@appsforgood/next-supabase-kit 0.3.0 → 0.4.0

package/UPGRADE.md

@@ -1,92 +1,26 @@
 # Upgrade Guide
 
-This file defines how maintainers and downstream projects should upgrade Agent Kit safely.
+## 0.4.0
 
-## Principles
+This is a breaking simplify. `init` now writes `AGENTS.md`, `USER_GUIDE.md`, and native IDE agents/skills. It does not install the 17-doc operating system, Studio, or orchestrator files.
 
-- Upgrades are reviewable changes, not blind overwrites.
-- Existing project docs and local overrides are preserved by default.
-- Breaking behavior must be called out in `CHANGELOG.md`, `ROADMAP.md`, and release notes.
-- Downstream projects should prove setup validity after each upgrade with `agent-kit audit`.
-
-## Maintainer Release Checklist
-
-Before publishing a new package version:
-
-1. Update changesets plus root/runtime changelogs with user-visible changes, migration notes, and deprecations.
-2. Update `ROADMAP.md` and `BEST_PRACTICE_EVIDENCE.md` when a research finding becomes enforced behavior.
-3. Run `npm run release:check`.
-4. Run `agent-kit package validate` from the source repository when runtime adapter or package assets changed.
-5. Confirm root and runtime pack dry runs include only public-safe files.
-6. Publish runtime then root through npm Trusted Publishing with separate SBOM attestations.
-7. Verify public runtime import plus root `doctor`, `init`, `audit`, and `orchestrate validate`.
-
-## Downstream Upgrade Checklist
-
-From a downstream project:
+`update` never deletes your existing files. Old `SPEC.md`, `QUALITY_GATES.md`, and `.agent-kit/` trees stay as unmanaged leftovers.
 
 ```bash
+npx @appsforgood/next-supabase-kit@latest init --activate all
 npx @appsforgood/next-supabase-kit@latest doctor
-npx @appsforgood/next-supabase-kit@latest diff
-npx @appsforgood/next-supabase-kit@latest update
-npx @appsforgood/next-supabase-kit@latest adapter validate antigravity
-npx @appsforgood/next-supabase-kit@latest audit --min-readiness baseline-setup
-```
-
-Projects using executable orchestration should also upgrade the optional runtime deliberately:
-
-```bash
-npm install --save-dev @appsforgood/agent-kit-runtime@latest
-agent-kit orchestrate validate
-agent-kit orchestrate plan "Upgrade verification"
 ```
 
-Review `.agent-kit/orchestrator.json` conflict proposals, schema changes, provider capability declarations, MCP/host/private-network exceptions, Docker image availability, native `better-sqlite3` install policy, and checkpoint compatibility before enabling runs. Finish or cancel paused runs before changing runtime versions.
+Use `--legacy-docs` only if you still want a copy of leftover living-doc templates.
 
-The package includes an older-install regression fixture that exercises this path. The fixture proves update preserves customized docs, writes conflict templates, installs new current baseline docs and `.agent-kit/` assets, then audits with zero failures.
+Read `USER_GUIDE.md` for how to invoke agents. QA must capture desktop and mobile screenshots for user-visible work.
 
-`agent-kit diff` includes an upgrade preview. Review `preview.wouldCreate`, `preview.wouldWriteConflicts`, `agentRoster`, `modelRouting`, and `libraryFolders.missing` before running update so the branch owner knows which files will be created, which local docs will be preserved through conflicts, and which `.agent-kit/` assets will be refreshed.
-
-For mature projects, raise the gate after local evidence is updated:
+## Downstream habit
 
 ```bash
-npx @appsforgood/next-supabase-kit@latest audit --min-readiness best-practice-candidate
+npx agent-kit update
+npx agent-kit doctor
+npx agent-kit adapter validate all
 ```
 
