaviour** ("on this page I'd like…") **is** a feature request — in any language.
+
+**Stop rationalizing — every one of these is wrong:**
+- *"I understand the feature, I'll just build it."* → That is the exact failure SDD prevents. Spec first; the artifact is the contract.
+- *"A more specific skill matched (a stack skill, `chatbot`, `course-builder`, marketing…), so it takes precedence."* → **No skill outranks this gate.** Any builder skill **defers** to `specify` for new features and runs *inside* the chain, after the plan is approved. Route first.
+- *"The user gave lots of detail / a URL, so they want code now."* → Detail feeds the spec, not the editor.
+- *"The dial is L0, so I'll skip the gate to stay terse."* → L0 changes how many words and questions, **never** whether the gate fires.
+- *"It's phrased in a language I have no example for, so maybe it isn't a feature request."* → The trigger lists are examples, not a closed set. Judge the **meaning**, not the keywords; any language with build/add/change intent fires the gate identically.
+
+If `specify` / `sdd` are **not installed**, fall through to the install detector below and offer to add them *before* routing. The gate decides **where the turn goes**; the detector below only handles **missing** skills. Full method and phase map: `../sdd/SKILL.md`.
+
+---
 
 When the current task would clearly benefit from an rsc skill that is **not installed**:
 
@@ -24,6 +61,42 @@ Rules:
 - Never recommend something already installed (`npx @ericrisco/rsc list`).
 - One suggestion at a time. Don't interrupt the flow for nice-to-haves.
 
+## Mid-task capability intent detector
+
+This runs **inside the agent conversation**, not only in the `rsc` CLI. At the start of
+each user turn, before planning, coding, writing, researching, or answering in depth,
+check whether the user is asking to create, build, fix, connect, automate, analyze,
+publish, sell, teach, govern, secure, deploy, or document something that maps to a
+known rsc capability.
+
+This is broader than "start a project". It includes mid-conversation requests such as:
+
+- Technology: "quiero montar una pagina web", "necesito una API", "build me a mobile app", "conecta Stripe", "automatiza este flujo", "deploy this", "review security".
+- Creation: "haz una landing que convierta", "write a cold email sequence", "crea un pitch deck", "monta un curso", "edita shorts", "make social posts".
+- Data and AI: "analiza estos datos", "build a dashboard", "quiero un agente de IA", "haz RAG sobre mis documentos", "extrae datos de PDFs".
+- Business and ops: "organiza mi empresa", "prepara facturas", "monta CRM/pipeline", "haz contratos", "reduce churn", "gestiona soporte".
+- Knowledge and research: "documenta cómo funciona esto", "crea una wiki", "procesa este inbox", "research competitors", "turn this into SOPs".
+- Other languages: any equivalent phrasing. Match the user's intent, not exact words.
+
+When a capability intent appears:
+
+1. Run `npx @ericrisco/rsc list` to know what is already installed.
+2. Run `npx @ericrisco/rsc consult "<the user's exact intent>"`.
+3. Read the ordered result as the install queue, but pick only the **first missing**
+   skill that is useful right now. Skip `suggest` and any installed skill.
+4. Ask before installing: "Para esto instalaría `<id>`, que aún no tienes. ¿La instalo? (sí/no)".
+5. On yes, run `npx @ericrisco/rsc add <id>` and then continue the original request.
+
+Example: if the user says "quiero montar una pagina web para vender cursos online",
+do not just start building. Check the installed list, consult that exact phrase, and
+recommend the first missing skill from the returned queue. In a base install, `init`
+and `harness` may already exist, so the first missing skill is usually `nextjs`. In a
+bare install, `init` may be first. Install one skill at a time.
+
+Example: if the user says "hazme una secuencia de cold emails para vender mi SaaS",
+consult that exact phrase and recommend the first missing email/marketing skill rather
+than writing generic copy with no specialist loaded.
+
 ## Onboarding gate (first contact)
 
 Before handling the first request of the session, check the workspace state:
@@ -37,4 +110,3 @@ This is the universal layer every assistant reads. On Claude Code a SessionStart
 ## Orientación (siempre)
 
