@lifeaitools/rdc-skills 0.37.8 → 0.37.10

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "b71cf17b326bf3b68432d169032107877bfceb58"
+  "sha": "36d09ffe1920d0f5906909cf599953d73c71bff9"
 }

package/hooks/require-work-item-on-commit.js

@@ -385,6 +385,19 @@ async function preToolUse(raw) {
   const command = raw.tool_input?.command || '';
   if (!command.includes('git commit')) return process.exit(0);
 
+  // Scope guard (2026-10-01, Dave, direct instruction): this gate exists for
+  // the RDC/regen-root work-item contract, not for every git repo on the box.
+  // Same pattern as no-stop-open-epics.js's PROJECT_SCOPE check — a commit
+  // outside the configured scope (default 'regen-root') is none of this
+  // hook's business and must not be fail-closed into requiring an RDC work
+  // item it has no way to reference.
+  const scope = process.env.RDC_PROJECT_SCOPE || 'regen-root';
+  const cwd = (raw.cwd || process.cwd()).replace(/\\/g, '/').toLowerCase();
+  if (!cwd.includes(scope.toLowerCase())) {
+    hookLog('require-work-item', 'PreToolUse', 'pass-out-of-scope', { cwd, scope });
+    return process.exit(0);
+  }
+
   if (!(await requiresWorkItemNow())) {
     hookLog('require-work-item', 'PreToolUse', 'pass-flow-exempt', {});
     return process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.37.8",
+  "version": "0.37.10",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -19,7 +19,7 @@
     "type": "plugin",
     "skills": "skills/",
     "guides": "guides/",
-    "version": "0.37.8",
+    "version": "0.37.10",
     "commands": "commands/"
   },
   "bin": {

