@appsforgood/next-supabase-kit 0.1.8 → 0.2.1

package/BEST_PRACTICE_EVIDENCE.md

@@ -25,7 +25,7 @@ This repository treats the 100-repo research pass as input, not proof. A practic
 | Frontend acceptance needs a repeatable product-quality threshold. | Focused follow-up review of design-system, service-design, component-state, and accessibility guidance showed that good primitives do not prove product-specific quality. | Score significant UI work against user/task fit, content specificity, visual identity, information architecture, component states, accessibility and interaction, and source safety. | `skills/frontend-product-quality-rubric.md`, `prompts/frontend-product-quality-scorecard.md`, `checklists/frontend-product-quality.md`, `templates/next-supabase/DESIGN.md`, `rosters/next-supabase-default-council.json`. | Frontend-change roster requirements, `agent-kit audit`, public-readiness tests, install smoke. |
 | Visual QA needs a path beyond manual taste review. | Follow-up visual-testing review identified Storybook, Playwright screenshots, Chromatic, Argos, Loki, and baseline evidence as repeatable patterns. | Provide visual QA tiers that scale from screenshot review to regression evidence. | `skills/visual-regression-qa.md`, `checklists/visual-regression.md`, `prompts/visual-qa-plan.md`, `templates/next-supabase/TESTING.md`. | Public-readiness tests, `QUALITY_GATES.md` maturity evidence, downstream visual QA artifacts. |
 | Public OSS maintainability needs more than a package tarball. | Repository-health follow-up identified structured intake, ownership, labels, support, and governance as durable signals. | Ship contributor intake, labels, CODEOWNERS, support, conduct, governance, and repository settings guidance. | `.github/ISSUE_TEMPLATE/*`, `.github/pull_request_template.md`, `.github/CODEOWNERS`, `.github/labels.yml`, `SUPPORT.md`, `GOVERNANCE.md`, `REPOSITORY_SETTINGS.md`. | Public-readiness tests, PR labeler workflow, documented branch and repository settings. |
-| Supply-chain trust must be visible before publish. | Supply-chain follow-up identified OIDC publishing, provenance, dependency review, Scorecard, SBOMs, workflow controls, and release gates. | Use Trusted Publishing, avoid long-lived npm publish tokens, generate and attest a CycloneDX SBOM for the package tarball, and verify release integrity before publish. | `.github/workflows/release.yml`, `.github/workflows/scorecard.yml`, `.github/workflows/dependency-review.yml`, `SUPPLY_CHAIN.md`, `scripts/release-check.mjs`, `scripts/sbom-check.mjs`. | `npm run release:check`, `npm run sbom:check`, OpenSSF Scorecard, Dependency Review, npm Trusted Publishing, SBOM attestation, pack dry run. |
+| Supply-chain trust must be visible before publish. | Supply-chain follow-up identified OIDC publishing, provenance, dependency review, Scorecard, SBOMs, workflow controls, and release gates. | Use Trusted Publishing, avoid long-lived npm publish tokens, generate and attest a package-rooted CycloneDX SBOM for every tarball, and verify each public package before creating the source release. | `.github/workflows/release.yml`, `.github/workflows/scorecard.yml`, `.github/workflows/dependency-review.yml`, `SUPPLY_CHAIN.md`, `scripts/release-check.mjs`, `scripts/sbom-check.mjs`. | `npm run release:check`, root/runtime SBOM checks, OpenSSF Scorecard, Dependency Review, npm Trusted Publishing, SBOM attestations, pack dry runs. |
 | Best-practice claims need a maturity model. | Follow-up review showed a green build alone does not prove best-practice readiness. | Separate setup validity from project evidence and best-practice candidacy. | `templates/next-supabase/QUALITY_GATES.md`, `schemas/audit-report.schema.json`, `skills/best-practice-maturity-review.md`, `src/install/audit.ts`. | `agent-kit audit --min-readiness`, audit-report schema validation, install smoke, release check. |
 | Downstream adoption evidence must stay current. | Current read-only dogfood audits of two older installs both produced `11 pass / 20 warn / 7 fail`, proving that later hardening made older installs drift below baseline setup. | Publish a sanitized dogfood summary and keep detailed local-path evidence repo-only. Treat stale dogfood findings as upgrade inputs. | `DOGFOOD.md`, `dogfood/*.md`, `UPGRADE.md`, `agent-kit audit`, `agent-kit update`, `tests/public-readiness.test.ts`. | Public-readiness tests, release check, read-only dogfood audit snapshots, package dry run. |
 | Older installs need a conflict-safe upgrade proof. | Dogfood audits showed both older installs lacked current roster schemas, assistant adapters, maturity gates, upgrade docs, and design critique assets. | Add a deterministic old-install fixture that proves diff previews missing/conflicting assets and update adds missing current assets while preserving customized docs through conflicts. | `tests/update.test.ts`, `src/install/diff.ts`, `src/install/install.ts`, `UPGRADE.md`, `DOGFOOD.md`. | Unit tests, audit report on upgraded fixture, release check. |

