rsc-universal 0.1.1

package/skills/review-management/references/platform-apis.md

@@ -0,0 +1,86 @@
+# Platform APIs — review surfaces
+
+Per-surface wiring: endpoints, auth, roles, limits, and the gotchas that bite. Facts
+dated 2026-06-02. APIs here change faster than the playbook — confirm against the live
+docs before you ship a quota-sensitive integration.
+
+## Google Business Profile (GBP)
+
+**Still on v4 for reviews.** Review management was *not* migrated to the v1 Business
+Profile APIs and has no announced deprecation. List and reply both live under v4.
+
+- **Reply (create or update):**
+  ```text
+  PUT https://mybusiness.googleapis.com/v4/{name=accounts/*/locations/*/reviews/*}/reply
+  body: { "comment": "your reply text" }
+  ```
+  The same `PUT` creates a reply if none exists and overwrites it if one does. There is
+  one reply per review.
+- **Delete a reply:**
+  ```text
+  DELETE https://mybusiness.googleapis.com/v4/{name=...}/reply
+  ```
+- **Auth:** OAuth 2.0, scope `https://www.googleapis.com/auth/business.manage`.
+- **Gate:** only **verified** locations can reply. Unverified → the call fails.
+- **Dead — do not build:** the **Questions-and-Answers API was shut down in November
+  2025.** Any `.../questions` endpoint is gone. Review listing + reply survive; Q&A does
+  not. If old code references Q&A, rip it out.
+- **Quota:** GBP APIs are quota-gated per project; request increases via the API console
+  if you batch replies across many locations.
+
+## Trustpilot
+
+Two **separate** APIs — don't conflate them.
+
+- **Invitation / Invitations API** (earn reviews): generates unique service- or
+  product-review invitation links and emails.
+  - Needs: **Business Unit ID**, customer email, customer name, locale, a `reference`
+    (your order/txn id), and a **template ID**.
+  - Templates exist in **16 languages** — pass the matching `locale`.
+  - This is how you send the FTC-clean ask without gating: same invite to every
+    customer, no sentiment screen.
+- **Service Reviews API** (respond): post a public reply to a service review.
+  - Auth: **Business user OAuth token** (not the public API key).
+  - One reply per review, editable.
+
+## Apple — App Store Connect
+
+**Customer Review Responses** resource: get / create / update / delete.
+
+- **Exactly one response per review**, and it is **editable** (re-`update` to revise).
+- **Roles:** the API user must be **Account Holder, Admin, or Customer Support**. Other
+  roles can read reviews but not respond.
+- **AI review summaries (iOS 18.4+, 2025):** Apple auto-generates a summary of your
+  reviews on the product page. Recurring complaint themes now feed that digest — fixing
+  the underlying issue changes the summary, replying alone does not.
+- Auth: App Store Connect API JWT (issuer + key id + private key), standard ASC scopes.
+
+## Google Play
+
+**Reply-to-Reviews API** via the Google Play Developer API (also available in Play
+Console).
+
+- A developer response is **public** and, per Google's own figure, raises that review's
+  rating by **~0.7 stars on average** — the strongest single argument for ~100% response
+  rate.
+- **Reply window:** Play historically restricts programmatic replies to reviews within a
+  rolling window (commonly cited as ~7 days for the reply API; **confirm against the
+  current Developer API docs** before relying on it for old reviews — answer fresh ones
+  fast).
+- Auth: a Google Play service account with the Developer API enabled.
+
+## Flag / dispute paths (removal, not reply)
+
+Use these only for fake / off-topic / conflict-of-interest / policy-violation reviews —
+never for legitimate negatives.
+
+- **Google:** flag the review from the GBP reviews UI (the three-dot menu → "Report
+  review") or the Business Profile "report a review" support flow. There is no public
+  removal API — it's a human review against Google's content policy.
+- **Trustpilot:** flag the review in the Business portal with a reported reason
+  (defamatory, fake, not based on a genuine experience, etc.); Trustpilot adjudicates.
+- **Apple / Google Play:** report policy-violating reviews through the respective
+  console; removal is at the platform's discretion.
+
+Expect days, not minutes — and expect most legitimate-but-harsh reviews to stay up.
+Plan to reply, not to delete.

