@lifeaitools/rdc-skills 0.35.26 → 0.37.0

package/skills/fixit/SKILL.md

@@ -111,26 +111,27 @@ fi
 
 ⛔ **No fixit closes without a code-review pass.** Even single-file changes go through review.
 
-Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the fixit commit:
-
-```
-Agent({
-  subagent_type: "pr-review-toolkit:code-reviewer",
-  description: "fixit code review",
-  prompt: "Review `git show HEAD` on the development branch. Focus on:
-           bugs, logic errors, security, project-convention adherence (.claude/rules/*).
-           Confidence-based filtering — high-confidence findings only.
-           Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
-           low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
-})
-```
-
-**Severity gate:**
-- `critical` or `high` findings → fix in this same fixit session (do not escalate to rdc:build for the fix itself; the original fixit owns the cleanup), re-commit, re-run review until clean
-- `medium` or `low` findings → record in `implementation_report.flags`; proceed to close
-- Zero findings → proceed to close
-
-Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and proceed.
+Run the deterministic review gate in `guides/review-gate.md` with
+`BASE=HEAD~1` (or the commit before the fixit's first commit) and `SCOPE` set
+to the touched package. For a fixit this usually takes seconds.
+Approved: direct operator instruction — "we need to tune our code reviews to be
+specific -- if you ran the validator for solid and lint etc... it should take 1-2
+minutes". 2026-09-21, Dave, in session.
+
+Dispatch `pr-review-toolkit:code-reviewer` only for a **named question** the
+validators cannot answer, scoped to the files it touches. Never dispatch it with
+a bare "review the commit".
+
+**Gate outcome:**
+- A red gate step, or a critical/high finding from a named-question pass → fix
+  it in this same fixit session. Do not escalate the fix to rdc:build; the
+  original fixit owns the cleanup. Re-commit and re-run the gate until it is clean.
+- Medium/low findings from a named-question pass → record them in
+  `implementation_report.flags` and proceed to close.
+- All steps green → quote the `REVIEW_GATE` receipt in the implementation report
+  and proceed to close.
+
+Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and proceed.
 
 ### 5.7 Deliver to done (MANDATORY — a fixit is not done until the change is LIVE)
 
@@ -222,4 +223,10 @@ Report: what was fixed, file(s) changed, commit hash. One sentence.
 
 ## Capture lessons (exit step)
 
-Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-fixit-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — record each lesson where its fix belongs:
+
+- **Fix encoded in this run** (a guard, test or script shipped, commit linked): the lesson goes in that commit's message. No file, no issue.
+- **Fix not encoded**: submit it to the repository the fix belongs to, which opens one `lesson` + `proposal` issue there (an identical title opens nothing):
+  `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"`
+
+No lesson file is written. Note "N lessons captured (E encoded, S submitted)" with the issue URLs in your verdict/summary. A run that taught nothing records nothing — absence is the default.

package/skills/housekeeping/SKILL.md

@@ -160,26 +160,36 @@ Write to `.rdc/reports/YYYY-MM-DD-housekeeping.md`:
 
 ## Lessons triage (weekly)
 
-Read all `.rdc/lessons/*.md` with `status: open` (schema + procedure: `.rdc/guides/lessons-learned-spec.md` § Triage procedure). Cluster by `area` + root-cause similarity (dedupe repeats into one fix).
+List the open lesson issues across every registered repository (procedure: `.rdc/guides/lessons-learned-spec.md` § Triage procedure):
+
+```bash
+node "$LIFEAI_ENV/bin/rdc-lesson.mjs" list --state open
+```
+
+Every registered repository is listed, skipped because its issues are switched off (reported), or **NOT listed** — no GitHub repository resolves or the read failed. NOT listed is named on stderr and in `--json` `skipped`, and the command exits 1: the triage is then incomplete, not empty. Cluster open `proposal` issues by area + root-cause similarity (dedupe repeats into one fix; close the duplicates, linking the survivor), take reopened recurrences first (their fix did not hold), and decide each cluster's scope: **simple** (one-file fix, config, grep guard, test) or **architectural** (anything in `.claude/rules/architectural-change-approval.md`; when unsure, architectural).
 
 ### Attended mode (default — a human is present)
 
 For each cluster:
 
-- `scope: simple` → apply the fix directly (rule line, skill-doc edit, config, guard), commit it, set the lesson(s) `status: applied` with the commit linked.
-- `scope: architectural` → do NOT edit. Present the issue + options via `AskUserQuestion` (per `.claude/rules/architectural-change-approval.md`). On approval, apply via the correct lifecycle (rdc-skills tag/push for skills; cited commit for rules) and set `status: applied`. If deferred, set `status: triaged` and spawn a `work_item`.
-- Not worth fixing → `status: wont-fix` with a one-line reason.
+- **simple** → create the work item, run `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" accept <issue> --repo <slug> --work-item <uuid>`, apply the fix as a guard/test/script, and commit with `Fixes #N`. In regen-root (default branch `main`, integration `develop`) and regen-deploy-mgr (default branch `codex/regen-deploy-mgr-wp1`) `Fixes #N` never reaches the default branch, so once the fix lands run `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" close <issue> --repo <slug> --commit <sha>`.
+- **architectural** → do NOT edit. Present the issue + options via `AskUserQuestion` (per `.claude/rules/architectural-change-approval.md`). On approval, accept it and apply via the correct lifecycle (rdc-skills tag/push for skills; cited commit for rules). If deferred, accept it so the work item carries it.
+- Not worth fixing → close the issue as not planned with a one-line reason.
 