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.2.1
+
+- Rewrite the public README with verified setup commands and task-oriented examples for audits, council sessions, UI review, upgrades, and optional runtime orchestration.
+
+## 0.2.0
+
+- Ship the leading-harness release: hash-aware manifest v2 updates, audit v2 with SARIF and suppressions, hardened localhost Agent Studio APIs, and optional executable council workflows through `@appsforgood/agent-kit-runtime`. Runtime workflows use validated roster routing, SQLite checkpoints, explicit approval gates, provider and allowlisted MCP adapters, Docker-first tools, isolated Git worktrees, bounded retries/timeouts, cancellation, redacted evidence, and scoped commits. Release automation now publishes and verifies the runtime and root packages with separate SBOM attestations before creating a GitHub release.
+
+## 0.1.9
+
+- Added explicit anti-slop UI rules for frontend work, including accent-border cards, gradient-as-design, card soup, fake dashboard proof, vague SaaS sayings, decorative credibility, oversized glass panels, ornamental icon walls, filler sections, and inaccessible decorative state styling.
+- Extended installed template design guidance, UI detectors, frontend quality checklist, and review prompts with concrete best-practice replacements for generic AI-looking UI patterns.
+
 ## 0.1.8
 
 - Added `tests/setup-server-api.test.ts` for full setup-server API route coverage (PATCH state, context import, checklists, design/messaging drafts, apply, agentic-level refresh, oversized body, 404) plus wizard draft edge cases.

package/DOGFOOD.md

@@ -43,6 +43,7 @@ CLI source: local `dist/index.js` after `npm run release:check`
 - `readJsonBody` shared between setup and studio servers; oversized bodies return 400 without dropping the connection; studio SSE broadcasts notes.
 - Dedicated Ubuntu CI job for UI screenshots; not part of `release:check` matrix.
 - Local verification: `release:check` green (150 tests, setup-server.ts 86% statements), `smoke:ui-screens` produced 4 PNGs.
+- Published `@appsforgood/next-supabase-kit@0.1.8`; `publish:verify` passed against live registry.
 
 ## 2026-07-04 Publish @0.1.7 Snapshot
 
@@ -182,5 +183,5 @@ Scope: README/docs discoverability + three new Antigravity adapters
 | Canonical index | `prompts/lifecycle-command-index.md` for delivery commands (parallel to `prompts/ui-command-index.md`) |
 | New adapters | `/spec`, `/test`, `/review` in `antigravity/commands/` (20 total native commands) |
 | Roster | `testing` and `code-review` workflows; planning triggers for spec keywords |
-| Out of scope | `/build`, `/webperf`, `/code-simplify`, `/build auto` — documented as future orchestration |
+| Historical scope | `/build`, `/webperf`, `/code-simplify`, and `/build auto` were deferred in this 0.1.7 review; the later runtime ships bounded roster workflows rather than cloning those command semantics |
 | Verification | `npm test`, `agent-kit adapter validate antigravity` after build |