@appsforgood/next-supabase-kit 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.7
+
+- Added **Workflow Commands** section to README and docs site: lifecycle diagram, 12 core + 8 UI slash commands, council table, skills-by-phase grouping, and explicit separation from package CLI commands.
+- Added `prompts/lifecycle-command-index.md` as the canonical delivery lifecycle command index (parallel to `prompts/ui-command-index.md`).
+- Added Antigravity native commands `/spec`, `/test`, and `/review` (20 total runtime commands) with roster `testing` and `code-review` workflows.
+- Added "How skills work" guidance to `SKILLS.md` and updated assistant adapter docs for lifecycle command discoverability.
+
+## 0.1.6
+
+- Added a repo-native UI improvement harness with command-style prompts, deterministic detector checklist, acceptance rubric, portable runtime skill, and focused Antigravity UI commands.
+- Wired UI audit, polish, layout cleanup, responsive cleanup, accessibility, distinctiveness, screenshot critique, and browser QA workflows into roster routing, docs, templates, package validation, and example snapshots.
+
 ## 0.1.5
 
 - Added computed **Agentic Engineering Level** (L3–L6) in Agent Office and setup wizard: iceberg strip, climb checklist, `/api/state` payload, and `POST /api/agentic-level/refresh`.

package/DOGFOOD.md

@@ -34,6 +34,32 @@ Mode: read-only audit; no downstream files were modified.
 - Assistant adapters and upgrade lifecycle still need real activation/dogfood evidence after publication.
 - Reference-led design critique still needs a real UI change dogfood pass with screenshots or equivalent visual evidence.
 
+## 2026-07-04 Publish @0.1.7 Snapshot
+
+Date: 2026-07-04
+CLI source: public npm registry `@appsforgood/next-supabase-kit@0.1.7`
+
+- Published `@appsforgood/next-supabase-kit@0.1.7` with lifecycle README commands, `/spec`/`/test`/`/review` Antigravity adapters, and `prompts/lifecycle-command-index.md`.
+- Post-publish: `npm run publish:verify` against live registry.
+
+## 2026-07-04 Publish @0.1.6 Snapshot
+
+Date: 2026-07-04
+CLI source: public npm registry `@appsforgood/next-supabase-kit@0.1.6`
+Mode: local maintainer publish (token) after `npm run release:check`, then `npm run publish:verify`.
+
+- Published `@appsforgood/next-supabase-kit@0.1.6` to public npm (local token publish with `--provenance=false`; CI releases continue to use OIDC + provenance).
+- `npm run publish:verify` passed: registry visibility confirmed, `npx` doctor ok, clean temp `init` installed current baseline assets, and `audit --json --min-readiness baseline-setup` returned 0 failures (67 pass / 4 warn / readiness `baseline-setup`).
+
+## 2026-07-02 Publish Verification And Self-Install Snapshot
+
+Date: 2026-07-02
+CLI source: public npm registry (`@appsforgood/next-supabase-kit`, published) plus local `src/` for the self-install.
+Mode: post-publish verification against the live registry, and dogfooding the kit into this repo's own root.
+
+- `node scripts/post-publish-verify.mjs` against the published package passed: registry visibility confirmed, `npx` doctor ok, clean temp `init` installed 23 files, and `audit --json --min-readiness baseline-setup` returned 0 failures (readiness `baseline-setup`).
+- This repo now dogfoods its own kit at the root: `agent-kit init` installed the root docs, `.agent-kit/`, and Cursor rules; project context, council session, and overrides were filled with real evidence; `agent-kit audit --min-readiness best-practice-candidate` passes with 0 warnings and 0 failures.
+
 ## 2026-06-07 Agent Studio Dogfood Snapshot
 
 Date: 2026-06-07
@@ -134,3 +160,17 @@ Policy: **gitignored local overlay + bootstrap script** (not committed to kit so
 | Rationale | Kit source stays in `templates/` and tracked maintainer docs; overlay proves Tier B activation without polluting commit history |
 
 This policy closes the gap where the kit shipped Level 5 IDE surfaces but BaseRepo maintainers operated at Level 4 day-to-day.
+
+## 2026-07-04 - Lifecycle Commands README Parity
+
+Date: 2026-07-04
+Scope: README/docs discoverability + three new Antigravity adapters
+
+| Item | Detail |
+| --- | --- |
+| README | Added **Workflow Commands** section: lifecycle diagram, 12 core + 8 UI slash commands, council table, skills-by-phase, skill activation narrative |
+| Canonical index | `prompts/lifecycle-command-index.md` for delivery commands (parallel to `prompts/ui-command-index.md`) |
+| New adapters | `/spec`, `/test`, `/review` in `antigravity/commands/` (20 total native commands) |
+| Roster | `testing` and `code-review` workflows; planning triggers for spec keywords |
+| Out of scope | `/build`, `/webperf`, `/code-simplify`, `/build auto` — documented as future orchestration |
+| Verification | `npm test`, `agent-kit adapter validate antigravity` after build |

