@lifeaitools/rdc-skills 0.35.22 → 0.35.23

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.35.22",
+  "version": "0.35.23",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/guides/agent-bootstrap.md

@@ -137,7 +137,7 @@ target's own declared build gates, or deploy to dev-PM2/npm-registry, you
 MUST use the real, tested `rdc-harness` CLI instead of hand-rolled bash/curl:
 
 ```bash
-npx --package=@lifeai/rdc-harness rdc-harness <create|open|edit|build|deploy> <slug> --monorepo-root <your own worktree, never the shared checkout>
+npx -y --package=@lifeai/rdc-harness rdc-harness <create|open|edit|build|deploy> <slug> --monorepo-root <your own worktree, never the shared checkout>
 ```
 
 `rdc-harness` is distributed as `@lifeai/rdc-harness` on **GitHub Packages**,
@@ -146,7 +146,11 @@ not npmjs (a different registry than `@lifeaitools/rdc-skills`). This needs
 PAT (clauth `github` service — repo/workflow/org scopes) as the registry auth
 token; check whether that mapping is already present (a machine that has
 already published or installed an `@lifeai` package usually has it globally)
-before assuming it needs to be created. Only if you are actively developing
+before assuming it needs to be created. An `npm` 404 on the package IS that
+missing mapping — do not read it as "the harness is unpublished". Keep the
+`-y`: without it a TTY-attached run stops on npx's `Ok to proceed?` prompt,
+which is the same one-off-published-package form `skills/convert/SKILL.md`
+already documents. Only if you are actively developing
 the harness itself does `node bin/rdc-harness.mjs ...` from inside a
 `C:/Dev/rdc-harness` checkout apply — never hardcode that path as a skill's
 default invocation; it exists on exactly one machine and defeats the point of

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.35.22",
+  "version": "0.35.23",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/skills/deploy/SKILL.md

@@ -7,6 +7,13 @@ description: rdc:deploy (slug, [action]) — run one command; exit 0 means shipp
 > One command, then one line: the URL on exit 0, or the `DEPLOY-FAILED` block on
 > non-zero. No tool-call narration, no raw JSON dumps, no progress commentary.
 
+> **Sandbox contract:** This skill honors `RDC_TEST=1` per
+> `.rdc/guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Under the flag
+> the run stays read-only — registry read plus health probe — and every
+> mutating step short-circuits: no deploy triggered, no Cloudflare cache purge,
+> no DNS write, no promote to main. `skills/tests/rdc-deploy.test.json` asserts
+> exactly those four absences, so this is an enforced contract, not a promise.
+
 # rdc:deploy — run the program, read the exit code
 
 **This skill is not a procedure. It is one command.**

package/skills/edit/SKILL.md

@@ -17,8 +17,10 @@ description: rdc:edit (target) — open the local website editor for a target
 **This skill is the designated handler `rdc-harness` dispatches to.**
 `packages/work/src/editors.mjs`'s `BY_CLASS` table maps `site-html`/`site-ts`
 product classes to editor id `'rdc:edit'` — when an agent calls
-`npx --package=@lifeai/rdc-harness rdc-harness edit <slug>` (the published
-package; see `guides/agent-bootstrap.md` for registry setup) against a website
+`npx -y --package=@lifeai/rdc-harness rdc-harness edit <slug>` (published on
+GitHub Packages — needs `@lifeai:registry=https://npm.pkg.github.com` in
+`.npmrc`; an `npm` 404 means that mapping is missing. Full setup:
+`{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md`) against a website
 target, its receipt names `editorId: 'rdc:edit'` and an `editableBoundary`.
 This skill IS that handler: resolve the same target, launch/reuse the editor
 host, use the harness's `editableBoundary` as the save boundary if the call

package/skills/open/SKILL.md

@@ -12,12 +12,14 @@ description: rdc:open ([slug]) — orient before working; answers where you are
 ## Run the script. Do not re-derive this by hand.
 
 `rdc-harness` ships as a published package — `@lifeai/rdc-harness` on GitHub
-Packages, not npmjs (see `guides/agent-bootstrap.md` for the registry
-precondition). Invoke it through the installed `bin`, never a
-machine-specific checkout path:
+Packages, not npmjs. That needs `@lifeai:registry=https://npm.pkg.github.com`
+in `.npmrc`; if `npm` 404s on the package, that mapping is what is missing
+(auth token: the clauth `github` PAT — full setup in
+`.rdc/guides/agent-bootstrap.md`). Invoke it through the installed `bin`,
+never a machine-specific checkout path:
 
 ```bash
-npx --package=@lifeai/rdc-harness rdc-harness open <slug>
+npx -y --package=@lifeai/rdc-harness rdc-harness open <slug>
 ```
 
 Only if you are actively developing the harness itself (working ON
@@ -143,9 +145,10 @@ Downstream verbs re-resolve from the registry by slug.
 
 ## Steps
 
-0. **Call `rdc-harness open <slug>`.** Steps 1–2 are what it returns, not a
-   procedure to perform. Only hand-resolve if the harness is genuinely
-   unavailable, and say so explicitly when you do.
+0. **Call `npx -y --package=@lifeai/rdc-harness rdc-harness open <slug>`.**
+   Steps 1–2 are what it returns, not a procedure to perform. Only
+   hand-resolve if the harness is genuinely unavailable, and say so
+   explicitly when you do.
 1. **Position.** Read `sourceBoundary` and `boundaryNote` from the result — they
    already account for pooled repos and lanes. Relative paths from there are
    correct by construction; a hardcoded `C:/Dev/regen-root/...` from a lane

package/skills/release/SKILL.md

@@ -94,11 +94,13 @@ monorepo subtree, not a standalone repo like this one),
 "Tests/self-test passed" through "Local install/update executed" rows safely:
 real `npm pack`, isolated-prefix install (never the real global store), real
 verify, and `--live` explicitly gating the actual publish. Where applicable,
-`npx --package=@lifeai/rdc-harness rdc-harness deploy <slug> [--live]` (the
-published package; see `guides/agent-bootstrap.md` for registry setup) can
-supply that evidence directly instead of hand-rolling the same
-pack/install/verify cycle. It does **not** replace version bump, tag or push
-— the harness CLI does none of those.
+`npx -y --package=@lifeai/rdc-harness rdc-harness deploy <slug> [--live]`
+(published on GitHub Packages — needs
+`@lifeai:registry=https://npm.pkg.github.com` in `.npmrc`; an `npm` 404 means
+that mapping is missing. Full setup:
+`{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md`) can supply that evidence
+directly instead of hand-rolling the same pack/install/verify cycle. It does
+**not** replace version bump, tag or push — the harness CLI does none of those.
 
 ## Resolution Order