@lifeaitools/rdc-skills 0.9.37 → 0.10.0

package/skills/design/SKILL.md

@@ -19,7 +19,7 @@ RDC-owned design execution for Studio and LIFEAI interfaces. This skill is the S
 
 - Studio, Palette Library, brand-token, theme, component, or live-editor work
 - Any design task that must understand RDC's real token tables and Studio routes
-- UI critique, audit, polish, colorize, type, layout, or craft work in `regen-root`
+- UI critique, audit, polish, colorize, type, layout, or craft work in `{PROJECT_ROOT}`
 - Agent-side color-system exploration using Rampa CLI
 - Preparing token-aware implementation instructions for frontend/backend/data agents
 
@@ -166,7 +166,7 @@ Project docs to read for Studio work:
 8. **Verify.**
    - Run scoped tests only.
    - For Studio: prefer route smoke checks, token API checks, and browser screenshots when UI changed.
-   - For CLI prompt work: run `node C:/Dev/rdc-skills/scripts/rdc-design-cli.mjs <command> <brief>` and inspect the generated report under `.rdc/reports/rdc-design-cli/`.
+   - For CLI prompt work: run `node {RDC_SKILLS_ROOT}/scripts/rdc-design-cli.mjs <command> <brief>` and inspect the generated report under `.rdc/reports/rdc-design-cli/`.
 
 ## Command Menu
 
@@ -188,15 +188,15 @@ Project docs to read for Studio work:
 Use the local helper to see exactly how much instruction text the skill is generating before sending it through an agent:
 
 ```powershell
-node C:/Dev/rdc-skills/scripts/rdc-design-cli.mjs studio "audit the Studio palette page"
-node C:/Dev/rdc-skills/scripts/rdc-design-cli.mjs palette "generate a PRT palette workflow"
-node C:/Dev/rdc-skills/scripts/rdc-design-cli.mjs --json theme "RDC earth-forward light theme"
+node {RDC_SKILLS_ROOT}/scripts/rdc-design-cli.mjs studio "audit the Studio palette page"
+node {RDC_SKILLS_ROOT}/scripts/rdc-design-cli.mjs palette "generate a PRT palette workflow"
+node {RDC_SKILLS_ROOT}/scripts/rdc-design-cli.mjs --json theme "RDC earth-forward light theme"
 ```
 
 The helper writes logs to:
 
 ```text
-C:/Dev/rdc-skills/.rdc/reports/rdc-design-cli/
+{RDC_SKILLS_ROOT}/.rdc/reports/rdc-design-cli/
 ```
 
 Each run includes character count, word count, approximate token count, references loaded, and the final prompt text.

package/skills/fixit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rdc:fixit
-description: "Usage `rdc:fixit <description>` — Quick fix under 5 files / 30 min that does not warrant a full plan→build cycle. Creates a minimal work item, makes the change, commits, closes. The only sanctioned bypass of rdc:build."
+description: "Usage `rdc:fixit <description>` — Quick fix under 5 files / 30 min that does not warrant a full plan→build cycle. Creates a minimal work item, makes the change, commits, runs a mandatory code-review pass (pr-review-toolkit:code-reviewer), closes. The only sanctioned bypass of rdc:build."
 ---
 