package/README.md

@@ -1,5 +1,11 @@
 # Agent Skills Next/Supabase Kit
 
+[![CI](https://github.com/lukey662/agentsandskills/actions/workflows/ci.yml/badge.svg)](https://github.com/lukey662/agentsandskills/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/%40appsforgood%2Fnext-supabase-kit)](https://www.npmjs.com/package/@appsforgood/next-supabase-kit)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/lukey662/agentsandskills/badge)](https://scorecard.dev/viewer/?uri=github.com/lukey662/agentsandskills)
+[![CodeQL](https://github.com/lukey662/agentsandskills/actions/workflows/codeql.yml/badge.svg)](https://github.com/lukey662/agentsandskills/actions/workflows/codeql.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
 `@appsforgood/next-supabase-kit` installs an agent operating system for Next.js + Supabase projects.
 
 It gives agentic coders a default council roster, reusable skills, handoff rules, model-routing guidance, markdown docs, frontend design gates, Supabase/RLS security checks, upgrade workflows, and audit commands.
@@ -14,10 +20,10 @@ It also includes a local Agent Studio workflow: project context, durable human c
 
 ## Quick Start
 
-Use this in a Next.js + Supabase project after the public package is available on npm:
+Use this in a Next.js + Supabase project (latest: **v0.1.7** on npm):
 
 ```bash
-npx @appsforgood/next-supabase-kit init --stack next-supabase --setup --open
+npx @appsforgood/next-supabase-kit@0.1.7 init --stack next-supabase --setup --open
 npx @appsforgood/next-supabase-kit audit
 npx @appsforgood/next-supabase-kit audit --min-readiness baseline-setup
 ```
@@ -27,12 +33,45 @@ After install, the **Agent Office** setup view teaches agents about your project
 ```bash
 npx @appsforgood/next-supabase-kit setup --open
 npx @appsforgood/next-supabase-kit setup --status
-npx @appsforgood/next-supabase-kit init --activate antigravity
-npx @appsforgood/next-supabase-kit adapter validate antigravity
+```
+
+Promote IDE/runtime adapters after install:
+
+```bash
+npx @appsforgood/next-supabase-kit init --activate cursor --activate antigravity
+npx @appsforgood/next-supabase-kit adapter validate all
 ```
 
 The installer preserves existing docs. If a file already exists and differs from the template, the new version is written to `.agent-kit/conflicts/` for review.
 
