@lifeaitools/rdc-skills 0.9.32 → 0.9.34

package/.claude-plugin/plugin.json

@@ -1,11 +1,34 @@
 {
   "name": "rdc",
-  "version": "0.9.32",
+  "version": "0.9.34",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",
     "email": "support@lifeai.tools"
   },
   "homepage": "https://github.com/LIFEAI/rdc-skills",
-  "repository": "https://github.com/LIFEAI/rdc-skills"
+  "repository": "https://github.com/LIFEAI/rdc-skills",
+  "skills": [
+    "build",
+    "co-develop",
+    "collab",
+    "deploy",
+    "design",
+    "fixit",
+    "fs-mcp",
+    "handoff",
+    "help",
+    "overnight",
+    "plan",
+    "preplan",
+    "prototype",
+    "release",
+    "report",
+    "review",
+    "self-test",
+    "status",
+    "terminal-config",
+    "watch",
+    "workitems"
+  ]
 }

package/MANIFEST.md

@@ -47,6 +47,7 @@ All skills have been converted from project-specific to generic/portable:
     ├── fixit/SKILL.md
     ├── status/SKILL.md
     ├── report/SKILL.md
+    ├── co-develop/SKILL.md   [peer-aware Claude/Codex co-development]
     ├── collab/SKILL.md       [claude.ai ↔ Claude Code relay]
     ├── handoff/SKILL.md
     ├── prototype/SKILL.md
@@ -92,6 +93,9 @@ All skills have been converted from project-specific to generic/portable:
 ### Quality (1)
 - rdc:self-test — static lint (tier1) + smoke tests (tier2)
 
+### Collaboration (1)
+- rdc:co-develop — peer-aware Claude/Codex co-development over clauth
+
 ### Agent Guides (10, in `guides/agents/`) — [agent-only — dispatched by rdc:build, not user-invocable]
 - frontend — React, UI, Tailwind
 - backend — API, database, auth

package/commands/build.md

@@ -132,7 +132,7 @@ Read the task title and description, then:
 9. **As agents complete:**
    - Verify commit landed on the development branch
    - Push to origin *(skip if `$RDC_TEST=1` — echo `[RDC_TEST] skipping git push` instead)*
-   - Set work item to `done` with notes
+   - Ensure the agent submitted `implementation_report.codeflow_post`, then set the work item to `review`; the validator closes `done`
    - Continue to next wave
 
    **If an agent fails:**
@@ -142,7 +142,7 @@ Read the task title and description, then:
      BUILD_STATUS: { wave, tasks_done, tasks_failed, commits, escalated: true }
      ```
 
-10. **Final verification gate (mandatory — before marking epic done):**
+10. **Final verification gate (mandatory — before marking work or epic done):**
     Dispatch the verify agent (see `guides/agents/verify.md`) across every package/app touched in this build.
     The Iron Law: **NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE.**
     - Run `npx vitest run --dir <pkg>` fresh for each touched package

package/commands/fixit.md

@@ -87,11 +87,23 @@ else
 fi
 ```
 
-### 6. Close and clean up
+### 6. Report, review, close, and clean up
 
 ```sql
+SELECT submit_implementation_report('<id>'::uuid,
+  '{"tldr":"<one sentence>","assumptions":[],"deviations":[],"uncertainty":[],"detail":"<what was fixed>","flags":[],"transactional":false,"memory_records":[],"codeflow_post":{"agent_session_id":"<agent-session-id>","summary":"<what changed and why>","files_changed":["<path>"],"verification":["<command/evidence>"],"commit":"<hash optional>"}}'::jsonb
+);
+
+SELECT update_work_item_status('<id>'::uuid, 'review',
+  '["Fixed via rdc:fixit; ready for validation"]'::jsonb,
+  '<agent-session-id>',
+  'agent'
+);
+
 SELECT update_work_item_status('<id>'::uuid, 'done',
-  '["Fixed via rdc:fixit"]'::jsonb
+  '["Validator verified rdc:fixit report, CodeFlow post, and checklist evidence"]'::jsonb,
+  '<validator-session-id>',
+  'validator'
 );
 ```
 

package/commands/workitems.md

@@ -66,10 +66,15 @@ Est: <hours>',
 