 ### Unattended mode (no human — overnight / cron / `rdc:overnight`)
 
 When the weekly triage runs unattended, follow `.rdc/guides/lessons-learned-spec.md` § **Triage procedure — UNATTENDED weekly mode** — do not run `AskUserQuestion`. In brief (the spec is authoritative):
 
 - **Per-difficulty model routing** (reuses the `rdc:build` table): the run is led by `claude-sonnet-5` for clustering + scope/difficulty triage; mechanical apply → `claude-haiku-4-5`; harder multi-file/migration fix → `claude-sonnet-5`; design/architectural fix → `claude-opus-5`.
-- `scope: simple` → apply directly or via `rdc:fixit`, commit, `status: applied`.
-- `scope: architectural` with a single clear correct fix (records an already-learned lesson — e.g. "document X", "add a gate", update a guide) → route through `rdc:plan` → `rdc:build` (or `rdc:fixit` if genuinely <5 files), update the documentation, set `status: applied`/`triaged`.
-- `scope: architectural` **and genuinely ambiguous** (multiple valid approaches, real tradeoffs) → write a `human_items` row (`item_type='decision'`, with options in `suggested_agent_prompt`, `source_type='lesson'`, `source_fingerprint` for dedupe), set `status: triaged`, spawn + link a `work_item`. Decided in the morning. This is the asynchronous equivalent of the attended interview and honors `.claude/rules/architectural-change-approval.md`.
+- **simple** → accept, apply directly or via `rdc:fixit`, commit with `Fixes #N` or close with `rdc-lesson close` where the default branch is not the integration branch.
+- **architectural with a single clear correct fix** (records an already-learned lesson — e.g. "add a gate", "encode X as a test") → accept, route through `rdc:plan` → `rdc:build` (or `rdc:fixit` if genuinely <5 files).
+- **architectural and genuinely ambiguous** (multiple valid approaches, real tradeoffs) → write a `human_items` row (`item_type='decision'`, with options in `suggested_agent_prompt`, `source_type='lesson'`, `source_fingerprint` = the issue URL for dedupe), accept the issue against a linked `work_item`. Decided in the morning. This is the asynchronous equivalent of the attended interview and honors `.claude/rules/architectural-change-approval.md`.
+
+### Conversion backlog — remaining lesson files
+
+List the lesson files still in the project (`.rdc/lessons/*.md`: doc-only and product lessons from before issues). They are a backlog to convert, not a place to capture: with the capacity left after the issues, pick files and encode each as a guard or test, point any live link at that artifact, and delete the file in the same commit (spec § Existing `.rdc/lessons/` files). Nothing new is written there — a new lesson, doc-only included, is an issue.
 
-Never delete lesson files — `applied` and `wont-fix` stay as the audit trail. Report captured / applied / escalated / deferred counts in the housekeeping report.
+Issues are closed, never deleted — a closed issue with its fixing commit or won't-fix reason is the audit trail. Report open / recurred / accepted / closed-fixed / closed-won't-fix counts with issue URLs, and backlog files converted / remaining, in the housekeeping report.
 
 ## Rules
 - Never run `pnpm build` — not needed for this audit

package/skills/onramp/SKILL.md

@@ -1466,4 +1466,4 @@ Append Phase 7 results to ONRAMP-REPORT.md (final section).
 
 ## Capture Lessons
 
-Before the final verdict, follow `.rdc/guides/lessons-learned-spec.md`. Write `.rdc/lessons/<YYYY-MM-DD>-onramp-<slug>.md` if the run taught something non-obvious.
+Before the final verdict, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure if the run taught something non-obvious. A lesson whose fix shipped as a guard, test or script this run goes in that commit's message; any other lesson is submitted to the repository the fix belongs to — `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"` opens one `lesson` + `proposal` issue there. No lesson file is written.

