@appsforgood/next-supabase-kit 0.3.0 → 0.4.1

package/DOGFOOD.md

@@ -1,201 +0,0 @@
-# Dogfood Evidence
-
-This file is the public-safe summary of downstream adoption evidence. Detailed local-path notes live in `dogfood/` and are intentionally excluded from the npm package.
-
-## Evidence Rule
-
-- Dogfood evidence must run against the current built CLI, not an older remembered result.
-- Real-project audits may fail. Failure is useful when it proves the kit catches setup drift.
-- Public summaries use project archetypes instead of local paths or private project details.
-- A dogfood item only counts as promoted when it leads to an installed asset, audit check, test, release gate, or documented decision.
-
-## Current Read-Only Audit Snapshot
-
-Date: 2026-06-03
-CLI source: current `dist/index.js`
-Command: `node dist/index.js audit --json`
-Mode: read-only audit; no downstream files were modified.
-
-| Project Archetype | Summary | Readiness | Highest-Value Gaps Caught |
-| --- | --- | --- | --- |
-| SaaS/tool hybrid | 11 pass, 20 warn, 7 fail | `needs-setup` | Missing `.agent-kit/agent-roster.json`, schema contracts, `AGENT_ROSTER.md`, `ASSISTANT_ADAPTERS.md`, `COUNCIL.md`, `DESIGN.md`, `QUALITY_GATES.md`, `UPGRADE.md`, assistant adapters, visual QA evidence, reference-led design critique, and stale templates. |
-| Content/admin hybrid | 11 pass, 20 warn, 7 fail | `needs-setup` | Missing `.agent-kit/agent-roster.json`, schema contracts, `AGENT_ROSTER.md`, `ASSISTANT_ADAPTERS.md`, `COUNCIL.md`, `DESIGN.md`, `QUALITY_GATES.md`, `UPGRADE.md`, assistant adapters, visual QA evidence, reference-led design critique, and stale/customized templates. |
-
-## What This Proves
-
-- The audit distinguishes older valid installs from the current best-practice setup.
-- Current audits catch the exact post-research hardening areas: schema-backed council routing, assistant activation, maturity gates, upgrade lifecycle, visual QA, and reference-led frontend critique.
-- Real projects installed before later hardening phases need `agent-kit update` and conflict review before they can claim baseline setup under the current package.
-
-## What This Does Not Prove
-
-- These two projects are not yet best-practice candidates.
-- The public npm package has not yet been published and verified with `npx`.
-- Assistant adapters and upgrade lifecycle still need real activation/dogfood evidence after publication.
-- Reference-led design critique still needs a real UI change dogfood pass with screenshots or equivalent visual evidence.
-
-## 2026-07-04 Publish @0.1.8 Snapshot
-
-Date: 2026-07-04
-CLI source: local `dist/index.js` after `npm run release:check`
-
-- Setup-server API route coverage (`tests/setup-server-api.test.ts`), Playwright UI screenshot smoke (`smoke:ui-screens`, Playwright 1.55.1), and Agent Studio Milestone 8 completion (note/render POST endpoints, session picker, live office controls).
-- `readJsonBody` shared between setup and studio servers; oversized bodies return 400 without dropping the connection; studio SSE broadcasts notes.
-- Dedicated Ubuntu CI job for UI screenshots; not part of `release:check` matrix.
-- Local verification: `release:check` green (150 tests, setup-server.ts 86% statements), `smoke:ui-screens` produced 4 PNGs.
-- Published `@appsforgood/next-supabase-kit@0.1.8`; `publish:verify` passed against live registry.
-
-## 2026-07-04 Publish @0.1.7 Snapshot
-
-Date: 2026-07-04
-CLI source: public npm registry `@appsforgood/next-supabase-kit@0.1.7`
-
-- Published `@appsforgood/next-supabase-kit@0.1.7` with lifecycle README commands, `/spec`/`/test`/`/review` Antigravity adapters, and `prompts/lifecycle-command-index.md`.
-- Post-publish: `npm run publish:verify` against live registry.
-
-## 2026-07-04 Publish @0.1.6 Snapshot
-
-Date: 2026-07-04
-CLI source: public npm registry `@appsforgood/next-supabase-kit@0.1.6`
-Mode: local maintainer publish (token) after `npm run release:check`, then `npm run publish:verify`.
-
-- Published `@appsforgood/next-supabase-kit@0.1.6` to public npm (local token publish with `--provenance=false`; CI releases continue to use OIDC + provenance).
-- `npm run publish:verify` passed: registry visibility confirmed, `npx` doctor ok, clean temp `init` installed current baseline assets, and `audit --json --min-readiness baseline-setup` returned 0 failures (67 pass / 4 warn / readiness `baseline-setup`).
-
-## 2026-07-02 Publish Verification And Self-Install Snapshot
-
-Date: 2026-07-02
-CLI source: public npm registry (`@appsforgood/next-supabase-kit`, published) plus local `src/` for the self-install.
-Mode: post-publish verification against the live registry, and dogfooding the kit into this repo's own root.
-
-- `node scripts/post-publish-verify.mjs` against the published package passed: registry visibility confirmed, `npx` doctor ok, clean temp `init` installed 23 files, and `audit --json --min-readiness baseline-setup` returned 0 failures (readiness `baseline-setup`).
