@lifeaitools/rdc-skills 0.31.2 → 0.33.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.31.2",
+  "version": "0.33.0",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",
@@ -78,7 +78,7 @@
       "leads_to": [
         "convert",
         "brochure",
-        "rdc-brochurify",
+        "brochurify",
         "lifeai-brochure-author"
       ],
       "sandbox_aware": true,
@@ -158,8 +158,8 @@
       "enabled_default": true,
       "codeflow_required": false
     },
-    "rdc-brochurify": {
-      "name": "rdc-brochurify",
+    "brochurify": {
+      "name": "brochurify",
       "slash": "rdc:brochurify",
       "category": "tooling",
       "usage": "rdc:brochurify <source|job-payload>",
@@ -234,7 +234,7 @@
       ],
       "follows": [],
       "leads_to": [
-        "rdc-brochurify"
+        "brochurify"
       ],
       "sandbox_aware": false,
       "output_contract": "guides/output-contract.md",
@@ -999,8 +999,8 @@
       "enabled_default": true,
       "codeflow_required": true
     },
-    "rdc-extract-verifier-rules": {
-      "name": "rdc-extract-verifier-rules",
+    "extract-verifier-rules": {
+      "name": "extract-verifier-rules",
       "slash": "rdc:extract-verifier-rules",
       "category": "tooling",
       "usage": "rdc:extract-verifier-rules [enhancement-log]",
@@ -1032,7 +1032,7 @@
         "nightly cron at 3:00 AM PT"
       ],
       "follows": [
-        "rdc-brochurify"
+        "brochurify"
       ],
       "leads_to": [
         "review"

package/.github/workflows/publish.yml

@@ -1,5 +1,32 @@
 name: Publish to npm
 
+# TRUSTED PUBLISHING (OIDC) — no stored npm credential.
+#
+# WHY THIS CHANGED. npm retired the token model this fleet was built on:
+#   2025-12-09  every classic token permanently revoked
+#   2025-11     granular tokens capped at 90 days; any expiring after 2026-02-03
+#               were forcibly moved to that date
+#   2026-08     tokens with Bypass-2FA stop working entirely
+# So `secrets.NPM_TOKEN` is a credential that expires on npm's schedule regardless of
+# how carefully it is managed, and a release pipeline that depends on one is a pipeline
+# that silently stops working. This job proves its identity to npm per-run instead, and
+# there is nothing to rotate.
+#
+# It also publishes provenance automatically — cryptographic proof of the commit and
+# workflow that built the tarball — which a token publish does not.
+#
+# ONE-TIME SETUP ON NPMJS, per package (this cannot be done from CI):
+#   npmjs.com -> package -> Settings -> Trusted Publisher
+#     organization/user : LIFEAI
+#     repository        : rdc-skills
+#     workflow filename : publish.yml      (filename only, not a path)
+#     allowed actions   : must select at least one (required for configs created
+#                         after 2026-05-20)
+#
+# A package that does not exist yet cannot be configured this way — npm requires the
+# package to exist before its settings page does. Publish the first version with a
+# short-lived token, then switch here.
+
 on:
   push:
     tags:
@@ -7,6 +34,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write        # REQUIRED — without it npm gets no OIDC identity to trust
 
 jobs:
   publish:
@@ -19,10 +47,14 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
+      # npm >= 11.5.1 is the first release that understands trusted publishing. The
+      # node-24 image ships an older npm, and the failure mode without this is an
+      # ordinary-looking auth error rather than anything naming OIDC.
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest && npm --version
+
       - name: Publish
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Notify clauth channel
         if: always()
@@ -31,4 +63,4 @@ jobs:
           STATUS="${{ job.status }}"
           curl -s -X POST "${{ secrets.CLAUTH_CHANNEL_URL }}" \
             -H "Content-Type: application/json" \
-            -d "{\"event\":\"npm-publish\",\"package\":\"rdc-skills\",\"version\":\"${VERSION}\",\"status\":\"${STATUS}\",\"source\":\"github-actions\"}"
+            -d "{\"event\":\"npm-publish\",\"package\":\"rdc-skills\",\"version\":\"${VERSION}\",\"status\":\"${STATUS}\",\"source\":\"github-actions-oidc\"}"

package/README.md

@@ -335,8 +335,8 @@ skills/
   plan/SKILL.md        (create architecture + tasks)
   preplan/SKILL.md     (research before planning)
   prototype/SKILL.md   (build JSX prototype)
-  rdc-brochurify/SKILL.md (Brochurify orchestration)
-  rdc-extract-verifier-rules/SKILL.md (verifier rule extraction)
+  brochurify/SKILL.md  (Brochurify orchestration)
+  extract-verifier-rules/SKILL.md (verifier rule extraction)
   refactor/SKILL.md   (governed corrective takeover and consolidation)
   release/SKILL.md     (atomic package/app release)
   report/SKILL.md      (nightly report)

package/guides/lessons-learned-spec.md

@@ -30,7 +30,7 @@ gate, a tooling gotcha) used to survive only if someone hand-wrote a memory. Thi
 makes capture a **routine exit step** of every long skill, and triage a **routine phase**
 of the weekly housekeeping. Capture is cheap and append-only; triage is where fixes happen.
 