package/scripts/gen-rpms-kind-tables.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+/**
+ * Generate the kind tables in skills/new/SKILL.md and skills/open/SKILL.md
+ * from ONE source: the RPMS kind registry.
+ *
+ * WHY THIS EXISTS
+ *
+ * `public.rpms_kinds` + `public.rpms_usages` (Supabase uvojezuorjgqzmhhgluu)
+ * are the single home for every kind of development: its level, usage, home,
+ * ship route and deploy route. Both skills used to carry a hand-written copy of
+ * that list ("the eleven values --product-type accepts", and the class ->
+ * build/dev/prod table). Two hand copies of one fact drift; a projection does
+ * not. A new kind is one row via `register_rpms_kind` — then refresh the
+ * snapshot and re-run this script.
+ *
+ * SOURCE
+ *
+ *   data/rpms-kinds.snapshot.json — a committed, byte-stable copy of
+ *   `select rpms_kinds_snapshot()` (schema "rpms.kinds.v1"). Keys are sorted
+ *   recursively and `kinds` / `usages` are sorted by slug, so a refresh that
+ *   changes nothing produces no diff.
+ *
+ * TARGETS
+ *
+ *   Each target file holds a delimited block:
+ *     <!-- BEGIN GENERATED: rpms-kinds -->
+ *     ...
+ *     <!-- END GENERATED -->
+ *   Everything between the markers is rewritten; the prose around it is not.
+ *   The block inherits the indentation of its BEGIN marker.
+ *
+ * Run:
+ *   node scripts/gen-rpms-kind-tables.mjs              rewrite both blocks
+ *   node scripts/gen-rpms-kind-tables.mjs --check      exit 1 if a block is stale
+ *   node scripts/gen-rpms-kind-tables.mjs --from <raw.json>
+ *       canonicalise a raw `rpms_kinds_snapshot()` dump into the snapshot file,
+ *       then rewrite both blocks
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SNAPSHOT = path.join(ROOT, 'data', 'rpms-kinds.snapshot.json');
+const SCHEMA = 'rpms.kinds.v1';
+const BEGIN = '<!-- BEGIN GENERATED: rpms-kinds -->';
+const END = '<!-- END GENERATED -->';
+const PRODUCT_TYPE_DECL = 'rdc-harness:PRODUCT_CLASSES';
+
+/** Recursively sort object keys so serialisation is byte-stable. */
+export function canonicalise(value) {
+  if (Array.isArray(value)) return value.map(canonicalise);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((k) => [k, canonicalise(value[k])]),
+    );
+  }
+  return value;
+}
+
+const bySlug = (a, b) => (a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0);
+
+/** Validate and canonicalise a raw snapshot object. */
+export function normaliseSnapshot(raw) {
+  const snap = typeof raw === 'string' ? JSON.parse(raw) : raw;
+  if (snap?.schema !== SCHEMA) throw new Error(`snapshot schema is ${snap?.schema}, expected ${SCHEMA}`);
+  if (!Array.isArray(snap.kinds) || !Array.isArray(snap.usages)) throw new Error('snapshot needs kinds[] and usages[]');
+  return canonicalise({
+    ...snap,
+    kinds: [...snap.kinds].sort(bySlug),
+    usages: [...snap.usages].sort(bySlug),
+  });
+}
+
+export function serialiseSnapshot(snap) {
+  return `${JSON.stringify(snap, null, 2)}\n`;
+}
+
+const code = (s) => `\`${String(s).replace(/\|/g, '\\|')}\``;
+const dash = '—';
+
+function usageMap(snap) {
+  return new Map(snap.usages.map((u) => [u.slug, u]));
+}
+
+function productKinds(snap) {
+  return snap.kinds.filter((k) => k.level === 'product');
+}
+
+const acceptsProductType = (k) => (k.declared_in || []).includes(PRODUCT_TYPE_DECL);
+
+function statusNote(k) {
+  return k.status === 'active' ? '' : ` _(${k.status})_`;
+}
+
+function prodCell(u) {
+  if (!u) return dash;
+  if (u.deploy_route) return code(u.deploy_route);
+  return u.inapplicable_reason ? `${dash} (${u.inapplicable_reason})` : dash;
+}
+
+/** skills/new: the product-level kind table. */
+export function renderNewTable(snap) {
+  const usages = usageMap(snap);
+  const kinds = productKinds(snap);
+  const accepted = kinds.filter(acceptsProductType).length;
+  const lines = [