-- This repo now dogfoods its own kit at the root: `agent-kit init` installed the root docs, `.agent-kit/`, and Cursor rules; project context, council session, and overrides were filled with real evidence; `agent-kit audit --min-readiness best-practice-candidate` passes with 0 warnings and 0 failures.
-
-## 2026-06-07 Agent Studio Dogfood Snapshot
-
-Date: 2026-06-07
-CLI source: current `dist/index.js`
-Mode: downstream update, guided context generation, session recording, static Studio export, and final audit.
-
-| Project Archetype | Stage | Summary | Readiness | Notes |
-| --- | --- | --- | --- | --- |
-| Content/admin hybrid | Before update | 11 pass, 31 warn, 8 fail | `needs-setup` | Older partial install was missing current roster, schemas, docs, context, and Agent Studio assets. |
-| Content/admin hybrid | After update/onboard/export | 54 pass, 17 warn, 0 fail | `baseline-setup` | `agent-kit update` preserved customized docs through `.agent-kit/conflicts/`; `onboard`, session render, and `studio export` worked locally. |
-| Content/admin hybrid | After `session output` fix and completed session | 52 pass, 19 warn, 0 fail | `baseline-setup` | Completed planning session has all required outputs marked complete, verification recorded, rendered Markdown current, static Studio export regenerated, and 14 valid Agent Studio events. Extra warnings reflect template changes made during this fix and remaining project-specific evidence gaps. |
-
-### Finding Promoted Back Into The Kit
-
-Dogfood exposed that sessions could define required outputs but lacked a CLI command to update their status. The fix adds `agent-kit session output <name...> --status <missing|partial|complete|not-applicable> --evidence <evidence>`, a `required_output_updated` event type, renderer/static-export support, CLI smoke coverage, and completed-session regression tests.
-
-### Remaining Dogfood Gaps
-
-- Project context still needs real product summary, audience, workflows, auth/tenant model, UI direction, value proposition, and quality target answers.
-- Assistant adapter rows still need active-tool verification evidence in downstream projects beyond the kit repo itself.
-- Project-owned docs need conflict review before adopting newer template wording.
-- A real UI change still needs reference-led design critique and desktop/mobile visual QA evidence.
-- Public npm publish and `npm run publish:verify` still need maintainer release execution. See [PUBLISH.md](PUBLISH.md).
-
-## 2026-06-07 Release Gate Snapshot
-
-Date: 2026-06-07
-CLI source: current built CLI
-Command: `npm run release:check`
-Result: passed locally on Windows after assistant adapter install on init, baseline audit gate smoke, install smoke, Agent Studio smoke, SBOM check, and npm pack dry run.
-
-| Gate | Result |
-| --- | --- | --- |
-| Tests | 65 passed |
-| Example install shape | `baseline-setup`, 0 failures |
-| Install smoke | IDE adapter rules installed, `baseline-setup`, 0 failures |
-| Agent Studio smoke | `baseline-setup`, 0 failures |
-| Baseline audit gate smoke | `baseline-setup`, 0 failures |
-| npm pack dry run | `@appsforgood/next-supabase-kit@0.1.1` tarball validated |
-
-Remaining publish action: execute [PUBLISH.md](PUBLISH.md), then run `npm run publish:verify`.
-
-## 2026-06-07 Assistant Adapter Activation On Init
-
-Date: 2026-06-07
-CLI source: current built CLI
-Mode: init-time assistant adapter rule installation for downstream projects.
-
-| Surface | Path | Status | Evidence |
-| --- | --- | --- | --- |
-| Downstream init | `.cursor/rules/cursor-agent-kit.mdc` | Active on `agent-kit init` | `smoke:install`, `smoke:audit-gate`, and `tests/update.test.ts` verify rule installation. |
-| Downstream init | `.cursor/rules/cursor-model-selection.mdc` | Active on `agent-kit init` | Same smoke and update coverage as council rule. |
-| Template docs | `ASSISTANT_ADAPTERS.md` | Updated | Adapter activation steps and init-time install behavior documented for downstream projects. |
-
-## Promotion Back Into The Kit
-
-| Dogfood Finding | Promoted Kit Behavior |
-| --- | --- |
-| Older installs drift as the package improves. | Template hashes, `agent-kit diff`, `agent-kit update`, `UPGRADE.md`, upgrade checklist, and upgrade audit warnings. |
-| Existing project docs vary and must be preserved. | Conflict-safe writes and `.agent-kit/overrides.json`. |
-| Agent instructions can exist without machine-readable council routing. | `.agent-kit/agent-roster.json`, roster schema validation, and council-session evidence. |
-| AI tool activation cannot be assumed from `AGENTS.md` alone. | `ASSISTANT_ADAPTERS.md` and `.agent-kit/assistant-adapters/`. |
-| Frontend docs can miss product-specific design evidence. | `DESIGN.md`, content-first design skill, reference-led design critique, visual QA tiers, and screenshot review. |
