@lifeaitools/rdc-skills 0.8.7

package/skills/release/SKILL.md

@@ -0,0 +1,221 @@
+---
+name: rdc:release
+description: >-
+  Atomic release for ANY LIFEAI repo. Usage `rdc:release <repo> [version]` — one skill, all repos. Known repos: clauth, rdc-skills, regen-root, regen-media, gws. Handles npm publish, monorepo develop→main promotion, and MCP server restarts. No user handoff.
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw git/npm/CI dumps.
+> One checklist upfront, updated in place, shown again at end with 1-line verdict.
+
+> **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag — checklist runs, each destructive step echoes `[RDC_TEST] skipping <step>` instead of mutating state.
+
+# rdc:release — Atomic LIFEAI Release
+
+## Purpose
+
+One skill. All repos. No confusion about which release path to use.
+
+When user says **"release"**, **"publish"**, **"promote"**, **"deploy to main"**, **"ship"**, or **"bump the version"** — this is the skill. Always. No exceptions.
+
+Dave has Bash access. He should never be asked to run commands. This skill runs the complete loop and shows one checklist + one verdict.
+
+## When to Use
+- User says "release", "publish", "promote", "deploy to main", "ship", or "bump the version"
+- A package, plugin, or app needs to be versioned and pushed to its distribution channel
+- After landing significant changes that must be published (clauth, rdc-skills, regen-media, gws)
+- After develop is verified and staging passes — promoting to main
+
+## Arguments
+
+- `rdc:release <repo>` — patch bump (default), full loop
+- `rdc:release <repo> <version>` — explicit version (e.g. `1.6.0`)
+- `rdc:release <repo> --minor` | `--major` | `--patch` — semver bump
+- `rdc:release <repo> --dry-run` — show checklist and planned version, do nothing
+- `rdc:release` (no args) — list known repos, ask which
+
+## Known Repos — The Single Lookup Table
+
+Resolve `<repo>` here. If not in this table, ask Dave for source path + deploy mechanism before proceeding.
+
+| Repo | Type | Source path | Release mechanism | Post-release |
+|------|------|-------------|-------------------|--------------|
+| `clauth` | npm package | `C:/Dev/clauth` | bump + tag → GitHub Actions → npm publish | `npm install -g @lifeaitools/clauth@latest` → daemon restart |
+| `rdc-skills` | local install | `C:/Dev/rdc-skills` | bump + tag → `install.sh` | copy to `~/.claude/skills/user/` + project |
+| `regen-root` | monorepo | `C:/Dev/regen-root` | merge develop→main via GitHub PR → Coolify auto-deploys | run `rdc:deploy <affected-slug>` gate checks |
+| `regen-media` | MCP server (in monorepo) | `C:/Dev/regen-root/mcp-servers/regen-media` | part of regen-root release — use `rdc:release regen-root` | Coolify redeploys `regen-media-mcp` from main |
+| `gws` | MCP server (in monorepo) | `C:/Dev/regen-root/mcp-servers/gws` | part of regen-root release — use `rdc:release regen-root` | Coolify redeploys from main |
+
+> **MCP servers inside the monorepo** (`regen-media`, `gws`) are released as part of `regen-root`. Coolify watches main and auto-deploys each app by its `watch_paths`. Don't release them separately.
