@ericrisco/rsc 0.1.5

package/scripts/rsc.js

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+import { loadManifest, skillsForProfile } from './lib/manifest.js';
+import { detectTarget } from '../targets/index.js';
+import { detectRepo } from './detect-repo.js';
+import { rank } from './consult.js';
+import { expandRecommends, toOutcomes, hasOutcome } from './lib/recommend.js';
+import { applyInstall, listInstalled, uninstall } from './install-apply.js';
+import { doctor } from './doctor.js';
+import { ask, say, yes, select, pickFrom, banner } from './lib/ui.js';
+import { refreshRegistry, registryStatus } from './lib/registry.js';
+import { DOMAINS } from './lib/domains.js';
+
+const argv = process.argv.slice(2);
+const cmd = argv[0];
+
+function flag(name) {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? (argv[i + 1] || true) : undefined;
+}
+
+async function recommendIds(query, { labeledOnly = false } = {}) {
+  const m = loadManifest();
+  const repo = detectRepo();
+  const ranked = query ? (await rank(m, query)).map((r) => r.id) : [];
+  let base = [...new Set(query ? [...ranked, ...repo] : repo)].filter((id) => id !== 'suggest');
+  if (labeledOnly) base = base.filter(hasOutcome);
+  base = base.slice(0, 4);
+  let out = expandRecommends(m, base).filter((id) => id !== 'suggest');
+  if (labeledOnly) out = out.filter(hasOutcome);
+  return out.slice(0, 6);
+}
+
+// Pick skills by browsing the domains, accumulating across rounds.
+async function manualSelect() {
+  const chosen = new Set();
+  for (;;) {
+    const opts = DOMAINS.map((d, i) => ({ key: String(i), label: `${d.title} (${d.ids.length})` }));
+    opts.push({ key: 'done', label: chosen.size ? `✅ Finish & install (${chosen.size} chosen)` : 'Finish without choosing anything' });
+    const k = await select('\nWhich area do you want to install skills from?', opts);
+    if (k === 'done' || k === null) break;
+    const d = DOMAINS[parseInt(k, 10)];
+    (await pickFrom(`${d.title}:`, d.ids)).forEach((id) => chosen.add(id));
+    say(`   → ${chosen.size} skills chosen so far.`);
+  }
+  return [...chosen];
+}
+
+// Describe-your-project flow: rsc reads repo + words and proposes skills.
+async function describeFlow() {
+  const goal = await ask('\nTell me in one sentence what you want to build or run:\n> ');
+  const ids = await recommendIds(goal, { labeledOnly: true });
+  if (!ids.length) {
+    say("I'm not sure. Try describing it in more detail, or pick by hand (option 3).");
+    return [];
+  }
+  say('\nI recommend installing:');
+  for (const o of toOutcomes(ids)) say(`   • ${o.label}`);
+  return ids;
+}
+
+// After installing, remind the user how to actually start — per IDE — and that
+// rsc keeps recommending skills as they work. The harness/SDD *init* runs INSIDE
+// the assistant (with the user present), never blindly from this CLI.
+function printNextSteps(target, ids) {
+  const hasHarness = ids.includes('harness');
+  const hasSdd = ids.includes('sdd') || ids.includes('sdd-init');
+  const openLine = {
+    claude: 'Open **Claude Code** in this project folder.',
+    cursor: 'Open **Cursor** in this project folder.',
+    codex: 'Open **Codex CLI** (it reads AGENTS.md) in this project folder.',
+    gemini: 'Open **Gemini CLI** in this project folder.',
+  }[target] || 'Open your assistant in this project folder.';
+
+  say('\n────────────────────────────────────────────────────────');
+  say('👉 When you start working (these steps happen in your assistant, not here):');
+  let n = 1;
+  say(`   ${n++}. ${openLine}`);
+  if (hasHarness) {
+    say(`   ${n++}. Set up the second brain — tell it:`);
+    say('        "set up the harness for this project"');
+    say('      → creates 01-TOOLS/ (connections) + 02-DOCS/ (wiki) + CLAUDE.md/AGENTS.md.');
+  }
+  if (hasSdd) {
+    say(`   ${n++}. For a new feature, tell it:`);
+    say('        "sdd-init"   then   "I want <your idea>"');
+    say('      → walks you specify → plan → tasks → implement → verify → ship.');
+  }
+  say(`   ${n++}. From there, work in your own words. orient + suggest stay always-on:`);
+  say('      they keep you oriented after each step and propose the missing skill (you confirm, it installs).');
+  say('\n   Add something by hand anytime:    npx @ericrisco/rsc add <skill>');