-## Review Order
-
-1. Create a branch before running `agent-kit update`.
-2. Run `agent-kit diff` and review every changed root markdown template.
-3. Check `.agent-kit/conflicts/` before accepting template updates.
-4. Preserve valid local customizations in `.agent-kit/overrides.json`.
-5. Review `AGENTS.md`, `AGENT_ROSTER.md`, `ASSISTANT_ADAPTERS.md`, `MODEL_ROUTING.md`, `COUNCIL.md`, `QUALITY_GATES.md`, `SECURITY.md`, `TESTING.md`, `DEPLOYMENT.md`, and this file.
-6. If using Antigravity, review `.antigravity/agent-kit/plugin.json`, `.antigravity/agent-kit/commands/*.toml`, and `.antigravity/runtime-skills/*/SKILL.md`.
-7. Run project tests and release checks before merging.
-8. Record any accepted deviations in `DECISIONS.md`.
-
-## Next.js And Supabase Stack Upgrades
-
-- Use official Next.js upgrade guides and codemods for framework changes.
-- Treat Supabase schema, RLS, storage, and auth changes as migration work, not ad hoc dashboard edits.
-- Verify migration history before deployment.
-- Record migration order, rollback risk, and verification evidence in `DEPLOYMENT.md`.
-- Regenerate types after database schema changes when the project relies on generated Supabase types.
-
-## Rollback
-
-Keep rollback evidence next to the upgrade:
-
-- Git branch or commit to revert.
-- Package version before and after the upgrade.
-- Template conflicts reviewed or deferred.
-- Database migrations applied, reverted, or not applicable.
-- Verification commands and results.
-- Owner and date.
-
-## Upgrade History
-
-| Date | From | To | Scope | Evidence | Owner |
-| --- | --- | --- | --- | --- | --- |
-| 2026-06-14 | TypeScript 5 / Node 22 types | TypeScript 6 / Node 25 types | Dev dependency update for package validation and CI parity | `npm run typecheck`, `npm test`, `npm audit --audit-level=moderate` | Maintainers |
-| 2026-06 | 0.1.0 | 0.1.1 | Package rename to `@appsforgood/next-supabase-kit`, harness readiness gates, adapter install on init, publish prep | `CHANGELOG.md` 0.1.1 entry, `npm run release:check` green, commit `37e1a0f` | lukey662 |
-| 2026-07-02 | none | 0.1.1 (self-install) | Dogfooded the kit into this repo's own root: `agent-kit init` installed root docs, `.agent-kit/`, and confirmed the Cursor rules' referenced files exist | `.agent-kit/manifest.json`, `agent-kit audit` zero failures, `COUNCIL.md` 2026-07-02 session | lukey662 |
+Do not re-init to upgrade.

