@appsforgood/next-supabase-kit 0.1.1 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.1.4
+
+- Added true multi-agent IDE activation for **Cursor** (`.cursor/agents/*.md`, `.cursor/skills/*/SKILL.md`, scoped rules) and **Codex** (`.codex/agents/*.toml` with model routing effort) via `agent-kit init --activate cursor|codex`.
+- Added shared roster adapter generation (`roster-adapters.ts`) and assistant adapter table parsing so audit and `adapter validate` warn when Active Cursor/Codex rows lack specialist files.
+- Fixed setup wizard IDE activation order so `present` is detected after files are generated and conflicts are returned in the API response.
+- Quoted YAML frontmatter in generated Cursor/Claude subagents and Cursor skills so descriptions with colons or quotes remain valid.
+- Stopped post-copy mutation of existing `.codex/config.toml`; conflict-safe copy behavior now protects customized Codex config.
+- Fixed `cursor-planner.mdc` scoped rule frontmatter and expanded adapter validation, IDE activation, and SSE stream tests.
+
+## 0.1.3
+
+- Added Antigravity runtime adapter support with `agent-kit init --activate antigravity`, `antigravity/plugin.json`, native `/setup`, `/audit`, `/plan`, `/handoff`, `/frontend`, `/security`, `/copy`, `/ship`, and `/upgrade` command files, and portable `runtime-skills/*/SKILL.md` wrappers.
+- Added `agent-kit adapter validate` and `agent-kit package validate` so runtime adapter assets, package allowlists, portable skills, examples, and source-package audit behavior are release-gated.
+- Fixed package-source audit mode so the source repository validates shipped templates and package assets without requiring installed-project root docs such as `AGENTS.md` or `.agent-kit/manifest.json`.
+- Updated development dependencies for TypeScript 6 and Node 25 type coverage, while preserving the package runtime floor at Node 20.
+- Hardened GitHub CI by keeping OpenSSF Scorecard write scopes at job level and documenting Dependency Review's dependency-graph requirement.
+- Updated `actions/upload-artifact` to v7 in release and research workflows to avoid the GitHub Actions Node 20 runtime deprecation window.
+- Added an `esbuild` override to clear the release-gate dependency audit without downgrading `tsup`.
+- Hardened npm Trusted Publishing by scrubbing inherited `NODE_AUTH_TOKEN` state and publishing with a token-free npm config.
+- Added **`agent-kit init --activate`** for Claude Code (`.claude/agents/*.md`, `CLAUDE.md`), Copilot (`.github/copilot-instructions.md`), and Codex (`.codex/config.toml`) IDE parity.
+- Plain **`agent-kit init`** now always creates `.agent-kit/project-context.json` and ships `.github/workflows/agent-kit-audit.yml`.
+- Added code-aware audit tier (`project-reality` vs `docs-hygiene`): Supabase migration RLS parsing, test-script verification, and secret-pattern scanning.
+- Added **`agent-kit session checkpoint --file`** batch API for council evidence logging.
+- Reference `.agent-kit/agent-briefs.md` in all assistant adapters.
+- Release workflow publishes through npm Trusted Publishing/OIDC without `NODE_AUTH_TOKEN`, avoiding OTP-bound token automation.
+
+## 0.1.2
+
+- Added pixel **Agent Office** as the default `agent-kit setup` view with canvas agents, break-room amenities (coffee, water cooler), agent movement, and high-res floor rendering.
+- Added local setup wizard form fallback at `/wizard`, progressive depth (Quick/Standard/Complete), resume state, and agent briefing drafts.
+- Fixed setup routing so `/setup` serves the office; added form-to-office navigation, port-in-use CLI warnings, and `data-view` markers for debugging.
+- Added **`agent-kit studio serve`** — localhost live session viewer with SSE event stream, speech bubbles, and transcript panel reusing the office canvas.
+
 ## 0.1.1
 
 - Completed npm package rename from `@agent-skills/next-supabase-kit` to `@appsforgood/next-supabase-kit` across CLI defaults, shipped docs, templates, examples, tests, and release scripts.

package/README.md

@@ -17,11 +17,20 @@ It also includes a local Agent Studio workflow: project context, durable human c
 Use this in a Next.js + Supabase project after the public package is available on npm:
 
 ```bash
-npx @appsforgood/next-supabase-kit init --stack next-supabase
+npx @appsforgood/next-supabase-kit init --stack next-supabase --setup --open
 npx @appsforgood/next-supabase-kit audit
 npx @appsforgood/next-supabase-kit audit --min-readiness baseline-setup
 ```
 
+After install, the **Agent Office** setup view teaches agents about your project (~10 min). Resume anytime:
+
+```bash
+npx @appsforgood/next-supabase-kit setup --open
+npx @appsforgood/next-supabase-kit setup --status
+npx @appsforgood/next-supabase-kit init --activate antigravity
+npx @appsforgood/next-supabase-kit adapter validate antigravity
+```
+
 The installer preserves existing docs. If a file already exists and differs from the template, the new version is written to `.agent-kit/conflicts/` for review.
 
