@appsforgood/next-supabase-kit 0.4.0 → 0.4.2

package/skills/deslop/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: deslop
+description: Use as the last copy pass. Strip AI-writing tells and leftover visual slop. Copy must run this after product-copy, not instead of it.
+---
+
+# Deslop
+
+Last pass. `product-copy` writes the words. This skill removes the machine accent.
+
+Scan 2026-09-06: `conorbronsdon/avoid-ai-writing`, `funboy322/avoid-ai-design`, `educlopez/ui-craft`, `superdesigndev/superdesign-skill`. Patterns only. Do not copy their catalogs.
+
+## Use when
+
+Copy is about to say “done,” or anyone asked to de-slop, humanize, or “make this less AI.” Always run after `product-copy` on public or conversion copy.
+
+## Order
+
+1. Finish `product-copy` (audience, headline, CTA, claims).
+2. Open the rendered surface if one exists.
+3. Run this skill. Fix words first. If the screenshot still reads as default AI UI, hand back to Design with the P0 list. Do not skip this step.
+
+## Writing tells — cut or rewrite
+
+| Tell | Fix |
+| --- | --- |
+| Chatbot openers (“Certainly!”, “Great question!”) | Delete. Start with the point. |
+| Inflators (seamless, robust, leverage, unlock, supercharge, 10x, paradigm) | Name the thing. “use,” “ships,” “blocks.” |
+| Copula dodge (“serves as,” “boasting,” “featuring”) | “is” / “has.” |
+| “It’s not X, it’s Y” | One positive sentence. |
+| Moreover / Furthermore / In today’s X / In conclusion | Cut or join with “and.” |
+| Vague experts / studies show | Cite or delete. |
+| Title Case Headings on every line | Sentence case. |
+| Em dash stacks, emoji headers, sparkle bullets | Periods. Real nouns. |
+| “Get started” / “Learn more” with no object | Say the next action. |
+| Placeholder leftovers (`[Your Name]`, `TODO copy`) | Fill or delete. |
+
+Second pass: re-read the rewrite. If the same tell remains, rewrite the paragraph, do not synonym-swap.
+
+## Visual P0s — fail if still on screen
+
+These are the 2026 convergence cluster. One is a smell. Two or more is a reject.
+
+- Purple-to-blue (or indigo) gradient hero, or gradient-clipped headline type
+- Inter / Roboto / default shadcn zinc as the whole identity
+- Centered slogan + two pills + three equal icon cards
+- `rounded-2xl` + `shadow-lg` + blur on every surface
+- Cream paper `#F4F1EA` + terracotta accent (the 2026 “editorial default”)
+- Acid green or neon vermilion on near-black used as decoration, not meaning
+- Lucide Sparkles / Zap as the product metaphor
+- Fake dashboard metrics or DiceBear avatars
+
+Copy does not restyle the page. It lists the P0s from the screenshot and sends them to Design.
+
+## Must keep
+
+Facts, commands, file paths, the fail-closed screenshot sentence, and any claim that has proof. Deslop is subtraction, not a new brand voice.
+
+## Done when
+
+- A second read finds no writing tells above.
+- If a screen exists, the screenshot was read and remaining visual P0s are named or gone.
+- Copy’s verdict is not “done” until this pass ran.

package/skills/frontend-design/SKILL.md

@@ -1,26 +1,107 @@
 ---
 name: frontend-design
-description: Use when building or reviewing user-facing UI. Prefer task-first screens. Reject generic AI-looking gradients, card soup, and fake metrics.
+description: Use when building or reviewing user-facing UI. Commit one simple palette and type pairing. Reject default AI layouts, timid color spreads, and decoration that is not the task.
 ---
 
 # Frontend Design
 
+Build or review a screen as if a stranger must name the product from the first viewport. Simple and specific beats decorated.
+
+Scan 2026-09-06 (structure only, no bodies copied): Anthropic `frontend-design` (updated 2026-06), addyosmani `frontend-ui-engineering`, `educlopez/ui-craft`, `funboy322/avoid-ai-design`, `superdesigndev/superdesign-skill`.
+
 ## Use when
 
-Screens, components, layout, visual design, or anti-generic UI review.
+Any user-facing layout, component, HTML page, or “it looks generic.” Required for `USER_GUIDE.html` and for app screens.
+
+## Ground in the subject
+
+Name the product, the user, and this screen’s job before CSS. Tokens come from the domain (materials, time of day, one real object) — not from a theme pack. A toy store and a ledger cannot share a palette.
+
+**This kit’s HTML** (`USER_GUIDE.html`): charcoal assignment desk.
+
+| Token | Value |
+| --- | --- |
+| Paper | `#10100e` |
+| Ink | `#eceae4` |
+| Frame | `#070706` |
+| Line | `#2a2823` |
+| Safelight | `#ff5a2a` (required / fail only) |
+| Pass | `#5ea37a` |
+| Type | `"Helvetica Neue", Helvetica, Arial, ui-sans-serif` |
+| Mono | `ui-monospace, Menlo, Consolas` |
+| Radius | `2px` |
+| Shadow | none |
+
+**Downstream Next.js apps:** do not paste the kit desk onto a product. Extract or invent **4–6 hex tokens** from *this* product’s job. Write them before CSS. Inside an existing design system, stay surgical — swap tells, do not invent a second brand.
+
+## Color — simple schemes that hold up
+
+One field, one ink, one accent, one line. That is enough.
+
+1. **Dominant field** (~80%): the page. Flat. Not a gradient, not a mesh.
+2. **Ink** (~15%): body text. Contrast ≥ 4.5:1 (3:1 for large type).
+3. **Accent** (~5%): one action or one required state. Recolor-as-decoration fails.
+4. **Line / well**: borders and code wells, one step off the field.
+
+Recipes (pick one that fits the product, then stop):
+
+| Scheme | Field | Ink | Accent | Use when |
+| --- | --- | --- | --- | --- |
+| Charcoal desk | `#10100e` | `#eceae4` | `#ff5a2a` | Tools, manuals, this kit |
+| Paper + ink | `#f4f4f1` | `#171717` | `#0b57d0` | Documents, settings, calm apps |
+| Night + signal | `#0e1116` | `#e6edf3` | `#3fb950` | Ops, status, pass/fail |
+| Warm shop | `#1c1916` | `#f3ece3` | `#e8a317` | Craft, commerce with real goods |
+
+Do not:
+
+- Spread six mid-chroma colors evenly.
+- Use purple→blue, default `blue-600`, or untouched shadcn `zinc` as the identity.
+- Use cream `#F4F1EA` + terracotta (the 2026 editorial default) unless the brief asks.
+- Use acid green or neon vermilion on near-black as decoration.
+- Treat Space Grotesk + slate, or any “tasteful” swap you used last week, as a new idea.
+
+Prefer CSS variables. Self-contained kit HTML: no Google Fonts, no CDN CSS.
+
+## Type
+
+One family, or two that are obviously different (display vs mono). Inter + system sans is not a pairing. Roboto, Space Grotesk, and “the last distinctive font you used” are second-order defaults.
+
+- Line length < 80 characters.
+- Tight display tracking on large sans. Do not italicize or recolor one word of a headline.
+- No tracked-out ALL-CAPS eyebrows, middle-dot meta (`A · B · C`), or `WORD — fragment` labels unless the content needs them.
+- Numbered tickets only when the content is a real sequence.
+
+## Layout
+
+- First viewport = the characteristic thing: command, table, form, named owner. Not a slogan over atmosphere.
+- Mobile (~390): the primary CTA still fits above the fold.
+- Hierarchy from size, weight, and space — not from cards.
+- Landing and marketing pages take a full direction. App chrome (settings, tables) stays quiet and dense.
+- Reject: centered hero + two pills + three icon cards; glass navbar; four-column empty footer; fake metrics; broadsheet hairlines + dense newsprint columns (that look is itself a 2026 default).
+
+## Motion
+
+None, or one moment that answers a click. Fade-and-slide on every section is generated. Respect `prefers-reduced-motion`.
+
+## Process
+
+1. Name the product, the user, and the job of this screen.
+2. Write the 4–6 tokens and one-sentence layout idea.
+3. Check the plan is not a 2026 default (cream editorial, neon-on-black decoration, SaaS card kit, newsprint desk, last week’s “tasteful” swap). If it is, change one axis: field, accent, or structure.
+4. Build. Spend boldness once. Remove one accessory.
+5. Screenshot desktop (~1280) and mobile (~390). Fix from pixels. Ask: would a stranger believe a person chose this?
 
 ## Checks
 
-- First screen shows the real product, task, or workflow.
-- Hierarchy, density, and primary action are obvious.
-- Loading, empty, error, disabled, success, and mobile states exist where relevant.
-- Contrast, focus, labels, and tap targets meet WCAG 2.1 AA.
-- Reject purple-blue gradient heroes, vague SaaS copy, fake dashboards, glass-card soup, and glow rails.
+- A stranger can name the product from the first screen.
+- Loading, empty, error, disabled, success exist where the flow has them.
+- Focus visible, tap targets usable.
+- Copy on the screen is real. If words are public-facing, Copy runs `deslop` last.
 
 ## Tools
 
-Critique from `browser` + `screenshot` + `image-review` first. Do not approve UI from TSX alone.
+`browser` + `screenshot` + `image-review` first. Do not approve UI from TSX or HTML alone.
 
 ## Done when
 
-Desktop and mobile screenshots were read. Blocker detector findings are fixed.
+Desktop and mobile images were read. Token list is in the change or in `DESIGN.md`. No P0 slop from `deslop` remains unless Design names it as an accepted exception.

package/skills/nextjs-app-router/SKILL.md

@@ -1,23 +1,43 @@
 ---
 name: nextjs-app-router
-description: Use for Next.js App Router, Server Components, Client Components, Route Handlers, Server Actions, caching, forms, and metadata.
+description: Use for Next.js App Router — Server vs Client, Server Actions, Route Handlers, async params/cookies, caching, and proxy.ts. Smoke the changed route in the browser.
 ---
 
 # Next.js App Router
 
+Scan 2026-09-09 (structure only, no bodies copied): Next.js App Router docs, Next.js 16 async request APIs and `proxy.ts` rename. This pack’s auth is **Supabase**, not a marketplace auth vendor.
+
 ## Use when
 
-Routes, layouts, Server Components, Client Components, Server Actions, Route Handlers, data loading, caching, or revalidation.
+`app/` routes, layouts, Server Components, Client Components, Server Actions, Route Handlers, `params` / `searchParams`, `cookies()` / `headers()`, caching, or request interception (`proxy.ts` / legacy `middleware.ts`).
+
+## Do
+
+1. Read the existing `app/` tree and match its conventions (`src/app` vs `app`).
+2. Keep the work on the **server** unless the browser must hold state, events, or Web APIs.
+3. Put mutations in Server Actions (forms) or Route Handlers (HTTP). Validate every input.
+4. After a user-visible change, open the running route before handing to QA.
 
