feat(skills): dunning-ladder - governed dunning and AR reminder escalation skill

.ai/runs/runx-claim-via-nango/session.json

@@ -0,0 +1,23 @@
+{
+  "schema_version": 3,
+  "task_id": "runx-claim-via-nango",
+  "created_at": "2026-04-26T08:57:26Z",
+  "updated_at": "2026-04-26T08:57:26Z",
+  "model_profile": "default",
+  "entries": [
+    {
+      "type": "approval",
+      "recorded_at": "2026-04-26T08:57:26Z",
+      "gate": "approve",
+      "actor": "human",
+      "note": "spec approved"
+    }
+  ],
+  "recovery_attempts": {},
+  "criterion_states": {},
+  "phases": [],
+  "attempts": [],
+  "phase_summaries": [],
+  "workspace_baseline": null,
+  "usage": {}
+}

.ai/specs/active/runx-unified-workspace-topology.yaml

@@ -0,0 +1,295 @@
+spec_version: "1.1"
+task_id: "runx-unified-workspace-topology"
+created: "2026-04-24T00:45:00Z"
+updated: "2026-04-26T15:40:48Z"
+status: "in_progress"
+
+task:
+  title: "Converge runx onto one real workspace and remove nested-repo hybrid debt"
+  summary: >
+    The parent workspace root now exists, but the current parent repo plus
+    nested oss/cloud git repos is still a hybrid. The ideal shape from here is a
+    single authoritative workspace rooted at /home/kam/dev/runx, with manifest
+    dependencies expressed as workspace package edges and no gitlink-style nested
+    repos. Converge the topology so the package graph, tooling, and versioning
+    all describe the same reality.
+  size: "large"
+  risk_level: "high"
+  context:
+    packages:
+      - ".."
+      - "../oss/packages/*"
+      - "../cloud/apps/*"
+      - "../cloud/packages/*"
+    files_impacted:
+      - path: "../package.json"
+        lines: "all"
+        reason: "Parent repo is already the workspace root and should become the only authoritative repo root."
+      - path: "../pnpm-workspace.yaml"
+        lines: "all"
+        reason: "Workspace membership is declared at the real root and should stay authoritative."
+      - path: "../cloud/package.json"
+        lines: "all"
+        reason: "Cloud should consume @runxhq/* through workspace refs, not local links."
+      - path: "../oss/package.json"
+        lines: "all"
+        reason: "Top-level oss workspace behavior should move to the root or become a package-local concern."
+      - path: "../.github/workflows"
+        lines: "all"
+        reason: "CI should run from the real workspace root, not through nested-repo assumptions."
+      - path: "../oss"
+        lines: "all"
+        reason: "Nested git-repo packaging assumptions should be removed."
+      - path: "../cloud"
+        lines: "all"
+        reason: "Nested git-repo packaging assumptions should be removed."
+    invariants:
+      - "Package edges must be real workspace edges, not hidden source or link hacks."
+      - "There is exactly one authoritative git/workspace root."
+      - "Cloud and oss remain separately buildable within the unified workspace."
+  objectives:
+    - "Finish promoting /home/kam/dev/runx to the only real workspace root."
+    - "Keep cloud manifest dependencies on workspace package edges instead of link:../oss references."
+    - "Remove nested gitlink-style repos and normalize tooling and CI around the root."
+  scope:
+    in_scope:
+      - "Workspace manifests, dependency edges, repo topology, and root-level tooling."
+    out_of_scope:
+      - "Physically moving every directory if the unified root can be achieved without it."
+      - "Publishing external package versions to a remote registry."
+  dependencies:
+    - "runx-verification-foundation-and-fast-lanes"
+    - "runx-cli-kernel-final-split"
+    - "runx-runner-local-facade-final-split"
+    - "runx-hosted-api-domain-service-split"
+    - "runx-contracts-single-authority"
+  assumptions:
+    - "The preferred end state is one real monorepo workspace, not separate published package release trains."
+  touchpoints:
+    - area: "/home/kam/dev/runx"
+      description: "Future authoritative git and package-manager root."
+    - area: "../cloud/package.json"
+      description: "Current local-link consumer that should use workspace refs."
+    - area: "../oss and ../cloud git topology"
+      description: "Current nested-repo debt that should disappear."
+  risks:
+    - description: "Repo-topology changes can disrupt daily workflows if done before structural code work settles."
+      impact: "high"
+      mitigation: "Execute this after the major code-shape refactors and only with a stable fast verification lane."
+    - description: "Workspace convergence can accidentally break scripts that assume the old cwd layout."
+      impact: "medium"
+      mitigation: "Move tooling and scripts in phases and keep root-level entrypoints explicit."
+  acceptance:
+    validation_profile: "strict"
+    definition_of_done:
+      - id: "dod1"
+        description: "The parent repo is the only authoritative workspace root."
+      - id: "dod2"
+        description: "Cloud consumes @runxhq/* through workspace refs instead of link:../oss/package paths."
+      - id: "dod3"
+        description: "oss and cloud are no longer tracked as nested gitlink-style repos."
+      - id: "dod4"