 For local development of this repo:
@@ -64,6 +73,7 @@ For meaningful multi-agent work, record the decision, risk, next handoff, requir
 For local Agent Studio sessions, use:
 
 ```bash
+agent-kit setup
 agent-kit init --guided
 agent-kit context validate
 agent-kit session start "Build checkout flow" --workflow frontend-change
@@ -108,8 +118,9 @@ The `.agent-kit/` folder includes:
 - `model-routing.json` for provider-neutral model profile routing.
 - `project-context.json`, `project-context.md`, `corrections/`, and `council-sessions/` for local Agent Studio context, correction rules, session events, and rendered transcripts.
 - `schemas/` for agent roster, council-session, model-routing, project context, correction rules, session events, studio sessions, and audit-report contracts.
-- `agents/`, `skills/`, `prompts/`, and `checklists/`.
-- `assistant-adapters/` for Codex/AGENTS.md-compatible tools, GitHub Copilot/VS Code, Cursor, and Claude Code.
+- `agents/`, `skills/`, `runtime-skills/`, `prompts/`, and `checklists/`.
+- `assistant-adapters/` for Codex/AGENTS.md-compatible tools, GitHub Copilot/VS Code, Cursor, Claude Code, and Antigravity.
+- `antigravity/` for native command and plugin assets.
 - `design-briefs/` for SaaS, admin, marketplace, content, tool, ecommerce, portfolio/venue, education, community/social, and AI workflow surfaces.
 - `profiles/` for product-type and adjacent-stack adaptation.
 
@@ -119,6 +130,8 @@ The `.agent-kit/` folder includes:
 agent-kit audit
 agent-kit audit --json
 agent-kit audit --min-readiness baseline-setup
+agent-kit adapter validate antigravity
+agent-kit package validate
 agent-kit context init
 agent-kit session start "Short task name"
 agent-kit session output "verification evidence" --status complete --evidence "npm test"
@@ -147,6 +160,8 @@ Agent Kit separates the mechanisms that make AI coding repeatable:
 - Instructions: `AGENTS.md`, assistant adapters, and IDE-specific rule files.
 - Roster: `.agent-kit/agent-roster.json` chooses agents, workflows, and handoffs.
 - Skills: `.agent-kit/skills/` keeps specialist workflows reusable.
+- Runtime commands: Antigravity `commands/*.toml` expose `/setup`, `/audit`, `/plan`, `/handoff`, `/frontend`, `/security`, `/copy`, `/ship`, and `/upgrade` as native adapter entrypoints.
+- Portable skills: `runtime-skills/*/SKILL.md` wraps canonical `skills/*.md` files for runtimes that discover skill directories.
 - Model routing: `MODEL_ROUTING.md` and `.agent-kit/model-routing.json` map agents to model profiles.
 - Messaging: `MESSAGING.md` records audience, pain, outcome, proof, objections, voice, and conversion evidence for public-facing copy.
 - Local Agent Studio: `.agent-kit/project-context.*`, `.agent-kit/corrections/*.json`, and `.agent-kit/council-sessions/*` keep context, corrections, decisions, handoffs, required-output status, artifacts, verification, and rendered Markdown transcripts local.
@@ -155,6 +170,8 @@ Agent Kit separates the mechanisms that make AI coding repeatable:
 
 Some IDEs can partially enforce model settings; others only let project files advise the user. The kit records that difference instead of pretending every tool can force per-agent model selection.
 
+Runtime command files are adapters only. `AGENTS.md`, `.agent-kit/agent-roster.json`, `QUALITY_GATES.md`, and Agent Studio session evidence remain the canonical operating model.
+
 ## Frontend Quality Bar
 
 The kit is intentionally strict about frontend work because normal AI output often looks generic.

package/REPOSITORY_SETTINGS.md

@@ -33,6 +33,7 @@ Create environment `npm-publish` with:
 - Deployment branches restricted to `main` and release events.
 - No npm publish token secret for the trusted-publishing flow.
 - Any legacy npm token secrets deleted after Trusted Publishing is confirmed.
+- Optional fallback: a maintainer npm publish token secret on the `npm-publish` environment when trusted publishing returns 404 on PUT.
 
 The npm trusted publisher must match:
 

package/UPGRADE.md

@@ -16,9 +16,10 @@ Before publishing a new package version:
 1. Update `CHANGELOG.md` with user-visible changes, migration notes, and deprecations.
 2. Update `ROADMAP.md` and `BEST_PRACTICE_EVIDENCE.md` when a research finding becomes enforced behavior.
 3. Run `npm run release:check`.
-4. Confirm the pack dry run includes only public-safe files.
-5. Publish through npm Trusted Publishing.
-6. Verify public install with `npx @appsforgood/next-supabase-kit`.
+4. Run `agent-kit package validate` from the source repository when runtime adapter or package assets changed.
+5. Confirm the pack dry run includes only public-safe files.
+6. Publish through npm Trusted Publishing.
+7. Verify public install with `npx @appsforgood/next-supabase-kit`.
 
 ## Downstream Upgrade Checklist
 
@@ -28,6 +29,7 @@ From a downstream project:
 npx @appsforgood/next-supabase-kit@latest doctor
 npx @appsforgood/next-supabase-kit@latest diff
 npx @appsforgood/next-supabase-kit@latest update
+npx @appsforgood/next-supabase-kit@latest adapter validate antigravity
 npx @appsforgood/next-supabase-kit@latest audit --min-readiness baseline-setup
 ```
 