+    `_${kinds.length} product-level kinds; ${accepted} accepted by \`--product-type\` today. Generated from \`rpms_kinds\` (schema \`${snap.schema}\`) by \`scripts/gen-rpms-kind-tables.mjs\` — do not hand-edit._`,
+    '',
+    '| kind | level | usage | ship | deploy | home | `--product-type` today |',
+    '|---|---|---|---|---|---|---|',
+  ];
+  for (const k of kinds) {
+    const u = usages.get(k.usage);
+    lines.push([
+      '',
+      `${code(k.slug)}${statusNote(k)}`,
+      k.level,
+      code(k.usage),
+      u?.ship_route ? code(u.ship_route) : dash,
+      prodCell(u),
+      k.home_template ? code(k.home_template) : dash,
+      acceptsProductType(k) ? 'yes' : dash,
+      '',
+    ].join(' | ').trim());
+  }
+  return lines;
+}
+
+/** skills/open: kind -> build/dev/prod routes. */
+export function renderOpenTable(snap) {
+  const usages = usageMap(snap);
+  const lines = [
+    `_Generated from \`rpms_kinds\` + \`rpms_usages\` (schema \`${snap.schema}\`) by \`scripts/gen-rpms-kind-tables.mjs\` — do not hand-edit. Product-level kinds only; every other level is in \`select rpms_kinds_snapshot()\`._`,
+    '',
+    '| kind | home | build · dev (`ship_route`) | runtime | prod (`deploy_route`) |',
+    '|---|---|---|---|---|',
+  ];
+  for (const k of productKinds(snap)) {
+    const u = usages.get(k.usage);
+    lines.push([
+      '',
+      `${code(k.slug)}${statusNote(k)}`,
+      k.home_template ? code(k.home_template) : dash,
+      u?.ship_route ? code(u.ship_route) : dash,
+      u?.runtime ? code(u.runtime) : dash,
+      prodCell(u),
+      '',
+    ].join(' | ').trim());
+  }
+  return lines;
+}
+
+/** Replace the delimited block in `text` with `lines`, keeping the marker indent. */
+export function replaceBlock(text, lines, file) {
+  const eol = text.includes('\r\n') ? '\r\n' : '\n';
+  const src = text.split(/\r?\n/);
+  const b = src.findIndex((l) => l.trim() === BEGIN);
+  const e = src.findIndex((l, i) => i > b && l.trim() === END);
+  if (b < 0 || e < 0) throw new Error(`${file}: missing ${BEGIN} … ${END} markers`);
+  const indent = src[b].match(/^\s*/)[0];
+  const body = lines.map((l) => (l ? indent + l : ''));
+  return [...src.slice(0, b + 1), ...body, ...src.slice(e)].join(eol);
+}
+
+const TARGETS = [
+  { file: path.join('skills', 'new', 'SKILL.md'), render: renderNewTable },
+  { file: path.join('skills', 'open', 'SKILL.md'), render: renderOpenTable },
+];
+
+function main(argv) {
+  const check = argv.includes('--check');
+  const fromIdx = argv.indexOf('--from');
+  if (fromIdx >= 0) {
+    if (check) throw new Error('--from and --check are exclusive');
+    const raw = readFileSync(path.resolve(argv[fromIdx + 1]), 'utf8');
+    writeFileSync(SNAPSHOT, serialiseSnapshot(normaliseSnapshot(raw)));
+    console.log(`snapshot written: ${path.relative(ROOT, SNAPSHOT)}`);
+  }
+
+  const onDisk = readFileSync(SNAPSHOT, 'utf8');
+  const snap = normaliseSnapshot(onDisk);
+  const stale = [];
+  if (serialiseSnapshot(snap) !== onDisk) stale.push(`${path.relative(ROOT, SNAPSHOT)} (not canonical)`);
+
+  for (const t of TARGETS) {
+    const abs = path.join(ROOT, t.file);
+    const before = readFileSync(abs, 'utf8');
+    const after = replaceBlock(before, t.render(snap), t.file);
+    if (after === before) continue;
+    stale.push(t.file);
+    if (!check) writeFileSync(abs, after);
+  }
+
+  if (check && stale.length) {
+    console.error(`rpms kind tables out of date (${stale.length}): ${stale.join(', ')} — run: node scripts/gen-rpms-kind-tables.mjs`);
+    return 1;
+  }
+  console.log(check ? 'rpms kind tables current' : `rpms kind tables: ${stale.length} file(s) rewritten`);
+  return 0;
+}
+
+if (path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+  try {
+    process.exit(main(process.argv.slice(2)));
+  } catch (err) {
+    console.error(`gen-rpms-kind-tables: ${err.message}`);
+    process.exit(2);
+  }
+}

