rdap-q 1.2.1

package/rdap-q-skill/memory/lessons.md

@@ -0,0 +1,3 @@
+scope: global
+kind: lessons
+records: []

package/rdap-q-skill/memory/patterns.md

@@ -0,0 +1,3 @@
+scope: global
+kind: patterns
+records: []

package/rdap-q-skill/memory/tooling.md

@@ -0,0 +1,3 @@
+scope: global
+kind: tooling
+records: []

package/rdap-q-skill/playbooks/00-bootstrap.md

@@ -0,0 +1,17 @@
+phase: BOOTSTRAP
+do:
+  - resolve home from SKILL.md; if unwritable, record that and use repo state only
+  - read task-relevant project memory, then global memory; do not bulk-load
+  - inspect root, status, branch, remotes, worktrees, languages, manifests, lockfiles, test, CI
+  - do not assume main, a remote, or a package manager
+  - create .rdapq/state files on first write; do not preload every template
+inspect:
+  - git status --short
+  - git branch --show-current
+  - git remote -v
+  - git branch -a
+  - git worktree list
+git_mutation: playbooks/07-git-worktree.md # worktree, commit, push, or audit cleanup only
+out: [scope, assumptions, evidence, risks, iteration-log]
+next: DISCOVERY
+forbid: [imagined_repo, destroying_unrelated_work]

package/rdap-q-skill/playbooks/01-discovery.md

@@ -0,0 +1,9 @@
+phase: DISCOVERY
+sources: [local_source, project_config, upstream_docs, upstream_source, experiment, secondary]
+per_assumption: [record, materiality, needed_evidence, investigate, status]
+block_exit:
+  critical_unknown: true
+  high_unresolved_if: [architecture, interfaces, security, persistence, compatibility, destructive]
+memory: may suggest questions; never replaces evidence; candidates stay unpromoted
+out: [questions, repo, architecture, external, experiments, resolved, unresolved, implications, evidence_ids]
+next: PLAN

package/rdap-q-skill/playbooks/02-planning.md

@@ -0,0 +1,6 @@
+phase: PLAN
+shape: [phases, milestones, tasks]
+task: [id, milestone, objective, files_if_known, evidence, action, commands_or_TBD-EVIDENCE, verification, observable, dependencies]
+plan_weights: {coverage: 15, grounding: 15, architecture: 15, completeness: 10, order: 10, verification: 15, risk: 10, repro: 5, git_safety: 5}
+block_execute_if: [ambiguous_success, critical_assumption_open, imagined_paths, task_without_verification, destructive_without_safeguard, bad_order]
+out: .rdapq/state/plan.md

package/rdap-q-skill/playbooks/03-architecture.md

@@ -0,0 +1,6 @@
+phase: ARCHITECTURE
+when: [interfaces, boundaries, persistence, security, concurrency, integration]
+record: [components, responsibilities, interfaces, data_flow, persistence, compatibility, failures, security, runtime, rejected]
+decision: [decision, evidence, alternatives, why, risks, verification]
+rules: [fit_current_system, no_unrelated_refactor, promote_only_if_durable_and_verified]
+out: decisions.md

package/rdap-q-skill/playbooks/04-implementation.md

@@ -0,0 +1,8 @@
+phase: IMPLEMENT
+loop: [observe, implement, verify, review]
+observe: [affected_code, interfaces, versions, nearby_tests, memory_if_it_affects_the_edit]
+implement: [smallest_change, no_driveby_refactor, preserve_behavior_unless_intended, no_secrets, no_speculative_abstraction]
+verify: planned checks only; an unrun test is not a pass
+review: [status, diff, whitespace, generated, debug, secrets, unrelated, todos]
+close_when: [tasks_done, definition_of_done, verification, diff_reviewed, state_updated, gates]
+vcs: commit only a coherent milestone

package/rdap-q-skill/playbooks/05-verification.md

@@ -0,0 +1,6 @@
+phase: VERIFY
+use_real_stack_only: [unit, integration, e2e, build, lint, format, types, static_analysis, security, race, migration, perf, manual]
+on_fail: [record, severity, cause, return_to_IMPLEMENT, rerun]
+if_cannot_run: "NOT VERIFIED — ENVIRONMENTAL CONSTRAINT"
+forbid: [invented_commands, averaging_a_failure_into_the_score]
+each_result: evidence_id

package/rdap-q-skill/playbooks/06-final-audit.md

@@ -0,0 +1,7 @@
+phase: AUDIT
+stance: disprove completion
+ask: [misread_requirement, unexercised_path, untested_failure, inferred_claim, stale_memory, false_dependency, regression, malformed_input, dependency_down, observable_errors, secrets, races, unintended_interface_change, extra_dependency, debug_or_unused, docs_match, diff_matches_scope]
+memory: [candidates, promotion_test, write_approved_only, invalidate_stale, no_secrets]
+report: [quality, confidence, coverage, gates, defects, unknowns, history, best_remaining, aqc]
+complete_only_if: all_applicable_gates_pass
+say: "Vibe Code Build complete."