 ```sql
 SELECT update_work_item_status('<uuid>'::uuid, 'in_progress');
-SELECT update_work_item_status('<uuid>'::uuid, 'done', '["What was completed"]'::jsonb);
+SELECT update_work_item_status('<uuid>'::uuid, 'review', '["Implementation complete; ready for validator"]'::jsonb, '<agent-session-id>', 'agent');
+SELECT update_work_item_status('<uuid>'::uuid, 'done', '["Validator verified implementation report, CodeFlow post, and checklist evidence"]'::jsonb, '<validator-session-id>', 'validator');
 SELECT update_work_item_status('<uuid>'::uuid, 'blocked', '["Why it is blocked"]'::jsonb);
 ```
 
+Non-epic `done` is a validator-only close and requires an existing
+`implementation_report.codeflow_post`, checked required checklist evidence, and
+originating-agent tick audit.
+
 ## Read Tasks in an Epic
 
 ```sql

package/guides/agent-bootstrap.md

@@ -10,6 +10,10 @@ You are a subagent dispatched by the rdc:build supervisor. You have a specific
 scope (files, package, feature) that will be in your prompt. Stay in that scope.
 NEVER modify files outside it.
 
+Read `guides/engineering-behavior.md` next when it is available. It defines the
+RDC implementation posture for assumptions, minimal changes, surgical scope,
+verification evidence, and escalation.
+
 ---
 
 ## Credentials — Daemon Access Pattern
@@ -86,6 +90,18 @@ Never run `pnpm build` or equivalent full builds locally — they consume excess
 Type-check only: `npx tsc --noEmit --project <path>/tsconfig.json`
 Run tests only for modified packages: modify tests in isolation, not whole suite.
 
+### No Foreground Windows
+
+Agent-launched processes must not steal focus. This is a hard local-operator
+rule, not a preference.
+
+- Playwright must run headless. Do not use `--headed`, `--ui`, `codegen`, `open`, `show-report`, or `PWDEBUG=1` in agent sessions.
+- Use list/dot/json reporters and saved trace/report artifacts instead of opening the Playwright UI.
+- PowerShell helpers must use `-WindowStyle Hidden -NonInteractive`, or a hidden wrapper.
+- `Start-Process` must include `-WindowStyle Hidden` or `-WindowStyle Minimized`.
+- `cmd /c start` must use `/min` for intentionally visible tools or `/b` for background work.
+- Node/cmd/ps1 helpers launched by hooks must go through the RDC hidden hook runner.
+
 Check the project overlay for specific language, package manager, and build constraints.
 
 ---
@@ -183,36 +199,83 @@ If you discover that fixing your assigned task would also require changing files
 
 ---
 
-## ⛔ Implementation Report Contract
+## ⛔ Implementation Report + CodeFlow Exit Contract
 
-Every agent MUST follow this protocol before closing any work item as `done`.
+Every implementation agent MUST follow this protocol before moving a work item
+to `review`. Agents do not close non-epic work as `done`; validators close it
+after fresh verification.
 
 ### Step 1 — Tick checklist items as you complete them
 
 ```sql
-SELECT update_checklist_item('<work-item-id>'::uuid, 'item-id', true);
+SELECT update_checklist_item(
+  '<work-item-id>'::uuid,
+  'item-id',
+  true,
+  '<agent-session-id>',
+  'agent',
+  'rpc'
+);
 ```
 
-Call this for each item AS you complete it — not all at once at the end.
+Call this for each item AS you complete it — not all at once at the end. The
+database records every tick in `work_item_checklist_events`. Supervisor and
+validator re-ticks are rejected by the exit gate.
 
 ### Step 2 — Submit implementation report BEFORE marking done
 
 ```sql
 SELECT submit_implementation_report(
   '<work-item-id>'::uuid,
-  '{"tldr":"...","assumptions":[],"deviations":[],"uncertainty":[],"detail":"...","flags":[]}'::jsonb
+  '{
+    "tldr":"...",
+    "assumptions":[],
+    "deviations":[],
+    "uncertainty":[],
+    "detail":"...",
+    "flags":[],
+    "codeflow_post":{
+      "agent_session_id":"<agent-session-id>",
+      "summary":"...",
+      "files_changed":["path/to/file"],
+      "verification":["command or evidence"],
+      "commit":"<optional commit hash>"
+    }
+  }'::jsonb
 );
 ```
 
 Returns `{ flags_count, deviations_count, has_deviations }`. Include this signal in your `AGENT_COMPLETE` report.
 
-### Step 3 — Mark done
+### Step 3 — Move to review
 
 ```sql
-SELECT update_work_item_status('<work-item-id>'::uuid, 'done');
+SELECT update_work_item_status(
+  '<work-item-id>'::uuid,
+  'review',
+  '["Implementation complete; ready for validator"]'::jsonb,
+  '<agent-session-id>',
+  'agent'
+);
+```
+
+If the report or `codeflow_post` is missing, the database raises EXCEPTION.
+
+### Validator close — mark done only after fresh review
+
+```sql
+SELECT update_work_item_status(
+  '<work-item-id>'::uuid,
+  'done',
+  '["Validator verified implementation report, CodeFlow post, and checklist evidence"]'::jsonb,
+  '<validator-session-id>',
+  'validator'
+);
 ```
 
-If any `required: true` checklist item is still unchecked, the DB raises EXCEPTION — fix it first.
+If any `required: true` checklist item is still unchecked, was re-ticked by a
+supervisor/validator, or was ticked by a different session than the originating
+agent, the DB and PreToolUse hook reject the close.
 
 ### Supervisor workflow
 

package/guides/agents/backend.md

@@ -57,8 +57,8 @@ SELECT insert_work_item(
   p_source := 'agent'
 );
 
--- Update
-SELECT update_work_item_status('<uuid>'::uuid, 'done', '["What was done"]'::jsonb);
+-- Implementation agents submit report + CodeFlow post, then move to review
+SELECT update_work_item_status('<uuid>'::uuid, 'review', '["Implementation complete; ready for validator"]'::jsonb, '<agent-session-id>', 'agent');
 ```
 
 **NEVER write raw INSERT/UPDATE against work items.**

package/guides/agents/data.md

@@ -37,7 +37,7 @@ After `apply_migration`: always verify with queries.
 ```sql
 SELECT get_open_epics();
 SELECT insert_work_item(p_title := 'Task', p_priority := 'high', p_labels := ARRAY['data'], p_source := 'agent');
-SELECT update_work_item_status('<uuid>'::uuid, 'done');
+SELECT update_work_item_status('<uuid>'::uuid, 'review', '["Implementation complete; ready for validator"]'::jsonb, '<agent-session-id>', 'agent');
 SELECT get_work_items_by_epic('<epic-uuid>'::uuid);
 ```
 

package/guides/agents/frontend.md

@@ -88,5 +88,5 @@ Never hardcode hex values in components. Always use CSS variables from the app's
 - NEVER overlap with other agents on the same files
 - NEVER modify files outside your assigned scope
 - After completing: commit with descriptive message, push *(skip push if `$RDC_TEST=1` — echo `[RDC_TEST] skipping git push` instead)*
-- Update work item to `done` via `update_work_item_status()`
+- Submit `implementation_report.codeflow_post`, then update work item to `review` via `update_work_item_status(..., p_actor_role := 'agent')`; validators close `done`
 - Write tests FIRST — red → implement → green

package/guides/agents/setup.md

@@ -142,7 +142,7 @@ Use `mcp__claude_ai_Supabase__execute_sql` — no `project_id` needed.
 ## Work Items
 SELECT get_open_epics();
 SELECT insert_work_item(p_title := '...', p_priority := 'high');
-SELECT update_work_item_status('<id>'::uuid, 'done');
+SELECT update_work_item_status('<id>'::uuid, 'review', '["Implementation complete; ready for validator"]'::jsonb, '<agent-session-id>', 'agent');
 Create work items BEFORE starting work.
 
 ## Completion Report
@@ -206,12 +206,14 @@ agents, manages git, enforces hooks, and ships to production.
 
 | Capability | Tool |
 |-----------|------|
-| Read/write repo files | `fs_read`, `fs_write`, `fs_glob`, `fs_grep` |
+| Read/write/import repo files | `fs_read`, `fs_write`, `fs_write_chunk`, `fs_ingest_url`, `fs_import_git_files`, `fs_glob`, `fs_grep` |
 | Query Supabase | Supabase MCP `execute_sql` |
 | GitHub operations | Github Proxy MCP |
 | Credentials | clauth MCP `clauth_get` |
 | Trigger Claude Code | `monkey_dispatch` MCP |
 
+For filesystem decisions, load `rdc:fs-mcp`. It defines when to use direct FS writes, chunked writes, URL ingest, or GitHub-branch import into the dirty local monorepo.
+