+        description: "Root-level install and verification commands operate over the unified workspace."
+    validation:
+      - id: "v1"
+        type: "integration"
+        description: "Root workspace install succeeds."
+        command: "pnpm install"
+        cwd: ".."
+        expected: "exit code 0"
+      - id: "v2"
+        type: "compile"
+        description: "Root-driven oss and cloud verification succeeds."
+        command: "pnpm --dir oss typecheck && pnpm --dir cloud typecheck"
+        cwd: ".."
+        expected: "exit code 0"
+      - id: "v3"
+        type: "boundary"
+        description: "No cloud package manifest still uses link:../oss package edges."
+        command: "! rg -n 'link:\\.\\./oss/packages' cloud -g 'package.json'"
+        cwd: ".."
+        expected: "exit code 0"
+      - id: "v4"
+        type: "boundary"
+        description: "oss and cloud are no longer tracked as gitlink-style nested repos."
+        command: "test -z \"$(git ls-files -s oss cloud | awk '$1 == 160000 { print }')\""
+        cwd: ".."
+        expected: "exit code 0"
+
+planning_log:
+  - timestamp: "2026-04-24T00:45:00Z"
+    actor: "user"
+    summary: "Asked for concrete execution specs covering the full path to ideal shape."
+  - timestamp: "2026-04-24T00:45:00Z"
+    actor: "agent"
+    summary: "Chose one real workspace as the target end state instead of keeping the current parent-plus-nested-repo hybrid."
+  - timestamp: "2026-04-25T14:31:49Z"
+    actor: "agent"
+    summary: "Rebased the draft on the current root workspace manifests; remaining topology risk is nested gitlink removal and root-driven verification."
+  - timestamp: "2026-04-26T12:58:00Z"
+    actor: "agent"
+    summary: "Executed root workspace install and fixed the blocking workspace-edge issue by including oss/cloud roots and converting local @runxhq package edges to workspace refs."
+  - timestamp: "2026-04-26T12:58:00Z"
+    actor: "agent"
+    summary: "Adversarial review kept phase3 open because parent git still tracks oss and cloud as 160000 gitlinks; removing nested repo history requires an explicit destructive topology cutover."
+  - timestamp: "2026-04-26T15:40:48Z"
+    actor: "agent"
+    summary: "Added a precise final topology cutover checklist and rollback path; phase3 remains blocked until the user explicitly approves the gitlink removal."
+
+phases:
+  - id: "phase1"
+    name: "Normalize the existing parent workspace root"
+    objective: "Keep /home/kam/dev/runx as the package-manager root with explicit workspace membership and root-level commands."
+    changes:
+      - file: "../package.json"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Audit and expand the existing root package manifest so it exposes the
+          authoritative workspace-level scripts and package manager settings.
+      - file: "../pnpm-workspace.yaml"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Keep oss and cloud workspace members declared from the real root.
+      - file: "../oss/package.json"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Remove assumptions that oss itself is the only workspace root when
+          they should now live at the parent level.
+      - file: "../cloud/package.json"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Align cloud package-manager behavior with the new root workspace.
+    acceptance_criteria:
+      - id: "ac1_1"
+        type: "integration"
+        description: "Root workspace install succeeds."
+        command: "pnpm install"
+        cwd: ".."
+        expected: "exit code 0"
+    status: "completed"
+
+  - id: "phase2"
+    name: "Replace link edges with workspace edges"
+    objective: "Make the package graph honest at the manifest level."
+    dependencies:
+      - "phase1"
+    changes:
+      - file: "../cloud/package.json"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Replace link:../oss package edges with workspace: references to the
+          unified root workspace packages.
+      - file: "../cloud/pnpm-lock.yaml"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Refresh the lockfile against workspace-based package edges. PNPM may
+          still render resolved workspace packages as link: entries in the
+          lockfile; the invariant is that package manifests no longer declare
+          link:../oss dependencies.
+      - file: "../cloud/tsconfig.base.json"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Keep compile-time path resolution aligned with the workspace package
+          graph after the manifest change.
+    acceptance_criteria:
+      - id: "ac2_1"
+        type: "boundary"
+        description: "No cloud package manifest still uses link:../oss package refs."
+        command: "! rg -n 'link:\\.\\./oss/packages' cloud -g 'package.json'"
+        cwd: ".."
+        expected: "exit code 0"
+    status: "completed"
+
+  - id: "phase3"
+    name: "Remove nested gitlink topology and normalize tooling"
+    objective: "Finish the topology migration so git, CI, and developer commands all operate from the root."
+    dependencies:
+      - "phase2"
+    changes:
+      - file: "../.github/workflows"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Move workspace verification and release automation to the parent root.
+      - file: "../oss"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Remove nested git-repo assumptions and keep only package-level
+          concerns inside the directory tree.
+      - file: "../cloud"
+        action: "update"
+        lines: "all"
+        content_spec: >
+          Remove nested git-repo assumptions and keep only package-level
+          concerns inside the directory tree.
+    acceptance_criteria:
+      - id: "ac3_1"
+        type: "boundary"
+        description: "oss and cloud are no longer tracked as nested gitlinks."
+        command: "test -z \"$(git ls-files -s oss cloud | awk '$1 == 160000 { print }')\""
+        cwd: ".."
+        expected: "exit code 0"
+      - id: "ac3_2"
+        type: "compile"
+        description: "Root-driven oss and cloud verification succeeds."
+        command: "pnpm --dir oss typecheck && pnpm --dir cloud typecheck"
+        cwd: ".."
+        expected: "exit code 0"
+    status: "pending"
+    blocked_reason: "Parent git still tracks oss and cloud as 160000 gitlinks. Completing this phase requires removing nested .git directories or otherwise converting both trees into parent-tracked files, which is intentionally not hidden inside this spec execution while both nested repos have active dirt."
+    cutover_checklist:
+      - "Freeze nested repo work: `git -C oss status --short --branch` and `git -C cloud status --short --branch` must be clean except intended final commits."
+      - "Record exact nested SHAs and parent gitlink SHAs before mutation: `git -C oss rev-parse HEAD`, `git -C cloud rev-parse HEAD`, and `git ls-files -s oss cloud`."
+      - "Create rollback anchors before destructive topology changes: parent branch/tag plus timestamped backups of `oss/.git` and `cloud/.git` outside the workspace."
+      - "Commit the parent gitlink updates first so the parent repo records the final nested SHAs before the cutover."
+      - "Choose history strategy explicitly: squash-import current trees into parent, or use subtree/filter import if preserving nested history is required."
+      - "Remove gitlink index entries only after backups exist: `git rm --cached oss cloud`; remove `.gitmodules` entries if any are present."
+      - "Move nested `.git` directories out of the tree rather than deleting them: for example `.git-backups/runx-oss-<sha>` and `.git-backups/runx-cloud-<sha>` outside `/home/kam/dev/runx`."
+      - "Re-add `oss` and `cloud` as ordinary parent-tracked directories, respecting parent `.gitignore` so `node_modules`, caches, and generated build output stay out."
+      - "Verify no gitlinks remain: `test -z \"$(git ls-files -s oss cloud | awk '$1 == 160000 { print }')\"`."
+      - "Run root install and verification from `/home/kam/dev/runx`: `pnpm install`, `pnpm --dir oss typecheck`, `pnpm --dir cloud typecheck`, and targeted fast suites."
+      - "Commit the cutover as one topology commit that contains only gitlink removal, ordinary file tracking, root ignore/tooling updates, and verification notes."
+      - "Rollback path: restore the pre-cutover parent commit, move backed-up `.git` directories back into `oss/.git` and `cloud/.git`, and reset the parent gitlinks to the recorded SHAs."
+
+rollback:
+  strategy: "per_phase"
+  commands:
+    phase1: "git -C /home/kam/dev/runx checkout HEAD -- package.json pnpm-workspace.yaml && git -C /home/kam/dev/runx/oss checkout HEAD -- package.json && git -C /home/kam/dev/runx/cloud checkout HEAD -- package.json"
+    phase2: "git -C /home/kam/dev/runx/cloud checkout HEAD -- package.json pnpm-lock.yaml tsconfig.base.json && git -C /home/kam/dev/runx checkout HEAD -- pnpm-lock.yaml"
+    phase3: "git -C /home/kam/dev/runx checkout HEAD -- .github/workflows oss cloud"
+
+review:
+  verdict: "blocked"
+  reviewed_at: "2026-04-26T12:58:00Z"
+  reviewer: "agent"
+  finding_counts:
+    critical: 0
+    high: 1
+    medium: 0
+    low: 0
+  findings:
+    - severity: "high"
+      area: "repo topology"
+      evidence: "git ls-files -s oss cloud still returns mode 160000 entries for both directories."
+      impact: "The parent repo is not yet the only authoritative git root, so definition-of-done item dod3 remains unmet."
+      recommendation: "Schedule a dedicated cutover that commits nested repos, removes gitlinks, removes or migrates nested .git directories, and adds the full oss/cloud trees to the parent repo in one reviewed operation."
+  notes:
+    - "Root workspace install now succeeds with 25 workspace projects."
+    - "Cloud package manifests no longer declare link:../oss package edges."
+    - "Root-driven oss and cloud typechecks pass."
+
+metadata:
+  estimated_effort_hours: 12
+  ai_model: "gpt-5"
+  tags:
+    - "workspace"
+    - "repo-topology"
+    - "package-boundaries"

.ai/specs/active/icey-cli-upstream-binding.yaml → .ai/specs/archive/2026-04/icey-cli-upstream-binding.yaml

@@ -1,7 +1,7 @@
 spec_version: "1.1"
 task_id: "icey-cli-upstream-registry-binding"
 created: "2026-04-16T01:35:44Z"
-updated: "2026-04-16T01:35:44Z"
+updated: "2026-04-23T15:27:08Z"
 status: "completed"
 
 task: