@lifeaitools/rdc-skills 0.37.5 → 0.37.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.37.5",
+  "version": "0.37.8",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/clauth-plugin.json

@@ -1,7 +1,7 @@
 {
   "schema": "lifeai.plugin.v1",
   "id": "rdc-skills",
-  "version": "0.37.5",
+  "version": "0.37.8",
   "publisher": "LIFEAI",
   "core": false,
   "documentation": {

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "a96832c1aa663240fecf042c6b41d7017c8bce47"
+  "sha": "b71cf17b326bf3b68432d169032107877bfceb58"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.37.5",
+  "version": "0.37.8",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -19,7 +19,7 @@
     "type": "plugin",
     "skills": "skills/",
     "guides": "guides/",
-    "version": "0.37.5",
+    "version": "0.37.8",
     "commands": "commands/"
   },
   "bin": {

package/scripts/install-rdc-skills.js

@@ -951,7 +951,7 @@ function findCodexTargets() {
   return targets;
 }
 
-function registerCodexTarget(targetDir) {
+function registerCodexTarget(targetDir, { install = false } = {}) {
   fs.mkdirSync(targetDir, { recursive: true });
 
   // Clean: remove dirs that are rdc skills — by prefix OR by frontmatter name
@@ -967,11 +967,21 @@ function registerCodexTarget(targetDir) {
     }
   }
 
-  // Do not reinstall file-based copies. Codex discovers the live catalog via
-  // [mcp_servers.rdc-skills]. Keeping the same skills in ~/.codex and ~/.agents
-  // registers every skill two or three times, exhausts Codex's skill metadata
-  // budget, and emits a red startup error on every session.
-  return { removed, copied: 0 };
+  if (!install) return { removed, copied: 0 };
+
+  // Install into exactly ONE Codex skill dir. Copies in both ~/.codex and
+  // ~/.agents registered every skill twice and exhausted Codex's skill metadata
+  // budget; bf88292 answered that by installing none, which left Codex with
+  // rdc: skills only while the remote MCP was reachable.
+  const skillsSrc = path.join(repoRoot, 'skills');
+  let copied = 0;
+  for (const entry of fs.readdirSync(skillsSrc, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    if (!fs.existsSync(path.join(skillsSrc, entry.name, 'SKILL.md'))) continue;
+    copyDirRecursive(path.join(skillsSrc, entry.name), path.join(targetDir, `rdc-${entry.name}`));
+    copied++;
+  }
+  return { removed, copied };
 }
 
 // ── Step 6: Zip for claude.ai / distribution ─────────────────────────────────
@@ -1372,21 +1382,24 @@ async function main() {
     info('[2.5] MCP        — rdc-skills endpoint verified (claude + codex)');
   }
 
-  // 2.6. Codex migration: MCP is authoritative; purge legacy file copies.
+  // 2.6. Codex: rdc skill files in ONE dir (the explicit one, else ~/.codex/skills);
+  // every other Codex skill dir is only cleaned, so nothing registers twice.
   const codexTargets = findCodexTargets();
-  if (codexTargets.length > 0) {
-    let copiedTotal = 0;
-    let removedTotal = 0;
-    for (const target of codexTargets) {
-      const { removed, copied } = registerCodexTarget(target.targetDir);
-      copiedTotal += copied;
-      removedTotal += removed;
-      info(`       ${target.label.padEnd(15)}: ${target.targetDir} (${removed} stale removed; MCP authoritative)`);
-    }
-    ok(`[2.6] Codex      — ${removedTotal} stale file-based skill(s) removed across ${codexTargets.length} target(s); MCP authoritative`);
-  } else {
-    info('[2.6] Codex      — skipped (no Codex skill dirs found; use --codex-root or --codex-skill-dir)');
-  }
+  const primaryCodexDir = explicitCodexSkillDir || path.join(os.homedir(), '.codex', 'skills');
+  if (!codexTargets.some((t) => t.targetDir === primaryCodexDir)) {
+    codexTargets.unshift({ label: 'global .codex', targetDir: primaryCodexDir });
+  }
+  let copiedTotal = 0;
+  let removedTotal = 0;
+  for (const target of codexTargets) {
+    const install = target.targetDir === primaryCodexDir;
+    const { removed, copied } = registerCodexTarget(target.targetDir, { install });
+    copiedTotal += copied;
+    removedTotal += removed;
+    info(`       ${target.label.padEnd(15)}: ${target.targetDir} (${install ? `${copied} installed` : 'cleaned only'}, ${removed} stale removed)`);
+  }
+  if (copiedTotal === 0) throw new Error(`Codex skill install wrote nothing to ${primaryCodexDir}`);
+  ok(`[2.6] Codex      — ${copiedTotal} skill(s) installed in ${primaryCodexDir}; ${removedTotal} stale copies removed across ${codexTargets.length} dir(s)`);
 