 > **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
@@ -90,6 +90,31 @@ else
 fi
 ```
 
+### 5.5 Mandatory code-review gate (before submitting implementation report)
+
+⛔ **No fixit closes without a code-review pass.** Even single-file changes go through review.
+
+Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the fixit commit:
+
+```
+Agent({
+  subagent_type: "pr-review-toolkit:code-reviewer",
+  description: "fixit code review",
+  prompt: "Review `git show HEAD` on the development branch. Focus on:
+           bugs, logic errors, security, project-convention adherence (.claude/rules/*).
+           Confidence-based filtering — high-confidence findings only.
+           Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
+           low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
+})
+```
+
+**Severity gate:**
+- `critical` or `high` findings → fix in this same fixit session (do not escalate to rdc:build for the fix itself; the original fixit owns the cleanup), re-commit, re-run review until clean
+- `medium` or `low` findings → record in `implementation_report.flags`; proceed to close
+- Zero findings → proceed to close
+
+Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and proceed.
+
 ### 6. Close and clean up
 
 Submit implementation report first, move to review, then close as validator:

package/skills/fs-mcp/SKILL.md

@@ -11,7 +11,7 @@ description: "Usage `rdc:fs-mcp <task>` — Use the File System MCP bridge for l
 # rdc:fs-mcp — File System MCP Bridge
 
 ## When to Use
-- Claude.ai, Cowork, or another remote surface needs live access to `C:/Dev/regen-root` through the File System MCP.
+- Claude.ai, Cowork, or another remote surface needs live access to `{PROJECT_ROOT}` through the File System MCP.
 - You need to read, search, or list current local repo files without relying on GitHub freshness.
 - You need to write a small/scratch file through FS MCP.
 - You need to move a larger cloud file into the local repo.
@@ -88,7 +88,7 @@ Required Claude.ai handoff shape:
 
 ```json
 {
-  "repo": "LIFEAI/regen-root",
+  "repo": "<owner>/<repo>",
   "remote": "origin",
   "ref": "claude-ai/docs-upload-123",
   "paths": ["docs/plans/foo.md"],

package/skills/overnight/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rdc:overnight
-description: "Usage `rdc:overnight [epic-id|label=<label>]` — Unattended end-to-end: drain the entire work queue autonomously (preplan → plan → build → review → report). Use when leaving Claude to run unsupervised for an extended session."
+description: "Usage `rdc:overnight [epic-id|label=<label>]` — Unattended end-to-end: drain the entire work queue autonomously (preplan → plan → build → review → report). Inherits mandatory per-wave code-review (pr-review-toolkit:code-reviewer) from rdc:build and rdc:review. Use when leaving Claude to run unsupervised for an extended session."
 ---
 
 > **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
@@ -119,6 +119,8 @@ Agents receive the relevant guide file from `.rdc/guides/` (fallback: `.rdc/guid
 After each wave: check `BUILD_STATUS`. If `escalated: true`, log the escalation
 in the overnight doc and continue — don't stop the loop.
 
