@lifeaitools/rdc-skills 0.31.2 → 0.34.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.31.2",
+  "version": "0.33.0",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",
@@ -78,7 +78,7 @@
       "leads_to": [
         "convert",
         "brochure",
-        "rdc-brochurify",
+        "brochurify",
         "lifeai-brochure-author"
       ],
       "sandbox_aware": true,
@@ -158,8 +158,8 @@
       "enabled_default": true,
       "codeflow_required": false
     },
-    "rdc-brochurify": {
-      "name": "rdc-brochurify",
+    "brochurify": {
+      "name": "brochurify",
       "slash": "rdc:brochurify",
       "category": "tooling",
       "usage": "rdc:brochurify <source|job-payload>",
@@ -234,7 +234,7 @@
       ],
       "follows": [],
       "leads_to": [
-        "rdc-brochurify"
+        "brochurify"
       ],
       "sandbox_aware": false,
       "output_contract": "guides/output-contract.md",
@@ -999,8 +999,8 @@
       "enabled_default": true,
       "codeflow_required": true
     },
-    "rdc-extract-verifier-rules": {
-      "name": "rdc-extract-verifier-rules",
+    "extract-verifier-rules": {
+      "name": "extract-verifier-rules",
       "slash": "rdc:extract-verifier-rules",
       "category": "tooling",
       "usage": "rdc:extract-verifier-rules [enhancement-log]",
@@ -1032,7 +1032,7 @@
         "nightly cron at 3:00 AM PT"
       ],
       "follows": [
-        "rdc-brochurify"
+        "brochurify"
       ],
       "leads_to": [
         "review"

package/.github/workflows/publish.yml

@@ -1,5 +1,32 @@
 name: Publish to npm
 
+# TRUSTED PUBLISHING (OIDC) — no stored npm credential.
+#
+# WHY THIS CHANGED. npm retired the token model this fleet was built on:
+#   2025-12-09  every classic token permanently revoked
+#   2025-11     granular tokens capped at 90 days; any expiring after 2026-02-03
+#               were forcibly moved to that date
+#   2026-08     tokens with Bypass-2FA stop working entirely
+# So `secrets.NPM_TOKEN` is a credential that expires on npm's schedule regardless of
+# how carefully it is managed, and a release pipeline that depends on one is a pipeline
+# that silently stops working. This job proves its identity to npm per-run instead, and
+# there is nothing to rotate.
+#
+# It also publishes provenance automatically — cryptographic proof of the commit and
+# workflow that built the tarball — which a token publish does not.
+#
+# ONE-TIME SETUP ON NPMJS, per package (this cannot be done from CI):
+#   npmjs.com -> package -> Settings -> Trusted Publisher
+#     organization/user : LIFEAI
+#     repository        : rdc-skills
+#     workflow filename : publish.yml      (filename only, not a path)
+#     allowed actions   : must select at least one (required for configs created
+#                         after 2026-05-20)
+#
+# A package that does not exist yet cannot be configured this way — npm requires the
+# package to exist before its settings page does. Publish the first version with a
+# short-lived token, then switch here.
+
 on:
   push:
     tags:
@@ -7,6 +34,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write        # REQUIRED — without it npm gets no OIDC identity to trust
 
 jobs:
   publish:
@@ -19,10 +47,14 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
+      # npm >= 11.5.1 is the first release that understands trusted publishing. The
+      # node-24 image ships an older npm, and the failure mode without this is an
+      # ordinary-looking auth error rather than anything naming OIDC.
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest && npm --version
+
       - name: Publish
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Notify clauth channel
         if: always()
@@ -31,4 +63,4 @@ jobs:
           STATUS="${{ job.status }}"
           curl -s -X POST "${{ secrets.CLAUTH_CHANNEL_URL }}" \
             -H "Content-Type: application/json" \
-            -d "{\"event\":\"npm-publish\",\"package\":\"rdc-skills\",\"version\":\"${VERSION}\",\"status\":\"${STATUS}\",\"source\":\"github-actions\"}"
+            -d "{\"event\":\"npm-publish\",\"package\":\"rdc-skills\",\"version\":\"${VERSION}\",\"status\":\"${STATUS}\",\"source\":\"github-actions-oidc\"}"

package/.github/workflows/self-test.yml

@@ -1,29 +1,29 @@
-name: self-test
-
-on:
-  push:
-    branches: ['**']
-    tags: ['v*']
-  pull_request:
-
-jobs:
-  tier1:
-    name: Tier 1 static lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node 20
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Run rdc:self-test --strict (Tier 1)
-        # Tier 2 requires headless claude + clauth daemon — not available in standard CI.
-        # Tier 1 catches the backtick-drift + frontmatter class of bugs.
-        run: node scripts/self-test.mjs --strict
-
+name: self-test
+
+on:
+  push:
+    branches: ['**']
+    tags: ['v*']
+  pull_request:
+
+jobs:
+  tier1:
+    name: Tier 1 static lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Run rdc:self-test --strict (Tier 1)
+        # Tier 2 requires headless claude + clauth daemon — not available in standard CI.
+        # Tier 1 catches the backtick-drift + frontmatter class of bugs.
+        run: node scripts/self-test.mjs --strict
+
   tier2-gate:
     name: Tier 2 behavioral (tag releases only)
     runs-on: ubuntu-latest
@@ -32,14 +32,14 @@ jobs:
     env:
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node 20
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
       - name: Install claude CLI
         if: env.ANTHROPIC_API_KEY != ''
         run: npm install -g @anthropic-ai/claude-code