+
+---
+
+## Checklists
+
+### Package release checklist (clauth, rdc-skills)
+
+```
+rdc:release: <repo> vX.Y.Z → vA.B.C
+[ ] Source path resolved
+[ ] Working tree clean (git status)
+[ ] Current version detected (package.json)
+[ ] New version computed
+[ ] Dry-run gate (if --dry-run, stop here and print planned commands)
+[ ] package.json bumped
+[ ] Commit created
+[ ] Tag vA.B.C created + pushed
+[ ] CI run located (gh run list)
+[ ] CI completed successfully (poll 20s, 10min timeout)
+[ ] npm registry shows vA.B.C (if npm — poll 15s, 3min timeout)
+[ ] Local install executed
+[ ] Installed version verified
+[ ] Post-install action (daemon restart if clauth)
+[ ] Smoke test passed
+✅ rdc:release <repo>: vA.B.C live
+```
+
+### Monorepo release checklist (regen-root)
+
+```
+rdc:release: regen-root — develop → main
+[ ] Source path: C:/Dev/regen-root
+[ ] develop branch clean and pushed (git status + git push)
+[ ] Commits ahead of main summarised (git log main..develop --oneline)
+[ ] Dry-run gate (if --dry-run, stop here)
+[ ] Root package.json version bumped on develop
+[ ] Version bump committed + pushed to develop
+[ ] GitHub PR: develop → main created (or existing PR located)
+[ ] PR merged via GitHub API (merge method: merge)
+[ ] main pulled locally (git fetch origin main)
+[ ] Coolify auto-deploy confirmed in progress (poll deployment status)
+[ ] Affected apps gate-checked via rdc:deploy health probes
+[ ] deployment_registry updated (last_deploy_at)
+✅ rdc:release regen-root: main promoted, Coolify deployed
+```
+
+---
+
+## Execution Details
+
+### Package repos (clauth, rdc-skills)
+
+#### 1. Version bump
+- Read `package.json`, parse `version`
+- Apply: patch (default), minor, major, or explicit
+- Rewrite all `version` fields (some packages have `claude.version` too)
+
+#### 2. Commit + tag + push
+```bash
+cd <source_path>
+git add package.json
+git commit -m "chore(release): vA.B.C"
+git tag vA.B.C
+git push && git push --tags
+```
+Never `--no-verify`. Never `--force`. Fix pre-commit hook failures at root cause.
+
+#### 3. CI poll (clauth only — GitHub Actions publishes to npm)
+```bash
+gh run list --repo LIFEAI/clauth --limit 5 --json status,conclusion,headBranch,databaseId
+# Poll every 20s until conclusion ∈ {success, failure, cancelled} — 10min timeout
+```
+
+#### 4. npm poll (clauth only)
+```bash
+npm view @lifeaitools/clauth version
+# Poll every 15s until new version appears — 3min timeout
+```
+
+#### 5. Install
+- **clauth:** `npm install -g @lifeaitools/clauth@latest`
+- **rdc-skills:** `bash C:/Dev/rdc-skills/scripts/install.sh`
+  - If only 1 file copied (known installer bug), fall back:
+    `cp C:/Dev/rdc-skills/skills/**/*.md ~/.claude/skills/user/ && cp C:/Dev/rdc-skills/skills/**/*.md C:/Dev/regen-root/.claude/skills/user/`
+
+#### 6. Verify
+- **clauth:** `curl -s http://127.0.0.1:52437/ping | python3 -c "import sys,json; print(json.load(sys.stdin)['app_version'])"` — must match vA.B.C
+- **rdc-skills:** `ls ~/.claude/skills/user/rdc-release/SKILL.md` — must exist
+- **npm:** `npm list -g --depth=0 @lifeaitools/clauth` — version matches
+
+#### 7. Post-install
+- **clauth:** `curl -s -X POST http://127.0.0.1:52437/restart` → wait 3s → ping again
+- **rdc-skills:** none
+
+#### 8. Smoke test
+- **clauth:** `curl -s http://127.0.0.1:52437/get/supabase-anon | python3 -c "import sys,json; print('ok' if json.load(sys.stdin).get('value') else 'fail')"` — expect `ok`
+- **rdc-skills:** read frontmatter of one new/updated SKILL.md — parse succeeds
+
+---
+
+### Monorepo release (regen-root)
+
+#### 1. Git state check
+```bash
+cd C:/Dev/regen-root
+git status          # must be clean on develop
+git push origin develop   # ensure latest is pushed
+git log origin/main..develop --oneline   # summarise what's going to main
+```
+
+#### 2. Bump root version on develop
+```bash
+# Read current version from package.json, apply patch bump
+# Commit: "chore(release): vA.B.C — promote develop → main"
+git add package.json && git commit -m "chore(release): vA.B.C"
+git push origin develop
+```
+
+#### 3. GitHub PR: develop → main
+- Check for open PR from develop→main: `gh pr list --repo LIFEAI/regen-root --base main --head develop`
+- If exists: use it. If not: create it via `mcp__claude_ai_Github_Proxy_MCP__create_pull_request`
+- Merge via `mcp__claude_ai_Github_Proxy_MCP__merge_pull_request` with `merge_method: merge`
+
+#### 4. Confirm Coolify auto-deploy
+- Coolify watches `main` for all production apps
+- Poll the deployment for each affected app (identified by which `watch_paths` match changed files)
+- Use clauth daemon + Coolify REST to poll: `GET /api/v1/applications/<uuid>/deployments?per_page=1`
+- Wait for `status = finished`
+
+#### 5. Gate checks
+For each affected app, verify: HTTP 200, TLS valid, container running.