 ## Checks
 
-- Server Components are the default. Client Components are only for browser-only behavior.
-- Secrets never enter client bundles.
-- User-specific data is not stored in shared caches.
-- Route params, query params, forms, and API bodies are validated.
-- Loading, error, empty, and success states exist.
-- Authorization is enforced on the server and in RLS, not only in the UI.
+- Server Components are the default. `"use client"` is only for browser-only behavior (event handlers, local state, browser APIs).
+- Secrets, service-role keys, and privileged fetches never enter a Client Component or a client bundle.
+- `cookies()`, `headers()`, `params`, and `searchParams` are **awaited** (Next.js 15+/16).
+- Navigation uses `next/navigation`, not `next/router`. Metadata uses `metadata` / `generateMetadata`, not `next/head`.
+- Pages Router APIs (`getServerSideProps`, `getStaticProps`, `pages/api`) stay out of new work.
+- Next.js 16 request interception lives in `proxy.ts` (`proxy()`). If the repo still has `middleware.ts`, migrate or document why it stays.
+- User-specific data is not stored in a shared/public cache. Tag invalidation uses the current two-argument `revalidateTag` API when tags are used.
+- Route params, query strings, form fields, and JSON bodies are validated with a schema. Do not trust the URL or the client.
+- `loading.tsx`, `error.tsx`, empty, and success exist for the changed route when the user can wait or fail.
+- Authorization is enforced on the server **and** in RLS (`supabase-auth-rls`). Hiding a button is not access control.
+
+## Reject
+
+- “It’s a Client Component so we can use hooks” when the data could load on the server.
+- Importing `@supabase/supabase-js` with the service-role key in a file that has `"use client"`.
+- Switching this pack to Clerk / Auth0 / NextAuth as the default. Auth here is Supabase.
+- Shipping a route from the diff without opening it.
 
 ## Done when
 
-The server/client boundary is explicit and the changed route can be opened in the browser.
+The server/client boundary is explicit, failure paths are named, and the changed route was opened in the running app. User-visible work then goes to QA with `browser-qa`.

package/skills/owasp-security-review/SKILL.md

@@ -1,23 +1,45 @@
 ---
 name: owasp-security-review
-description: Use when reviewing auth, APIs, Server Actions, uploads, webhooks, dependencies, secrets, or data mutations.
+description: Use when reviewing auth, Server Actions, Route Handlers, uploads, webhooks, SSRF, secrets, or data mutations in a Next.js + Supabase app.
 ---
 
 # OWASP Security Review
 
+Scan 2026-09-09: OWASP Top 10 mapped onto this pack (App Router + Supabase). Pair with `supabase-auth-rls`. Do not treat a UI walkthrough as access control.
+
 ## Use when
 
-Auth, APIs, Server Actions, external fetches, uploads, webhooks, dependencies, or mutations.
+Auth, RLS, Server Actions, Route Handlers, uploads, webhooks, server-side `fetch`, new dependencies, or any mutation.
 
 ## Checks
 
-- Broken access control and IDOR are tested.
-- Inputs are validated with safe schemas.
-- Outputs are encoded; secrets are not logged or bundled.
-- SSRF risk is addressed for server-side fetches.
-- Dependencies are reviewed for known critical CVEs.
-- Errors are explicit without leaking internals.
+Map each change to a concrete control. Skip rows that do not apply; do not skip access control when data is involved.
+
+| Risk | In this pack |
+| --- | --- |
+| Broken access control / IDOR | RLS + server checks. Object IDs in params/body cannot reach another user’s row. |
+| Cryptographic failures | No secrets in git, logs, or client bundles. Service role is server-only. |
+| Injection | Schema-validate inputs. Parameterized queries / Supabase client. No string-built SQL. |
+| Insecure design | Abuse case named (anon, other user, stolen cookie, replayed action). |
+| Misconfiguration | CORS, env, debug flags, Storage public/private. |
+| Vulnerable components | New deps reviewed; no known critical CVE waved through. |
+| Auth failures | Login, logout, refresh, denied. `getUser()` on the server. |
+| Integrity | Lockfile + CI. No postinstall scripts from untrusted packages. |
+| Logging | Privileged actions log without tokens, cookies, or PII dumps. |
+| SSRF | Server `fetch` / webhook URLs are allowlisted or parsed; no user-controlled hostname to cloud metadata. |
+
+## Server Actions And Route Handlers
+
+- Every mutation validates origin/input. Do not trust hidden form fields for `user_id` or `role`.
+- CSRF: cookie-session apps use SameSite and origin checks on state-changing POST.
+- File uploads: type, size, and Storage policy. Do not serve user files from a privileged bucket via a guessable path.
+
+## Reject
+
+- “RLS is enabled” without a policy that names the owner or tenant.
+- Findings with no severity, no affected behavior, and no fix.
+- Closing a user-visible auth bug from the SQL file alone (needs `browser-qa` for login/denied).
 