+**Mandatory code-review gate inherited from rdc:build (Step 9b).** Every wave inside `rdc:build` runs a `pr-review-toolkit:code-reviewer` pass before the next wave dispatches. Critical/high findings reopen the affected work items to `todo` and the next wave fixes them. Overnight does not skip or weaken this gate. If a wave's code-review escalates twice, advisor decides; otherwise the loop continues.
+
 ### 3d. Review
 
 ```

package/skills/plan/SKILL.md

@@ -227,7 +227,7 @@ Q1. Which Coolify project does this app belong to?
     → Record: project_uuid + environment_uuid (staging or production)
 
 Q2. What is the domain?
-    → *.dev.place.fund subdomain? (staging / internal tools)
+    → staging wildcard subdomain? (staging / internal tools)
     → Custom subdomain on an existing zone? (e.g. app.regendevcorp.com)
     → Apex domain? (e.g. place.fund itself)
     → Domain on a different zone entirely? (e.g. skymesasouth.com)
@@ -238,7 +238,7 @@ Q3. Is this domain already in our Cloudflare account?
     → If NS not delegated to Cloudflare: A record in Cloudflare does nothing — must go to registrar
 
 Q4. Does this app need Cloudflare proxy (orange cloud)?
-    → *.dev.place.fund: NEVER proxy — breaks Traefik Let's Encrypt HTTP-01 cert provisioning
+    → Traefik/Let's Encrypt HTTP-01 staging wildcards are often safest unproxied; verify your platform's DNS requirements.
     → Custom domain needing DDoS/CDN: proxy OK only if SSL mode = Full (strict) + origin cert provisioned
     → Any doubt: start unproxied, add proxy after confirming SSL works
 

package/skills/release/SKILL.md

@@ -1,342 +1,111 @@
 ---
 name: rdc:release
-description: "Usage `rdc:release [promote <slug>|rdc-skills|clauth]` — Promote develop→main and deploy to production for any LIFEAI repo (clauth, rdc-skills, regen-root, etc.), or promote a staged app with rdc:release promote <slug>. Requires dev verification first."
+description: "Usage `rdc:release <repo> [version|--patch|--minor|--major|--dry-run]` — bump, commit, tag, push, wait for CI/publish, install, and verify a package or project using repo-local release metadata."
 ---
 
 > **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
 > Checklist-only output. No tool-call narration. No raw git/npm/CI dumps.
 > One checklist upfront, updated in place, shown again at end with 1-line verdict.
 
-> **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag — checklist runs, each destructive step echoes `[RDC_TEST] skipping <step>` instead of mutating state.
+> **Sandbox contract:** This skill honors `RDC_TEST=1` per `guides/agent-bootstrap.md` § RDC_TEST Sandbox Contract. Destructive external calls short-circuit under the flag.
 
-# rdc:release — Atomic LIFEAI Release
-
-## Purpose
-
-One skill. All repos. No confusion about which release path to use.
-
-When user says **"release"**, **"publish"**, **"promote"**, **"deploy to main"**, **"ship"**, or **"bump the version"** — this is the skill. Always. No exceptions.
-
-Dave has Bash access. He should never be asked to run commands. This skill runs the complete loop and shows one checklist + one verdict.
+# rdc:release — Generic Release
 
 ## When to Use
-- User says "release", "publish", "promote", "deploy to main", "ship", or "bump the version"
-- A package, plugin, or app needs to be versioned and pushed to its distribution channel
-- After landing significant changes that must be published (clauth, rdc-skills, regen-media, gws)
-- After develop is verified and staging passes — promoting to main
-- User says "promote studio", "release studio to production", "ship the app" — use `promote <slug>` mode
-
-**Never release autonomously.** This skill ONLY runs when the user explicitly invokes it. Never push to main on your own initiative.
 
-## Arguments
+- The user explicitly asks to release, publish, promote, ship, tag, or bump a repo.
+- A package or app needs versioning plus verification.
+- A repo provides release metadata in `package.json`, `.rdc/release.json`, README release instructions, or CI config.
 
-- `rdc:release <repo>` — patch bump (default), full loop
-- `rdc:release <repo> <version>` — explicit version (e.g. `1.6.0`)
-- `rdc:release <repo> --minor` | `--major` | `--patch` — semver bump
-- `rdc:release <repo> --dry-run` — show checklist and planned version, do nothing
-- `rdc:release promote <slug>` — promote a specific deployed app from staging → production
-- `rdc:release promote <slug> --dry-run` — show what would happen, do nothing
-- `rdc:release` (no args) — list known repos, ask which
+Never release without explicit user authorization.
 
-## Known Repos — The Single Lookup Table
+## Inputs
 
-Resolve `<repo>` here. If not in this table, ask Dave for source path + deploy mechanism before proceeding.
+- `rdc:release <repo>` — patch release by default.
+- `rdc:release <repo> <version>` — explicit version.
+- `rdc:release <repo> --patch|--minor|--major`
+- `rdc:release <repo> --dry-run`
 
-| Repo | Type | Source path | Release mechanism | Post-release |
-|------|------|-------------|-------------------|--------------|
-| `clauth` | npm package | `C:/Dev/clauth` | bump + tag → GitHub Actions → npm publish | `npm install -g @lifeaitools/clauth@latest` → daemon restart |
-| `rdc-skills` | local install | `C:/Dev/rdc-skills` | bump + tag → `install.sh` | copy to `~/.claude/skills/user/` + project |
-| `regen-root` | monorepo | `C:/Dev/regen-root` | merge develop→main via GitHub PR → Coolify auto-deploys | run `rdc:deploy <affected-slug>` gate checks |
-| `regen-media` | MCP server (in monorepo) | `C:/Dev/regen-root/mcp-servers/regen-media` | part of regen-root release — use `rdc:release regen-root` | Coolify redeploys `regen-media-mcp` from main |
-| `gws` | MCP server (in monorepo) | `C:/Dev/regen-root/mcp-servers/gws` | part of regen-root release — use `rdc:release regen-root` | Coolify redeploys from main |
+If `<repo>` is not resolvable from the current workspace, ask for its local path or GitHub slug.
 
-> **MCP servers inside the monorepo** (`regen-media`, `gws`) are released as part of `regen-root`. Coolify watches main and auto-deploys each app by its `watch_paths`. Don't release them separately.
-
----
-
-## Checklists
-
-### Package release checklist (clauth, rdc-skills)
+## Checklist
 