+Use `rdc:deploy diagnose <slug>` for any that fail.
+
+#### 6. Update registry
+```sql
+UPDATE deployment_registry SET last_deploy_at = now() WHERE slug IN (<affected slugs>);
+```
+
+---
+
+## Failure Modes
+
+| Failure | Marker | Action |
+|---------|--------|--------|
+| Dirty working tree | `[!]` | Abort — show one-line diff summary, ask to commit or stash |
+| Pre-commit hook fails | `[!]` | Fix root cause, re-stage, retry — NEVER `--no-verify` |
+| CI fails | `[!]` | Print run URL + last 20 log lines |
+| npm not registered | `[!]` | Check CI actually published — not a silent skip |
+| PR merge blocked | `[!]` | Show blocker (branch protection, conflict) — resolve and retry |
+| Coolify deploy failed | `[!]` | Run `rdc:deploy diagnose <slug>` — fix before declaring done |
+| Gate non-200 | `[!]` | Don't update registry until fixed |
+
+Show full checklist with `[!]` markers even on failure.
+
+---
+
+## Hard Rules
+
+- **Never push directly to `main`** — always via GitHub PR merge (`mcp__claude_ai_Github_Proxy_MCP__merge_pull_request`)
+- **Never `--force`, never `--no-verify`, never `--no-gpg-sign`**
+- **Never declare success** without verified install or verified Coolify gate
+- **Never release without an explicit `rdc:release` invocation** from the user
+- **Monorepo MCP servers** (`regen-media`, `gws`) are released via `rdc:release regen-root` — not separately
+
+---
+
+## Related
+
+- `.claude/rules/clauth.md` — clauth release source of truth
+- `.claude/rules/coolify-deployment.md` — Coolify watch_paths, deploy rules
+- `memory/feedback_version_bump_must_tag.md` — never bump without tagging
+- `memory/feedback_use_rdc_release.md` — "promote/deploy to main" always triggers this skill

package/skills/report/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: rdc:report
+description: >-
+  Usage `rdc:report [--unattended]` — nightly markdown report, writes to .rdc/reports/YYYY-MM-DD.md. Covers completed/open work items, per-project progress, infra status, git stats, test counts.
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.
+> One checklist upfront, updated in place, shown again at end with a 1-line verdict.
+
+> If dispatching subagents or running as a subagent: read `{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md` first (fallback: `{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md`).
+
+> **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag. Git push is skipped under `RDC_TEST=1`.
