@lifeaitools/rdc-skills 0.35.2 → 0.35.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.35.2",
+  "version": "0.35.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/CHANGELOG.md

@@ -7,6 +7,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## v0.35.4 — marketplace sync false-positive: untracked file blocked it forever
+
+### Fixed
+- `syncMarketplaceCheckout()`'s dirty-check used plain `git status --porcelain`,
+  which also reports untracked files. A single harmless untracked file in a
+  marketplace clone (e.g. a stray local scratch file) made the check treat the
+  clone as "has local changes" and permanently refuse to sync it, on every
+  single install run, forever — even though `git reset --hard` never touches
+  untracked files and there was no real edit to preserve. This is the
+  confirmed root cause of the marketplace checkout sitting stale for over a
+  week despite repeated installer runs. Fixed to `--untracked-files=no`, which
+  checks only tracked-file modifications — genuine local edits still block the
+  sync exactly as before (PRESERVE-DIRTY intact); a stray untracked file no
+  longer does.
+- Regression test added: a real temp git origin+clone pair reproduces both the
+  untracked-cruft case (must sync) and the genuine-local-edit case (must still
+  block), so this cannot silently regress.
+- `tests/install-rdc-skills.test.mjs` also had two stale fixtures caught while
+  fixing this: `package-lock.json` version drifted from `package.json`
+  (0.35.2 vs 0.35.3+), and a hardcoded `skillCount === 36` assertion had rotted
+  against the real, current 43 skill directories. The count assertion now
+  compares against the actual `skills/*/SKILL.md` directories on disk instead
+  of a hardcoded number, so it can't go stale the same way again.
+
+---
+
+## v0.35.3 — coding standards wired into plan/preplan/build/fixit/review
+
+### Fixed
+- `docs/CODING-STANDARDS.md` (regen-root's SOLID/Clean-Architecture standard)
+  existed but was never referenced by any skill that actually reads source
+  documents before working — `preplan`, `plan`, `build`, `fixit`, and
+  `review` all now load it (regen-root; skip if absent). Applied to both the
+  `commands/*.md` and `skills/*/SKILL.md` copies where they diverge.
+- `skills/review/SKILL.md` incorrectly attributed `rdc-solid-score` to ATF;
+  it is this package's own validator (`scripts/solid-score.mjs`), which ATF's
+  Test-Ladder separately invokes as a consumer, not an owner.
+
+### Added
+- WIP, best-effort references to ATF's Test-Ladder and rdc-harness's
+  proof-ledger/mutation-check pattern in `build`, `fixit`, and `review` — not
+  a hard gate; explicitly a no-op where a target repo doesn't ship either.
+
+---
+
 ## v0.25.11 — private Coolify maintenance path
 
 ### Added

package/commands/build.md

@@ -108,7 +108,9 @@ Read the task title and description, then:
 
 3. **Load the plan** (if exists): check `.rdc/plans/` for matching topic (fallback: `.rdc/plans/`).
 
-4. **Read CLAUDE.md files** for all affected packages.
+4. **Read CLAUDE.md files** for all affected packages, plus `docs/CODING-STANDARDS.md`
+   (SOLID/Clean-Architecture standard — regen-root; skip if absent) — carry it into every
+   dispatched agent prompt.
 
 5. **Classify each task** → assign agent type from the table above.
 
@@ -163,6 +165,12 @@ Read the task title and description, then:
     - Read the full output — zero failures, zero type errors
     - If any step fails: fix and re-run the entire gate. Do not skip.
     - NEVER `pnpm build` / `pnpm test` / `pnpm -r` (crashes machine)
+    - **ATF Test-Ladder / rdc-harness (WIP — best-effort, not a hard gate yet):** if a
+      touched package/repo ships an ATF `STP-001.md` or an `rdc-harness`-style
+      `tools/mutate-check.mjs`/`tools/proof-ledger.mjs` pair, run it and quote the result
+      alongside vitest/tsc. A red mutation gate is a real finding — report it, do not
+      silently drop it because it isn't wired into this checklist as required yet.
+      Absence of either system in the target is not a failure; do not install one ad hoc.
 