@@ -48,8 +50,9 @@ npx @appsforgood/next-supabase-kit@latest audit --min-readiness best-practice-ca
 3. Check `.agent-kit/conflicts/` before accepting template updates.
 4. Preserve valid local customizations in `.agent-kit/overrides.json`.
 5. Review `AGENTS.md`, `AGENT_ROSTER.md`, `ASSISTANT_ADAPTERS.md`, `MODEL_ROUTING.md`, `COUNCIL.md`, `QUALITY_GATES.md`, `SECURITY.md`, `TESTING.md`, `DEPLOYMENT.md`, and this file.
-6. Run project tests and release checks before merging.
-7. Record any accepted deviations in `DECISIONS.md`.
+6. If using Antigravity, review `.antigravity/agent-kit/plugin.json`, `.antigravity/agent-kit/commands/*.toml`, and `.antigravity/runtime-skills/*/SKILL.md`.
+7. Run project tests and release checks before merging.
+8. Record any accepted deviations in `DECISIONS.md`.
 
 ## Next.js And Supabase Stack Upgrades
 
@@ -74,4 +77,5 @@ Keep rollback evidence next to the upgrade:
 
 | Date | From | To | Scope | Evidence | Owner |
 | --- | --- | --- | --- | --- | --- |
+| 2026-06-14 | TypeScript 5 / Node 22 types | TypeScript 6 / Node 25 types | Dev dependency update for package validation and CI parity | `npm run typecheck`, `npm test`, `npm audit --audit-level=moderate` | Maintainers |
 | TBD | TBD | TBD | TBD | TBD | TBD |

package/antigravity/commands/audit.toml

@@ -0,0 +1,16 @@
+name = "audit"
+description = "Run the Agent Kit maturity audit and convert findings into concrete follow-up work."
+
+prompt = """
+Run the Agent Kit audit workflow.
+
+Canonical sources: QUALITY_GATES.md, AGENTS.md, .agent-kit/agent-roster.json, SPEC.md, SECURITY.md, TESTING.md, DEPLOYMENT.md, and ASSISTANT_ADAPTERS.md.
+
+Workflow:
+1. Run `agent-kit audit --json`.
+2. Classify failures before warnings.
+3. Map each finding to the responsible council role.
+4. Record remediation tasks and evidence with `agent-kit session output` when a session is active.
+
+Required outputs: readiness level, failures, warnings, owner/council role, remediation order, verification command.
+"""

package/antigravity/commands/copy.toml

@@ -0,0 +1,16 @@
+name = "copy"
+description = "Route public-facing and conversion-facing copy through messaging and proof gates."
+
+prompt = """
+Run the marketing-copy workflow.
+
+Canonical sources: MESSAGING.md, DESIGN.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/skills/positioning-messaging.md, and .agent-kit/skills/conversion-copywriting.md.
+
+Workflow:
+1. Start with Marketing Copy Lead for public-facing, onboarding, pricing, CTA, landing, empty-state, or conversion-facing copy.
+2. Confirm audience, pain, outcome, differentiator, proof, objections, voice, and conversion goal.
+3. Mark unsupported claims as assumptions.
+4. Handoff accepted copy to Frontend Design Lead for hierarchy and layout fit.
+
+Required outputs: audience, problem/pain/outcome, value proposition, proof, objections, voice/tone, CTA hierarchy, risky-claim review.
+"""

package/antigravity/commands/frontend.toml

@@ -0,0 +1,17 @@
+name = "frontend"
+description = "Route frontend work through content-first design, accessibility, and visual QA gates."
+
+prompt = """
+Run the frontend-change workflow.
+
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, MESSAGING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/design-briefs/, .agent-kit/prompts/screenshot-review.md, and .agent-kit/skills/frontend-design-system.md.
+
+Workflow:
+1. Start with Frontend Design Lead before implementation.
+2. Confirm brand/content intake, user needs, real content, creative direction, references, anti-references, and source-safety notes.
+3. Require distinctiveness benchmark and product-quality scorecard for significant UI.
+4. Preserve WCAG 2.1 AA, keyboard flow, responsive states, and loading/error/empty/success states.
+5. Record visual QA and accessibility evidence with `agent-kit session output`.
+
+Required outputs: design direction, reference evidence, product-specific UI rationale, state coverage, accessibility checks, desktop/mobile visual QA.
+"""

package/antigravity/commands/handoff.toml

@@ -0,0 +1,16 @@
+name = "handoff"
+description = "Record durable Agent Studio handoff evidence between council roles."
+
+prompt = """
+Run the Agent Kit handoff workflow.
+
+Canonical sources: COUNCIL.md, .agent-kit/council-sessions/, .agent-kit/schemas/session-event.schema.json, AGENT_ROSTER.md, and .agent-kit/agent-roster.json.
+
+Workflow:
+1. Identify source agent, target agent, decision, risk, and evidence.
+2. Use `agent-kit session handoff --from <agent> --to <agent> --decision <decision> --risk <risk> --evidence <evidence>`.
+3. Mark required outputs with `agent-kit session output`.
+4. Run `agent-kit session render`.
+
+Required outputs: source agent, target agent, decision, risk, evidence path, required-output status, rendered session path.
+"""

package/antigravity/commands/plan.toml

@@ -0,0 +1,18 @@
+name = "plan"
+description = "Create an implementation-ready Agent Kit plan through Planner and Lead Architect routing."
+
+prompt = """
+Run the planning workflow.
+
+Canonical sources: AGENTS.md, AGENT_ROSTER.md, .agent-kit/agent-roster.json, MODEL_ROUTING.md, .agent-kit/model-routing.json, .agent-kit/project-context.md, .agent-kit/corrections/project-rules.json, COUNCIL.md, and QUALITY_GATES.md.
+
+Workflow:
+1. Start with Planner.
+2. Name the active workflow and maturity target from QUALITY_GATES.md.
+3. Map affected layers: data, business logic, presentation, auth, deployment, docs, and tests.
+4. Name preserved behavior and compatibility constraints.
+5. Route core changes through Lead Architect before implementation.
+6. Record decision, risk, next handoff, and required outputs with `agent-kit session ...` when available.
+
+Required outputs: goal, affected layers, preserved capabilities, implementation sequence, risks, tests, docs, handoffs, acceptance criteria.
+"""

package/antigravity/commands/security.toml

@@ -0,0 +1,16 @@
+name = "security"
+description = "Run OWASP, auth, RLS, dependency, secret, and external-call review before acceptance."
+
+prompt = """
+Run the security-review workflow.
+
+Canonical sources: SECURITY.md, .agent-kit/checklists/owasp.md, .agent-kit/checklists/rls.md, .agent-kit/skills/owasp-security-review.md, AGENTS.md, and .agent-kit/agent-roster.json.
+
+Workflow:
+1. Route through Security Reviewer for auth, RLS, API, Server Action, data mutation, dependency, secret, external-call, upload, or release-risk changes.
+2. Check OWASP Top 10, IDOR, SSRF, injection, broken auth, unsafe output rendering, secret leakage, and vulnerable dependencies.
+3. Verify service-role access stays server-only.
+4. Record findings with severity, exploit path, affected behavior, and remediation.
+
+Required outputs: reviewed boundaries, findings, severity, exploit path, mitigation, negative authorization tests or skipped rationale.
+"""

