@lifeaitools/rdc-skills 0.15.0 → 0.17.0

package/lib/cloud-rewrite.mjs

@@ -0,0 +1,155 @@
+/**
+ * lib/cloud-rewrite.mjs — transform a CLI SKILL.md body into a cloud
+ * (claude.ai web) body.
+ *
+ * The CLI bodies assume a Claude Code session on Dave's Windows host: a local
+ * clauth HTTP daemon at 127.0.0.1:52437, a local shell, PM2, git, pnpm, and
+ * local node scripts. The claude.ai web client has NONE of those — it reaches
+ * credentials through the clauth MCP and the filesystem through the File System
+ * MCP, and it cannot run local processes at all.
+ *
+ * `toCloudBody(markdown)` applies rule-based rewrites:
+ *   1. clauth daemon curl  → "retrieve `<svc>` via the clauth MCP"
+ *   2. local shell/Bash fs ops + local `fs` → File System MCP tools
+ *   3. CLI-only mechanics (PM2 reload, git push, local node scripts, daemon
+ *      restart, pnpm) → annotated with a callout (NOT deleted — the cloud
+ *      caller needs to know to hand that step to a Claude Code session).
+ *
+ * The rewriter is intentionally rule-based and conservative: it annotates rather
+ * than rips out, so no information is lost. A hand-tuned `SKILL.cloud.md` (handled
+ * by the caller in catalog.mjs) bypasses this entirely.
+ *
+ * Contract: the cloud body for `deploy` MUST NOT contain `127.0.0.1:52437`.
+ */
+
+const CLI_CALLOUT = '> ⚠ CLI-only step — hand this to a Claude Code session.';
+
+/**
+ * Rule 1 — clauth daemon credential retrieval.
+ * Matches `curl ... http://127.0.0.1:52437/v/<svc>` (and /get/<svc>), with or
+ * without flags, optionally wrapped in $(...). Collapses to instruction text.
+ */
+function rewriteClauthCurls(md) {
+  let out = md;
+
+  // `_VAR=$(curl ... 127.0.0.1:52437/v/<svc>)`  → assignment-style instruction
+  out = out.replace(
+    /([A-Za-z_][A-Za-z0-9_]*)=\$\(\s*curl[^\n)]*?(?:127\.0\.0\.1|localhost):52437\/(?:v|get)\/([A-Za-z0-9._-]+)[^\n)]*\)/g,
+    (_m, varName, svc) => `# ${varName}: retrieve \`${svc}\` via the clauth MCP (clauth_inject / clauth_get)`,
+  );
+
+  // bare `curl ... 127.0.0.1:52437/v/<svc>` → instruction
+  out = out.replace(
+    /curl[^\n]*?(?:127\.0\.0\.1|localhost):52437\/(?:v|get)\/([A-Za-z0-9._-]+)[^\n]*/g,
+    (_m, svc) => `retrieve \`${svc}\` via the clauth MCP (clauth_inject / clauth_get)`,
+  );
+
+  // any remaining ping/list/other daemon references → MCP instruction
+  out = out.replace(
+    /curl[^\n]*?(?:127\.0\.0\.1|localhost):52437\/(?:ping|list-services|status|meta)[^\n]*/g,
+    'check clauth health via the clauth MCP (clauth_ping / clauth_status)',
+  );
+
+  // belt-and-suspenders: kill any stray bare daemon URL still standing
+  out = out.replace(
+    /https?:\/\/(?:127\.0\.0\.1|localhost):52437\/(?:v|get)\/([A-Za-z0-9._-]+)/g,
+    (_m, svc) => `the clauth MCP value for \`${svc}\``,
+  );
+  out = out.replace(
+    /https?:\/\/(?:127\.0\.0\.1|localhost):52437\S*/g,
+    'the clauth MCP',
+  );
+
+  return out;
+}
+
+/**
+ * Rule 2 — local shell/Bash file ops and a local `fs` → File System MCP.
+ * We add a one-line note rather than rewriting every cat/ls/grep, since the
+ * shapes vary wildly; the note tells the cloud caller which tools to reach for.
+ */
+function rewriteFsOps(md) {
+  let out = md;
+  // Direct references to a local `fs` module / node fs.
+  out = out.replace(
+    /\bnode:fs\b|\brequire\(['"]fs['"]\)\b|\bfrom ['"]fs['"]/g,
+    'the File System MCP (fs_read/fs_write/fs_glob/fs_grep)',
+  );
+  return out;
+}
+
+/**
+ * Rule 3 — flag CLI-only mechanics with a callout. We annotate fenced code
+ * blocks and bullet/numbered lines that contain a CLI-only verb. The callout
+ * is inserted ABOVE the offending block/line; the content is preserved.
+ */
+const CLI_ONLY_PATTERNS = [
+  /\bpm2\s+(?:start|restart|reload|delete|stop|list|status)\b/i,
+  /\bgit\s+push\b/i,
+  /\bpnpm\b/i,
+  /\bnpm\s+(?:install|run|publish|ci)\b/i,
+  /\bnode\s+[A-Za-z0-9_./-]+\.(?:mjs|cjs|js)\b/i,
+  /\brestart-clauth(?:\.bat)?\b/i,
+  /\bclauth\s+(?:scrub|restart|serve|lock|unlock)\b/i,
+];
+
+function isCliOnlyLine(line) {
+  return CLI_ONLY_PATTERNS.some((re) => re.test(line));
+}
+
+/**
+ * Walk the markdown line by line. Inside fenced ``` blocks, if ANY line trips a
+ * CLI-only pattern, emit one callout immediately before the fence. Outside code
+ * blocks, annotate individual list/prose lines that trip a pattern.
+ */
+function annotateCliOnly(md) {
+  const lines = md.split('\n');
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const fenceMatch = line.match(/^(\s*)```/);
+    if (fenceMatch) {
+      // Collect the whole fenced block.
+      const block = [line];
+      let j = i + 1;
+      for (; j < lines.length; j++) {
+        block.push(lines[j]);
+        if (/^\s*```/.test(lines[j])) {
+          j++;
+          break;
+        }
+      }
+      const hasCliOnly = block.some(isCliOnlyLine);
+      if (hasCliOnly) out.push(`${fenceMatch[1]}${CLI_CALLOUT}`);
+      out.push(...block);
+      i = j;
+      continue;
+    }
+
+    // Non-fence line: annotate list/prose lines that trip a pattern, but never
+    // double-annotate (skip if previous emitted line is already the callout).
+    if (isCliOnlyLine(line) && out[out.length - 1] !== CLI_CALLOUT) {
+      const indent = (line.match(/^(\s*)/) || ['', ''])[1];
+      out.push(`${indent}${CLI_CALLOUT}`);
+    }
+    out.push(line);
+    i++;
+  }
+  return out.join('\n');
+}
+
+/**
+ * Transform a CLI SKILL.md body into the cloud body.
+ * Order matters: rewrite clauth curls FIRST (they often live in code blocks that
+ * the CLI-only annotator would otherwise also flag), then fs ops, then annotate
+ * remaining CLI-only mechanics.
+ */
+export function toCloudBody(markdown) {
+  if (typeof markdown !== 'string' || !markdown) return markdown;
+  let out = markdown;
+  out = rewriteClauthCurls(out);
+  out = rewriteFsOps(out);
+  out = annotateCliOnly(out);
+  return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -24,7 +24,8 @@
   },
   "bin": {
     "rdc-skills-install": "scripts/install-rdc-skills.js",
-    "rdc-skills-self-test": "scripts/self-test.mjs"
+    "rdc-skills-self-test": "scripts/self-test.mjs",
+    "rdc-skills-mcp": "bin/rdc-skills-mcp.mjs"
   },
   "scripts": {
     "install-rdc-skills": "node scripts/install-rdc-skills.js",
@@ -33,9 +34,14 @@
     "validate": "node tests/validate-skills.js",
     "rdc-design": "node scripts/rdc-design-cli.mjs",
     "test:hooks": "node scripts/test-rdc-hooks.mjs",
+    "mcp": "node bin/rdc-skills-mcp.mjs",
+    "rebuild-mcp": "node scripts/rebuild-mcp.mjs",
     "prepack": "node scripts/validate-publish-manifests.js --mode warn || true && node scripts/validate-place-histories.js --mode warn || true"
   },
-  "devDependencies": {
-    "yaml": "^2.9.0"
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "express": "^5.0.0",
+    "yaml": "^2.9.0",
+    "zod": "^3.25.76"
   }
 }

package/scaffold/templates/brochure-studio-default.html

@@ -0,0 +1,70 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<title>{{TITLE}}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com"/>
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Source+Serif+4:ital,opsz,wght@0,8..60,300..900;1,8..60,300..900&family=Hanken+Grotesk:ital,wght@0,300..900;1,300..900&display=swap"/>
+<style>
+/* TOKENS_INJECT */
+@page { size: letter; margin: 0.6in 0.7in; }
+:root {
+  --loam-800:#2b2218; --loam-700:#3d2f1f; --loam-600:#5c4628;
+  --loam-300:#bda079; --loam-200:#d9c4a4; --loam-100:#ece0c8;
+  --moss-700:#4f5a37; --ochre-700:#97772c; --ochre-100:#f4e9d4;
+  --linen-50:#faf8f5; --linen-100:#f4edde;
+  --char-700:#2b2e26; --char-500:#4d5145; --char-400:#6d7164;
+  --ff-display:'Source Serif 4', Georgia, serif;
+  --ff-sans:'Hanken Grotesk', system-ui, sans-serif;
+}
+* { box-sizing: border-box; }
+html, body { background: white; }
+body {
+  margin: 0; font-family: var(--ff-sans); font-size: 10.5pt; line-height: 1.55;
+  color: var(--char-700);
+  -webkit-print-color-adjust: exact; print-color-adjust: exact;
+}
+h1, h2, h3, h4 { font-family: var(--ff-display); color: var(--loam-800); font-weight: 600; letter-spacing: -0.005em; }
+h1 { font-size: 28pt; line-height: 1.15; margin: 0 0 0.4em; }
+h2 { font-size: 18pt; line-height: 1.2; margin: 1.8em 0 0.4em; padding-bottom: 0.25em; border-bottom: 1px solid var(--loam-200); }
+h3 { font-size: 13pt; margin: 1.4em 0 0.3em; color: var(--loam-700); }
+p  { margin: 0 0 0.7em; }
+ul, ol { margin: 0 0 0.8em 1.1em; padding: 0; }
+li { margin: 0.15em 0; }
+code { font-family: 'JetBrains Mono', ui-monospace, monospace; font-size: 9pt; background: var(--linen-100); padding: 0.05em 0.3em; border-radius: 2px; }
+pre { background: var(--linen-100); padding: 0.7em 0.9em; border-radius: 4px; overflow-wrap: anywhere; font-size: 8.5pt; }
+img { max-width: 100%; height: auto; display: block; margin: 0.8em auto; }
+strong { color: var(--loam-800); }
+em { color: var(--char-500); }
+
+.cover { page-break-after: always; min-height: 9in; display: flex; flex-direction: column; justify-content: space-between; padding: 0.3in 0; }
+.cover-eyebrow { font-family: var(--ff-sans); font-size: 9pt; letter-spacing: 0.15em; text-transform: uppercase; color: var(--ochre-700); }
+.cover-title { font-family: var(--ff-display); font-size: 44pt; line-height: 1.05; color: var(--loam-800); margin: 0.2em 0 0.4em; }
+.cover-sub { font-family: var(--ff-display); font-style: italic; font-size: 14pt; color: var(--loam-600); max-width: 5.5in; }
+.cover-foot { font-size: 8.5pt; color: var(--char-400); border-top: 1px solid var(--loam-200); padding-top: 0.4em; display: flex; justify-content: space-between; }
+
+.brochure-section { page-break-before: always; }
+.brochure-section:first-of-type { page-break-before: auto; }
+
+@media screen {
+  body { max-width: 7.1in; margin: 0.6in auto; padding: 0 0.7in; }
+}
+</style>
+</head>
+<body>
+  <header class="cover">
+    <div>
+      <div class="cover-eyebrow">Brochure</div>
+      <h1 class="cover-title">{{TITLE}}</h1>
+      <div class="cover-sub">Composed by rdc:brochure</div>
+    </div>
+    <div class="cover-foot">
+      <span>RDC</span>
+      <span>{{TITLE}}</span>
+    </div>
+  </header>
+
+  {{SECTIONS}}
+</body>
+</html>

package/scripts/install-rdc-skills.js

@@ -675,6 +675,66 @@ function buildHooksConfig(hooksDir, profile = 'core') {
   return config;
 }
 
+// ── MCP server registration (non-fatal) ───────────────────────────────────────
+// Ensures the rdc-skills MCP deps are installed, registers/starts the local MCP
+// under PM2 as `rdc-skills-mcp` on PORT=3110, and prints the claude.ai connector
+// line. Every failure here WARNs — it must never abort the installer.
+function registerMcpServer() {
+  const MCP_NAME = 'rdc-skills-mcp';
+  const MCP_PORT = '3110';
+  const binPath = path.join(repoRoot, 'bin', 'rdc-skills-mcp.mjs');
+  const connector = 'https://rdc-skills.regendevcorp.com/mcp';
+
+  try {
+    // (a) ensure MCP runtime deps are present (express, @modelcontextprotocol/sdk, yaml, zod)
+    const needDeps = ['express', '@modelcontextprotocol/sdk', 'yaml', 'zod'].some((d) => {
+      try { require.resolve(d, { paths: [repoRoot] }); return false; } catch { return true; }
+    });
+    if (needDeps) {
+      try {
+        execSync('npm install --no-audit --no-fund', { cwd: repoRoot, stdio: 'pipe' });
+        ok('[7/7] MCP deps   — installed');
+      } catch (e) {
+        warn(`[7/7] MCP deps   — npm install failed (${e.message.split('\n')[0]}); install manually with \`npm install\``);
+      }
+    } else {
+      ok('[7/7] MCP deps   — already present');
+    }
+
+    // (b) register/start under PM2 (tolerate pm2 missing)
+    let pm2Ok = false;
+    try { execSync('pm2 -v', { stdio: 'pipe' }); pm2Ok = true; } catch { pm2Ok = false; }
+
+    if (!pm2Ok) {
+      warn('[7/7] MCP server — pm2 not found; start manually:');
+      info(`       PORT=${MCP_PORT} pm2 start ${binPath} --name ${MCP_NAME}`);
+    } else {
+      let registered = false;
+      try {
+        const jlist = JSON.parse(execSync('pm2 jlist', { encoding: 'utf8', stdio: 'pipe' }));
+        registered = Array.isArray(jlist) && jlist.some((p) => p.name === MCP_NAME);
+      } catch {}
+      try {
+        if (registered) {
+          execSync(`pm2 restart ${MCP_NAME} --update-env`, { cwd: repoRoot, stdio: 'pipe', env: { ...process.env, PORT: MCP_PORT } });
+          ok(`[7/7] MCP server — pm2 restarted ${MCP_NAME} (PORT=${MCP_PORT})`);
+        } else {
+          execSync(`pm2 start "${binPath}" --name ${MCP_NAME}`, { cwd: repoRoot, stdio: 'pipe', env: { ...process.env, PORT: MCP_PORT } });
+          ok(`[7/7] MCP server — pm2 started ${MCP_NAME} (PORT=${MCP_PORT})`);
+        }
+      } catch (e) {
+        warn(`[7/7] MCP server — pm2 start/restart failed (${e.message.split('\n')[0]})`);
+        info(`       PORT=${MCP_PORT} pm2 start ${binPath} --name ${MCP_NAME}`);
+      }
+    }
+
+    // (c) print the claude.ai connector line
+    info(`       claude.ai connector: ${connector}  (Auth: none — URL is the shared secret)`);
+  } catch (e) {
+    warn(`[7/7] MCP server — skipped (${e.message.split('\n')[0]})`);
+  }
+}
+
 // ── Preflight ─────────────────────────────────────────────────────────────────
 function runPreflight() {
   const nodeMajor = parseInt(process.versions.node.split('.')[0], 10);
@@ -982,6 +1042,11 @@ async function main() {
     process.exit(2);
   }
 
+  // 7. MCP server registration (non-fatal — WARNs only, never aborts)
+  console.log('');
+  console.log('  \x1b[36mMCP server:\x1b[0m');
+  try { registerMcpServer(); } catch (e) { warn(`[7/7] MCP server — unexpected error (${e.message})`); }
+
   // Done
   console.log('');
   console.log('  \x1b[32mDone!\x1b[0m');

package/scripts/rebuild-mcp.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+/**
+ * scripts/rebuild-mcp.mjs — "build hook" for the rdc-skills MCP server.
+ *
+ * The server reads skills live from disk, so a skill edit is usually picked up
+ * without a restart. This script exists to (a) bounce the PM2 process so any
+ * in-memory module cache is dropped, and (b) assert the local /health endpoint
+ * reports the current on-disk skill count — a fast smoke that the server is up
+ * and seeing the same catalog this script does.
+ *
+ * Tolerant of a missing PM2: if pm2 is not installed/registered, it prints how
+ * to start the server and exits 0. It never hard-fails the caller.
+ */
+
+import { execSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { listSkills } from '../lib/catalog.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, '..');
+const PM2_NAME = 'rdc-skills-mcp';
+const PORT = parseInt(process.env.PORT || '3110', 10);
+const BIN = path.join(REPO_ROOT, 'bin', 'rdc-skills-mcp.mjs');
+
+const ok = (m) => console.log(`  \x1b[32m✓\x1b[0m ${m}`);
+const info = (m) => console.log(`  \x1b[36m→\x1b[0m ${m}`);
+const warn = (m) => console.log(`  \x1b[33m⚠\x1b[0m ${m}`);
+
+function sh(cmd) {
+  return execSync(cmd, { encoding: 'utf8', stdio: 'pipe' }).trim();
+}
+
+function pm2Available() {
+  try {
+    sh('pm2 -v');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function pm2HasProcess() {
+  try {
+    const list = JSON.parse(sh('pm2 jlist'));
+    return Array.isArray(list) && list.some((p) => p.name === PM2_NAME);
+  } catch {
+    return false;
+  }
+}
+
+async function checkHealth(expectedSkills) {
+  // Node 22 has global fetch.
+  try {
+    const res = await fetch(`http://127.0.0.1:${PORT}/health`, { signal: AbortSignal.timeout(4000) });
+    if (!res.ok) {
+      warn(`/health returned HTTP ${res.status}`);
+      return false;
+    }
+    const json = await res.json();
+    if (json.skills === expectedSkills) {
+      ok(`/health OK — skills=${json.skills} (matches disk), version=${json.version}`);
+      return true;
+    }
+    warn(`/health skills=${json.skills} but disk has ${expectedSkills} — server may be stale`);
+    return false;
+  } catch (err) {
+    warn(`/health unreachable on port ${PORT}: ${err?.message || err}`);
+    return false;
+  }
+}
+
+async function main() {
+  const diskSkills = listSkills().length;
+  info(`On-disk catalog: ${diskSkills} skill(s)`);
+
+  if (!pm2Available()) {
+    warn('pm2 not found — cannot bounce the MCP process.');
+    info(`Start it manually:  PORT=${PORT} pm2 start ${BIN} --name ${PM2_NAME}`);
+    info(`Or run directly:    PORT=${PORT} node ${BIN}`);
+    process.exit(0);
+  }
+
+  if (pm2HasProcess()) {
+    try {
+      sh(`pm2 restart ${PM2_NAME} --update-env`);
+      ok(`pm2 restart ${PM2_NAME}`);
+    } catch (err) {
+      warn(`pm2 restart failed: ${err?.message || err}`);
+    }
+  } else {
+    info(`pm2 process '${PM2_NAME}' not registered.`);
+    info(`Start it:  PORT=${PORT} pm2 start ${BIN} --name ${PM2_NAME}`);
+    process.exit(0);
+  }
+
+  // Give the process a beat to bind, then probe /health (no long sleeps).
+  await new Promise((r) => setTimeout(r, 1200));
+  await checkHealth(diskSkills);
+  process.exit(0);
+}
+
+main().catch((err) => {
+  warn(`rebuild-mcp error (non-fatal): ${err?.message || err}`);
+  process.exit(0);
+});

package/skills/build/SKILL.md

@@ -401,3 +401,7 @@ NEVER run pnpm build or pnpm turbo. Use npx vitest run only.
 - Unattended: max 2 retries per task before escalating to advisor
 - Every Agent() dispatch: `model: <routed>` + `max_turns: 70` + `isolation: "worktree"` — non-negotiable. Model is chosen per task per the routing table in Step 7: Sonnet 4.6 for updates/edits, Opus 4.6 for harder coding, Opus 4.8 for design/innovative thought (CS 2.0, brand/UX, architecture). Supervisor logs `model=<chosen> reason=<phrase>` per agent. Exception: validator agent in Step 10 omits isolation; validator model stays `claude-sonnet-4-6` (verification, not generation).
 - Finding an existing file is NOT task completion — verify it satisfies the spec
+
+## Capture lessons (exit step)
+
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-build-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.

package/skills/collab/SKILL.md

@@ -215,3 +215,7 @@ If Dave types in this terminal during a turn:
 - Treat it as an override injected into the current task
 - Acknowledge it in your `chitchat_reply` response
 - If it changes direction mid-task, note what you stopped and why
+
+## Capture lessons (exit step)
+
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-collab-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.

package/skills/deploy/SKILL.md

@@ -372,6 +372,10 @@ Fields:
 
 When diagnosing a broken deploy in Mode 3: query `coolify_events` FIRST before re-running the deploy — the most recent event row tells you whether the previous deploy actually triggered, whether it failed, and how long it ran. Faster than checking the Coolify UI.
 
+## Capture lessons (exit step)
+
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-deploy-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+
 ## References
 
 - Type-specific checklists + DNS tree + gate commands: `docs/runbooks/coolify-deploy-checklist.md`

package/skills/fixit/SKILL.md

@@ -159,3 +159,7 @@ Report: what was fixed, file(s) changed, commit hash. One sentence.
 - Never run `pnpm build` — not needed for a fixit
 - If scope expands mid-fix: stop, escalate to rdc:build, don't finish under fixit
 - Marker file must be cleaned up whether fix succeeds or escalates
+
+## Capture lessons (exit step)
+
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-fixit-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.

package/skills/housekeeping/SKILL.md

@@ -158,6 +158,16 @@ Write to `.rdc/reports/YYYY-MM-DD-housekeeping.md`:
 ## Verdict: CLEAN / HAS_ISSUES
 ```
 
+## Lessons triage (weekly)
+
+Read all `.rdc/lessons/*.md` with `status: open` (schema + procedure: `.rdc/guides/lessons-learned-spec.md` § Triage procedure). Cluster by `area` + root-cause similarity (dedupe repeats into one fix). For each cluster:
+
+- `scope: simple` → apply the fix directly (rule line, skill-doc edit, config, guard), commit it, set the lesson(s) `status: applied` with the commit linked.
+- `scope: architectural` → do NOT edit. Present the issue + options via `AskUserQuestion` (per `.claude/rules/architectural-change-approval.md`). On approval, apply via the correct lifecycle (rdc-skills tag/push for skills; cited commit for rules) and set `status: applied`. If deferred, set `status: triaged` and spawn a `work_item`.
+- Not worth fixing → `status: wont-fix` with a one-line reason.
+
+Never delete lesson files — `applied` and `wont-fix` stay as the audit trail. Report captured / applied / escalated / deferred counts in the housekeeping report.
+
 ## Rules
 - Never run `pnpm build` — not needed for this audit
 - Never modify app_deployments — the DB is the source of truth; PUBLISH.md conforms to it