+### See It In Action
+
+```text
+$ agent-kit init --stack next-supabase
+agent-kit installed (stack: next-supabase)
+Created (21)
+  AGENTS.md
+  AGENT_ROSTER.md
+  ASSISTANT_ADAPTERS.md
+  ...
+  .cursor/rules/cursor-agent-kit.mdc
+  .agent-kit/agent-roster.json
+  .agent-kit/model-routing.json
+
+Manifest: .agent-kit/manifest.json
+Next: run agent-kit audit to check readiness.
+
+$ agent-kit audit
+READINESS baseline-setup: Agent kit setup is valid, but project-specific
+evidence still needs to replace starter placeholders.
+SUMMARY pass=60 warn=3 fail=0
+NEXT ACTIONS
+- Run agent-kit onboard or agent-kit init --guided so agents can start
+  with project-specific context.
+```
+
+Every command accepts `--json` for machine-readable output, and mutating commands (`init`, `update`, `add skill`) accept `--dry-run`. A `vhs` tape for regenerating the animated demo lives at `docs/demo.tape`.
+
 For local development of this repo:
 
 ```bash
@@ -44,6 +83,83 @@ npm run release:check
 
 `npm run release:check` is the main pre-release proof command. It typechecks, tests, builds, install-smokes the package, checks examples, runs dependency audit, validates SBOM generation, and dry-runs packaging.
 
+## Workflow Commands
+
+Twenty slash commands map to the delivery lifecycle. Each one activates the right council agents and skills automatically. Use them in Antigravity after `init --activate antigravity`, or as prompt prefixes in any IDE. Canonical workflow steps live in `.agent-kit/prompts/lifecycle-command-index.md` (delivery) and `.agent-kit/prompts/ui-command-index.md` (UI polish).
+
+```text
+SETUP → SPEC/PLAN → BUILD → VERIFY → REVIEW → SHIP
+```
+
+**Workflow commands** (`/setup`, `/spec`, …) are runtime adapters. **Package CLI** commands (`agent-kit init`, `audit`, `session`, …) are documented under [CLI Reference](#cli-reference) below. Cursor loads rules and skills from `init`; Antigravity gets native slash commands from `init --activate antigravity`. See `ASSISTANT_ADAPTERS.md` for per-IDE setup.
+
+### Core lifecycle commands
+
+| What you're doing | Command | Key principle | Skills / council |
+| --- | --- | --- | --- |
+| Onboard project context | `/setup` | Context before code | Agent Office, project-context |
+| Define what to build | `/spec` | Spec before code | Planner, docs-maintainer |
+| Plan how to build it | `/plan` | Council before implementation | planning-council, lead-architect |
+| Route between agents | `/handoff` | Explicit handoffs | agent-handoff-tracing |
+| Build frontend/UI | `/frontend` | Content-first design | frontend-design-lead skills |
+| Check kit readiness | `/audit` | Evidence before claims | best-practice-maturity-review |
+| Prove behavior | `/test` | Tests are proof | testing-qa, qa-engineer |
+| Review before merge | `/review` | Improve code health | qa-engineer + security-reviewer |
+| Security signoff | `/security` | RLS at the boundary | owasp-security-review, supabase-auth-rls |
+| Public copy | `/copy` | Proof before publish | marketing-copy-lead |
+| Ship release | `/ship` | Faster is safer | deployment-observability, release gates |
+| Upgrade kit/deps | `/upgrade` | Diff before overwrite | upgrade-maintenance |
+
+### UI harness commands
+
+Focused UI improvement commands. Full steps: `.agent-kit/prompts/ui-command-index.md`.
+
+| What you're doing | Command | Key principle |
+| --- | --- | --- |
+| Audit UI before release | `/ui-audit` | Detect before ship |
+| Improve visual quality | `/ui-polish` | Scope-safe polish |
+| Repair layout structure | `/layout-cleanup` | Hierarchy over decoration |
+| Fix responsive behavior | `/responsive-cleanup` | Mobile is not an afterthought |
+| WCAG 2.1 AA pass | `/accessibility-pass` | Keyboard and contrast matter |
+| Prove product distinctiveness | `/distinctiveness-pass` | Not interchangeable SaaS |
+| Critique screenshots | `/screenshot-critique` | Evidence over opinion |
+| Live browser QA loop | `/browser-qa` | Measure in the real UI |
+
