@appsforgood/next-supabase-kit 0.3.0 → 0.4.1

package/prompts/ui-command-index.md

@@ -1,124 +0,0 @@
-# UI Command Index
-
-Use this index to run repeatable UI improvement workflows. These are command-like prompts for any assistant surface and the source of truth for native runtime commands.
-
-Canonical sources:
-
-- `DESIGN.md`
-- `STYLE_GUIDE.md`
-- `TESTING.md`
-- `QUALITY_GATES.md`
-- `.agent-kit/agent-roster.json`
-- `.agent-kit/skills/ui-improvement-harness.md`
-- `.agent-kit/checklists/ui-detectors.md`
-- `.agent-kit/checklists/ui-acceptance-rubric.md`
-- `.agent-kit/prompts/screenshot-review.md`
-- `.agent-kit/prompts/visual-qa-plan.md`
-
-## `/ui-audit`
-
-Audit a target UI surface before release.
-
-Required steps:
-
-1. Identify target route, component, workflow, auth state, data state, and risk tier.
-2. Load product/design context and relevant design brief.
-3. Review desktop and mobile evidence, or state which evidence must still be captured.
-4. Run the UI detector checklist.
-5. Return blockers, majors, minors, preserved capabilities, and required fixes.
-
-Required outputs: target surface, risk tier, detector findings by severity, missing evidence, pass/fail verdict.
-
-## `/ui-polish`
-
-Improve visual quality without changing product scope.
-
-Required steps:
-
-1. Start from detector findings, screenshots, or a named surface.
-2. Preserve product behavior, auth boundaries, copy claims, and data contracts.
-3. Improve hierarchy, spacing, density, alignment, component states, and interaction feedback.
-4. Avoid decorative complexity and generic SaaS defaults.
-5. Re-run detector and screenshot critique after changes.
-
-Required outputs: polish goals, changes made or proposed, detector deltas, screenshots needed, residual risks.
-
-## `/layout-cleanup`
-
-Reduce clutter and repair layout structure.
-
-Required steps:
-
-1. Identify primary task, secondary tasks, and content hierarchy.
-2. Remove unnecessary nesting, repeated surfaces, card-within-card patterns, and arbitrary dividers.
-3. Normalize spacing, grouping, alignment, heading scale, and responsive containers.
-4. Verify no truncation, overlap, or horizontal overflow remains.
-
-Required outputs: layout findings, cleanup actions, preserved workflow, desktop/mobile evidence.
-
-## `/responsive-cleanup`
-
-Make a UI work across mobile and desktop.
-
-Required steps:
-
-1. Review mobile width, desktop width, and any tablet breakpoint used by the project.
-2. Verify tap targets, text fit, navigation, primary action visibility, sticky UI, and scroll behavior.
-3. Verify stateful screens on mobile, not only the happy path.
-4. Capture or request mobile and desktop screenshots before acceptance.
-
-Required outputs: viewports checked, responsive findings, fixes, screenshots, remaining risks.
-
-## `/accessibility-pass`
-
-Run a WCAG 2.1 AA-oriented pass on the target UI.
-
-Required steps:
-
-1. Check semantics, headings, landmarks, forms, labels, tables, and buttons.
-2. Check keyboard navigation, visible focus, tab order, escape/close behavior, and skip path when applicable.
-3. Check contrast, reduced motion, error association, touch targets, and status announcements.
-4. Keep auth, state, and data-boundary tests separate from visual checks.
-
-Required outputs: accessibility findings, severity, fixes, skipped checks, test evidence.
-
-## `/distinctiveness-pass`
-
-Prove the UI belongs to this product and does not look generic.
-
-Required steps:
-
-1. Compare the first viewport to product category, audience, workflow, and content fingerprint.
-2. Confirm references were translated into lessons without copying source layouts, copy, assets, or brand marks.
-3. Remove fake metrics, vague claims, abstract filler, and interchangeable card stacks.
-4. Re-score distinctiveness and product quality where significant UI work is involved.
-
-Required outputs: product-specific evidence, generic-risk findings, source-safety notes, required changes.
-
-## `/screenshot-critique`
-
-Review provided screenshots or captured browser screenshots.
-
-Required steps:
-
-1. Name each screenshot, viewport, route, auth state, data state, and UI state.
-2. Run screenshot review, detector checklist, and accessibility risk scan.
-3. Compare against `DESIGN.md`, `STYLE_GUIDE.md`, and selected creative direction.
-4. Return concrete fixes, not broad design advice.
-
-Required outputs: screenshot inventory, blockers, high-value fixes, accepted areas, missing screenshots.
-
-## `/browser-qa`
-
-Run a live browser QA loop for an implemented UI.
-
-Required steps:
-
-1. Start or identify the dev/preview server and target routes.
-2. Open the target with required auth, role, tenant, and data state.
-3. Capture desktop and mobile screenshots.
-4. Run detector, screenshot critique, accessibility pass, and responsive cleanup.
-5. Apply scoped fixes and repeat until acceptance criteria pass.
-6. Record evidence with `agent-kit session output` when Agent Studio is in use.
-
-Required outputs: route, auth state, commands run, screenshots, detector results, fixes, final verdict.