+  say('   Browse the catalog / get picks:   npx @ericrisco/rsc consult "whatever you need"');
+  say('────────────────────────────────────────────────────────');
+}
+
+async function wizard() {
+  const m = loadManifest();
+  banner();
+  say('  the skill catalog for your assistant (Claude Code · Cursor · Codex · Gemini)\n');
+  const choice = await select('What do you want to do?', [
+    { key: 'base', label: 'Base install — the essentials (orient + suggest + harness + init)' },
+    { key: 'sdd', label: 'Base + Spec-Driven Development — the specify → plan → implement → ship flow' },
+    { key: 'manual', label: 'Pick skills by hand, by area' },
+    { key: 'describe', label: 'Describe my project and let rsc choose' },
+  ]);
+
+  let ids = [];
+  if (choice === 'base') ids = skillsForProfile(m, 'minimal');
+  else if (choice === 'sdd') ids = skillsForProfile(m, 'core');
+  else if (choice === 'manual') ids = await manualSelect();
+  else if (choice === 'describe') ids = await describeFlow();
+  else { say("Didn't catch that. Run again: npx @ericrisco/rsc"); return; }
+
+  // The floor is always installed: the compass + the detector.
+  ids = [...new Set(['orient', 'suggest', ...ids])];
+  if (ids.length <= 2 && choice !== 'base') {
+    say('\nNo skills were chosen. Anytime: npx @ericrisco/rsc');
+    return;
+  }
+
+  const target = detectTarget();
+  say(`\nI'll install ${ids.length} skills into ${target}:`);
+  say('   ' + ids.join(', '));
+  if (!yes(await ask('\nInstall it? (yes / no) > '))) {
+    say('No problem. Anytime: npx @ericrisco/rsc');
+    return;
+  }
+  await applyInstall({ skillIds: ids, target });
+  say(`\n✅ Installed ${ids.length} skills into ${target}.`);
+  printNextSteps(target, ids);
+}
+
+async function main() {
+  const target = flag('target') || detectTarget();
+  switch (cmd) {
+    case undefined:
+      return wizard();
+    case 'add':
+      await applyInstall({ skillIds: [...new Set(['orient', 'suggest', ...argv.slice(1)])], target });
+      return void say(`✅ Installed: ${argv.slice(1).join(', ')}`);
+    case 'install': {
+      const profile = flag('profile') || 'minimal';
+      const without = argv.filter((a, i) => argv[i - 1] === '--without');
+      let ids = skillsForProfile(loadManifest(), profile);
+      ids = [...new Set(['orient', 'suggest', ...ids])].filter((id) => !without.includes(id));
+      await applyInstall({ skillIds: ids, target });
+      return void say(`✅ Profile '${profile}' installed into ${target} (${ids.length} skills)`);
+    }
+    case 'consult': {
+      const ids = await recommendIds(argv.slice(1).join(' '));
+      if (!ids.length) return void say('(no recommendations)');
+      for (const o of toOutcomes(ids)) say(`${o.id}\t${o.label}`);
+      return;
+    }
+    case 'list':
+      return void say(listInstalled({ target }).join('\n') || '(nothing installed)');
+    case 'doctor':
+      return void say(JSON.stringify(doctor({ target }), null, 2));
+    case 'registry': {
+      const sub = argv[1];
+      if (sub === 'refresh') {
+        const registry = refreshRegistry({ target });
+        say(`✅ Registry updated: .rsc/skill-registry.md (${registry.counts.skills} skills)`);
+        return;
+      }
+      if (sub === 'status') {
+        say(JSON.stringify(registryStatus(), null, 2));
+        return;
+      }
+      say('Use: npx @ericrisco/rsc registry refresh | registry status');
+      return;
+    }
+    case 'uninstall': {
+      const dry = argv.includes('--dry-run');
+      const ids = argv.slice(1).filter((a) => !a.startsWith('--'));
+      const removed = await uninstall({ skillIds: ids, target, dryRun: dry });
+      return void say((dry ? 'Would remove:\n' : 'Removed:\n') + (removed.join('\n') || '(nothing)'));
+    }
+    default:
+      say(`rsc: unknown command '${cmd}'.`);
+      say('Use: npx @ericrisco/rsc | add <id...> | install --profile <p> | consult "<text>" | list | registry refresh | doctor | uninstall <id>');
+  }
+}
+
+main().catch((e) => {
+  console.error('rsc error:', e.message);
+  process.exit(1);
+});

package/scripts/skill-behavior-eval.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// skill-behavior-eval.js — turn the behavior workflow's raw JSON into a scorecard.
+// Usage:
+//   node scripts/skill-behavior-eval.js --score <raw.json>   (or pipe raw JSON on stdin with -)
+// Exits 0 if the behavioral gate passes, 1 if it fails, 2 on usage/parse error.
+
+import { readFileSync } from 'node:fs';
+import { scoreFromRaw, formatScorecard } from './lib/behavior-score.js';
+
+function readInput(argPath) {
+  if (argPath && argPath !== '-') return readFileSync(argPath, 'utf8');
+  return readFileSync(0, 'utf8'); // stdin
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  if (args[0] !== '--score') {
+    process.stderr.write('usage: skill-behavior-eval.js --score <raw.json|->\n');
+    process.exit(2);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readInput(args[1]));
+  } catch (e) {
+    process.stderr.write(`parse error: ${e.message}\n`);
+    process.exit(2);
+  }
+  const scored = scoreFromRaw(raw);
+  process.stdout.write(formatScorecard(scored) + '\n');
+  process.exit(scored.gate.pass ? 0 : 1);
+}
+
+main();

package/scripts/skill-behavior-eval.workflow.js

@@ -0,0 +1,136 @@
+export const meta = {
+  name: 'skill-behavior-eval',
+  description: 'Behaviorally score one rsc skill: run each capability scenario with and without the skill, blind-grade both, emit raw signals',
+  phases: [
+    { title: 'Load' },
+    { title: 'Execute & Grade' },
+  ],
+}
+
+const skillId = (typeof args === 'string' ? args : (args && args.skillId)) || ''
+if (!skillId) throw new Error('skill-behavior-eval: pass the skill id as args, e.g. "grants"')
+
+const GRADE_OUTPUT = {
+  type: 'object',
+  properties: {
+    mustInclude: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          item: { type: 'string' },
+          satisfied: { type: 'boolean' },
+          evidence: { type: 'string' },
+        },
+        required: ['item', 'satisfied', 'evidence'],
+      },
+    },
+    quality: {
+      type: 'object',
+      properties: {
+        completeness: { type: 'number' },
+        actionability: { type: 'number' },
+        correctness: { type: 'number' },
+        grounding: { type: 'number' },
+      },
+      required: ['completeness', 'actionability', 'correctness', 'grounding'],
+    },
+  },
+  required: ['mustInclude', 'quality'],
+}
+
+const LOAD_SCHEMA = {
+  type: 'object',
+  properties: {
+    skillId: { type: 'string' },
+    skillBody: { type: 'string' },
+    scenarios: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          scenario: { type: 'string' },
+          mustInclude: { type: 'array', items: { type: 'string' } },
+        },
+        required: ['scenario', 'mustInclude'],
+      },
+    },
+  },
+  required: ['skillId', 'skillBody', 'scenarios'],
+}
+
+const GRADE_SCHEMA = {
+  type: 'object',
+  properties: { gradeX: GRADE_OUTPUT, gradeY: GRADE_OUTPUT },
+  required: ['gradeX', 'gradeY'],
+}
+
+phase('Load')
+const injected = (typeof args === 'object' && args && Array.isArray(args.scenarios)) ? args.scenarios : null
+
+const loaded = injected
+  ? await (async () => {
+      const body = await agent(
+        `Read skills/${skillId}/SKILL.md and return its full text as "skillBody". ` +
+        `Return {skillId: "${skillId}", skillBody, scenarios: []}.`,
+        { label: `load-body:${skillId}`, phase: 'Load', schema: LOAD_SCHEMA, agentType: 'Explore' },
+      )
+      return { skillId, skillBody: (body && body.skillBody) || '', scenarios: injected }
+    })()
+  : await agent(
+      `Read two files and return structured data — do not summarize, return content verbatim where asked.\n` +
+      `1. skills/${skillId}/SKILL.md — return its full text as "skillBody".\n` +
+      `2. skills/${skillId}/evals/cases.yaml — under the "capability:" key is a list. For each entry return ` +
+      `{scenario: <the "scenario" string verbatim>, mustInclude: [<each string under that entry's "must_include">]}.\n` +
+      `Return {skillId: "${skillId}", skillBody, scenarios}. If either file is missing, return skillBody "" and scenarios [].`,
+      { label: `load:${skillId}`, phase: 'Load', schema: LOAD_SCHEMA, agentType: 'Explore' },
+    )
+
+if (!loaded || !Array.isArray(loaded.scenarios) || loaded.scenarios.length === 0) {
+  return { skillId, scenarios: [], error: 'no-capability-scenarios' }
+}
+
+phase('Execute & Grade')
+const results = await pipeline(
+  loaded.scenarios,
+  // Stage 1: baseline (no skill) + treatment (skill injected), concurrently.
