@lifeaitools/rdc-skills 0.36.1 → 0.37.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.36.1",
+  "version": "0.37.0",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## v0.37.0 — review gates run the deterministic validators, in 1–2 minutes
+
+### Changed
+- The code-review step in `rdc:build` (9b), `rdc:fixit` (5.5), `rdc:review`
+  (8b), `rdc:release` and `rdc:overnight` now runs one deterministic gate,
+  `guides/review-gate.md`:
+  - `rdc-solid-score --diff <base>`;
+  - the repo linter on changed files (`--write`, then check);
+  - `tsc`;
+  - the touched package's tests;
+  - the UI spec when a route changed.
+
+  On the PRT launch build it took 9.3 s over 33 changed code files, where each
+  open-ended `pr-review-toolkit:code-reviewer` pass had taken 4–10 minutes. The
+  reviewer agent remains, but only for a named question the validators cannot
+  answer.
+- `rdc-clean-code-score` is documented as advisory. It has no `--diff`, and in a
+  monorepo it needs `--project-root <package>`; its default dead-export scope ran
+  out of 4 GB of heap on regen-root.
+
+### Fixed
+- `rdc-solid-score --diff` exited 2 on any diff that added a file. Git's
+  "exists on disk, but not in <ref>" wording was not recognized as absent at the
+  ref; it now is. A bad ref or a path-form mismatch is still rethrown.
+- `rdc-solid-score --diff` exited 2 with ENOENT on any diff that deleted a file.
+  Deletions are now split out with `--diff-filter=D` and reported in a new
+  `removedFiles` output field.
+- The README File Structure omitted `convo` (shipped in 0.36.0), which failed
+  `npm run test:acceptance`.
+
+---
+
 ## v0.35.11 — Design Review is explicit opt-in
 
 ### Changed

package/README.md

@@ -321,6 +321,7 @@ skills/
   co-develop/SKILL.md  (peer-aware Claude/Codex co-development)
   collab/SKILL.md      (bidirectional claude.ai ↔ Claude Code relay)
   convert/SKILL.md     (Office/Markdown conversion)
+  convo/SKILL.md       (attributed discussion that converges to a decision)
   deploy/SKILL.md      (Coolify ops: deploy, new, diagnose, audit)
   design/SKILL.md      (RDC/Studio design, Palette Library, Rampa CLI)
   edit/SKILL.md        (local website editor launcher)

package/commands/compare-compliance.md

@@ -8,4 +8,8 @@ description: rdc:compare-compliance <path> --diff <ref> — gate a change agains
 Use Skill tool with skill: "solid-validator", passing the path and a
 required `--diff <ref>` as args. Read `regressions` and `boundaryViolations`
 from the output — either non-empty means the change made compliance worse
-than the base ref, not merely "still imperfect."
+than the base ref, not merely "still imperfect." `removedFiles` lists what the
+change deleted; those are reported, never scored.
+
+This is step 1 of the review gate. For the whole gate (lint, tsc, tests and UI
+spec as well), follow `guides/review-gate.md`.

package/commands/quick-check.md

@@ -7,4 +7,6 @@ description: rdc:quick-check <path> — fast mechanical pass, SOLID score and bo
 
 Use Skill tool with skill: "solid-validator", passing the path as args.
 This is the mechanical-only subset — no judgment dispatch, meant to run in
-seconds during active editing. Use `full-analysis` before a merge.
+seconds during active editing. Before a merge, run the review gate in
+`guides/review-gate.md`, which takes one to two minutes. `full-analysis` is a
+deeper advisory pass, not the merge gate.

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "a5325ff86c953a4f64b3deef96551975d530f528"
+  "sha": "15c0b76b2fa48b6ab335478041940337a84da588"
 }