 ```
-rdc:release: <repo> vX.Y.Z → vA.B.C
+rdc:release: <repo> vX.Y.Z -> vA.B.C
+[ ] PUBLISH.md status gate: status=active AND prod in environments (block if not)
 [ ] Source path resolved
-[ ] Working tree clean (git status)
-[ ] Current version detected (package.json)
+[ ] Release metadata read
+[ ] Working tree clean or user-approved dirty scope identified
+[ ] Current version detected
 [ ] New version computed
-[ ] Dry-run gate (if --dry-run, stop here and print planned commands)
-[ ] package.json bumped
+[ ] Dry-run gate handled
+[ ] Version files updated
+[ ] Tests/self-test passed
+[ ] Mandatory release code-review (pr-review-toolkit:code-reviewer on `git diff <last-released-tag>..HEAD`). Block release on `critical`/`high` findings; record `medium`/`low` in the release notes and proceed.
 [ ] Commit created
-[ ] Tag vA.B.C created + pushed
-[ ] CI completion event received via clauth channel (mcp__claude_ai_clauth__channel_list)
-[ ] CI concluded successfully (failure → pull logs via gh run view --log-failed)
-[ ] npm registry shows vA.B.C (npm view @lifeaitools/<repo> version)
-[ ] Local install executed
-[ ] Installed version verified
-[ ] Post-install action (daemon restart if clauth)
+[ ] Tag created
+[ ] Branch and tag pushed
+[ ] CI/publish status verified
+[ ] Registry/package/deploy target shows vA.B.C, if applicable
+[ ] Local install/update executed, if applicable
+[ ] Installed/runtime version verified
 [ ] Smoke test passed
-✅ rdc:release <repo>: vA.B.C live
-```
-
-### App promote checklist (promote <slug>)
-
-This mode promotes a single deployed app. It does NOT push `git push origin main` directly — it uses the GitHub PR merge API, which bypasses the `block-main-push` hook by design. The hook blocks autonomous pushes; explicit promotion via this skill is authorized by the user invoking it.
-
-```
-rdc:release promote: <slug> → <domain>
-[ ] Registry lookup (slug, coolify_uuid, domain, staging_slug, staging_domain, app_version)
-[ ] Staging health gate (HTTP 200 on staging_domain)
-[ ] Staging TLS valid
-[ ] develop branch clean and pushed
-[ ] Commits ahead of main: <N> commits
-[ ] Dry-run gate (if --dry-run, stop here and print planned commands)
-[ ] app package.json version bumped on develop
-[ ] Version bump committed + pushed to develop
-[ ] GitHub PR develop→main: created or located
-[ ] PR merged via GitHub API (merge method: merge)
-[ ] Coolify auto-deploy confirmed started (polling <slug> deployments)
-[ ] Deployment reached "finished" state
-[ ] Gate: HTTP 200 on <domain>
-[ ] Gate: TLS valid on <domain>
-[ ] deployment_registry updated (last_deploy_at, status='active')
-✅ rdc:release promote <slug>: <domain> live
-```
-
-### Monorepo release checklist (regen-root)
-
-```
-rdc:release: regen-root — develop → main
-[ ] Source path: C:/Dev/regen-root
-[ ] develop branch clean and pushed (git status + git push)
-[ ] Commits ahead of main summarised (git log main..develop --oneline)
-[ ] Dry-run gate (if --dry-run, stop here)
-[ ] Root package.json version bumped on develop
-[ ] Version bump committed + pushed to develop
-[ ] GitHub PR: develop → main created (or existing PR located)
-[ ] PR merged via GitHub API (merge method: merge)
-[ ] main pulled locally (git fetch origin main)
-[ ] Coolify auto-deploy confirmed in progress (poll deployment status)
-[ ] Affected apps gate-checked via rdc:deploy health probes
-[ ] deployment_registry updated (last_deploy_at)
-✅ rdc:release regen-root: main promoted, Coolify deployed
-```
-
----
-
-## Execution Details