 11. **After verification passes:**
     - Push all commits:

package/commands/fixit.md

@@ -70,7 +70,8 @@ This signals the Stop hook that fixit is handling its own documentation.
 
 ### 4. Make the fix
 
-Do the minimal work. Scope creep rule: if you discover the fix requires more than originally scoped, **stop immediately**:
+Do the minimal work, conforming to `docs/CODING-STANDARDS.md` where present
+(regen-root; skip if absent). Scope creep rule: if you discover the fix requires more than originally scoped, **stop immediately**:
 1. Close the work item: `update_work_item_status('<id>', 'blocked', '["Escalated — scope exceeded fixit threshold"]')`
 2. Delete the marker file
 3. Tell the user to use `/rdc:build` instead
@@ -108,6 +109,11 @@ failure this step exists to prevent. Carry the change to where it is consumed an
 
 Under `RDC_TEST=1`: echo `[RDC_TEST] skipping delivery (publish/deploy)` and proceed.
 
+**ATF Test-Ladder / rdc-harness (WIP — best-effort, not a hard gate yet):** if the touched
+package/repo already ships an ATF `STP-001.md` or an `rdc-harness`-style
+`tools/mutate-check.mjs`/`tools/proof-ledger.mjs` pair, run it and quote the result. Neither
+is fleet-wide yet — its absence is not itself a fixit failure.
+
 ### 6. Report, review, close, and clean up
 
 **Precondition: Step 5.5 delivery is verified.** If delivery is blocked, set `blocked` (not

package/commands/plan.md

@@ -34,6 +34,10 @@ description: >-
    .claude/rules/work-items-rpc.md            — work item schema, RPC, status enums
    .claude/rules/system-quick-links.md        — routing map to all system architecture docs
    .claude/rules/version-numbering.md         — version bump rules for affected packages
+   docs/CODING-STANDARDS.md                   — SOLID/Clean-Architecture standard; names
+                                                 ATF's Test-Ladder and rdc-harness's
+                                                 proof-ledger pattern where either applies
+                                                 (regen-root; skip if absent)
    ```
 
    **Step 1b — Identify affected domains, then load the matching architecture doc:**
@@ -112,6 +116,12 @@ description: >-
      - completeness: independently observable acceptance criteria plus at least one required `decomp-*` and `test-*` checklist row; and
      - proportionality: estimated files/LOC, declared surfaces, and change kind.
    - Do not invent architecture evidence. Missing, unregistered, broad-refactor, multi-surface, or disproportionate contracts are intentionally routed to human Design Review.
+   - **ATF Test-Ladder / rdc-harness (WIP — best-effort, not a hard gate yet):** if the
+     package being planned has its own ATF `STP-001.md` or ships an `rdc-harness`-style
+     `tools/proof-ledger.mjs`/`tools/mutate-check.mjs` pair, name it in the work package's
+     test requirements as an additional validation signal alongside vitest/tsc. Neither
+     system is fleet-wide or hook-enforced yet — do not fabricate a ladder or a proof
+     ledger for a package that doesn't already have one.
 
 6. **Write plan doc** to `.rdc/plans/<topic-slug>.md` (fallback: `.rdc/plans/<topic-slug>.md` if `.rdc/` does not exist):
    ```markdown

package/commands/preplan.md

@@ -37,6 +37,10 @@ description: >-
    .claude/rules/infrastructure-contract.md   — hard deployment + registry rules
    .claude/rules/work-items-rpc.md            — work item schema and RPC patterns
    .claude/rules/system-quick-links.md        — routing map to system architecture docs
+   docs/CODING-STANDARDS.md                   — SOLID/Clean-Architecture standard; names
+                                                 ATF's Test-Ladder and rdc-harness's
+                                                 proof-ledger pattern where either applies
+                                                 (regen-root; skip if absent)
    ```
 
    **Step 2b — Identify affected domains, then load the matching architecture doc:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.35.2",
+  "version": "0.35.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/scripts/install-rdc-skills.js