+  (sc, _orig, index) => parallel([
+    () => agent(
+      `Complete this task fully and concretely. Produce the ACTUAL deliverable the task asks for, ` +
+      `not a description of how you would do it.\n\nTASK:\n${sc.scenario}`,
+      { label: `baseline:${index}`, phase: 'Execute & Grade' },
+    ),
+    () => agent(
+      `You have a skill loaded — follow it. Its reference files live under ` +
+      `skills/${loaded.skillId}/references/; read them if the skill points you there.\n\n` +
+      `=== SKILL: ${loaded.skillId} ===\n${loaded.skillBody}\n=== END SKILL ===\n\n` +
+      `Complete this task fully and concretely. Produce the ACTUAL deliverable, not a description.\n\n` +
+      `TASK:\n${sc.scenario}`,
+      { label: `treatment:${index}`, phase: 'Execute & Grade' },
+    ),
+  ]).then(([baselineOut, treatmentOut]) => ({ sc, index, baselineOut, treatmentOut })),
+  // Stage 2: blind grade. X/Y slot varied by index parity; mapping recorded for the scorer.
+  (prev) => {
+    if (!prev) return null
+    const { sc, index, baselineOut, treatmentOut } = prev
+    const xIsTreatment = index % 2 === 0
+    const outX = (xIsTreatment ? treatmentOut : baselineOut) || '(empty)'
+    const outY = (xIsTreatment ? baselineOut : treatmentOut) || '(empty)'
+    const checklist = sc.mustInclude.map((m, i) => `  ${i + 1}. ${m}`).join('\n')
+    return agent(
+      `You are an adversarial, independent grader. Two AI outputs answer the same task. You do NOT ` +
+      `know which (if any) used a helper skill — judge only what is on the page.\n\n` +
+      `TASK:\n${sc.scenario}\n\n` +
+      `REQUIRED ELEMENTS (must_include):\n${checklist}\n\n` +
+      `For EACH output and EACH required element, set satisfied true/false and quote the exact line ` +
+      `that satisfies it (empty string if unmet). Be skeptical: if unsure, mark unmet. Then rate four ` +
+      `quality axes 0-10: completeness, actionability, correctness, grounding (no invented facts).\n\n` +
+      `=== OUTPUT X ===\n${outX}\n=== OUTPUT Y ===\n${outY}\n`,
+      { label: `grade:${index}`, phase: 'Execute & Grade', schema: GRADE_SCHEMA },
+    )
+      .then((g) => ({ index, xIsTreatment, gradeX: g.gradeX, gradeY: g.gradeY }))
+      .catch(() => ({ index, xIsTreatment, error: 'grade-failed' }))
+  },
+)
+
+return { skillId: loaded.skillId, scenarios: results.filter(Boolean) }

package/scripts/skill-behavior-rubric.md

@@ -0,0 +1,63 @@
+# skill-behavior-rubric — how a skill's OUTPUT is graded (the behavioral gate)
+
+Sibling of `skill-rubric.md`. That one scores the skill as a **document**; this one scores what
+the skill **produces when run**. A skill ships only if BOTH gates are green.
+
+## How the behavioral eval works
+
+For each `capability` scenario in the skill's `evals/cases.yaml`, the engine
+(`scripts/skill-behavior-eval.workflow.js`) runs the scenario twice — once with the skill's
+`SKILL.md` injected (**treatment**), once without it (**baseline**) — and an independent, blind
+grader scores both outputs. The grader never learns which output used the skill; outputs are
+presented as X and Y, their slot varied by scenario index parity so a "first output" bias can't
+systematically favor the skill.
