@lifeaitools/rdc-skills 0.37.7 → 0.37.9

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "9621389d4e4724ae260e0d4e91651c10b3ac0e2c"
+  "sha": "74680b31a041d74e9c4c72e58cbc876fd5e920c3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.37.7",
+  "version": "0.37.9",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -19,7 +19,7 @@
     "type": "plugin",
     "skills": "skills/",
     "guides": "guides/",
-    "version": "0.37.7",
+    "version": "0.37.9",
     "commands": "commands/"
   },
   "bin": {

package/scripts/gen-rpms-kind-tables.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+/**
+ * Generate the kind tables in skills/new/SKILL.md and skills/open/SKILL.md
+ * from ONE source: the RPMS kind registry.
+ *
+ * WHY THIS EXISTS
+ *
+ * `public.rpms_kinds` + `public.rpms_usages` (Supabase uvojezuorjgqzmhhgluu)
+ * are the single home for every kind of development: its level, usage, home,
+ * ship route and deploy route. Both skills used to carry a hand-written copy of
+ * that list ("the eleven values --product-type accepts", and the class ->
+ * build/dev/prod table). Two hand copies of one fact drift; a projection does
+ * not. A new kind is one row via `register_rpms_kind` — then refresh the
+ * snapshot and re-run this script.
+ *
+ * SOURCE
+ *
+ *   data/rpms-kinds.snapshot.json — a committed, byte-stable copy of
+ *   `select rpms_kinds_snapshot()` (schema "rpms.kinds.v1"). Keys are sorted
+ *   recursively and `kinds` / `usages` are sorted by slug, so a refresh that
+ *   changes nothing produces no diff.
+ *
+ * TARGETS
+ *
+ *   Each target file holds a delimited block:
+ *     <!-- BEGIN GENERATED: rpms-kinds -->
+ *     ...
+ *     <!-- END GENERATED -->
+ *   Everything between the markers is rewritten; the prose around it is not.
+ *   The block inherits the indentation of its BEGIN marker.
+ *
+ * Run:
+ *   node scripts/gen-rpms-kind-tables.mjs              rewrite both blocks
+ *   node scripts/gen-rpms-kind-tables.mjs --check      exit 1 if a block is stale
+ *   node scripts/gen-rpms-kind-tables.mjs --from <raw.json>
+ *       canonicalise a raw `rpms_kinds_snapshot()` dump into the snapshot file,
+ *       then rewrite both blocks
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SNAPSHOT = path.join(ROOT, 'data', 'rpms-kinds.snapshot.json');
+const SCHEMA = 'rpms.kinds.v1';
+const BEGIN = '<!-- BEGIN GENERATED: rpms-kinds -->';
+const END = '<!-- END GENERATED -->';
+const PRODUCT_TYPE_DECL = 'rdc-harness:PRODUCT_CLASSES';
+
+/** Recursively sort object keys so serialisation is byte-stable. */
+export function canonicalise(value) {
+  if (Array.isArray(value)) return value.map(canonicalise);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((k) => [k, canonicalise(value[k])]),
+    );
+  }
+  return value;
+}
+
+const bySlug = (a, b) => (a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0);
+
+/** Validate and canonicalise a raw snapshot object. */
+export function normaliseSnapshot(raw) {
+  const snap = typeof raw === 'string' ? JSON.parse(raw) : raw;
+  if (snap?.schema !== SCHEMA) throw new Error(`snapshot schema is ${snap?.schema}, expected ${SCHEMA}`);
+  if (!Array.isArray(snap.kinds) || !Array.isArray(snap.usages)) throw new Error('snapshot needs kinds[] and usages[]');
+  return canonicalise({
+    ...snap,
+    kinds: [...snap.kinds].sort(bySlug),
+    usages: [...snap.usages].sort(bySlug),
+  });
+}
+
+export function serialiseSnapshot(snap) {
+  return `${JSON.stringify(snap, null, 2)}\n`;
+}
+
+const code = (s) => `\`${String(s).replace(/\|/g, '\\|')}\``;
+const dash = '—';
+
+function usageMap(snap) {
+  return new Map(snap.usages.map((u) => [u.slug, u]));
+}
+
+function productKinds(snap) {
+  return snap.kinds.filter((k) => k.level === 'product');
+}
+
+const acceptsProductType = (k) => (k.declared_in || []).includes(PRODUCT_TYPE_DECL);
+
+function statusNote(k) {
+  return k.status === 'active' ? '' : ` _(${k.status})_`;
+}
+
+function prodCell(u) {
+  if (!u) return dash;
+  if (u.deploy_route) return code(u.deploy_route);
+  return u.inapplicable_reason ? `${dash} (${u.inapplicable_reason})` : dash;
+}
+