package/skills/overnight/SKILL.md

@@ -47,7 +47,7 @@ Before touching any code, verify the environment is safe:
 1. **Clauth daemon alive AND unlocked:** `/ping` alive is NOT enough — a LOCKED
    vault answers `/ping` but every `/v/<service>` returns nothing, so credentials
    silently resolve empty and a long unattended run fails hours later
-   (lesson 2026-06-16-overnight-preflight-clauth-locked-and-shared-develop-cells).
+   (retired lesson 2026-06-16-overnight-preflight-clauth-locked-and-shared-develop-cells).
    Assert `locked:false` before proceeding:
    ```bash
    curl -s http://127.0.0.1:52437/ping
@@ -58,8 +58,8 @@ Before touching any code, verify the environment is safe:
 2. **Git state clean AND no concurrent committer on shared develop:** Overnight
    shares the `develop` working tree with other cells/sessions. A second session
    committing concurrently can drop a just-committed file during a rebase
-   (lessons 2026-06-16-overnight-preflight-clauth-locked-and-shared-develop-cells,
-   2026-06-17-build-shared-develop-rebase-dropped-committed-file).
+   (retired lessons 2026-06-16-overnight-preflight-clauth-locked-and-shared-develop-cells,
+   retired lesson 2026-06-17-build-shared-develop-rebase-dropped-committed-file).
    ```bash
    git status --short
    git fetch -q origin && git log --oneline @..@{u}   # any rows = origin moved under you
@@ -144,7 +144,7 @@ After each wave: check `BUILD_STATUS`. If `escalated: true`, log the escalation
 in the overnight doc and continue — don't stop the loop.
 After each wave and after every resumed epic, require the `runOrchestrator()` receipt from `rdc:build` **where the orchestrator applies** — the target contains `corpus/_shared/build/phase-manifest.json` (today: regen-root; see `rdc:build` §1a). Elsewhere, require the contract checklist (`rdc-work check`) instead; an absent orchestrator is not a hold. `admission_refocus` or `pipeline_blocked` means the epic is held for an explicitly requested Design Review or validator closure; log that state and do not hand-reconstruct a dispatch wave.
 
-**Mandatory code-review gate inherited from rdc:build (Step 9b).** Every wave inside `rdc:build` runs a `pr-review-toolkit:code-reviewer` pass before the next wave dispatches. Critical/high findings reopen the affected work items to `todo` and the next wave fixes them. Overnight does not skip or weaken this gate. If a wave's code-review escalates twice, advisor decides; otherwise the loop continues.
+**Mandatory code-review gate inherited from rdc:build (Step 9b).** Every wave inside `rdc:build` runs the deterministic review gate (`guides/review-gate.md`: solid-score --diff, linter on changed files, tsc, scoped tests, UI spec) before the next wave dispatches. It takes one to two minutes, where an open-ended reviewer took 4–10, which matters most across an overnight queue. A red step reopens the affected work items to `todo` and the next wave fixes them. Overnight does not skip or weaken this gate. If a wave's gate escalates twice, the advisor decides; otherwise the loop continues.
 
 ### 3d. Review
 
@@ -253,4 +253,10 @@ Provide the advisor with:
 
 ## Capture lessons (exit step)
 
-Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-overnight-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — record each lesson where its fix belongs:
+
+- **Fix encoded in this run** (a guard, test or script shipped, commit linked): the lesson goes in that commit's message. No file, no issue.
+- **Fix not encoded**: submit it to the repository the fix belongs to, which opens one `lesson` + `proposal` issue there (an identical title opens nothing):
+  `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"`
+
+No lesson file is written. Note "N lessons captured (E encoded, S submitted)" with the issue URLs in your verdict/summary. A run that taught nothing records nothing — absence is the default.

package/skills/plan/SKILL.md

@@ -383,4 +383,10 @@ designing topology. Do not reach for the REMOTE rule by default.
 
 ## Capture lessons (exit step)
 
-Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-plan-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — record each lesson where its fix belongs:
+
+- **Fix encoded in this run** (a guard, test or script shipped, commit linked): the lesson goes in that commit's message. No file, no issue.
+- **Fix not encoded**: submit it to the repository the fix belongs to, which opens one `lesson` + `proposal` issue there (an identical title opens nothing):
+  `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"`
+
+No lesson file is written. Note "N lessons captured (E encoded, S submitted)" with the issue URLs in your verdict/summary. A run that taught nothing records nothing — absence is the default.

package/skills/preplan/SKILL.md

@@ -87,4 +87,10 @@ direction if given. If advisor cannot resolve, log and skip to next step.
 
 ## Capture lessons (exit step)
 
-Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-preplan-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — record each lesson where its fix belongs:
+
+- **Fix encoded in this run** (a guard, test or script shipped, commit linked): the lesson goes in that commit's message. No file, no issue.
+- **Fix not encoded**: submit it to the repository the fix belongs to, which opens one `lesson` + `proposal` issue there (an identical title opens nothing):
+  `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"`
+
+No lesson file is written. Note "N lessons captured (E encoded, S submitted)" with the issue URLs in your verdict/summary. A run that taught nothing records nothing — absence is the default.

package/skills/release/SKILL.md

@@ -41,7 +41,7 @@ rdc:release: <repo> vX.Y.Z -> vA.B.C
 [ ] Dry-run gate handled
 [ ] Version files updated
 [ ] Tests/self-test passed
-[ ] Mandatory release code-review (pr-review-toolkit:code-reviewer on `git diff <last-released-tag>..HEAD`). Block release on `critical`/`high` findings; record `medium`/`low` in the release notes and proceed.
+[ ] Mandatory release review gate (`guides/review-gate.md`, BASE=<last-released-tag>): solid-score --diff, linter on changed files, tsc, scoped tests. Block the release on any red step; LLM reviewer only for a named question.
 [ ] Commit created
 [ ] Tag created
 [ ] Branch and tag pushed
@@ -139,12 +139,12 @@ doc-sync/scope guard to catch contamination. In them:
 - **Pre-tag guard: refuse to tag if `git diff --cached --name-only` includes any
   path outside the declared change set.** A broad add swept 4 pre-existing
   untracked skill files into a tagged release that CI published before anyone
-  noticed (lesson 2026-06-08-release-git-add-all-swept-untracked-wip). Same
+  noticed (retired lesson 2026-06-08-release-git-add-all-swept-untracked-wip). Same
   dirty-tree contamination class as a lockfile generated against a dirty tree.
 
 ## ⛔ Cross-platform prepack + verify the PUBLISHED tarball
 
-- **Prepack must be OS-agnostic.** A bash-style `prepack` chain (`node A || true && node B || true && node stamp`) short-circuits under Windows **cmd.exe** (npm runs lifecycle scripts via cmd, not bash; `true` is not a cmd builtin and `||`/`&&` evaluate differently), so an appended step silently never runs (lesson 2026-06-13-release-windows-cmd-prepack-shortcircuit). When a prepack step must run cross-platform, use a node wrapper / `shx` / `cross-env` — never rely on `|| true` shell semantics that differ between cmd and bash.
+- **Prepack must be OS-agnostic.** A bash-style `prepack` chain (`node A || true && node B || true && node stamp`) short-circuits under Windows **cmd.exe** (npm runs lifecycle scripts via cmd, not bash; `true` is not a cmd builtin and `||`/`&&` evaluate differently), so an appended step silently never runs (retired lesson 2026-06-13-release-windows-cmd-prepack-shortcircuit). When a prepack step must run cross-platform, use a node wrapper / `shx` / `cross-env` — never rely on `|| true` shell semantics that differ between cmd and bash.
 - **Validate the PUBLISHED artifact, not a local Windows `npm pack`.** A local Windows `npm pack` is NOT a faithful rehearsal of the CI (ubuntu/bash) publish. After publish, verify the real tarball:
   ```bash
   npm pack <pkg>@<version>            # downloads the PUBLISHED tarball
@@ -165,4 +165,10 @@ Use `--profile lifeai` only on a workstation that intentionally has the LIFEAI p
 
 ## Capture lessons (exit step)
 
-Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-release-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — record each lesson where its fix belongs:
+
+- **Fix encoded in this run** (a guard, test or script shipped, commit linked): the lesson goes in that commit's message. No file, no issue.
+- **Fix not encoded**: submit it to the repository the fix belongs to, which opens one `lesson` + `proposal` issue there (an identical title opens nothing):
+  `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"`
+
+No lesson file is written. Note "N lessons captured (E encoded, S submitted)" with the issue URLs in your verdict/summary. A run that taught nothing records nothing — absence is the default.

package/skills/review/SKILL.md

@@ -12,8 +12,9 @@ description: rdc:review () - [--unattended] — post-build gate over tsc, tests,
 > **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag.
 
 > **Standard being enforced:** `docs/CODING-STANDARDS.md` (SOLID/Clean-Architecture —
-> regen-root; skip if absent). Step 8c is where it's actually checked, via this package's
+> regen-root; skip if absent). Steps 8b and 8c check it, via this package's
 > own `rdc-solid-score` (also invoked by ATF's Test-Ladder as a consumer, not an owner).
+> Step 8b runs the deterministic review gate, `guides/review-gate.md`.
 
 
 # rdc:review — Quality Gate
@@ -84,41 +85,47 @@ description: rdc:review () - [--unattended] — post-build gate over tsc, tests,
    - Never silently leave orphaned tasks
    - **⛔ Raw `UPDATE work_items SET parent_id = ...` is forbidden** — bypasses RLS and all constraint checks
 
-8b. **Mandatory code-review gate — dispatch pr-review-toolkit:code-reviewer:**
-
-   ⛔ **No CLEAN verdict without a code-review pass.** This is the second half of the quality gate; tsc/vitest catch type and behavior errors, code-reviewer catches logic, security, and convention drift.
-
-   Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the full diff under review:
-
-   ```
-   Agent({
-     subagent_type: "pr-review-toolkit:code-reviewer",
-     description: "rdc:review code-review pass",
-     prompt: "Review `git diff origin/main...HEAD` on the development branch.
-              Focus on: bugs, logic errors, security vulnerabilities, project-convention
-              adherence (.claude/rules/*, CLAUDE.md, engineering-behavior.md).
-              Confidence-based filtering — high-confidence findings only.
-              Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
-              low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
-   })
-   ```
-
-   **Severity gate:**
-   - `critical` or `high` → verdict cannot be CLEAN. Interactive: report and pause. Unattended: auto-fix if mechanical (rename, missing await, obvious null check), otherwise escalate via advisor and mark HAS_ISSUES.
-   - `medium` or `low` → record in the review report's "Issues" section; verdict can still be CLEAN.
-   - Zero findings → log `CODE_REVIEW: CLEAN` and continue.
-
-   Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and continue.
+8b. **Mandatory code-review gate — deterministic validators on the diff:**
+
+   ⛔ **No CLEAN verdict without a review-gate pass.** Run `guides/review-gate.md`
+   over the diff under review, with `BASE` set to the review's base ref and `SCOPE`
+   set to each modified package from step 1. Its checks are
+   `rdc-solid-score --diff`, the repo linter on changed files (`--write`, then
+   check), `tsc`, scoped tests, and the UI spec for changed routes. It finishes in
+   one to two minutes and gives the same answer twice.
+   Approved: direct operator instruction — "we need to tune our code reviews to be
+   specific -- if you ran the validator for solid and lint etc... it should take 1-2
+   minutes". 2026-09-21, Dave, in session.
+
+   Dispatch `pr-review-toolkit:code-reviewer` only for a **named question** the
+   validators cannot answer, such as auth bypass on a protected path or a return
+   figure in public copy. Scope it to the files that question touches, following
+   the guide's "When an LLM reviewer is still right" section. A bare "review the
+   diff" dispatch is retired.
+
+   **Gate outcome:**
+   - A red gate step, or a critical/high finding from a named-question pass →
+     the verdict cannot be CLEAN. Interactive: report and pause. Unattended:
+     fix it if the fix is mechanical (`--write` lint fixes, a missing await, an
+     obvious null check); otherwise escalate via the advisor and mark HAS_ISSUES.
+   - Medium/low findings from a named-question pass → record them in the review
+     report's "Issues" section. The verdict can still be CLEAN.
+   - All steps green → quote the `REVIEW_GATE` receipt and continue.
+
+   Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and continue.
 
 8c. **Form/fit/function gate — solid-validator + architecture-reviewer:**
 
-   ⛔ **No CLEAN verdict without this pass either.** Step 8b catches logic,
-   security, and convention drift. This step catches a different failure
-   shape entirely: code that is logically correct and convention-clean but
-   architecturally wrong — the `Harness` case (a use-case orchestrator that
-   reimplements what sibling packages exist to do, scoring fine on every
-   generic metric while failing the one check that names the actual rule).
+   ⛔ **No CLEAN verdict without this pass either.** Step 8b's lint, tsc and
+   tests catch convention drift and broken behavior. This step catches a
+   different failure shape: code that is logically correct and
+   convention-clean but architecturally wrong. The `Harness` case is the
+   example: a use-case orchestrator that reimplements what sibling packages
+   exist to do, scores fine on every generic metric, and fails the one check
+   that names the actual rule.
 
+   Reuse the `rdc-solid-score` JSON from step 8b rather than running the scorer
+   twice. If 8b ran without the repo's boundary config, re-run it with the config:
    ```bash
    rdc-solid-score <modified-package-path> --diff origin/main --config <repo>/.solid-score.yml --format json
    ```
@@ -212,4 +219,10 @@ description: rdc:review () - [--unattended] — post-build gate over tsc, tests,
 
 ## Capture lessons (exit step)
 
-Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — write one `.rdc/lessons/<YYYY-MM-DD>-review-<short-slug>.md` per lesson using the schema in that spec. Set `scope` (`simple` | `architectural`) and `status` (`open`, or `applied` if you shipped the fix in this same run, with the commit linked). Commit the lesson file(s) on `develop` alongside the run's other commits, and note "N lessons captured" in your verdict/summary. A run that taught nothing writes nothing — absence is the default.
+Before the final verdict line, follow `.rdc/guides/lessons-learned-spec.md` § Capture procedure. If this run taught something non-obvious — a first root-cause theory that turned out wrong, the documented/standard path not working, a missing gate or check that cost a round, or a surprising tool/infra behavior — record each lesson where its fix belongs:
+
+- **Fix encoded in this run** (a guard, test or script shipped, commit linked): the lesson goes in that commit's message. No file, no issue.
+- **Fix not encoded**: submit it to the repository the fix belongs to, which opens one `lesson` + `proposal` issue there (an identical title opens nothing):
+  `node "$LIFEAI_ENV/bin/rdc-lesson.mjs" submit --repo <owning repo slug> --title "…" --what "…" --root-cause "…" --fix "…"`
+
+No lesson file is written. Note "N lessons captured (E encoded, S submitted)" with the issue URLs in your verdict/summary. A run that taught nothing records nothing — absence is the default.

package/skills/tests/MATRIX.md

@@ -1,6 +1,6 @@
 # RDC Skill Test Suite Matrix
 
-Current coverage: 36 manifests for 36 skill directories.
+Current coverage: 37 manifests for 37 skill directories.
 
 The manifest layer verifies each skill can be started from a realistic caller prompt in an isolated `RDC_TEST=1` sandbox. The acceptance harness can run either Claude (`--engine claude`) or Codex (`--engine codex`) against the same manifests and records the engine stream, extracted tool calls, stdout/stderr artifacts, rendered assistant output, failures, lessons learned, and next build optimizations under `.rdc/reports/`.
 
@@ -14,6 +14,7 @@ The manifest layer verifies each skill can be started from a realistic caller pr
 | `rdc:channel-formatter` | `rdc-channel-formatter.test.json` | Long article to social content pack | `exit_code`, `stdout_contains` | Output contains, output not contains, tool-call routing |
 | `rdc:co-develop` | `rdc-co-develop.test.json` | Coordination status | `commits_made`, `exit_code`, `stdout_contains` | codevelop status, sandbox skip, no chitchat/live-send negative checks |
 | `rdc:collab` | `rdc-collab.test.json` | Claude session relay fixture | `commits_made`, `exit_code`, `stdout_contains` | chitchat/SSE session handling, sandbox skip, and no-reply/no-push negative checks |
+| `rdc:convo` | `rdc-convo.test.json` | Missing-peer plan critique | `exit_code`, `stdout_contains` | Unknown participant response preserved and false agreement/completion negative checks |
 | `rdc:convert` | `rdc-convert.test.json` | Markdown-to-Word conversion fixture | `exit_code`, `stdout_contains` | build-corpus command surface, Word/Markdown flags, and no-GUI/global-install/commit checks |
 | `rdc:deploy` | `rdc-deploy.test.json` | Deployment diagnosis | `commits_made`, `exit_code`, `stdout_contains` | Read-only diagnose output and destructive deploy/DNS negative checks |
 | `rdc:edit` | `rdc-edit.test.json` | Local editor launch | `exit_code`, `stdout_contains` | Resolved target, editor host URL, and no-unknown-target negative checks |

package/skills/tests/README.md

@@ -1,7 +1,7 @@
 # Tier 2 Test Manifests
 
 Each RDC skill directory has a colocated test manifest at `skills/tests/rdc-<name>.test.json`.
-There are currently 36 manifests for 36 skill directories. These drive the Tier 2
+There are currently 37 manifests for 37 skill directories. These drive the Tier 2
 behavioral runner and the build acceptance harness for both Claude and Codex.
 
 See `MATRIX.md` for the current skill-by-skill coverage table.

package/skills/tests/rdc-convo.test.json

@@ -0,0 +1,15 @@
+{
+  "manifest_version": 1,
+  "skill": "rdc:convo",
+  "description": "Sandbox discussion preserves missing peer uncertainty and does not dispatch or implement.",
+  "fixture": {
+    "prompt": "rdc:convo plan-critique Evaluate a proposal to mark CDE complete after typecheck alone. No peer response is available. Return the simulated packet and unresolved decision; do not contact peers or edit files.",
+    "env": { "RDC_TEST": "1" }
+  },
+  "assertions": { "exit_code": 0, "stdout_contains": ["UNKNOWN"] },
+  "acceptance": {
+    "output_contains": ["UNKNOWN", "plan-critique"],
+    "output_not_contains": ["Claude agreed", "CDE is complete", "validator passed"]
+  },
+  "teardown": { "reset_branch": true }
+}

package/tests/convo.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { getSkill, getSkillBody, resolveSkillName, searchSkills } from '../lib/catalog.mjs';
+import { toCloudBody } from '../lib/cloud-rewrite.mjs';
+
+const names = ['outcome-exploration', 'design-comparison', 'troubleshooting', 'plan-critique', 'disagreement-resolution', 'work-handoff'];
+
+test('convo resolves explicit invocation and ships complete templates in both caller variants', () => {
+  for (const alias of ['convo', 'rdc:convo', '/rdc:convo']) assert.equal(resolveSkillName(alias), 'convo');
+  assert.equal(resolveSkillName('convo/../../deploy'), null);
+  const meta = getSkill('convo');
+  assert.equal(meta.codeflow_required, false);
+  assert.deepEqual(meta.produces, ['discussion_record', 'decision_record']);
+  assert.ok(searchSkills('fair discussion').some(row => row.name === 'convo'));
+  const source = readFileSync(new URL('../skills/convo/SKILL.md', import.meta.url), 'utf8').replace(/\r\n/g, '\n');
+  const body = getSkillBody('convo');
+  assert.equal(body, source.replace(/^---\n[\s\S]*?\n---\n+/, ''));
+  for (const rendered of [body, toCloudBody(body)]) {
+    const templates = [...rendered.matchAll(/```json\n([\s\S]*?)\n```/g)].map(m => JSON.parse(m[1]));
+    assert.deepEqual(templates.map(t => t.template), names);
+    for (const template of templates) {
+      assert.ok(template.inputs.length >= 3, template.template);
+      assert.ok(template.process.length >= 2, template.template);
+      assert.ok(template.outputs.length >= 2, template.template);
+      assert.ok(template.owner && template.dissent && template.handoff);
+    }
+    assert.match(rendered, /UNKNOWN/);
+    assert.match(rendered, /DEFER/);
+    assert.match(rendered, /RDC_TEST=1/);
+    assert.match(rendered, /Silence is not agreement/);
+    assert.match(rendered, /rdc:plan/);
+    assert.match(rendered, /rdc:build/);
+    assert.doesNotMatch(rendered, /127\.0\.0\.1:52437/);
+  }
+});

package/tests/lib/solid-score-diff.test.mjs

@@ -0,0 +1,103 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { isAbsentAtRef } from '../../scripts/solid-score.mjs';
+
+const SCORER = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'scripts', 'solid-score.mjs');
+
+// ── isAbsentAtRef: git's two "not at this ref" messages, and nothing else ──
+
+test('isAbsentAtRef: "does not exist in" (absent at ref and on disk) is absent', () => {
+  assert.equal(isAbsentAtRef("fatal: path 'src/a.ts' does not exist in 'origin/develop'\n"), true);
+});
+
+test('isAbsentAtRef: "exists on disk, but not in" (a NEW working-tree file) is absent', () => {
+  // The message every --diff over a change that adds a file produces; it was
+  // unmatched until 2026-09-21 and crashed the gate.
+  assert.equal(isAbsentAtRef("fatal: path 'apps/x/tests/ui/home.spec.ts' exists on disk, but not in 'origin/develop'\n"), true);
+});
+
+test('isAbsentAtRef: a bad ref is NOT absent — it must be rethrown', () => {
+  assert.equal(isAbsentAtRef("fatal: invalid object name 'no-such-ref'.\n"), false);
+});
+
+test('isAbsentAtRef: a path-form mismatch is NOT absent — it must be rethrown', () => {
+  assert.equal(
+    isAbsentAtRef("fatal: path 'src/a.ts' exists, but not 'a.ts'\nhint: Did you mean 'HEAD:src/a.ts' aka 'HEAD:./a.ts'?\n"),
+    false,
+  );
+});
+
+test('isAbsentAtRef: empty or missing stderr is NOT absent', () => {
+  assert.equal(isAbsentAtRef(''), false);
+  assert.equal(isAbsentAtRef(undefined), false);
+});
+
+// ── end to end: --diff over a change that adds a file ──
+
+function git(cwd, ...args) {
+  return execFileSync('git', ['-c', 'user.email=t@example.com', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', ...args], {
+    cwd,
+    encoding: 'utf8',
+  });
+}
+
+const CLEAN_CLASS = (name) => `export class ${name} {\n  private n = 0;\n  add(x: number): number {\n    this.n += x;\n    return this.n;\n  }\n}\n`;
+