+
+## What the grader returns (per output)
+
+1. **must_include coverage.** For each `must_include` item: `satisfied` true/false **and a quoted
+   line** from the output that satisfies it. Evidence, not vibes. If unsure, mark unmet.
+2. **Quality, four axes 0-10:** `completeness`, `actionability`, `correctness`, `grounding`
+   (no invented facts / APIs / numbers).
+
+The grader returns raw signals only. It does **not** compute the score — that keeps the number
+deterministic and auditable.
+
+## Orientation signal (the brújula)
+
+User-facing, conversational skills should keep the user oriented. When a skill's capability scenario ends a turn the user acts on, the grader expects the output to:
+
+- **Situate** the user (where they are / what is built vs missing).
+- **Teach the why**, scaled to the dial (`technical_level` / `accompaniment_level`).
+- **Propose a next step phrased as a question** — never end in seco.
+
+Encode this as `must_include` items in those skills' capability scenarios (see `skills/orient/evals/cases.yaml` for the canonical pattern). It scores through the existing coverage axis — no separate formula. Skills that own a purely mechanical task (lint, a single rename) are exempt and should not be penalized.
+
+## How signals become the /10 (computed by `scripts/lib/behavior-score.js`)
+
+- Per output: `score = 0.6 × (satisfied / total × 10) + 0.4 × mean(quality axes)`.
+  Empty output → 0. No checklist → quality only.
+- Per scenario: `absolute` = treatment's score; `delta` = treatment − baseline.
+- Per skill: `absolute_score` = mean of absolutes; `lift` = mean of deltas.
+
+## The gate (both required)
+
+- `absolute_score ≥ 8.5` — the skill genuinely produces a good result.
+- `lift ≥ +1.0` — the skill measurably beats no-skill. `lift ≤ 0` is an automatic FAIL even at a
+  high absolute: the skill adds nothing the bare agent didn't already do.
+
+## Anti-gaming
+
+- Independent, blind grader; default-skeptical on coverage.
+- Errors fail closed: a scenario whose run or grade errored is dropped; if all drop, FAIL.
+- A skill with no `capability` scenario cannot be behaviorally evaluated → FAIL until one exists.
+- v1 uses a single grader per scenario. Upgrade path: N=3 graders, majority vote.
+
+## Running it
+
+```
+# 1) execute + grade — invoke the Workflow tool with the engine script and the skill id:
+#      scriptPath: scripts/skill-behavior-eval.workflow.js   args: "<skill-id>"
+#    capture the workflow's returned object to a JSON file (e.g. /tmp/<skill>-raw.json)
+# 2) score + gate (exit 0 pass / 1 fail):
+node scripts/skill-behavior-eval.js --score /tmp/<skill>-raw.json
+```

package/scripts/skill-harden-rubric.md

@@ -0,0 +1,40 @@
+# skill-harden-rubric — how the fix-loop diagnoses and guards a fix
+
+The `skill-harden` workflow turns a FAILING behavioral score into edits, without gaming the eval.
+These are the rules its agents follow.
+
+## Diagnosis (skill-fault vs eval-fault)
+
+Given the failing `mustFix`, both A/B outputs, and the grader's per-item evidence, decide the FAULT:
+
+- **skill** — the treatment output genuinely misses real capability (weak method, missing depth,
+  no concrete output). Fix the SKILL.md body and/or references/.
+- **eval** — the failure is the eval's, not the skill's. Two known biases:
+  1. **Self-describing scenario** — the `scenario` text enumerates its own `must_include`, so a
+     bare agent gets the same guidance the skill would give and the lift collapses artificially.
+  2. **Phantom-context must_include** — an item demands workspace artifacts the isolated eval
+     agent cannot have (e.g. `user-profile.md`, a real sibling skill to delegate to), capping the
+     absolute unfairly.
+
+Default to **skill** when unsure: blaming the eval is the easier, less honest path.
+
+## Eval-fix guard (independent judge)
+
+An eval edit ships ONLY if a judge certifies it corrects one of the two biases above and does NOT
+lower the bar — i.e. it makes the scenario less self-describing or removes a phantom-context item,
+but never deletes a legitimate quality criterion to make a weak skill pass. Rejected → treat as a
+skill-fault this round.