package/antigravity/commands/setup.toml

@@ -0,0 +1,16 @@
+name = "setup"
+description = "Onboard the project into Agent Kit context and verify runtime adapter setup."
+
+prompt = """
+Run Agent Kit setup as a runtime command.
+
+Canonical sources: AGENTS.md, AGENT_ROSTER.md, .agent-kit/agent-roster.json, MODEL_ROUTING.md, .agent-kit/model-routing.json, QUALITY_GATES.md, and ASSISTANT_ADAPTERS.md.
+
+Workflow:
+1. Run or recommend `agent-kit setup --open` when project context is missing.
+2. Validate context with `agent-kit context validate`.
+3. Confirm adapter evidence in ASSISTANT_ADAPTERS.md.
+4. Record setup evidence in an Agent Studio session when meaningful work starts.
+
+Required outputs: project context status, active IDE/runtime surface, model-selection status, remaining setup gaps, verification command.
+"""

package/antigravity/commands/ship.toml

@@ -0,0 +1,17 @@
+name = "ship"
+description = "Make a GO/NO-GO release call from council, security, QA, docs, deployment, and rollback evidence."
+
+prompt = """
+Run the ship workflow.
+
+Canonical sources: QUALITY_GATES.md, TESTING.md, SECURITY.md, DEPLOYMENT.md, UPGRADE.md, COUNCIL.md, .agent-kit/council-sessions/, and .agent-kit/agent-roster.json.
+
+Workflow:
+1. Confirm implementation scope and preserved behavior.
+2. Require code review, Security Reviewer signoff, QA/test evidence, accessibility evidence when UI changed, docs evidence, deployment/observability review, and rollback plan.
+3. Run the project release gate, normally `npm run release:check` for this package or the project-specific equivalent.
+4. Record verification with `agent-kit session verify`.
+5. Return GO only when required outputs are complete or explicitly not-applicable.
+
+Required outputs: code review, security review, QA/test review, accessibility/doc/deployment checks, rollback plan, release command, GO/NO-GO verdict.
+"""

package/antigravity/commands/upgrade.toml

@@ -0,0 +1,17 @@
+name = "upgrade"
+description = "Plan and verify Agent Kit, framework, dependency, and adapter upgrades with rollback evidence."
+
+prompt = """
+Run the upgrade-maintenance workflow.
+
+Canonical sources: UPGRADE.md, CHANGELOG.md, DECISIONS.md, DEPLOYMENT.md, .agent-kit/skills/upgrade-maintenance.md, and QUALITY_GATES.md.
+
+Workflow:
+1. Run `agent-kit diff` before accepting template changes.
+2. Preserve local overrides and review `.agent-kit/conflicts/`.
+3. Check framework release notes, codemods, migrations, generated types, RLS impact, and rollback risk when applicable.
+4. Run `agent-kit audit --min-readiness baseline-setup` after update.
+5. Record version, migration impact, verification, owner, and rollback evidence.
+
+Required outputs: version change, conflict review, migration impact, generated files/types, audit result, rollback plan, owner/date.
+"""

