feat(rpi): consolidate lifecycle around reusable skills

[agreaves-ms]

feat(rpi): consolidate lifecycle around reusable skills

Description

This PR consolidated the Research, Plan, Implement, Review, and Follow-up lifecycle around reusable rpi-* skills, a thin RPI Agent wrapper, and bounded research and planning workers. It removed superseded Task agents, fixed lifecycle workers, Memory and checkpoint surfaces, and dedicated Prompt Builder entry points while retaining the three prompt-engineering compatibility skills.

RPI lifecycle and evidence

• Rebuilt planning, implementation, and review around one task identity, stable Pxx and Pxx-Txx markers, and stage-specific amendment, change, divergence, critique, and review records.
• Added rpi-challenger for adaptive scope challenges and rpi-plan-critique for independent read-only plan assessment.
• Added bounded RPI Researcher and RPI Planner workers and routed demonstrated evidence gaps from planning, documentation, Design Thinking, code review, accessibility, privacy, RAI, security, SSSC, and PowerPoint workflows through rpi-research.
• Changed walkthrough continuity so ordinary progress remains conversational and a dated decisions-and-changes ledger is created only when a material decision or requested change occurs.

HVE Builder and validation

• Replaced fixed HVE Builder lifecycle workers with generic stage-dispatch contracts and made the remaining artifact tester return a read-only trace for lead-owned persistence.
• Separated local-safe validate:* commands from CI-owned browser, model, moderation, and evaluation lanes under ci:*.
• Updated workflow consumers, package scripts, contribution guidance, and regression coverage for the renamed validation entry points.
• Added conservative generated-reference orphan reconciliation that preserves ambiguous or authored pages for manual attention.
• Excluded generated Playwright reports from frontmatter validation and added regression coverage so local browser evidence does not affect repository validation.
• Cloned the light Prism theme and raised comment-token contrast while preserving the upstream theme object and dark theme.

Packaging, documentation, and evaluations

• Updated collection manifests and synchronized packaged plugin outputs with the retained RPI wrapper, phase skills, and bounded workers.
• Packaged the /rpi entry prompt with RPI Agent in the Design Thinking and Project Planning collections.
• Reworked getting-started, architecture, customization, lifecycle, Design Thinking, RPI, security, and contribution guidance for the skill-forward workflow.
• Removed eval specifications and baseline signatures for retired agents, retargeted shared coverage to RPI Agent, and strengthened conformance cases for research boundaries, stable markers, challenge cadence, plan critique, amendments, divergences, and review routing.
• Updated PowerShell regression fixtures to use current RPI surfaces or clearly synthetic artifact identities.

Related Issue(s)

None

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with hve-builder and addressed all actionable findings
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)
• Copilot hook (.github/hooks/*/*.json)
• Eval spec added/updated for changed AI artifacts (evals/)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Skills: Must include both bash and PowerShell scripts. See Skills.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

User Request:

Use RPI Agent to coordinate this task from the evidence already available. Research only demonstrated gaps, create an independently critiqued plan, implement approved work, review the evidence, and route any follow-up to the earliest responsible stage.

Execution Flow:

1. RPI Agent assessed whether the supplied context was planning-ready and activated rpi-research only for demonstrated evidence gaps.
2. rpi-plan created the plan and matching phase details, then activated rpi-plan-critique for an independent disposition.
3. rpi-implement executed approved Pxx or Pxx-Txx scope and recorded changes, validation evidence, amendments, and material divergences.
4. rpi-review reconciled the plan and implementation evidence, recorded separate execution and outcome states, and routed defects, decision gaps, evidence gaps, or residual work.

Output Artifacts:

.copilot-tracking/research/YYYY-MM-DD/task-research.md
.copilot-tracking/plans/YYYY-MM-DD/task-plan.md
.copilot-tracking/details/YYYY-MM-DD/task-phase-details.md
.copilot-tracking/reviews/plans/YYYY-MM-DD/task-plan-critique.md
.copilot-tracking/changes/YYYY-MM-DD/task-changes.md
.copilot-tracking/reviews/logs/YYYY-MM-DD/task-review.md

<!-- rpi:phase id=P01 -->
### [ ] P01: First approved phase
<!-- rpi:task id=P01-T01 -->
#### [ ] P01-T01: First evidence-backed task

Success Indicators:

• Research was reused or satisfied-and-skipped when existing evidence was adequate.
• Plans and phase details used matching task identities, headings, and stable markers.
• Material divergences linked DIV-xxx changes to AM-xxx amendments and fresh critique evidence.
• Review reported execution status separately from outcome and assigned every open finding to a next owner.