package/scripts/lib/plugins/static-call-reference.mjs

@@ -0,0 +1,109 @@
+// Resolve known POSSIBLE call targets, not observed runtime calls. A dynamic
+// key into a closed literal registry can select any of its entries, just as
+// either branch of an if can call its target. Open/escaped registries stay
+// unresolved. These private parser facts do not change the public unit schema.
+function unwrap(node) {
+  while (node && ['as_expression', 'satisfies_expression', 'parenthesized_expression', 'non_null_expression'].includes(node.type)) node = node.namedChild(0);
+  return node;
+}
+
+function children(node) { return node?.namedChildren ?? []; }
+
+function containsName(node, name) {
+  return node?.text === name || children(node).some(child => containsName(child, name));
+}
+
+function hasAssignment(node, name) {
+  const target = ['assignment_expression', 'augmented_assignment_expression', 'for_in_statement'].includes(node.type)
+    ? node.childForFieldName('left') : node.type === 'update_expression' ? node.childForFieldName('argument') : null;
+  return containsName(target, name) || children(node).some(child => hasAssignment(child, name));
+}
+
+function binding(name, site) {
+  for (let scope = site.parent; scope; scope = scope.parent) {
+    if (['function_expression', 'class', 'class_expression'].includes(scope.type) && scope.childForFieldName('name')?.text === name) return { blocked: true };
+    const parameters = scope.childForFieldName('parameters') ?? scope.childForFieldName('parameter');
+    if (parameters && new RegExp(`\\b${name.replace(/[$]/g, '\\$&')}\\b`).test(parameters.text)) return { blocked: true };
+    if (scope.type === 'for_in_statement' && containsName(scope.childForFieldName('left'), name)) return { blocked: true };
+    if (scope.type === 'for_statement' && containsName(scope.childForFieldName('initializer'), name)) return { blocked: true };
+    if (!['statement_block', 'program'].includes(scope.type)) continue;
+    for (const statement of children(scope)) {
+      const declaration = statement.type === 'export_statement' ? statement.childForFieldName('declaration') : statement;
+      if (declaration?.childForFieldName('name')?.text === name) {
+        return { blocked: scope.type !== 'program' || hasAssignment(scope, name), terminal: true, node: declaration.childForFieldName('name') };
+      }
+      for (const entry of children(declaration)) {
+        if (entry.type !== 'variable_declarator' || !containsName(entry.childForFieldName('name'), name)) continue;
+        return { node: entry.childForFieldName('value'), declaration: entry, scope,
+          blocked: entry.childForFieldName('name')?.type !== 'identifier' || declaration.children[0]?.text !== 'const' || entry.startIndex > site.startIndex };
+      }
+    }
+  }
+  return null;
+}
+
+function hasUnsafeUse(found, name) {
+  let unsafe = false;
+  function visit(node) {
+    if (['identifier', 'shorthand_property_identifier'].includes(node.type) && node.text === name && node.startIndex !== found.declaration.childForFieldName('name').startIndex) {
+      const parent = node.parent;
+      const isSelection = ['member_expression', 'subscript_expression'].includes(parent?.type) && parent.childForFieldName('object')?.id === node.id;
+      let selected = isSelection ? parent : node;
+      while (['parenthesized_expression', 'as_expression', 'non_null_expression', 'array_pattern', 'object_pattern', 'pair_pattern'].includes(selected.parent?.type)) selected = selected.parent;
+      const container = selected.parent;