package/guides/review-gate.md

@@ -0,0 +1,133 @@
+# Review Gate — deterministic validators on the diff
+
+> The code-review gate used by `rdc:build` (step 9b), `rdc:fixit` (5.5),
+> `rdc:review` (8b), `rdc:release` and `rdc:overnight`. It runs the specific
+> validators over the changed files and finishes in one to two minutes.
+>
+> Approved: direct operator instruction — "we need to tune our code reviews to
+> be specific -- if you ran the validator for solid and lint etc... it should
+> take 1-2 minutes". 2026-09-21, Dave, in session.
+
+## Why this replaced the open-ended reviewer
+
+The previous default dispatched one `pr-review-toolkit:code-reviewer` agent to
+read the whole diff. On the PRT launch build (2026-09-21) four such passes took
+4 to 10 minutes and roughly 200–300k tokens each. Each one was a new judgment
+call, so two runs could not be compared.
+
+The gate below took **9.3 seconds** over the same build's 33 changed code files.
+It found two things that had shipped:
+
+- a SOLID regression: `investors/page.tsx` went from 96.3 to 85, on OCP;
+- 45 lint diagnostics in 14 touched files. Most were import order. Three were
+  accessibility defects: two buttons with no `type`, and an SVG with no title.
+
+A number that two runs agree on can block a merge. An opinion cannot.
+
+## The gate
+
+Run every step and report every result. A red step does not stop the others,
+because the reader needs the whole picture in one pass.
+
+```bash
+BASE=<ref the change is measured against>     # wave base sha, origin/develop, last release tag
+SCOPE=<package or app dir the change touches> # never the monorepo root
+CHANGED=$(git diff --name-only --diff-filter=d "$BASE" -- "$SCOPE" | grep -E '\.(ts|tsx|js|jsx|mjs|cjs)$')
+```
+
+| # | Check | Command | Blocks when |
+|---|---|---|---|
+| 1 | **FORM**: SOLID and boundaries | `rdc-solid-score "$SCOPE" --diff "$BASE" --format json` (add `--config <repo>/.solid-score.yml` if the repo has one) | `regressions`, `boundaryViolations` or `boundaryMisconfigured` is non-empty |
+| 2 | **LINT**: changed files only | the repo's own linter; fix first, then check: `npx biome check --write $CHANGED` then `npx biome check $CHANGED` (ESLint: `npx eslint --fix` then `npx eslint`) | the second command exits non-zero |
+| 3 | **TYPES** | `npx tsc --noEmit -p <package>/tsconfig.json`, once per touched package | exit non-zero |
+| 4 | **TESTS**, scoped | the touched package's own test command, e.g. `pnpm --filter <pkg> exec vitest run` | any failure |
+| 5 | **RENDERED UI**, if a route changed | the project's pinned `test:ui` Playwright spec against a fresh app-owned server (`rdc:review` step 9a) | any red assertion, or no harness |
+
+Read the scorer output fully:
+
+- `removedFiles` lists deletions. They are reported, not scored: a deleted file has no units left that can regress.
+- `unresolvedLanguages` lists files no plugin parses, such as `.css`. They are unmeasured, never passed.
+
+### Rules that keep it honest
+
+- **Lint is fixed, never baselined.** Diagnostics already in a touched file
+  are fixed in the same change. Run `--write` first, and most of them clear
+  mechanically. Do not add an ignore list or a count ratchet.
+- **SOLID is a ratchet by design.** `--diff` compares each unit with itself at
+  `$BASE`. OCP and LSP report `low` confidence, and that confidence is data. A
+  regression still blocks. The usual fix for an OCP drop is to move the
+  branching into a named module; for `investors/page.tsx` that means taking the
+  data read and FAQ shaping out into a loader.
+- **Stay inside the time budget by narrowing scope.** Changed files and touched
+  packages only. If the gate takes more than two minutes, it is scanning too
+  wide. Narrow `$SCOPE` rather than dropping a step.
+- **Never edit what a gate measures to turn it green.** A red check is either
+  fixed properly or reported as a finding.
+
+### New UI tests: prove them before trusting them
+
+Three lessons from the same build:
+
+- **Negative-control every new UI assertion.** Run it once against the broken
+  or old state and watch it go red. A test that has never failed has not
+  proved anything. The CTA-clipping spec was trusted only after it failed on
+  the old CSS.
+- **Measure settled layout.** Take bounding boxes after motion finishes, using
+  reduced motion or waiting for the animation to end. A panel measured
+  mid-slide reports the wrong size.
+- **Include a 1280×800 viewport.** A laptop screen is where a tall panel
+  clips its call-to-action. 1440 and 390 alone missed it.
+
+## When an LLM reviewer is still right
+
+Only for a **named question the validators cannot answer**, scoped to the
+files that question touches. Examples:
+
+- "Does this middleware bypass skip auth on any protected path?"
+- "Does any public string state a return figure?"
+
+```
+Agent({
+  subagent_type: "pr-review-toolkit:code-reviewer",
+  description: "<the question, in five words>",
+  prompt: "Answer one question about <files>: <question>. Read only those files.
+           Return CODE_REVIEW_COMPLETE with { critical_count, high_count, medium_count,
+           low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
+})
+```
+
+A reviewer asked to "review the diff" with no question is the pattern this
+guide retired. Critical and high findings from a named-question pass block, the
+same as a red gate step.
+
+## What is not in the default gate
+
+| Tool | Why it is not in the default gate | When to run it |
+|---|---|---|
+| `rdc-clean-code-score` | No `--diff`, so it reports absolute counts. On the PRT build it reported 475 findings in 17 files, 459 of them N4 "magic number" on SVG coordinates. Its default dead-export scope is the whole git repo, which ran out of 4 GB of heap on regen-root. | Advisory, in `rdc:full-analysis`. Always pass `--project-root <package dir>`; that run took 7.9 s. |
+| `rdc-architecture-score` | No `--diff`. With no `layers:` config, every file is `unclassified`, so it measures nothing. | When the repo declares layers. |
+| `rdc-duplication-score` | Absolute, not a delta. | Advisory. |
+
+## Review is not closure
+
+The gate replaces the per-wave LLM code review. It does **not** replace the
+validator.
+
+A non-epic work item still reaches `done` only through
+`update_work_item_status(..., 'done', ..., <validator session>, 'validator')`,
+and the database refuses an actor session equal to the item's own. A forked
+agent shares its parent's session id, so a fork cannot validate the parent's
+item. Dispatch a fresh agent for that.
+
+## Receipt
+
+Emit this line. The skill that ran the gate quotes it in the implementation
+report or review report:
+
+```
+REVIEW_GATE: { base, scope, files, solid: { regressions, boundaryViolations, removedFiles, unresolved },
+               lint: <exit>, tsc: <exit>, tests: "<N passed>", ui: "<spec + viewports> | n/a",
+               elapsed_s, verdict: "CLEAN|HAS_ISSUES" }
+```
+
+Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and continue.