+Skills activate from task keywords and roster `defaultFor` tags—for example, schema/RLS work routes to **Supabase/Postgres Engineer** with `supabase-auth-rls` and `postgres-migrations`; App Router work routes to **Next.js Engineer** with `nextjs-app-router`. See `SKILLS.md` and `.agent-kit/agent-roster.json`.
+
+### Council
+
+| Agent | Owns | Key skills |
+| --- | --- | --- |
+| Planner | Scope, roadmap, ambiguous requests | planning-council, agent-handoff-tracing |
+| Lead Architect | Core and cross-layer changes | nextjs-app-router, supabase-auth-rls, owasp-security-review |
+| Supabase/Postgres Engineer | Schema, migrations, RLS, auth | supabase-auth-rls, postgres-migrations |
+| Next.js Engineer | App Router, Server Actions, UI state | nextjs-app-router, frontend-design-system |
+| Frontend Design Lead | Design gates, visual QA, anti-generic UI | content-first-design, ui-improvement-harness |
+| Marketing Copy Lead | Positioning, conversion copy, CTAs | positioning-messaging, conversion-copywriting |
+| Security Reviewer | OWASP, auth boundaries, secrets | owasp-security-review, supabase-auth-rls |
+| QA Engineer | Tests, regression, acceptance evidence | testing-qa, visual-regression-qa |
+| Documentation Maintainer | Living docs, spec, decisions | docs-maintainer, planning-council |
+| Deployment/Observability Engineer | Release, rollback, monitoring | deployment-observability |
+
+### Skills by lifecycle phase
+
+Full skill list: `SKILLS.md`.
+
+**Define:** planning-council, agent-handoff-tracing, best-practice-maturity-review, docs-maintainer
+
+**Build:** nextjs-app-router, supabase-auth-rls, postgres-migrations, content-first-design, frontend-design-system, ui-improvement-harness, positioning-messaging
+
+**Verify:** testing-qa, visual-regression-qa, owasp-security-review, accessibility-wcag, reference-led-design-critique, frontend-product-quality-rubric
+
+**Ship:** deployment-observability, upgrade-maintenance
+
+### How skills work
+
+- **Canonical skills** live in `.agent-kit/skills/` as markdown checklists agents load for a task type.
+- **Runtime wrappers** in `runtime-skills/*/SKILL.md` expose the same content to Antigravity and other skill-directory runtimes.
+- **Roster routing** in `.agent-kit/agent-roster.json` maps `defaultFor` keywords and workflows to agents and their default skill sets—slash commands and natural-language requests both use the same contract.
+
 ## How Agentic Coders Should Use It
 
 Start with the installed files:
@@ -63,29 +179,142 @@ Default routing:
 - Planner handles plans, roadmaps, scope, and ambiguous requests first.
 - Lead Architect reviews core changes before implementation.
 - Security Reviewer joins auth, RLS, data mutation, dependency, secret, external-call, and release-risk work.
-- Frontend Design Lead owns content-first design, reference-led critique, distinctiveness benchmarking, product-quality scoring, and visual QA.
+- Frontend Design Lead owns content-first design, reference-led critique, distinctiveness benchmarking, product-quality scoring, UI detector severity review, command-based polish/audit loops, and visual QA.
 - Marketing Copy Lead owns public-facing and conversion-facing copy, positioning, proof, objections, voice, and CTA hierarchy.
 - QA Engineer verifies behavior changes before completion.
 - Documentation Maintainer keeps the living markdown current.
 
 For meaningful multi-agent work, record the decision, risk, next handoff, required outputs, and verification evidence in `COUNCIL.md` or `.agent-kit/council-sessions/*.json`.
 
-For local Agent Studio sessions, use:
+## CLI Reference
+
+Every command accepts `--json` for machine-readable output. Mutating commands (`init`, `update`, `add skill`, `correction apply`) also accept `--dry-run`.
+
+### Install and upgrade
+
+| Command | Purpose |
+| --- | --- |
+| `init` | Install docs, roster, skills, schemas, Cursor rules, and project context |
+| `diff` | Compare local docs against bundled templates |
+| `update` | Hash-aware upgrade: pristine docs refresh, local edits kept, conflicts for review |
+| `add skill <name>` | Copy one skill into `.agent-kit/skills/` |
+| `onboard` | Print the recommended first-run checklist |
 