-| Required session outputs were hard to complete without manual JSON edits. | `agent-kit session output`, `required_output_updated` events, renderer/export support, and completed-session audit coverage. |
-
-## Upgrade Regression Fixture
-
-The package also includes a deterministic test for an older install shape:
-
-- Older install has customized root docs and no current roster, schemas, assistant adapters, `DESIGN.md`, `QUALITY_GATES.md`, or `UPGRADE.md`.
-- `agent-kit update` behavior preserves customized docs and writes new template versions into `.agent-kit/conflicts/`.
-- `agent-kit diff` previews missing docs, changed docs, roster status, missing library folders, files update would create, and files update would write to conflicts.
-- Missing current baseline docs and `.agent-kit/agent-roster.json` are added.
-- `.agent-kit/schemas/`, `.agent-kit/assistant-adapters/`, and the reference-led design critique skill are installed.
-- The upgraded fixture audits with `0` failures and readiness `baseline-setup`.
-
-Covered by `tests/update.test.ts`.
-
-## Next Dogfood Passes
-
-- Review generated conflicts in the dogfood project and decide which project-owned docs should adopt the latest template wording.
-- Run `agent-kit update` on another real project on a dedicated branch and record conflict-review outcomes.
-- Activate at least one assistant adapter in a real project and record whether the chosen tool loads the canonical council instructions.
-- Apply the reference-led design critique gate to one real frontend change with desktop/mobile screenshot evidence.
-- After public publish, run `npm run publish:verify` to verify registry visibility, public `npx doctor`, clean temp `init`, and `audit --json` with zero failures.
-
-## BaseRepo Maintainer Dogfood Policy
-
-Date: 2026-06-17
-Policy: **gitignored local overlay + bootstrap script** (not committed to kit source)
-
-| Item | Detail |
-| --- | --- |
-| Bootstrap | `npm run dogfood:init` runs `agent-kit init --stack next-supabase --activate cursor --activate codex` against the repo root |
-| Gitignore | `.agent-kit/`, `.codex/`, init-generated council docs at repo root, and local pack tarballs — see `.gitignore` and [DOCS.md](DOCS.md#maintainer-dogfood) |
-| Validation | `node dist/index.js adapter validate cursor\|codex` after bootstrap |
-| Release evidence | [MAINTAINER_RELEASE.md](MAINTAINER_RELEASE.md) session checklist; loop patterns in [LOOP_CODING.md](LOOP_CODING.md) |
-| Rationale | Kit source stays in `templates/` and tracked maintainer docs; overlay proves Tier B activation without polluting commit history |
-
-This policy closes the gap where the kit shipped Level 5 IDE surfaces but BaseRepo maintainers operated at Level 4 day-to-day.
-
-## 2026-07-04 - Lifecycle Commands README Parity
-
-Date: 2026-07-04
-Scope: README/docs discoverability + three new Antigravity adapters
-
-| Item | Detail |
-| --- | --- |
-| README | Added **Workflow Commands** section: lifecycle diagram, 12 core + 8 UI slash commands, council table, skills-by-phase, skill activation narrative |
-| Canonical index | `prompts/lifecycle-command-index.md` for delivery commands (parallel to `prompts/ui-command-index.md`) |
-| New adapters | `/spec`, `/test`, `/review` in `antigravity/commands/` (20 total native commands) |
-| Roster | `testing` and `code-review` workflows; planning triggers for spec keywords |
-| Historical scope | `/build`, `/webperf`, `/code-simplify`, and `/build auto` were deferred in this 0.1.7 review; the later runtime ships bounded roster workflows rather than cloning those command semantics |
-| Verification | `npm test`, `agent-kit adapter validate antigravity` after build |
-
-## 2026-07-11 - README Examples Release 0.2.1
-
-Date: 2026-07-11
-Scope: publish the verified README rewrite through npm Trusted Publishing and confirm the public artifacts.
-
-| Evidence | Result |
-| --- | --- |
-| Local release gate | `npm run release:check` passed with 200 tests, coverage gates, package/adapters/examples/install/Studio/setup/audit checks, zero dependency vulnerabilities, SBOM validation, and package dry runs. |
-| Root package | `@appsforgood/next-supabase-kit@0.2.1` is public and the `latest` dist-tag resolves to `0.2.1`. |
-| Published README | npm returns the rewritten quick start, audit, council-session, frontend-review, update, and optional-runtime examples for `0.2.1`. |
-| Runtime package | `@appsforgood/agent-kit-runtime` remains at `0.1.3`; the release workflow correctly skipped its unchanged package. |
-| GitHub release | [`v0.2.1`](https://github.com/lukey662/agentsandskills/releases/tag/v0.2.1) was created only after public-registry verification. |
-| Supply chain | Trusted Publishing used GitHub Actions OIDC and generated the root-package SBOM attestation before publication. |