-
-> **Notification paths by repo type:**
-> - **Public repos** (rdc-skills, clauth): GitHub Actions POSTs to clauth channel on publish — wait for `mcp__claude_ai_clauth__channel_list` event, not a polling loop
-> - **Private repos** (regen-root): Coolify webhook is wired to Supabase — check `deployment_registry` for deploy completion, not the clauth channel
-
-### Package repos (clauth, rdc-skills)
-
-#### 1. Version bump
-- Read `package.json`, parse `version`
-- Apply: patch (default), minor, major, or explicit
-- Rewrite all `version` fields (some packages have `claude.version` too)
-
-#### 2. Commit + tag + push
-```bash
-cd <source_path>
-git add package.json
-git commit -m "chore(release): vA.B.C"
-git tag vA.B.C
-git push && git push --tags
+✅ rdc:release <repo>: vA.B.C live and verified
 ```
-Never `--no-verify`. Never `--force`. Fix pre-commit hook failures at root cause.
-
-#### 3. Wait for CI via clauth channel (rdc-skills and clauth)
 
-Both repos have a GitHub Actions workflow that POSTs to `https://clauth.prtrust.fund/channel` on publish completion. **Do not poll `gh run list` in a loop.** Use the Monitor tool or check the channel:
+## PUBLISH.md Status Gate (Step 0 — before any production-touching step)
 
-```
-# Check clauth channel for the completion event:
-mcp__claude_ai_clauth__channel_list (since: <tag-push-timestamp>)
-# Wait for event with text containing "vA.B.C" and status "success" or "failure"
-# If no event after 10 min → fallback: gh run list --repo LIFEAI/<repo> --limit 3
-```
+Before touching any production system, read `PUBLISH.md` from the app root and validate promotion eligibility.
 
-If the channel event shows failure, pull the run logs before proceeding:
 ```bash
-gh run view <databaseId> --repo LIFEAI/<repo> --log-failed
+PUBLISH_MD="<monorepo_path>/PUBLISH.md"
 ```
 
-#### 4. Verify npm registry
+**Block promotion if ANY of the following are true:**
 
-```bash
-npm view @lifeaitools/<repo> version   # must equal vA.B.C
-```
-
-Only run this after the channel event confirms success — don't poll npm independently.
-
-#### 5. Install
-- **clauth:** `npm install -g @lifeaitools/clauth@latest`
-- **rdc-skills:** `node C:/Dev/rdc-skills/scripts/install-rdc-skills.js`
-  - If install script fails, fall back:
-    `cp -r C:/Dev/rdc-skills/skills/* ~/.claude/plugins/cache/rdc-skills/rdc-skills/latest/skills/`
-
-#### 6. Verify
-- **clauth:** `curl -s http://127.0.0.1:52437/ping | python3 -c "import sys,json; print(json.load(sys.stdin)['app_version'])"` — must match vA.B.C
-- **rdc-skills:** `ls ~/.claude/skills/user/rdc-release/SKILL.md` — must exist
-- **npm:** `npm list -g --depth=0 @lifeaitools/clauth` — version matches
+1. **PUBLISH.md is missing AND the app has a row in `app_deployments`** — emit warn and continue (during rollout period); becomes a hard block after Option A rollout is complete.
+2. **PUBLISH.md exists AND `status` field is NOT `active`** — hard block regardless of rollout status.
+   - `status: draft` → `BLOCKED: PUBLISH.md status=draft for <slug> — promote requires status=active`
+   - `status: deprecated` → `BLOCKED: PUBLISH.md status=deprecated for <slug> — promote requires status=active`
+3. **PUBLISH.md exists AND `environments` array does not include `prod`** → `BLOCKED: PUBLISH.md environments=[dev] for <slug> — prod must be declared before promotion`
+4. **Any required surface field is missing** (`source_dir` or `path` absent on any surface) → `BLOCKED: PUBLISH.md surface <id> missing required field for <slug>`
 
-#### 7. Post-install
-- **clauth:** `curl -s -X POST http://127.0.0.1:52437/restart` → wait 3s → ping again
-- **rdc-skills:** none
+If blocked, abort immediately with the message above. Do NOT proceed to the version bump, commit, or any Coolify call.
 
-#### 8. Smoke test
-- **clauth:** `curl -s http://127.0.0.1:52437/v/supabase-anon` — expect a non-empty JWT string
-- **rdc-skills:** read frontmatter of one new/updated SKILL.md — parse succeeds
+If PUBLISH.md is absent and app has no `app_deployments` row (library/package), skip this gate.
 
----
+## Resolution Order
 
-### App promote (promote <slug>)
+1. Current repo if `<repo>` is `.` or omitted and the user clearly refers to the current workspace.
+2. Sibling directory matching `<repo>`.
+3. GitHub slug `<owner>/<repo>`.
+4. Repo-local `.rdc/release.json` if present.
+5. Ask for the missing path or release mechanism.
 
-#### 1. Registry lookup
-```sql
-SELECT slug, display_name, domain, staging_slug, staging_domain, coolify_uuid, monorepo_path, environment
-FROM deployment_registry
-WHERE slug = '<slug>';
-```
-If no `staging_slug` or `staging_domain`, ask Dave before proceeding — don't assume.
+## Generic Commands
 
-#### 2. Staging health gate
-```bash
-curl -s -o /dev/null -w "%{http_code}" https://<staging_domain>/
-# Must return 200. TLS must be valid (no -k flag).
-```
-If staging is not healthy, STOP with `[!]` — don't promote a broken staging.
+Use repo-local package tooling when available. Examples:
 
-#### 3. Git state check
 ```bash
-cd C:/Dev/regen-root
-git status          # must be clean on develop
-git push origin develop
-git log origin/main..develop --oneline   # show what's going to main
-```
-
-#### 4. Version bump
-- Read `apps/<app>/package.json` (use `monorepo_path` from registry), parse `version`
-- Apply patch bump (default) or use explicit version if provided
-- Commit: `chore(release): <slug> vA.B.C`
-- Push to develop
-
-#### 5. GitHub PR merge
-```
-# Check for existing open PR develop→main
-mcp__claude_ai_Github_Proxy_MCP__list_pull_requests (base: main, head: develop)
-
-# If none: create one
-mcp__claude_ai_Github_Proxy_MCP__create_pull_request (base: main, head: develop, title: "chore(release): <slug> vA.B.C")
-
-# Merge it
-mcp__claude_ai_Github_Proxy_MCP__merge_pull_request (merge_method: merge)
-```
-**Note:** This uses the GitHub API — it does NOT run `git push origin main`. The `block-main-push` hook only blocks direct git push, not API merges.
-
-#### 6. Coolify deploy poll
-```bash
-# Use clauth to get Coolify token, then poll the app's deployments
-# Wait for status = "finished" — poll every 15s, 15min timeout
-curl -s -H "Authorization: Bearer $COOLIFY_TOKEN" \
-  "https://deploy.regendevcorp.com/api/v1/applications/<coolify_uuid>/deployments?per_page=1"
-```
-
-#### 7. Gate checks
-```bash
-curl -s -o /dev/null -w "%{http_code}" https://<domain>/   # must return 200
-curl -s -I https://<domain>/ | grep -i "strict-transport"   # TLS
-```
-
-#### 8. Update registry
-```sql
-UPDATE deployment_registry SET last_deploy_at = now(), status = 'active' WHERE slug = '<slug>';
-```
-
----
-
-### Monorepo release (regen-root)
-
-#### 1. Git state check
-```bash
-cd C:/Dev/regen-root
-git status          # must be clean on develop
-git push origin develop   # ensure latest is pushed
-git log origin/main..develop --oneline   # summarise what's going to main
-```
-
-#### 2. Bump root version on develop
-```bash
-# Read current version from package.json, apply patch bump