package/skills/review-management/scripts/verify.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+#
+# verify.sh — FTC copy-banlist linter for review-request & reply copy.
+#
+# WHAT IT DOES (read-only; never edits or writes a file)
+#   Static, network-free scan over ONE copy file you point it at (a review-request
+#   template, a reply, or a config snippet) — or stdin. It catches the three ways
+#   review copy crosses the FTC Consumer Review Rule line, plus the dead Q&A API:
+#
+#     1. GATING / sentiment-screen phrasing (HARD FAIL) — e.g. "if you loved",
+#        "only if you're happy", "had a bad experience? contact us instead",
+#        "give us 5 stars", "rate us 5". FTC review-suppression risk.
+#     2. INCENTIVE-BY-SENTIMENT phrasing (HARD FAIL) — e.g. "leave a positive
+#        review", "in exchange for a good review", "discount for a 5-star".
+#        You may incentivize a review; you may NOT condition it on sentiment.
+#     3. DEAD-API usage (HARD FAIL) — a "...googleapis.com/v4/.../questions"
+#        endpoint or the literal "Q&A API" in config. Shut down Nov 2025.
+#
+#   A clean OR empty/missing-content file (or empty stdin) exits 0 — no false fail.
+#
+# HOW TO RUN (inside YOUR project, not the skills repo)
+#   ./verify.sh review-copy.md          # scan a file
+#   cat reply.txt | ./verify.sh -        # scan stdin
+#   ./verify.sh -h                       # this help
+#
+# EXIT CODES
+#   0  clean, or empty/missing-content input
+#   1  one or more banlist hits (each printed with its line number)
+#   2  bad usage (no input given, or file does not exist)
+#
+# Runs on stock macOS bash 3.2: no mapfile, no associative arrays, no bc.
+
+set -euo pipefail
+
+if [ -t 1 ]; then
+  RED=$'\033[31m'; GREEN=$'\033[32m'; YELLOW=$'\033[33m'; NC=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; NC=''
+fi
+
+ok()   { printf '%s[ ok ]%s %s\n' "$GREEN"  "$NC" "$*"; }
+hit()  { printf '%s[fail]%s %s\n' "$RED"    "$NC" "$*"; }
+note() { printf '%s%s%s\n'        "$YELLOW" "$*" "$NC"; }
+
+usage() { sed -n '2,38p' "$0" | sed 's/^# \{0,1\}//'; }
+
+INPUT=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -h|--help) usage; exit 0 ;;
+    --) shift; INPUT="${1:-}"; shift || true ;;
+    -) INPUT="-"; shift ;;
+    -*) printf '%sunknown option: %s%s\n' "$RED" "$1" "$NC" >&2; usage; exit 2 ;;
+    *) if [ -z "$INPUT" ]; then INPUT="$1"; fi; shift ;;
+  esac
+done
+
+if [ -z "$INPUT" ]; then
+  printf '%sno input given (pass a file or "-" for stdin)%s\n' "$RED" "$NC" >&2
+  usage; exit 2
+fi
+
+# Resolve input to a temp file so we can grep with line numbers uniformly.
+TMP=""
+cleanup() { [ -n "$TMP" ] && rm -f "$TMP"; return 0; }
+trap cleanup EXIT
+
+if [ "$INPUT" = "-" ]; then
+  TMP="$(mktemp 2>/dev/null || mktemp -t revmgmt)"
+  cat > "$TMP"
+  SRC="$TMP"
+  LABEL="stdin"
+else
+  if [ ! -f "$INPUT" ]; then
+    printf '%sfile not found: %s%s\n' "$RED" "$INPUT" "$NC" >&2
+    exit 2
+  fi
+  SRC="$INPUT"
+  LABEL="$INPUT"
+fi
+
+# Empty / whitespace-only: nothing to check, never a false failure.
+if [ ! -s "$SRC" ] || ! grep -q '[^[:space:]]' "$SRC" 2>/dev/null; then
+  ok "empty input — nothing to check"
+  exit 0
+fi
+
+note "review-management verify — $LABEL"
+printf '\n'
+
+fail_count=0
+
+# Each entry: a label, then an extended-regex of banned phrasings (case-insensitive).
+# Printed with grep -nEi so every hit carries its line number.
+scan() {
+  # $1 = human label, $2 = regex
+  local label="$1" rx="$2" out
+  out="$(grep -nEi "$rx" "$SRC" 2>/dev/null || true)"
+  if [ -n "$out" ]; then
+    while IFS= read -r line; do
+      [ -n "$line" ] && hit "$label — line $line"
+      fail_count=$((fail_count + 1))
+    done <<EOF
+$out
+EOF
+  fi
+}
+
+# 1. Gating / sentiment-screen.
+scan "GATING (FTC review-suppression)" \
+  "if you('| a)?re? (loved|happy|satisfied)|if you loved|only if you('| a)?re? (happy|satisfied)|loved us\??|had a (bad|poor|negative) experience.*(contact|email|reach|instead)|tell us (privately|directly) (first|instead)|give (us|me) (a |an )?5|rate (us|me) (a |an )?5|leave (us )?(a |an )?5[ -]?star|5[ -]?stars? (please|if)|please (give|leave|rate).*5"
+
+# 2. Incentive conditioned on sentiment.
+scan "INCENTIVE-BY-SENTIMENT (FTC banned)" \
+  "leave (a |an )?positive review|positive review (in|for) (exchange|return)|in exchange for (a |an )?(good|positive|5)|discount for (a |an )?(5|positive|good)|(\\\$|€|gift).* for (a |an )?(5|positive|good) (star|review)|reward.* (positive|5[ -]?star) review"
+
+# 3. Dead Google Q&A API.
+scan "DEAD Q&A API (shut down Nov 2025)" \
+  "googleapis\.com/v4/[^[:space:]]*questions|/questions[^a-z]|\bq&a api\b|questions-?and-?answers api"
+
+printf '\n'
+if [ "$fail_count" -gt 0 ]; then
+  printf '%s%d banlist hit(s) — fix before shipping (FTC Consumer Review Rule)%s\n' \
+    "$RED" "$fail_count" "$NC"
+  exit 1
+fi
+ok "clean — no gating, sentiment-incentive, or dead-API phrasing"
+exit 0

package/skills/ruby/SKILL.md

@@ -0,0 +1,316 @@
+---
+name: ruby
+description: "Use when writing idiomatic Ruby outside Rails — plain scripts, CLIs, gems, libraries — or refactoring imperative loops into Enumerable chains, designing module mixins, packaging with Bundler, deciding whether metaprogramming is worth it, or setting up Minitest/RSpec. Triggers: 'write this in Ruby', 'refactor this loop with map/reduce', 'build a gem', 'gemspec / Gemfile.lock', 'method_missing or define_method?', 'Minitest vs RSpec', 'FrozenError after Ruby 3.4 upgrade', 'mixin vs inheritance', 'escribir una gema en Ruby', 'refactoritzar amb blocs'. NOT Rails/ActiveRecord/controllers (that is rails)."
+tags: [ruby, gems, bundler, metaprogramming, rspec, minitest, enumerable]
+recommends: [rails, testing-web, secure-coding]
+profiles: []
+origin: risco
+---
+
+# Idiomatic Ruby, the language
+
+Write Ruby a senior Rubyist would sign off on: expression-oriented, block-driven,
+leaning on `Enumerable` and `Comparable` instead of hand-rolled loops, with
+`frozen_string_literal` hygiene and a real `Gemfile`/`.gemspec` when you package.
+
+This is **Ruby the language and its non-Rails ecosystem** — blocks, modules, gems,
+metaprogramming, Minitest/RSpec. The moment code loads the Rails framework or reaches
+for ActiveRecord/ActiveSupport idioms, it is no longer this skill — that is `rails`.
+
+Targets **Ruby 4.0** (released 2025-12-25) on **3.4** semantics: Prism is the default
+parser, string literals warn on mutation without a magic comment, `it` is an implicit
+block param, and `Set` is now a core class.
+
+## When to use / When NOT to use
+
+**Use when:**
+
+- Authoring or refactoring any plain-Ruby `.rb` file, CLI, script, gem, or library.
+- Turning imperative loops into `Enumerable` chains (`map`/`select`/`reduce`/`each_with_object`/`group_by`).
+- Designing module mixins, `Comparable`/`Enumerable` inclusion, refinements, or value objects (`Struct`/`Data`).
+- Setting up a gem: `bundle gem`, `.gemspec`, SemVer, version constraints, publishing to RubyGems.
+- Deciding whether metaprogramming (`method_missing`, `define_method`, `instance_eval`, DSLs) earns its keep.
+- Writing tests with Minitest or RSpec, wiring RuboCop/Standard, or adding RBS/Sorbet typing.
+
+**When NOT to use (delegate):**
+
+- Rails apps, ActiveRecord models, controllers, migrations, views, Hotwire -> `rails`.
+  The hard line: anything that loads Rails or uses ActiveSupport/ActiveRecord idioms.
+- The same task in another language -> `python`, `go`, `rust`, `elixir`, `php`, `typescript`.
+- A CI pipeline that runs your Ruby tests -> `github-actions` (this skill writes the tests, not the workflow).
+
+## Mental model
+
+Internalize these before writing a line:
+
+1. **Everything is an expression and returns a value.** `if`, `case`, blocks, method
+   bodies all yield a value — name and return it instead of threading a flag.
+2. **Everything is an object receiving messages.** `5.times`, `nil.to_a`, `"x".freeze`.
+   There are no primitives to special-case.
+3. **Reach for `Enumerable` before you write a loop.** A manual index loop in Ruby is
+   almost always a `map`/`select`/`reduce` you have not spotted yet.
+4. **Prefer returning new values to mutating in place.** Mutation is allowed but it is
+   the exception you justify, not the default.
+5. **Freeze your string literals.** New files start with `# frozen_string_literal: true`.
+6. **Dynamism is the trap, not the feature.** Metaprogramming is a scalpel; if a plain
+   method, a `Struct`, or a `Data` does the job, use that.
+
+## Blocks, procs, lambdas, yield
+
+Blocks are the spine of Ruby. A method takes a block implicitly via `yield`, or
+explicitly with `&block` when it must store or forward it.
+
+```ruby
+# frozen_string_literal: true
+
+# Implicit: yield runs the caller's block and returns its value.
+def with_timing
+  start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+  result = yield
+  [result, Process.clock_gettime(Process::CLOCK_MONOTONIC) - start]
+end
+
+# Explicit: capture the block as a Proc to forward or store it.
+def retrying(times, &block)
+  attempts = 0
+  begin
+    block.call
+  rescue StandardError
+    (attempts += 1) < times ? retry : raise
+  end
+end
+```
+
+`proc` vs `lambda` differ in two ways that bite:
+
+| Aspect | `proc` / block | `lambda` / `->` |
+|--------|----------------|-----------------|
+| Arity  | Lenient — extra args dropped, missing become `nil` | Strict — wrong count raises `ArgumentError` |
+| `return` | Returns from the enclosing method (can surprise) | Returns from the lambda only |
+
+Rule: use a **lambda** for a function-like value you call yourself; use a **block/proc**
+for the "do this with each element" pattern. For cheap accumulation prefer
+`each_with_object` (returns the seed) or `reduce`; use `tap` (returns the receiver) for
+side effects and `then` for piping a value through a transform.
+
+```ruby
+# Bad: index loop building a result by mutation.
+result = []
+(0...items.length).each { |i| result << items[i].upcase if items[i].size > 3 }
+
+# Good: intent reads top-to-bottom, no index, no pre-seeded array.
+result = items.select { |s| s.size > 3 }.map(&:upcase)
+```
+
+## Enumerable & Comparable
+
+Most loops map to one named method. Pick by **intent**, not by habit:
+
+| You want to…                          | Use                          |
+|---------------------------------------|------------------------------|
+| Transform every element               | `map`                        |
+| Keep / drop by predicate              | `select` / `reject`          |
+| Fold into one value                   | `reduce` / `sum` / `min_by`  |
+| Build a Hash or accumulate into a seed| `each_with_object`           |
+| Count occurrences                     | `tally`                      |
+| Bucket by a key                       | `group_by`                   |
+| First match                           | `find` (`detect`)            |
+| Pair index with element               | `each_with_index`            |
+
+Make your own classes first-class collections by including `Enumerable` and defining
+`each`; get `<`, `>`, `between?`, `clamp`, `sort` for free by including `Comparable` and
+defining `<=>`.