@@ -508,8 +508,16 @@ function syncMarketplaceCheckout(mktDir) {
   const git = (...args) =>
     execSync(`git -C "${mktDir}" ${args.join(' ')}`, { encoding: 'utf8', stdio: 'pipe' }).trim();
   try {
-    if (git('status', '--porcelain')) {
-      warn(`marketplace clone has local changes at ${mktDir} — left untouched; it may serve stale commands`);
+    // PRESERVE-DIRTY means "don't discard a real local edit to a TRACKED file" —
+    // `--untracked-files=no` is deliberate. Plain `git status --porcelain` also
+    // reports untracked files (`?? some-cruft.txt`), which `git reset --hard`
+    // never touches and never conflicts with. Treating that as "dirty" made this
+    // sync silently refuse forever the moment ANY stray untracked file appeared
+    // in the clone — which is exactly how this checkout sat 39+ commits behind
+    // for over a week (2026-08-23), still warning "left untouched" on every run,
+    // while a plain `git status` on the same directory read completely clean.
+    if (git('status', '--porcelain', '--untracked-files=no')) {
+      warn(`marketplace clone has local changes to tracked files at ${mktDir} — left untouched; it may serve stale commands`);
       return;
     }
     const branch = git('rev-parse', '--abbrev-ref', 'HEAD') || 'master';
@@ -1347,7 +1355,7 @@ async function main() {
 // scripts/probe-installed-hooks.mjs verify the real install path instead of
 // re-implementing it — a probe that copies its own way proves nothing about what
 // ships. Without this guard, requiring the module would run a full install.
-module.exports = { copyHookFiles, assertHooksLoadable, registerCodexTarget, RDC_ENV_HOOK_TIMEOUT_SEC };
+module.exports = { copyHookFiles, assertHooksLoadable, registerCodexTarget, syncMarketplaceCheckout, RDC_ENV_HOOK_TIMEOUT_SEC };
 
 if (require.main === module) {
   main().catch(e => { fail(e.message); process.exit(1); });

package/skills/build/SKILL.md

@@ -293,7 +293,9 @@ Read the task title and description, then:
 
    **Plan verifier escalation:** A separate verifier agent is optional, not default. Dispatch one only when the plan touches 5+ UI routes, 3+ data/API boundaries, auth/security, production deployment, or when this rubric fails twice. The verifier reads the plan and work-item checklists only; it does not write code.
 
-4. **Read CLAUDE.md files** for all affected packages.
+4. **Read CLAUDE.md files** for all affected packages, plus `docs/CODING-STANDARDS.md`
+   (SOLID/Clean-Architecture standard — regen-root; skip if absent) — carry it into every
+   dispatched agent prompt.
 
 5. **Classify each task** → assign agent type from the table above.
 
@@ -625,6 +627,12 @@ Read the task title and description, then:
     - Runs `npx tsc --noEmit` for every touched app/package
     - Starts the dev server and probes every modified route (expects HTTP 200, not 500)
     - Runs vitest for every touched package
+    - **ATF Test-Ladder / rdc-harness (WIP — best-effort, not a hard gate yet):** if a
+      touched package/repo ships an ATF `STP-001.md` or an `rdc-harness`-style
+      `tools/mutate-check.mjs`/`tools/proof-ledger.mjs` pair, run it and quote the result
+      alongside tsc/vitest. A red mutation gate is a real finding — report it even though
+      it isn't wired into this checklist as required yet. Absence of either system in the
+      target is not a failure; do not install one ad hoc.
     - For every durable workflow, runs the committed E2E harness and rejects the
       item unless its receipt proves public ingress -> queued/running -> terminal
       state, persisted outputs, and fixture cleanup on the deploy-equivalent

package/skills/fixit/SKILL.md

@@ -69,7 +69,8 @@ This signals the Stop hook that fixit is handling its own documentation.
 
 ### 4. Make the fix
 
-Do the minimal work. Scope creep rule: if you discover the fix requires more than originally scoped, **stop immediately**:
+Do the minimal work, conforming to `docs/CODING-STANDARDS.md` where present
+(regen-root; skip if absent). Scope creep rule: if you discover the fix requires more than originally scoped, **stop immediately**:
 1. Close the work item: `update_work_item_status('<id>', 'blocked', '["Escalated — scope exceeded fixit threshold"]')`
 2. Delete the marker file
 3. Tell the user to use `/rdc:build` instead
@@ -147,6 +148,11 @@ Hard rules for this gate:
 Under `RDC_TEST=1`: echo `[RDC_TEST] skipping delivery (publish/deploy)` and proceed; the
 gate is validated structurally, not executed.
 
+**ATF Test-Ladder / rdc-harness (WIP — best-effort, not a hard gate yet):** if the touched
+package/repo already ships an ATF `STP-001.md` or an `rdc-harness`-style
+`tools/mutate-check.mjs`/`tools/proof-ledger.mjs` pair, run it and quote the result. Neither
+is fleet-wide yet — its absence is not itself a fixit failure.
+
 ### 6. Close and clean up
 
 Submit implementation report first, move to review, then close as validator.

package/skills/review/SKILL.md

@@ -11,6 +11,10 @@ description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc
 
 > **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag.
 
+> **Standard being enforced:** `docs/CODING-STANDARDS.md` (SOLID/Clean-Architecture —
+> regen-root; skip if absent). Step 8c is where it's actually checked, via this package's
+> own `rdc-solid-score` (also invoked by ATF's Test-Ladder as a consumer, not an owner).
+
 
 # rdc:review — Quality Gate
 
@@ -124,7 +128,10 @@ description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc
    output. Either non-empty is a FORM/FIT failure — dispatch
    `architecture-reviewer` (skill: "architecture-reviewer") for the judgment
    half if a boundary finding needs a suggested fix, not just a named
-   violation.
+   violation. `rdc-solid-score` is this package's own SOLID validator
+   (`scripts/solid-score.mjs`), which ATF's Test-Ladder also invokes at rung
+   TI-3/R3 as a dogfooding example — this step is not an ATF integration;
+   ATF is a separate consumer of the same tool, not its owner.
 
    **Severity gate:**
    - Any regression, or any boundary violation → verdict cannot be CLEAN.
@@ -133,6 +140,14 @@ description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc
      nothing wrong to report, but say so explicitly rather than silently
      passing.
 
+   **rdc-harness (WIP — best-effort, not a hard gate yet):** if the reviewed
+   repo ships an `rdc-harness`-style `tools/mutate-check.mjs` and
+   `tools/proof-ledger.mjs` pair, run `tools/mutate-check.mjs` and quote its
+   result. A proof-ledger count is not citable evidence while its own
+   mutation gate is red — report that combination as HAS_ISSUES rather than
+   passing along a ledger number the gate itself has disowned. Absence of
+   this tooling in the target repo is not a finding; do not install it ad hoc.
+
    Under `RDC_TEST=1`: echo `[RDC_TEST] skipping form/fit/function gate` and continue.
 
 9. **Verification gate — dispatch the verify agent:**

package/tests/install-rdc-skills.test.mjs

@@ -44,7 +44,22 @@ assert.match(
 const skillCount = Array.isArray(plugin.skills_meta)
   ? plugin.skills_meta.length
   : Object.keys(plugin.skills_meta || {}).length;
-assert.equal(skillCount, 36, 'test fixture should expose all 36 MCP skills from plugin skills_meta');
+// A hardcoded magic number here (previously 36, silently stale against the
+// real 43) rots the instant a skill is added or removed and stops proving
+// anything — it only proves someone remembered to bump a number. Assert
+// against the actual skills/ directory instead: every dir containing a
+// SKILL.md must be represented in plugin.json's skills_meta, and vice versa.
+const skillsDir = join(REPO_ROOT, 'skills');
+const realSkillDirs = require('node:fs')
+  .readdirSync(skillsDir, { withFileTypes: true })
+  .filter((e) => e.isDirectory() && existsSync(join(skillsDir, e.name, 'SKILL.md')))
+  .map((e) => e.name)
+  .sort();
+assert.equal(
+  skillCount,
+  realSkillDirs.length,
+  `plugin.json skills_meta (${skillCount}) must match the actual skill directories on disk (${realSkillDirs.length}): ${realSkillDirs.join(', ')}`,
+);
 assert.match(
   source,
   /Available MCP skills.*\/rdc:\* command shorthands/,
@@ -97,6 +112,81 @@ try {
   rmSync(codexSkills, { recursive: true, force: true });
 }
 