package/antigravity/plugin.json

@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "name": "agent-kit-next-supabase",
+  "displayName": "Agent Kit Next/Supabase",
+  "version": "0.1.3",
+  "description": "Runtime commands and portable skills for the Agent Kit Next/Supabase council workflow.",
+  "homepage": "https://github.com/lukey662/agentsandskills",
+  "sourceOfTruth": [
+    "AGENTS.md",
+    "AGENT_ROSTER.md",
+    ".agent-kit/agent-roster.json",
+    "MODEL_ROUTING.md",
+    ".agent-kit/model-routing.json",
+    "QUALITY_GATES.md",
+    "COUNCIL.md",
+    ".agent-kit/council-sessions/"
+  ],
+  "commands": [
+    { "name": "setup", "path": "commands/setup.toml" },
+    { "name": "audit", "path": "commands/audit.toml" },
+    { "name": "plan", "path": "commands/plan.toml" },
+    { "name": "handoff", "path": "commands/handoff.toml" },
+    { "name": "frontend", "path": "commands/frontend.toml" },
+    { "name": "security", "path": "commands/security.toml" },
+    { "name": "copy", "path": "commands/copy.toml" },
+    { "name": "ship", "path": "commands/ship.toml" },
+    { "name": "upgrade", "path": "commands/upgrade.toml" }
+  ],
+  "skills": [
+    { "name": "accessibility-wcag", "path": "../runtime-skills/accessibility-wcag/SKILL.md" },
+    { "name": "agent-handoff-tracing", "path": "../runtime-skills/agent-handoff-tracing/SKILL.md" },
+    { "name": "best-practice-maturity-review", "path": "../runtime-skills/best-practice-maturity-review/SKILL.md" },
+    { "name": "content-first-design", "path": "../runtime-skills/content-first-design/SKILL.md" },
+    { "name": "conversion-copywriting", "path": "../runtime-skills/conversion-copywriting/SKILL.md" },
+    { "name": "deployment-observability", "path": "../runtime-skills/deployment-observability/SKILL.md" },
+    { "name": "docs-maintainer", "path": "../runtime-skills/docs-maintainer/SKILL.md" },
+    { "name": "frontend-design-system", "path": "../runtime-skills/frontend-design-system/SKILL.md" },
+    { "name": "frontend-distinctiveness-benchmark", "path": "../runtime-skills/frontend-distinctiveness-benchmark/SKILL.md" },
+    { "name": "frontend-product-quality-rubric", "path": "../runtime-skills/frontend-product-quality-rubric/SKILL.md" },
+    { "name": "landing-page-copy", "path": "../runtime-skills/landing-page-copy/SKILL.md" },
+    { "name": "nextjs-app-router", "path": "../runtime-skills/nextjs-app-router/SKILL.md" },
+    { "name": "onboarding-empty-state-copy", "path": "../runtime-skills/onboarding-empty-state-copy/SKILL.md" },
+    { "name": "owasp-security-review", "path": "../runtime-skills/owasp-security-review/SKILL.md" },
+    { "name": "planning-council", "path": "../runtime-skills/planning-council/SKILL.md" },
+    { "name": "positioning-messaging", "path": "../runtime-skills/positioning-messaging/SKILL.md" },
+    { "name": "postgres-migrations", "path": "../runtime-skills/postgres-migrations/SKILL.md" },
+    { "name": "product-voice-tone", "path": "../runtime-skills/product-voice-tone/SKILL.md" },
+    { "name": "reference-led-design-critique", "path": "../runtime-skills/reference-led-design-critique/SKILL.md" },
+    { "name": "supabase-auth-rls", "path": "../runtime-skills/supabase-auth-rls/SKILL.md" },
+    { "name": "testing-qa", "path": "../runtime-skills/testing-qa/SKILL.md" },
+    { "name": "upgrade-maintenance", "path": "../runtime-skills/upgrade-maintenance/SKILL.md" },
+    { "name": "visual-regression-qa", "path": "../runtime-skills/visual-regression-qa/SKILL.md" }
+  ],
+  "validation": {
+    "agentKit": "agent-kit adapter validate antigravity",
+    "nativeOptional": "agy plugin validate"
+  }
+}

package/assistant-adapters/README.md

@@ -21,6 +21,7 @@ Adapters should point back to those files. Do not maintain separate policy, secu
 - `github-next-supabase.instructions.md`: path-aware Copilot/VS Code instructions for Next.js and Supabase files.
 - `cursor-agent-kit.mdc`: Cursor project-rule template.
 - `claude-code-subagents.md`: Claude Code project subagent template guidance.
+- `antigravity.md`: Antigravity plugin, command, runtime skill, and validation guidance.
 - `model-selection/`: dated setup examples for Codex, Claude Code, Cursor, and GitHub Copilot model routing.
 