+
+```ruby
+# frozen_string_literal: true
+
+class Playlist
+  include Enumerable
+
+  def initialize(tracks) = @tracks = tracks
+  def each(&) = @tracks.each(&)   # one method unlocks map/select/sort/...
+end
+
+class Version
+  include Comparable
+  attr_reader :major, :minor
+
+  def initialize(major, minor)
+    @major = major
+    @minor = minor
+  end
+
+  def <=>(other) = [major, minor] <=> [other.major, other.minor]
+end
+```
+
+## Modules & composition
+
+Ruby favors composition through mixins over deep inheritance.
+
+- `include M` — adds `M`'s instance methods to instances (the default mixin).
+- `prepend M` — inserts `M` *before* the class in the lookup chain, so `M`'s methods can
+  wrap the originals via `super` (cleaner than aliasing for decoration).
+- `extend M` — adds `M`'s methods as *class/singleton* methods.
+
+Rule: reach for a **module mixin** when the same behavior is shared across unrelated
+classes; reserve inheritance for a genuine is-a hierarchy. Namespace with `module Foo`
+to avoid global constant clashes. Need to patch a class without polluting it globally?
+Use a **refinement** (`refine … using`) — a scoped, reversible scalpel — never a bare
+monkey-patch. Full refinement scoping and `prepend`-wrapping in
+[references/metaprogramming.md](references/metaprogramming.md).
+
+## Value objects: Data vs Struct
+
+```ruby
+# frozen_string_literal: true
+
+Point  = Data.define(:x, :y)         # immutable value object (Ruby 3.2+)
+origin = Point.new(x: 0, y: 0)       # no setters; with(x: 1) returns a copy
+
+Cursor = Struct.new(:x, :y)          # mutable; has setters and is Enumerable
+```
+
+| Need                                       | Reach for     |
+|--------------------------------------------|---------------|
+| Immutable value with equality + `with`     | `Data.define` |
+| Mutable record, or array/positional access | `Struct.new`  |
+
+Default to `Data` for value semantics; pick `Struct` only when you genuinely need
+mutation or positional/`to_a` behavior.
+
+## Metaprogramming, sparingly
+
+Decision rule, in order: **could a plain method, a `Struct`, or a `Data` do this?**
+If yes, do that. Only when the method *names themselves* are dynamic (driven by data or
+config) does metaprogramming earn its keep.
+
+- Prefer `define_method` (defines real, introspectable methods) over `method_missing`
+  (intercepts at call time, slower, invisible to `respond_to?` and tooling).
+- If you *must* use `method_missing`, you **must** also define `respond_to_missing?` —
+  otherwise `respond_to?`, `method`, and duck-typing all lie about your object.
+- Never `eval` a string built from user input.
+
+```ruby
+# Good: dynamic method names, but real methods that introspect and document themselves.
+class Config
+  def initialize(**data) = @data = data
+
+  %i[host port timeout].each do |key|
+    define_method(key)       { @data[key] }
+    define_method("#{key}=") { |value| @data[key] = value }
+  end
+end
+```
+
+Building a real DSL, `instance_eval`/`class_eval`, and the full
+`method_missing` + `respond_to_missing?` pairing live in
+[references/metaprogramming.md](references/metaprogramming.md).
+
+## Gems & Bundler
+
+Bundler is the universal dependency manager. `bundle init` creates a `Gemfile`;
+`bundle install` resolves and writes `Gemfile.lock`; run project binaries with
+`bundle exec` so they use the locked versions.
+
+- Use the **pessimistic constraint** `~> 2.3` (allows `2.x >= 2.3`, blocks `3.0`) for
+  libraries; pin tighter only when forced.
+- **Commit `Gemfile.lock` for applications** (reproducible installs); for a *library*
+  gem, do not commit the lock — let consumers resolve.
+- Scaffold a gem with `bundle gem NAME`, which generates the `lib/`, `test/`/`spec/`,
+  `.gemspec`, and Rakefile layout.
+
+```ruby
+# my_gem.gemspec
+Gem::Specification.new do |spec|
+  spec.name        = "my_gem"
+  spec.version     = MyGem::VERSION       # SemVer: MAJOR.MINOR.PATCH
+  spec.summary     = "One-line description."