+
+
+# rdc:report — Nightly Report
+
+## When to Use
+- End of a build session
+- Project lead asks for a report or summary
+- Nightly scheduled task
+- Before handing off to another session
+- Called by `rdc:overnight` at the end of every session
+
+## Arguments
+- `rdc:report` — interactive, prints summary to conversation
+- `rdc:report --unattended` — silent mode, writes file only, returns status block
+
+## Procedure
+
+1. **Query completed work (last 24h or since last report):**
+   ```sql
+   SELECT title, labels, completed_at, notes
+   FROM work_items
+   WHERE completed_at > now() - interval '24 hours'
+   ORDER BY completed_at;
+   ```
+
+2. **Query open work:**
+   ```sql
+   SELECT title, status, priority, labels
+   FROM work_items
+   WHERE status IN ('todo', 'in_progress', 'blocked')
+   ORDER BY priority, created_at;
+   ```
+
+3. **Git stats (since last report or last 24h):**
+   ```bash
+   git log --since="24 hours ago" --shortstat --oneline
+   git diff --shortstat HEAD~N  # where N = commits in window
+   ```
+
+4. **Infrastructure deployment snapshot** (if MCP available):
+   - List all apps with current status
+   - Flag any failures
+
+5. **Write report** to `.rdc/reports/YYYY-MM-DD.md` (fallback: `.rdc/reports/YYYY-MM-DD.md` if `.rdc/` does not exist):
+   ```markdown
+   # Daily Report — YYYY-MM-DD
+
+   ## Completed Today
+   | Item | Project | Priority |
+
+   ## Git Activity
+   - Commits: N
+   - Files changed: N
+   - Lines: +N / -N
+
+   ## Open Work
+   ### Urgent (N)
+   ### High (N)
+   ### Normal (N)
+
+   ## Deployment Status
+   | App | Domain | Status |
+
+   ## Blockers
+   <any blocked items or failed deploys>
+
+   ## Next Session Recommendation
+   <highest priority unstarted work>
+   ```
+
+6. **Check if weekly rollup needed** (if today is Sunday):
+   - Aggregate daily reports for the week
+   - Write `.rdc/reports/week-YYYY-WNN.md` (fallback: `.rdc/reports/week-YYYY-WNN.md`)
+
+7. **Report results:**
+   - Interactive: print summary to conversation
+   - Unattended: no interactive output, emit status block only:
+     ```
+     REPORT_STATUS: { report_path, completed_count, open_count, blockers_count }
+     ```
+
+## Rules
+- Reports go in `.rdc/reports/` (fallback: `.rdc/reports/`) — create dir if missing
+- One report per day — overwrite if re-run same day
+- Keep under 100 lines — scannable, not exhaustive
+- Include links to relevant CLAUDE.md files where helpful
+- Always end with "Next Session Recommendation"
+- Unattended: NEVER print to conversation — write file only

package/skills/review/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: rdc:review
+description: >-
+  Usage `rdc:review [--unattended]` — tests, typecheck, stale docs, export conflicts across modified packages. Fixes issues found. Use after a build session or before merging to main.
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.
+> One checklist upfront, updated in place, shown again at end with a 1-line verdict.
+
+> If dispatching subagents or running as a subagent: read `{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md` first (fallback: `{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md`).
+
+> **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag.
+
+
+# rdc:review — Quality Gate
+
+## When to Use
+- After a build session (especially overnight builds)
+- Before merging development → main/production
+- Project lead asks "review the work", "is everything clean"
+- Before any production deployment
+- Called by `rdc:overnight` after each epic build completes
+
+## Arguments
+- `rdc:review` — interactive review, pauses on issues needing judgment
+- `rdc:review --unattended` — silent mode, auto-fixes everything fixable
+
+## Procedure
+
+1. **Identify modified packages:**
+   ```bash
+   git diff --name-only origin/main...HEAD | grep "^packages/" | cut -d/ -f2 | sort -u
+   ```
+
+2. **Run tests for each modified package:**
+   ```bash
+   cd packages/<name> && npx vitest run 2>&1 | tail -10
+   ```
+   Report: package → test count → pass/fail → new tests added
+
+   **IMPORTANT:** `pnpm build` must NEVER be run (crashes system). Use `npx tsc --noEmit --project <path>/tsconfig.json` for typecheck instead. For packages without tests, typecheck is the verification method. Do NOT run vitest across the entire monorepo — check only modified packages individually.
