@appsforgood/next-supabase-kit 0.2.1 → 0.3.0

package/examples/next-supabase-installed/.agent-kit/config.json

@@ -0,0 +1,30 @@
+{
+  "stack": "next-supabase",
+  "projectType": "saas",
+  "docsMode": "advisory",
+  "githubActions": {
+    "mode": "off"
+  },
+  "agentCouncil": {
+    "required": true,
+    "rosterPath": ".agent-kit/agent-roster.json",
+    "defaultWorkflow": "planning",
+    "coreChangeWorkflow": "core-change"
+  },
+  "modelRouting": {
+    "required": true,
+    "routingPath": ".agent-kit/model-routing.json",
+    "reviewCadence": "quarterly-or-when-model-docs-change"
+  },
+  "designProviders": [
+    "stitch",
+    "claude",
+    "figma",
+    "human"
+  ],
+  "research": {
+    "maxRepos": 100,
+    "githubTokenEnv": "GITHUB_TOKEN",
+    "workdir": "research/workdir"
+  }
+}

package/examples/next-supabase-installed/.agent-kit/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "packageName": "@appsforgood/next-supabase-kit",
-  "packageVersion": "0.2.1",
+  "packageVersion": "0.3.0",
   "stack": "next-supabase",
   "installedAt": "2026-07-04T01:32:06.844Z",
   "docs": [
@@ -51,12 +51,12 @@
     "DESIGN.md": "a89eaed5d40e3cbe07a2c216bd56009275d973c30508aaf5bc31aa334a6ebe97",
     "MESSAGING.md": "f1f7c0f11796820b60bb44e42a65749763f7167944ba6acf092a1cf7b59e50de",
     "MODEL_ROUTING.md": "68bc686762ad7ec2b08759fc294b9e6b1be5fcd250ebea9574be71d1eebff5d6",
-    "QUALITY_GATES.md": "941e4b3b230f8b7a66ef721293232ef3ab13bccd8aeb01190662a0f54b00e48b",
+    "QUALITY_GATES.md": "b3d5b754972201eae89f7a46fd279c3b12cda3e2145a1445f6329864566249da",
     "STYLE_GUIDE.md": "70b984b69829f23b87af3f85535bed1bce81a0452e451aed876219fb416d7671",
     "SECURITY.md": "6f6aeed911059a9e0259b93322ef25212411d23daee3091975a868585fa280d5",
-    "TESTING.md": "bbd210900da4df1b553d9e090590eee264aeb97436a8f31840ee6e1d40f39ed3",
-    "LOOP_CODING.md": "3d4719c7fc7c2e8465ee15aec27574adbbc5207d58123ecf4f88f3942c522812",
-    "DEPLOYMENT.md": "8df2388fd28b847705a7f57e835c542def57008525dc85a1a8a9e4050bedb420",
+    "TESTING.md": "f4d604ff7935959d402f952db9be7ca4a444652b12f7ac46c97f4cc08553b4dd",
+    "LOOP_CODING.md": "a0f454cf1865dbce985dbdaa3f3232002ad5b83005eaa7c00d212085351d2b45",
+    "DEPLOYMENT.md": "da3a395c857dc7809227d4a134939d0d9d10e43dee5b06f14c7d613fd5471301",
     "UPGRADE.md": "589e301cc77eeaa56397c5759a11db596f0930ff1aaf53369be424a227b653d1"
   },
   "assetHashes": {
@@ -211,24 +211,23 @@
     ".agent-kit/skills/visual-regression-qa.md": "a8b71c62df726757d3557230c0a4244cc51b136a653afdcd250dc2f7ccfa72c4",
     ".cursor/rules/cursor-agent-kit.mdc": "8ac2b33af78a4a7eeac572eaa2fa3549555064a52890eb354dc0cae9b6f458b8",
     ".cursor/rules/cursor-model-selection.mdc": "21f4318fb5f9f91f49e81aae3ddb1293cd69b7a366f40271005eb2f425b2d001",
-    ".github/workflows/agent-kit-audit.yml": "7992324c3a641472a6543cc382f4064be5460a4a6a0346d3199c0aa595393dbb",
     "AGENT_ROSTER.md": "40147eecf3977bf64431204b67f24eb277a834ba5b6f894c053c79c0a9dbb8f5",
     "AGENTS.md": "b27d38f3797485d79295c9caefbd4e8052ffaded37d3f71ca43f195b0d287e07",
     "ASSISTANT_ADAPTERS.md": "b1611a886965095aea7c4a9e86953c0c7001b3455ca47c60969b7e023cadac00",
     "COUNCIL.md": "40bec9051664c9c38b8360ee16f21b5e4716030d19c493cdec67395ab06528e1",
     "DECISIONS.md": "15e281ba65f82393346fa40278d0067b933ac72bd5b079ea066c12be5dd8cea9",
-    "DEPLOYMENT.md": "8df2388fd28b847705a7f57e835c542def57008525dc85a1a8a9e4050bedb420",
+    "DEPLOYMENT.md": "da3a395c857dc7809227d4a134939d0d9d10e43dee5b06f14c7d613fd5471301",
     "DESIGN.md": "a89eaed5d40e3cbe07a2c216bd56009275d973c30508aaf5bc31aa334a6ebe97",
     "DOCS.md": "350ca7dccecbc56a85f731e73280eba0c5ce57dc7b5a1b908bb85dcabe5493b2",
-    "LOOP_CODING.md": "3d4719c7fc7c2e8465ee15aec27574adbbc5207d58123ecf4f88f3942c522812",
+    "LOOP_CODING.md": "a0f454cf1865dbce985dbdaa3f3232002ad5b83005eaa7c00d212085351d2b45",
     "MESSAGING.md": "f1f7c0f11796820b60bb44e42a65749763f7167944ba6acf092a1cf7b59e50de",
     "MODEL_ROUTING.md": "68bc686762ad7ec2b08759fc294b9e6b1be5fcd250ebea9574be71d1eebff5d6",
-    "QUALITY_GATES.md": "941e4b3b230f8b7a66ef721293232ef3ab13bccd8aeb01190662a0f54b00e48b",
+    "QUALITY_GATES.md": "b3d5b754972201eae89f7a46fd279c3b12cda3e2145a1445f6329864566249da",
     "SECURITY.md": "6f6aeed911059a9e0259b93322ef25212411d23daee3091975a868585fa280d5",
     "SKILLS.md": "320b76f37e8b509d597ba01331d3b1a4dc4f1eb68b6d2294ba4125fb2ab02970",
     "SPEC.md": "6424090a564467176fff1f85e93855d41ed383bc525e67ba3d43d4908daad095",
     "STYLE_GUIDE.md": "70b984b69829f23b87af3f85535bed1bce81a0452e451aed876219fb416d7671",
-    "TESTING.md": "bbd210900da4df1b553d9e090590eee264aeb97436a8f31840ee6e1d40f39ed3",
+    "TESTING.md": "f4d604ff7935959d402f952db9be7ca4a444652b12f7ac46c97f4cc08553b4dd",
     "UPGRADE.md": "589e301cc77eeaa56397c5759a11db596f0930ff1aaf53369be424a227b653d1"
   }
 }