package/hooks/require-work-item-on-commit.js

@@ -156,6 +156,17 @@ function isGitCommit(command) {
 function extractCommitMessage(command) {
   const cmd = String(command || '');
 
+  // `-m "$(cat <<'EOF' … EOF)"` / `-m "$(cat <<-'EOF' … EOF)"`: the plain -m
+  // regexes below match the FIRST unrelated quote inside the substitution
+  // (the opening `'` of `<<'EOF'` reads as a closing delimiter to the
+  // non-greedy pattern) and return early with literal shell text as the
+  // "message" -- before the heredoc fallback ever runs. This is the same
+  // defect class the 2026-08-29 fix addressed for a bare heredoc, just one
+  // wrapper layer further out: detect the substitution shape first and
+  // extract from its OWN heredoc body.
+  const mSub = cmd.match(/-m\s+"\$\(\s*cat\s+<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1\s*\n([\s\S]*?)\n[ \t]*\2\s*\)"/);
+  if (mSub) return { message: mSub[3], readable: true };
+
   const msgMatch = cmd.match(/-m\s+["']([^"']+)["']/s) ||
                    cmd.match(/-m\s+"([\s\S]+?)"\s*(?:&&|$)/);
   if (msgMatch) return { message: msgMatch[1], readable: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.36.1",
+  "version": "0.37.0",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/scripts/solid-score.mjs

@@ -141,6 +141,23 @@ function walk(dir, exclude, out = []) {
   return out;
 }
 
+/**
+ * Does this `git show <ref>:<path>` stderr mean "the file is not at <ref>"?
+ *
+ * Git words it two ways, and the common one was missing until 2026-09-21:
+ *   - `fatal: path 'p' does not exist in 'ref'`        — absent at ref AND on disk
+ *   - `fatal: path 'p' exists on disk, but not in 'ref'` — a NEW file in the
+ *     working tree, i.e. every `--diff` over a change that adds a file
+ * Matching only the first made `--diff` crash on any diff with a new file.
+ * Anything else (a bad ref, a path-form mismatch) is not "absent" and must be
+ * rethrown, so a real error never passes silently as a new unit.
+ */
+export function isAbsentAtRef(stderr) {
+  const msg = String(stderr ?? '');
+  if (!msg.includes('fatal: path')) return false;
+  return msg.includes('does not exist in') || msg.includes('exists on disk, but not in');
+}
+
 /** Score a file's text as it existed at a given git ref, without touching the working tree. */
 function scoreAtRef(repoRoot, filePath, ref, weights) {
   const relPath = relative(repoRoot, filePath).split('\\').join('/');
@@ -151,10 +168,9 @@ function scoreAtRef(repoRoot, filePath, ref, weights) {
     // `git show` fails both when the file is genuinely new at `ref` AND for
     // unrelated reasons (a path-form mismatch, a bad ref). Collapsing both
     // into "it's new" hides the second case — the exact class of silent
-    // path-form bug found three times in this file already tonight. Only a
-    // "does not exist" message is treated as new; anything else is rethrown.
-    const msg = String(err.stderr ?? err.message ?? '');
-    if (msg.includes('does not exist in') || msg.includes('fatal: path') && msg.includes('does not exist')) return null;
+    // path-form bug found three times in this file already. Only git's two
+    // "not at this ref" messages are treated as new; anything else is rethrown.
+    if (isAbsentAtRef(err.stderr ?? err.message)) return null;
     throw err;
   }
   const plugin = pluginFor(filePath);
@@ -237,6 +253,7 @@ async function main() {
   }
 
   let files;
+  let removedFiles = [];
   if (diffRef) {
     // `git diff --name-only <ref> -- <path>` (no `...HEAD`) compares `<ref>`
     // directly against the WORKING TREE — committed history AND uncommitted
@@ -244,8 +261,16 @@ async function main() {
     // diff` form, so they're unioned in separately. Before this fix, only
     // `<ref>...HEAD` (committed history alone) was scored — a dirty tree
     // with real regressions scored zero files and exited 0.
-    const committed = execFileSync('git', ['diff', '--name-only', diffRef, '--', targetPath], { cwd: repoRoot, encoding: 'utf8' })
+    //
+    // Deleted paths are split out by git's own account (`--diff-filter=D`),
+    // not by an existsSync guess, so a path-form bug can never pass as a
+    // deletion. A deleted file has no current units and so nothing that can
+    // regress; before 2026-09-21 it reached extractUnits and crashed the gate
+    // with ENOENT. It is reported in `removedFiles`, never dropped silently.
+    const nameOnly = (filter) => execFileSync('git', ['diff', '--name-only', `--diff-filter=${filter}`, diffRef, '--', targetPath], { cwd: repoRoot, encoding: 'utf8' })
       .split('\n').filter(Boolean);
+    const committed = nameOnly('d');
+    removedFiles = nameOnly('D');
     const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard', '--', targetPath], { cwd: repoRoot, encoding: 'utf8' })
       .split('\n').filter(Boolean);
     files = [...new Set([...committed, ...untracked])]
@@ -285,7 +310,7 @@ async function main() {
   const boundaryViolations = boundaryFindings.filter((f) => !f.satisfied);
 