For detailed contribution requirements, see:

• Common Standards: docs/contributing/ai-artifacts-common.md - Shared standards for XML blocks, markdown quality, RFC 2119, validation, and testing
• Agents: docs/contributing/custom-agents.md - Agent configurations with tools and behavior patterns
• Prompts: docs/contributing/prompts.md - Workflow-specific guidance with template variables
• Instructions: docs/contributing/instructions.md - Technology-specific standards with glob patterns
• Skills: docs/contributing/skills.md - Task execution utilities with cross-platform scripts

Testing

• npm run validate:local passed on the final tree. Asset-doc validation reported the existing human-authored stub baseline as non-blocking warnings with zero errors.
• npm run validate:docs passed 10 Jest suites and 116 tests, along with Docusaurus linting, label-registry validation, and TypeScript checking.
• The CI-equivalent Docusaurus sequence passed 10 suites and 116 tests with coverage, then completed the production build.
• npm run ci:docs:test:e2e completed the production build and passed 176 Playwright tests with 2 intentional skips, including all normal and forced-colors axe scans.
• npm run spell-check passed 1,249 files with zero issues.
• npm run lint:md-links completed successfully.
• The focused frontmatter Pester suite passed 110 runnable tests with zero failures.
• The eval PowerShell suite passed 473 tests with zero failures and one skipped test.
• Static eval generator, schema, text, safety, and presence lanes passed; stimulus presence reported 119 covered, 0 missing, and 30 skipped changed artifacts.
• Plugin generation and stable and pre-release extension preparation completed successfully after the collection changes.
• Diff analysis covered all 66 PR-reference chunks and verified changed-file intent, references, maturity, security-sensitive surfaces, and source-to-package synchronization.
• git diff --check origin/main...HEAD passed, and all 18 commit subjects followed conventional commit syntax.
• No dependency versions, workflow permission expansions, unpinned actions, credentials, or secret-bearing runtime paths were identified in the reviewed diff.
• Manual interactive testing was not performed.

Note

Add manual testing descriptions when applicable.

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

• Used hve-builder review mode to review contribution
• Addressed all actionable findings from the hve-builder review
• Verified contribution follows common standards and type-specific requirements

Required Local Checks

The following local-safe validation commands must pass before merging:

• Local validation aggregate: npm run validate:local
• Documentation validation (if docs changed): npm run validate:docs
• Spell checking: npm run spell-check
• Link validation: npm run lint:md-links

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A — no dependency versions changed)
• Security-related scripts follow the principle of least privilege (N/A — no security scripts changed)

GHCP Artifact Maturity

Warning

This PR includes experimental GHCP artifacts that may have breaking changes.

• .github/agents/accessibility/accessibility-planner.agent.md
• .github/agents/coding-standards/code-review.agent.md
• .github/agents/coding-standards/subagents/code-review-walkback.agent.md
• .github/agents/hve-core/task-challenger.agent.md (removed)
• .github/agents/privacy/privacy-planner.agent.md
• .github/agents/privacy/privacy-reviewer.agent.md
• .github/agents/project-planning/network-isa95-planner.agent.md
• .github/agents/rai-planning/rai-planner.agent.md
• .github/agents/security/security-planner.agent.md
• .github/agents/security/sssc-planner.agent.md
• .github/instructions/accessibility/accessibility-identity.instructions.md
• .github/instructions/project-planning/adr-handoff.instructions.md
• .github/instructions/project-planning/adr-standards.instructions.md
• .github/instructions/rai-planning/rai-identity.instructions.md
• .github/instructions/security/identity.instructions.md
• .github/instructions/security/sssc-planner.instructions.md
• .github/instructions/security/standards-mapping.instructions.md
• .github/prompts/experimental/graph-research.prompt.md
• .github/prompts/hve-core/evals-import.prompt.md
• .github/prompts/hve-core/task-challenge.prompt.md (removed)
• .github/prompts/hve-core/vally-test-write.prompt.md
• .github/skills/hve-core/vally-tests/SKILL.md

File or group	Type	Maturity	Notes
.github/agents/design-thinking/dt-coach.agent.md	Agent	🔶 preview	Pre-release artifact changed
.github/prompts/design-thinking/dt-handoff-*-space.prompt.md	Prompt	🔶 preview	Three pre-release prompts
.github/skills/design-thinking/dt-rpi-integration/SKILL.md	Skill	🔶 preview	Pre-release skill changed
.github/agents/accessibility/accessibility-planner.agent.md	Agent	⚠️ experimental	Pre-release artifact changed
.github/agents/coding-standards/code-review.agent.md	Agent	⚠️ experimental	Pre-release artifact changed
.github/agents/coding-standards/subagents/code-review-walkback.agent.md	Agent	⚠️ experimental	Pre-release artifact changed
.github/agents/hve-core/task-challenger.agent.md	Agent	⚠️ experimental	Removed
.github/agents/privacy/*.agent.md	Agent	⚠️ experimental	Two pre-release agents changed
.github/agents/project-planning/network-isa95-planner.agent.md	Agent	⚠️ experimental	Pre-release artifact changed
.github/agents/rai-planning/rai-planner.agent.md	Agent	⚠️ experimental	Pre-release artifact changed
.github/agents/security/{security-planner,sssc-planner}.agent.md	Agent	⚠️ experimental	Two pre-release agents changed
.github/instructions/accessibility/accessibility-identity.instructions.md	Instructions	⚠️ experimental	Pre-release artifact changed
.github/instructions/project-planning/{adr-handoff,adr-standards}.instructions.md	Instructions	⚠️ experimental	Two pre-release instructions changed
.github/instructions/rai-planning/rai-identity.instructions.md	Instructions	⚠️ experimental	Pre-release artifact changed
.github/instructions/security/{identity,sssc-planner,standards-mapping}.instructions.md	Instructions	⚠️ experimental	Three pre-release instructions changed
.github/prompts/experimental/graph-research.prompt.md	Prompt	⚠️ experimental	Pre-release artifact changed
.github/prompts/hve-core/{evals-import,vally-test-write}.prompt.md	Prompt	⚠️ experimental	Two pre-release prompts changed
.github/prompts/hve-core/task-challenge.prompt.md	Prompt	⚠️ experimental	Removed
.github/skills/hve-core/vally-tests/SKILL.md	Skill	⚠️ experimental	Pre-release artifact changed
Remaining changed .agent.md files	Agent	✅ stable	Stable additions, changes, and removals
Remaining changed .prompt.md files	Prompt	✅ stable	Stable changes and removals
Remaining changed .instructions.md files	Instructions	✅ stable	Stable additions, changes, and removals
Remaining changed SKILL.md files	Skill	✅ stable	Stable additions and changes

GHCP Maturity Acknowledgment

• I acknowledge this PR includes non-stable GHCP artifacts
• Non-stable artifacts are intentional for this change

Additional Notes

• The repository PR template was used for this description.
• Retired Task-agent, checkpoint, Memory, and npm command surfaces were removed without compatibility layers; consumers of those surfaces must migrate to the RPI skills and current validation commands.
• Commit subjects followed conventional syntax, while this description explicitly marks the removed workflow and command surfaces as breaking.
• The hosted pr-validation-success merge gate remains the final merge-readiness signal after all required CI jobs complete.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.76%. Comparing base (8ae6195) to head (1a6545b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2474      +/-   ##
==========================================
- Coverage   82.76%   82.76%   -0.01%     
==========================================
  Files         154      154              
  Lines       20853    20853              
  Branches       13       13              
==========================================
- Hits        17259    17258       -1     
- Misses       3592     3593       +1     
  Partials        2        2              

Flag	Coverage Δ
docusaurus	94.44% <ø> (ø)
pester	86.26% <100.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ills/hve-core/vally-tests/scripts/New-Stimulus.ps1	100.00% <ø> (ø)
...nstaller/hve-core-installer/scripts/agent-copy.ps1	100.00% <ø> (ø)
...hve-core-installer/scripts/collision-detection.ps1	100.00% <100.00%> (ø)
...lls/installer/hve-core-installer/scripts/eject.ps1	100.00% <ø> (ø)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Eval Execution