package/prompts/upgrade-review.md

@@ -1,18 +0,0 @@
-# Upgrade Review Prompt
-
-Use this prompt before accepting a dependency, framework, Agent Kit, or template upgrade.
-
-## Prompt
-
-Review this upgrade against `UPGRADE.md`, `QUALITY_GATES.md`, `SECURITY.md`, `TESTING.md`, and `DEPLOYMENT.md`.
-
-Return:
-
-- What changed and why.
-- Which release notes, migration guides, or codemods apply.
-- Which local templates or overrides changed.
-- Which Supabase migrations, RLS policies, generated types, or auth boundaries are affected.
-- Which Next.js routing, rendering, caching, metadata, or middleware behavior is affected.
-- Which tests, smoke checks, visual QA, and release checks prove the upgrade.
-- Rollback plan.
-- Remaining warnings before best-practice readiness.

package/prompts/visual-qa-plan.md

@@ -1,16 +0,0 @@
-# Visual QA Plan Prompt
-
-Use before accepting a frontend change or before adding visual regression coverage.
-
-Return:
-
-1. Visual QA tier: baseline, strong, or mature.
-2. Surfaces requiring evidence.
-3. Component states to capture.
-4. Viewports, themes, locales, permissions, or data states to cover.
-5. Dynamic content that must be mocked, masked, frozen, or excluded.
-6. Tooling recommendation: Playwright screenshots, Storybook stories, Chromatic, Argos, Loki, or manual screenshot review.
-7. CI or PR evidence that should be produced.
-8. Rules for approving baseline updates.
-
-Do not recommend visual snapshots for volatile full pages unless the volatile regions can be stabilized.