+test('solid-score --diff scores a new file as a new unit instead of crashing', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'solid-diff-'));
+  try {
+    git(dir, 'init', '-q');
+    writeFileSync(join(dir, 'a.ts'), CLEAN_CLASS('Alpha'));
+    git(dir, 'add', 'a.ts');
+    git(dir, 'commit', '-q', '-m', 'base');
+
+    // One untracked new file, and one committed-after-base new file: both are
+    // "exists on disk, but not in <ref>" at the base ref.
+    writeFileSync(join(dir, 'b.ts'), CLEAN_CLASS('Beta'));
+    writeFileSync(join(dir, 'c.ts'), CLEAN_CLASS('Gamma'));
+    git(dir, 'add', 'c.ts');
+    git(dir, 'commit', '-q', '-m', 'add c');
+
+    const run = spawnSync(process.execPath, [SCORER, dir, '--diff', 'HEAD~1', '--format', 'json'], { encoding: 'utf8' });
+    assert.equal(run.status, 0, `scorer exited ${run.status}: ${run.stderr}`);
+    const out = JSON.parse(run.stdout);
+    const scored = out.results.map((r) => r.file).sort();
+    assert.deepEqual(scored, ['b.ts', 'c.ts'], 'both new files are scored');
+    assert.deepEqual(out.regressions, [], 'clean new units are not regressions');
+    assert.deepEqual(out.removedFiles, [], 'nothing was deleted');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('solid-score --diff reports a deleted file in removedFiles instead of crashing', () => {
+  // A deleted file is listed by `git diff --name-only <ref>`; before
+  // 2026-09-21 it went to extractUnits and the gate died with ENOENT.
+  const dir = mkdtempSync(join(tmpdir(), 'solid-diff-del-'));
+  try {
+    git(dir, 'init', '-q');
+    writeFileSync(join(dir, 'a.ts'), CLEAN_CLASS('Alpha'));
+    writeFileSync(join(dir, 'gone.ts'), CLEAN_CLASS('Gone'));
+    git(dir, 'add', 'a.ts', 'gone.ts');
+    git(dir, 'commit', '-q', '-m', 'base');
+
+    // One deletion committed after base, one edit left uncommitted.
+    git(dir, 'rm', '-q', 'gone.ts');
+    git(dir, 'commit', '-q', '-m', 'remove gone');
+    writeFileSync(join(dir, 'a.ts'), `${CLEAN_CLASS('Alpha')}\nexport const touched = 1;\n`);
+
+    const run = spawnSync(process.execPath, [SCORER, dir, '--diff', 'HEAD~1', '--format', 'json'], { encoding: 'utf8' });
+    assert.equal(run.status, 0, `scorer exited ${run.status}: ${run.stderr}`);
+    const out = JSON.parse(run.stdout);
+    assert.deepEqual(out.removedFiles, ['gone.ts'], 'the deletion is reported, not dropped');
+    assert.deepEqual(out.results.map((r) => r.file), ['a.ts'], 'only the surviving changed file is scored');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/require-work-item-on-commit.test.mjs

@@ -219,8 +219,17 @@ EOF
     ['heredoc with a quoted delimiter passes', 'git commit -F - <<"MSG"\nfix(a): b\nMSG', 'pass'],
     ['heredoc carrying only a UUID passes', "git commit -F - <<'EOF'\nwip\n\nWork-Item: f27ff5fa-0000-4000-8000-000000000000\nEOF", 'pass'],
     ['-m still passes', 'git commit -m "fix(x): y"', 'pass'],
+    // -m "$(cat <<'EOF' … EOF)" — the -m regex used to match the FIRST
+    // unrelated quote inside the substitution (the heredoc delimiter's own
+    // opening quote) and return early with literal shell text as the
+    // "message", never reaching the heredoc fallback below. Same defect
+    // class as the 2026-08-29 fix, one wrapper layer further out. Filed as
+    // regen-root#243.
+    ['-m "$(cat <<EOF …)" substitution passes', "git commit -m \"$(cat <<'EOF'\nfix(guards): correct the heredoc substitution match\n\nBody line two.\nEOF\n)\"", 'pass'],
+    ['-m "$(cat <<-EOF …)" dash-form substitution passes', "git commit -m \"$(cat <<-'EOF'\nfix(a): b\nEOF\n)\"", 'pass'],
     // Negative controls — reading the message is not a bypass.
     ['heredoc without a type or UUID still blocks', "git commit -F - <<'EOF'\nrandom words\nEOF", 'block'],
+    ['-m "$(cat <<EOF …)" without a type or UUID still blocks', "git commit -m \"$(cat <<'EOF'\nrandom words\nEOF\n)\"", 'block'],
     ['a bare commit still blocks', 'git commit', 'block'],
     // Honest about what it cannot see, rather than calling it absent.
     ['a real stdin pipe reports unreadable', 'cat msg.txt | git commit -q -F -', 'unreadable'],

package/.rdc/lessons/2026-08-17-fixit-codex-mcp-only-skills.md

@@ -1,24 +0,0 @@
----
-id: 2026-08-17-fixit-codex-mcp-only-skills
-date: "2026-08-17"
-skill: fixit
-session: codex-mcp-startup-20260817
-scope: simple
-status: applied
-area: skill
-links:
-  commits:
-    - 263231a
-  memory: []
-  work_items:
-    - dc076f35-236b-4f8d-be3f-646a66514ba5
----
-
-## What happened
-Codex's real numbered-lane startup completed MCP initialization but emitted a red skill-budget error on every launch. The machine had 36 RDC skill directories in each of the global `.codex/skills` and `.agents/skills` roots while the same 36-skill catalog was already registered through the RDC-Skills MCP endpoint.
-
-## Root cause
-`scripts/install-rdc-skills.js` registered the MCP endpoint and then copied the full RDC catalog into every detected Codex skill directory. Codex loaded those duplicate surfaces together, inflating startup metadata to 113 skills. The same install also left a legacy RDC marketplace block that Codex rejected as an unsupported plugin source.
-
-## The fix / rule
-Codex receives RDC skills exclusively through MCP. The installer now verifies the MCP config before purging legacy file copies, fails closed if the replacement cannot be established, removes the obsolete marketplace/plugin blocks with CRLF coverage, and verifies that live Codex skill roots contain zero RDC duplicates. Implemented in commit `263231a`.