   // 2.7. Symlinks in regen-root/.claude/skills/ (FS MCP + claude.ai access)
   if (codexRoot) {

package/scripts/verify-live-install.mjs

@@ -178,10 +178,16 @@ function checkCodex(truth) {
     const rdcDirs = dirs.filter((e) => /^rdc-/.test(e.name) || readFrontmatterName(path.join(t.dir, e.name, 'SKILL.md'))?.startsWith('rdc:'));
     results.push({ label: t.label, dir: t.dir, count: rdcDirs.length });
   }
-  const pass = results.every((r) => r.count === 0);
-  const detail = results.map((r) =>
-    `${r.label}: ${r.count} legacy file-based rdc skill(s)${r.count === 0 ? '' : ' [MCP DUPLICATES PRESENT]'}`
-  ).join('; ');
+  // Codex keeps rdc skills as files in exactly one dir (~/.codex/skills), so it
+  // works without the network; any copy elsewhere registers the skill twice.
+  const skillsSrc = path.join(repoRoot, 'skills');
+  const expected = fs.readdirSync(skillsSrc, { withFileTypes: true })
+    .filter((e) => e.isDirectory() && fs.existsSync(path.join(skillsSrc, e.name, 'SKILL.md'))).length;
+  const isPrimary = (r) => r.label === 'global .codex';
+  const pass = results.some(isPrimary) && results.every((r) => (isPrimary(r) ? r.count === expected : r.count === 0));
+  const detail = results.map((r) => (isPrimary(r)
+    ? `${r.label}: ${r.count}/${expected} rdc skill(s) installed`
+    : `${r.label}: ${r.count} rdc skill(s)${r.count === 0 ? '' : ' [DUPLICATES — would register twice]'}`)).join('; ');
   return { surface: 'Codex', pass, detail };
 }
 

package/skills/co-develop/SKILL.md

@@ -8,6 +8,11 @@ description: rdc:co-develop (subcommand) - [--wait] — peer-aware Claude/Codex
 > One checklist upfront, updated in place, shown again at end with a 1-line verdict.
 > **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Under the flag, do not create/send/reply to live co-development turns; report the intended clauth command and mark the external relay action as skipped.
 
+> **⚠️ Transport gone (probed 2026-09-24).** `clauth codevelop …` returns `unknown command 'codevelop'`
+> and `GET /codevelop` returns `Unknown endpoint` on clauth 2.16.8. The commands below cannot run.
+> Use `rdc:collab` (named lane via `pool/collab-lane.mjs`, ask via `pool/collab-ask.mjs`, reply file
+> under `.rdc/reports/`). This skill is kept only until it is retired or re-pointed.
+
 # rdc:co-develop — Peer-Aware Co-Development
 
 Use this skill when an RDC workflow needs Claude and Codex to work together in

package/skills/collab/COLLABORATOR.md

@@ -67,6 +67,14 @@ that guard just made impossible. That happened on 2026-08-14 and cost a complete
 negotiation result. **Your reasoning in the reply is always deliverable. A file
 write may not be.**
 
+**One exception — a named report.** If the dispatch carries `DELIVERABLE: <path>` and
+the path is under `.rdc/` (a report in `.rdc/reports/`, a plan in
+`.rdc/areas/<domain>/<program>/plans/`, scratch in `.rdc/tmp/`), write exactly that file and no
+other: the start gate exempts `.rdc/**` docs, so it cannot strand, and the reply still carries the
+summary. If the path is anywhere else, do **not** write it: return the content in the reply and
+say `BLOCKED: DELIVERABLE outside .rdc/ would be refused by work-contract-required`. Never create
+a work contract to get past it; that is the initiator's decision.
+
 ---
 
 ## What you owe BACK — your responsibilities
@@ -282,7 +290,7 @@ cannot act on a guess it has to verify.
 | Filing a settled agreement as a lesson | Buries a queryable Decision |
 | Going silent when blocked | Indistinguishable from being dead |
 | Editing a document you do not own | Lost work, no error, no trace |
-| Writing ANY file during a collab | Not your job here — the reply is the deliverable |
+| Writing ANY file during a collab | Not your job here — the reply is the deliverable. Only exception: the one `DELIVERABLE:` path under `.rdc/` named in the dispatch |
 | Committing to whatever branch you happen to be on | The change strands where nobody looks for it |
 | Answering an easier adjacent question | The real point stays open and looks settled |
 | Attempting a workaround for a guard block | The guard is usually right; the dispatch is usually wrong |

package/skills/collab/SKILL.md

@@ -224,7 +224,7 @@ most common failure and it fails at the guard layer, not the prompt layer.
 
 | Collaborator | Invocation | Isolation requirement | Known failure mode |
 |---|---|---|---|
-| **`codex`** | `codex exec [-C <dir>] "<msg>"` · resume: `codex exec resume <session-id> "<msg>"` | **A headless `codex exec` peer is READ-ONLY. It cannot write to any lane — see below.** Never dispatch it from your own lane. | Its managed identity is fixed at session creation and `-C` does **not** change it. Dispatch from your lane and every write is refused with `CODEX MANAGED LANE: App Local must use an owned managed Codex lane` — permanently, for that session's whole life. |
+| **`codex`** | `codex exec [-C <dir>] "<msg>"` · resume: `codex exec resume <session-id> "<msg>"` | **A headless `codex exec` peer can write ONE named report under `.rdc/` (probed 2026-09-24); any other write in a git work tree is refused by `work-contract-required` unless it holds a contract — see the notes below.** Never dispatch it from your own lane, and launch it with its own lane's identity: `env -u CELL_ROLE LIFEAI_CHECKOUT_ROOT=<its lane> codex exec -C <its lane> -m <model> "<prompt>" < /dev/null` (a headless peer inherits your `CELL_ROLE`/`LIFEAI_CHECKOUT_ROOT` and then fails lane recovery with "identity … differs"; probed 2026-09-24: with this env it starts clean). Close stdin with `< /dev/null`: an open pipe makes `codex exec` wait forever. | Its managed identity is fixed at session creation and `-C` does **not** change it. Dispatch from your lane and every write is refused with `CODEX MANAGED LANE: App Local must use an owned managed Codex lane` — permanently, for that session's whole life. |
 
 > **`-C` does not establish lane identity — verified 2026-08-14, and an earlier
 > version of this table said the opposite.** Managed identity is an 8-field record
@@ -235,6 +235,14 @@ most common failure and it fails at the guard layer, not the prompt layer.
 > `codex exec` has no lane-claim path, so it cannot produce that record — which
 > means **a headless Codex peer cannot write in any lane, including its own**.
 >
+> **Correction, probed 2026-09-24.** `codex exec -s workspace-write` wrote a file in a lane
+> it did not own with no identity refusal, so "cannot write in any lane" above is too strong. What
+> stops a peer is the START gate, `work-contract-required` (guard-rules.mjs): a write inside a git
+> work tree needs a work contract, and **only `.rdc/**` files with a doc extension (`md`, `txt`,
+> `json`, `yml`, `csv`, `html`, …) are exempt.** A peer told to write `REVIEW-REPLY.md` at a lane
+> root was refused (2026-09-24) and had to hand the finished report back through its log. The flow
+> does not change this: the rule never reads it. Name the reply path under `.rdc/` (rule 7, Step 2).
+>
 > Two consequences: (1) `resume` replays the session's *recorded* identity, so a
 > session created in the wrong cwd is poisoned for life and `-C` will not repair
 > it — start a new session instead; (2) treat a `codex exec` peer as a
@@ -391,6 +399,21 @@ Rules that make the contract hold:
    OUT of the collab still lands in a governing document (Step 5); it is the
    negotiation turns themselves that are conversation-only.
 