 Cierra cada turno con el **bloque-brújula** (📍 dónde estás · ✅ qué hiciste · 🧭 por qué · ➡️ siguiente, terminando en pregunta), calibrado al dial de `02-DOCS/wiki/harness/user-profile.md`. **Nunca termines en seco.** Protocolo completo: skill `orient` → `skills/orient/references/orientation-contract.md`. (Defiere a `suggest` el "¿instalo la skill que falta?".)
-

package/skills/suggest/evals/README.md

@@ -7,6 +7,9 @@ skill (and stays quiet when the task needs nothing new).
 |---|---|
 | "crear la tabla de pedidos en la base de datos" | suggests `postgresdb` |
 | "publicar mi web online con docker" | suggests `deployment` |
+| "quiero montar una pagina web para vender cursos online" | during agent use, consults the catalog and suggests the first missing startup/web skill, usually `nextjs` after base install |
+| "Automatiza el flujo de leads desde el formulario hasta mi CRM" | during agent use, consults the catalog and suggests the first missing automation/connector skill |
+| "Write a cold email sequence to sell my SaaS to agencies" | during agent use, consults the catalog and suggests the first missing email/marketing skill |
 | "renombra esta variable" | no suggestion (trivial, nothing to install) |
 
 A pass = the detector names the expected skill, asks a one-word confirm, and on

package/skills/suggest/evals/cases.yaml

@@ -6,6 +6,15 @@ skill: suggest
 # skill that already owns the task.
 
 should_trigger:
+  - prompt: "Quiero montar una pagina web para vender cursos online."
+    why: "Mid-conversation project-start intent — the detector should consult the catalog and propose the first missing skill from the startup queue (usually `nextjs` after the base install, or `init` in a bare install) before building."
+
+  - prompt: "Automatiza el flujo de leads desde el formulario hasta mi CRM."
+    why: "Mid-conversation automation/integration intent — the detector should consult the catalog and propose the first missing automation or connector skill before designing the workflow."
+
+  - prompt: "Write a cold email sequence to sell my SaaS to agencies."
+    why: "Mid-conversation creation/marketing intent — the detector should consult the catalog and propose the first missing email or marketing skill before writing generic copy."
+
   - prompt: "Ayúdame a montar la tabla de pedidos en la base de datos."
     why: "A database task with no DB skill present — the detector should propose `npx @ericrisco/rsc add postgresdb` before diving in."
 
@@ -49,3 +58,21 @@ capability:
       - "On confirmation, runs `npx @ericrisco/rsc add postgresdb` via Bash, then continues the original task"
       - "Checks what is already installed (npx @ericrisco/rsc list) and never proposes a skill the user already has"
       - "Makes at most one suggestion and does not interrupt the flow for nice-to-haves"
+
+  - scenario: "Mid-conversation, after base install, the user says 'quiero montar una pagina web para vender cursos online'. `init`, `harness`, `orient`, and `suggest` are already installed; `nextjs` is not. Show how rsc-suggest behaves."
+    must_include:
+      - "Treats the message as in-agent capability intent, not as a CLI-only consult task"
+      - "Runs `npx @ericrisco/rsc list` before recommending so installed `init`/`harness` are skipped"
+      - "Runs `npx @ericrisco/rsc consult \"quiero montar una pagina web para vender cursos online\"` or equivalent exact-intent consult"
+      - "Names `nextjs` as the first missing useful skill for the website work"
+      - "Asks one short confirmation before installing and does not auto-install"
+      - "On confirmation, runs `npx @ericrisco/rsc add nextjs`, then resumes the original website task"
+
+  - scenario: "Mid-conversation, the user says 'Automatiza el flujo de leads desde el formulario hasta mi CRM'. The base skills are installed, but `automation-flows` and CRM/connector skills are not. Show how rsc-suggest behaves."
+    must_include:
+      - "Treats the message as in-agent capability intent for automation/integration, not only as a coding task"
+      - "Runs `npx @ericrisco/rsc list` before recommending"
+      - "Runs `npx @ericrisco/rsc consult \"Automatiza el flujo de leads desde el formulario hasta mi CRM\"` or equivalent exact-intent consult"
+      - "Names the first missing useful automation/connector skill from the consult results"
+      - "Asks one short confirmation before installing and does not auto-install"
+      - "On confirmation, runs `npx @ericrisco/rsc add <id>` for that one missing skill, then resumes the automation task"

package/targets/claude.js

@@ -107,7 +107,24 @@ export function wireHook(paths) {
   );
   settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: dgCmd }] });
 