+
+## Skill-fix guards (both required)
+
+1. **Diff judge.** Read the SKILL.md/references diff. Does it add genuine capability (method,
+   decision rules, concrete guidance) or merely echo the `must_include` wording into the body to
+   satisfy the grader? Keyword-stuffing → revert the edit; it is not a fix.
+2. **Hold-out.** Re-score on a FRESH scenario from the skill's domain that the fixer never saw.
+   A real improvement generalizes; a memorized one does not. The hold-out score must also improve.
+
+## Stopping & honesty
+
+- Max 2 rounds. On give-up, report the honest final score and a recommendation — never a faked pass.
+- Persistent lift-fail at a high absolute → recommend deprecate/merge: the skill does not justify
+  its own existence.

package/scripts/skill-harden.workflow.js

@@ -0,0 +1,161 @@
+export const meta = {
+  name: 'skill-harden',
+  description: 'Detect AND fix one rsc skill: behaviorally score it, diagnose the failure, edit the right artifact with anti-gaming guards, re-verify, and commit on pass (max 2 rounds)',
+  phases: [
+    { title: 'Evaluate' },
+    { title: 'Diagnose & Fix' },
+    { title: 'Commit' },
+  ],
+}
+
+// args may arrive as an object {skillId, noCommit} or as a string "debug" / "debug noCommit".
+function parseArgs(a) {
+  if (typeof a === 'object' && a) return { skillId: a.skillId || '', noCommit: a.noCommit === true }
+  if (typeof a === 'string') {
+    const toks = a.trim().split(/[\s,]+/).filter(Boolean)
+    const id = toks.find((t) => !/^(no[-_]?commit|--no-commit)$/i.test(t)) || ''
+    const nc = toks.some((t) => /^(no[-_]?commit|--no-commit)$/i.test(t))
+    return { skillId: id, noCommit: nc }
+  }
+  return { skillId: '', noCommit: false }
+}
+const { skillId, noCommit } = parseArgs(args)
+if (!skillId) throw new Error('skill-harden: pass the skill id as args, e.g. "debug" or "debug noCommit"')
+const EVAL = { scriptPath: 'scripts/skill-behavior-eval.workflow.js' }
+
+const MAX_ROUNDS = 2
+
+const SCORE_SCHEMA = {
+  type: 'object',
+  properties: {
+    pass: { type: 'boolean' },
+    absolute: { type: 'number' },
+    lift: { type: 'number' },
+    mustFix: { type: 'array', items: { type: 'string' } },
+  },
+  required: ['pass', 'absolute', 'lift', 'mustFix'],
+}
+
+const FAULT_SCHEMA = {
+  type: 'object',
+  properties: {
+    fault: { type: 'string', enum: ['skill', 'eval'] },
+    rationale: { type: 'string' },
+  },
+  required: ['fault', 'rationale'],
+}
+
+const GUARD_SCHEMA = {
+  type: 'object',
+  properties: {
+    genuine: { type: 'boolean' },
+    rationale: { type: 'string' },
+  },
+  required: ['genuine', 'rationale'],
+}
+
+const HOLDOUT_SCHEMA = {
+  type: 'object',
+  properties: {
+    scenario: { type: 'string' },
+    mustInclude: { type: 'array', items: { type: 'string' } },
+  },
+  required: ['scenario', 'mustInclude'],
+}
+
+// Score a raw eval result via the authoritative CLI (keeps math in behavior-score.js).
