Add solana launch readiness skill

solana-launch-readiness-skill/CLAUDE.md

@@ -0,0 +1 @@
+Read skill/SKILL.md to assess Solana launch readiness.

solana-launch-readiness-skill/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Faadil Boussari
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

solana-launch-readiness-skill/README.md

@@ -0,0 +1,152 @@
+# solana-launch-readiness-skill
+
+solana-launch-readiness-skill doesn't help you ship faster — it tells your agent when NOT to ship yet.
+
+Detects launch context (demo, devnet, mainnet-no-funds, mainnet-with-funds) and applies Solana-specific severity accordingly — a hot wallet authority is a warning on devnet and a hard BLOCKER on mainnet with funds.
+
+Every BLOCKER comes with the exact fix command. No vague advice.
+
+## What This Is
+
+This is a default-deny Solana launch verdict engine, not a checklist. It assumes `NOT_LAUNCH_READY` until evidence proves otherwise, and it outputs exactly one verdict:
+
+- `LAUNCH_READY`
+- `LAUNCH_READY_WITH_RISKS`
+- `NOT_LAUNCH_READY`
+
+The verdict comes from 19 criteria across 5 domains:
+
+- **Security & Authority** — upgrade authority, build verifiability, IDL/interface evidence, vulnerability status, external review
+- **Testing Evidence** — core instruction coverage, error-path tests, live integration evidence, test-keypair isolation
+- **RPC & Runtime Reliability** — dedicated RPC, retry logic, transaction simulation, spending caps
+- **Documentation & Discoverability** — correct program ID, error mapping, security disclosure process
+- **Demo & Submission Confidence** — reachable demo, demo wallet funding, submission completeness
+
+Severity for every criterion depends on detected launch context — the same gap (e.g., a hot-wallet upgrade authority) can be a HIGH on devnet and a hard BLOCKER on mainnet with real funds.
+
+## Install
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/Faadil1/solana-launch-readiness-skill/main/install.sh)
+```
+
+Or clone and install locally:
+
+```bash
+git clone https://github.com/Faadil1/solana-launch-readiness-skill.git
+cd solana-launch-readiness-skill
+./install.sh
+```
+
+## Usage
+
+### Example 1 — `MAINNET_WITH_FUNDS` → `NOT_LAUNCH_READY`
+
+Project has a hot-wallet upgrade authority and uses the shared public RPC endpoint.
+
+```
+> /launch-check
+Context detected: MAINNET_WITH_FUNDS
+
+NOT_LAUNCH_READY
+
+BLOCKER A1 — Upgrade authority is a hot wallet.
+  Fix: solana program set-upgrade-authority <PROGRAM_ID> <SQUADS_MULTISIG_ADDRESS>
+
+BLOCKER C1 — Production RPC is api.mainnet-beta.solana.com.
+  Fix: set RPC_URL to a dedicated Helius/Triton endpoint before launch.
+```
+
+### Example 2 — `DEVNET` → `LAUNCH_READY_WITH_RISKS`
+
+Project is missing core instruction tests and has no recent integration evidence.
+
+```
+> /launch-check
+Context detected: DEVNET
+
+LAUNCH_READY_WITH_RISKS
+
+HIGH B1 — Core instruction tests missing for 2 of 5 instructions.
+  Fix: add LiteSVM or cargo test coverage for the untested instructions.
+
+HIGH B3 — No integration test run found within the last 48 hours.
+  Fix: run the integration suite against devnet or Surfpool and retain the dated log.
+```
+
+### Example 3 — `DEMO_HACKATHON` → `LAUNCH_READY`
+
+Project has a working demo link, README and LICENSE present, and makes no real-funds claim.
+
+```
+> /launch-check
+Context detected: DEMO_HACKATHON
+
+LAUNCH_READY
+
+No BLOCKERs. No unresolved HIGH risks.
+```
+
+## Signature Example
+
+```text
+> /launch-check
+
+Detected launch context: MAINNET_WITH_FUNDS
+
+Verdict: NOT_LAUNCH_READY
+
+BLOCKER A1 — Upgrade authority is a hot wallet.
+Fix: solana program set-upgrade-authority <PROGRAM_ID> --new-upgrade-authority <SQUADS_MULTISIG_ADDRESS>
+
+BLOCKER C1 — Production RPC is api.mainnet-beta.solana.com.
+Fix: set RPC_URL to a dedicated Helius/Triton/QuickNode endpoint before launch.
+
+Next Fix:
+Move upgrade authority away from a hot wallet before any funded mainnet launch.
+```
+
+## Commands
+
+- **`/launch-check`** — runs the full verdict flow: classifies launch context, loads only the relevant domain modules, evaluates applicable criteria, and returns one of the three verdicts above with named BLOCKERs and HIGH risks.
+- **`/fix-blockers`** — takes the most recent `/launch-check` result and produces an ordered fix plan, pulling exact commands from the remediation guide. Requires a prior `/launch-check` run.
+
+## Verified
+
+Remote installer tested from GitHub raw:
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/Faadil1/solana-launch-readiness-skill/main/install.sh)
+```
+
+Verified result:
+
+```text
+Installed solana-launch-readiness to ~/.claude/skills/solana-launch-readiness
+Available commands: /launch-check, /fix-blockers
+PASS_MAIN
+```
+
+Cloud sanity harness:
+
+```bash
+./tests/cloud-sanity.sh
+```
+
+Verified result:
+
+```text
+ALL CLOUD SANITY CHECKS PASSED
+```
+
+## Rule
+
+`no-shared-rpc` passively warns whenever `api.mainnet-beta.solana.com` (or `clusterApiUrl('mainnet-beta')`) appears in a project file, independent of running `/launch-check`. It does not assume launch context on its own — it points to `/launch-check` for the full context-aware verdict.
+
+## Safety Boundaries
+
+This skill never asks for private keys or seed phrases, never sends transactions, and never modifies wallet authorities or deployments directly. Every fix is presented as an exact command for the user to run themselves.
+
+## License
+
+MIT