+/** skills/new: the product-level kind table. */
+export function renderNewTable(snap) {
+  const usages = usageMap(snap);
+  const kinds = productKinds(snap);
+  const accepted = kinds.filter(acceptsProductType).length;
+  const lines = [
+    `_${kinds.length} product-level kinds; ${accepted} accepted by \`--product-type\` today. Generated from \`rpms_kinds\` (schema \`${snap.schema}\`) by \`scripts/gen-rpms-kind-tables.mjs\` — do not hand-edit._`,
+    '',
+    '| kind | level | usage | ship | deploy | home | `--product-type` today |',
+    '|---|---|---|---|---|---|---|',
+  ];
+  for (const k of kinds) {
+    const u = usages.get(k.usage);
+    lines.push([
+      '',
+      `${code(k.slug)}${statusNote(k)}`,
+      k.level,
+      code(k.usage),
+      u?.ship_route ? code(u.ship_route) : dash,
+      prodCell(u),
+      k.home_template ? code(k.home_template) : dash,
+      acceptsProductType(k) ? 'yes' : dash,
+      '',
+    ].join(' | ').trim());
+  }
+  return lines;
+}
+
+/** skills/open: kind -> build/dev/prod routes. */
+export function renderOpenTable(snap) {
+  const usages = usageMap(snap);
+  const lines = [
+    `_Generated from \`rpms_kinds\` + \`rpms_usages\` (schema \`${snap.schema}\`) by \`scripts/gen-rpms-kind-tables.mjs\` — do not hand-edit. Product-level kinds only; every other level is in \`select rpms_kinds_snapshot()\`._`,
+    '',
+    '| kind | home | build · dev (`ship_route`) | runtime | prod (`deploy_route`) |',
+    '|---|---|---|---|---|',
+  ];
+  for (const k of productKinds(snap)) {
+    const u = usages.get(k.usage);
+    lines.push([
+      '',
+      `${code(k.slug)}${statusNote(k)}`,
+      k.home_template ? code(k.home_template) : dash,
+      u?.ship_route ? code(u.ship_route) : dash,
+      u?.runtime ? code(u.runtime) : dash,
+      prodCell(u),
+      '',
+    ].join(' | ').trim());
+  }
+  return lines;
+}
+
+/** Replace the delimited block in `text` with `lines`, keeping the marker indent. */
+export function replaceBlock(text, lines, file) {
+  const eol = text.includes('\r\n') ? '\r\n' : '\n';
+  const src = text.split(/\r?\n/);
+  const b = src.findIndex((l) => l.trim() === BEGIN);
+  const e = src.findIndex((l, i) => i > b && l.trim() === END);
+  if (b < 0 || e < 0) throw new Error(`${file}: missing ${BEGIN} … ${END} markers`);
+  const indent = src[b].match(/^\s*/)[0];
+  const body = lines.map((l) => (l ? indent + l : ''));
+  return [...src.slice(0, b + 1), ...body, ...src.slice(e)].join(eol);
+}
+
+const TARGETS = [
+  { file: path.join('skills', 'new', 'SKILL.md'), render: renderNewTable },
+  { file: path.join('skills', 'open', 'SKILL.md'), render: renderOpenTable },
+];
+
+function main(argv) {
+  const check = argv.includes('--check');
+  const fromIdx = argv.indexOf('--from');
+  if (fromIdx >= 0) {
+    if (check) throw new Error('--from and --check are exclusive');
+    const raw = readFileSync(path.resolve(argv[fromIdx + 1]), 'utf8');
+    writeFileSync(SNAPSHOT, serialiseSnapshot(normaliseSnapshot(raw)));
+    console.log(`snapshot written: ${path.relative(ROOT, SNAPSHOT)}`);
+  }
+
+  const onDisk = readFileSync(SNAPSHOT, 'utf8');
+  const snap = normaliseSnapshot(onDisk);
+  const stale = [];
+  if (serialiseSnapshot(snap) !== onDisk) stale.push(`${path.relative(ROOT, SNAPSHOT)} (not canonical)`);
+
+  for (const t of TARGETS) {
+    const abs = path.join(ROOT, t.file);
+    const before = readFileSync(abs, 'utf8');
+    const after = replaceBlock(before, t.render(snap), t.file);
+    if (after === before) continue;
+    stale.push(t.file);
+    if (!check) writeFileSync(abs, after);
+  }
+
+  if (check && stale.length) {
+    console.error(`rpms kind tables out of date (${stale.length}): ${stale.join(', ')} — run: node scripts/gen-rpms-kind-tables.mjs`);
+    return 1;
+  }
+  console.log(check ? 'rpms kind tables current' : `rpms kind tables: ${stale.length} file(s) rewritten`);
+  return 0;
+}
+
+if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+  try {
+    process.exit(main(process.argv.slice(2)));
+  } catch (err) {
+    console.error(`gen-rpms-kind-tables: ${err.message}`);
+    process.exit(2);
+  }
+}