❌ Status: Failed — 1 spec(s) block merge

• Artifacts evaluated: 68
• Specs run: 81
• Assertions passed: 430
• Assertions failed (blocking): 5
• Assertions failed (advisory): 158
• Failed specs (merge-blocking): 1

Artifact	Kind	Status	Specs	Passed	Failed (blocking)	Failed (advisory)
accessibility-planner	agent	✅ pass	1	5	0	0
ado-backlog-manager	agent	⚠️ advisory-fail	1	1	0	4
code-review	agent	⚠️ advisory-fail	1	4	0	1
code-review-walkback	agent	✅ pass	1	5	0	0
dt-coach	agent	✅ pass	1	5	0	0
pptx	agent	⚠️ advisory-fail	1	1	0	4
github-backlog-manager	agent	❌ fail	1	0	5	0
documentation	agent	⚠️ advisory-fail	1	5	0	5
rpi-agent	agent	⚠️ advisory-fail	4	149	0	114
hve-artifact-tester	agent	✅ pass	1	5	0	0
rpi-planner	agent	✅ pass	1	5	0	0
rpi-researcher	agent	✅ pass	1	5	0	0
jira-backlog-manager	agent	⚠️ advisory-fail	1	4	0	1
privacy-planner	agent	✅ pass	1	5	0	0
privacy-reviewer	agent	✅ pass	1	5	0	0
adr-creation	agent	✅ pass	1	5	0	0
brd-builder	agent	✅ pass	1	5	0	0
network-isa95-planner	agent	✅ pass	1	5	0	0
prd-builder	agent	✅ pass	1	5	0	0
product-manager-advisor	agent	✅ pass	1	5	0	0
system-architecture-reviewer	agent	✅ pass	1	5	0	0
ux-ui-designer	agent	✅ pass	1	5	0	0
rai-planner	agent	⚠️ advisory-fail	1	9	0	1
security-planner	agent	✅ pass	1	5	0	0
sssc-planner	agent	✅ pass	1	10	0	0
code-review rpi-agent	agent	✅ pass	3	0	0	0
documentation rpi-agent	agent	✅ pass	3	0	0	0
dependency-reviewer rpi-agent	agent	✅ pass	3	0	0	0
brd-builder github-backlog-manager issue-triage prd-builder product-manager-advisor rpi-agent	agent	✅ pass	3	0	0	0
issue-triage rpi-agent	agent	✅ pass	3	0	0	0
accessibility-identity	instruction	✅ pass	1	3	0	0
commit-message	instruction	⚠️ advisory-fail	1	2	0	1
copilot-tracking	instruction	✅ pass	1	3	0	0
hve-builder	instruction	✅ pass	1	3	0	0
pull-request	instruction	✅ pass	1	3	0	0
adr-handoff	instruction	✅ pass	1	3	0	0
adr-standards	instruction	✅ pass	1	3	0	0
rai-identity	instruction	⚠️ advisory-fail	1	2	0	4
identity	instruction	✅ pass	1	3	0	0
sssc-planner	instruction	⚠️ advisory-fail	1	2	0	1
standards-mapping	instruction	✅ pass	1	3	0	0
ado-process-my-work-items-for-task-planning	prompt	✅ pass	1	3	0	0
dt-handoff-implementation-space	prompt	✅ pass	1	3	0	0
dt-handoff-problem-space	prompt	✅ pass	1	3	0	0
dt-handoff-solution-space	prompt	✅ pass	1	3	0	0
graph-research	prompt	✅ pass	1	3	0	0
github-suggest	prompt	✅ pass	1	3	0	0
evals-import	prompt	✅ pass	1	3	0	0
git-commit	prompt	✅ pass	1	3	0	0
rpi	prompt	✅ pass	1	3	0	0
vally-test-write	prompt	⚠️ advisory-fail	1	2	0	1
dt-rpi-integration	skill	✅ pass	1	9	0	0
documentation	skill	✅ pass	1	3	0	0
hve-builder-tester	skill	✅ pass	1	3	0	0
hve-builder	skill	✅ pass	1	15	0	0
prompt-analyze	skill	⚠️ advisory-fail	1	7	0	2
prompt-builder	skill	⚠️ advisory-fail	1	6	0	3
prompt-refactor	skill	⚠️ advisory-fail	1	5	0	4
vally-tests	skill	⚠️ advisory-fail	1	6	0	3
hve-core-installer	skill	✅ pass	1	9	0	0
rpi-challenger	skill	⚠️ advisory-fail	1	0	0	3
rpi-implement	skill	⚠️ advisory-fail	1	7	0	2
rpi-plan-critique	skill	✅ pass	1	3	0	0
rpi-plan	skill	✅ pass	1	9	0	0
rpi-quick	skill	✅ pass	1	9	0	0
rpi-research	skill	⚠️ advisory-fail	1	7	0	2
rpi-review	skill	⚠️ advisory-fail	1	7	0	2
rpi-walkthrough	skill	✅ pass	1	3	0	0