+      const writesSelection = ['assignment_expression', 'augmented_assignment_expression', 'update_expression', 'unary_expression'].includes(container?.type)
+        || (container?.type === 'for_in_statement' && container.childForFieldName('left')?.id === selected.id);
+      // Passing or aliasing the object can expose it to mutation. No whole-program guess.
+      if (!isSelection || writesSelection) unsafe = true;
+    }
+    for (const child of children(node)) visit(child);
+  }
+  visit(found.scope);
+  return unsafe;
+}
+
+function propertyName(node) {
+  if (!node) return null;
+  if (['property_identifier', 'identifier', 'shorthand_property_identifier'].includes(node.type)) return node.text;
+  if (node.type === 'string') return node.namedChildren.every(child => child.type === 'string_fragment') ? node.text.slice(1, -1) : null;
+  return null;
+}
+
+function resolveValue(node, seen) {
+  node = unwrap(node);
+  if (!node || seen.has(node.id)) return [];
+  seen = new Set([...seen, node.id]);
+  if (node.type === 'identifier' || node.type === 'shorthand_property_identifier') {
+    const found = binding(node.text, node);
+    if (!found) return [node];
+    if (found.blocked) return [];
+    if (found.terminal) return [found.node];
+    return resolveValue(found.node, seen);
+  }
+  if (node.type === 'binary_expression' && node.childForFieldName('operator')?.text === '??') {
+    return [...resolveValue(node.childForFieldName('left'), seen), ...resolveValue(node.childForFieldName('right'), seen)];
+  }
+  if (!['member_expression', 'subscript_expression'].includes(node.type)) return [];
+  const object = node.childForFieldName('object');
+  const keyNode = node.childForFieldName(node.type === 'member_expression' ? 'property' : 'index');
+  // A runtime key gives a set of known possible targets, never a definite one.
+  const key = node.type === 'subscript_expression' && keyNode?.type !== 'string' ? null : propertyName(keyNode);
+  if (object?.type !== 'identifier') return [];
+  const found = binding(object.text, node);
+  if (!found || found.blocked || found.terminal || hasUnsafeUse(found, object.text)) return [];
+  // An exported object can be mutated by another module; const seals only its binding.
+  if (found.declaration.parent?.parent?.type === 'export_statement') return [];
+  const registry = unwrap(found.node);
+  if (registry?.type !== 'object' || registry.namedChildren.some(entry => !['pair', 'shorthand_property_identifier'].includes(entry.type))) return [];
+  const keys = registry.namedChildren.map(entry => propertyName(entry.childForFieldName('key') ?? entry));
+  if (keys.includes(null) || keys.includes('__proto__') || new Set(keys).size !== keys.length) return [];
+  const entries = registry.namedChildren.filter((entry, index) => key === null || keys[index] === key);
+  return entries.flatMap(entry => resolveValue(entry.childForFieldName('value') ?? entry, seen));
+}
+
+/** Private parser helper: known possible callees; [] means unresolved, not impossible. */
+export function staticCallReference(node) {
+  return [...new Set(resolveValue(node, new Set())
+    .filter(value => ['identifier', 'shorthand_property_identifier'].includes(value?.type))
+    .map(value => value.text))];
+}

package/scripts/lib/plugins/treesitter.mjs

@@ -141,6 +141,7 @@ import { extractMembers } from '../vendor/codeflow-parser/memberFacts.js';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
+import { staticCallReference } from './static-call-reference.mjs';
 
 const require = createRequire(import.meta.url);
 
@@ -423,9 +424,18 @@ function fieldsOf(bodyNode) {
 function callsOf(bodyNode) {
   const out = [];
   walkSelfAndDescendants(bodyNode, (n) => {
-    if (n.type !== 'call_expression') return;
-    const fn = n.childForFieldName('function');
-    if (fn) out.push(fn.text.replace(/^this\./, ''));
+    const jsx = n.type === 'jsx_opening_element' || n.type === 'jsx_self_closing_element';
+    if (n.type !== 'call_expression' && !jsx) return;
+    const fn = n.childForFieldName(jsx ? 'name' : 'function');
+    if (!fn || (jsx && fn.type === 'identifier' && /^[a-z]/.test(fn.text))) return;
+    const resolved = staticCallReference(fn);
+    if (jsx) {
+      if (resolved.length) out.push(...resolved);
+      else if (fn.type === 'member_expression') out.push(fn.text.replace(/^this\./, ''));
+    } else {
+      out.push(fn.text.replace(/^this\./, ''));
+      out.push(...resolved.filter(target => target !== fn.text));
+    }
   });
   return out;
 }

package/skills/new/SKILL.md

@@ -0,0 +1,154 @@
+---
+name: new
+description: rdc:new <slug> --product-type <t> [--environment <e> --host-type <t> --url <u>] — scaffold and register a new product, then optionally register its deployment environment
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.
+> One checklist upfront, updated in place, shown again at end with a 1-line verdict.
+
+# rdc:new — create and register a product, no register-then-improvise gap
+
+## The gap this closes
+
+`/rdc:open` is gate-only: it resolves an **already-registered** slug and
+refuses to guess a default for one that isn't. Nothing named what to do next.
+The real capability existed one layer down, unwrapped: `rdc-harness create`
+(scaffold + register) and `rdc-harness new` (register a deployment
+environment). This skill is the guided flow over both — pick a product class,
+scaffold it, register the environment(s) it needs, then hand you straight to
+`rdc:open` to confirm.
+
+## Run the script. Do not re-derive this by hand.
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness create <slug> --product-type <t> --monorepo-root <dir>
+npx -y --package=@lifeai/rdc-harness rdc-harness new <slug> --environment <e> --host-type <t> --url <u>
+```
+
+Same package as `rdc:open` — `@lifeai/rdc-harness` on GitHub Packages, needs
+`@lifeai:registry=https://npm.pkg.github.com` in `.npmrc` (full setup:
+`.rdc/guides/agent-bootstrap.md`). `new` needs `@lifeai/rdc-harness@>=0.5.0`
+— the environment-registration verb; anything older 404s the flag.
+
+## Steps
+
+### 1. Pick the kind
+
+Every kind of development lives in ONE place: the RPMS kind registry
+(`public.rpms_kinds` + `public.rpms_usages`; read it with
+`select rpms_kinds_snapshot()`). The table below is **generated from
+`rpms_kinds`** — its level, usage, ship and deploy routes and home all come
+from the registry, never from this file. A new kind is **one row via
+`register_rpms_kind`**; then refresh the snapshot and regenerate
+(rdc-skills: `node scripts/gen-rpms-kind-tables.mjs --from <dump.json>`). Never invent a
+kind here, and never hand-edit the block.
+
+**`--kind <slug>` is the forward name for `--product-type`.** For product-level
+kinds the values are the same slugs. `--product-type` remains the flag the
+current `rdc-harness create` CLI takes — keep passing `--product-type <t>` to
+it, and only for a kind marked **yes** in the last column (the harness enum,
+byte-identical to `repo_registry`'s product-class reference). A product-level
+kind without **yes** is registered in `rpms_kinds` but has no `create`
+scaffold yet: stop and say so rather than picking a near neighbour.
+
+Full guide to every kind at every level (not just product-level), and the path to add a new one:
+`docs/architecture/KINDS.md` in regen-root.
+
+<!-- BEGIN GENERATED: rpms-kinds -->
+_22 product-level kinds; 11 accepted by `--product-type` today. Generated from `rpms_kinds` (schema `rpms.kinds.v1`) by `scripts/gen-rpms-kind-tables.mjs` — do not hand-edit._
+
+| kind | level | usage | ship | deploy | home | `--product-type` today |
+|---|---|---|---|---|---|---|
+| `app` | product | `public-surface` | `pm2-development` | `declared-promotion` | `apps/<slug>/` | yes |
+| `artifact` | product | `export` | `artifact-export` | — (no-production-target) | `artifacts/<slug>/` | yes |
+| `bpmn-process` | product | `process` | `flowable-dev-release` | `flowable-release` | `docs/systems/<system>/bpmn/` | — |
+| `city-tool` | product | `public-surface` | `pm2-development` | `declared-promotion` | `apps/<slug>/` | — |
+| `corpus` | product | `content` | `content-write` | — (content-not-code) | `$CORPUS_ROOT/<CO>/docs/` | yes |
+| `dmn-decision` _(proposed)_ | product | `decision` | `dmn-test-cases` | `flowable-dmn-release` | `docs/systems/<system>/dmn/` | — |
+| `documentation` | product | `export` | `artifact-export` | — (no-production-target) | `docs/<slug>/` | yes |
+| `dsl` _(proposed)_ | product | `language` | `grammar-suite` | — (production-is-registry) | `packages/<pkg>/src/dsl/` | — |
+| `education-piece` | product | `export` | `artifact-export` | — (no-production-target) | `artifacts/<slug>/` | — |
+| `grammar` | product | `language` | `grammar-suite` | — (production-is-registry) | `packages/<pkg>/src/grammar/` | — |
+| `mcp` | product | `agent-tool` | `plugin-registration` | `declared-service-route` | `mcp-servers/<slug>/` | yes |
+| `model` | product | `public-surface` | `pm2-development` | `declared-promotion` | `models/<slug>/` | yes |
+| `ontology` | product | `language` | `grammar-suite` | — (production-is-registry) | `packages/planetary-ontology/src/` | — |
+| `package` | product | `library` | `registry-release` | — (production-is-registry) | `packages/<slug>/` | yes |
+| `prototype` | product | `exploration` | — | — (no-production-target) | `artifacts/<slug>/` | yes |
+| `share-app` | product | `embed` | `pm2-development` | `declared-promotion` | `apps/<slug>/` | yes |
+| `site-html` | product | `static-site` | `static-development` | `declared-promotion` | `sites/<slug>/` | yes |
+| `site-ts` | product | `static-site` | `static-development` | `declared-promotion` | `sites/<slug>/` | yes |
+| `skill` | product | `agent-instruction` | `local-install` | `release-tag` | `skills/<slug>/` | — |
+| `theme` | product | `content` | `content-write` | — (content-not-code) | — | — |
+| `vendor` | product | `library` | `registry-release` | — (production-is-registry) | `vendor/<slug>/` | — |
+| `worker` | product | `edge` | `edge-dev` | `edge-deploy` | `workers/<slug>/` | — |
+<!-- END GENERATED -->
+
+If the ask is a VLAS reference model (`model`), stop here and use `rdc:new-model`
+instead — it registers all four VLAS-required homes; this skill's `create` verb scaffolds files; it does not touch the
+four fixed homes a model needs.
+
+### 2. Scaffold and register
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness create <slug> --product-type <t> --monorepo-root <dir>
+```
+
+Registry-first-then-files: writes `repo_registry` (or the app's row, for a
+monorepo target), then scaffolds. A failure after the registry write is a
+**registered-but-empty** target — `rdc:open <slug>` will resolve it with
+`weDoNotHold` naming what's missing; re-run `create`, do not hand-write the
+registry row to route around it.
+
+### 3. Register the environment(s) it needs
+
+**Dev-vs-prod-and-shared-docker is a class-wide POLICY, not a question this
+step asks you.** `.claude/rules/infrastructure-contract.md` Rule 12 already
+decides it: a public-facing app or site runs on Docker in both dev and main;
+an MCP or daemon stays on PM2 everywhere. Apply that rule, then register
+accordingly — don't prompt the person for a choice the policy already makes:
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness new <slug> --environment dev --host-type <t> --url <dev-url>
+# only if the class is public-facing (app/site) and the work is ready for it:
+npx -y --package=@lifeai/rdc-harness rdc-harness new <slug> --environment prod --host-type <t> --url <prod-url>
+```
+
+`--host-type` names the real runtime (`coolify`, `pm2`, …), not a guess. A
+Coolify target additionally needs `--coolify-uuid <uuid> --coolify-server
+<ip>` — resolve these via `/knowledge`/clauth, never hardcode.
+
+A `dev`-only registration is the normal, complete outcome for most new work —
+**do not register `prod` speculatively.** Prod promotion is a separate,
+later, deliberate act (`/rdc:release`, `/rdc:deploy … promote`).
+
+### 4. Confirm with `rdc:open`
+
+```bash
+npx -y --package=@lifeai/rdc-harness rdc-harness open <slug>
+```
+
+Must return `opened: true` with no `weDoNotHold` entries for the fields this
+skill just set (`product_class`, and `deployment_record` once step 3 ran).
+Any remaining `weDoNotHold` entry names a real gap — do not paper over it by
+re-running `create`/`new` with guessed values.
+
+## Checklist
+
+```
+[ ] kind chosen from the generated rpms_kinds table (--product-type = a "yes" kind), or routed to rdc:new-model
+[ ] rdc-harness create — scaffold + registry write succeeded
+[ ] environment(s) registered per infrastructure-contract Rule 12, not by asking
+[ ] prod NOT registered speculatively (dev-only unless promotion is the actual ask)
+[ ] rdc:open <slug> confirms — opened:true, no unexpected weDoNotHold
+```
+
+## Related
+
+- `rdc:open` — the gate this hands off to; resolves what `new` just registered.
+- `rdc:new-model` — VLAS Reference Models only; registers all four required
+  homes in one gated flow. Use it instead of this skill for a model.
+- `.claude/rules/infrastructure-contract.md` — Rule 12 (Docker vs PM2 by
+  class), and the deployment registry contract `new` writes into.
+- `rdc:deploy` / `rdc:release` — consume the registration this skill creates;
+  prod promotion is their job, not this skill's.