-Precedent: brochurify's `rdc-extract-verifier-rules` already does read-log → cluster →
+Precedent: brochurify's `extract-verifier-rules` already does read-log → cluster →
 propose-rule for one domain. This generalizes that pattern fleet-wide.
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.31.2",
+  "version": "0.33.0",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -35,7 +35,7 @@
     "rdc-design": "node scripts/rdc-design-cli.mjs",
     "test:hooks": "node scripts/test-rdc-hooks.mjs",
     "test:truth-gate": "node tests/run-evidence-gate.test.mjs && node tests/work-item-exit-gate-l2.test.mjs && node tests/work-item-exit-gate-l3.test.mjs && node tests/require-work-item-on-commit.test.mjs && node tests/harness-gates.test.mjs",
-    "test:acceptance": "node tests/acceptance.test.mjs && node tests/install-rdc-skills.test.mjs && node tests/help-surface.test.mjs && node tests/manifest-contract-fields.test.mjs && node tests/skill-test-matrix.test.mjs && node tests/completion-gate-supervisor-admission.test.mjs && node tests/curl-surface.test.mjs",
+    "test:acceptance": "node tests/acceptance.test.mjs && node tests/install-rdc-skills.test.mjs && node tests/help-surface.test.mjs && node tests/manifest-contract-fields.test.mjs && node tests/plugin-namespace-names.test.mjs && node tests/skill-test-matrix.test.mjs && node tests/completion-gate-supervisor-admission.test.mjs && node tests/curl-surface.test.mjs",
     "acceptance": "node scripts/acceptance.mjs --changed",
     "test:mcp": "node tests/mcp.test.mjs",
     "test:mcp:remote": "node tests/mcp.test.mjs --remote",