   const output = {
-    results, regressions, boundaryFindings, boundaryViolations, boundaryMisconfigured, unresolvedLanguages,
+    results, regressions, removedFiles, boundaryFindings, boundaryViolations, boundaryMisconfigured, unresolvedLanguages,
     config: { weights: config.weights, diff: config.diff, boundaryRuleCount: (config.boundaries ?? []).length },
     configPath, configLoaded,
     parser: parserName,
@@ -312,6 +337,10 @@ async function main() {
       console.log('\nREGRESSIONS:');
       for (const r of regressions) console.log(`  ${r.file} :: ${r.unit} — ${r.reason} ${JSON.stringify(r)}`);
     }
+    if (removedFiles.length) {
+      console.log(`\n${removedFiles.length} file(s) deleted since ${diffRef} — no units left to score:`);
+      for (const f of removedFiles) console.log(`  ${f}`);
+    }
     if (unresolvedLanguages.length) {
       console.log(`\n${unresolvedLanguages.length} file(s) matched no registered language plugin — skipped, not silently passed:`);
       for (const f of unresolvedLanguages) console.log(`  ${relative(repoRoot, f)}`);

package/skills/build/SKILL.md

@@ -644,27 +644,30 @@ Read the task title and description, then:
 
     ⛔ **NO wave may dispatch until the previous wave's code-review pass clears.** Memory `feedback_code_review_per_wave.md` — Davesend 2026-05-24 incident.
 
-    Dispatch ONE `pr-review-toolkit:code-reviewer` agent with the wave's merged diff:
-
-    ```
-    Agent({
-      subagent_type: "pr-review-toolkit:code-reviewer",
-      description: "Wave <N> code review",
-      prompt: "Review the diff `git diff <wave-base-sha>..HEAD` on develop.
-               Focus on: bugs, logic errors, security vulnerabilities, project-convention adherence
-               (.claude/rules/*, CLAUDE.md). Apply confidence-based filtering — high-confidence
-               findings only. Report severity per finding: critical | high | medium | low.
-               Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
-               low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
-    })
-    ```
-
-    **Severity gate (default — high+ blocks):**
-    - `critical` or `high` findings → reopen affected work items to `todo` with finding text in notes; fix in a new wave before continuing
-    - `medium` or `low` findings → append to each work item's `implementation_report.flags`; do NOT reopen; validator sees them
-    - Zero findings → log `CODE_REVIEW: CLEAN` and proceed to next wave
-
-    Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and proceed.
+    Run the deterministic review gate in `guides/review-gate.md` over the wave's
+    merged diff, with `BASE=<wave-base-sha>` and `SCOPE` set to each package or
+    app the wave touched. That covers `rdc-solid-score --diff`, the repo linter on
+    changed files, `tsc`, scoped tests, and the UI spec when a route changed. It
+    takes one to two minutes; an open-ended reviewer agent took 4–10.
+    Approved: direct operator instruction — "we need to tune our code reviews to be
+    specific -- if you ran the validator for solid and lint etc... it should take 1-2
+    minutes". 2026-09-21, Dave, in session.
+
+    Dispatch `pr-review-toolkit:code-reviewer` only for a **named question** the
+    validators cannot answer, scoped to the files it touches (the guide's
+    "When an LLM reviewer is still right" section). Never dispatch it with a bare
+    "review the diff".
+
+    **Gate outcome:**
+    - A red gate step, or a critical/high finding from a named-question pass →
+      reopen the affected work items to `todo` with the `REVIEW_GATE` receipt and
+      the failing output in notes. Fix in a new wave before continuing.
+    - Medium/low findings from a named-question pass → append them to each work
+      item's `implementation_report.flags`. Do not reopen; the validator sees them.
+    - All steps green → log the `REVIEW_GATE` receipt with `verdict: "CLEAN"` and
+      proceed to the next wave.
+
+    Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and proceed.
 
 10. **Mandatory validator gate (runs after ALL waves complete — before any work item closes):**
 

package/skills/clean-code-analyzer/SKILL.md

@@ -65,6 +65,12 @@ matches the numeric-suffix heuristic) alongside real hits (`data`, `temp`,
    `bin.rdc-clean-code-score`; falls back to
    `node <rdc-skills-install-path>/scripts/clean-code-score.mjs`.)
 
+   **In a monorepo, always pass `--project-root <package or app dir>`.** Without
+   it, the dead-export scan walks the whole git repo. On regen-root that ran out
+   of 4 GB of heap after 18 s (exit 134); scoped to `apps/prtrust` it took 7.9 s.
+   This scorer has no `--diff` and reports absolute counts, so it is advisory,
+   not part of the merge gate (`guides/review-gate.md`).
+
 2. **Read `results`** — per-unit findings for N1 (cryptic names), N2 (heuristic
    meaningless-distinction names, low confidence), N4 (magic numbers), N7
    (generic class/function names), F1 (>20 statements), F2 (>3 params), E1

package/skills/fixit/SKILL.md

@@ -111,26 +111,27 @@ fi
 
 ⛔ **No fixit closes without a code-review pass.** Even single-file changes go through review.
 
-Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the fixit commit:
-
-```
-Agent({
-  subagent_type: "pr-review-toolkit:code-reviewer",
-  description: "fixit code review",
-  prompt: "Review `git show HEAD` on the development branch. Focus on:
-           bugs, logic errors, security, project-convention adherence (.claude/rules/*).
-           Confidence-based filtering — high-confidence findings only.
-           Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
-           low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
-})
-```
-
-**Severity gate:**
-- `critical` or `high` findings → fix in this same fixit session (do not escalate to rdc:build for the fix itself; the original fixit owns the cleanup), re-commit, re-run review until clean
-- `medium` or `low` findings → record in `implementation_report.flags`; proceed to close
-- Zero findings → proceed to close
-
-Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and proceed.
+Run the deterministic review gate in `guides/review-gate.md` with
+`BASE=HEAD~1` (or the commit before the fixit's first commit) and `SCOPE` set
+to the touched package. For a fixit this usually takes seconds.
+Approved: direct operator instruction — "we need to tune our code reviews to be
+specific -- if you ran the validator for solid and lint etc... it should take 1-2
+minutes". 2026-09-21, Dave, in session.
+
+Dispatch `pr-review-toolkit:code-reviewer` only for a **named question** the
+validators cannot answer, scoped to the files it touches. Never dispatch it with
+a bare "review the commit".
+
+**Gate outcome:**
+- A red gate step, or a critical/high finding from a named-question pass → fix
+  it in this same fixit session. Do not escalate the fix to rdc:build; the
+  original fixit owns the cleanup. Re-commit and re-run the gate until it is clean.
+- Medium/low findings from a named-question pass → record them in
+  `implementation_report.flags` and proceed to close.
+- All steps green → quote the `REVIEW_GATE` receipt in the implementation report
+  and proceed to close.
+
+Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and proceed.
 
 ### 5.7 Deliver to done (MANDATORY — a fixit is not done until the change is LIVE)
 

package/skills/overnight/SKILL.md

@@ -144,7 +144,7 @@ After each wave: check `BUILD_STATUS`. If `escalated: true`, log the escalation
 in the overnight doc and continue — don't stop the loop.
 After each wave and after every resumed epic, require the `runOrchestrator()` receipt from `rdc:build` **where the orchestrator applies** — the target contains `corpus/_shared/build/phase-manifest.json` (today: regen-root; see `rdc:build` §1a). Elsewhere, require the contract checklist (`rdc-work check`) instead; an absent orchestrator is not a hold. `admission_refocus` or `pipeline_blocked` means the epic is held for an explicitly requested Design Review or validator closure; log that state and do not hand-reconstruct a dispatch wave.
 
-**Mandatory code-review gate inherited from rdc:build (Step 9b).** Every wave inside `rdc:build` runs a `pr-review-toolkit:code-reviewer` pass before the next wave dispatches. Critical/high findings reopen the affected work items to `todo` and the next wave fixes them. Overnight does not skip or weaken this gate. If a wave's code-review escalates twice, advisor decides; otherwise the loop continues.
+**Mandatory code-review gate inherited from rdc:build (Step 9b).** Every wave inside `rdc:build` runs the deterministic review gate (`guides/review-gate.md`: solid-score --diff, linter on changed files, tsc, scoped tests, UI spec) before the next wave dispatches. It takes one to two minutes, where an open-ended reviewer took 4–10, which matters most across an overnight queue. A red step reopens the affected work items to `todo` and the next wave fixes them. Overnight does not skip or weaken this gate. If a wave's gate escalates twice, the advisor decides; otherwise the loop continues.
 
 ### 3d. Review
 

package/skills/release/SKILL.md

@@ -41,7 +41,7 @@ rdc:release: <repo> vX.Y.Z -> vA.B.C
 [ ] Dry-run gate handled
 [ ] Version files updated
 [ ] Tests/self-test passed
-[ ] Mandatory release code-review (pr-review-toolkit:code-reviewer on `git diff <last-released-tag>..HEAD`). Block release on `critical`/`high` findings; record `medium`/`low` in the release notes and proceed.
+[ ] Mandatory release review gate (`guides/review-gate.md`, BASE=<last-released-tag>): solid-score --diff, linter on changed files, tsc, scoped tests. Block the release on any red step; LLM reviewer only for a named question.
 [ ] Commit created
 [ ] Tag created
 [ ] Branch and tag pushed

package/skills/review/SKILL.md

@@ -12,8 +12,9 @@ description: rdc:review () - [--unattended] — post-build gate over tsc, tests,
 > **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag.
 