 ## Two-Claude Relay
 
 Two channels to communicate with Claude Code:

package/guides/engineering-behavior.md

@@ -0,0 +1,43 @@
+# Engineering Behavior
+
+Use this with `agent-bootstrap.md` for implementation and review work. These
+rules adapt general coding-agent hygiene into the RDC work-item contract.
+
+## Before Editing
+
+- State material assumptions in the work-item report; ask or block when the
+  ambiguity changes architecture, data shape, security, or user-visible scope.
+- Prefer the smallest change that satisfies the assigned checklist rows.
+- Do not add features, abstractions, configurability, or fallback behavior that
+  is not required by the work item.
+- If a simpler path exists than the apparent request, report the tradeoff before
+  widening the implementation.
+
+## While Editing
+
+- Stay inside the assigned files, package, route, or work-item boundary.
+- Match the local style and contracts already in the touched files.
+- Do not reformat, rename, or refactor adjacent code unless the checklist row
+  explicitly requires it.
+- Clean up only the unused imports, variables, files, or branches created by
+  your own change.
+- If existing code looks dead or wrong but is outside scope, list it as a
+  blocker or follow-up. Do not remove it.
+
+## Verification
+
+- Every completed row needs evidence: test output, route probe, SQL result,
+  screenshot artifact, type-check output, CLI transcript, or reviewer citation.
+- Finding an existing file is not evidence. Verify the required behavior.
+- Tick each `decomp-*` and `test-*` checklist item immediately after proving
+  that exact behavior. Do not batch ticks at the end.
+- Record assumptions, deviations, uncertainty, blockers, files changed, and
+  verification in `submit_implementation_report()` before moving to `review`.
+
+## Escalation
+
+- Stop and report `BLOCKED` when the fix requires files outside scope, a broader
+  architectural choice, a missing credential, or a second repeated failure.
+- In unattended mode, choose the most conservative valid path only when the
+  acceptance criteria remain unchanged; otherwise escalate through the advisor
+  path required by the active skill.

package/hooks/foreground-process-gate.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook — block focus-stealing foreground process launches.
+ */
+'use strict';
+
+const hookLog = require('./hook-logger');
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let input = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => { input += chunk; });
+    process.stdin.on('end', () => resolve(input));
+    process.stdin.resume();
+  });
+}
+
+function block(message, details = {}) {
+  hookLog('foreground-process-gate', 'PreToolUse', 'block', details);
+  process.stdout.write(JSON.stringify({
+    systemMessage: `HARD BLOCK — Foreground process launch rejected.\n\n${message}`,
+  }));
+  process.exit(1);
+}
+
+function pass(details = {}) {
+  hookLog('foreground-process-gate', 'PreToolUse', 'pass', details);
+  process.exit(0);
+}
+
+function toolText(raw) {
+  if (typeof raw.tool_input?.command === 'string') return raw.tool_input.command;
+  if (typeof raw.tool_input === 'string') return raw.tool_input;
+  try { return JSON.stringify(raw.tool_input || raw); } catch { return ''; }
+}
+
+function hasHiddenIntent(command) {
+  return /-WindowStyle\s+Hidden/i.test(command) ||
+    /-WindowStyle\s+Minimized/i.test(command) ||
+    /windowsHide\s*:\s*true/i.test(command) ||
+    /CreateNoWindow\s*=\s*\$?true/i.test(command) ||
+    /Start-Job\b/i.test(command) ||
+    /--background\b/i.test(command) ||
+    /\bHEADLESS\s*=\s*(1|true)\b/i.test(command) ||
+    /\bCI\s*=\s*(1|true)\b/i.test(command);
+}
+
+function checkPlaywright(command) {
+  if (!/\b(playwright|@playwright\/test)\b/i.test(command)) return;
+
+  if (/\bplaywright\s+(show-report|codegen|open)\b/i.test(command)) {
+    block(