package/scripts/clean-malformed-registrations.js

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+/**
+ * clean-malformed-registrations — find (and optionally remove) rdc-skills
+ * registrations that are malformed or duplicated on an already-installed box.
+ *
+ * DRY RUN BY DEFAULT. Nothing is deleted unless you pass --apply.
+ *
+ *   node scripts/clean-malformed-registrations.mjs                 # report only
+ *   node scripts/clean-malformed-registrations.mjs --apply         # remove
+ *   node scripts/clean-malformed-registrations.mjs --project-root C:/Dev/regen-root
+ *
+ * What "malformed" means here
+ * ---------------------------
+ * `.claude-plugin/plugin.json` declares `name: "rdc"`, and Claude Code registers
+ * a plugin component as `<plugin>:<declared frontmatter name>`. A component whose
+ * own `name:` already spells the namespace gets it twice — `name: rdc:plan`
+ * renders `/rdc:rdc:plan`, and a directory called `rdc-brochurify` renders
+ * `rdc:rdc-brochurify`.
+ *
+ * Two independent defects produce what the operator sees, and this script
+ * separates them because the remedies differ:
+ *
+ *   PREFIXING     — a component declares the namespace itself. Fixed at the
+ *                   source (this repo). An installed copy carrying it is simply
+ *                   an old build: re-run the installer.
+ *   MULTIPLICATION— the same component is registered from more than one live
+ *                   source at once (extra plugin-cache dirs, a stale marketplace
+ *                   clone that is a full second copy of commands/ + skills/,
+ *                   leftover skills/user orphans). Re-running the installer does
+ *                   not always clear these, which is what this script is for.
+ *
+ * Safety: only regenerable install artifacts are ever removed. The marketplace
+ * directory is a git clone — it is REPORTED with the exact command, never
+ * deleted, because destroying it loses nothing but confuses Claude Code's own
+ * marketplace sync.
+ */
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const args = process.argv.slice(2);
+const APPLY = args.includes('--apply');
+const argOf = (flag, fallback) => {
+  const i = args.indexOf(flag);
+  return i >= 0 && args[i + 1] ? args[i + 1] : fallback;
+};
+const CLAUDE_HOME = path.resolve(argOf('--claude-home', path.join(os.homedir(), '.claude')));
+const PROJECT_ROOT = argOf('--project-root', null);
+const MARKETPLACE = 'rdc-skills';
+
+// The namespace is read from the installed plugin manifest when available, so
+// this script stays correct if the plugin is ever renamed.
+function pluginNamespace() {
+  const candidates = [
+    path.join(CLAUDE_HOME, 'plugins', 'cache', MARKETPLACE, 'rdc-skills', 'latest', '.claude-plugin', 'plugin.json'),
+    path.resolve(__dirname, '..', '.claude-plugin', 'plugin.json'),
+  ];
+  for (const p of candidates) {
+    try { return JSON.parse(fs.readFileSync(p, 'utf8')).name; } catch {}
+  }
+  return 'rdc';
+}
+const NS = pluginNamespace();
+
+const findings = { prefixing: [], multiplication: [], report: [] };
+const removals = []; // { path, why, kind: 'dir' | 'file' }
+
+function declaredName(file) {
+  try {
+    const raw = fs.readFileSync(file, 'utf8').replace(/\r\n/g, '\n');
+    const block = raw.match(/^---\n([\s\S]*?)\n---/);
+    if (!block) return null;
+    const line = block[1].split('\n').find((l) => /^name:\s*/.test(l));
+    return line ? line.replace(/^name:\s*/, '').trim().replace(/^["']|["']$/g, '') : null;
+  } catch { return null; }
+}
+
+function isDoubled(effective) {
+  return effective === NS || effective.startsWith(`${NS}:`) || effective.startsWith(`${NS}-`);
+}
+
+/** Scan one installed plugin tree (commands/ + skills/) for doubled names. */
+function scanTree(label, treeDir) {
+  if (!fs.existsSync(treeDir)) return;
+
+  const cmdDir = path.join(treeDir, 'commands');
+  if (fs.existsSync(cmdDir)) {
+    for (const f of fs.readdirSync(cmdDir).filter((f) => f.endsWith('.md')).sort()) {
+      const eff = declaredName(path.join(cmdDir, f)) ?? f.replace(/\.md$/, '');
+      if (isDoubled(eff)) {
+        findings.prefixing.push({ source: label, file: path.join(cmdDir, f), declared: eff, renders: `${NS}:${eff}` });
+      }
+    }
+  }
+
+  const skillsDir = path.join(treeDir, 'skills');
+  if (fs.existsSync(skillsDir)) {
+    for (const e of fs.readdirSync(skillsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (!e.isDirectory()) continue;
+      const md = path.join(skillsDir, e.name, 'SKILL.md');
+      if (!fs.existsSync(md)) continue;
+      const eff = declaredName(md) ?? e.name;
+      if (isDoubled(eff)) {
+        findings.prefixing.push({ source: label, file: md, declared: eff, renders: `${NS}:${eff}` });
+      }
+    }
+  }
+}
+
+// ── 1. Every live plugin source ───────────────────────────────────────────────
+const pluginsDir = path.join(CLAUDE_HOME, 'plugins');
+const cacheBase = path.join(pluginsDir, 'cache', MARKETPLACE, 'rdc-skills');
+const mktDir = path.join(pluginsDir, 'marketplaces', MARKETPLACE);
+
+if (fs.existsSync(cacheBase)) {
+  for (const entry of fs.readdirSync(cacheBase)) {
+    scanTree(`cache/${entry}`, path.join(cacheBase, entry));
+    if (entry !== 'latest') {
+      findings.multiplication.push(`extra plugin cache dir registers a second full copy: cache/${entry}`);
+      removals.push({ path: path.join(cacheBase, entry), why: 'non-latest plugin cache dir (duplicate source)', kind: 'dir' });
+    }
+  }
+}
+
+// The marketplace directory is a git CLONE of the whole repo, not just a
+// manifest. When it lags, it is a second, older copy of every command and skill,
+// live in the menu beside the current one. Never deleted here.
+if (fs.existsSync(mktDir)) {
+  scanTree('marketplaces/rdc-skills', mktDir);
+  const hasTree = fs.existsSync(path.join(mktDir, 'commands')) || fs.existsSync(path.join(mktDir, 'skills'));
+  if (hasTree) {
+    findings.multiplication.push('marketplace dir contains a full commands/ + skills/ tree — a second live source');
+    findings.report.push(
+      `Marketplace clone is a second source. Bring it to the shipping ref (do NOT delete it):\n` +
+      `      git -C "${mktDir}" fetch origin master\n` +
+      `      git -C "${mktDir}" status --porcelain     # must be empty first\n` +
+      `      git -C "${mktDir}" reset --hard origin/master`
+    );
+  }
+}
+
+// ── 2. skills/ and skills/user/ orphans ───────────────────────────────────────
+for (const rel of ['skills', path.join('skills', 'user')]) {
+  const dir = path.join(CLAUDE_HOME, rel);
+  if (!fs.existsSync(dir)) continue;
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    let md = null;
+    if (e.isDirectory()) {
+      md = ['SKILL.md', 'skill.md'].map((n) => path.join(p, n)).find((f) => fs.existsSync(f)) || null;
+    } else if (e.name.endsWith('.md')) {
+      md = p;
+    }
+    if (!md) continue;
+    const name = declaredName(md);
+    if (name && (name === NS || name.startsWith(`${NS}:`) || name.startsWith(`${NS}-`))) {
+      findings.multiplication.push(`loose skill in ${rel}/ shadows the plugin copy: ${e.name} (declares "${name}")`);
+      removals.push({ path: p, why: `loose rdc skill under ${rel}/ (plugin cache is authoritative)`, kind: e.isDirectory() ? 'dir' : 'file' });
+    }
+  }
+}
+
+// ── 3. Codex / .agents skill dirs — stale rdc-* copies ────────────────────────
+const codexTargets = [
+  path.join(os.homedir(), '.codex', 'skills'),
+  path.join(os.homedir(), '.agents', 'skills'),
+  PROJECT_ROOT ? path.join(path.resolve(PROJECT_ROOT), '.agents', 'skills', 'user') : null,
+].filter(Boolean);
+
+for (const target of codexTargets) {
+  if (!fs.existsSync(target)) continue;
+  for (const e of fs.readdirSync(target, { withFileTypes: true })) {
+    if (!e.isDirectory() || !new RegExp(`^${NS}-`).test(e.name)) continue;
+    const p = path.join(target, e.name);
+    findings.multiplication.push(`stale codex skill copy: ${p}`);
+    removals.push({ path: p, why: 'legacy rdc-<name>/ codex skill copy (superseded by MCP)', kind: 'dir' });
+  }
+}
+
+// ── 4. Duplicate plugin registration rows ─────────────────────────────────────
+function jsonKeysStartingWithRdc(file, pick) {
+  if (!fs.existsSync(file)) return [];
+  try {
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const bag = pick(data) || {};
+    return Object.keys(bag).filter((k) => k.startsWith('rdc-skills@'));
+  } catch { return []; }
+}
+const ipKeys = jsonKeysStartingWithRdc(path.join(pluginsDir, 'installed_plugins.json'), (d) => d.plugins);
+if (ipKeys.length > 1) {
+  findings.multiplication.push(`installed_plugins.json has ${ipKeys.length} rdc-skills keys: ${ipKeys.join(', ')}`);
+  findings.report.push('Re-run `node scripts/install-rdc-skills.js` — it collapses these to one row.');
+}
+const spKeys = jsonKeysStartingWithRdc(path.join(CLAUDE_HOME, 'settings.json'), (d) => d.enabledPlugins);
+if (spKeys.length > 1) {
+  findings.multiplication.push(`settings.json enabledPlugins has ${spKeys.length} rdc-skills keys: ${spKeys.join(', ')}`);
+  findings.report.push('Re-run `node scripts/install-rdc-skills.js` — it collapses these to one key.');
+}
+
+// ── Output ────────────────────────────────────────────────────────────────────
+const B = (s) => `\x1b[1m${s}\x1b[0m`;
+console.log('');
+console.log(B(`rdc-skills malformed-registration scan   namespace="${NS}"   home=${CLAUDE_HOME}`));
+console.log(APPLY ? '  MODE: APPLY (will remove)' : '  MODE: DRY RUN (nothing will be removed — pass --apply to act)');
+console.log('');
+
+console.log(B(`A. PREFIXING — components that spell "${NS}" twice  (${findings.prefixing.length})`));
+if (!findings.prefixing.length) console.log('   none');
+for (const f of findings.prefixing) {
+  console.log(`   [${f.source}] ${f.declared}  ->  registers as ${f.renders}`);
+  console.log(`      ${f.file}`);
+}
+console.log('');
+console.log('   Remedy: these are stale BUILDS, not stray files — fixing them by hand');
+console.log('   would be overwritten on the next install. Update the source package and');
+console.log('   re-run the installer:  npm i -g @lifeaitools/rdc-skills && rdc-skills-install');
+console.log('');
+
+console.log(B(`B. MULTIPLICATION — the same component registered from >1 source  (${findings.multiplication.length})`));
+if (!findings.multiplication.length) console.log('   none');
+for (const m of findings.multiplication) console.log(`   ${m}`);
+console.log('');
+
+console.log(B(`REMOVABLE ARTIFACTS  (${removals.length})`));
+if (!removals.length) console.log('   none');
+for (const r of removals) console.log(`   ${r.kind.padEnd(4)} ${r.path}\n        why: ${r.why}`);
+console.log('');
+
+if (findings.report.length) {
+  console.log(B('MANUAL STEPS (not removable by this script)'));
+  for (const r of findings.report) console.log(`   - ${r}`);
+  console.log('');
+}
+
+if (!APPLY) {
+  console.log(B('DRY RUN — nothing was removed.'));
+  console.log(`  Re-run with --apply to remove the ${removals.length} artifact(s) listed above.`);
+  console.log('');
+  process.exit(0);
+}
+
+let removed = 0;
+for (const r of removals) {
+  try {
+    fs.rmSync(r.path, { recursive: r.kind === 'dir', force: true });
+    console.log(`  removed ${r.path}`);
+    removed++;
+  } catch (e) {
+    console.log(`  FAILED  ${r.path} — ${e.message}`);
+  }
+}
+console.log('');
+console.log(`  removed ${removed}/${removals.length} artifact(s).`);
+console.log('  Now re-run the installer so the single authoritative copy is rebuilt:');
+console.log('    node scripts/install-rdc-skills.js');
+console.log('');