package/GOVERNANCE.md

@@ -1,45 +0,0 @@
-# Governance
-
-## Maintainer Model
-
-This project is maintained as a small public OSS package. Maintainers own release approval, public-package safety, research promotion, and final merge decisions.
-
-## Decision Rules
-
-Changes should improve reusable setup quality for many projects. Project-specific preferences belong downstream unless repeated evidence shows they generalize.
-
-Promoted best practices need at least one of:
-
-- Repeated findings from repository research.
-- Dogfood evidence from downstream installs.
-- Official framework or platform documentation.
-- A clear security, release, or maintainability requirement.
-
-Promotion targets should be explicit:
-
-- Installed root template.
-- Agent role.
-- Skill.
-- Prompt.
-- Checklist.
-- Schema.
-- Audit rule.
-- Research scanner signal.
-- CI or release gate.
-
-## Release Rules
-
-Releases require:
-
-- Passing CI.
-- Passing install smoke.
-- Passing dependency audit.
-- Passing package dry run.
-- Branch protection and repository settings reviewed when workflows, permissions, or release controls changed.
-- Public package metadata review.
-- No secrets, copied third-party source, or private downstream details.
-- Trusted Publishing or another npm-approved secure publish path.
-
-## Research Rules
-
-Research findings are evidence, not implementation. A pattern only becomes kit behavior after it is promoted into an installed asset, CLI/audit behavior, test, release gate, or recorded decision.