 > **Standard being enforced:** `docs/CODING-STANDARDS.md` (SOLID/Clean-Architecture —
-> regen-root; skip if absent). Step 8c is where it's actually checked, via this package's
+> regen-root; skip if absent). Steps 8b and 8c check it, via this package's
 > own `rdc-solid-score` (also invoked by ATF's Test-Ladder as a consumer, not an owner).
+> Step 8b runs the deterministic review gate, `guides/review-gate.md`.
 
 
 # rdc:review — Quality Gate
@@ -84,41 +85,47 @@ description: rdc:review () - [--unattended] — post-build gate over tsc, tests,
    - Never silently leave orphaned tasks
    - **⛔ Raw `UPDATE work_items SET parent_id = ...` is forbidden** — bypasses RLS and all constraint checks
 
-8b. **Mandatory code-review gate — dispatch pr-review-toolkit:code-reviewer:**
-
-   ⛔ **No CLEAN verdict without a code-review pass.** This is the second half of the quality gate; tsc/vitest catch type and behavior errors, code-reviewer catches logic, security, and convention drift.
-
-   Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the full diff under review:
-
-   ```
-   Agent({
-     subagent_type: "pr-review-toolkit:code-reviewer",
-     description: "rdc:review code-review pass",
-     prompt: "Review `git diff origin/main...HEAD` on the development branch.
-              Focus on: bugs, logic errors, security vulnerabilities, project-convention
-              adherence (.claude/rules/*, CLAUDE.md, engineering-behavior.md).
-              Confidence-based filtering — high-confidence findings only.
-              Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
-              low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
-   })
-   ```
-
-   **Severity gate:**
-   - `critical` or `high` → verdict cannot be CLEAN. Interactive: report and pause. Unattended: auto-fix if mechanical (rename, missing await, obvious null check), otherwise escalate via advisor and mark HAS_ISSUES.
-   - `medium` or `low` → record in the review report's "Issues" section; verdict can still be CLEAN.
-   - Zero findings → log `CODE_REVIEW: CLEAN` and continue.
-
-   Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and continue.
+8b. **Mandatory code-review gate — deterministic validators on the diff:**
+
+   ⛔ **No CLEAN verdict without a review-gate pass.** Run `guides/review-gate.md`
+   over the diff under review, with `BASE` set to the review's base ref and `SCOPE`
+   set to each modified package from step 1. Its checks are
+   `rdc-solid-score --diff`, the repo linter on changed files (`--write`, then
+   check), `tsc`, scoped tests, and the UI spec for changed routes. It finishes in
+   one to two minutes and gives the same answer twice.
+   Approved: direct operator instruction — "we need to tune our code reviews to be
+   specific -- if you ran the validator for solid and lint etc... it should take 1-2
+   minutes". 2026-09-21, Dave, in session.
+
+   Dispatch `pr-review-toolkit:code-reviewer` only for a **named question** the
+   validators cannot answer, such as auth bypass on a protected path or a return
+   figure in public copy. Scope it to the files that question touches, following
+   the guide's "When an LLM reviewer is still right" section. A bare "review the
+   diff" dispatch is retired.
+
+   **Gate outcome:**
+   - A red gate step, or a critical/high finding from a named-question pass →
+     the verdict cannot be CLEAN. Interactive: report and pause. Unattended:
+     fix it if the fix is mechanical (`--write` lint fixes, a missing await, an
+     obvious null check); otherwise escalate via the advisor and mark HAS_ISSUES.
+   - Medium/low findings from a named-question pass → record them in the review
+     report's "Issues" section. The verdict can still be CLEAN.
+   - All steps green → quote the `REVIEW_GATE` receipt and continue.
+
+   Under `RDC_TEST=1`: echo `[RDC_TEST] skipping review gate` and continue.
 
 8c. **Form/fit/function gate — solid-validator + architecture-reviewer:**
 
-   ⛔ **No CLEAN verdict without this pass either.** Step 8b catches logic,
-   security, and convention drift. This step catches a different failure
-   shape entirely: code that is logically correct and convention-clean but
-   architecturally wrong — the `Harness` case (a use-case orchestrator that
-   reimplements what sibling packages exist to do, scoring fine on every
-   generic metric while failing the one check that names the actual rule).
+   ⛔ **No CLEAN verdict without this pass either.** Step 8b's lint, tsc and
+   tests catch convention drift and broken behavior. This step catches a
+   different failure shape: code that is logically correct and
+   convention-clean but architecturally wrong. The `Harness` case is the
+   example: a use-case orchestrator that reimplements what sibling packages
+   exist to do, scores fine on every generic metric, and fails the one check
+   that names the actual rule.
 