 ## Done when
 
-Each finding has severity, affected behavior, and a concrete fix. User-visible auth failures were seen in the browser.
+Each finding has severity, affected behavior, and a concrete fix. Access control is in Postgres or the server, not only the UI. User-visible auth failures were seen in the browser.

package/skills/planning/SKILL.md

@@ -11,15 +11,21 @@ Planning, roadmaps, “what should we do,” or any request that needs an owner.
 
 ## Steps
 
-1. Read enough of the repo to name affected routes and data.
+1. Read enough of the repo to name affected routes, tables, and auth boundaries.
 2. Pick one owner: `app-engineer`, `security`, `design`, `qa`, or `copy`.
-3. Add Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
-4. If the change is user-visible, list the desktop and mobile screenshots QA must capture.
+3. Name the skill that owner must run first:
+   - App engineer: `nextjs-app-router` and, if data/auth, `supabase-auth-rls` / `postgres-migrations`
+   - Security: `owasp-security-review` + `supabase-auth-rls`
+   - Design: `frontend-design`
+   - QA: `browser-qa` (screens) and `testing-qa` (commands)
+   - Copy: `product-copy` then `deslop` last
+4. Add extra reviewers: Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
+5. If the change is user-visible, list the desktop and mobile screenshots QA must capture.
 
 ## Done when
 
-Owner, extra reviewers, preserved behavior, and required screenshots are explicit. No product code was written.
+Owner, extra reviewers, required skills, preserved behavior, and required screenshots are explicit. No product code was written.
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role.
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.”

package/skills/postgres-migrations/SKILL.md

@@ -1,21 +1,39 @@
 ---
 name: postgres-migrations
-description: Use for schema changes, migrations, constraints, indexes, and rollback risk.
+description: Use for schema, constraints, indexes, RLS in the same change, generated types, and rollback risk.
 ---
 
 # Postgres Migrations
 
+Scan 2026-09-09 (structure only, no bodies copied): Supabase migration + RLS docs. Pair every user-data table with `supabase-auth-rls`.
+
 ## Use when
 
-Creating or changing tables, constraints, indexes, functions, triggers, or seed data.
+Creating or changing tables, columns, constraints, indexes, functions, triggers, views, or seed data.
+
+## Do
+
+1. Name the migration, the tables, and whether existing rows must keep working.
+2. Prefer additive changes. Destructive steps need an explicit rollback (or an expand/contract plan).
+3. If the table holds user or tenant data, **RLS lands in this change**, not a later ticket.
+4. Refresh generated DB types after the schema change.
 
 ## Checks
 
-- Migrations are additive or have an explicit rollback path.
-- Constraints protect integrity; indexes match real query paths.
-- RLS is planned in the same change when the table holds user or tenant data.
-- Generated types are refreshed after schema changes.
+- Constraints protect integrity (PK, FK, unique, `NOT NULL` where the product requires it).
+- Indexes match real `WHERE` / join paths, not speculative columns.
+- `ENABLE ROW LEVEL SECURITY` + policies ship with the table when it is user-owned, tenant-owned, or privileged.
+- `GRANT` is not a substitute for RLS. Revoking grants from `anon` / `authenticated` without policies is still incomplete if the service role is exposed.
+- Functions that run as definer are listed and justified. Prefer invoker + RLS.
+- Seed data does not insert other users’ rows as the current user.
+- Migration order is safe on a non-empty database (backfill before `NOT NULL`, rename in steps).
+
+## Reject
+
+- “We’ll add RLS after launch.”
+- Dropping a column or table in the same release that still reads it, with no expand/contract.
+- Editing production by hand instead of a numbered migration.
 
 ## Done when
 
-Migration order and rollback risk are named. User data is not left unprotected.
+Migration order and rollback risk are named. User data is not left unprotected. Types used by the app match the new schema.

package/skills/product-copy/SKILL.md

@@ -7,16 +7,48 @@ description: Use for headlines, CTAs, empty states, and conversion copy. Review
 
 ## Use when
 
-Landing pages, CTAs, positioning, onboarding, empty states, or pricing copy.
+Landing pages, CTAs, positioning, onboarding, empty states, pricing copy, or the public user guide (`USER_GUIDE.html`).
+
+## Audience
+
+Engineers and coding agents on a Next.js + Supabase repo who already have Cursor, Claude, Codex, Copilot, or Antigravity. They do not need a manifesto. They need to know **who to @**, **what to paste**, and **what “done” looks like**.
+
+## Positioning (this product)
+
+Name the specialist. Prove the screen. Six agents, twelve skills, five IDEs. QA is two screenshots, not a file diff.
+
+Do not describe this as an “agent operating system,” a copilot marketplace, or “AI-powered delivery.”
+
+## Voice
+
+Direct, specific, slightly dry. Prefer verbs: ask, paste, open, capture, reject.
+
+Use: specialist, owner, screenshot, desktop, mobile, fail-closed, paste, Planner, browser-qa.  
+Avoid: supercharge, seamless, unlock, copilot for X, 10x, enterprise-grade, magic, revolutionize.
+
+## Headline test
+
+If the headline could sell GitHub Copilot, Cursor, or any agent marketplace, rewrite it.
+
+Good: `Ask one specialist. Then open the running UI.`  
+Bad: `Supercharge your AI workflow with agents and skills.`
+
+## CTA test
+
+A CTA is a command or a pasteable prompt, not “Get started.”
+
+Good: `Paste this to Planner` followed by the plan prompt.  
+Good: `npx --yes @appsforgood/next-supabase-kit init --activate all`  
+Bad: `Start building today`.
 
 ## Checks
 
 - Audience, pain, and outcome are specific to this product.
-- Claims are backed or marked as assumptions.
+- Claims are backed or marked as assumptions. Do not invent user counts or “best-in-class.”
 - Headlines could not fit any competitor.
 - CTAs say what happens next.
-- Review the words on a screenshot for truncation and hierarchy.
+- Review the words on a screenshot for truncation, wrapping, and hierarchy. Copy that only exists in markdown is not approved for a public HTML page.
 
 ## Done when
 
-Copy is specific and the rendered screenshot shows the key line and CTA clearly.
+Copy is specific and the rendered screenshot shows the key line and CTA clearly on desktop and mobile. Copy then runs `deslop` as the last pass — this skill is not the end of the run.

package/skills/supabase-auth-rls/SKILL.md

@@ -1,23 +1,55 @@
 ---
 name: supabase-auth-rls
-description: Use for Supabase Auth, SSR clients, middleware, sessions, Row Level Security, Storage policies, and service-role usage.
+description: Use for Supabase Auth, SSR clients, session refresh, RLS, Storage policies, and keeping the service role server-only. UI checks are not authorization.
 ---
 
 # Supabase Auth And RLS
 
+Scan 2026-09-09 (structure only, no bodies copied): Supabase SSR Auth, RLS, and Storage policy docs. Do not replace this pack with a non-Supabase auth vendor.
+
 ## Use when
 
-Supabase Auth, SSR clients, middleware, sessions, tables, policies, Storage, or service-role operations.
+Supabase Auth, cookie/SSR clients, `proxy.ts` / middleware session refresh, RLS, Storage, service-role usage, or any table that stores user or tenant data.
+
+## Do
+
+1. Name the table or bucket and who may read or write a row.
+2. Use the **anon/user SSR client** in user requests. Use the **service role** only in a server-only module that never imports into Client Components.
+3. Enable RLS and write policies in the **same change** as the table (`postgres-migrations`).
+4. Prove a negative: another user (or anon) cannot read or write the row.
+
+## Clients
+
+| Client | Where | Key |
+| --- | --- | --- |
+| Browser / `'use client'` | Components that must talk to Supabase in the browser | `NEXT_PUBLIC_SUPABASE_ANON_KEY` only |
+| SSR / Server Components / Actions / Route Handlers | Cookie session, `createServerClient` | Anon key + cookies |
+| Service role | Server-only jobs, webhooks, migrations | `SUPABASE_SERVICE_ROLE_KEY` — never `NEXT_PUBLIC_` |
+
+Auth decisions use `getUser()` (or equivalent server verification), not a client-trusted `getSession()` JWT.
+
+If the app intercepts requests, refresh the session there (`proxy.ts` or existing `middleware.ts`) so Server Components see a current user.
+
+## RLS And Storage
+
+- `ENABLE ROW LEVEL SECURITY` on every user-owned, tenant-owned, or privileged table.
+- Policies name ownership (`auth.uid()`) and tenant boundaries. An “authenticated” role is not ownership.
+- Storage buckets have explicit policies. A private bucket with a public URL is a finding.
+- Privileged bypass (service role, `security definer`) is listed, server-only, and as narrow as the job.
 
 ## Checks
 
-- RLS is enabled on user-owned and tenant-owned tables.
-- Policies enforce ownership and tenant boundaries.
-- Service-role keys stay server-only.
-- Auth middleware refreshes sessions safely.
-- Storage buckets have explicit policies.
-- IDOR is considered and tested at the policy boundary.
+- IDOR is tested at the **policy** (and server) boundary: object IDs in the URL or body cannot reach another user’s row.
+- Login, logout, expired session, and denied are exercised when those states exist. User-visible ones need `browser-qa`.
+- `.env.example` documents public anon URL/key placeholders only. Service role stays unnamed in client files.
+
+## Reject
+
+- “The button is hidden, so they cannot hit the API.”
+- RLS deferred to a follow-up PR while the table is already queryable.
+- Service role in `NEXT_PUBLIC_*`, in a Client Component, or in a file imported by one.
+- Trusting `user_id` from the request body instead of `auth.uid()`.
 
 ## Done when
 
-A table that stores user data cannot be read or written across users without a failing policy. UI checks are not treated as authorization.
+A second user (or anon) cannot read or write the protected row. UI checks are not treated as authorization. Hand user-visible auth states to QA with `browser-qa`.

package/skills/testing-qa/SKILL.md

@@ -14,14 +14,14 @@ Adding or reviewing tests, smoke checks, or regression coverage.
 - Core logic has unit tests.
 - Preserved behavior has regression tests.
 - Critical flows have Playwright or equivalent smoke tests.
-- Auth and mutation paths are prioritized.
+- Auth, RLS, and mutation paths are prioritized (other-user / anon cannot pass).
 - Network failure, empty, and error behavior is covered.
 - Gaps are named when infrastructure is missing.
 
 ## Visual proof
 
-User-visible screens also require `browser-qa`. This skill does not replace screenshots.
+User-visible screens also require `browser-qa`. This skill does not replace screenshots. Passing `toBeVisible` is not image review.
 
 ## Done when
 
-Commands run, results, and residual gaps are listed.
+Commands run, results, and residual gaps are listed. RLS/auth tests fail closed when another user can read the row.

package/templates/next-supabase/AGENTS.md

@@ -27,4 +27,4 @@ Planner names the owner. Security joins auth/data/secret work. Design joins user
 
 ## Skills
 
-Default skills live in `.cursor/skills/*/SKILL.md` (and the matching Claude/Codex/Antigravity copies). QA of a screen always uses `browser-qa`, not `testing-qa` alone.
+Default skills live in `.cursor/skills/*/SKILL.md` (and the matching Claude/Codex/Antigravity copies). QA of a screen always uses `browser-qa`, not `testing-qa` alone. Copy finishes public words with `deslop`. Planner uses `planning` and names owners; it does not run the other agents. Each agent file points at `catalog.json` for the full skill list.