solana-launch-readiness-skill/commands/fix-blockers.md

@@ -0,0 +1,80 @@
+# /fix-blockers
+
+Convert a prior `/launch-check` result into an ordered remediation plan using `skill/remediation.md` as the source of truth. This command does not re-derive fixes — it pulls them from that module. It does not re-run the full launch check unless the user explicitly asks for that.
+
+## Procedure
+
+**STEP 1 — Get the source verdict.**
+Use the most recent `/launch-check` result available in this conversation. If none exists, stop and instruct the user to run `/launch-check` first — do not guess at a verdict or context to proceed without one.
+
+**STEP 2 — Extract from that verdict:**
+- detected launch context
+- the verdict itself
+- every named BLOCKER
+- every named HIGH risk
+- any criteria listed under missing evidence
+
+**STEP 3 — Load `skill/remediation.md`.** For each BLOCKER and HIGH extracted in STEP 2, find that criterion's entry in `remediation.md` and use its fix, verification step, and "what not to do" guidance exactly as written there. Do not invent a fix not present in `remediation.md`.
+
+**STEP 4 — Order the plan:**
+1. BLOCKERs first, in the order they appeared in the source verdict
+2. HIGH risks second
+3. Missing evidence that is currently preventing a criterion from being classified at all
+
+**STEP 5 — Mark judgment calls.** Any fix that `remediation.md` labels as requiring a decision only the user can make (e.g., selecting multisig signers, engaging an external auditor, deciding where to move excess demo funds) must be marked `requires human approval: yes` with a one-line explanation of what the user needs to decide. All other fixes are `requires human approval: no`.
+
+**STEP 6 — Handle a clean verdict.** If the source verdict is `LAUNCH_READY`, do not produce a BLOCKER/HIGH fix plan — state that none is needed, and optionally list any MEDIUM advisories from the source verdict if present.
+
+## Safety Boundaries
+
+Never execute any command in the plan. Never request a private key, seed phrase, or keypair file content, under any phrasing. Never move funds or change an upgrade authority — only present the exact command for the user to run themselves. Never instruct the user to paste a secret into chat.
+
+## Required Output Format
+
+```
+# Solana Launch Fix Plan
+
+Source verdict: <LAUNCH_READY | LAUNCH_READY_WITH_RISKS | NOT_LAUNCH_READY>
+Detected launch context: <context>
+
+## Priority 1 — BLOCKERs
+1. <ID> — <title>
+   Why it blocks: <reason>
+   Fix:
+   ```bash
+   <exact command if applicable>
+   ```
+   Verify:
+   ```bash
+   <verification command/check>
+   ```
+   Human approval: <yes/no, explain if yes>
+
+## Priority 2 — HIGH Risks
+1. <ID> — <title>
+   Why it matters: <reason>
+   Fix: <command/action>
+   Verify: <verification check>
+   Human approval: <yes/no, explain if yes>
+
+## Missing Evidence
+- <ID> — <what is needed to classify this criterion>
+
+## Do Not Do
+- <safety boundary relevant to this plan's fixes>
+
+## Re-check Command
+Run `/launch-check` again after completing the fixes above.
+```
+
+If the source verdict has zero BLOCKERs and zero HIGH risks, output only:
+```
+No blocker fix plan needed. Re-run /launch-check only after material changes.
+```
+followed by any MEDIUM advisories from the source verdict, if present.
+
+## Output Discipline
+
+- Do not invent a fix, command, or verification step that is not present in `skill/remediation.md` for that criterion ID.
+- Do not reproduce the full contents of `remediation.md` — pull only the entries relevant to the BLOCKERs and HIGH risks named in the source verdict.
+- Keep every fix command-oriented: a concrete command, file edit, or named action — not a general instruction to "improve" or "review" something.