package/scripts/lib/plugins/static-call-reference.mjs

@@ -0,0 +1,109 @@
+// Resolve known POSSIBLE call targets, not observed runtime calls. A dynamic
+// key into a closed literal registry can select any of its entries, just as
+// either branch of an if can call its target. Open/escaped registries stay
+// unresolved. These private parser facts do not change the public unit schema.
+function unwrap(node) {
+  while (node && ['as_expression', 'satisfies_expression', 'parenthesized_expression', 'non_null_expression'].includes(node.type)) node = node.namedChild(0);
+  return node;
+}
+
+function children(node) { return node?.namedChildren ?? []; }
+
+function containsName(node, name) {
+  return node?.text === name || children(node).some(child => containsName(child, name));
+}
+
+function hasAssignment(node, name) {
+  const target = ['assignment_expression', 'augmented_assignment_expression', 'for_in_statement'].includes(node.type)
+    ? node.childForFieldName('left') : node.type === 'update_expression' ? node.childForFieldName('argument') : null;
+  return containsName(target, name) || children(node).some(child => hasAssignment(child, name));
+}
+
+function binding(name, site) {
+  for (let scope = site.parent; scope; scope = scope.parent) {
+    if (['function_expression', 'class', 'class_expression'].includes(scope.type) && scope.childForFieldName('name')?.text === name) return { blocked: true };
+    const parameters = scope.childForFieldName('parameters') ?? scope.childForFieldName('parameter');
+    if (parameters && new RegExp(`\\b${name.replace(/[$]/g, '\\$&')}\\b`).test(parameters.text)) return { blocked: true };
+    if (scope.type === 'for_in_statement' && containsName(scope.childForFieldName('left'), name)) return { blocked: true };
+    if (scope.type === 'for_statement' && containsName(scope.childForFieldName('initializer'), name)) return { blocked: true };
+    if (!['statement_block', 'program'].includes(scope.type)) continue;
+    for (const statement of children(scope)) {
+      const declaration = statement.type === 'export_statement' ? statement.childForFieldName('declaration') : statement;
+      if (declaration?.childForFieldName('name')?.text === name) {
+        return { blocked: scope.type !== 'program' || hasAssignment(scope, name), terminal: true, node: declaration.childForFieldName('name') };
+      }
+      for (const entry of children(declaration)) {
+        if (entry.type !== 'variable_declarator' || !containsName(entry.childForFieldName('name'), name)) continue;
+        return { node: entry.childForFieldName('value'), declaration: entry, scope,
+          blocked: entry.childForFieldName('name')?.type !== 'identifier' || declaration.children[0]?.text !== 'const' || entry.startIndex > site.startIndex };
+      }
+    }
+  }
+  return null;
+}
+
+function hasUnsafeUse(found, name) {
+  let unsafe = false;
+  function visit(node) {
+    if (['identifier', 'shorthand_property_identifier'].includes(node.type) && node.text === name && node.startIndex !== found.declaration.childForFieldName('name').startIndex) {
+      const parent = node.parent;
+      const isSelection = ['member_expression', 'subscript_expression'].includes(parent?.type) && parent.childForFieldName('object')?.id === node.id;
+      let selected = isSelection ? parent : node;
+      while (['parenthesized_expression', 'as_expression', 'non_null_expression', 'array_pattern', 'object_pattern', 'pair_pattern'].includes(selected.parent?.type)) selected = selected.parent;
+      const container = selected.parent;
+      const writesSelection = ['assignment_expression', 'augmented_assignment_expression', 'update_expression', 'unary_expression'].includes(container?.type)
+        || (container?.type === 'for_in_statement' && container.childForFieldName('left')?.id === selected.id);
+      // Passing or aliasing the object can expose it to mutation. No whole-program guess.
+      if (!isSelection || writesSelection) unsafe = true;
+    }
+    for (const child of children(node)) visit(child);
+  }
+  visit(found.scope);
+  return unsafe;
+}
+
+function propertyName(node) {
+  if (!node) return null;
+  if (['property_identifier', 'identifier', 'shorthand_property_identifier'].includes(node.type)) return node.text;
+  if (node.type === 'string') return node.namedChildren.every(child => child.type === 'string_fragment') ? node.text.slice(1, -1) : null;
+  return null;
+}
+
+function resolveValue(node, seen) {
+  node = unwrap(node);
+  if (!node || seen.has(node.id)) return [];
+  seen = new Set([...seen, node.id]);
+  if (node.type === 'identifier' || node.type === 'shorthand_property_identifier') {
+    const found = binding(node.text, node);
+    if (!found) return [node];
+    if (found.blocked) return [];
+    if (found.terminal) return [found.node];
+    return resolveValue(found.node, seen);
+  }
+  if (node.type === 'binary_expression' && node.childForFieldName('operator')?.text === '??') {
+    return [...resolveValue(node.childForFieldName('left'), seen), ...resolveValue(node.childForFieldName('right'), seen)];
+  }
+  if (!['member_expression', 'subscript_expression'].includes(node.type)) return [];
+  const object = node.childForFieldName('object');
+  const keyNode = node.childForFieldName(node.type === 'member_expression' ? 'property' : 'index');
+  // A runtime key gives a set of known possible targets, never a definite one.
+  const key = node.type === 'subscript_expression' && keyNode?.type !== 'string' ? null : propertyName(keyNode);
+  if (object?.type !== 'identifier') return [];
+  const found = binding(object.text, node);
+  if (!found || found.blocked || found.terminal || hasUnsafeUse(found, object.text)) return [];
+  // An exported object can be mutated by another module; const seals only its binding.
+  if (found.declaration.parent?.parent?.type === 'export_statement') return [];
+  const registry = unwrap(found.node);
+  if (registry?.type !== 'object' || registry.namedChildren.some(entry => !['pair', 'shorthand_property_identifier'].includes(entry.type))) return [];
+  const keys = registry.namedChildren.map(entry => propertyName(entry.childForFieldName('key') ?? entry));
+  if (keys.includes(null) || keys.includes('__proto__') || new Set(keys).size !== keys.length) return [];
+  const entries = registry.namedChildren.filter((entry, index) => key === null || keys[index] === key);
+  return entries.flatMap(entry => resolveValue(entry.childForFieldName('value') ?? entry, seen));
+}
+
+/** Private parser helper: known possible callees; [] means unresolved, not impossible. */
+export function staticCallReference(node) {
+  return [...new Set(resolveValue(node, new Set())
+    .filter(value => ['identifier', 'shorthand_property_identifier'].includes(value?.type))
+    .map(value => value.text))];
+}