-# Commit: "chore(release): vA.B.C — promote develop → main"
-git add package.json && git commit -m "chore(release): vA.B.C"
-git push origin develop
+npm version patch --no-git-tag-version
+npm test
+git add package.json package-lock.json
+git commit -m "chore(release): vA.B.C"
+git tag vA.B.C
+git push origin HEAD
+git push origin vA.B.C
+npm view <package-name> version
 ```
 
-#### 3. GitHub PR: develop → main
-- Check for open PR from develop→main: `gh pr list --repo LIFEAI/regen-root --base main --head develop`
-- If exists: use it. If not: create it via `mcp__claude_ai_Github_Proxy_MCP__create_pull_request`
-- Merge via `mcp__claude_ai_Github_Proxy_MCP__merge_pull_request` with `merge_method: merge`
+Never use `--force` or bypass hooks. If a hook fails, fix the cause.
 
-#### 4. Confirm Coolify auto-deploy
+## RDC Skills Package
 
-regen-root is a **private repo**. Coolify's webhook is wired to Supabase — deployment events land there automatically. Do NOT poll the Coolify REST API in a loop. Check Supabase:
-
-```sql
--- Wait for the affected app's deployment to show status = 'finished'
-SELECT slug, last_deploy_at, status, notes
-FROM deployment_registry
-WHERE slug IN (<affected slugs>)
-ORDER BY last_deploy_at DESC;
-```
+For this package, prefer the npm installer binary after publish:
 
-If the registry hasn't updated within 2 minutes of the PR merge, check Coolify directly:
 ```bash
-curl -s -H "Authorization: Bearer $(curl -s http://127.0.0.1:52437/v/coolify-api)" \
-  "https://deploy.regendevcorp.com/api/v1/applications/<uuid>/deployments?per_page=1"
+npm install -g @lifeaitools/rdc-skills@latest
+rdc-skills-install --profile core
 ```
 
-#### 5. Gate checks
-For each affected app, verify: HTTP 200, TLS valid, container running.
-Use `rdc:deploy diagnose <slug>` for any that fail.
-
-#### 6. Update registry
-```sql
-UPDATE deployment_registry SET last_deploy_at = now() WHERE slug IN (<affected slugs>);
-```
-
----
-
-## Failure Modes
-
-| Failure | Marker | Action |
-|---------|--------|--------|
-| Dirty working tree | `[!]` | Abort — show one-line diff summary, ask to commit or stash |
-| Pre-commit hook fails | `[!]` | Fix root cause, re-stage, retry — NEVER `--no-verify` |
-| CI fails | `[!]` | Print run URL + last 20 log lines |
-| npm not registered | `[!]` | Check CI actually published — not a silent skip |
-| PR merge blocked | `[!]` | Show blocker (branch protection, conflict) — resolve and retry |
-| Coolify deploy failed | `[!]` | Run `rdc:deploy diagnose <slug>` — fix before declaring done |
-| Gate non-200 | `[!]` | Don't update registry until fixed |
-
-Show full checklist with `[!]` markers even on failure.
-
----
-
-## Hard Rules
-
-- **Never push directly to `main`** — always via GitHub PR merge (`mcp__claude_ai_Github_Proxy_MCP__merge_pull_request`)
-- **Never `--force`, never `--no-verify`, never `--no-gpg-sign`**
-- **Never declare success** without verified install or verified Coolify gate
-- **Never release without an explicit `rdc:release` invocation** from the user
-- **Monorepo MCP servers** (`regen-media`, `gws`) are released via `rdc:release regen-root` — not separately
-
----
-
-## Related
-
-- `.claude/context/clauth.md` — clauth release source of truth
-- `.claude/context/coolify-deployment.md` — Coolify watch_paths, deploy rules
-- `memory/feedback_version_bump_must_tag.md` — never bump without tagging
-- `memory/feedback_use_rdc_release.md` — "promote/deploy to main" always triggers this skill
+Use `--profile lifeai` only on a workstation that intentionally has the LIFEAI project layout and services.

package/skills/review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rdc:review
-description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc, tests, stale docs, export conflicts across modified packages. Fixes what it can automatically, escalates the rest. Call after rdc:build and before merging to main."
+description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc, tests, stale docs, export conflicts, and a mandatory pr-review-toolkit:code-reviewer pass across modified packages. Fixes what it can automatically, escalates the rest. Call after rdc:build and before merging to main."
 ---
 
 > **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
@@ -80,6 +80,32 @@ description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc
    - Never silently leave orphaned tasks
    - **⛔ Raw `UPDATE work_items SET parent_id = ...` is forbidden** — bypasses RLS and all constraint checks
 
+8b. **Mandatory code-review gate — dispatch pr-review-toolkit:code-reviewer:**
+
+   ⛔ **No CLEAN verdict without a code-review pass.** This is the second half of the quality gate; tsc/vitest catch type and behavior errors, code-reviewer catches logic, security, and convention drift.
+
+   Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the full diff under review:
+
+   ```
+   Agent({
+     subagent_type: "pr-review-toolkit:code-reviewer",
+     description: "rdc:review code-review pass",
+     prompt: "Review `git diff origin/main...HEAD` on the development branch.
+              Focus on: bugs, logic errors, security vulnerabilities, project-convention
+              adherence (.claude/rules/*, CLAUDE.md, engineering-behavior.md).
+              Confidence-based filtering — high-confidence findings only.
+              Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
+              low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
+   })
+   ```
+
+   **Severity gate:**
+   - `critical` or `high` → verdict cannot be CLEAN. Interactive: report and pause. Unattended: auto-fix if mechanical (rename, missing await, obvious null check), otherwise escalate via advisor and mark HAS_ISSUES.
+   - `medium` or `low` → record in the review report's "Issues" section; verdict can still be CLEAN.
+   - Zero findings → log `CODE_REVIEW: CLEAN` and continue.
+
+   Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and continue.
+
 9. **Verification gate — dispatch the verify agent:**
    After any fixes land, run the verify gate on every touched package. See `guides/agents/verify.md`.
    Apply `guides/engineering-behavior.md` while reviewing: flag unnecessary abstraction, drive-by refactors, missing assumptions, hidden uncertainty, out-of-scope edits, and prose-only verification.

package/skills/self-test/SKILL.md

@@ -31,7 +31,7 @@ description: "Usage `rdc:self-test [--strict]` — Validate all rdc:* skills, pl
 Launch the interactive menu — pick tier, pick skill, see live output:
 
 ```bash
-node C:/Dev/rdc-skills/scripts/self-test-ui.mjs
+node {RDC_SKILLS_ROOT}/scripts/self-test-ui.mjs
 ```
 
 Menu options:
@@ -45,9 +45,9 @@ Test output streams live to the terminal. No server, no extra processes.
 
 1. **Run the linter (direct or via UI):**
    ```bash
-   node C:/Dev/rdc-skills/scripts/self-test.mjs
+   node {RDC_SKILLS_ROOT}/scripts/self-test.mjs
    # or interactively:
-   node C:/Dev/rdc-skills/scripts/self-test-ui.mjs
+   node {RDC_SKILLS_ROOT}/scripts/self-test-ui.mjs
    ```
 
 2. **Interpret exit codes:**