package/LOOP_CODING.md

@@ -1,107 +0,0 @@
-# Loop Coding
-
-Loop coding means the agent repeats **plan → act → check → fix** until a stop condition, instead of finishing in one chat turn. The Agent Kit is opinionated about **which loops are safe** and **which checkpoints must stay in place**.
-
-This document describes loop types, kit-safe patterns, and limits. It is the canonical reference for eval-driven development with `@appsforgood/next-supabase-kit`.
-
-## Loop Types
-
-| Loop type | What it means | Kit-safe version |
-| --- | --- | --- |
-| **Agent loop** | Same agent iterates on feedback until done | Use scoped prompts (for example `.agent-kit/prompts/implement-feature.md`); review each turn; do not remove Security Reviewer or QA gates |
-| **Eval-driven loop** | Code changes until **tests, audit, or evals pass** | `npm test` + `agent-kit audit` + CI — BaseRepo uses `npm run release:check` as the maintainer merge gate |
-| **Self-improving loop** | Agent critiques its own output and revises | Manual: delegate to `@qa-engineer` or run tests between passes; **avoid fully unsupervised self-critique on auth, RLS, or release tooling** |
-| **Council / team loop** | Planner → specialist → Security → QA handoffs | `agent-kit session handoff` + IDE subagents — the kit's core operating model |
-| **Background / overnight loop** | Runs without a human present | **Defer by default** — requires worktree policy, cost caps, kill switches, and stronger eval gates than agent freedom |
-
-## Practical Rule
-
-Climb maturity by adding **checkpoints** (tests, audit, guards, human review), not by removing them. Unsupervised loops are only healthy when **eval gates are stronger than the agent's freedom**.
-
-## Eval-Driven PR Loop (recommended)
-
-For feature work in a kit-consuming project:
-
-1. **Plan** — Planner classifies scope; Lead Architect maps affected layers when the change is core.
-2. **Implement** — Next.js / Supabase engineers (or general agent with council rules loaded).
-3. **Check** — run the smallest reliable gate set:
-   ```bash
-   npm test
-   agent-kit audit --min-readiness baseline-setup
-   agent-kit adapter validate all   # when IDE surfaces change
-   ```
-4. **Fix** — repeat implement/check until green or blocked on a documented gap.
-5. **Record** — `agent-kit session render` and mirror summary in `COUNCIL.md` for meaningful multi-agent work.
-
-BaseRepo maintainers use the same pattern at repo scale:
-
-```bash
-npm run release:check    # tests, build, package validate, smokes, adapter validate
-npm run smoke:audit-gate
-```
-
-## Council Loop (multi-agent)
-
-The default handoff order lives in `AGENTS.md` and `.agent-kit/agent-roster.json`:
-
-1. Planner — scope, workflow, council selection
-2. Lead Architect — core changes
-3. Domain engineers — data, UI, copy as needed
-4. Security Reviewer — auth, mutations, secrets, dependencies, release risk
-5. QA Engineer — behavior evidence
-6. Documentation Maintainer — living docs and council record
-
-Use Agent Studio when the CLI is available:
-
-```bash
-agent-kit session start --workflow core-change --request "Short title"
-agent-kit session handoff --from planner --to lead-architect --decision "..." --risk "..." --next "..." --evidence "..."
-agent-kit session verify --command "npm test" --result pass
-agent-kit session output phased-checklist --status complete --evidence "..."
-agent-kit session render
-```
-
-When CLI tooling is unavailable, append the session template in `COUNCIL.md` (see `MAINTAINER_RELEASE.md` for kit release evidence).
-
-## Hooks And Local Automation (Level 6 enablers)
-
-The kit does **not** ship unsupervised orchestration. It documents safe local enablers:
-
-| Pattern | Purpose | Starting point |
-| --- | --- | --- |
-| Pre-commit test or audit | Catch drift before commit | `.agent-kit/prompts/audit-project-setup.md`, project `npm test` |
-| Post-edit lint/typecheck | Fast feedback on save | Project ESLint / `tsc --noEmit` in editor or CI |
-| PR CI audit gate | Block merge below readiness | `.github/workflows/agent-kit-audit.yml` template |
-| Adapter validate on PR | Prove IDE templates stay shippable | `agent-kit adapter validate all` (BaseRepo: `npm run adapter:validate` in `release:check`) |
-
-For Cursor-specific hook/automation patterns, see Cursor Automations docs and keep Planner-first triage **opt-in** — never as a replacement for Security Reviewer or human release approval.
-
-## MCP Routing (delegation hint)
-
-Match MCP servers to council roles in consuming projects:
-
-| Role | Typical MCP use |
-| --- | --- |
-| Supabase/Postgres Engineer | Schema, migrations, RLS, logs, advisors |
-| Security Reviewer | Dependency/advisory checks; no broad production writes without review |
-| Deployment/Observability Engineer | Hosting logs, release status, error tracking |
-| QA Engineer | Test runners, visual diff tools where configured |
-
-Record active MCP surfaces in `ASSISTANT_ADAPTERS.md` when they affect council behavior.
-
-## What Not To Default
-
-- Overnight unsupervised agent runs on auth, RLS, or release tooling
-- Agents managing agents without eval harness and kill switches
-- Removing human review from publish, migration, or security-sensitive paths
-- Duplicating runtime product agents inside the kit repo (wrong shape for agent-kit)
-
-## Related Docs
-
-- `AGENTS.md` — council roles and default handoffs
-- `QUALITY_GATES.md` — Baseline / Strong / Mature evidence tiers
-- `COUNCIL.md` — session evidence template
-- `MAINTAINER_RELEASE.md` — kit maintainer release session checklist
-- `research/summaries/agentic-engineering-maturity-levels.md` — L3–L8 ladder and office integration
-- `TESTING.md` — project test and CI gate expectations
-- `PUBLISH.md` — npm publish runbook

package/MAINTAINER_RELEASE.md

@@ -1,100 +0,0 @@
-# Maintainer Release Evidence
-
-Use this checklist when shipping `@appsforgood/next-supabase-kit` releases. It aligns kit maintainer practice with the **Strong** tier in `QUALITY_GATES.md`: council sessions record workflow, decision, risk, next handoff, required outputs, and evidence.
-
-For loop patterns and safe automation limits, see [LOOP_CODING.md](LOOP_CODING.md). For publish steps, see [PUBLISH.md](PUBLISH.md).
-
-## When To Open A Session
-
-Start `agent-kit session` (or a `COUNCIL.md` entry) when the release includes any of:
-
-- CLI or install behavior changes
-- New or changed IDE adapter surfaces (Cursor, Codex, Claude, Copilot, Antigravity)
-- Audit, roster, schema, or Agent Studio contract changes
-- Security-sensitive dependency or publish pipeline changes
-- Multi-agent work spanning Planner → Architect → QA
-
-Skip a formal session only for typo-only doc fixes with no behavioral impact.
-
-## Bootstrap Maintainer Dogfood
-
-Maintainers run the kit locally on BaseRepo without committing the overlay:
-
-```bash
-npm run dogfood:init
-node dist/index.js adapter validate cursor
-node dist/index.js adapter validate codex
-```
-
-Generated paths (`.agent-kit/`, `.cursor/`, `.codex/`, root council docs from init) are **gitignored**. Kit source stays in `templates/`, `assistant-adapters/`, and tracked root docs such as `DOCS.md` and `SPEC.md`.
-
-## Release Session Workflow
-
-```bash
-agent-kit session start --workflow release --request "Release vX.Y.Z"
-agent-kit session decision --agent planner --decision "..." --risk "..." --next "lead-architect" --evidence "..."
-agent-kit session verify --command "npm run release:check" --result pass --notes "..."
-agent-kit session verify --command "npm run smoke:audit-gate" --result pass
-agent-kit session output changelog --status complete --evidence "CHANGELOG.md#X.Y.Z"
-agent-kit session output test-evidence --status complete --evidence "vitest + smokes green"
-agent-kit session output publish-evidence --status complete --evidence "npm run publish:verify or GitHub Release vX.Y.Z"
-agent-kit session render
-```
-
-After publish, append a short evidence block to [DOGFOOD.md](DOGFOOD.md) (public-safe, no local paths).
-
-## COUNCIL.md Mirror Template
-
-When Agent Studio CLI is unavailable, paste this block into root `COUNCIL.md` (maintainer overlay, gitignored) or into the PR description:
-
-```md
-## YYYY-MM-DD - Release vX.Y.Z
-
-- Workflow: release
-- Status: complete
-- Request: Ship @appsforgood/next-supabase-kit@X.Y.Z
-- Affected layers: CLI, install, adapters, docs, CI, deployment
-
-### Required Outputs
-
-| Output | Status | Evidence |
-| --- | --- | --- |
-| Phased checklist | Complete | ROADMAP / PR scope |
-| Architecture decision | Complete/N/A | DECISIONS.md or PR note |
-| Security review | Complete | Dependency audit in release:check; no secret in adapters |
-| Test evidence | Complete | npm run release:check; npm run smoke:audit-gate |
-| Adapter validation | Complete | npm run adapter:validate (all IDE templates) |
-| Docs impact | Complete | CHANGELOG.md, DOCS.md, PUBLISH.md if process changed |
-| Publish verification | Complete | npm run publish:verify or Release workflow green |
-
-### Handoffs
-
-| Agent | Decision | Risk | Next Handoff | Evidence |
-| --- | --- | --- | --- | --- |
-| Planner | Release scope approved | Missed breaking change | Lead Architect / QA | PR + CHANGELOG |
-| QA Engineer | release:check green | Residual flake | Documentation Maintainer | CI logs |
-| Documentation Maintainer | CHANGELOG + DOGFOOD updated | Stale public evidence | Deployment/Observability | DOGFOOD.md entry |
-
-### Verification
-
-| Command Or Review | Result | Notes |
-| --- | --- | --- |
-| npm run release:check | Pass | Includes adapter:validate |
-| npm run smoke:audit-gate | Pass | baseline-setup, 0 failures |
-| npm run publish:verify | Pass/Skipped | Required after registry publish |
-```
-
-## Pre-Merge Gate (BaseRepo)
-
-Every release PR must pass:
-
-1. `npm run release:check` (tests, build, package validate, smokes, **adapter validate all**, audit, pack dry-run)
-2. `npm run smoke:audit-gate`
-3. CHANGELOG section for the target version
-4. Session render or COUNCIL mirror with verification table filled in
-
-## Post-Publish
-
-1. Run `npm run publish:verify` after registry propagation (or confirm Release workflow verification).
-2. Update `DOGFOOD.md` with publish verification snapshot (no machine paths).
-3. Mark release items in `ROADMAP.md`.