package/research/proposed-updates.md

@@ -1,70 +0,0 @@
-# Proposed Agent Kit Updates
-
-Generated after the 100-repo scan on 2026-06-02.
-
-## Repeated Evidence
-
-- 88 of 100 findings had weak or non-discoverable Supabase/Auth/RLS signals.
-- 66 of 100 findings had immature agent handoff or AI-workflow signals.
-- 57 of 100 findings had weak accessibility signals.
-- 54 of 100 findings had implicit or incomplete security expectations.
-- Stronger repos consistently exposed docs, CI, validation, component systems, test setup, or explicit review workflows.
-
-## Updates Promoted In This Iteration
-
-- Added package-level `DECISIONS.md`.
-- Added RLS policy inventory expectations to `templates/next-supabase/SPEC.md` and `SECURITY.md`.
-- Added security control inventory expectations to `templates/next-supabase/SECURITY.md`.
-- Added design token and component-state inventory expectations to `STYLE_GUIDE.md` and `SPEC.md`.
-- Added CI gate expectations to `TESTING.md`.
-- Strengthened frontend-design, Supabase/RLS, accessibility, and testing skills/checklists.
-- Added machine-readable agent council routing with Planner-first planning and architect-led core-change handoffs.
-- Added public-readiness expectations around MIT licensing, neutral package identity, citation policy, and install smoke.
-- Added a focused creative-design follow-up pass after recognizing that the original frontend score over-weighted tokens, components, and states.
-- Added `DESIGN.md`, content-first design skill, brand/content intake, creative-direction matrix, brand/content checklist, expanded design briefs, and audit coverage for frontend creative-direction evidence.
-- Added a visual QA follow-up pass for Storybook, Playwright screenshots, Chromatic, Argos, Loki, visual baselines, and component-state evidence.
-- Added Visual Regression QA skill, visual-regression checklist, visual QA plan prompt, `TESTING.md` visual QA tiers, roster routing, audit coverage, and research scanner signals.
-- Added a schema-backed council traceability pass after recognizing that the 100-repo research volume was not enough unless practices became enforceable contracts.
-- Added `schemas/agent-roster.schema.json`, `schemas/council-session.schema.json`, `COUNCIL.md`, Agent Handoff Tracing skill, agent-council checklist, council-session review prompt, roster routing, audit coverage, and public-readiness tests.
-- Added a repo-health follow-up pass for issue templates, PR templates, CODEOWNERS, Dependabot, CodeQL, support, conduct, governance, and public-maintainer workflows.
-- Added repo-health files, public-readiness tests, scanner scoring, and a refresh category so public OSS maintainability is treated as release readiness.
-- Added a repository-settings follow-up for branch protection, protected publish environment, private vulnerability reporting, required labels, discussions, and security settings that live outside git.
-- Added `REPOSITORY_SETTINGS.md`, `.github/labels.yml`, `.github/labeler.yml`, PR labeler workflow, public-readiness tests, and scanner signals.
-- Added shared release-readiness command so CI, release, and local checks use the same gate.
-- Added a supply-chain follow-up pass for npm Trusted Publishing/provenance, Dependency Review, OpenSSF Scorecard, workflow hardening, and release controls.
-- Added `SUPPLY_CHAIN.md`, Dependency Review workflow, Scorecard workflow, workflow concurrency/non-persistent checkout controls, manual publish ref validation, supply-chain scanner scoring, and public-readiness tests.
-- Added lockfile-derived CycloneDX SBOM validation and release-workflow SBOM attestation for the exact npm tarball being published.
-- Added a maturity-model follow-up pass after recognizing that a broad 100-repo scan still needs a project-level definition of baseline, strong, and best-practice evidence.
-- Added `QUALITY_GATES.md`, installed it by default, added audit coverage for multi-area maturity expectations, and added tests that catch hollowed-out quality-gate docs.