package/skills/open/SKILL.md

@@ -56,9 +56,14 @@ That is a **scoped grant**, not a readout: `permittedActions` and
 to "which checkout do I work in" — it already knows pooled repos want a lane.
 
 **Unresolved is a result, not an error.** `open regen-root` returns
-`weDoNotHold: ["product_class"]`; `open fsm` returns `unknown_slug`. Register the
-target, then open it again — never guess a default and never fall back to
-hand-rolled git.
+`weDoNotHold: ["product_class"]`; `open fsm` returns `unknown_slug`. An
+`unknown_slug` — nothing registered at all — means `rdc:new` next: it
+scaffolds and registers a product of the declared class, then hands back to
+this skill to confirm. A `weDoNotHold` entry on an otherwise-known slug is
+narrower — `rdc-harness new <slug> --environment ...` (also wrapped by
+`rdc:new`) fills in just the missing piece. Either way: register the target,
+then open it again — never guess a default and never fall back to hand-rolled
+git.
 
 **Two targets at once is two calls.** Each returns its own `bindingId` and its
 own `sourceBoundary`; nothing is exclusive. Working `clauth` and `rdc-harness`
@@ -156,14 +161,46 @@ Downstream verbs re-resolve from the registry by slug.
 2. **Target.** Read `productClass`, `workModel`, `delivery` and `weDoNotHold`
    from the same result. `monorepo_path` NULL means a standalone repo, not in
    this tree. Do not re-query the registry for facts the handle already carries.
-3. **Harness.** Name the shape the target's class implies:
-
-   | class | build | dev | prod |
-   |---|---|---|---|
-   | `apps/<name>` | `pnpm --filter @regen/<name> build` | PM2 @ Vultr | Coolify |
-   | `packages/<name>` | `pnpm --filter @regen/<name> build` | imported | `npm publish` |
-   | `sites/`, `models/` | static/vite | PM2 @ Vultr | Coolify |
-   | standalone | its own tooling | — | Coolify |
+3. **Harness.** Name the shape the target's class implies. The routes come
+   from the RPMS kind registry (`rpms_kinds` → `rpms_usages`); this table is
+   **generated from `rpms_kinds`** and never hand-edited. A new kind is one
+   row via `register_rpms_kind`, then (in rdc-skills)
+   `node scripts/gen-rpms-kind-tables.mjs --from <dump.json>`. Full guide to
+   every level, not just product classes: `docs/architecture/KINDS.md` in
+   regen-root.
+
+   <!-- BEGIN GENERATED: rpms-kinds -->
+   _Generated from `rpms_kinds` + `rpms_usages` (schema `rpms.kinds.v1`) by `scripts/gen-rpms-kind-tables.mjs` — do not hand-edit. Product-level kinds only; every other level is in `select rpms_kinds_snapshot()`._
+
+   | kind | home | build · dev (`ship_route`) | runtime | prod (`deploy_route`) |
+   |---|---|---|---|---|
+   | `app` | `apps/<slug>/` | `pm2-development` | `next` | `declared-promotion` |
+   | `artifact` | `artifacts/<slug>/` | `artifact-export` | — | — (no-production-target) |
+   | `bpmn-process` | `docs/systems/<system>/bpmn/` | `flowable-dev-release` | `java` | `flowable-release` |
+   | `city-tool` | `apps/<slug>/` | `pm2-development` | `next` | `declared-promotion` |
+   | `corpus` | `$CORPUS_ROOT/<CO>/docs/` | `content-write` | — | — (content-not-code) |
+   | `dmn-decision` _(proposed)_ | `docs/systems/<system>/dmn/` | `dmn-test-cases` | `java` | `flowable-dmn-release` |
+   | `documentation` | `docs/<slug>/` | `artifact-export` | — | — (no-production-target) |
+   | `dsl` _(proposed)_ | `packages/<pkg>/src/dsl/` | `grammar-suite` | — | — (production-is-registry) |
+   | `education-piece` | `artifacts/<slug>/` | `artifact-export` | — | — (no-production-target) |
+   | `grammar` | `packages/<pkg>/src/grammar/` | `grammar-suite` | — | — (production-is-registry) |
+   | `mcp` | `mcp-servers/<slug>/` | `plugin-registration` | `ts-server` | `declared-service-route` |
+   | `model` | `models/<slug>/` | `pm2-development` | `next` | `declared-promotion` |
+   | `ontology` | `packages/planetary-ontology/src/` | `grammar-suite` | — | — (production-is-registry) |
+   | `package` | `packages/<slug>/` | `registry-release` | — | — (production-is-registry) |
+   | `prototype` | `artifacts/<slug>/` | — | — | — (no-production-target) |
+   | `share-app` | `apps/<slug>/` | `pm2-development` | `next` | `declared-promotion` |
+   | `site-html` | `sites/<slug>/` | `static-development` | `static-html` | `declared-promotion` |
+   | `site-ts` | `sites/<slug>/` | `static-development` | `static-html` | `declared-promotion` |
+   | `skill` | `skills/<slug>/` | `local-install` | — | `release-tag` |
+   | `theme` | — | `content-write` | — | — (content-not-code) |
+   | `vendor` | `vendor/<slug>/` | `registry-release` | — | — (production-is-registry) |
+   | `worker` | `workers/<slug>/` | `edge-dev` | — | `edge-deploy` |
+   <!-- END GENERATED -->
+
+   The concrete build command is the target's own (`pnpm --filter <pkg>
+   build` in a monorepo, its own tooling standalone); the route names what
+   kind of ship and deploy it owes.
 
 4. **Visual-test contract (for an app/site with UI work).** Read the target
    `package.json` and name its `test:ui` command and Playwright config. A
@@ -216,6 +253,8 @@ Downstream verbs re-resolve from the registry by slug.
 
 ## Related
 
+- `rdc:new` — an `unknown_slug` or a `weDoNotHold` gap routes here: scaffold and
+  register a product, or just its deployment environment, then re-open.
 - `guides/work-contract.md` — the contract this skill opens: rows, tiers, proving,
   staleness, and what Stop checks.
 - `rdc:flow` — declares what KIND of work this is. `rdc-work start --type` sets it