 ```bash
-agent-kit setup
-agent-kit init --guided
+agent-kit init --stack next-supabase --guided --dry-run
+agent-kit init --activate cursor --activate codex --no-setup
+agent-kit diff
+agent-kit update --dry-run
+agent-kit add skill ui-improvement-harness
+```
+
+`init` flags: `--stack`, `--guided`, `--dry-run`, `--activate <targets...>`, `--setup`, `--no-setup`, `--open`, `--force`, `--json`.  
+`update` flags: `--dry-run`, `--force`, `--json`.
+
+### Setup and Agent Office
+
+| Command | Purpose |
+| --- | --- |
+| `setup` | Serve local Agent Office (default) and form wizard at `http://127.0.0.1:9321` |
+| `setup --status` | Print onboarding progress as JSON |
+
+Routes: `/` or `/office` (pixel office, default), `/wizard` (form fallback).
+
+```bash
+agent-kit setup --open
+agent-kit setup --status
+```
+
+### Audit and validation
+
+| Command | Purpose |
+| --- | --- |
+| `audit` | Readiness report with pass/warn/fail findings |
+| `doctor` | Validate CLI runtime prerequisites |
+| `adapter validate [target]` | Validate IDE/runtime adapter assets (`cursor`, `claude`, `codex`, `copilot`, `antigravity`, `all`) |
+| `package validate` | Source-repo release asset validation (maintainers) |
+
+```bash
+agent-kit audit --json --min-readiness baseline-setup
+agent-kit adapter validate cursor
+agent-kit doctor --json
+```
+
+Readiness levels: `needs-setup`, `baseline-setup`, `needs-improvement`, `best-practice-candidate`. Use `--min-readiness <level>` in CI.
+
+### Project context
+
+| Command | Purpose |
+| --- | --- |
+| `context init` | Create or refresh `.agent-kit/project-context.json` |
+| `context scan` | Print inferred context without writing |
+| `context ask` | List unanswered high-value context questions |
+| `context render` | Render `.agent-kit/project-context.md` |
+| `context validate` | Validate context against schema |
+| `context show` | Print current context JSON |
+
+```bash
+agent-kit context init
 agent-kit context validate
+```
+
+### Council sessions
+
+| Command | Purpose |
+| --- | --- |
+| `session start` | Open a council session with workflow routing |
+| `session list` / `session active` | Inspect sessions |
+| `session note` / `decision` / `handoff` | Record collaboration events |
+| `session correct` / `artifact` / `verify` / `output` | Record corrections, files, checks, required outputs |
+| `session checkpoint` | Batch-apply events from a JSON file |
+| `session render` / `session close` | Render Markdown and close the session |
+
+```bash
 agent-kit session start "Build checkout flow" --workflow frontend-change
-agent-kit session decision --agent planner --risk "Generic UI risk" "Use frontend-change workflow."
 agent-kit session handoff --from planner --to frontend-design-lead --decision "Start design intake." --risk "Generic UI risk."
-agent-kit session correct --agent frontend-design-lead --scope project "Keep UI dense and operational."
 agent-kit session verify --command "npm test" --result pass --notes "Tests passed."
 agent-kit session output "visual QA evidence" --status not-applicable --evidence "No UI change."
+agent-kit session checkpoint --file .agent-kit/checkpoint.json
 agent-kit session render
-agent-kit correction list
+agent-kit session close --status complete
+```
+
+### Corrections
+
+| Command | Purpose |
+| --- | --- |
+| `correction list` | List durable project and agent correction rules |
+| `correction add` | Add a correction (`--scope project\|agent\|session`) |
+| `correction apply` | Promote a correction into active rules |
+| `correction retire` | Retire a correction with reason |
+| `correction propose-upstream` | Flag a correction for kit promotion |
+
+```bash
+agent-kit correction add --scope project "Prefer operational density over hero-style marketing layout."
+agent-kit correction apply --id project-ui-density
+```
+
+### Studio views
+
+| Command | Purpose |
+| --- | --- |
+| `studio export` | Generate self-contained static HTML at `.agent-kit/studio/index.html` |
+| `studio serve` | Live localhost Agent Office with SSE session events (default port `9331`) |
+
+```bash
 agent-kit studio export
-agent-kit audit --json
+agent-kit studio serve --open
+```
+
+### Research (maintainers)
+
+Requires `GITHUB_TOKEN` in the environment.
+
+```bash
+agent-kit research discover --limit 100
+agent-kit research scan
+agent-kit research summarize
+agent-kit research propose-updates
 ```
 
 ## What Gets Installed
@@ -124,35 +353,6 @@ The `.agent-kit/` folder includes:
 - `design-briefs/` for SaaS, admin, marketplace, content, tool, ecommerce, portfolio/venue, education, community/social, and AI workflow surfaces.
 - `profiles/` for product-type and adjacent-stack adaptation.
 
-## Everyday Commands
-
-```bash
-agent-kit audit
-agent-kit audit --json
-agent-kit audit --min-readiness baseline-setup
-agent-kit adapter validate antigravity
-agent-kit package validate
-agent-kit context init
-agent-kit session start "Short task name"
-agent-kit session output "verification evidence" --status complete --evidence "npm test"
-agent-kit session render
-agent-kit correction list
-agent-kit studio export
-agent-kit diff
-agent-kit update
-agent-kit add skill frontend-design-system
-agent-kit doctor
-```
-
-Readiness levels from `agent-kit audit --json`:
-
-- `needs-setup`: required install or council contracts are failing.
-- `baseline-setup`: setup is valid, but starter evidence placeholders remain.
-- `needs-improvement`: no failures, but warnings remain.
-- `best-practice-candidate`: static audit found no failures or warnings.
-
-Use `agent-kit audit --min-readiness <level>` in CI when a project wants a merge or release threshold.
-
 ## AI Mechanisms
 
 Agent Kit separates the mechanisms that make AI coding repeatable:
@@ -160,7 +360,7 @@ Agent Kit separates the mechanisms that make AI coding repeatable:
 - Instructions: `AGENTS.md`, assistant adapters, and IDE-specific rule files.
 - Roster: `.agent-kit/agent-roster.json` chooses agents, workflows, and handoffs.
 - Skills: `.agent-kit/skills/` keeps specialist workflows reusable.
-- Runtime commands: Antigravity `commands/*.toml` expose `/setup`, `/audit`, `/plan`, `/handoff`, `/frontend`, `/security`, `/copy`, `/ship`, and `/upgrade` as native adapter entrypoints.
+- Runtime commands: Antigravity `commands/*.toml` expose `/setup`, `/spec`, `/audit`, `/plan`, `/handoff`, `/frontend`, `/test`, `/review`, focused UI improvement commands, `/security`, `/copy`, `/ship`, and `/upgrade` as native adapter entrypoints.
 - Portable skills: `runtime-skills/*/SKILL.md` wraps canonical `skills/*.md` files for runtimes that discover skill directories.
 - Model routing: `MODEL_ROUTING.md` and `.agent-kit/model-routing.json` map agents to model profiles.
 - Messaging: `MESSAGING.md` records audience, pain, outcome, proof, objections, voice, and conversion evidence for public-facing copy.
@@ -189,6 +389,8 @@ Significant UI work should prove:
 
 The Frontend Design Lead should reject work that would still look valid for another product after only changing the logo or headline.
 
+Operational UI improvement workflows live in `.agent-kit/prompts/ui-command-index.md` and ship as Antigravity commands: `/ui-audit`, `/ui-polish`, `/layout-cleanup`, `/responsive-cleanup`, `/accessibility-pass`, `/distinctiveness-pass`, `/screenshot-critique`, and `/browser-qa`. Use `.agent-kit/checklists/ui-detectors.md` for deterministic blocker/major/minor findings and `.agent-kit/checklists/ui-acceptance-rubric.md` for pass/fail decisions. High-risk UI work requires desktop and mobile screenshots plus authenticated or permission-state evidence when the surface is not public.
+
 ## Security Bar
 
 The kit treats these as defaults, not optional polish:
@@ -206,6 +408,7 @@ Use the upgrade flow instead of overwriting project-owned docs:
 
 ```bash
 agent-kit diff
+agent-kit update --dry-run
 agent-kit update
 agent-kit audit --min-readiness baseline-setup
 ```
@@ -255,7 +458,7 @@ Release expectations:
 - Dependency Review, CodeQL, OpenSSF Scorecard, Dependabot, SBOM validation, and SBOM attestation.
 - Post-publish verification with `npm run publish:verify`.
 
-Public release remains gated until the npm scope/package exists, Trusted Publishing is configured, and post-publish `npx` verification succeeds.
+The package is published to public npm under `@appsforgood/next-supabase-kit@0.1.7`. Every release must pass `npm run release:check` before publish and `npm run publish:verify` after (registry visibility, clean `npx` doctor/init/audit). Post-publish verification last passed **2026-07-04** against the live registry: `@0.1.7` doctor, clean init, and `audit --min-readiness baseline-setup` with zero failures.
 
 ## Repository Health
 

package/REPOSITORY_SETTINGS.md

@@ -31,9 +31,9 @@ Create environment `npm-publish` with:
 - Required reviewers enabled.
 - Prevent self-review enabled where available.
 - Deployment branches restricted to `main` and release events.
-- No npm publish token secret for the trusted-publishing flow.
-- Any legacy npm token secrets deleted after Trusted Publishing is confirmed.
-- Optional fallback: a maintainer npm publish token secret on the `npm-publish` environment when trusted publishing returns 404 on PUT.
+- Preferred path: no npm publish token secret once Trusted Publishing is confirmed for this package.
+- Current fallback: a maintainer npm publish token secret on the release workflow so manual publish dispatch can complete until npm Trusted Publishing is configured.
+- Any fallback npm token secrets deleted after Trusted Publishing is confirmed.
 
 The npm trusted publisher must match:
 
@@ -66,6 +66,10 @@ Create labels from `.github/labels.yml`. Required label families:
 - Status: `needs-triage`, `blocked`, `good first issue`, `help wanted`
 - Risk: `risk: security`, `risk: breaking-change`
 
+## GitHub Pages
+
+Enable GitHub Pages with source "Deploy from a branch", branch `main`, folder `/docs`. The minimal docs site lives at `docs/index.md` with the `jekyll-theme-minimal` theme configured in `docs/_config.yml`. Update `docs/index.md` when the CLI surface, readiness levels, or quick-start commands change.
+
 ## Review Cadence
 
 Review these settings before every public release and after any workflow, release, permission, package, or security-policy change.

package/SUPPLY_CHAIN.md

@@ -5,12 +5,12 @@ This package is intended for public npm distribution and downstream project boot
 ## Publish Identity
 
 - Public package: `@appsforgood/next-supabase-kit`.
-- Publish path: GitHub Actions release workflow through npm Trusted Publishing.
-- Authentication: OIDC trusted publisher, not a long-lived npm automation token.
+- Publish path: GitHub Actions release workflow through npm Trusted Publishing when configured, with a token-backed publish fallback for the current npm package setup.
+- Authentication: prefer OIDC trusted publisher; the fallback uses a scoped npm automation token stored as a GitHub Actions secret.
 - Environment: `npm-publish`.
 - Trusted publisher must be scoped to repository `lukey662/agentsandskills`, workflow `release.yml`, and allowed action `npm publish`.
 
-When npm Trusted Publishing is used from a public GitHub repository for a public package, npm generates provenance attestations automatically. The release workflow keeps `id-token: write` for this reason and does not set `NODE_AUTH_TOKEN` for publishing.
+When npm Trusted Publishing is used from a public GitHub repository for a public package, npm generates provenance attestations automatically. Until that package-level publisher is confirmed in npm, the release workflow publishes with the configured secret and `--provenance` so npm still receives GitHub Actions provenance.
 
 The release workflow also creates a deterministic package tarball, generates a CycloneDX SBOM from `package-lock.json`, uploads the tarball, SBOM, and pack metadata as release evidence, and attests the SBOM against the exact tarball path that is published to npm.
 
@@ -47,9 +47,9 @@ The release workflow and `npm run publish:verify` both use `scripts/post-publish
 
 ## Maintainer Rules
 
-- Do not use bypass-2FA npm publish tokens for automation.
+- Do not use bypass-2FA npm publish tokens for automation; any fallback token must be scoped for package publishing and stored only as a GitHub Actions secret.
 - Do not publish from unreviewed branches or untrusted workflow changes.
 - Treat workflow edits as release-risk changes requiring security and maintainer review.
-- Rotate and delete legacy publish secrets after Trusted Publishing is confirmed.
+- Rotate and delete fallback publish secrets after Trusted Publishing is confirmed.
 - Keep package contents free of secrets, private downstream data, and copied third-party source.
 - Keep SBOM generation and attestation in the shared release path; do not publish an unattested tarball when the workflow is available.

package/UPGRADE.md

@@ -78,4 +78,5 @@ Keep rollback evidence next to the upgrade:
 | Date | From | To | Scope | Evidence | Owner |
 | --- | --- | --- | --- | --- | --- |
 | 2026-06-14 | TypeScript 5 / Node 22 types | TypeScript 6 / Node 25 types | Dev dependency update for package validation and CI parity | `npm run typecheck`, `npm test`, `npm audit --audit-level=moderate` | Maintainers |
-| TBD | TBD | TBD | TBD | TBD | TBD |
+| 2026-06 | 0.1.0 | 0.1.1 | Package rename to `@appsforgood/next-supabase-kit`, harness readiness gates, adapter install on init, publish prep | `CHANGELOG.md` 0.1.1 entry, `npm run release:check` green, commit `37e1a0f` | lukey662 |
+| 2026-07-02 | none | 0.1.1 (self-install) | Dogfooded the kit into this repo's own root: `agent-kit init` installed root docs, `.agent-kit/`, and confirmed the Cursor rules' referenced files exist | `.agent-kit/manifest.json`, `agent-kit audit` zero failures, `COUNCIL.md` 2026-07-02 session | lukey662 |

package/antigravity/commands/accessibility-pass.toml

@@ -0,0 +1,16 @@
+name = "accessibility-pass"
+description = "Run a WCAG 2.1 AA-oriented UI pass for semantics, keyboard flow, focus, labels, contrast, and motion."
+
+prompt = """
+Run the accessibility pass workflow.
+
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, TESTING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/skills/ui-improvement-harness.md, .agent-kit/skills/accessibility-wcag.md, .agent-kit/checklists/ui-detectors.md, .agent-kit/checklists/ui-acceptance-rubric.md, and .agent-kit/prompts/ui-command-index.md.
+
+Workflow:
+1. Check semantics, headings, landmarks, forms, labels, tables, buttons, and ARIA use.
+2. Check keyboard navigation, visible focus, tab order, escape/close behavior, and skip path when applicable.
+3. Check contrast, reduced motion, error association, touch targets, and status announcements.
+4. Keep accessibility checks separate from visual-only approval.
+
+Required outputs: accessibility findings by severity, fixes made or proposed, skipped checks, test evidence, remaining risks.
+"""

package/antigravity/commands/browser-qa.toml

@@ -0,0 +1,18 @@
+name = "browser-qa"
+description = "Run a live browser QA loop with desktop, mobile, state, and authenticated screen evidence."
+
+prompt = """
+Run the live browser QA workflow.
+
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, TESTING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/skills/ui-improvement-harness.md, .agent-kit/checklists/ui-detectors.md, .agent-kit/checklists/ui-acceptance-rubric.md, .agent-kit/prompts/screenshot-review.md, .agent-kit/prompts/visual-qa-plan.md, and .agent-kit/prompts/ui-command-index.md.
+
+Workflow:
+1. Start or identify the dev/preview server and target routes.
+2. Open the target with required auth, role, tenant, and data state.
+3. Capture desktop and mobile screenshots.
+4. Run detector, screenshot critique, accessibility pass, and responsive cleanup.
+5. Apply scoped fixes and repeat until no blockers remain and major findings are fixed or documented.
+6. Record evidence with agent-kit session output when Agent Studio is in use.
+
+Required outputs: route, auth state, commands run, screenshots, detector results, fixes, final verdict.
+"""

package/antigravity/commands/distinctiveness-pass.toml

@@ -0,0 +1,16 @@
+name = "distinctiveness-pass"
+description = "Check that UI is product-specific, source-safe, and not generic SaaS or AI-site styling."
+
+prompt = """
+Run the visual distinctiveness pass workflow.
+
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, MESSAGING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/skills/ui-improvement-harness.md, .agent-kit/skills/frontend-distinctiveness-benchmark.md, .agent-kit/checklists/ui-detectors.md, .agent-kit/checklists/ui-acceptance-rubric.md, and .agent-kit/prompts/ui-command-index.md.
+
+Workflow:
+1. Compare the first viewport to product category, audience, workflow, and content fingerprint.
+2. Confirm references were translated into lessons without copying source layouts, copy, assets, or brand marks.
+3. Identify fake metrics, vague claims, abstract filler, interchangeable card stacks, and generic visual tropes.
+4. Re-score distinctiveness and product quality where significant UI work is involved.
+
+Required outputs: product-specific evidence, generic-risk findings, source-safety notes, required changes, final distinctiveness verdict.
+"""

package/antigravity/commands/frontend.toml

@@ -4,14 +4,15 @@ description = "Route frontend work through content-first design, accessibility,
 prompt = """
 Run the frontend-change workflow.
 