-- Added project-evidence placeholder audit warnings so a fresh install does not get mistaken for completed best-practice evidence.
-- Added machine-readable audit readiness verdicts so downstream projects can distinguish setup failures, baseline setup, remaining warnings, and best-practice candidates.
-- Added `agent-kit audit --min-readiness <level>` so projects can enforce baseline or best-practice readiness in CI without parsing JSON themselves.
-- Added `schemas/audit-report.schema.json` and runtime contract tests so audit consumers can validate machine-readable output.
-- Added an assistant-adapter activation pass after recognizing that a roster is not enough unless downstream tools load or reference it.
-- Added `ASSISTANT_ADAPTERS.md`, `assistant-adapters/*`, install support, audit checks, and public-readiness tests for AGENTS.md-compatible tools, GitHub Copilot/VS Code instructions, Cursor rules, and Claude Code subagents.
-- Added an upgrade-lifecycle pass after recognizing that reusable kits need safe adoption paths for future template, assistant-adapter, framework, and Supabase changes.
-- Added `UPGRADE.md`, `templates/next-supabase/UPGRADE.md`, Upgrade Maintenance skill, upgrade checklist, upgrade-review prompt, roster routing, audit checks, and public-readiness tests.
-- Added a reference-led design critique pass after recognizing that frontend work could still pass with generic visual quality if it had tokens, states, and screenshots but no reference-set evidence or distinctiveness verdict.
-- Added Reference-Led Design Critique skill, design-critique prompt, design-critique checklist, `DESIGN.md` reference/anti-reference fields, roster routing, audit coverage, and public-readiness tests.
-- Added a frontend product-quality rubric pass after recognizing that qualitative critique still needed a repeatable score threshold.
-- Added Frontend Product Quality Rubric skill, product-quality checklist, scorecard prompt, `DESIGN.md` scorecard fields, roster routing, audit coverage, and public-readiness tests.
-- Added a frontend distinctiveness benchmark pass after recognizing that even a scored UI can still feel interchangeable without first-screen proof, content fingerprint, safe reference learning, asset provenance, state proof, and visual QA proof.
-- Added Frontend Distinctiveness Benchmark skill, checklist, benchmark prompt, `DESIGN.md` evidence fields, roster routing, audit coverage, and public-readiness tests.
-
-## Future Updates To Consider
-
-- Re-run dogfood installs after the public package is published.
-- Add more stack-specific rosters for non-Supabase stacks.
-- Add richer audit severity scoring once more downstream evidence exists.
-- Dogfood the visual QA tier guidance on a real frontend project and convert repeated findings into concrete starter examples.
-- Dogfood the reference-led design critique gate on a real frontend project and convert repeated weaknesses into stricter examples or audit signals.
-- Dogfood the frontend product-quality scorecard on a real frontend project and tune score thresholds from actual review evidence.
-- Dogfood the frontend distinctiveness benchmark on a real frontend project and convert repeated weaknesses into stricter examples or audit signals.
-- Dogfood assistant adapters in real Codex, Copilot, Cursor, and Claude Code projects and convert repeated activation failures into stricter checks.
-- Dogfood the upgrade lifecycle on a real existing install and convert repeated conflict or rollback gaps into stricter checks.
-- Add optional CI validation for structured council-session JSON records once downstream projects start storing machine-readable traces.
-- Add optional scorecard-style repository health checks once the public repo has enough external contribution activity to tune the signal.
-- Add branch/environment protection documentation after the GitHub repository settings are confirmed.
-- Compare actual GitHub repository settings against `REPOSITORY_SETTINGS.md` after maintainer credentials are available.
-
-Do not copy source code from scanned repositories. Adopt only generalized practices with clear rationale.

