P6: `/react-rules-sync` — source fetch + diff preview

[tkowalczyk]

Parent PRD

#1

What to build

A new skill, /react-rules-sync, that refreshes the canonical source quotes embedded in the rule card library. The skill iterates over every shipping card, fetches the source URL declared in the card's frontmatter (Exa MCP for web sources, gh CLI for GitHub-hosted sources), and diffs the fetched content against the embedded quote/snippet in the card body.

Output is a preview-only report listing every card with detected drift and the proposed change. No card file is mutated by the skill. The user manually applies updates after reviewing the preview. The skill produces no GitHub issues.

This is the only skill that performs live network fetches during normal operation. The Source Sync deep module is isolated from /react-audit, /react-review, /react-rules code paths.

See PRD #1 "Implementation Decisions" → "Source content handling" and "Out of Scope" → "Scheduled sync execution".

Acceptance criteria

• skills/react-rules-sync/SKILL.md exists with manual-trigger metadata
• Skill fetches every card's source via the appropriate fetch path (Exa MCP for web, gh CLI for GitHub-hosted)
• Diff output clearly identifies which cards drift and shows the proposed change per card
• Skill exits without modifying any card file under any circumstances (verified by file mtime/hash check before/after)
• Skill produces no GitHub issues
• Source Sync deep module is isolated from the other three skills' code paths
• Static check confirms no live fetch (Exa, WebFetch, curl) occurs in /react-audit, /react-review, or /react-rules

Blocked by

• Blocked by P2c: Rerender cards + grouping #5

User stories addressed

• User story 17
• User story 18
• User story 36