+  spec.authors     = ["You"]
+  spec.files       = Dir["lib/**/*.rb"]
+  spec.required_ruby_version = ">= 3.4"
+  spec.add_dependency "thor", "~> 1.3"
+end
+```
+
+Full `bundle gem` tree, publishing flow (`gem build` / `gem push`), and Rake test tasks
+are in [references/gems-and-testing.md](references/gems-and-testing.md).
+
+## Ruby 4.0 / 3.4 hygiene
+
+```ruby
+# frozen_string_literal: true     # without it, 3.4+ warns under -W:deprecated on mutation
+
+nums.map { it * 2 }               # `it` is the implicit single block param (3.4+)
+seen = Set.new([1, 2, 3])         # Set is a core class in 4.0 — no `require "set"`
+```
+
+- The magic comment freezes every string literal in the file; mutating one then raises
+  `FrozenError`. This is the cause of most "my string froze after upgrading" reports.
+- `it` reads cleaner than `_1` for one-arg blocks.
+- Ruby 4.0 ships **ZJIT** (a new JIT written in Rust, successor to YJIT) and removed
+  `Ractor.yield`/`Ractor#take` in favor of `Ractor::Port`.
+
+## Testing
+
+Both ship a clean path; choose by ceremony tolerance:
+
+| Framework | Pick when… |
+|-----------|-----------|
+| **Minitest** | You want the default — ships with Ruby, tiny surface, `assert`-style or spec-style, fast. |
+| **RSpec** | You want the expressive DSL and large ecosystem (`describe`/`context`/`it`/`expect`, `let`, mocks). |
+
+```ruby
+# test/tally_test.rb  (Minitest)
+require "minitest/autorun"
+require "tally"
+
+class TallyTest < Minitest::Test
+  def test_counts_words
+    assert_equal({ "a" => 2, "b" => 1 }, Tally.count("a b a"))
+  end
+end
+```
+
+```ruby
+# spec/tally_spec.rb  (RSpec)
+RSpec.describe Tally do
+  subject(:counts) { described_class.count("a b a") }
+  it { is_expected.to eq("a" => 2, "b" => 1) }
+end
+```
+
+Run via `bundle exec rake test` (Minitest) or `bundle exec rspec` (RSpec). Fuller
+examples with `let`/`subject`/`context` are in
+[references/gems-and-testing.md](references/gems-and-testing.md).
+
+## Linting & typing (optional layers)
+
+- **Linter:** Standard (zero-config, "no bikeshadding" wrapper) when you want one less
+  argument; RuboCop (`.rubocop.yml`, every cop opt-in/out) when the team wants control.
+- **Types:** two coexisting systems — **RBS** (official signatures in separate `.rbs`
+  files, checked by Steep) and **Sorbet** (inline `sig` blocks, with experimental
+  inline-RBS-comment support). Add types only on a library's public surface or a hot,
+  bug-prone core — not on throwaway scripts.
+
+## Anti-patterns
+
+| Anti-pattern | Why it bites | Do instead |
+|--------------|--------------|------------|
+| Monkey-patching a core class globally | Action-at-a-distance; collides with gems and future Ruby | A refinement (scoped) or a wrapper/helper |
+| `method_missing` without `respond_to_missing?` | `respond_to?`/`method`/duck-typing all lie | Pair them, or prefer `define_method` |
+| Mutating a frozen string literal | `FrozenError` after the magic comment | `dup` before mutating, or build a new string |
+| `for x in coll` loops | Leaks the loop var; un-idiomatic | `coll.each`/`map`/`select` |
+| `rescue Exception` (bare) | Swallows `SignalException`, `NoMemoryError`, exit | `rescue StandardError` (or specific classes) |
+| Not committing `Gemfile.lock` for an app | Non-reproducible installs across machines | Commit it for apps; omit only for library gems |
+| `eval` of user-derived input | Remote code execution | Parse explicitly; never `eval` untrusted data |
+| Over-DSLing config a Hash would serve | Hidden control flow, slow `method_missing` | A plain Hash or `Data` object |
+
+## References
+
+- [references/metaprogramming.md](references/metaprogramming.md) — `define_method`,
+  `method_missing` + `respond_to_missing?`, `instance_eval`/`class_eval`, building a DSL,
+  refinements vs monkey-patching, `prepend` wrapping.
+- [references/gems-and-testing.md](references/gems-and-testing.md) — full `bundle gem`
+  tree and `.gemspec`, SemVer + `~>`, publishing, Rakefile, full Minitest + RSpec files,
+  RuboCop vs Standard config.

package/skills/ruby/evals/README.md

@@ -0,0 +1,12 @@
+# Evals for the `ruby` skill
+
+`cases.yaml` holds three kinds of fixture. `should_trigger` lists prompts whose
+situation this skill should claim (idiomatic plain-Ruby work — Enumerable refactors,
+gem packaging, metaprogramming judgment, Minitest/RSpec, the FrozenError-after-upgrade
+case, plus a Catalan phrasing). `should_not_trigger` lists adjacent prompts that must
+route to a real sibling instead (`rails`, `python`, `elixir`, `github-actions`), each
+with the reason. The single `capability` case is a build-a-gem scenario scored against
+a `must_include` rubric. Run them with the repository's eval harness over `evals/`,
+which matches the trigger/route fixtures against the skill description and checks a
+capability transcript against the rubric. No network or Ruby toolchain is required to
+score the routing cases; the capability rubric is judged on the produced answer.

package/skills/ruby/evals/cases.yaml

@@ -0,0 +1,41 @@
+skill: ruby
+
+should_trigger:
+  - prompt: "Refactor this Ruby loop that builds a hash of counts into something idiomatic"
+    why: "Enumerable refactor (each_with_object/tally) is the core day-to-day use of the skill."
+  - prompt: "I want to package this Ruby code as a gem — what goes in the gemspec and do I commit Gemfile.lock?"
+    why: "Gems + Bundler packaging, including the lock-file commit rule."
+  - prompt: "Should I use method_missing or define_method for this dynamic attribute API?"
+    why: "Metaprogramming judgment call — the skill's signature value-add (prefer define_method, pair method_missing with respond_to_missing?)."
+  - prompt: "Set up tests for my plain Ruby library — Minitest or RSpec, and how do I run them?"
+    why: "Testing-framework decision and rake/rspec wiring for non-Rails Ruby."
+  - prompt: "After upgrading to Ruby 3.4 I suddenly get a FrozenError when mutating a string literal"
+    why: "Non-obvious: the symptom routes to frozen_string_literal hygiene, not a generic bug hunt."
+  - prompt: "Vull escriure una gema en Ruby amb blocs i mòduls, sense Rails"
+    why: "Catalan phrasing for plain-Ruby gem authoring with blocks and modules, explicitly non-Rails."
+  - prompt: "Is a mixin or inheritance better here, and when should I prepend vs include?"
+    why: "Module composition design, a core section of the skill."
+
+should_not_trigger:
+  - prompt: "Add a has_many association and a migration to my User model"
+    route_to: rails
+    why: "ActiveRecord associations and migrations load the Rails framework — that is rails, not plain Ruby."
+  - prompt: "Write this list-comprehension data pipeline in Python with pandas"
+    route_to: python
+    why: "Different language; the Ruby skill does not own Python idioms."
+  - prompt: "Build a GenServer that supervises a pool of workers"
+    route_to: elixir
+    why: "BEAM/OTP concurrency belongs to elixir."
+  - prompt: "Set up GitHub Actions CI to run my Ruby tests on every push"
+    route_to: github-actions
+    why: "Authoring the CI workflow is the pipeline skill; this skill writes the tests, not the YAML workflow."
+
+capability:
+  - scenario: "Write a small non-Rails Ruby gem `tally` that exposes a module method counting word frequencies in a string, with a test."
+    must_include:
+      - "A `# frozen_string_literal: true` magic comment at the top of source files."
+      - "An Enumerable idiom (each_with_object, tally, or group_by) rather than a manual index loop."
+      - "A module (e.g. `module Tally`) holding the public method, not just a top-level def."
+      - "Bundler/gem packaging signal: a .gemspec or Gemfile, with a sane version constraint (~>)."
+      - "A real test in Minitest or RSpec that asserts the counts."
+      - "No gratuitous metaprogramming (no method_missing/eval where a plain method suffices)."