+async function scoreRaw(raw, round) {
+  return agent(
+    `Write this JSON to /tmp/harden-${skillId}-r${round}.json exactly, then run ` +
+    `\`node scripts/skill-behavior-eval.js --score /tmp/harden-${skillId}-r${round}.json\`. ` +
+    `Read its markdown output and return {pass, absolute, lift, mustFix}: pass = the CLI exit code was 0 ` +
+    `(scorecard says PASS), absolute and lift from the Verdict line, mustFix = the bullet list under "Must fix" ` +
+    `(empty array if none).\n\nJSON:\n${JSON.stringify(raw)}`,
+    { label: `score:r${round}`, phase: 'Evaluate', schema: SCORE_SCHEMA },
+  )
+}
+
+const history = []
+let round = 0
+let committed = null
+
+while (true) {
+  phase('Evaluate')
+  const raw = await workflow(EVAL, skillId)
+  if (raw && raw.error === 'no-capability-scenarios') {
+    return { skillId, error: 'no-capability-scenarios', history, committed: null }
+  }
+  const score = await scoreRaw(raw, round)
+  history.push({ absolute: score.absolute, lift: score.lift, pass: score.pass })
+
+  if (score.pass) break
+  if (round >= MAX_ROUNDS) break
+
+  phase('Diagnose & Fix')
+  const evidence = JSON.stringify(raw.scenarios || [])
+  const fault = await agent(
+    `Follow scripts/skill-harden-rubric.md (Diagnosis). The skill "${skillId}" FAILED its behavioral gate. ` +
+    `mustFix:\n- ${score.mustFix.join('\n- ')}\n\nGrader signals (both A/B outputs, per-item evidence):\n${evidence}\n\n` +
+    `Decide fault = 'skill' or 'eval' and give a rationale. Default to 'skill' when unsure.`,
+    { label: `diagnose:r${round}`, phase: 'Diagnose & Fix', schema: FAULT_SCHEMA },
+  )
+
+  if (fault.fault === 'eval') {
+    const judged = await agent(
+      `Follow scripts/skill-harden-rubric.md (Eval-fix guard). Proposed: edit skills/${skillId}/evals/cases.yaml to ` +
+      `correct an eval bias (self-describing scenario, or a phantom-context must_include item). ` +
+      `Rationale from diagnosis: ${fault.rationale}\n\n` +
+      `Decide genuine=true ONLY if the change corrects a real bias WITHOUT lowering the bar. If genuine, APPLY the ` +
+      `edit to cases.yaml now (Edit tool); if not, change nothing. Return {genuine, rationale}.`,
+      { label: `eval-judge:r${round}`, phase: 'Diagnose & Fix', schema: GUARD_SCHEMA },
+    )
+    if (!judged.genuine) {
+      // Eval blamed but not justified -> fall through to a skill fix this round.
+      fault.fault = 'skill'
+    }
+  }
+
+  if (fault.fault === 'skill') {
+    await agent(
+      `Follow the author-skill discipline. The skill "${skillId}" must genuinely cover this mustFix without ` +
+      `keyword-stuffing:\n- ${score.mustFix.join('\n- ')}\n\nEdit skills/${skillId}/SKILL.md (body) and/or files under ` +
+      `skills/${skillId}/references/ to add the REAL missing capability (method, decision rules, concrete guidance). ` +
+      `Do not touch evals/. Apply the edits now.`,
+      { label: `fix:r${round}`, phase: 'Diagnose & Fix' },
+    )
+    const diffJudge = await agent(
+      `Follow scripts/skill-harden-rubric.md (Skill-fix guard 1). Run \`git diff -- skills/${skillId}/SKILL.md skills/${skillId}/references\` ` +
+      `and judge: does the diff add genuine capability, or just echo the mustFix wording to satisfy the grader? ` +
+      `If it is keyword-stuffing, run \`git checkout -- skills/${skillId}/SKILL.md skills/${skillId}/references\` to revert it. ` +
+      `Return {genuine, rationale}.`,
+      { label: `diff-judge:r${round}`, phase: 'Diagnose & Fix', schema: GUARD_SCHEMA },
+    )
+
+    if (diffJudge.genuine) {
+      // Guard 2: hold-out. Generate a fresh scenario and re-score the A/B on it only.
+      const holdout = await agent(
+        `Invent ONE fresh capability scenario for the "${skillId}" skill's domain that is NOT in its cases.yaml and ` +
+        `does NOT enumerate its own requirements. Return {scenario, mustInclude:[3-6 outcome-level checks]}.`,
+        { label: `holdout-gen:r${round}`, phase: 'Diagnose & Fix', schema: HOLDOUT_SCHEMA },
+      )
+      const holdoutRaw = await workflow(EVAL, { skillId, scenarios: [holdout] })
+      await scoreRaw(holdoutRaw, `${round}-holdout`) // recorded in transcript; informs the next loop's eval
+    }
+  }
+
+  round++
+}
+
+const passed = history.length > 0 && history[history.length - 1].pass === true
+if (passed && !noCommit) {
+  phase('Commit')
+  const commit = await agent(
+    `The skill "${skillId}" now passes its behavioral gate. Commit ONLY its files: ` +
+    `run \`git add skills/${skillId}\` then commit with a message describing the hardening. ` +
+    `Author is Eric — do NOT add any Claude co-author or generated footer. Return the commit hash as plain text.`,
+    { label: `commit:${skillId}`, phase: 'Commit' },
+  )
+  committed = (commit || '').trim()
+}
+
+return { skillId, rounds: round + 1, history, committed, passed }

package/scripts/skill-rubric.md

@@ -0,0 +1,39 @@
+# skill-rubric — the objective test every rsc skill must pass before shipping
+
+This is **the test, written before any skill is built.** A reviewer scores a finished skill
+0–10 on seven weighted dimensions, then the deterministic gates run (pass/fail, not gradeable).
+A skill **ships only at a weighted score ≥ 8.5 AND all deterministic gates green.** The reviewer
+is adversarial and independent of the author; it must cite evidence (line counts, char counts,
+quoted source dates), never vibes. No grade inflation — an honest 7.0 that drives a fix beats a
+dishonest 9.
+
+## Weighted dimensions (0–10 each)
+
+| # | Dimension | Weight | What a 10 looks like |
+|---|---|---|---|
+| 1 | **Triggering & description** | 0.15 | Third-person, `Use when …` lead, concrete `Triggers:` incl. ≥1 non-obvious phrasing and ≥1 Spanish/Catalan phrasing, explicit `NOT … (that is <sibling>)` boundary, ≤1024 chars, parses as single-line quoted YAML. |
+| 2 | **Scope & boundary** | 0.10 | One job. Body never drifts into a sibling's territory; it delegates by name. Near-miss prompts route to the correct existing sibling. |
+| 3 | **Body craft & progressive disclosure** | 0.15 | 120–400 lines, references pointed to inline (not orphaned), rsc voice, every fence language-tagged, a checklist/decision table only where the flow branches, an anti-patterns table present. |
+| 4 | **Correctness, grounding & freshness** | **0.25** | Every load-bearing claim is accurate and **current (2025–2026)**: real library/API versions, no hallucinated flags/endpoints. The spec cites **authoritative sources with dates**; nothing rests on stale or invented facts. This is the heaviest dimension by design. |
+| 5 | **Actionability** | 0.15 | Concrete and runnable: real numbers, paths, commands, decision rules — not adjectives. A practitioner could act from it without leaving the skill. |
+| 6 | **Evals quality** | 0.10 | ≥5 `should_trigger` (incl. non-obvious), ≥4 `should_not_trigger` each with a `route_to` that names a **real** sibling, ≥1 `capability` with a meaningful `must_include` rubric. The cases are genuine, not filler. |
+| 7 | **Originality & safety** | 0.10 | rsc voice, not a clone of any external catalog (no borrowed urgency blocks / rationalization tables / `*-reviewer-prompt.md` conventions / verbatim flowcharts). `verify.sh` present iff there is a checkable artifact. No destructive or unsafe advice presented without guardrails. |
+
+**Weighted score** = Σ(subscore × weight), rounded to 1 decimal. **Ship gate: ≥ 8.5.**
+
+## Deterministic gates (pass/fail — not part of the 0–10, but block shipping)
+
+1. `name` matches the directory id; `origin: risco` present.
+2. Frontmatter validates against `schema/frontmatter.schema.json` (`node scripts/build-manifest.js --validate`).
+3. Every `recommends` id is a **real** skill in the catalog (no dangling refs — `--validate` enforces).
+4. `scripts/eval-lint.sh` reports PASS for the skill (≥5/≥4/≥1 and the keys are lists).
+5. Every `../<sibling>/SKILL.md` link resolves to a skill that exists.
+6. `description` is ≤ 1024 characters and parses as YAML.
+7. If a `scripts/verify.sh` exists, it is executable, read-only by default, and exits 0 on a clean/empty target (no false failure).
+
+## How the reviewer must work (anti-cheat)
+
+- **Independent pass.** Review the artifact as written; do not assume the author's intent filled a gap.
+- **Evidence, not vibes.** For dimension 1 quote the char count; for 3 quote the SKILL.md line count; for 4 quote at least two source titles **with their dates** from the spec and name any claim you could not verify; for 6 count the entries.
+- **Freshness is mandatory.** If the skill names a version, API, or pricing that is plausibly out of date, dimension 4 is capped at 6 until a current source is cited. "Looks right" is not a source.
+- **Fix loop.** Below 8.5, return a concrete `mustFix` list; the author applies it and re-scores. Up to two fix rounds. If still < 8.5, **record the real score and flag it** — never round up to pass.