package/scripts/lib/plugins/treesitter.mjs

@@ -141,6 +141,7 @@ import { extractMembers } from '../vendor/codeflow-parser/memberFacts.js';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
+import { staticCallReference } from './static-call-reference.mjs';
 
 const require = createRequire(import.meta.url);
 
@@ -423,9 +424,18 @@ function fieldsOf(bodyNode) {
 function callsOf(bodyNode) {
   const out = [];
   walkSelfAndDescendants(bodyNode, (n) => {
-    if (n.type !== 'call_expression') return;
-    const fn = n.childForFieldName('function');
-    if (fn) out.push(fn.text.replace(/^this\./, ''));
+    const jsx = n.type === 'jsx_opening_element' || n.type === 'jsx_self_closing_element';
+    if (n.type !== 'call_expression' && !jsx) return;
+    const fn = n.childForFieldName(jsx ? 'name' : 'function');
+    if (!fn || (jsx && fn.type === 'identifier' && /^[a-z]/.test(fn.text))) return;
+    const resolved = staticCallReference(fn);
+    if (jsx) {
+      if (resolved.length) out.push(...resolved);
+      else if (fn.type === 'member_expression') out.push(fn.text.replace(/^this\./, ''));
+    } else {
+      out.push(fn.text.replace(/^this\./, ''));
+      out.push(...resolved.filter(target => target !== fn.text));
+    }
   });
   return out;
 }

package/skills/co-develop/SKILL.md

@@ -8,6 +8,11 @@ description: rdc:co-develop (subcommand) - [--wait] — peer-aware Claude/Codex
 > One checklist upfront, updated in place, shown again at end with a 1-line verdict.
 > **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Under the flag, do not create/send/reply to live co-development turns; report the intended clauth command and mark the external relay action as skipped.
 
+> **⚠️ Transport gone (probed 2026-09-24).** `clauth codevelop …` returns `unknown command 'codevelop'`
+> and `GET /codevelop` returns `Unknown endpoint` on clauth 2.16.8. The commands below cannot run.
+> Use `rdc:collab` (named lane via `pool/collab-lane.mjs`, ask via `pool/collab-ask.mjs`, reply file
+> under `.rdc/reports/`). This skill is kept only until it is retired or re-pointed.
+
 # rdc:co-develop — Peer-Aware Co-Development
 
 Use this skill when an RDC workflow needs Claude and Codex to work together in

package/skills/collab/COLLABORATOR.md

@@ -67,6 +67,14 @@ that guard just made impossible. That happened on 2026-08-14 and cost a complete
 negotiation result. **Your reasoning in the reply is always deliverable. A file
 write may not be.**
 
+**One exception — a named report.** If the dispatch carries `DELIVERABLE: <path>` and
+the path is under `.rdc/` (a report in `.rdc/reports/`, a plan in
+`.rdc/areas/<domain>/<program>/plans/`, scratch in `.rdc/tmp/`), write exactly that file and no
+other: the start gate exempts `.rdc/**` docs, so it cannot strand, and the reply still carries the
+summary. If the path is anywhere else, do **not** write it: return the content in the reply and
+say `BLOCKED: DELIVERABLE outside .rdc/ would be refused by work-contract-required`. Never create
+a work contract to get past it; that is the initiator's decision.
+
 ---
 
 ## What you owe BACK — your responsibilities
@@ -282,7 +290,7 @@ cannot act on a guess it has to verify.
 | Filing a settled agreement as a lesson | Buries a queryable Decision |
 | Going silent when blocked | Indistinguishable from being dead |
 | Editing a document you do not own | Lost work, no error, no trace |
-| Writing ANY file during a collab | Not your job here — the reply is the deliverable |
+| Writing ANY file during a collab | Not your job here — the reply is the deliverable. Only exception: the one `DELIVERABLE:` path under `.rdc/` named in the dispatch |
 | Committing to whatever branch you happen to be on | The change strands where nobody looks for it |
 | Answering an easier adjacent question | The real point stays open and looks settled |
 | Attempting a workaround for a guard block | The guard is usually right; the dispatch is usually wrong |

package/skills/collab/SKILL.md

@@ -224,7 +224,7 @@ most common failure and it fails at the guard layer, not the prompt layer.
 
 | Collaborator | Invocation | Isolation requirement | Known failure mode |
 |---|---|---|---|
-| **`codex`** | `codex exec [-C <dir>] "<msg>"` · resume: `codex exec resume <session-id> "<msg>"` | **A headless `codex exec` peer is READ-ONLY. It cannot write to any lane — see below.** Never dispatch it from your own lane. | Its managed identity is fixed at session creation and `-C` does **not** change it. Dispatch from your lane and every write is refused with `CODEX MANAGED LANE: App Local must use an owned managed Codex lane` — permanently, for that session's whole life. |
+| **`codex`** | `codex exec [-C <dir>] "<msg>"` · resume: `codex exec resume <session-id> "<msg>"` | **A headless `codex exec` peer can write ONE named report under `.rdc/` (probed 2026-09-24); any other write in a git work tree is refused by `work-contract-required` unless it holds a contract — see the notes below.** Never dispatch it from your own lane, and launch it with its own lane's identity: `env -u CELL_ROLE LIFEAI_CHECKOUT_ROOT=<its lane> codex exec -C <its lane> -m <model> "<prompt>" < /dev/null` (a headless peer inherits your `CELL_ROLE`/`LIFEAI_CHECKOUT_ROOT` and then fails lane recovery with "identity … differs"; probed 2026-09-24: with this env it starts clean). Close stdin with `< /dev/null`: an open pipe makes `codex exec` wait forever. | Its managed identity is fixed at session creation and `-C` does **not** change it. Dispatch from your lane and every write is refused with `CODEX MANAGED LANE: App Local must use an owned managed Codex lane` — permanently, for that session's whole life. |
 
 > **`-C` does not establish lane identity — verified 2026-08-14, and an earlier
 > version of this table said the opposite.** Managed identity is an 8-field record
@@ -235,6 +235,14 @@ most common failure and it fails at the guard layer, not the prompt layer.
 > `codex exec` has no lane-claim path, so it cannot produce that record — which
 > means **a headless Codex peer cannot write in any lane, including its own**.
 >
+> **Correction, probed 2026-09-24.** `codex exec -s workspace-write` wrote a file in a lane
+> it did not own with no identity refusal, so "cannot write in any lane" above is too strong. What
+> stops a peer is the START gate, `work-contract-required` (guard-rules.mjs): a write inside a git
+> work tree needs a work contract, and **only `.rdc/**` files with a doc extension (`md`, `txt`,
+> `json`, `yml`, `csv`, `html`, …) are exempt.** A peer told to write `REVIEW-REPLY.md` at a lane
+> root was refused (2026-09-24) and had to hand the finished report back through its log. The flow
+> does not change this: the rule never reads it. Name the reply path under `.rdc/` (rule 7, Step 2).
+>
 > Two consequences: (1) `resume` replays the session's *recorded* identity, so a
 > session created in the wrong cwd is poisoned for life and `-C` will not repair
 > it — start a new session instead; (2) treat a `codex exec` peer as a
@@ -391,6 +399,21 @@ Rules that make the contract hold:
    OUT of the collab still lands in a governing document (Step 5); it is the
    negotiation turns themselves that are conversation-only.
 
+7. **A report or plan the peer must hand back goes to ONE named path under `.rdc/`,
+   stated in the dispatch.** Add the line `DELIVERABLE: <path>` (or
+   `DELIVERABLE: reply-only`) to the contract. Reports: `.rdc/reports/<lane>-<topic>.md`.
+   Plans: `.rdc/areas/<domain>/<program>/plans/<name>.md`. Scratch: `.rdc/tmp/`. These are the
+   only places a peer without a work contract can write, so the file cannot strand. A path at a
+   lane root or in any code or docs directory will be refused, and the peer's answer then
+   exists only in its transcript. The peer still returns a short summary in the reply; the file
+   is the durable copy. Name the peer the single writer of that one file (Step 4).
+
+   **Cap the file in the dispatch, or it will not be short.** Peers asked for "the literal result" of
+   every probe paste raw dumps (2026-09-24: a 12-finding audit came back as 99 KB). State: findings
+   at most 4 lines each, `EVIDENCE` one command plus a one-line result, raw output to
+   `.rdc/tmp/<lane>-evidence/` and linked, whole file at most 15 KB, a time box, and "append after each
+   point" so a partial report still exists.
+
 ---
 
 ## Step 3 — Converge
@@ -571,6 +594,7 @@ and avoids acting on a misread premise (lesson
 | Escalating a transcript | The human has to find the question themselves |
 | Two agents editing one document | Lost work, no error |
 | Writing to the repo during a collab | Your answer may be guard-blocked and stranded; the reply is always deliverable, a write may not be |
+| Naming a reply file outside `.rdc/` (a lane root, `docs/`, a package) | Refused by `work-contract-required`; the finished report has to be dug out of the peer's log. Use `DELIVERABLE: .rdc/reports/<name>.md` |
 | Using collab to hand off WORK | Wrong skill. Create a work item and use rdc:build or an isolated-worktree agent |
 
 ---

package/skills/new/SKILL.md

@@ -0,0 +1,154 @@
+---
+name: new
+description: rdc:new <slug> --product-type <t> [--environment <e> --host-type <t> --url <u>] — scaffold and register a new product, then optionally register its deployment environment
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.
+> One checklist upfront, updated in place, shown again at end with a 1-line verdict.
+
+# rdc:new — create and register a product, no register-then-improvise gap
+
+## The gap this closes
+
+`/rdc:open` is gate-only: it resolves an **already-registered** slug and
+refuses to guess a default for one that isn't. Nothing named what to do next.
+The real capability existed one layer down, unwrapped: `rdc-harness create`
+(scaffold + register) and `rdc-harness new` (register a deployment
+environment). This skill is the guided flow over both — pick a product class,
+scaffold it, register the environment(s) it needs, then hand you straight to
+`rdc:open` to confirm.
+
+## Run the script. Do not re-derive this by hand.
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness create <slug> --product-type <t> --monorepo-root <dir>
+npx -y --package=@lifeai/rdc-harness rdc-harness new <slug> --environment <e> --host-type <t> --url <u>
+```
+
+Same package as `rdc:open` — `@lifeai/rdc-harness` on GitHub Packages, needs
+`@lifeai:registry=https://npm.pkg.github.com` in `.npmrc` (full setup:
+`.rdc/guides/agent-bootstrap.md`). `new` needs `@lifeai/rdc-harness@>=0.5.0`
+— the environment-registration verb; anything older 404s the flag.
+
+## Steps
+
+### 1. Pick the kind
+
+Every kind of development lives in ONE place: the RPMS kind registry
+(`public.rpms_kinds` + `public.rpms_usages`; read it with
+`select rpms_kinds_snapshot()`). The table below is **generated from
+`rpms_kinds`** — its level, usage, ship and deploy routes and home all come
+from the registry, never from this file. A new kind is **one row via
+`register_rpms_kind`**; then refresh the snapshot and regenerate
+(rdc-skills: `node scripts/gen-rpms-kind-tables.mjs --from <dump.json>`). Never invent a
+kind here, and never hand-edit the block.
+
+**`--kind <slug>` is the forward name for `--product-type`.** For product-level
+kinds the values are the same slugs. `--product-type` remains the flag the
+current `rdc-harness create` CLI takes — keep passing `--product-type <t>` to
+it, and only for a kind marked **yes** in the last column (the harness enum,
+byte-identical to `repo_registry`'s product-class reference). A product-level
+kind without **yes** is registered in `rpms_kinds` but has no `create`
+scaffold yet: stop and say so rather than picking a near neighbour.
+
+Full guide to every kind at every level (not just product-level), and the path to add a new one:
+`docs/architecture/KINDS.md` in regen-root.
+
+<!-- BEGIN GENERATED: rpms-kinds -->
+_22 product-level kinds; 11 accepted by `--product-type` today. Generated from `rpms_kinds` (schema `rpms.kinds.v1`) by `scripts/gen-rpms-kind-tables.mjs` — do not hand-edit._
+
+| kind | level | usage | ship | deploy | home | `--product-type` today |
+|---|---|---|---|---|---|---|
+| `app` | product | `public-surface` | `pm2-development` | `declared-promotion` | `apps/<slug>/` | yes |
+| `artifact` | product | `export` | `artifact-export` | — (no-production-target) | `artifacts/<slug>/` | yes |
+| `bpmn-process` | product | `process` | `flowable-dev-release` | `flowable-release` | `docs/systems/<system>/bpmn/` | — |
+| `city-tool` | product | `public-surface` | `pm2-development` | `declared-promotion` | `apps/<slug>/` | — |
+| `corpus` | product | `content` | `content-write` | — (content-not-code) | `$CORPUS_ROOT/<CO>/docs/` | yes |
+| `dmn-decision` _(proposed)_ | product | `decision` | `dmn-test-cases` | `flowable-dmn-release` | `docs/systems/<system>/dmn/` | — |
+| `documentation` | product | `export` | `artifact-export` | — (no-production-target) | `docs/<slug>/` | yes |
+| `dsl` _(proposed)_ | product | `language` | `grammar-suite` | — (production-is-registry) | `packages/<pkg>/src/dsl/` | — |
+| `education-piece` | product | `export` | `artifact-export` | — (no-production-target) | `artifacts/<slug>/` | — |
+| `grammar` | product | `language` | `grammar-suite` | — (production-is-registry) | `packages/<pkg>/src/grammar/` | — |
+| `mcp` | product | `agent-tool` | `plugin-registration` | `declared-service-route` | `mcp-servers/<slug>/` | yes |
+| `model` | product | `public-surface` | `pm2-development` | `declared-promotion` | `models/<slug>/` | yes |
+| `ontology` | product | `language` | `grammar-suite` | — (production-is-registry) | `packages/planetary-ontology/src/` | — |
+| `package` | product | `library` | `registry-release` | — (production-is-registry) | `packages/<slug>/` | yes |
+| `prototype` | product | `exploration` | — | — (no-production-target) | `artifacts/<slug>/` | yes |
+| `share-app` | product | `embed` | `pm2-development` | `declared-promotion` | `apps/<slug>/` | yes |
+| `site-html` | product | `static-site` | `static-development` | `declared-promotion` | `sites/<slug>/` | yes |
+| `site-ts` | product | `static-site` | `static-development` | `declared-promotion` | `sites/<slug>/` | yes |
+| `skill` | product | `agent-instruction` | `local-install` | `release-tag` | `skills/<slug>/` | — |
+| `theme` | product | `content` | `content-write` | — (content-not-code) | — | — |
+| `vendor` | product | `library` | `registry-release` | — (production-is-registry) | `vendor/<slug>/` | — |
+| `worker` | product | `edge` | `edge-dev` | `edge-deploy` | `workers/<slug>/` | — |
+<!-- END GENERATED -->
+
+If the ask is a VLAS reference model (`model`), stop here and use `rdc:new-model`
+instead — it registers all four VLAS-required homes; this skill's `create` verb scaffolds files; it does not touch the
+four fixed homes a model needs.
+
+### 2. Scaffold and register
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness create <slug> --product-type <t> --monorepo-root <dir>
+```
+
+Registry-first-then-files: writes `repo_registry` (or the app's row, for a
+monorepo target), then scaffolds. A failure after the registry write is a
+**registered-but-empty** target — `rdc:open <slug>` will resolve it with
+`weDoNotHold` naming what's missing; re-run `create`, do not hand-write the
+registry row to route around it.
+
+### 3. Register the environment(s) it needs
+
+**Dev-vs-prod-and-shared-docker is a class-wide POLICY, not a question this
+step asks you.** `.claude/rules/infrastructure-contract.md` Rule 12 already
+decides it: a public-facing app or site runs on Docker in both dev and main;
+an MCP or daemon stays on PM2 everywhere. Apply that rule, then register
+accordingly — don't prompt the person for a choice the policy already makes:
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness new <slug> --environment dev --host-type <t> --url <dev-url>
+# only if the class is public-facing (app/site) and the work is ready for it:
+npx -y --package=@lifeai/rdc-harness rdc-harness new <slug> --environment prod --host-type <t> --url <prod-url>
+```
+
+`--host-type` names the real runtime (`coolify`, `pm2`, …), not a guess. A
+Coolify target additionally needs `--coolify-uuid <uuid> --coolify-server
+<ip>` — resolve these via `/knowledge`/clauth, never hardcode.
+
+A `dev`-only registration is the normal, complete outcome for most new work —
+**do not register `prod` speculatively.** Prod promotion is a separate,
+later, deliberate act (`/rdc:release`, `/rdc:deploy … promote`).
+
+### 4. Confirm with `rdc:open`
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness open <slug>
+```
+
+Must return `opened: true` with no `weDoNotHold` entries for the fields this
+skill just set (`product_class`, and `deployment_record` once step 3 ran).
+Any remaining `weDoNotHold` entry names a real gap — do not paper over it by
+re-running `create`/`new` with guessed values.
+
+## Checklist
+
+```
+[ ] kind chosen from the generated rpms_kinds table (--product-type = a "yes" kind), or routed to rdc:new-model
+[ ] rdc-harness create — scaffold + registry write succeeded
+[ ] environment(s) registered per infrastructure-contract Rule 12, not by asking
+[ ] prod NOT registered speculatively (dev-only unless promotion is the actual ask)
+[ ] rdc:open <slug> confirms — opened:true, no unexpected weDoNotHold
+```
+
+## Related
+
+- `rdc:open` — the gate this hands off to; resolves what `new` just registered.
+- `rdc:new-model` — VLAS Reference Models only; registers all four required
+  homes in one gated flow. Use it instead of this skill for a model.
+- `.claude/rules/infrastructure-contract.md` — Rule 12 (Docker vs PM2 by
+  class), and the deployment registry contract `new` writes into.
+- `rdc:deploy` / `rdc:release` — consume the registration this skill creates;
+  prod promotion is their job, not this skill's.