+      'Playwright report/codegen/open launches foreground UI. Use trace/report files as artifacts, or run a hidden/background smoke wrapper.',
+      { kind: 'playwright-ui' },
+    );
+  }
+
+  if (/(^|[\s;&|])(--headed|--ui|PWDEBUG\s*=\s*1|PWDEBUG\s*=\s*true)(?=$|[\s;&|])/i.test(command)) {
+    block(
+      'Playwright must run headless in agent sessions. Remove `--headed`, `--ui`, and `PWDEBUG=1`; use `--reporter=list` or an artifact trace instead.',
+      { kind: 'playwright-headed' },
+    );
+  }
+}
+
+function checkPowerShell(command) {
+  if (!/\bStart-Process\b/i.test(command)) return;
+  if (hasHiddenIntent(command)) return;
+  block(
+    '`Start-Process` must include `-WindowStyle Hidden` or `-WindowStyle Minimized` for agent-launched node/cmd/ps1/test processes.',
+    { kind: 'start-process' },
+  );
+}
+
+function checkCmdStart(command) {
+  if (!/\bcmd(?:\.exe)?\s+\/c\s+start\b/i.test(command)) return;
+  if (/\bcmd(?:\.exe)?\s+\/c\s+start\s+(""|''|`"")?\s*\/(?:min|b)\b/i.test(command)) return;
+  block(
+    '`cmd /c start` must use `/min` for visible tools or `/b`/a hidden wrapper for background tools.',
+    { kind: 'cmd-start' },
+  );
+}
+
+function checkDirectShellLaunch(command) {
+  if (hasHiddenIntent(command)) return;
+  if (/\bpowershell(?:\.exe)?\b[^|\n]*(?:-File\s+[^|\n]*\.ps1|\.ps1\b)/i.test(command)) {
+    block(
+      'PowerShell script launches from agent tooling must use `-WindowStyle Hidden -NonInteractive` or a hidden wrapper.',
+      { kind: 'powershell-ps1' },
+    );
+  }
+}
+
+async function main() {
+  let raw;
+  try { raw = JSON.parse(await readStdin()); } catch { process.exit(0); }
+  const command = toolText(raw);
+  if (!command) pass({ reason: 'no-command' });
+
+  checkPlaywright(command);
+  checkPowerShell(command);
+  checkCmdStart(command);
+  checkDirectShellLaunch(command);
+
+  pass({ reason: 'clean' });
+}
+
+main().catch((e) => block(`Foreground process gate crashed: ${e.message}`));

package/hooks/hook-logger.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const logPath = path.join(os.homedir(), '.claude', 'hook-events.jsonl');
+
+module.exports = function hookLog(hook, event, verdict, details = {}) {
+  try {
+    fs.mkdirSync(path.dirname(logPath), { recursive: true });
+    fs.appendFileSync(
+      logPath,
+      JSON.stringify({
+        ts: new Date().toISOString(),
+        hook,
+        event,
+        verdict,
+        details,
+      }) + '\n',
+    );
+  } catch (_) {
+    // Hooks should never fail just because telemetry could not be written.
+  }
+};

package/hooks/run-hidden-hook.ps1

@@ -0,0 +1,47 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [string]$HookScript
+)
+
+$ErrorActionPreference = "Stop"
+
+$nodeCmd = Get-Command node.exe -ErrorAction SilentlyContinue
+if (-not $nodeCmd) {
+  $nodeCmd = Get-Command node -ErrorAction SilentlyContinue
+}
+$node = if ($nodeCmd) { $nodeCmd.Source } else { $null }
+if (-not $node) {
+  $node = if ($nodeCmd) { $nodeCmd.Path } else { $null }
+}
+if (-not $node) {
+  [Console]::Error.WriteLine("run-hidden-hook: node was not found on PATH")
+  exit 127
+}
+
+$stdinText = [Console]::In.ReadToEnd()
+
+$psi = [System.Diagnostics.ProcessStartInfo]::new()
+$psi.FileName = $node
+$psi.UseShellExecute = $false
+$psi.CreateNoWindow = $true
+$psi.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
+$psi.RedirectStandardInput = $true
+$psi.RedirectStandardOutput = $true
+$psi.RedirectStandardError = $true
+$psi.Arguments = "`"$HookScript`""
+
+$proc = [System.Diagnostics.Process]::new()
+$proc.StartInfo = $psi
+$null = $proc.Start()
+
+$proc.StandardInput.Write($stdinText)
+$proc.StandardInput.Close()
+
+$stdout = $proc.StandardOutput.ReadToEnd()
+$stderr = $proc.StandardError.ReadToEnd()
+$proc.WaitForExit()
+
+if ($stdout) { [Console]::Out.Write($stdout) }
+if ($stderr) { [Console]::Error.Write($stderr) }
+
+exit $proc.ExitCode