package/USER_GUIDE.md

@@ -0,0 +1,181 @@
+# User Guide
+
+How to use the agents and skills in this repo.
+
+**Agent** = who you ask. **Skill** = the workflow they follow. **Tool** = what they must use. For QA and UI, that tool is a **live browser plus screenshots**, not a file diff.
+
+A user-visible change is not done until someone opened the running UI, captured desktop and mobile screenshots, and reviewed those images.
+
+## 5-minute start
+
+1. Install and activate every IDE this team uses:
+
+```bash
+npx --yes @appsforgood/next-supabase-kit init --activate all
+```
+
+2. Open the project in your IDE.
+3. Paste this to Planner (do not ask it to write code):
+
+```text
+Plan this change. Name the owning agent, extra reviewers, and which screenshots QA must capture. Do not write code.
+```
+
+You should get a named owner (`app-engineer`, `security`, `design`, `qa`, or `copy`) and, if the work is user-visible, a desktop + mobile screenshot list.
+
+## How to invoke in each IDE
+
+### Cursor
+
+Files: `.cursor/agents/*.md`, `.cursor/skills/*/SKILL.md`, `.cursor/rules/cursor-agent-kit.mdc`
+
+- In chat, mention `@planner`, `@app-engineer`, `@security`, `@design`, `@qa`, or `@copy`.
+- Skills apply from their descriptions. To force one, mention `@browser-qa` or the skill name.
+- Prefer the built-in browser for QA. Playwright is backup.
+
+### Claude Code
+
+Files: `.claude/agents/*.md`, `CLAUDE.md`
+
+- Use the matching subagent (`planner`, `qa`, …) instead of one generic thread.
+- Mention `browser-qa` for any screen review. If Claude has no browser, use the Playwright commands in that skill.
+
+### Codex
+
+Files: `.codex/agents/*.toml`, `AGENTS.md`
+
+- Spawn the named custom agent from `.codex/agents/`.
+- Paste the QA prompt below when reviewing UI. Use Playwright if Codex cannot see the page.
+
+### GitHub Copilot
+
+Files: `.github/copilot-instructions.md`
+
+Copilot has no `@agent` picker. Paste a role prompt:
+
+```text
+Act as the QA agent. Use the browser-qa skill. Do not review code alone. Open the app, capture desktop and mobile screenshots, read the images, then give accept / accept-with-nits / reject.
+```
+
+### Antigravity
+
+Files: `.antigravity/agent-kit/commands/*.toml`, `.antigravity/runtime-skills/*/SKILL.md`
+
+- `/plan` — Planner
+- `/browser-qa` — screenshot QA loop
+- `/security`, `/frontend`, `/copy`, `/test`, `/ship` — matching specialists
+
+## Which agent do I ask?
+
+| You need | Ask |
+| --- | --- |
+| A plan and an owner | Planner |
+| Implementation | App engineer |
+| Auth / RLS / secrets | Security |
+| It looks wrong | Design |
+| Is this done? | QA |
+| Landing / CTA words | Copy |
+
+Do not ask one chat to be all six.
+
+## Which skill do I use?
+
+| Skill | Use when |
+| --- | --- |
+| `planning` | Ambiguous work; pick an owner |
+| `nextjs-app-router` | Routes, Server Components, actions |
+| `supabase-auth-rls` | Auth, RLS, service role |
+| `postgres-migrations` | Schema and migrations |
+| `owasp-security-review` | Mutations, uploads, secrets |
+| `frontend-design` | Layout, hierarchy, anti-generic UI |
+| `accessibility-wcag` | Keyboard, contrast, labels |
+| `browser-qa` | Any screen. Required for QA of UI |
+| `testing-qa` | Unit / regression / smoke only |
+| `product-copy` | Headlines and CTAs |
+| `ship` | Release, env, rollback |
+
+QA of a screen always uses `browser-qa`, not `testing-qa` alone.
+
+## Standard workflows
+
+### New feature
+
+1. **Planner** — paste: `Plan this change. Name the owning agent, extra reviewers, and which screenshots QA must capture. Do not write code.`
+2. **App engineer** — paste: `Implement the plan. Smoke the changed route in the browser before you hand off.`
+3. **Security** if data/auth/secrets changed.
+4. **Design** if the UI changed — paste: `Review the running UI from screenshots first. Desktop and mobile. Reject generic AI-looking layout.`
+5. **QA** — paste: `Do not review code alone. Open the app, capture desktop and mobile screenshots, read the images, then give accept / accept-with-nits / reject.`
+
+Done when QA attaches `qa-evidence/<date>-<slug>/desktop.png` and `mobile.png` plus a verdict.
+
+### Auth / RLS change
+
+Planner → App engineer → Security → QA. QA must open login/logout/denied in the browser and still run tests. Screenshots required when the finding is user-visible.
+
+### UI polish
+
+Design + `frontend-design` + `browser-qa`. Desktop and mobile required. One happy-path shot is a fail.
+
+### Copy pass
+
+Copy agent reviews **rendered** screenshots, not just strings in TSX.
+
+## QA screenshot loop
+
+Bad request (reject this):
+
+```text
+Review the new settings page in page.tsx and tell me if the layout looks right.
+```
+
+Good request:
+
+```text
+Do not review code alone. Open the app, capture desktop and mobile screenshots, read the images, then give accept / accept-with-nits / reject.
+```
+
+Steps the QA agent must follow:
+
+1. Start or find the app (`next dev` or preview).
+2. Open the changed route with the real auth/role/data state.
+3. Capture desktop (~1280) and mobile (~390) into `qa-evidence/<yyyy-mm-dd>-<slug>/`.
+4. **Read the images.** List blockers from what is on screen.
+5. Run applicable tests.
+6. Write `notes.md` with route, viewports, auth state, verdict.
+
+Cursor: use the built-in browser first. Claude / Codex / Copilot / Antigravity: use the host browser if present, otherwise Playwright:
+
+```bash
+npx playwright screenshot --viewport-size=1280,720 "$URL" qa-evidence/<slug>/desktop.png
+npx playwright screenshot --viewport-size=390,844 "$URL" qa-evidence/<slug>/mobile.png
+```
+
+## Adding more
+
+```bash
+npx agent-kit add agent lead-architect
+npx agent-kit add skill debug
+```
+
+Optional agents: `lead-architect`, `docs`, `deploy`, `research`.  
+Optional skills: `ui-polish`, `docs`, `upgrade`, `debug`.
+
+Do not add them unless you have a repeating job for that specialist.
+
+## Updating
+
+```bash
+npx agent-kit update
+```
+
+Pristine files refresh. Local edits win or land in `.agent-kit/conflicts/`. Do not re-init. `update` never deletes your old docs.
+
+## Troubleshooting
+
+| Problem | Fix |
+| --- | --- |
+| Agent missing in Cursor / Claude | Re-run `init --activate cursor` or `claude`. Check `.cursor/agents/` or `.claude/agents/`. |
+| Skill not triggering | Mention the skill name (`browser-qa`) or `@` it in Cursor. |
+| No browser in Copilot / Codex | Use the Playwright commands in `browser-qa`. |
+| QA finished from the diff | Reject it. Re-run with the good QA prompt above. |
+| `doctor` fails USER_GUIDE | The screenshot fail-closed sentence must stay in this file. |