package/skills/behavior-audit/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:behavior-audit
+name: behavior-audit
 description: "Usage `rdc:behavior-audit <report-dir> [--since-days N] [--latest N] [--reprocess]` — produces a bounded, redacted Claude/Codex transcript evidence bundle, incrementally skips completed transcript hashes, and aligns candidate behavior problems to shared truth-governance rules."
 ---
 

package/skills/brochure/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:brochure
+name: brochure
 description: "Usage `rdc:brochure <input> [--out <path>] [--template <name>] [--format Letter|A4]` — Turn a zip, folder, HTML file, URL, or markdown folder into a print-quality PDF brochure via Puppeteer. Auto-detects print-variant HTML, honors @page CSS, falls back to a Studio-token-aware template when no HTML exists."
 ---
 

package/skills/{rdc-brochurify → brochurify}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc-brochurify
+name: brochurify
 version: 0.1.0
 description: |
   Orchestrate a Brochurify job from source ingest through delivered PDF, using six parallel-dispatched typed sub-agents and the convergence loop. Use this skill EVERY TIME the user invokes Brochurify directly via "brochurify this", "make a brochure from", "convert this to a brochure PDF", or "rdc:brochurify". Also runs automatically when a job arrives from the broker via monkey_dispatch. The skill enforces D-001 through D-016 from the brochurify DECISIONS-LOG.

package/skills/build/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:build
+name: build
 description: "Usage `rdc:build <epic-id>` — You have a planned epic with tasks ready to execute. Dispatches parallel typed agents, each commits atomically to develop, runs a mandatory per-wave code-review gate (pr-review-toolkit:code-reviewer), closes work items, and runs the validator gate. Call after rdc:plan or when told to build."
 ---
 

package/skills/channel-formatter/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:channel-formatter
+name: channel-formatter
 description: "Usage `rdc:channel-formatter <channel|pack> [content]` — Apply precise, channel-native formatting and content repurposing to any output: LinkedIn, Twitter/X, Slack/Teams, Email (external/internal), Pitch Deck slides, Word/DOCX, PDF Report, Web/Landing Page, and multi-output content packs. Use EVERY TIME the user names an output channel/platform/document type, asks to 'write a post', 'draft an email', 'format this for', 'make this a slide', 'send to LinkedIn', 'write a tweet', 'social media post', 'turn this article into posts', 'make a content pack', 'make a social pack', or 'repurpose this article'. Each channel has its own Unicode strategy, emphasis system, length limits, and structure — never apply generic markdown to channel-specific output. This skill FORMATS, STRUCTURES, and REPURPOSES text only — for actual .docx/.pptx ↔ Markdown FILE conversion (either direction) use `rdc:convert` (build-corpus), not this skill. Self-contained: all channel and pack rules are inlined below (no external reference files)."
 ---
 

package/skills/co-develop/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:co-develop
+name: co-develop
 description: "Usage `rdc:co-develop <ask|reply|inbox|start|resume|status>` — peer-aware Claude/Codex co-development over clauth, with ask --wait as the default delegation pattern."
 ---
 

package/skills/collab/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:collab
+name: collab
 description: "Usage `rdc:collab <collaborator> [inbound] <topic>` — Structured agent-to-agent CONVERSATION with Codex, a local LLM, a Claude agent, or a claude.ai session. Converges on a decision and never writes to the repo — work that needs writing becomes a work item for rdc:build. Run `rdc:collab status <peer>` first — both sides emit probed capability state. Every dispatch carries a response contract."
 ---
 

package/skills/convert/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:convert
+name: convert
 description: "Usage `rdc:convert <input> [--out <dir>] [--to markdown|word] [--images assets|base64|s3]` — Convert .docx/.pptx/.ppt → Markdown (Word OMML equations as KaTeX TeX, tables, images) or Markdown → Word via the build-corpus CLI from npm `regen.mde`. Portable: runs in any session that can reach npm — Claude Code CLI, Codex, and claude.ai can fetch + run it. Use whenever the user asks to convert an Office document, build a Markdown corpus from .docx/.pptx, turn Markdown into a .docx, or open the report in the regen-mde editor on Windows."
 ---
 

package/skills/deploy/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:deploy
+name: deploy
 description: "Usage `rdc:deploy <slug> [promote|diagnose|audit|convert]` — registry-resolved PM2 development deployment and Coolify production promotion through clauth's bearer-authenticated job control plane, with status receipts and mandatory content gates."
 ---
 

package/skills/design/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:design
+name: design
 description: "Usage `rdc:design <topic>` — RDC-owned design work for Studio, Palette Library, and token-aware UI systems. Use for Rampant color work or design-system-first builds owned by the design cell. Not for general UI polish — use impeccable for that."
 ---
 

package/skills/edit/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:edit
+name: edit
 description: "Usage `rdc:edit <site|brand|route|file>` — open the local website editor host for a target site, brand, route, or file. Resolves the target, launches or reuses the local editor host on port 3015, and opens the target in the browser when not under `RDC_TEST=1`."
 ---
 

package/skills/env/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:env
+name: env
 description: "Usage `rdc:env [status|install|repair|update]` — Manage the LIFEAI environment harness: check status, install on a fresh box, repair broken services, or pull updates. Reads $LIFEAI_ENV/manifest.json as the source of truth. Use when: 'check the environment', 'install environment', 'repair environment', 'update environment', 'setup env', 'fix env', 'env status', or after a reboot/GPU crash."
 ---
 

package/skills/{rdc-extract-verifier-rules → extract-verifier-rules}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc-extract-verifier-rules
+name: extract-verifier-rules
 version: 0.1.0
 description: |
   Read recent enhancement-log entries, cluster failures by pattern, generate candidate verifier rules, test them against the known-good corpus and the failure corpus, and propose pull requests adding the highest-confidence rules to forbidden-patterns.json. Use this skill on a nightly cadence (3 AM PT), or manually when the user says "extract verifier rules", "promote enhancement log", "what new rules should we add", or after a significant brochure run produced many failures.

package/skills/fixit/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:fixit
+name: fixit
 description: "Usage `rdc:fixit <description>` — Quick fix under 5 files / 30 min that does not warrant a full plan→build cycle. Creates a minimal work item, makes the change, commits, runs a mandatory code-review pass (pr-review-toolkit:code-reviewer), DELIVERS the change to where it is consumed (publish/deploy/land) and verifies it, then closes. The only sanctioned bypass of rdc:build."
 ---
 

package/skills/fs-mcp/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:fs-mcp
+name: fs-mcp
 description: "Usage `rdc:fs-mcp <task>` — Use the File System MCP bridge for live repo reads, safe writes, cloud-to-local ingest, and GitHub-branch imports into a dirty local monorepo. Use when Claude.ai, Cowork, or CLI agents need fs_read/fs_write/fs_import_git_files guidance."
 ---
 

package/skills/handoff/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:handoff
+name: handoff
 description: "Usage `rdc:handoff [--from-prototype <id>]` — Convert a finalized plan or prototype into CLI-ready artifacts: writes .rdc/plans/, creates Supabase work items with DoD checklists, registers prototype if present. Bridge between planning session and rdc:build."
 ---
 

package/skills/help/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:help
+name: help
 description: "Usage `rdc:help` — Show all MCP skills with usage, requirements, slash forms, and codeflow status. Reads `.claude-plugin/plugin.json` skills_meta (single source of truth). Call when unsure which skill to use or what args it takes."
 ---
 

package/skills/housekeeping/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:housekeeping
+name: housekeeping
 description: "Usage `rdc:housekeeping [--fix]` — Weekly maintenance audit: directory structure verification, PUBLISH.md URL validation, CLAUDE.md freshness, orphan detection, places compliance, and stale version scan. Produces `.rdc/reports/YYYY-MM-DD-housekeeping.md`. With `--fix`, auto-remediate safe issues."
 ---
 

package/skills/onramp/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:onramp
+name: onramp
 description: "Usage `rdc:onramp <slug> --name \"<Display Name>\"` — Full-pipeline enrollment orchestrator for a new Place Fund project. Runs all 7 phases: enroll → research + document integration → conflict resolution → brand book + imagery → Regen Score gate → site build → deploy dev. Each phase is idempotent and resumable."
 ---
 

package/skills/overnight/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:overnight
+name: overnight
 description: "Usage `rdc:overnight [epic-id|label=<label>]` — Unattended end-to-end: drain the entire work queue autonomously (preplan → plan → build → review → report). Inherits mandatory per-wave code-review (pr-review-toolkit:code-reviewer) from rdc:build and rdc:review. Use when leaving Claude to run unsupervised for an extended session."
 ---
 

package/skills/plan/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:plan
+name: plan
 description: "Usage `rdc:plan <topic>` — No epic exists and you need architecture + task breakdown. Produces design decisions, tradeoffs, and Supabase epics/tasks with DoD checklists that feed rdc:build. Use after rdc:preplan or when given clear architectural direction."
 ---
 

package/skills/preplan/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:preplan
+name: preplan
 description: "Usage `rdc:preplan <topic>` — Before committing to an architecture, research unknowns first. Codebase scan + web search, no code written, no work items created. Output feeds rdc:plan. Use for open-ended approach questions."
 ---
 

package/skills/prototype/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:prototype
+name: prototype
 description: "Usage `rdc:prototype <description>` — Build a JSX/TSX mockup for visual review before implementation. Saves to docs/source/, registers in prototype_registry. Use when asked to mock something up or show what it looks like. Not production code."
 ---
 

package/skills/refactor/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:refactor
+name: refactor
 description: "Usage `rdc:refactor <epic-id|topic> --takeover <reason>` — Governed consolidation and implementation of a cross-cutting refactor. Authorizes an explicit takeover, preserves evidence, re-parents relevant work through the consolidation RPC, isolates every writer, and uses the same review, validator, landing, and delivery gates as rdc:build."
 ---
 

package/skills/regen-media/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:regen-media
+name: regen-media
 description: "Usage `rdc:regen-media <generate|edit|upscale|upload> <brief-or-path>` - Primary image-generation and Regen Media asset workflow. Use for image generation, image editing/upscaling, GPT Image/gpt-image-2 requests, Codex built-in image_gen, and uploading finished images to regen-media/R2. The default path is keyless local Codex gpt-image-2 via the built-in image_gen tool; server-side regen-media MCP/API generation is fallback only."
 ---
 

package/skills/release/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:release
+name: release
 description: "Usage `rdc:release <repo> [version|--patch|--minor|--major|--dry-run]` — bump, commit, tag, push, wait for CI/publish, install, and verify a package or project using repo-local release metadata."
 ---
 

package/skills/report/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:report
+name: report
 description: "Usage `rdc:report` — Write the nightly session summary to .rdc/reports/YYYY-MM-DD.md covering completed work, open items, per-project progress, and infra status. Call at session end."
 ---
 

package/skills/review/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:review
+name: review
 description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc, tests, stale docs, export conflicts, and a mandatory pr-review-toolkit:code-reviewer pass across modified packages. Fixes what it can automatically, escalates the rest. Call after rdc:build and before merging to main."
 ---
 

package/skills/self-test/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:self-test
+name: self-test
 description: "Usage `rdc:self-test [--strict]` — Validate all rdc:* skills, plugin manifest, and tooling consistency. Use after editing skills, upgrading the plugin, or when a skill behaves unexpectedly."
 ---
 

package/skills/status/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:status
+name: status
 description: "Usage `rdc:status` — Read-only snapshot of open epics, work items, Coolify health, blockers, and next recommended action. Safe to call anytime. Start here when disoriented or resuming a session."
 ---
 

package/skills/terminal-config/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:terminal-config
+name: terminal-config
 description: "Usage `rdc:terminal-config <task>` — read and safely modify Windows Terminal settings, shell profiles, and agent startup sequencing without relying on machine-specific paths."
 ---
 

package/skills/tests/MATRIX.md

@@ -31,8 +31,8 @@ The manifest layer verifies each skill can be started from a realistic caller pr
 | `rdc:plan` | `rdc-plan.test.json` | Health-endpoint planning prompt | `exit_code`, `stdout_contains` | Design-decision, decomposition-matrix, work-package, and coarse-check negative checks |
 | `rdc:preplan` | `rdc-preplan.test.json` | Rate-limiter research prompt | `commits_made`, `exit_code`, `stdout_contains` | Research artifact, comparison, unknowns, recommendation, and research-tool routing checks |
 | `rdc:prototype` | `rdc-prototype.test.json` | Tiny component prototype prompt | `exit_code`, `stdout_contains` | Local TSX prototype artifact, registry, test-mode, and production-write negative checks |
-| `rdc:brochurify` | `rdc-rdc-brochurify.test.json` | Read-only markdown Brochurify fixture | `exit_code`, `stdout_contains` | Sandbox output and no-follow-up negative checks |
-| `rdc:extract-verifier-rules` | `rdc-rdc-extract-verifier-rules.test.json` | Enhancement-log verifier fixture | `exit_code`, `stdout_contains` | Candidate, false-positive, known-good, recall, and no-auto-merge/PR negative checks |
+| `rdc:brochurify` | `rdc-brochurify.test.json` | Read-only markdown Brochurify fixture | `exit_code`, `stdout_contains` | Sandbox output and no-follow-up negative checks |
+| `rdc:extract-verifier-rules` | `rdc-extract-verifier-rules.test.json` | Enhancement-log verifier fixture | `exit_code`, `stdout_contains` | Candidate, false-positive, known-good, recall, and no-auto-merge/PR negative checks |
 | `rdc:release` | `rdc-release.test.json` | Dry-run package release | `commits_made`, `exit_code`, `stdout_contains` | Dry-run release checklist and force/bypass negative checks |
 | `rdc:regen-media` | `rdc-regen-media.test.json` | Image generation path selection | `commits_made`, `exit_code`, `stdout_contains` | Local keyless Codex gpt-image-2 default, test-mode no-generation, and server-side fallback negative checks |
 | `rdc:report` | `rdc-report.test.json` | Unattended report generation | `exit_code`, `stdout_contains` | Report status block, counts, next recommendation, and dump/push negative checks |

package/skills/watch/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:watch
+name: watch
 description: "Usage `rdc:watch` — Initialize a live session-log viewer and report its path; open it only during attended, non-test use. Zero infrastructure — pure filesystem + static HTML."
 ---
 

package/skills/workitems/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: rdc:workitems
+name: workitems
 description: "Usage `rdc:workitems [add|done|status|list|query]` — Manual work item CRUD outside the normal build flow: add to backlog, mark done, update status, list open epics, query by label."
 ---
 

package/tests/channel-formatter.contract.test.mjs

@@ -152,7 +152,7 @@ function inspectFormatterBody(body, prefix) {
 function unitChecks() {
   const names = listSkills().map((skill) => skill.name);
   check('unit: channel-formatter in local catalog', names.includes('channel-formatter'));
-  for (const specialist of ['convert', 'brochure', 'rdc-brochurify', 'lifeai-brochure-author']) {
+  for (const specialist of ['convert', 'brochure', 'brochurify', 'lifeai-brochure-author']) {
     check(`unit: specialist present ${specialist}`, names.includes(specialist));
   }
   const results = searchSkills('turn this article into social posts');
@@ -181,7 +181,7 @@ async function endpointChecks(url, label) {
   const catalog = JSON.parse(list.text || '{"skills":[]}');
   const names = catalog.skills.map((skill) => skill.name);
   check(`${label}: list includes channel-formatter`, names.includes('channel-formatter'));
-  for (const specialist of ['convert', 'brochure', 'rdc-brochurify', 'lifeai-brochure-author']) {
+  for (const specialist of ['convert', 'brochure', 'brochurify', 'lifeai-brochure-author']) {
     check(`${label}: list includes ${specialist}`, names.includes(specialist));
   }
 

package/tests/mcp.test.mjs

@@ -115,7 +115,7 @@ function unitTests() {
   check('unit: resolves bare skill name', resolveSkillName('build') === 'build');
   check('unit: resolves rdc slash skill name', resolveSkillName('rdc:build') === 'build');
   check('unit: resolves leading slash command form', resolveSkillName('/rdc:build') === 'build');
-  check('unit: resolves specialist slash alias', resolveSkillName('rdc:brochurify') === 'rdc-brochurify');
+  check('unit: resolves specialist slash alias', resolveSkillName('rdc:brochurify') === 'brochurify');
   check('unit: resolves non-rdc specialist name', resolveSkillName('lifeai-brochure-author') === 'lifeai-brochure-author');
 
   // Searchability gate — the dimension the first "100% coverage" missed. Every

package/tests/plugin-cache-clean-install.test.mjs

@@ -0,0 +1,76 @@
+/**
+ * Installing REBUILDS the plugin cache from scratch — a skill removed or renamed
+ * upstream must not survive in it.
+ *
+ * Claude Code registers whatever sits in the plugin cache, so anything left behind
+ * there keeps registering. A rename like `skills/rdc-brochurify/` ->
+ * `skills/brochurify/` would otherwise leave the old folder in place and the box
+ * would register BOTH `rdc:brochurify` and the double-namespaced
+ * `rdc:rdc-brochurify` — the shape of the malformed registrations this branch fixes.
+ *
+ * The installer already gets this right: both call sites `fs.rmSync(latestDir, ...)`
+ * immediately before `buildPluginCache(latestDir, ...)`. This test exists to keep it
+ * that way, because the guarantee lives in two separate places and neither states
+ * that it is load-bearing.
+ *
+ * WORTH RECORDING, because it nearly went the other way: the first version of this
+ * file shipped alongside an "obvious" fix to buildPluginCache — clear each payload
+ * directory before copying into it — on the theory that copy-over-merge was leaving
+ * the stale folders. Reverting that fix and re-running left the test GREEN, which is
+ * what exposed the diagnosis as wrong: the wipe already happens one level up, at the
+ * caller. Without that control run, a redundant change and a test that could not
+ * detect its own subject would both have shipped, and the real source of the stale
+ * registrations would have stayed hidden behind an apparent fix.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const INSTALLER = path.join(ROOT, 'scripts', 'install-rdc-skills.js');
+
+function runInstaller(claudeHome) {
+  try {
+    return execFileSync(process.execPath, [INSTALLER, '--claude-home', claudeHome, '--skip-hooks'], {
+      encoding: 'utf8', timeout: 300_000, cwd: ROOT,
+    });
+  } catch (err) {
+    return `${err.stdout || ''}${err.stderr || ''}`;
+  }
+}
+
+test('a stale skill directory in the plugin cache does not survive an install', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'rdcskills-home-'));
+
+  const first = runInstaller(home);
+  // The cache carries a version segment: cache/<marketplace>/<plugin>/<version>/skills
+  const cache = path.join(home, 'plugins', 'cache', 'rdc-skills', 'rdc-skills', 'latest', 'skills');
+  assert.ok(fs.existsSync(cache), `expected a plugin skills cache — installer said:\n${first.slice(-800)}`);
+
+  // Plant exactly the shape the defect produces: a skill folder that no longer exists
+  // upstream, carrying the double-namespaced name.
+  const stale = path.join(cache, 'rdc-brochurify');
+  fs.mkdirSync(stale, { recursive: true });
+  fs.writeFileSync(path.join(stale, 'SKILL.md'), '---\nname: rdc-brochurify\n---\nstale\n');
+  assert.ok(fs.existsSync(stale), 'precondition: decoy planted');
+
+  runInstaller(home);
+  assert.ok(!fs.existsSync(stale), 'a skill removed upstream must not survive in the cache');
+  assert.ok(
+    fs.readdirSync(cache).length > 0,
+    'control: the cache must still hold real skills — an empty cache would satisfy the assertion above for the wrong reason',
+  );
+});
+
+test('no rdc-prefixed skill directory ships in the repo', () => {
+  // The plugin is already named `rdc`, so a directory named `rdc-x` registers as
+  // `rdc:rdc-x`. This is the source-side half of the same defect, and it is the half
+  // that actually produced the malformed names.
+  const skills = path.join(ROOT, 'skills');
+  const bad = fs.readdirSync(skills).filter((d) => /^rdc-/.test(d));
+  assert.deepEqual(bad, [], `these register as rdc:rdc-*: ${bad.join(', ')}`);
+});

package/tests/plugin-namespace-names.test.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+/**
+ * Regression guard: the plugin namespace is applied ONCE.
+ *
+ * `.claude-plugin/plugin.json` declares `"name": "rdc"`. Claude Code registers a
+ * plugin component as `<plugin>:<declared frontmatter name>`. So any component
+ * that ALSO spells the namespace into its own `name:` gets it twice, and the
+ * menu renders `/rdc:rdc:plan` beside `/rdc:plan` — one entry per source.
+ *
+ * That defect was fixed for `commands/` in 643e198 ("the plugin namespace
+ * already says rdc — stop saying it twice") and `skills/` was never migrated,
+ * so 31 skills kept declaring `name: rdc:<x>` and two more carried the
+ * namespace in their DIRECTORY name (`skills/rdc-brochurify/`), composing to
+ * `rdc:rdc-brochurify`.
+ *
+ * Why the existing guards missed it: `tests/manifest-contract-fields.test.mjs`
+ * and `tests/mcp.test.mjs` both assert `!/^rdc:rdc-/` against
+ * `plugin.json.skills_meta[].slash` — a HAND-AUTHORED field that was already
+ * spelled correctly (`rdc:brochurify`). Nothing asserted anything about the
+ * frontmatter `name:` or the directory name, which is what the loader actually
+ * composes from. This test checks the registering artifact, not the aspiration.
+ */
+import assert from 'node:assert/strict';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = resolve(__dirname, '..');
+
+const plugin = JSON.parse(readFileSync(join(root, '.claude-plugin', 'plugin.json'), 'utf8'));
+const PLUGIN = plugin.name;
+assert.ok(PLUGIN, '.claude-plugin/plugin.json must declare a plugin name');
+
+/** Declared `name:` from a markdown frontmatter block, or null when absent. */
+function declaredName(file) {
+  const raw = readFileSync(file, 'utf8').replace(/\r\n/g, '\n');
+  const block = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!block) return null;
+  const line = block[1].split('\n').find((l) => /^name:\s*/.test(l));
+  return line ? line.replace(/^name:\s*/, '').trim().replace(/^["']|["']$/g, '') : null;
+}
+
+/** Every registering component: its file, the id it composes to, and its source. */
+function components() {
+  const out = [];
+
+  const cmdDir = join(root, 'commands');
+  if (existsSync(cmdDir)) {
+    for (const f of readdirSync(cmdDir).filter((f) => f.endsWith('.md')).sort()) {
+      const file = join(cmdDir, f);
+      out.push({
+        kind: 'command',
+        file: `commands/${f}`,
+        dir: f.replace(/\.md$/, ''),
+        declared: declaredName(file),
+      });
+    }
+  }
+
+  const skillsDir = join(root, 'skills');
+  for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.name === 'tests') continue;
+    const file = join(skillsDir, entry.name, 'SKILL.md');
+    if (!existsSync(file)) continue;
+    out.push({
+      kind: 'skill',
+      file: `skills/${entry.name}/SKILL.md`,
+      dir: entry.name,
+      declared: declaredName(file),
+    });
+  }
+
+  return out;
+}
+
+const all = components();
+assert.ok(all.length > 0, 'expected at least one plugin component to check');
+
+const offenders = { doublePrefixed: [], dirPrefixed: [] };
+
+for (const c of all) {
+  // The loader falls back to the directory / file stem when `name:` is absent.
+  const effective = c.declared ?? c.dir;
+
+  // 1. The declared name must not repeat the plugin namespace.
+  //    `name: rdc:plan` under plugin `rdc` composes to `rdc:rdc:plan`.
+  if (effective === PLUGIN || effective.startsWith(`${PLUGIN}:`)) {
+    offenders.doublePrefixed.push(`${c.file}  name: ${effective}  ->  ${PLUGIN}:${effective}`);
+  }
+
+  // 2. Same defect, hyphen spelling: a directory named `rdc-brochurify`
+  //    composes to `rdc:rdc-brochurify`.
+  if (effective.startsWith(`${PLUGIN}-`)) {
+    offenders.dirPrefixed.push(`${c.file}  name: ${effective}  ->  ${PLUGIN}:${effective}`);
+  }
+}
+
+assert.deepEqual(
+  offenders.doublePrefixed,
+  [],
+  `these components spell the "${PLUGIN}" namespace twice — the plugin supplies it:\n  ` +
+    offenders.doublePrefixed.join('\n  '),
+);
+
+assert.deepEqual(
+  offenders.dirPrefixed,
+  [],
+  `these components carry the "${PLUGIN}-" namespace in their own name — the plugin supplies it:\n  ` +
+    offenders.dirPrefixed.join('\n  '),
+);
+
+// 3. No two components of the same kind may compose to the same registered id.
+for (const kind of ['command', 'skill']) {
+  const seen = new Map();
+  for (const c of all.filter((c) => c.kind === kind)) {
+    const id = `${PLUGIN}:${c.declared ?? c.dir}`;
+    if (seen.has(id)) {
+      assert.fail(`duplicate ${kind} registration ${id}: ${seen.get(id)} and ${c.file}`);
+    }
+    seen.set(id, c.file);
+  }
+}
+
+console.log(`plugin namespace name tests — PASS (${all.length} components, namespace "${PLUGIN}")`);