 ## Activation Rule

package/assistant-adapters/antigravity.md

@@ -0,0 +1,56 @@
+# Antigravity Adapter
+
+This adapter packages Agent Kit as native Antigravity-style plugin assets while keeping the Agent Kit council contract canonical.
+
+## Source Of Truth
+
+- `AGENTS.md`
+- `AGENT_ROSTER.md`
+- `.agent-kit/agent-roster.json`
+- `MODEL_ROUTING.md`
+- `.agent-kit/model-routing.json`
+- `.agent-kit/project-context.json`
+- `.agent-kit/project-context.md`
+- `.agent-kit/corrections/project-rules.json`
+- `.agent-kit/corrections/agent-rules.json`
+- `COUNCIL.md`
+- `.agent-kit/council-sessions/`
+- `QUALITY_GATES.md`
+
+Runtime command files must wrap those files. Do not fork role definitions, security policy, frontend quality rules, release gates, or session evidence rules into command prompts.
+
+## Activation
+
+```bash
+agent-kit init --activate antigravity
+agent-kit adapter validate antigravity
+```
+
+This installs:
+
+- `.antigravity/agent-kit/plugin.json`
+- `.antigravity/agent-kit/commands/*.toml`
+- `.antigravity/runtime-skills/*/SKILL.md`
+- `.antigravity/agent-kit/README.md`
+
+If the `agy` CLI is available, teams may additionally run its native plugin validation. Agent Kit only requires structural validation because many projects will not have Antigravity installed locally.
+
+## Command Contract
+
+Commands expose short runtime entrypoints:
+
+- `/setup`
+- `/audit`
+- `/plan`
+- `/handoff`
+- `/frontend`
+- `/security`
+- `/copy`
+- `/ship`
+- `/upgrade`
+
+Each command must load project context and correction rules when present, select the appropriate roster workflow, record required outputs with `agent-kit session output`, and render sessions when evidence changes.
+
+## Security
+
+Do not place tokens, credentials, private URLs, database URLs, customer data, or hidden model reasoning in Antigravity plugin files, command files, or runtime skills.

package/assistant-adapters/claude-code-subagents.md

@@ -24,7 +24,7 @@ name: planner
 description: Use for planning, phasing, scope breakdown, workflow routing, and council setup in this repository.
 ---
 
-Read `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` before making routing decisions.
+Read `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/agent-briefs.md` when present, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` before making routing decisions.
 