+
+3. **Check test coverage delta:**
+   ```bash
+   git diff origin/main...HEAD -- packages/*/src/ | grep -c "^+" | head -5
+   git diff origin/main...HEAD -- packages/*/test* packages/*/src/**/*.test.* packages/*/src/**/*.spec.* 2>/dev/null | grep -c "^+" || echo 0
+   ```
+   Flag any package where implementation lines added > 50 but test lines added = 0.
+
+4. **Check for export conflicts:**
+   - Read `packages/*/src/index.ts` for any package with new exports
+   - Look for duplicate export names across the barrel
+   - Verify aliased exports don't shadow each other
+
+5. **Check for TODO/FIXME/HACK:**
+   ```bash
+   grep -rn "TODO\|FIXME\|HACK\|XXX" packages/*/src/ --include="*.ts" --include="*.tsx"
+   ```
+
+6. **Check package versions:**
+   - Any package with significant new code should have a version bump
+   - Compare package.json versions to what's in `docs/SYSTEM-STATE.md`
+
+7. **Check for stale CLAUDE.md:**
+   - If new modules were added to a package, does its CLAUDE.md mention them?
+   - Flag any package where exports grew by >10 lines but CLAUDE.md wasn't updated
+
+8. **Orphan work item audit:**
+   ```sql
+   SELECT id, title, item_type, status, source, created_at::date
+   FROM work_items
+   WHERE parent_id IS NULL
+     AND item_type NOT IN ('epic', 'bug')
+     AND status NOT IN ('done', 'archived')
+   ORDER BY created_at DESC;
+   ```
+   For each orphaned task found:
+   - If it clearly belongs to an open epic → attach it: `UPDATE work_items SET parent_id = '<epic-id>' WHERE id = '<task-id>'`
+   - If unclear → report (interactive) or flag in REVIEW_STATUS (unattended)
+   - Never silently leave orphaned tasks
+
+9. **Verification gate — dispatch the verify agent:**
+   After any fixes land, run the verify gate on every touched package. See `guides/agents/verify.md`.
+   **Iron Law: no CLEAN verdict without fresh evidence.** Quote the vitest + tsc output in the report.
+   If verify fails → do NOT emit CLEAN. Loop back, fix, re-run verify.
+
+10. **Fix issues found:**
+   - Failing tests → fix and commit
+   - Export conflicts → resolve and commit
+   - Missing version bumps → bump and commit
+   - All fixes as separate commits with descriptive messages
+
+   **Judgment calls:**
+   - Interactive: report — don't guess
+   - Unattended: escalate via advisor tool with: error message, surrounding context,
+     two most likely fix paths. Resume with advisor's recommendation.
+     If advisor unavailable: take the most conservative path, flag in status block.
+
+11. **Report:**
+    - Interactive:
+      ```
+      ## Review Results
+      | Package | Tests | Pass/Fail | New Tests | Issues |
+      ## Fixed
+      ## Remaining Issues
+      ## Verdict: CLEAN / HAS ISSUES
+      ```
+    - Unattended: emit status block only:
+      ```
+      REVIEW_STATUS: { verdict: "CLEAN|HAS_ISSUES", packages_checked, tests_passed, tests_failed, new_tests_added, fixes_applied, escalations }
+      ```
+
+## Rules
+- Do NOT run `pnpm build` (crashes system) — vitest only
+- Interactive: fix what you can, flag what needs decision
+- Unattended: fix everything fixable; escalate judgment calls to advisor
+- Each fix is a separate commit (not batched)
+- Always push fixes to origin after committing *(skip if `$RDC_TEST=1` — echo `[RDC_TEST] skipping git push` instead)*
+- Unattended: NEVER pause for input

package/skills/self-test/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: rdc:self-test
+description: >-
+  Usage `rdc:self-test [--strict] [--skill <name>] [--json] [--fix] [--tier2] [--parallel <n>] [--quick]` — validates every rdc-*.md skill: frontmatter, Usage marker, name↔filename match, referenced guides/rules/hooks exist, output contract banner, plugin manifest, duplicate-name + collision checks. Tier 1 static lint; Tier 2 behavioral runs via headless claude in isolated worktrees + Supabase branch. Run before every release.