package/examples/next-supabase-installed/audit-output.json

@@ -19,7 +19,7 @@
     {
       "level": "pass",
       "area": "install",
-      "message": "Agent kit installed at version 0.2.1."
+      "message": "Agent kit installed at version 0.3.0."
     },
     {
       "level": "pass",

package/examples/next-supabase-installed/tree.txt

@@ -17,9 +17,6 @@
 |-- LOOP_CODING.md
 |-- DEPLOYMENT.md
 |-- UPGRADE.md
-|-- .github
-|   `-- workflows
-|       `-- agent-kit-audit.yml
 |-- .cursor
 |   `-- rules
 |       |-- cursor-agent-kit.mdc

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsforgood/next-supabase-kit",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Open agent council, skills, prompts, checklists, and markdown templates for Next.js and Supabase projects.",
   "type": "module",
   "repository": {
@@ -38,6 +38,7 @@
     "rosters",
     "schemas",
     "examples/next-supabase-installed/.agent-kit/agent-roster.json",
+    "examples/next-supabase-installed/.agent-kit/config.json",
     "examples/next-supabase-installed/.agent-kit/model-routing.json",
     "examples/next-supabase-installed/.agent-kit/manifest.json",
     "examples/next-supabase-installed/.agent-kit/overrides.json",

package/templates/next-supabase/.github/workflows/agent-kit-audit.yml

@@ -13,23 +13,22 @@ permissions:
 jobs:
   audit:
     name: Agent kit readiness
+    # Automatic hosted CI is opt-in so unavailable Actions billing cannot block delivery.
+    # Set the repository variable AGENT_KIT_ACTIONS_ENABLED=true to enable push/PR runs.
+    if: ${{ github.event_name == 'workflow_dispatch' || vars.AGENT_KIT_ACTIONS_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
 