-Canonical sources: DESIGN.md, STYLE_GUIDE.md, MESSAGING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/design-briefs/, .agent-kit/prompts/screenshot-review.md, and .agent-kit/skills/frontend-design-system.md.
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, MESSAGING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/design-briefs/, .agent-kit/prompts/screenshot-review.md, .agent-kit/prompts/ui-command-index.md, .agent-kit/checklists/ui-detectors.md, .agent-kit/checklists/ui-acceptance-rubric.md, .agent-kit/skills/frontend-design-system.md, and .agent-kit/skills/ui-improvement-harness.md.
 
 Workflow:
 1. Start with Frontend Design Lead before implementation.
 2. Confirm brand/content intake, user needs, real content, creative direction, references, anti-references, and source-safety notes.
 3. Require distinctiveness benchmark and product-quality scorecard for significant UI.
-4. Preserve WCAG 2.1 AA, keyboard flow, responsive states, and loading/error/empty/success states.
-5. Record visual QA and accessibility evidence with `agent-kit session output`.
+4. Apply the UI improvement command index when auditing, polishing, cleaning layout, reviewing screenshots, or running browser QA.
+5. Preserve WCAG 2.1 AA, keyboard flow, responsive states, and loading/error/empty/success states.
+6. Record UI detector findings, visual QA, and accessibility evidence with `agent-kit session output`.
 
-Required outputs: design direction, reference evidence, product-specific UI rationale, state coverage, accessibility checks, desktop/mobile visual QA.
+Required outputs: design direction, reference evidence, product-specific UI rationale, UI detector findings, state coverage, accessibility checks, desktop/mobile visual QA, authenticated screen evidence when applicable.
 """

package/antigravity/commands/layout-cleanup.toml

@@ -0,0 +1,16 @@
+name = "layout-cleanup"
+description = "Clean crowded layouts, weak hierarchy, card nesting, overflow, and inconsistent spacing."
+
+prompt = """
+Run the layout cleanup workflow.
+
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, TESTING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/skills/ui-improvement-harness.md, .agent-kit/checklists/ui-detectors.md, .agent-kit/checklists/ui-acceptance-rubric.md, and .agent-kit/prompts/ui-command-index.md.
+
+Workflow:
+1. Identify primary task, secondary tasks, content hierarchy, and target viewport range.
+2. Remove unnecessary nesting, repeated surfaces, card-within-card patterns, arbitrary dividers, and workflow-obscuring decoration.
+3. Normalize spacing, grouping, alignment, heading scale, and responsive containers.
+4. Verify text fit, truncation, overlap, and horizontal overflow on desktop and mobile.
+
+Required outputs: layout findings, cleanup actions, preserved workflow, desktop/mobile evidence, remaining layout risks.
+"""

package/antigravity/commands/responsive-cleanup.toml

@@ -0,0 +1,16 @@
+name = "responsive-cleanup"
+description = "Verify and repair mobile and responsive UI behavior with required desktop and mobile evidence."
+
+prompt = """
+Run the responsive cleanup workflow.
+
+Canonical sources: DESIGN.md, STYLE_GUIDE.md, TESTING.md, QUALITY_GATES.md, .agent-kit/agent-roster.json, .agent-kit/skills/ui-improvement-harness.md, .agent-kit/checklists/ui-detectors.md, .agent-kit/checklists/ui-acceptance-rubric.md, and .agent-kit/prompts/ui-command-index.md.
+
+Workflow:
+1. Review mobile width, desktop width, and project-specific breakpoint assumptions.
+2. Verify tap targets, text fit, navigation, primary action visibility, sticky UI, scroll behavior, and viewport-safe spacing.
+3. Verify relevant loading, empty, error, disabled, success, permission, and focus states on mobile.
+4. Capture or request desktop and mobile screenshots before acceptance.
+
+Required outputs: viewports checked, responsive findings, fixes made or proposed, screenshots, remaining risks.
+"""

package/antigravity/commands/review.toml

@@ -0,0 +1,16 @@
+name = "review"
+description = "Run pre-merge code health review with QA and conditional Security Reviewer routing."
+
+prompt = """
+Run the code-review workflow.
+
+Canonical sources: TESTING.md, SECURITY.md, QUALITY_GATES.md, AGENTS.md, .agent-kit/agent-roster.json, .agent-kit/skills/testing-qa.md, .agent-kit/skills/owasp-security-review.md, and .agent-kit/prompts/lifecycle-command-index.md.
+
+Workflow:
+1. Route through QA Engineer for behavior, regression, and test evidence.
+2. Include Security Reviewer when auth, RLS, data mutation, dependency, secret, or external-call boundaries changed.
+3. Return findings by severity with concrete remediation.
+4. Distinguish this from release GO/NO-GO, which belongs to `/ship`.
+
+Required outputs: reviewed scope, findings by severity, required fixes, security notes when applicable, merge recommendation.
+"""