feat: raptor profile cross-check in status/login + local-mode docs in meta-skill

[anujhydrabadi]

Problem

praxis and raptor keep completely independent credential stores and profile selection (~/.praxis/credentials + pointer files vs ~/.facets/credentials + FACETS_PROFILE env). Nothing cross-checks them. For a power user with multiple profiles on each side, an AI host passes the skills' raptor preflight (raptor whoami succeeds — on the wrong control plane) and then mixes control-plane reads/writes on tenant A with praxis mcp k8s/cloud ops on tenant B, with no error anywhere.

Separately: local mode (per-directory profiles) was not explained in any installed skill — only in --help and CLAUDE.md, so AI hosts never learn it exists.

Changes

1. internal/raptorstate (new, 95.9% cov) — read-only mirror of raptor's own profile-resolution chain (raptor/pkg/config.GetProfile): env override → praxis pin → FACETS_PROFILE → [default] → sole profile. Never writes raptor's store, never touches its tokens.
2. praxis status gains a raptor block:

   "raptor": {"installed": true, "found": true, "pinned": false,
              "profile": "default", "source": "default",
              "control_plane_url": "https://root.console.facets.cloud",
              "username": "…", "matches_praxis_url": false}

   matches_praxis_url is a host comparison against the active praxis profile URL. Human output gets a one-line raptor: row.
3. praxis login --raptor-profile <name> — durable pairing stored as raptor_profile on the praxis profile (INI-charset validated at the store boundary). Validation is advisory: warnings on a missing or host-mismatched raptor profile, never a failed login. Plain re-logins preserve the pairing; status resolves raptor via the pin ("pinned": true, "source": "pin").
4. ExecutionPreamble + praxis meta-skill teach AI hosts the contract: check the raptor block; when pinned, prefix every raptor command with FACETS_PROFILE=<profile> (per-command — env doesn't persist across shell calls); on an unexplained matches_praxis_url: false, ask the user before any raptor write. askpraxis.ai profiles are called out as expected-mismatch.
5. Meta-skill: "Per-directory profiles (local mode)" section — documents login --profile X --local, refresh-skills --project, the .praxis/config.json pointer, and profile_source: "project" / project_root in status.
6. README (command surface, new "Pairing with raptor profiles" section) + CLAUDE.md structure note.

Testing

• make test / make lint green; go test -race ./... clean.
• New coverage: raptorstate 95.9%; cmd 68.1% → 68.6% (new funcs 90–100%).
• Live-verified on a machine with 7 praxis / 6 raptor profiles: caught a real mismatch (repo tree pinned to facetsdemo, raptor default → root); --raptor-profile root reuse-path login stored the pairing, status reported "source": "pin", "matches_praxis_url": true, and the reinstalled skills carry the new preamble + sections.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4d9b5d33-7724-4e52-a823-e2a5bce88bb4

📥 Commits

Reviewing files that changed from the base of the PR and between 50972a7 and 32bfee0.

📒 Files selected for processing (15)

• CLAUDE.md
• README.md
• cmd/login.go
• cmd/login_raptor_test.go
• cmd/login_reuse_test.go
• cmd/status.go
• cmd/status_test.go
• internal/credentials/credentials.go
• internal/credentials/credentials_test.go
• internal/raptorstate/raptorstate.go
• internal/raptorstate/raptorstate_test.go
• internal/render/preamble.go
• internal/render/preamble_test.go
• internal/skillinstall/dummy.go
• internal/skillinstall/dummy_test.go

---

_{Comment @coderabbitai help to get the list of available commands.}