solana-launch-readiness-skill/commands/launch-check.md

@@ -0,0 +1,78 @@
+# /launch-check
+
+Run the full Solana launch readiness verdict flow using `skill/SKILL.md` as the source of truth for severity, routing, and verdict logic. This command does not duplicate that logic — it invokes it.
+
+## Default Assumption
+
+Start every run from `NOT_LAUNCH_READY`. Do not move off this default until evidence for the relevant criteria has actually been checked.
+
+## Procedure
+
+**STEP 0 — Classify launch context.**
+Determine one of: `DEMO_HACKATHON`, `DEVNET`, `MAINNET_NO_FUNDS`, `MAINNET_WITH_FUNDS`, per `skill/SKILL.md` STEP 0. If the project files do not make this unambiguous, ask exactly one clarifying question and stop — do not proceed to STEP 1 on an assumed context.
+
+**STEP 1 — Classify project type.**
+Determine one of: on-chain program, frontend-only dApp, documentation/submission review, full-stack Solana project.
+
+**STEP 2 — Load only relevant modules**, per the routing table in `skill/SKILL.md`:
+- on-chain program → `security.md` + `testing.md`
+- frontend-only dApp → `rpc.md` + `demo.md`
+- documentation/submission review → `docs.md` + `demo.md`
+- full-stack project → all five domain modules
+- if any BLOCKER or HIGH is found in STEP 3 → also load `remediation.md`
+
+Do not load a module with no applicable criteria for the detected project type.
+
+**STEP 3 — Evaluate only the criteria in the loaded modules.** For each, gather evidence per that module's "what to check" guidance and classify as resolved, unresolved, or missing. Apply the context-aware severity for the STEP 0 context, as defined in that criterion's section of `SKILL.md` and the relevant domain module — do not re-derive severity from memory; read it from the table.
+
+**STEP 4 — Apply verdict logic** from `skill/SKILL.md`. Hard rule: never output `LAUNCH_READY` while any criterion that is BLOCKER-severity for the detected context remains unresolved. This rule cannot be overridden by narration, confidence, or stated intent to fix later.
+
+**STEP 5 — If any BLOCKER or HIGH is unresolved**, pull the exact fix for each from `skill/remediation.md` — do not invent a fix; use the one defined there for that criterion ID.
+
+## Safety Boundaries
+
+Do not send transactions, change upgrade authorities, query private wallet data, or request private keys, seed phrases, or keypair file content at any point in this command. All fixes are presented as commands or actions for the user to run themselves.
+
+## Required Output Format
+
+```
+# Solana Launch Readiness Verdict
+
+Detected launch context: <context>
+Project type: <type>
+Loaded modules: <modules>
+
+Verdict: <LAUNCH_READY | LAUNCH_READY_WITH_RISKS | NOT_LAUNCH_READY>
+
+## BLOCKERs
+- <ID> — <title>
+  Evidence: <what was found/missing>
+  Fix: <exact command/action from remediation.md>
+
+## HIGH Risks
+- <ID> — <title>
+  Evidence: <what was found/missing>
+  Fix: <recommended action>
+
+## MEDIUM Advisories
+- <ID> — <summary>
+
+## Evidence Table
+| ID | Status | Severity | Evidence |
+|---|---|---|---|
+
+## Missing Evidence
+- <ID> — <what is needed>
+
+## Next Fix
+<single highest-priority next action>
+```
+
+If no BLOCKER, HIGH, or MEDIUM finding exists for the loaded modules, still output every section above — use `None` in place of list items rather than omitting the section. A clean result can legitimately produce `Verdict: LAUNCH_READY`.
+
+## Output Discipline
+
+- Verdict comes first, before any explanatory detail.
+- Do not invent evidence — every line in the Evidence Table must trace to something actually checked, read, or stated by the user. If a criterion's evidence could not be gathered, list it under Missing Evidence instead of guessing.
+- Do not reproduce the full 19-criteria severity table from `SKILL.md` in the output — reference the criterion ID and its severity for this run only.
+- Keep BLOCKER and HIGH entries concrete: name the ID, the title, what was actually found or missing, and the fix — not a general statement that something needs attention.