package/rdap-q-skill/playbooks/07-git-worktree.md

@@ -0,0 +1,13 @@
+phase: GIT
+when: [worktree_requested, commit_requested, push_requested, audit_cleanup]
+inspect_already_in: playbooks/00-bootstrap.md
+never_without_explicit_authorization: ["git reset --hard", "git clean -fd", "git push --force"]
+forbid: destroying_unrelated_work
+worktree_when_requested:
+  - use the inspected default branch and remote; do not assume main
+  - "git checkout <default> && git pull --ff-only <remote> <default>"
+  - "git worktree add -b gb/<slug> ../gb-<slug>-wt"
+commit_when_milestone: ["git diff --check", "git add -A", "git diff --cached", "git commit -m 'Milestone X.Y: <summary>'"]
+empty_commits: false
+push: "git push -u <remote> <branch>"
+cleanup_after_merge: ["git worktree remove <path>", "git branch -d <branch>"]

package/rdap-q-skill/projects/architecture.md

@@ -0,0 +1,3 @@
+scope: project
+kind: architecture
+records: []

package/rdap-q-skill/projects/decisions.md

@@ -0,0 +1,3 @@
+scope: project
+kind: decisions
+records: []

package/rdap-q-skill/projects/lessons.md

@@ -0,0 +1,3 @@
+scope: project
+kind: lessons
+records: []

package/rdap-q-skill/projects/project.md

@@ -0,0 +1,3 @@
+scope: project
+kind: project
+records: []

package/rdap-q-skill/state/README.md

@@ -0,0 +1,4 @@
+role: task state, not durable memory
+path: .rdapq/state
+create: on first write
+secrets: never

package/rdap-q-skill/state/assumptions.md

@@ -0,0 +1,3 @@
+# classes: SKILL.md facts plus RESOLVED
+records: [] # id, statement, status, materiality, evidence_ids, next
+block: critical UNKNOWN before implementation; unresolved HIGH on architecture, interfaces, security, persistence, compatibility, or destructive work

package/rdap-q-skill/state/decisions.md

@@ -0,0 +1,2 @@
+# fields: playbooks/03-architecture.md decision
+records: []

package/rdap-q-skill/state/evidence.md

@@ -0,0 +1,3 @@
+records: [] # id, type, claim, source, outcome
+types: [OBSERVED, USER_SPECIFIED, VERIFIED_EXTERNAL, INFERRED, UNKNOWN, TEST, BUILD, STATIC_ANALYSIS, RUNTIME, VCS, CONSTRAINT]
+forbid: [unrun_command_as_pass, secrets]

package/rdap-q-skill/state/iteration-log.md

@@ -0,0 +1 @@
+rounds: [] # from, to, reason, gates, unknowns, evidence, memory, quality, confidence, coverage, defects, dQ, effort, decision

package/rdap-q-skill/state/plan.md

@@ -0,0 +1,4 @@
+# task shape: playbooks/02-planning.md
+milestones: [] # id, phase, tasks
+plan_score:
+plan_gates:

package/rdap-q-skill/state/research.md

@@ -0,0 +1,13 @@
+questions: []
+repo: []
+architecture: []
+external: []
+experiments: []
+resolved: []
+unresolved: []
+implications: []
+memory_candidates: []
+evidence_ids: []
+readiness:
+  score:
+  gates:

package/rdap-q-skill/state/risks.md

@@ -0,0 +1,2 @@
+records: [] # id, risk, probability, impact, evidence_ids, mitigation, status
+forbid: invented_risks_to_fill_a_quota

package/rdap-q-skill/state/scope.md

@@ -0,0 +1,9 @@
+goal:
+non_goals: []
+success: []
+constraints: []
+env: []
+risk: "LOW|MODERATE|HIGH|CRITICAL"
+target:
+confidence:
+coverage:

package/rdap-q-skill/state/scorecard.md

@@ -0,0 +1,15 @@
+# weights and anchors: SKILL.md. gate names: core/gates.md
+risk:
+target:
+quality:
+confidence:
+coverage:
+gates:
+critical:
+high:
+unknowns:
+previous:
+delta:
+aqc:
+rows: [] # dimension, score, evidence_ids, gap
+improvements: [] # severity, dQ, risk, effort, confidence, decision

package/rdap-q-skill/templates/final-report.md

@@ -0,0 +1,31 @@
+# fields already defined in SKILL.md and core/exit-logic.md
+result:
+risk:
+target:
+quality:
+confidence:
+coverage:
+gates:
+critical:
+high:
+unknowns:
+aqc:
+history: []
+exit:
+verification: []
+memory:
+  loaded: []
+  added: []
+  superseded: []
+  invalidated: []
+  secrets: NO
+residual: []
+git:
+  branch:
+  commits:
+  pr:
+  default:
+  worktree:
+  status:
+terminal: "COMPLETE|BLOCKED|STALLED|CONSTRAINT_LIMITED|FAILED_VERIFICATION"
+say_if_complete: "Vibe Code Build complete."

package/rdap-q-skill/templates/milestone.md

@@ -0,0 +1,8 @@
+id:
+goal:
+done: []
+tasks: []
+verification: []
+state: [assumptions, evidence, risks, scorecard, iteration-log]
+memory: [candidates_only, no_transient, no_secrets, revalidate_conflicts]
+close: [tasks_done, definition_of_done, verification, diff_reviewed, gates, commit_if_coherent]

package/rdap-q-skill/templates/task.md

@@ -0,0 +1,12 @@
+# shape: playbooks/02-planning.md task
+id:
+milestone:
+objective:
+files:
+evidence: []
+memory: []
+action:
+commands:
+verification:
+observable:
+dependencies:

package/scripts/check-static.js

@@ -0,0 +1,86 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const failures = [];
+
+function read(rel) {
+  return fs.readFileSync(path.join(ROOT, rel), 'utf8');
+}
+
+function ban(rel, pattern, why) {
+  if (pattern.test(read(rel))) failures.push(`${rel}: ${why}`);
+}
+
+function need(rel, pattern, why) {
+  if (!pattern.test(read(rel))) failures.push(`${rel}: ${why}`);
+}
+
+ban('install.sh', /\brm\b/, 'wrapper must not delete user files');
+ban('install.sh', /\|\|\s*true/, 'wrapper must not hide copy failures');
+need('install.sh', /refusing a piped install/, 'wrapper must refuse curl | bash');
+need('install.ps1', /refusing a piped install/, 'wrapper must refuse irm | iex');
+ban('install.ps1', /Remove-Item/, 'wrapper must not delete user files');
+ban('rdap-q-skill/install/install-unix.sh', /rm -rf "\$TARGET\/skills\/rdap-q"/, 'must not delete the live skill before the copy succeeds');
+ban('rdap-q-skill/install/install-unix.sh', /\|\|\s*true/, 'must not hide copy failures');
+need('rdap-q-skill/install/install-unix.sh', /SKILL\.md/, 'must verify the staged skill before swapping');
+need('.gitignore', /^\.code-dr\/$/m, 'diagnostic artifacts must be ignored');
+
+const pkg = JSON.parse(read('package.json'));
+const bin = pkg.bin || {};
+if (bin['rdapq-install'] && String(bin['rdapq-install']).includes('install.sh')) {
+  failures.push('package.json bin.rdapq-install must not point at the shell script');
+}
+if (bin.rdapq !== './bin/rdapq.js' || bin['rdap-q'] !== './bin/rdapq.js') {
+  failures.push('package.json bin entries must point at bin/rdapq.js');
+}
+
+for (const rel of ['bin/rdapq.js', 'lib/installer.js', 'scripts/check-versions.js', 'scripts/check-static.js', 'scripts/materialize-skill-links.js']) {
+  const checked = spawnSync(process.execPath, ['--check', path.join(ROOT, rel)], { encoding: 'utf8' });
+  if (checked.status !== 0) {
+    failures.push(`${rel}: node --check failed\n${checked.stderr}`);
+  }
+}
+
+const pluginPath = path.join(ROOT, '.agents/plugins/rdap-q/plugin.json');
+const plugin = JSON.parse(fs.readFileSync(pluginPath, 'utf8'));
+const base = path.dirname(pluginPath);
+for (const rel of [...(plugin.rules || []), ...(plugin.skills || [])]) {
+  const resolved = path.resolve(base, rel);
+  if (!fs.existsSync(resolved)) {
+    failures.push(`.agents plugin path does not exist: ${rel} -> ${resolved}`);
+  }
+}
+
+need('rdap-q-skill/README.md', /SKILL\.md` is the instruction source/, 'README must point at SKILL.md and not act as a second protocol');
+
+for (const rel of ['manifest.json', 'rdap-q-skill/manifest.json']) {
+  const manifest = JSON.parse(read(rel));
+  const bootstrap = (manifest.phase_load && manifest.phase_load.BOOTSTRAP) || [];
+  if (bootstrap.some((item) => String(item).includes('07-git-worktree'))) {
+    failures.push(`${rel}: BOOTSTRAP must not load the git mutation playbook`);
+  }
+  const events = manifest.event_load || {};
+  const listed = Object.values(events).flat().join('\n');
+  if (listed.includes('constitution.md')) {
+    failures.push(`${rel}: constitution.md must not be an event load`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(events, 'git_mutation')) {
+    failures.push(`${rel}: git_mutation event must point at the worktree playbook`);
+  }
+}
+need('rdap-q-skill/SKILL.md', /BOOTSTRAP: \[playbooks\/00-bootstrap\.md\]/, 'SKILL bootstrap must load inspection only');
+ban('rdap-q-skill/SKILL.md', /methodology_conflict/, 'SKILL must not load the constitution stub');
+if (fs.existsSync(path.join(ROOT, 'rdap-q-skill/core/constitution.md'))) {
+  failures.push('rdap-q-skill/core/constitution.md must stay deleted');
+}
+
+if (failures.length) {
+  process.stderr.write(`${failures.join('\n')}\n`);
+  process.exit(1);
+}
+
+process.stdout.write('static checks ok\n');

package/scripts/check-versions.js

@@ -0,0 +1,86 @@
+'use strict';
+
+/**
+ * package.json is the only version source. Every manifest and the prose
+ * version stamps must match it. Banner text is rendered from package.json
+ * at runtime and must not hardcode a version.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+const version = pkg.version;
+const semver = /(?<![\d.])\d+\.\d+\.\d+(?![\d.])/g;
+const failures = [];
+
+function read(rel) {
+  return fs.readFileSync(path.join(ROOT, rel), 'utf8');
+}
+
+function checkJson(rel, pick) {
+  const data = JSON.parse(read(rel));
+  const found = pick(data);
+  if (found !== version) {
+    failures.push(`${rel}: expected ${version}, found ${found}`);
+  }
+}
+
+function checkProse(rel) {
+  const text = read(rel);
+  const found = text.match(semver) || [];
+  if (!found.includes(version)) {
+    failures.push(`${rel}: does not mention ${version}`);
+  }
+  for (const hit of found) {
+    if (hit !== version) failures.push(`${rel}: stray version ${hit}`);
+  }
+}
+
+checkJson('agentskills.json', (j) => j.version);
+checkJson('marketplace.json', (j) => j.version);
+checkJson('manifest.json', (j) => j.version);
+checkJson('rdap-q-skill/manifest.json', (j) => j.version);
+checkJson('plugin.json', (j) => j.version);
+checkJson('plugins/rdap-q/plugin.json', (j) => j.version);
+checkJson('.agents/plugins/rdap-q/plugin.json', (j) => j.version);
+checkJson('skills.json', (j) => j.skills[0].version);
+checkJson('.grok/skill.json', (j) => j.version);
+checkJson('.codex/skill.json', (j) => j.version);
+checkJson('.claude-plugin/plugin.json', (j) => j.version);
+checkJson('.claude-plugin/marketplace.json', (j) => j.plugins[0].version);
+checkJson('.grok-plugin/marketplace.json', (j) => j.plugins[0].version);
+checkJson('.claude-plugin/plugin-index.json', (j) => j.plugins['rdap-q'].version);
+checkJson('.grok-plugin/plugin-index.json', (j) => j.plugins['rdap-q'].version);
+
+for (const rel of [
+  'README.md',
+  'AGENTS.md',
+  'CLAUDE.md',
+  'GEMINI.md',
+  '.github/copilot-instructions.md',
+  'rdap-q-skill/SKILL.md',
+  'rdap-q-skill/README.md',
+]) {
+  checkProse(rel);
+}
+
+for (const rel of ['bin/rdapq.js', 'lib/installer.js', 'install.sh', 'install.ps1']) {
+  const text = read(rel);
+  const found = text.match(semver) || [];
+  for (const hit of found) {
+    failures.push(`${rel}: hardcoded version ${hit} (read package.json instead)`);
+  }
+}
+
+if (!String(pkg.engines && pkg.engines.node || '').includes('>=18')) {
+  failures.push('package.json engines.node must require >=18');
+}
+
+if (failures.length) {
+  process.stderr.write(`${failures.join('\n')}\n`);
+  process.exit(1);
+}
+
+process.stdout.write(`versions ok (${version})\n`);

package/scripts/materialize-skill-links.js

@@ -0,0 +1,83 @@
+'use strict';
+
+/**
+ * npm does not pack symlink directories. Replace the marketplace skill
+ * mounts with real trees before `npm pack` / `npm publish`, then restore
+ * the symlinks afterwards. Re-entrant: a second materialize is a no-op
+ * while the state file exists (prepack can run twice).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { copyTreeSafe } = require('../lib/installer');
+
+const ROOT = path.resolve(__dirname, '..');
+const STATE = path.join(ROOT, '.rdapq-pack-state.json');
+const LINKS = [
+  '.agents/skills/rdap-q',
+  'plugins/rdap-q/skills/rdap-q',
+];
+
+function assertInsideRepo(resolved) {
+  const rel = path.relative(ROOT, resolved);
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`refusing to materialize a link outside the repo: ${resolved}`);
+  }
+}
+
+function materialize() {
+  if (fs.existsSync(STATE)) return;
+  const state = [];
+  fs.writeFileSync(STATE, '[]\n');
+  try {
+    for (const rel of LINKS) {
+      const abs = path.join(ROOT, rel);
+      const st = fs.lstatSync(abs);
+      if (!st.isSymbolicLink()) {
+        throw new Error(`${rel} is not a symlink; refusing to pack an unexpected tree`);
+      }
+      const target = fs.readlinkSync(abs);
+      const resolved = path.resolve(path.dirname(abs), target);
+      assertInsideRepo(resolved);
+      if (!fs.existsSync(path.join(resolved, 'SKILL.md'))) {
+        throw new Error(`symlink ${rel} does not point at a skill tree`);
+      }
+      fs.unlinkSync(abs);
+      copyTreeSafe(resolved, abs, resolved);
+      state.push({ rel, target });
+      fs.writeFileSync(STATE, `${JSON.stringify(state, null, 2)}\n`);
+    }
+  } catch (err) {
+    restore();
+    throw err;
+  }
+}
+
+function restore() {
+  if (!fs.existsSync(STATE)) return;
+  const state = JSON.parse(fs.readFileSync(STATE, 'utf8'));
+  for (const entry of state) {
+    const abs = path.join(ROOT, entry.rel);
+    fs.rmSync(abs, { recursive: true, force: true });
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.symlinkSync(entry.target, abs);
+  }
+  fs.unlinkSync(STATE);
+}
+
+if (require.main === module) {
+  const cmd = process.argv[2];
+  try {
+    if (cmd === 'materialize') materialize();
+    else if (cmd === 'restore') restore();
+    else {
+      process.stderr.write('usage: node scripts/materialize-skill-links.js materialize|restore\n');
+      process.exit(1);
+    }
+  } catch (err) {
+    process.stderr.write(`error: ${err.message}\n`);
+    process.exit(1);
+  }
+}
+
+module.exports = { LINKS, STATE, materialize, restore };

package/skills.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://raw.githubusercontent.com/agent-skills/spec/main/skills.schema.json",
+  "skills": [
+    {
+      "name": "rdap-q",
+      "version": "1.2.1",
+      "title": "RDAP-Q: Research-Driven Adaptive Planning with Quality Gates",
+      "description": "Vendor-neutral engineering protocol for evidence-first software development, persistent state, calibrated 0-10 scoring, and diminishing-return exit gates.",
+      "entrypoint": "rdap-q-skill/SKILL.md",
+      "invocation": "/rdapq",
+      "repository": "https://github.com/coldcanuk/rdapq",
+      "license": "GPL-3.0-or-later"
+    }
+  ]
+}