package/REPOSITORY_SETTINGS.md

@@ -1,83 +0,0 @@
-# Repository Settings
-
-This file records the GitHub settings that must be applied outside git for the repository to operate as a public best-practice package.
-
-## Branch Protection
-
-Protect `main` with:
-
-- Require a pull request before merging.
-- Require at least one approval.
-- Require review from CODEOWNERS for owned paths.
-- Dismiss stale approvals when new commits are pushed.
-- Require conversation resolution before merge.
-- Require branches to be up to date before merge.
-- Require linear history.
-- Do not allow force pushes.
-- Do not allow deletions.
-- Restrict bypasses to maintainers only.
-
-Optional status checks, only after GitHub Actions entitlement is confirmed and the project deliberately chooses hosted CI as required:
-
-- `Verify package`
-- `Review dependency changes`
-- `Analyze JavaScript and TypeScript`
-- `Scorecard`
-
-With the default `githubActions.mode: "off"`, configure no required hosted status checks. GitHub billing, spending-limit, or pre-execution failures cannot be recovered inside workflow YAML and must not block commit/push or ordinary phase progression. Preserve equivalent local test, audit, dependency, and security evidence in the council session.
-
-## Release Environment
-
-Create environment `npm-publish` with:
-
-- Required reviewers enabled.
-- Prevent self-review enabled where available.
-- Deployment branches restricted to `main`.
-- No npm package-write token secrets. Automated publication must fail closed when Trusted Publishing is unavailable.
-- Required reviewers should protect manual non-dry-run dispatches without preventing the normal version-PR merge path.
-
-Under **Actions > General > Workflow permissions**, allow GitHub Actions to create pull requests. The version workflow has job-scoped `contents: write` and `pull-requests: write` permissions and uses that setting only to open or update the Changesets version PR.
-
-Create this npm Trusted Publisher for each of these package names:
-
-- `@appsforgood/next-supabase-kit`
-- `@appsforgood/agent-kit-runtime`
-
-Each trusted publisher must match:
-
-- Provider: GitHub Actions
-- Repository: `lukey662/agentsandskills`
-- Workflow: `release.yml`
-- Environment: `npm-publish`
-- Allowed action: `npm publish`
-
-## Security Settings
-
-Enable:
-
-- Private vulnerability reporting.
-- GitHub Security Advisories.
-- Dependabot alerts.
-- Dependabot security updates.
-- Code scanning alerts.
-- Secret scanning where available.
-- Push protection for detected secrets where available.
-
-## Issues, Discussions, And Labels
-
-Enable issues. Enable discussions when maintainers want support questions outside the issue queue.
-
-Create labels from `.github/labels.yml`. Required label families:
-
-- Type: `bug`, `enhancement`, `research`, `documentation`, `security`, `dependencies`
-- Area: `area: cli`, `area: agents`, `area: frontend`, `area: supabase`, `area: research`, `area: release`, `area: repo-health`
-- Status: `needs-triage`, `blocked`, `good first issue`, `help wanted`
-- Risk: `risk: security`, `risk: breaking-change`
-
-## GitHub Pages
-
-Enable GitHub Pages with source "Deploy from a branch", branch `main`, folder `/docs`. The minimal docs site lives at `docs/index.md` with the `jekyll-theme-minimal` theme configured in `docs/_config.yml`. Update `docs/index.md` when the CLI surface, readiness levels, or quick-start commands change.
-
-## Review Cadence
-
-Review these settings before every public release and after any workflow, release, permission, package, or security-policy change.

package/RESEARCH_CITATION_POLICY.md

@@ -1,26 +0,0 @@
-# Research Citation Policy
-
-This project uses public repository research to identify reusable setup patterns for agents, skills, documentation, security, testing, and frontend quality.
-
-## Public Package Policy
-
-- Publish generalized summaries, promoted decisions, and methodology.
-- Do not publish third-party source code copied from researched repositories.
-- Do not imply endorsement by repository owners, maintainers, vendors, or design-system teams.
-- Do not present popularity as proof of quality.
-- Treat scanned repositories as untrusted input.
-
-## Included Public Research Artifacts
-
-The npm package may include:
-
-- `research/scan-config.json`
-- `research/scan-plan.md`
-- `research/summaries/*`
-- `research/proposed-updates.md`
-
-Detailed per-repo findings, candidate lists, and raw scan outputs should stay out of the public package unless they receive separate citation and legal review.
-
-## How Findings Become Guidance
-
-Research findings are promoted only as generalized practices with a clear rationale. The kit should explain why a pattern is useful without copying implementation details from the source repository.