+   Reuse the `rdc-solid-score` JSON from step 8b rather than running the scorer
+   twice. If 8b ran without the repo's boundary config, re-run it with the config:
    ```bash
    rdc-solid-score <modified-package-path> --diff origin/main --config <repo>/.solid-score.yml --format json
    ```

package/tests/lib/solid-score-diff.test.mjs

@@ -0,0 +1,103 @@
+import assert from 'node:assert/strict';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { isAbsentAtRef } from '../../scripts/solid-score.mjs';
+
+const SCORER = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'scripts', 'solid-score.mjs');
+
+// ── isAbsentAtRef: git's two "not at this ref" messages, and nothing else ──
+
+test('isAbsentAtRef: "does not exist in" (absent at ref and on disk) is absent', () => {
+  assert.equal(isAbsentAtRef("fatal: path 'src/a.ts' does not exist in 'origin/develop'\n"), true);
+});
+
+test('isAbsentAtRef: "exists on disk, but not in" (a NEW working-tree file) is absent', () => {
+  // The message every --diff over a change that adds a file produces; it was
+  // unmatched until 2026-09-21 and crashed the gate.
+  assert.equal(isAbsentAtRef("fatal: path 'apps/x/tests/ui/home.spec.ts' exists on disk, but not in 'origin/develop'\n"), true);
+});
+
+test('isAbsentAtRef: a bad ref is NOT absent — it must be rethrown', () => {
+  assert.equal(isAbsentAtRef("fatal: invalid object name 'no-such-ref'.\n"), false);
+});
+
+test('isAbsentAtRef: a path-form mismatch is NOT absent — it must be rethrown', () => {
+  assert.equal(
+    isAbsentAtRef("fatal: path 'src/a.ts' exists, but not 'a.ts'\nhint: Did you mean 'HEAD:src/a.ts' aka 'HEAD:./a.ts'?\n"),
+    false,
+  );
+});
+
+test('isAbsentAtRef: empty or missing stderr is NOT absent', () => {
+  assert.equal(isAbsentAtRef(''), false);
+  assert.equal(isAbsentAtRef(undefined), false);
+});
+
+// ── end to end: --diff over a change that adds a file ──
+
+function git(cwd, ...args) {
+  return execFileSync('git', ['-c', 'user.email=t@example.com', '-c', 'user.name=t', '-c', 'commit.gpgsign=false', ...args], {
+    cwd,
+    encoding: 'utf8',
+  });
+}
+
+const CLEAN_CLASS = (name) => `export class ${name} {\n  private n = 0;\n  add(x: number): number {\n    this.n += x;\n    return this.n;\n  }\n}\n`;
+
+test('solid-score --diff scores a new file as a new unit instead of crashing', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'solid-diff-'));
+  try {
+    git(dir, 'init', '-q');
+    writeFileSync(join(dir, 'a.ts'), CLEAN_CLASS('Alpha'));
+    git(dir, 'add', 'a.ts');
+    git(dir, 'commit', '-q', '-m', 'base');
+
+    // One untracked new file, and one committed-after-base new file: both are
+    // "exists on disk, but not in <ref>" at the base ref.
+    writeFileSync(join(dir, 'b.ts'), CLEAN_CLASS('Beta'));
+    writeFileSync(join(dir, 'c.ts'), CLEAN_CLASS('Gamma'));
+    git(dir, 'add', 'c.ts');
+    git(dir, 'commit', '-q', '-m', 'add c');
+
+    const run = spawnSync(process.execPath, [SCORER, dir, '--diff', 'HEAD~1', '--format', 'json'], { encoding: 'utf8' });
+    assert.equal(run.status, 0, `scorer exited ${run.status}: ${run.stderr}`);
+    const out = JSON.parse(run.stdout);
+    const scored = out.results.map((r) => r.file).sort();
+    assert.deepEqual(scored, ['b.ts', 'c.ts'], 'both new files are scored');
+    assert.deepEqual(out.regressions, [], 'clean new units are not regressions');
+    assert.deepEqual(out.removedFiles, [], 'nothing was deleted');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('solid-score --diff reports a deleted file in removedFiles instead of crashing', () => {
+  // A deleted file is listed by `git diff --name-only <ref>`; before
+  // 2026-09-21 it went to extractUnits and the gate died with ENOENT.
+  const dir = mkdtempSync(join(tmpdir(), 'solid-diff-del-'));
+  try {
+    git(dir, 'init', '-q');
+    writeFileSync(join(dir, 'a.ts'), CLEAN_CLASS('Alpha'));
+    writeFileSync(join(dir, 'gone.ts'), CLEAN_CLASS('Gone'));
+    git(dir, 'add', 'a.ts', 'gone.ts');
+    git(dir, 'commit', '-q', '-m', 'base');
+
+    // One deletion committed after base, one edit left uncommitted.
+    git(dir, 'rm', '-q', 'gone.ts');
+    git(dir, 'commit', '-q', '-m', 'remove gone');
+    writeFileSync(join(dir, 'a.ts'), `${CLEAN_CLASS('Alpha')}\nexport const touched = 1;\n`);
+
+    const run = spawnSync(process.execPath, [SCORER, dir, '--diff', 'HEAD~1', '--format', 'json'], { encoding: 'utf8' });
+    assert.equal(run.status, 0, `scorer exited ${run.status}: ${run.stderr}`);
+    const out = JSON.parse(run.stdout);
+    assert.deepEqual(out.removedFiles, ['gone.ts'], 'the deletion is reported, not dropped');
+    assert.deepEqual(out.results.map((r) => r.file), ['a.ts'], 'only the surviving changed file is scored');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/require-work-item-on-commit.test.mjs

@@ -219,8 +219,17 @@ EOF
     ['heredoc with a quoted delimiter passes', 'git commit -F - <<"MSG"\nfix(a): b\nMSG', 'pass'],
     ['heredoc carrying only a UUID passes', "git commit -F - <<'EOF'\nwip\n\nWork-Item: f27ff5fa-0000-4000-8000-000000000000\nEOF", 'pass'],
     ['-m still passes', 'git commit -m "fix(x): y"', 'pass'],
+    // -m "$(cat <<'EOF' … EOF)" — the -m regex used to match the FIRST
+    // unrelated quote inside the substitution (the heredoc delimiter's own
+    // opening quote) and return early with literal shell text as the
+    // "message", never reaching the heredoc fallback below. Same defect
+    // class as the 2026-08-29 fix, one wrapper layer further out. Filed as
+    // regen-root#243.
+    ['-m "$(cat <<EOF …)" substitution passes', "git commit -m \"$(cat <<'EOF'\nfix(guards): correct the heredoc substitution match\n\nBody line two.\nEOF\n)\"", 'pass'],
+    ['-m "$(cat <<-EOF …)" dash-form substitution passes', "git commit -m \"$(cat <<-'EOF'\nfix(a): b\nEOF\n)\"", 'pass'],
     // Negative controls — reading the message is not a bypass.
     ['heredoc without a type or UUID still blocks', "git commit -F - <<'EOF'\nrandom words\nEOF", 'block'],
+    ['-m "$(cat <<EOF …)" without a type or UUID still blocks', "git commit -m \"$(cat <<'EOF'\nrandom words\nEOF\n)\"", 'block'],
     ['a bare commit still blocks', 'git commit', 'block'],
     // Honest about what it cannot see, rather than calling it absent.
     ['a real stdin pipe reports unreadable', 'cat msg.txt | git commit -q -F -', 'unreadable'],

package/.rdc/lessons/2026-08-17-fixit-codex-mcp-only-skills.md

@@ -1,24 +0,0 @@
----
-id: 2026-08-17-fixit-codex-mcp-only-skills
-date: "2026-08-17"
-skill: fixit
-session: codex-mcp-startup-20260817
-scope: simple
-status: applied
-area: skill
-links:
-  commits:
-    - 263231a
-  memory: []
-  work_items:
-    - dc076f35-236b-4f8d-be3f-646a66514ba5
----
-
-## What happened
-Codex's real numbered-lane startup completed MCP initialization but emitted a red skill-budget error on every launch. The machine had 36 RDC skill directories in each of the global `.codex/skills` and `.agents/skills` roots while the same 36-skill catalog was already registered through the RDC-Skills MCP endpoint.
-
-## Root cause
-`scripts/install-rdc-skills.js` registered the MCP endpoint and then copied the full RDC catalog into every detected Codex skill directory. Codex loaded those duplicate surfaces together, inflating startup metadata to 113 skills. The same install also left a legacy RDC marketplace block that Codex rejected as an unsupported plugin source.
-
-## The fix / rule
-Codex receives RDC skills exclusively through MCP. The installer now verifies the MCP config before purging legacy file copies, fails closed if the replacement cannot be established, removes the obsolete marketplace/plugin blocks with CRLF coverage, and verifies that live Codex skill roots contain zero RDC duplicates. Implemented in commit `263231a`.

package/.rdc/lessons/2026-09-17-release-mcp-registry-split.md

@@ -1,34 +0,0 @@
----
-id: 2026-09-17-release-mcp-registry-split
-date: "2026-09-17"
-skill: release
-session: 01a07b0d-e74e-7601-af20-9caae7e94b71
-scope: architectural
-status: open
-area: infra
-links:
-  commits: [d39104709bf0035f84a8001cc6c30e5c5e0d9c13]
-  memory: []
-  work_items: [5f7618b4-cf32-4460-8a3a-761f0161b847]
----
-
-## What happened
-
-rdc-skillsv0.36.0 tag triggered npm workflow35178348993: packing succeeded,
-registryPUT returned404, and npm version lookup remained404. Independently,
-the existing public MCP tag updater served0.36.0 at the exacttagSHA with45skills;
-connected convo retrieval and remote tests passed. Prior0.35.26 workflow also
-shows a PUT404 although that version is now in npm.
-
-## Root cause
-
-Two release consumers advance independently: the MCP host follows mergedtags,
-while npm requires a successful authenticatedpublish. A live MCP cannot prove
-npm distribution, nor does failednpm publication prove the MCP is stale. The
-underlying registry permission/trustedpublisher cause is not established by404.
-
-## The fix / rule
-
-Keep runtimeSHA/catalog and npmversion/provenance as distinct release evidence.
-Preserve the failedjob; inspect publisherconfiguration with the packageowner
-before changing permissions or retrying. No authboundary repair shipped here.