+  // New-feature gate: a UserPromptSubmit hook that re-injects the SDD new-feature gate as
+  // the most-recent instruction on every user turn. SessionStart injects the full gate (the
+  // `suggest` body) once; this keeps the precedence rule salient regardless of how many
+  // skills are installed or how long the session runs (otherwise a strongly-matched stack
+  // skill can pull the model to code despite the gate being in context). UserPromptSubmit
+  // stdout is added to context, so a plain print suffices. Materialized + node-run
+  // (Windows-safe), idempotent, fail-open, opt-out via .rsc/.no-feature-gate. Other
+  // (non-rsc) UserPromptSubmit hooks are preserved.
+  const fgDest = join(paths.projectRoot, '.rsc', 'userprompt-gate.mjs');
+  copyFileSync(join(HERE, 'userprompt-gate.mjs'), fgDest);
+  const fgCmd = `node "${fgDest}" "${paths.projectRoot}"`;
+  settings.hooks.UserPromptSubmit ||= [];
+  settings.hooks.UserPromptSubmit = settings.hooks.UserPromptSubmit.filter(
+    (e) => !JSON.stringify(e).includes('.rsc/userprompt-gate.'),
+  );
+  settings.hooks.UserPromptSubmit.push({ hooks: [{ type: 'command', command: fgCmd }] });
+
   mkdirSync(dirname(file), { recursive: true });
   writeFileSync(file, JSON.stringify(settings, null, 2) + '\n');
-  return [file, scriptDest, wlDest, sgDest, dgDest];
+  return [file, scriptDest, wlDest, sgDest, dgDest, fgDest];
 }

package/targets/userprompt-gate.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+// rsc UserPromptSubmit payload (claude). Re-injects the SDD new-feature gate as the
+// MOST-RECENT instruction on every user turn. The SessionStart hook already injects the
+// full gate (the `suggest` body) once per session, but in a long session — or one with
+// many installed skills whose descriptions crowd the context — that single injection can
+// lose salience and a strongly-matched stack/builder skill can pull the model straight to
+// code. This keeps the precedence rule in front of the model every turn, so the gate is
+// independent of skill count and session length. Stdout is added to context for
+// UserPromptSubmit, so a plain print is enough (no JSON needed).
+//
+// Invoked as `node userprompt-gate.mjs <projectRoot>` (not bash) so it runs on Windows too.
+//   argv[2] = absolute project root
+// Fail-open (never blocks a turn). Opt out per project with .rsc/.no-feature-gate.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+const root = process.argv[2] || process.cwd();
+
+// Opt-out: a project that does not want the always-on gate drops this marker file.
+if (existsSync(join(root, '.rsc', '.no-feature-gate'))) process.exit(0);
+
+process.stdout.write(`===== rsc SDD new-feature gate (highest precedence) =====
+Before acting on this turn: if the user wants to BUILD, ADD, or CHANGE a feature — in
+ANY language, judged by intent, not by keywords — you MUST route it through SDD via
+\`specify\` FIRST. No feature code is written by ANY skill (stack skills included —
+nextjs/react/fastapi/flutter/go/postgresdb/building-agents/design — and any builder skill
+such as chatbot/course-builder/marketing) until a spec AND a plan exist and the user has
+approved them. No skill outranks this gate.
+- Unclear / in-between? -> \`specify\` (the safe default; a skipped spec is where drift hides).
+- One-line / low-risk change, or a bug fix restoring intended behaviour? -> skip the chain,
+  do it, and say so out loud.
+Full gate + decision table live in the always-on \`suggest\` body; method in \`sdd\`.
+=========================================================
+`);