Legend — ✅ clean · ⚠️ advisory failures only (non-blocking) · ⏭️ skipped · ❌ merge-blocking failure

Only Failed specs (merge-blocking) gates this PR. Advisory assertion failures are signal-quality checks captured during iteration; review them, but they do not block merge and may be acceptable.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/@github/copilot	1.0.71	Unknown	Unknown
pip/atheris	3.0.0	🟢 6.1	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo SAST ⚠️ 0 no SAST tool detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/colorama	0.4.6	Unknown	Unknown
pip/coverage	7.14.1	Unknown	Unknown
pip/iniconfig	2.3.0	Unknown	Unknown
pip/packaging	26.2	Unknown	Unknown
pip/pluggy	1.6.0	Unknown	Unknown
pip/pygments	2.20.0	Unknown	Unknown
pip/pytest	9.0.3	Unknown	Unknown
pip/pytest-cov	7.1.0	Unknown	Unknown
pip/ruff	0.15.16	Unknown	Unknown
pip/tomli	2.4.1	Unknown	Unknown
pip/atheris	3.0.0	🟢 6.1	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo SAST ⚠️ 0 no SAST tool detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/colorama	0.4.6	Unknown	Unknown
pip/coverage	7.14.1	Unknown	Unknown
pip/iniconfig	2.3.0	Unknown	Unknown
pip/packaging	26.2	Unknown	Unknown
pip/pluggy	1.6.0	Unknown	Unknown
pip/pygments	2.20.0	Unknown	Unknown
pip/pytest	9.0.3	Unknown	Unknown
pip/pytest-cov	7.1.0	Unknown	Unknown
pip/ruff	0.15.16	Unknown	Unknown
pip/tomli	2.4.1	Unknown	Unknown
npm/@github/copilot	1.0.71	Unknown	Unknown

Scanned Files

• evals/beval/package-lock.json
• plugins/hve-core-all/hooks/shared/telemetry/uv.lock
• plugins/hve-core/hooks/shared/telemetry/uv.lock

[github-actions]

Dependency Review — All Checks Passed ✅

This PR does not introduce version bumps or new dependencies. The dependency-adjacent changes are limited to build script taxonomy and workflow command references. All safety checks passed.

Changes Reviewed

File	Change Type	Classification
package.json	Script renaming (eval:* → ci:eval:*, lint:all → validate:local)	No dependency change
docs/docusaurus/package.json	Script renaming (test:e2e → ci:test:e2e)	No dependency change
.github/workflows/docusaurus-tests.yml	Quote normalization, test:e2e → ci:test:e2e command reference	No action version change
.github/workflows/eval-validation.yml	eval:* → ci:eval:* npm command references	No action version change
.github/workflows/issue-implement.lock.yml	Auto-generated lock file refresh (agent import removed)	All actions SHA-pinned

Safety Check Results

• New dependencies: None introduced. ✅
• Dependency version bumps: None. ✅
• License compatibility: N/A — no new or changed packages. ✅
• SHA pinning (GitHub Actions): All references in changed workflow files use SHA + version comment. ✅
  • actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
  • actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
  • All actions in issue-implement.lock.yml manifest are SHA-pinned.
• Environment synchronization (.devcontainer/ ↔ copilot-setup-steps.yml): Neither file was modified — no synchronization gap. ✅
• Known vulnerabilities: No dependency changes to assess. ✅

No action required from a dependency-review perspective. Human merge gate applies as usual.