package/research/scan-config.json

@@ -1,261 +0,0 @@
-{
-  "maxRepos": 100,
-  "minStars": 100,
-  "activeSince": "2024-12-01",
-  "excludeRepos": [
-    "appwrite/appwrite"
-  ],
-  "seedRepos": [
-    {
-      "fullName": "dubinc/dub",
-      "category": "production-saas"
-    },
-    {
-      "fullName": "documenso/documenso",
-      "category": "production-saas"
-    },
-    {
-      "fullName": "formbricks/formbricks",
-      "category": "production-saas"
-    },
-    {
-      "fullName": "triggerdotdev/trigger.dev",
-      "category": "production-saas"
-    },
-    {
-      "fullName": "unkeyed/unkey",
-      "category": "security-quality"
-    },
-    {
-      "fullName": "better-auth/better-auth",
-      "category": "security-quality"
-    },
-    {
-      "fullName": "nextauthjs/next-auth",
-      "category": "security-quality"
-    },
-    {
-      "fullName": "tailwindlabs/headlessui",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "shadcn-ui/ui",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "google-labs-code/design.md",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "google-labs-code/stitch-sdk",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "storybookjs/design-system",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "primer/react",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "radix-ui/primitives",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "carbon-design-system/carbon",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "Shopify/polaris",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "uswds/uswds",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "Shopify/polaris-tokens",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "alphagov/govuk-design-system",
-      "category": "design-systems"
-    },
-    {
-      "fullName": "t3-oss/create-t3-app",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "storybookjs/storybook",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "storybookjs/test-runner",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "chromaui/chromatic-cli",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "argos-ci/argos",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "oblador/loki",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "openai/openai-agents-js",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "openai/openai-agents-python",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "langchain-ai/langgraphjs",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "langchain-ai/langgraph-supervisor-py",
-      "category": "testing-docs-agents"
-    },
-    {
-      "fullName": "github/docs",
-      "category": "repo-health-maintainers"
-    },
-    {
-      "fullName": "github/codeql-action",
-      "category": "repo-health-maintainers"
-    },
-    {
-      "fullName": "dependabot/dependabot-core",
-      "category": "repo-health-maintainers"
-    },
-    {
-      "fullName": "ossf/scorecard",
-      "category": "repo-health-maintainers"
-    },
-    {
-      "fullName": "actions/dependency-review-action",
-      "category": "supply-chain-security"
-    },
-    {
-      "fullName": "ossf/scorecard-action",
-      "category": "supply-chain-security"
-    },
-    {
-      "fullName": "npm/provenance",
-      "category": "supply-chain-security"
-    },
-    {
-      "fullName": "slsa-framework/slsa-github-generator",
-      "category": "supply-chain-security"
-    }
-  ],
-  "categories": [
-    {
-      "name": "official-nextjs",
-      "targetCount": 15,
-      "queries": [
-        "org:vercel nextjs",
-        "org:vercel app-router",
-        "org:nextjs"
-      ]
-    },
-    {
-      "name": "supabase-nextjs",
-      "targetCount": 15,
-      "queries": [
-        "supabase nextjs language:TypeScript",
-        "\"createServerClient\" supabase language:TypeScript",
-        "\"row level security\" supabase nextjs",
-        "\"supabase\" \"app/\" \"middleware.ts\" language:TypeScript",
-        "\"supabase\" \"rls\" language:TypeScript"
-      ]
-    },
-    {
-      "name": "production-saas",
-      "targetCount": 20,
-      "queries": [
-        "nextjs saas language:TypeScript",
-        "nextjs dashboard language:TypeScript",
-        "app router saas language:TypeScript",
-        "open source saas starter nextjs language:TypeScript",
-        "nextjs admin dashboard language:TypeScript"
-      ]
-    },
-    {
-      "name": "design-systems",
-      "targetCount": 15,
-      "queries": [
-        "react design system language:TypeScript",
-        "component library react accessibility language:TypeScript",
-        "radix tailwind components language:TypeScript",
-        "shadcn components language:TypeScript",
-        "\"DESIGN.md\" \"design system\" language:Markdown",
-        "\"creative direction\" \"design tokens\" language:Markdown",
-        "\"design critique\" \"reference set\" language:Markdown",
-        "\"anti-reference\" \"creative direction\" language:Markdown",
-        "\"product quality\" \"scorecard\" \"frontend\" language:Markdown",
-        "\"user task\" \"content\" \"accessibility\" \"design system\" language:Markdown"
-      ]
-    },
-    {
-      "name": "security-quality",
-      "targetCount": 15,
-      "queries": [
-        "nextjs security language:TypeScript",
-        "codeql typescript nextjs",
-        "zod route handlers nextjs",
-        "auth middleware nextjs security language:TypeScript",
-        "csrf rate limit nextjs language:TypeScript"
-      ]
-    },
-    {
-      "name": "testing-docs-agents",
-      "targetCount": 20,
-      "queries": [
-        "playwright nextjs language:TypeScript",
-        "\"toHaveScreenshot\" playwright language:TypeScript",
-        "\"visual regression\" storybook language:TypeScript",
-        "chromatic storybook visual testing language:TypeScript",
-        "argos visual testing playwright language:TypeScript",
-        "vitest playwright nextjs language:TypeScript",
-        "contributing security testing nextjs language:TypeScript",
-        "AGENTS.md language:TypeScript",
-        "CLAUDE.md nextjs",
-        "\"agent handoff\" \"tracing\" language:TypeScript",
-        "\"json schema\" \"agents\" language:TypeScript",
-        "\"AGENTS.md\" \"handoff\" language:Markdown"
-      ]
-    },
-    {
-      "name": "repo-health-maintainers",
-      "targetCount": 10,
-      "queries": [
-        "\".github/ISSUE_TEMPLATE\" \"pull_request_template\" language:Markdown",
-        "\"dependabot.yml\" \"CODEOWNERS\" language:Markdown",
-        "\"CodeQL\" \"dependabot\" \"PULL_REQUEST_TEMPLATE\" language:Markdown",
-        "\"SECURITY.md\" \"SUPPORT.md\" \"CODE_OF_CONDUCT.md\" language:Markdown",
-        "\"research\" \"CONTRIBUTING.md\" \"security advisory\" language:Markdown",
-        "\"branch protection\" \"required status checks\" \"CODEOWNERS\" language:Markdown",
-        "\"private vulnerability reporting\" \"security advisories\" language:Markdown",
-        "\"labels.yml\" \"labeler.yml\" \".github\" language:YAML"
-      ]
-    },
-    {
-      "name": "supply-chain-security",
-      "targetCount": 10,
-      "queries": [
-        "\"npm publish\" \"id-token: write\" \"provenance\" language:YAML",
-        "\"trusted publishing\" \"npm publish\" \"GitHub Actions\" language:Markdown",
-        "\"dependency-review-action\" \"fail-on-severity\" language:YAML",
-        "\"ossf/scorecard-action\" \"publish_results\" language:YAML",
-        "\"OpenSSF Scorecard\" \"CodeQL\" \"Dependabot\" language:Markdown"
-      ]
-    }
-  ]
-}

package/research/scan-plan.md

@@ -1,24 +0,0 @@
-# 100 Repo Research Plan
-
-## Objective
-
-Discover repeatable, evidence-backed best practices for Next.js + Supabase project setup, then promote only durable patterns into this package.
-
-## Method
-
-1. Discover candidates through GitHub API queries.
-2. Filter for active, non-archived repositories.
-3. Shallow clone selected repos.
-4. Score architecture, security, Supabase/Auth/RLS, frontend design, accessibility, testing, docs, CI, and agent readiness.
-5. Write one finding per repo.
-6. Summarize repeated patterns.
-7. Update templates only when a pattern is repeated and defensible.
-
-## Do Not Copy
-
-- Source code
-- Proprietary assets
-- Project-specific copy
-- Security-sensitive implementation details
-
-Extract patterns and rationale only.

package/research/summaries/.gitkeep

@@ -1 +0,0 @@
-

package/research/summaries/agent-workflow-patterns.md

@@ -1,37 +0,0 @@
-# Agent Workflow And Handoff Trace Patterns
-
-Generated from a focused follow-up review of multi-agent workflow systems and configuration-validation practices.
-
-## Why This Pass Was Needed
-
-The kit had a default roster and audit checks, but mature agent systems also expose schemas, structured handoffs, guardrails, and traces. Without those, council routing can become prose-only and hard to verify after work is complete.
-
-## Focused Sources Reviewed
-
-- `openai/openai-agents-js` and OpenAI Agents SDK docs: handoffs expose schemas, parse handoff inputs locally, and tracing records what happened during agent runs.
-- `openai/openai-agents-python`: lightweight multi-agent framework with agents, tools, guardrails, handoffs, and tracing.
-- `langchain-ai/langgraphjs`: graph-based orchestration for resilient agent workflows and role-specific agents.
-- `langchain-ai/langgraph-supervisor-py`: supervisor pattern and explicit handoff tooling for routing between specialist agents.
-- JSON Schema / SchemaStore-style config validation patterns: machine-readable schemas help editors, CI, and audit tools detect configuration drift.
-
-## Repeated Patterns To Adopt
-
-- Treat the roster as a contract, not just documentation.
-- Ship schemas beside machine-readable config.
-- Keep handoffs explicit: owner, decision, risk, next owner, and evidence.
-- Record required outputs and whether each is missing, partial, complete, or not applicable.
-- Keep human-readable notes and machine-readable traces compatible.
-- Validate routing drift in audit so downstream projects cannot silently bypass core roles.
-
-## Promoted Updates
-
-- Add `schemas/agent-roster.schema.json`.
-- Add `schemas/council-session.schema.json`.
-- Add `COUNCIL.md` as the human-readable council evidence log.
-- Add Agent Handoff Tracing skill.
-- Add agent council checklist.
-- Add council-session review prompt.
-- Add schema folder to installed assets and public package contents.
-- Add audit coverage for schema presence and council evidence guidance.
-
-Do not tie the kit to a single runtime agent framework. The package should stay provider-neutral while adopting broadly useful schema, handoff, guardrail, and trace concepts.

package/research/summaries/agentic-engineering-maturity-levels.md

@@ -1,54 +0,0 @@
-# Agentic Engineering Maturity Levels
-
-Generated from the Agent Kit iceberg model for setup office gamification, `LOOP_CODING.md`, and maintainer climb planning.
-
-## Summary
-
-Agentic engineering maturity is modeled as **levels L3–L8**. The kit **computes L3–L6** from audit, adapter, and setup signals. **L7–L8 are deferred** (never auto-awarded) because they require stronger eval gates than agent freedom.
-
-| Level | Name | Computed? |
-| --- | --- | --- |
-| L3 | AI-native IDE | Yes |
-| L4 | Rules, context, MCP contract | Yes |
-| L5 | Subagents, skills, council specialists | Yes |
-| L6 | Eval loops, hooks, CI gates | Yes (downstream or maintainer profile) |
-| L7 | Overnight / unsupervised teams | No — explore only |
-| L8 | Agents managing agents | No — lab only |
-
-## Base levels (reference)
-
-| Lens | Level |
-| --- | --- |
-| What `@appsforgood/next-supabase-kit` ships | High L4 → solid L5 |
-| BaseRepo maintainer day-to-day (gitignored dogfood overlay) | Mid L4 |
-| BaseRepo CI (`release:check`, `adapter:validate`, audit smokes) | Partial L6 |
-| Fresh downstream `init` | ~L4 capability; L3 until context complete |
-| Fresh `init --activate cursor\|codex` | L5 capability when subagents exist |
-
-## When each level was cutting edge (approximate)
-
-| Era | Frontier | Became baseline |
-| --- | --- | --- |
-| 2022–2023 | Browser chat, tab completion | Copy-paste only |
-| 2023–2024 | Repo-aware IDE chat (L3) | Autocomplete-only |
-| Late 2024–2025 | AGENTS.md, rules, MCP (L4) | Ad-hoc prompting |
-| 2025–2026 | Subagents, skills, councils (L5) | Single chat for all roles |
-| 2026 now | Eval CI, loop until green (L6) | Manual “run tests when you remember” |
-| 2026 hype | Overnight agent teams (L7) | Not safe as default |
-| 2026+ lab | Meta-orchestration (L8) | Not mainstream production |
-
-## Office and wizard integration
-
-- `agent-kit setup` computes level via `computeAgenticLevel()` and returns it on `/api/state`.
-- Agent Office shows **Lcurrent → Ltarget**, an iceberg strip (L3–L8), and top climb steps.
-- Setup wizard complete screen links **`LOOP_CODING.md`**, **`agent-kit adapter validate`**, and audit gates.
-- Maintainer source repos use a **maintainer profile** (release-check + dogfood docs) for L6 signals.
-
-## Related assets
-
-- `LOOP_CODING.md` — kit-safe loop patterns
-- `schemas/agentic-level.schema.json` — report shape
-- `src/studio/agentic-level.ts` — scoring implementation
-- `research/summaries/maturity-model-patterns.md` — QUALITY_GATES evidence tiers (separate from Agentic L3–L8)
-
-Do not conflate **Agentic L3–L8** with **QUALITY_GATES Baseline/Strong/Best-Practice** or **visual QA baseline/strong/mature** — the setup UI labels these separately.

package/research/summaries/creative-design-patterns.md

@@ -1,38 +0,0 @@
-# Creative Design And Agent-Readable UI Patterns
-
-Generated from a focused second-pass review after the initial 100-repo scan showed that frontend scoring over-weighted reusable components, tokens, and states.
-
-## Why This Pass Was Needed
-
-The first scan correctly promoted design tokens, component states, accessibility, screenshot review, and anti-generic UI rules. It did not fully enforce creative discovery: audience, content inventory, brand direction, visual identity, category references, and multiple design directions before implementation.
-
-## Focused Sources Reviewed
-
-- `google-labs-code/design.md`: first-class design identity document for coding agents, with machine-readable tokens and human-readable rationale.
-- `google-labs-code/stitch-sdk`: design-generation workflow with project design systems, generated screens, screenshots, and variants.
-- `storybookjs/design-system`: open design system repository with shared components, Storybook docs, packaging, CI, and visual regression testing.
-- `storybookjs/storybook`: component workshop pattern for building, documenting, and testing UI states in isolation.
-- `primer/react`: product design-system implementation with contributor/testing expectations.
-- `Shopify/polaris-react` and `Shopify/polaris-tokens`: design-system and token packaging patterns for product-specific admin UI.
-- `govuk-design-system` and GOV.UK service/content guidance: user-need-first service design and content that maps to real user tasks.
-
-## Repeated Patterns To Adopt
-
-- Keep a persistent design-identity document beside agent instructions, not only a style guide.
-- Treat tokens as normative values and prose as usage rationale.
-- Require content and user needs before visual styling.
-- Generate or compare multiple creative directions before implementation.
-- Keep screenshots or visual states as acceptance evidence, not optional polish.
-- Prefer product/category-specific briefs over generic SaaS templates.
-- Make missing real content or assets explicit instead of masking gaps with generic placeholders.
-
-## Promoted Updates
-
-- Add `DESIGN.md` as an installed root document.
-- Add a content-first design skill.
-- Add brand/content intake and creative-direction prompts.
-- Add brand/content checklist.
-- Expand design briefs for ecommerce, portfolio/venue, education/course, community/social, and AI workflow products.
-- Require frontend audit coverage for content, brand, creative direction, and screenshot evidence.
-
-Do not copy source code, design files, or proprietary brand systems from reviewed repositories. Adopt only generalized practices with clear rationale.