+7. **A report or plan the peer must hand back goes to ONE named path under `.rdc/`,
+   stated in the dispatch.** Add the line `DELIVERABLE: <path>` (or
+   `DELIVERABLE: reply-only`) to the contract. Reports: `.rdc/reports/<lane>-<topic>.md`.
+   Plans: `.rdc/areas/<domain>/<program>/plans/<name>.md`. Scratch: `.rdc/tmp/`. These are the
+   only places a peer without a work contract can write, so the file cannot strand. A path at a
+   lane root or in any code or docs directory will be refused, and the peer's answer then
+   exists only in its transcript. The peer still returns a short summary in the reply; the file
+   is the durable copy. Name the peer the single writer of that one file (Step 4).
+
+   **Cap the file in the dispatch, or it will not be short.** Peers asked for "the literal result" of
+   every probe paste raw dumps (2026-09-24: a 12-finding audit came back as 99 KB). State: findings
+   at most 4 lines each, `EVIDENCE` one command plus a one-line result, raw output to
+   `.rdc/tmp/<lane>-evidence/` and linked, whole file at most 15 KB, a time box, and "append after each
+   point" so a partial report still exists.
+
 ---
 
 ## Step 3 — Converge
@@ -571,6 +594,7 @@ and avoids acting on a misread premise (lesson
 | Escalating a transcript | The human has to find the question themselves |
 | Two agents editing one document | Lost work, no error |
 | Writing to the repo during a collab | Your answer may be guard-blocked and stranded; the reply is always deliverable, a write may not be |
+| Naming a reply file outside `.rdc/` (a lane root, `docs/`, a package) | Refused by `work-contract-required`; the finished report has to be dug out of the peer's log. Use `DELIVERABLE: .rdc/reports/<name>.md` |
 | Using collab to hand off WORK | Wrong skill. Create a work item and use rdc:build or an isolated-worktree agent |
 
 ---

package/skills/deploy/SKILL.md

@@ -27,6 +27,20 @@ Run it from the regen-root checkout you are working in. That is the whole
 instruction. There is no checklist to follow, no mode to pick, and no decision
 for you to make on the success path.
 
+## Local build contract
+
+Standard dev deployment builds on the workstation first. `DEPLOY_MGR_URL`
+must name a loopback manager whose health response reports `host.role: local`.
+The program requests `builder: local` explicitly; Docker or build failure stops
+the deployment. It never falls back to a remote builder.
+
+The target must have a registered image route. Legacy remote build/reload routes
+are refused until a proper local artifact build-and-ship route is implemented.
+Do not enable an image route without its runtime and build configuration.
+
+The manager's explicitly requested remote maintenance operations remain separate
+from this standard command. `promote` remains build-free and approval-gated.
+
 ## Exit 0 — you are done
 
 Print the URL the program reports, and stop.
@@ -46,8 +60,8 @@ followed by the same record as one line of JSON.
 | exit | meaning | first move |
 |---|---|---|
 | 2 | usage — bad or missing arguments | read the usage line; this program takes a slug and optionally `promote` |
-| 3 | deploy manager unreachable | `pm2 restart regen-deploy-mgr` (it is a local PM2 process), then re-run |
-| 4 | slug not resolvable or not routable | the block names what is missing — a registry row, or an allowlist entry |
+| 3 | deploy manager unavailable or unsuitable for local building | read the block; restore the workstation manager and its local host identity, then re-run |
+| 4 | slug not resolvable or no local artifact route | the block names the missing registry or image route; repair that route before deployment |
 | 5 | a submitted job failed or was rejected | the block carries the manager's own step, command, exit code and stderr tail |
 | 6 | the job succeeded but the health probe did not | bytes shipped, app did not come up — read the job the block names |
 | 7 | polling exceeded the deadline | the job is NOT cancelled; the block gives the URL to read it |
@@ -110,9 +124,10 @@ manager, where it runs, rather than in a document that hopes to be read.
 
 A dev deploy needs no approval. `promote` puts bytes on production and needs
 explicit go-ahead for that call. The program itself refuses to promote anything
-that is not an image-model app, because promote retags the digest dev already
-runs — **a promote never builds**, and one that fell back to building would ship
-bytes production has never seen under a name claiming it had.
+that is not an image-model app. **A promote never builds**; it retags an existing
+image through the manager. The current manager resolves the configured dev tag
+(normally `develop`); a successful dev deploy alone does not prove that this
+mutable tag still identifies the running dev image when promotion begins.
 
 ## Verification