package/SUPPLY_CHAIN.md

@@ -1,57 +0,0 @@
-# Supply Chain Security
-
-The root kit and optional runtime are intended for public npm distribution. Release integrity is part of the product, not an optional operations detail.
-
-## Publish Identity
-
-- Public packages: `@appsforgood/next-supabase-kit` and `@appsforgood/agent-kit-runtime`.
-- Publish path: GitHub Actions release workflow through npm Trusted Publishing.
-- Authentication: short-lived GitHub OIDC identity only; automated publishing has no npm token fallback.
-- Environment: `npm-publish`.
-- Each npm package must have its own Trusted Publisher scoped to repository `lukey662/agentsandskills`, workflow `release.yml`, environment `npm-publish`, and allowed action `npm publish`.
-
-The workflow removes inherited npm token variables, supplies a token-free npm configuration, and requires the GitHub OIDC request context before publishing. A missing or incorrect package-level Trusted Publisher fails closed instead of switching authentication modes. Successful publication carries npm provenance tied to that workflow identity.
-
-The release workflow creates separate root/runtime tarballs and package-rooted CycloneDX SBOMs, uploads them as release evidence, and attests each SBOM against its exact tarball. Runtime publishes before root when both are new. Both public packages are verified before the matching GitHub release, so a partial npm publish cannot create an apparently successful source release.
-
-## Release Gates
-
-Before publish:
-
-- `npm ci`
-- `npm run release:check`
-- Public release review
-
-`npm run release:check` validates JSON assets, typechecks both workspaces, tests, builds both packages, runs install smoke, runs dependency audit, validates SBOM generation, and performs root/runtime package dry runs. The install smoke also inspects packaged public files for forbidden private-package text.
-
-`npm run sbom:check` validates that the lockfile-derived CycloneDX SBOM can be generated, includes runtime dependencies, and has no unresolved required dependency links. Optional platform-specific dependency links may be skipped when npm records optional package edges that are not present for the current install target.
-
-After publish:
-
-- `npm view @appsforgood/next-supabase-kit@<version> version`
-- `npm view @appsforgood/agent-kit-runtime@<version> version`
-- Clean install and import of `@appsforgood/agent-kit-runtime`
-- Clean install of both packages followed by root `doctor`, `init`, `audit --json` with zero failures, and `orchestrate validate --json`
-
-The release workflow and `npm run publish:verify` both use `scripts/post-publish-verify.mjs` for this post-publish verification path.
-
-## Repository Automation
-
-- Local `npm run release:check` is the default package verification and supply-chain gate.
-- Hosted CI may mirror package verification on push and pull request when Actions entitlement is deliberately enabled.
-- Dependency Review can block pull requests that introduce moderate or worse known vulnerabilities when hosted Actions is available; otherwise review `npm audit` and lockfile changes locally.
-- Dependabot proposes npm and GitHub Actions updates; workflow actions remain pinned to immutable commit SHAs with reviewed version comments.
-- CodeQL scans JavaScript/TypeScript code.
-- OpenSSF Scorecard publishes repository security posture as code-scanning evidence.
-- CODEOWNERS identifies default review ownership for source, templates, schemas, and workflows.
-- Release artifacts include an attested CycloneDX SBOM for the npm tarball.
-
-## Maintainer Rules
-
-- Do not use npm publish tokens for automation. Maintainer-local OTP publishing is an explicit recovery operation, not a workflow fallback.
-- Do not publish from unreviewed branches or untrusted workflow changes.
-- Treat workflow edits as release-risk changes requiring security and maintainer review.
-- Keep package-write token secrets absent from repository and environment configuration.
-- Keep package contents free of secrets, private downstream data, and copied third-party source.
-- Keep SBOM generation and attestation in the shared release path; do not publish an unattested tarball when the workflow is available.
-- Keep `allowScripts` approvals version-pinned to reviewed required native/build packages. Explicitly deny optional package scripts that are not needed.

package/agents/deployment-observability-engineer.md

@@ -1,13 +0,0 @@
-# Deployment/Observability Engineer Agent
-
-## Purpose
-
-Own release safety, environment configuration, migrations, logs, monitoring, and rollback.
-
-## Responsibilities
-
-- Verify env vars and server-only secrets.
-- Confirm migration and deploy order.
-- Ensure production errors are observable.
-- Define smoke checks after deployment.
-- Document rollback steps.

package/agents/docs-maintainer.md

@@ -1,17 +0,0 @@
-# Documentation Maintainer Agent
-
-## Purpose
-
-Keep living docs accurate enough for another engineer or agent to continue safely.
-
-## Responsibilities
-
-- Update `SPEC.md` after functional changes.
-- Update `DECISIONS.md` for meaningful tradeoffs.
-- Update `DOCS.md` for workflows and setup.
-- Update `COUNCIL.md` for meaningful handoff evidence.
-- Update `QUALITY_GATES.md`, `DESIGN.md`, `STYLE_GUIDE.md`, `SECURITY.md`, `TESTING.md`, `DEPLOYMENT.md`, and `UPGRADE.md` when standards change.
-
-## Rule
-
-Docs and council evidence are part of the implementation surface, not optional cleanup.