+// Regression for the 2026-08-23 incident: a marketplace clone with ZERO real
+// local edits — only a stray untracked file — sat 39+ commits behind for over
+// a week because `git status --porcelain` (which also reports untracked
+// files) was treated as "has local changes, never touch it". `git reset
+// --hard` never touches untracked files, so an untracked file is irrelevant
+// to whether the sync is safe. This builds a real origin + clone pair,
+// reproduces the exact scenario, and asserts the clone actually advances.
+const { syncMarketplaceCheckout } = require(script);
+const gitTestRoot = mkdtempSync(join(tmpdir(), 'rdc-marketplace-sync-'));
+try {
+  const originDir = join(gitTestRoot, 'origin');
+  const cloneDir = join(gitTestRoot, 'clone');
+  const runGit = (cwd, args) => {
+    const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
+    assert.equal(res.status, 0, `git ${args.join(' ')} failed: ${res.stderr}`);
+    return res.stdout.trim();
+  };
+
+  mkdirSync(originDir, { recursive: true });
+  runGit(originDir, ['init', '--initial-branch=master']);
+  runGit(originDir, ['config', 'user.email', 'test@example.com']);
+  runGit(originDir, ['config', 'user.name', 'Test']);
+  writeFileSync(join(originDir, 'file.txt'), 'v1\n');
+  runGit(originDir, ['add', '.']);
+  runGit(originDir, ['commit', '-m', 'v1']);
+
+  runGit(gitTestRoot, ['clone', originDir, cloneDir]);
+
+  // Advance origin so the clone is genuinely behind.
+  writeFileSync(join(originDir, 'file.txt'), 'v2\n');
+  runGit(originDir, ['add', '.']);
+  runGit(originDir, ['commit', '-m', 'v2']);
+  const originHead = runGit(originDir, ['rev-parse', 'HEAD']);
+
+  // The exact reproduction: a stray UNTRACKED file, nothing modified/staged.
+  writeFileSync(join(cloneDir, 'some-local-cruft.cjs'), 'module.exports = {};\n');
+  assert.match(
+    runGit(cloneDir, ['status', '--porcelain']),
+    /^\?\? some-local-cruft\.cjs$/,
+    'precondition: clone must show ONLY an untracked file, nothing modified',
+  );
+
+  syncMarketplaceCheckout(cloneDir);
+
+  assert.equal(
+    runGit(cloneDir, ['rev-parse', 'HEAD']),
+    originHead,
+    'a clone with only an untracked file must still advance to origin — untracked cruft is not a local edit',
+  );
+  assert.equal(
+    existsSync(join(cloneDir, 'some-local-cruft.cjs')),
+    true,
+    'the untracked file itself must survive the sync — reset --hard never touches it',
+  );
+
+  // Genuine dirt — a MODIFIED tracked file — must still block the sync.
+  writeFileSync(join(originDir, 'file.txt'), 'v3\n');
+  runGit(originDir, ['add', '.']);
+  runGit(originDir, ['commit', '-m', 'v3']);
+  const originHeadV3 = runGit(originDir, ['rev-parse', 'HEAD']);
+  writeFileSync(join(cloneDir, 'file.txt'), 'local edit, never committed\n');
+  const beforeDirtySync = runGit(cloneDir, ['rev-parse', 'HEAD']);
+
+  syncMarketplaceCheckout(cloneDir);
+
+  assert.equal(
+    runGit(cloneDir, ['rev-parse', 'HEAD']),
+    beforeDirtySync,
+    'a real local edit to a TRACKED file must still block the sync (PRESERVE-DIRTY)',
+  );
+  assert.notEqual(beforeDirtySync, originHeadV3, 'sanity: origin did advance further in this step');
+} finally {
+  rmSync(gitTestRoot, { recursive: true, force: true });
+}
+
 const packagedRoot = mkdtempSync(join(tmpdir(), 'rdc-packaged-truth-'));
 try {
   writeFileSync(join(packagedRoot, 'package.json'), JSON.stringify({ version: '9.9.9' }));