Generated by Dependabot PR Review for #2474 · 74.4 AIC · ⌖ 6.1 AIC · ⊞ 8.4K

[rezatnoMsirhC]

Manual skill conversion smoke test — 2026-07-21

I ran a manual smoke test of the RPI skills converted in this branch by invoking each /skill command directly in Copilot chat. All prompts used minimal wording with no explicit "Task:" or "Topic:" qualifiers to verify the skill could infer intent without scaffolding. Fresh-session turns (FS-x) were run after /clear in a new Copilot window with no prior conversation context. The full test log is at .copilot-tracking/research/2026-07-21/rpi-skills-manual-test-log.md.

Turn-by-turn results

Turn 1 — rpi-research
Prompt: /rpi-research What are the tracking artifact paths used by the RPI skills on this branch? Internal workspace only, no recommendation needed.
Verified the skill activates from a bare request, infers scope, runs workspace searches, and writes a dated artifact. The skill searched eight RPI SKILL.md files and their reference documents, then produced a consolidated path inventory at .copilot-tracking/research/2026-07-21/rpi-skill-tracking-paths-research.md.
Result: Pass

Turn 2 — rpi-plan
Prompt: /rpi-plan Add a single-sentence description field to SKILL.md frontmatter. Research is satisfied.
Note: the prompt said SKILL.md without a full path. The currently open file in the editor was rpi-quick/SKILL.md, which the skill used as its target. The skill examined the current description value, found it was two sentences, condensed it to one, and correctly created plan, phase-detail, and critique artifacts. However, it then continued past the plan boundary to execute the implementation and write a changes record — work that belongs to rpi-implement. This is F-001.
Result: Pass with finding F-001 (phase boundary overrun)

Turn 3 — rpi-plan-critique
Prompt: /rpi-plan-critique Critique the plan from the previous turn.
Because Turn 2 already executed the critique as part of its overrun, the evidence is not independently produced. Treating this as done via Turn 2 would be circular: if Turn 2 is a defect, its output cannot validate Turn 3.
Result: Not tested — evidence contaminated by F-001

Turn 4 — rpi-implement
Prompt: /rpi-implement The critique returned Pass. Execute the plan.
Same contamination issue. The changes record that Turn 2 produced cannot serve as proof that rpi-implement works correctly in isolation.
Result: Not tested — evidence contaminated by F-001

Turn 5 — rpi-review
Prompt: /rpi-review Review the implementation against the plan.
Verified the skill reads existing plan and changes artifacts, produces a distinct execution status and outcome, and writes a review log. The skill read the plan, phase details, critique, and changes record from disk, verified acceptance criteria programmatically via a terminal command, and wrote the review log to reviews/logs/2026-07-21/rpi-quick-description-review.md. Execution status and outcome were stated as two separate fields.
Result: Pass

Turn 6 — rpi-quick
Prompt: /rpi-quick Add user-invocable: true to SKILL.md frontmatter if it is missing.
Note: the prompt said SKILL.md without a full path, with rpi-walkthrough/SKILL.md open in the editor. The skill correctly identified that the open file already had the field, then expanded scope to search all SKILL.md files in the repository, discovered 14 were missing user-invocable:, and added it to all 14. This scope expansion beyond the referenced file is a behavioral characteristic worth noting. The skill recorded a "satisfied-and-skipped" research disposition and completed the task, but ran the lifecycle stages under "Stage 2/3/4" labels without explicitly routing to or naming rpi-plan, rpi-implement, or rpi-review by name. This is F-002.
Result: Partial — research readiness correct; scope expansion beyond referenced file; delegation implicit (F-002)

Turn 7 — rpi-challenger (meta-test)
Prompt: /rpi-challenger Our approach to testing the RPI skills is documented in .copilot-tracking/research/2026-07-21/rpi-skills-manual-test-log.md. Challenge it.
Used rpi-challenger on the test approach itself to surface assumptions. The skill produced two valid challenges: (1) all turns shared the same conversation history, so prior context could inflate results; (2) if F-001 is a real boundary violation, the artifacts it produced cannot be used as proof that rpi-plan-critique and rpi-implement work correctly as standalone skills. Both challenges were valid and led to reclassifying Turns 3 and 4 from SKIP to NOT TESTED.
Result: Pass

Turn 8 — rpi-walkthrough
Prompt: /rpi-walkthrough How does rpi-quick delegate to the individual phase skills?
Not yet run.
Result: Pending

Fresh-session turns

FS-1 — rpi-research (cold activation baseline)
Prompt: /rpi-research What fields does a SKILL.md frontmatter block require in this repository?
Verified the skill activates from a blank session and writes a dated artifact with no prior context. The skill located skill-frontmatter.schema.json, cross-referenced schema-mapping.json, and read several live SKILL.md files to confirm. Output: skill-md-frontmatter-research.md with a correct required vs. optional field table.
Result: Pass — cold-start artifact creation confirmed

FS-2 — rpi-review (artifact discovery from cold)
Prompt: /rpi-review Review the implementation at .copilot-tracking/changes/2026-07-21/rpi-quick-description-changes.md against the plan at .copilot-tracking/plans/2026-07-21/rpi-quick-description-plan.md.
Directly addressed the challenger's session-continuity concern. The skill ran find to locate related artifacts, read the plan, changes, phase details, plan critique, and existing review log from disk, identified a missing "Next Owner" section, completed it, and restated execution status and outcome as distinct fields. No conversation history was available.
Result: Pass — artifact discovery from disk confirmed; session-continuity assumption refuted

FS-3 — rpi-plan (phase boundary check from cold)
Prompt: /rpi-plan Add a compatibility field to .github/skills/rpi/rpi-review/SKILL.md frontmatter if missing. Research is satisfied.
Re-tested F-001 in a fresh session. The skill created plan and critique artifacts correctly, then executed a 90-line Python script that added compatibility: to 40 SKILL.md files across the repository — not just the specified file — and validated the result with npm run lint:frontmatter. Two failure modes are visible: (1) the same phase boundary overrun as Turn 2 with no prior context; (2) scope expansion from a single specified file to all 40 SKILL.md files in the repository, consistent with what was observed in Turn 6.
Result: Fail — F-001 confirmed persistent; scope expansion beyond specified file confirmed as a repeating pattern

Findings

ID	Severity	Skill	Description
F-001	Medium	rpi-plan	Phase boundary overrun confirmed persistent across two sessions. A single /rpi-plan invocation creates plan artifacts, runs inline critique, executes implementation, and writes a changes record. Confirmed in Turn 2 (in-session) and FS-3 (fresh session). The skill contract should enforce its own phase boundary regardless of how the task is phrased.
F-002	Low	rpi-quick	Phase delegation is implicit rather than explicit. The skill ran lifecycle stages labeled Stage 2/3/4 without routing to or naming rpi-plan, rpi-implement, or rpi-review. The skill contract describes rpi-quick as a sequencing layer. Whether inline execution is acceptable for trivial tasks under the "smallest-action" constraint is ambiguous and worth clarifying in the skill's stop rules.
F-003	Low	rpi-challenger	Stateless session setup. The skill re-ran mkdir -p challenges/YYYY-MM-DD at the start of each question segment even when the directory already existed. Harmless because mkdir is idempotent, but the pattern suggests no within-session write tracking.
F-004	Low	rpi-plan, rpi-quick	Scope expansion beyond the referenced file. When given a bare SKILL.md reference or a single specified path, the skills searched the repository broadly and modified all matching files. In Turn 6 this meant 14 files; in FS-3 it meant 40. This may be desirable behavior, but it was not requested and was not scoped by the prompts.

What probably needs resolution before merge

F-001 requires a decision before rpi-plan-critique and rpi-implement can be validated in isolation:

1. Update rpi-plan to stop after plan and critique artifacts and explicitly hand off.
2. Accept the combined behavior as intentional, document it, and treat Turns 3 and 4 as covered by the integrated flow.

Additionally, Turn 8 (rpi-walkthrough) is still pending, and F-004 (unscoped file expansion) may warrant a clarification in the skill prompts about whether repository-wide scope is intended behavior.