 Start with the Planner workflow. For core changes, hand off to Lead Architect. For frontend changes, require Frontend Design Lead evidence. For auth, RLS, secrets, dependency, external-call, or release-risk changes, require Security Reviewer. Record meaningful decisions, risks, handoffs, human corrections, artifacts, evidence, and verification through Agent Studio session files when available.
 ```

package/assistant-adapters/codex-agents.md

@@ -11,19 +11,33 @@ Use `AGENTS.md` as the primary project instruction surface.
 - `.agent-kit/model-routing.json`
 - `.agent-kit/project-context.json`
 - `.agent-kit/project-context.md`
+- `.agent-kit/agent-briefs.md` when present
 - `.agent-kit/corrections/project-rules.json`
 - `.agent-kit/corrections/agent-rules.json`
 - `COUNCIL.md`
 - `.agent-kit/council-sessions/`
 - `QUALITY_GATES.md`
 
+## Council Custom Agents
+
+After `agent-kit init --activate codex`, council specialists live in `.codex/agents/*.toml`.
+
+Spawn a dedicated custom agent instead of role-playing the whole council in one thread:
+
+- **Planning / scope:** `.codex/agents/planner.toml`
+- **Security / RLS / secrets:** `.codex/agents/security-reviewer.toml` (high reasoning effort)
+- **Frontend UI:** `.codex/agents/frontend-design-lead.toml`
+- **QA / tests:** `.codex/agents/qa-engineer.toml`
+
+Each file sets `model_reasoning_effort` from `.agent-kit/model-routing.json`. Verify model names in your Codex environment against `MODEL_ROUTING.md`.
+
 ## Operating Rule
 
 When a task is planning-oriented, ambiguous, risky, frontend-facing, security-sensitive, or release-related, start from the roster workflow instead of treating the request as a single generic implementation pass.
 
 Use `MODEL_ROUTING.md` to choose the model profile or reasoning effort for the active role. Exact model names belong in dated config comments, not in the role definitions.
 
-Before meaningful work, load project context and active correction rules. For meaningful handoffs, record visible decisions and evidence with `agent-kit session ...` commands, then run `agent-kit session render`.
+Before meaningful work, load project context, agent briefs when present, and active correction rules. For meaningful handoffs, record visible decisions and evidence with `agent-kit session checkpoint --file <json>` or individual `agent-kit session ...` commands, then run `agent-kit session render`.
 
 ## Verification
 
@@ -33,3 +47,5 @@ Record in `ASSISTANT_ADAPTERS.md`:
 - The command, session, or screenshot that proves the instructions loaded.
 - The model-selection setting or profile used for the active role.
 - Any known limitations or manual invocation steps.
+
+Run `agent-kit adapter validate codex` after activation.

package/assistant-adapters/cursor-agent-kit.mdc

@@ -7,7 +7,7 @@ alwaysApply: true
 
 # Agent Kit Cursor Rule
 
-Use `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` as the source of truth.
+Use `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/agent-briefs.md` when present, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` as the source of truth.
 
 ## Routing
 
@@ -19,7 +19,8 @@ Use `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTI
 - Significant changes require living markdown updates.
 - Meaningful work should read project context and active corrections first.
 - Human corrections should be recorded before continuing and promoted to durable project or agent correction rules when they should affect future work.
-- Meaningful multi-agent work should use `agent-kit session ...` commands and render Markdown evidence when available.
+- Meaningful multi-agent work should use `agent-kit session checkpoint --file <json>` or individual `agent-kit session ...` commands and render Markdown evidence when available.
+- For council work, delegate to the matching project subagent in `.cursor/agents/` instead of role-playing every role in the main thread.
 
 ## Validation
 

package/assistant-adapters/cursor-frontend.mdc

@@ -0,0 +1,16 @@
+---
+description: Require Frontend Design Lead evidence for significant UI and component work.
+globs:
+  - "src/app/**"
+  - "src/components/**"
+  - "**/*.css"
+alwaysApply: false
+---
+
+# Frontend design gate reminders
+
+Significant UI changes require **Frontend Design Lead** review: brand/content intake, creative-direction rationale, reference-led critique, product-quality scorecard, accessibility, and visual QA evidence.
+
+Delegate to `@frontend-design-lead` in `.cursor/agents/frontend-design-lead.md` for isolated design review context.
+
+Reject generic AI-looking UI that is not specific to the product workflow and content model.

package/assistant-adapters/cursor-planner.mdc

@@ -0,0 +1,14 @@
+---
+description: Route ambiguous, planning, and cross-layer requests through the Planner workflow first.
+globs:
+  - "**/*"
+alwaysApply: false
+---
+
+# Planner routing
+
+When a request is ambiguous, planning-oriented, roadmap-related, or spans multiple layers, start with the **Planner** workflow before implementation.
+
+Delegate to the `@planner` subagent in `.cursor/agents/planner.md` when the task needs isolated planning context.
+
+Read project context, corrections, and `AGENT_ROSTER.md` before choosing a workflow.

package/assistant-adapters/cursor-security.mdc

@@ -0,0 +1,18 @@
+---
+description: Require Security Reviewer for auth, RLS, secrets, API mutations, and external calls.
+globs:
+  - "supabase/**"
+  - "**/auth/**"
+  - "**/api/**"
+  - "**/middleware.ts"
+  - "**/proxy.ts"
+alwaysApply: false
+---
+
+# Security gate reminders
+
+Auth, RLS, data mutation, dependency, secret, external-call, and release-risk changes require **Security Reviewer** review before acceptance.
+
+Delegate to `@security-reviewer` in `.cursor/agents/security-reviewer.md` or Task `security-review` for isolated review context.
+
+Verify OWASP Top 10, IDOR, SSRF, injection, broken auth, and least-privilege boundaries.

package/assistant-adapters/github-copilot-instructions.md

@@ -1,6 +1,6 @@
 # Repository Instructions
 
-This repository uses Agent Kit. Treat `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` as the source of truth for agent routing, project context, correction rules, model profiles, quality gates, and handoff evidence.
+This repository uses Agent Kit. Treat `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/agent-briefs.md` when present, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` as the source of truth for agent routing, project context, correction rules, model profiles, quality gates, and handoff evidence.
 
 ## Workflows
 

package/assistant-adapters/github-next-supabase.instructions.md

@@ -4,7 +4,7 @@ applyTo: "app/**/*.{ts,tsx},src/app/**/*.{ts,tsx},pages/**/*.{ts,tsx},src/pages/
 
 # Next.js + Supabase Agent Kit Instructions
 
-Follow `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md`.
+Follow `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/agent-briefs.md` when present, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md`.
 
 ## Next.js
 

package/assistant-adapters/model-selection/codex-config.example.toml

@@ -1,6 +1,9 @@
 # Codex model-selection example for Agent Kit.
 # Copy the relevant comments into ~/.codex/config.toml or a trusted project .codex/config.toml.
 # Verify current model availability in your Codex environment before uncommenting.
+#
+# Custom council agents generated by agent-kit live under .codex/agents/*.toml.
+# Run `agent-kit init --activate codex` to create them from the project roster.
 
 # June 2026 Agent Kit suggested baseline:
 # model = "gpt-5.5"