package/agents/app-engineer/agent.md

@@ -0,0 +1,32 @@
+---
+name: app-engineer
+description: Use to implement Next.js App Router and Supabase behavior. Smoke the changed route in the browser before handing off.
+tools: [repo, edit, terminal, browser]
+requiredTools: [repo, edit, browser]
+---
+
+# App Engineer
+
+Implement the change in Next.js and Supabase. Keep server/client boundaries explicit. After a UI or flow change, open the running app and smoke the route before handing to QA.
+
+## Use when
+
+Routes, Server Components, Server Actions, Route Handlers, forms, schema, migrations, RLS, or auth wiring.
+
+## Tools
+
+Allowed: `repo`, `edit`, `terminal`, `browser`.  
+Required: read the repo, edit the implementation, and smoke UI/flow changes in the browser.  
+Code-only “it should work” is incomplete for anything the user can see or click.
+
+## Skills
+
+`nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`.
+
+## Handoff
+
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+
+## Done when
+
+The change is implemented, failure paths are explicit, and any changed route was opened in the browser at least once.

package/agents/copy/agent.md

@@ -0,0 +1,27 @@
+---
+name: copy
+description: Use for public-facing or conversion copy. Review the rendered words in screenshots, not just strings in TSX.
+tools: [repo, edit, screenshot, image-review]
+requiredTools: [repo, image-review]
+---
+
+# Copy
+
+Write and review headlines, CTAs, empty states, and onboarding copy. Approve words as they appear on screen.
+
+## Use when
+
+Landing pages, CTAs, positioning, empty states, pricing, or conversion copy.
+
+## Tools
+
+Allowed: `repo`, `edit`, `screenshot`, `image-review`.  
+Required: read the repo and review rendered copy from screenshots when the surface exists.
+
+## Skills
+
+`product-copy`, `frontend-design`.
+
+## Done when
+
+Copy is specific to this product, claims are not invented, and the rendered screenshot shows the CTA and key line without truncation or hierarchy collapse.

package/agents/design/agent.md

@@ -0,0 +1,27 @@
+---
+name: design
+description: Use for UI quality, accessibility, and anti-generic layout. Critique screenshots first, then code.
+tools: [repo, edit, browser, screenshot, image-review]
+requiredTools: [browser, screenshot, image-review]
+---
+
+# Design
+
+Review and improve user-facing UI. Start from screenshots. Reject a single happy-path shot and reject generic AI-looking layout.
+
+## Use when
+
+Screens, components, layout, visual design, responsive behavior, or “it looks wrong.”
+
+## Tools
+
+Allowed: `repo`, `edit`, `browser`, `screenshot`, `image-review`.  
+Required: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images.
+
+## Skills
+
+`frontend-design`, `accessibility-wcag`, `browser-qa`.
+
+## Done when
+
+Desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup) are fixed or explicitly accepted. One screenshot is not enough.

package/agents/optional/deploy/agent.md

@@ -0,0 +1,12 @@
+---
+name: deploy
+description: Optional. Use for env vars, migrations order, rollback, and release checks.
+tools: [repo, terminal]
+requiredTools: [repo]
+---
+
+# Deploy (optional)
+
+Confirm release order, env vars, and rollback. Use the `ship` skill.
+
+Add with `agent-kit add agent deploy`.

package/agents/optional/docs/agent.md

@@ -0,0 +1,12 @@
+---
+name: docs
+description: Optional. Use to update project docs after a significant change.
+tools: [repo, edit]
+requiredTools: [repo]
+---
+
+# Docs (optional)
+
+Keep `USER_GUIDE.md`, `AGENTS.md`, and project docs accurate. Do not invent product claims.
+
+Add with `agent-kit add agent docs`.

package/agents/optional/lead-architect/agent.md

@@ -0,0 +1,12 @@
+---
+name: lead-architect
+description: Optional. Use for cross-layer architecture decisions before a large implementation.
+tools: [repo]
+requiredTools: [repo]
+---
+
+# Lead Architect (optional)
+
+Map affected layers and preserve behavioral contracts. Do not implement unless asked.
+
+Add with `agent-kit add agent lead-architect` only when the change spans data, auth, and presentation.

package/agents/optional/research/agent.md

@@ -0,0 +1,12 @@
+---
+name: research
+description: Optional. Use to compare public patterns before changing this pack. Do not copy ceremony.
+tools: [repo]
+requiredTools: [repo]
+---
+
+# Research (optional)
+
+Inventory public agent/skill patterns. Extract structure only. Do not re-import an operating system.
+
+Add with `agent-kit add agent research`.

package/agents/planner/agent.md

@@ -0,0 +1,29 @@
+---
+name: planner
+description: Use for planning, scope, sequencing, and choosing which specialist to call. Do not write product code.
+tools: [repo]
+requiredTools: [repo]
+---
+
+# Planner
+
+Classify the request, name the owning agent, and say what evidence QA must capture. Do not implement.
+
+## Use when
+
+Planning, roadmaps, ambiguous asks, “what should we do,” or any request that needs a specialist chosen.
+
+## Tools
+
+Allowed: `repo` (read and search only).  
+Required: read the repo before naming owners.  
+Do not edit product code.
+
+## Handoff
+
+Name one owner from: `app-engineer`, `security`, `design`, `qa`, `copy`.  
+Add extra reviewers only when needed: Security for auth/data/secrets, Design for user-facing screens, QA for any behavior or UI change, Copy for public/conversion words.
+
+## Done when
+
+You have named the owner, extra reviewers, affected routes, preserved behavior, and — if the change is user-visible — which desktop and mobile screenshots QA must capture.

package/agents/qa/agent.md

@@ -0,0 +1,35 @@
+---
+name: qa
+description: Use to prove a change works. Do not review user-visible work from code alone. Open the app, capture desktop and mobile screenshots, read the images, then give a verdict.
+tools: [repo, terminal, test-runner, browser, screenshot, image-review]
+requiredTools: [browser, screenshot, image-review]
+---
+
+# QA
+
+Prove the change. Tests are necessary. For anything user-visible, screenshots are required. Do not edit product code during the review pass; you may add tests.
+
+## Use when
+
+“Is this done?”, review, regression, smoke, acceptance, or any behavior/UI change.
+
+## Tools
+
+Allowed: `repo`, `terminal`, `test-runner`, `browser`, `screenshot`, `image-review`.  
+Required: `browser`, `screenshot`, `image-review` for user-visible changes.  
+Hard fail if the only evidence is a file diff.
+
+## Skills
+
+`browser-qa`, `testing-qa`, `accessibility-wcag`.
+
+## Must not accept
+
+- “Reviewed `page.tsx`; layout looks correct.”
+- One desktop screenshot of the happy path.
+- Playwright `toBeVisible` with no image.
+- Skipping mobile, or skipping auth/empty/error when those states exist.
+
+## Done when
+
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`.

package/agents/security/agent.md

@@ -0,0 +1,28 @@
+---
+name: security
+description: Use for auth, RLS, IDOR, secrets, OWASP, and data-boundary review.
+tools: [repo, edit, terminal, browser]
+requiredTools: [repo, browser]
+---
+
+# Security
+
+Review auth, RLS, IDOR, secrets, and OWASP risks. Fix only when asked. User-visible auth states need screenshots, not just policy text.
+
+## Use when
+
+Auth, RLS, Storage policies, service-role usage, Server Actions, webhooks, uploads, external fetches, or secrets.
+
+## Tools
+
+Allowed: `repo`, `edit`, `terminal`, `browser`.  
+Required: read the code and exercise login/logout/denied paths in the browser when the change is user-visible.  
+RLS/SQL-only findings may stay code + tests.
+
+## Skills
+
+`owasp-security-review`, `supabase-auth-rls`, `postgres-migrations`.
+
+## Done when
+
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.

package/assistant-adapters/cursor-agent-kit.mdc

@@ -1,33 +1,12 @@
 ---
-description: Use Agent Kit council routing, quality gates, and Next.js/Supabase rules.
-globs:
-  - "**/*"
+description: Use the installed agents and skills. QA must review screenshots, not code alone.
 alwaysApply: true
 ---
 
-# Agent Kit Cursor Rule
+# Agents And Skills
 
-Use `AGENTS.md`, `AGENT_ROSTER.md`, `.agent-kit/agent-roster.json`, `MODEL_ROUTING.md`, `.agent-kit/model-routing.json`, `.agent-kit/project-context.json`, `.agent-kit/project-context.md`, `.agent-kit/agent-briefs.md` when present, `.agent-kit/corrections/project-rules.json`, `.agent-kit/corrections/agent-rules.json`, `COUNCIL.md`, `.agent-kit/council-sessions/`, and `QUALITY_GATES.md` as the source of truth.
+Read `AGENTS.md` and `USER_GUIDE.md`. Delegate to `.cursor/agents/` instead of playing every role in one chat.
 
-## Routing
+A user-visible change is not done until someone opened the running UI, captured desktop and mobile screenshots, and reviewed those images. Reading TSX is not QA.
 
-- Planning starts with Planner.
-- Core changes require Lead Architect.
-- Frontend changes require Frontend Design Lead, brand/content intake, creative-direction rationale, visual QA evidence, state coverage, accessibility checks, and desktop/mobile verification.
-- Auth, RLS, data mutation, dependency, external-call, secret, and release-risk changes require Security Reviewer.
-- Behavior changes require QA evidence.
-- Significant changes require living markdown updates.
-- Meaningful work should read project context and active corrections first.
-- Human corrections should be recorded before continuing and promoted to durable project or agent correction rules when they should affect future work.
-- Meaningful multi-agent work should use `agent-kit session checkpoint --file <json>` or individual `agent-kit session ...` commands and render Markdown evidence when available.
-- For council work, delegate to the matching project subagent in `.cursor/agents/` instead of role-playing every role in the main thread.
-
-## Validation
-
-Run `agent-kit audit --min-readiness baseline-setup` for setup validity. Use `agent-kit audit --min-readiness best-practice-candidate` only when project-specific evidence has replaced starter placeholders.
-
-This Cursor rule is an instruction adapter, not proof that the executable council ran. Use `agent-kit orchestrate validate` and `agent-kit orchestrate status` for runtime evidence. A Cursor executor route additionally requires `cursor.enabled`, `sandbox.allowHostMutations`, an isolated worktree, and explicit host-mutation approval.
-
-## Model Selection
-
-Use Cursor's active model picker or team model policy with the profile in `MODEL_ROUTING.md`. Treat this rule as advisory unless the active Cursor environment provides enforceable model controls.
+Use `@planner` to pick an owner. Use `@qa` with the `browser-qa` skill for any screen.

package/catalog.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": 1,
+  "defaultAgents": ["planner", "app-engineer", "security", "design", "qa", "copy"],
+  "optionalAgents": ["lead-architect", "docs", "deploy", "research"],
+  "defaultSkills": [
+    "planning",
+    "nextjs-app-router",
+    "supabase-auth-rls",
+    "postgres-migrations",
+    "owasp-security-review",
+    "frontend-design",
+    "accessibility-wcag",
+    "browser-qa",
+    "testing-qa",
+    "product-copy",
+    "ship"
+  ],
+  "optionalSkills": ["ui-polish", "docs", "upgrade", "debug"],
+  "screenshotFailClosed": "A user-visible change is not done until someone opened the running UI, captured desktop and mobile screenshots, and reviewed those images."
+}