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw runner dumps — summarize.
+> One checklist upfront, updated in place, shown again at end with a 1-line verdict.
+
+> **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Tier 2 behavioral runs and any git push are skipped under `RDC_TEST=1`; Tier 1 static lint runs normally.
+
+
+# rdc:self-test — Skill Library Self-Test (Tier 1)
+
+## When to Use
+- Before every `rdc:release rdc-skills` tag push
+- After editing any skill description or frontmatter
+- When a skill mysteriously disappears from the menu (backtick bug repro)
+- In CI on every rdc-skills PR (once wired)
+
+## Tiers
+
+| Tier | What it checks | Status |
+|------|----------------|--------|
+| Tier 1 | Static lint — frontmatter, Usage line, referenced files, name match | ✅ live |
+| Tier 2 | Behavioral — headless Claude runs each skill in sandbox, asserts artifacts | ✅ live — 13 manifests, blocked by check-cwd.js hook (see Rules) |
+| Tier 3 | Golden checklists — snapshot output format, regress on drift | 🔒 future |
+
+## Interactive UI
+
+Launch the interactive menu — pick tier, pick skill, see live output:
+
+```bash
+node C:/Dev/rdc-skills/scripts/self-test-ui.mjs
+```
+
+Menu options:
+- **1** — Full Tier 1 test (all skills)
+- **2** — Pick a specific skill from a numbered list
+- **3** — Choose tier (Tier 1 static lint | Tier 2 behavioral | Tier 3 🔒 future)
+
+Test output streams live to the terminal. No server, no extra processes.
+
+## Procedure (Tier 1)
+
+1. **Run the linter (direct or via UI):**
+   ```bash
+   node C:/Dev/rdc-skills/scripts/self-test.mjs
+   # or interactively:
+   node C:/Dev/rdc-skills/scripts/self-test-ui.mjs
+   ```
+
+2. **Interpret exit codes:**
+   - `0` = all skills pass
+   - `1` = at least one FAIL or (in `--strict` mode) at least one WARN
+   - `2` = runner itself crashed (e.g., skills dir unreadable)
+   - `3` = `.claude-plugin/plugin.json` missing entirely (distinct from skill failures)
+
+3. **Common findings and fixes:**
+
+   | Finding code | Cause | Fix |
+   |---|---|---|
+   | `description-backtick-leading` | Folded YAML starts with `` ` `` — parser drops skill | Rewrite description to start with a word |
+   | `usage-marker-missing` | No `` Usage `rdc:name <args>` `` in description | Front-load arg contract |
+   | `usage-marker-mismatch` | `Usage` line references a different skill's name (copy-paste drift) | Fix the skill name in the Usage marker |
+   | `name-filename-mismatch` | frontmatter `name:` ≠ filename | `--fix` auto-renames; or rewrite name |
+   | `guide-not-found` / `rule-not-found` / `hook-not-found` | Dead reference in skill body | Create file or fix link |
+   | `banner-missing` | Skill missing OUTPUT CONTRACT banner | `--fix` auto-inserts |
+   | `manifest-missing` / `manifest-version-mismatch` | `.claude-plugin/plugin.json` missing or out-of-sync with `package.json` | Create/update manifest |
+   | `duplicate-skill-name` / `skill-guide-filename-collision` | Two skills claim same name, or skill collides with agent guide | Rename one |
+   | `orphan-hook` | File under `hooks/` isn't referenced by any skill, settings.json, or plugin.json | Wire it up or delete |
+
+4. **Flags:**
+   - `--strict` — promotes warnings to failures (use in CI and before release)
+   - `--skill <name>` — run against a single skill (e.g. `--skill rdc:build`)
+   - `--json` — machine-readable schema v2 (per-skill `findings[]` with `code` + `level`, plugin_manifest block, global_findings, summary.exit_code). Consumed by Tier 2 runner as pre-gate.
+   - `--fix` — auto-repair fixable findings: insert missing OUTPUT CONTRACT banner, rename files to match frontmatter name. Prints `FIXED:` lines + touched file list so you can git diff + commit. Backtick-leading descriptions are NOT auto-fixed (need human rewrite).
+
+5. **Report to the project lead:**
+   ```
+   Self-test: X/Y pass, Z warnings, W failures
+   Failures: <list>
+   Verdict: PASS | FAIL
+   ```
+
+## Procedure (Tier 2)
+
+Tier 2 runs each skill end-to-end in an isolated sandbox and asserts on observed state (files touched, commits made, work items, exit code). Use it before shipping behavioral changes — Tier 1 alone can't catch runtime drift.
+
+1. **Prerequisites:**
+   - `claude` CLI on PATH (headless mode: `claude --print`)
+   - clauth daemon unlocked (`curl -s http://127.0.0.1:52437/ping`)
+   - Supabase MCP reachable (runner creates a throwaway test branch)
+   - Clean git tree in `rdc-skills` (worktrees are added under `.rdc/sandbox/<run-id>/`)
+
+2. **Run:**
+   ```bash
+   node scripts/self-test.mjs --tier2                    # all skills with manifests
+   node scripts/self-test.mjs --tier2 --skill rdc:build  # single skill
+   node scripts/self-test.mjs --tier2 --parallel 3       # up to 3 skills in parallel
+   node scripts/self-test.mjs --tier2 --quick            # skip long-running assertions
+   ```
+
+3. **What it does:**
+   - Runs Tier 1 as a pre-gate (fails fast if static lint fails)
+   - Creates one Supabase test branch for the run
+   - For each skill: `git worktree add` into `.rdc/sandbox/<run-id>/<skill>/`, sets `RDC_TEST=1`, invokes `claude --print` with the skill prompt, waits for exit
+   - Asserts per the skill's manifest: exit code, files touched, commits made, stdout patterns
+   - Cleans up worktrees + deletes the Supabase branch at the end (even on failure)
+
+4. **Reports:**
+   - `.rdc/reports/self-test-tier2-<iso>.json` — full per-skill result, findings, timings
+   - Exit codes: `0` pass, `1` fail (one or more skills failed assertions), `2` runner error (couldn't set up sandbox / branch)
+
+5. **Adding a new manifest:**
+   - Create `skills/tests/<skill>.test.json` (one per skill, colocated)
+   - Validate the shape against the schema at `scripts/lib/manifest-schema.mjs`
+   - Test it in isolation: `node scripts/self-test.mjs --tier2 --skill rdc:name`
+   - Commit the manifest alongside any skill body changes
+
+## Rules
+- Run Tier 1 **before every `rdc:release rdc-skills`** — it catches the backtick-drift class of bugs that break the skill menu silently.
+- Use `--strict` in CI. Warnings matter in the release path.
+- Do NOT skip findings by relaxing the linter. Fix the skill.
+- Run Tier 2 before tagging a release. Gate the tag if any manifested skill fails.
+- Tier 2 blocker: `check-cwd.js` SessionStart hook blocks headless sessions not launched from the monorepo root — runner uses `--dangerously-skip-permissions` to bypass. If tier2 tests fail with `exit_code: -1`, verify the flag is present in `scripts/lib/runner.mjs`.

package/skills/status/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: rdc:status
+description: >-
+  Usage `rdc:status` — open epics, work items by project, Coolify health, blockers, next recommended action. Read-only situational awareness.
+---
+
+> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
+> Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.
+> One checklist upfront, updated in place, shown again at end with a 1-line verdict.
+
+> If dispatching subagents or running as a subagent: read `{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md` first (fallback: `{PROJECT_ROOT}/.rdc/guides/agent-bootstrap.md`).
+
+
+# rdc:status — Project Dashboard
+
+## When to Use
+- Start of any session
+- Project lead asks "what's the status", "where are we", "what's open"
+- Before deciding what to work on next
+
+## Procedure
+
+1. **Open epics:**
+   ```sql
+   SELECT get_open_epics();
+   ```
+
+2. **Work item counts by status:**
+   ```sql
+   SELECT status, count(*) FROM work_items 
+   WHERE status != 'archived' 
+   GROUP BY status ORDER BY status;
+   ```
+
+3. **Items by label/project (top 10 labels):**
+   ```sql
+   SELECT unnest(labels) as label, count(*), 
+          count(*) FILTER (WHERE status = 'done') as done,
+          count(*) FILTER (WHERE status = 'todo') as todo,
+          count(*) FILTER (WHERE status = 'in_progress') as wip
+   FROM work_items 
+   GROUP BY label ORDER BY count DESC LIMIT 10;
+   ```
+
+4. **Recent activity (last 48 hours):**
+   ```sql
+   SELECT title, status, updated_at 
+   FROM work_items 
+   WHERE updated_at > now() - interval '48 hours'
+   ORDER BY updated_at DESC LIMIT 15;
+   ```
+
+5. **Git status:**
+   ```bash
+   git log --oneline -10
+   git status
+   git branch -v
+   ```
+
+6. **Infrastructure health** (if MCP available):
+   - Get infrastructure overview or diagnose issues
+   - Report any apps with failed builds or down containers
+
+7. **Present as a compact dashboard:**
+   ```
+   ## Open Epics (N)
+   <table>
+   
+   ## Work Items: X done | Y todo | Z in_progress
+   
+   ## Recent (48h)
+   <list>
+   
+   ## Deployments
+   <green/red/yellow status>
+   
+   ## Recommended Next
+   <highest priority unstarted epic>
+   ```
+
+## Rules
+- Keep output concise — this is a glance, not a deep dive
+- Always end with a recommendation for what to work on next
+- After the Recommended Next section, suggest which guide file from `.rdc/guides/` (fallback: `.rdc/guides/`) the recommended work would need
+- Use database MCP for queries (not raw curl)
+- If infrastructure MCP is unavailable, skip deployment status and note it

package/skills/tests/README.md

@@ -0,0 +1,29 @@
+# Tier 2 Test Manifests
+
+Each rdc:* skill has a colocated test manifest at `skills/tests/rdc-<name>.test.json`.
+These drive the Tier 2 behavioral runner (`scripts/self-test.mjs --tier2`).
+
+## Schema
+
+See `../../scripts/lib/manifest-schema.mjs` — the `validateManifest` function
+is the source of truth. Top-level fields:
+
+- `manifest_version` (int) — currently 1
+- `skill` (string) — `rdc:<name>`
+- `description` (string) — what this test verifies
+- `fixture` (object) — prompt, precondition files, env vars
+- `assertions` (object) — what to check after the skill runs
+- `teardown` (object) — cleanup policy
+
+## Authoring a manifest
+
+1. Start from an existing manifest in this dir
+2. Set `fixture.env.RDC_TEST = "1"` (required — sandbox contract)
+3. Write assertions tight enough to catch real regressions but not flaky
+4. Run `node scripts/self-test.mjs --tier2 --skill rdc:<name>` to smoke-test
+5. Commit manifest + any skill changes together
+
+## Adding a new skill
+
+New skills MUST ship with a manifest. Tier 2 CI will block tag push if a
+new skill lands without one.