@lifeaitools/rdc-skills 0.9.38 → 0.10.0

package/skills/release/SKILL.md

@@ -32,6 +32,7 @@ If `<repo>` is not resolvable from the current workspace, ask for its local path
 
 ```
 rdc:release: <repo> vX.Y.Z -> vA.B.C
+[ ] PUBLISH.md status gate: status=active AND prod in environments (block if not)
 [ ] Source path resolved
 [ ] Release metadata read
 [ ] Working tree clean or user-approved dirty scope identified
@@ -40,6 +41,7 @@ rdc:release: <repo> vX.Y.Z -> vA.B.C
 [ ] Dry-run gate handled
 [ ] Version files updated
 [ ] Tests/self-test passed
+[ ] Mandatory release code-review (pr-review-toolkit:code-reviewer on `git diff <last-released-tag>..HEAD`). Block release on `critical`/`high` findings; record `medium`/`low` in the release notes and proceed.
 [ ] Commit created
 [ ] Tag created
 [ ] Branch and tag pushed
@@ -51,6 +53,27 @@ rdc:release: <repo> vX.Y.Z -> vA.B.C
 ✅ rdc:release <repo>: vA.B.C live and verified
 ```
 
+## PUBLISH.md Status Gate (Step 0 — before any production-touching step)
+
+Before touching any production system, read `PUBLISH.md` from the app root and validate promotion eligibility.
+
+```bash
+PUBLISH_MD="<monorepo_path>/PUBLISH.md"
+```
+
+**Block promotion if ANY of the following are true:**
+
+1. **PUBLISH.md is missing AND the app has a row in `app_deployments`** — emit warn and continue (during rollout period); becomes a hard block after Option A rollout is complete.
+2. **PUBLISH.md exists AND `status` field is NOT `active`** — hard block regardless of rollout status.
+   - `status: draft` → `BLOCKED: PUBLISH.md status=draft for <slug> — promote requires status=active`
+   - `status: deprecated` → `BLOCKED: PUBLISH.md status=deprecated for <slug> — promote requires status=active`
+3. **PUBLISH.md exists AND `environments` array does not include `prod`** → `BLOCKED: PUBLISH.md environments=[dev] for <slug> — prod must be declared before promotion`
+4. **Any required surface field is missing** (`source_dir` or `path` absent on any surface) → `BLOCKED: PUBLISH.md surface <id> missing required field for <slug>`
+
+If blocked, abort immediately with the message above. Do NOT proceed to the version bump, commit, or any Coolify call.
+
+If PUBLISH.md is absent and app has no `app_deployments` row (library/package), skip this gate.
+
 ## Resolution Order
 
 1. Current repo if `<repo>` is `.` or omitted and the user clearly refers to the current workspace.

package/skills/review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rdc:review
-description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc, tests, stale docs, export conflicts across modified packages. Fixes what it can automatically, escalates the rest. Call after rdc:build and before merging to main."
+description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc, tests, stale docs, export conflicts, and a mandatory pr-review-toolkit:code-reviewer pass across modified packages. Fixes what it can automatically, escalates the rest. Call after rdc:build and before merging to main."
 ---
 
 > **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
@@ -80,6 +80,32 @@ description: "Usage `rdc:review [--unattended]` — Post-build quality gate: tsc
    - Never silently leave orphaned tasks
    - **⛔ Raw `UPDATE work_items SET parent_id = ...` is forbidden** — bypasses RLS and all constraint checks
 
+8b. **Mandatory code-review gate — dispatch pr-review-toolkit:code-reviewer:**
+
+   ⛔ **No CLEAN verdict without a code-review pass.** This is the second half of the quality gate; tsc/vitest catch type and behavior errors, code-reviewer catches logic, security, and convention drift.
+
+   Dispatch ONE `pr-review-toolkit:code-reviewer` agent on the full diff under review:
+
+   ```
+   Agent({
+     subagent_type: "pr-review-toolkit:code-reviewer",
+     description: "rdc:review code-review pass",
+     prompt: "Review `git diff origin/main...HEAD` on the development branch.
+              Focus on: bugs, logic errors, security vulnerabilities, project-convention
+              adherence (.claude/rules/*, CLAUDE.md, engineering-behavior.md).
+              Confidence-based filtering — high-confidence findings only.
+              Return CODE_REVIEW_COMPLETE with: { critical_count, high_count, medium_count,
+              low_count, findings: [{severity, file:line, issue, suggested_fix}] }."
+   })
+   ```
+
+   **Severity gate:**
+   - `critical` or `high` → verdict cannot be CLEAN. Interactive: report and pause. Unattended: auto-fix if mechanical (rename, missing await, obvious null check), otherwise escalate via advisor and mark HAS_ISSUES.
+   - `medium` or `low` → record in the review report's "Issues" section; verdict can still be CLEAN.
+   - Zero findings → log `CODE_REVIEW: CLEAN` and continue.
+
+   Under `RDC_TEST=1`: echo `[RDC_TEST] skipping code-review dispatch` and continue.
+
 9. **Verification gate — dispatch the verify agent:**
    After any fixes land, run the verify gate on every touched package. See `guides/agents/verify.md`.
    Apply `guides/engineering-behavior.md` while reviewing: flag unnecessary abstraction, drive-by refactors, missing assumptions, hidden uncertainty, out-of-scope edits, and prose-only verification.