       - name: Run baseline audit gate
-        run: npx agent-kit audit --json --min-readiness baseline-setup
+        run: npx --yes @appsforgood/next-supabase-kit@0.3.0 audit --json --min-readiness baseline-setup

package/templates/next-supabase/DEPLOYMENT.md

@@ -8,6 +8,8 @@ Document each environment:
 - Preview
 - Production
 
+Hosted GitHub Actions is off by default. Local verification is sufficient for commit/push and normal phase progression when required checks pass. Enable the advisory workflow with `agent-kit init --github-actions`, set `AGENT_KIT_ACTIONS_ENABLED=true` only when automatic runs are wanted, and do not configure it as a required status check until Actions jobs can reliably start.
+
 ## Environment Variables
 
 Document required variables with placeholder examples only.

package/templates/next-supabase/LOOP_CODING.md

@@ -66,7 +66,7 @@ The kit does **not** ship unsupervised orchestration. It documents safe local en
 | --- | --- | --- |
 | Pre-commit test or audit | Catch drift before commit | `.agent-kit/prompts/audit-project-setup.md`, project `npm test` |
 | Post-edit lint/typecheck | Fast feedback on save | Project ESLint / `tsc --noEmit` in editor or CI |
-| PR CI audit gate | Block merge below readiness | `.github/workflows/agent-kit-audit.yml` template |
+| Optional hosted audit | Advisory unless explicitly enabled and required | `agent-kit init --github-actions`; `AGENT_KIT_ACTIONS_ENABLED=true` |
 | Adapter validate on PR | Prove IDE activation stays valid | `agent-kit adapter validate all` when adapter assets change |
 
 For Cursor-specific hook/automation patterns, see Cursor Automations docs and keep Planner-first triage **opt-in** — never as a replacement for Security Reviewer or human release approval.

package/templates/next-supabase/QUALITY_GATES.md

@@ -83,6 +83,7 @@ Best-practice means evidence can survive handoff, release, and later audit.
 
 ## Evidence Rules
 
+- Hosted GitHub Actions is opt-in. A billing, spending-limit, or pre-execution entitlement failure is not test evidence and does not block commit/push or phase progression when local required gates pass; a project may separately require hosted checks only after reliable Actions startup and branch protection are verified.
 - A checklist item is not done until the evidence is linked or named.
 - A test is not evidence unless it covers the behavior, risk, or contract being claimed.
 - A screenshot is not visual QA unless it covers the important viewport, state, and content.

package/templates/next-supabase/TESTING.md

@@ -44,7 +44,23 @@ Required rules:
 
 ## CI Gates
 
-Every project should define the smallest reliable CI gate for its risk profile.
+Every project should define the smallest reliable verification gate for its risk profile. Local verification is the default and must be recorded before commit/push or phase progression. Hosted GitHub Actions is optional and must not be treated as required when jobs cannot start because of account billing, spending limits, or entitlement.
+
+Use `agent-kit init --github-actions` only to install the advisory hosted audit. Automatic runs require the repository variable `AGENT_KIT_ACTIONS_ENABLED=true`; keep `githubActions.mode` as `off` or `advisory` unless branch protection and Actions availability have been explicitly verified.
+
+Default local gate (remove only commands the project genuinely does not expose, and record the gap):
+
+```bash
+npm ci
+npm run typecheck
+npm test
+npm run build
+npm audit --audit-level=high
+npx --yes @appsforgood/next-supabase-kit@0.3.0 audit --min-readiness baseline-setup
+agent-kit session verify --command "local delivery gate" --result pass --notes "Record commands, commit SHA, and verification time."
+```
+
+A failed or unavailable hosted job never converts missing local evidence into a pass.
 
 Recommended baseline: