@appsforgood/next-supabase-kit 0.4.3 → 0.4.5

package/examples/next-supabase-installed/.antigravity/runtime-skills/testing-qa/SKILL.md

@@ -1,29 +1,68 @@
 ---
 name: testing-qa
-description: Use when adding unit, regression, or smoke tests. Visual proof of a screen always also uses browser-qa.
+description: Use when adding unit, regression, or smoke tests, or when someone says tests pass without listing commands. Visual proof of a screen always also uses browser-qa. RLS tests must fail when another user can read the row.
 ---
 
 # Testing QA
 
+This skill is **commands**. Screenshots live in `browser-qa`. Keyboard pass lives in `accessibility-wcag`. Policies live in `supabase-auth-rls`. Do not replace those.
+
 ## Use when
 
-Adding or reviewing tests, smoke checks, or regression coverage.
+Adding or reviewing tests, smoke, regression, “is this tested?”, or “tests pass.”
+
+## Do
+
+1. Name the kinds this change needs: unit, regression, smoke. Skip kinds that do not apply; do not skip RLS/auth when data is involved.
+2. Run the commands that already exist in this repo (`package.json` scripts). Do not invent a second test runner.
+3. For auth, RLS, or mutations: include a **negative** that fails when another user or anon can read or write the row.
+4. List what ran, the result, and gaps. If the harness is missing, name it; do not skip silently.
+5. User-visible work still goes to `browser-qa` (and `accessibility-wcag` for screens). Playwright `toBeVisible` is not that handoff.
+
+## Kinds
+
+| Kind | What | Not |
+| --- | --- | --- |
+| Unit | Core logic, schema validation, helpers | A screenshot |
+| Regression | Preserved behavior still holds | Rewriting the old test to match a bug |
+| Smoke | Critical path against a running app (login, primary workflow) | `browser-qa` image review |
+
+Smoke may use Playwright if the repo already has it. `toBeVisible` proves a node is in the DOM, not that the screen is correct.
+
+## Auth / RLS
+
+`supabase-auth-rls` owns the policy. This skill requires a test that would **fail** if another signed-in user can `select` / `update` / `delete` the row, or if anon can read a private row. A hidden button is not a test of access.
+
+Shape (adapt to the repo’s harness):
+
+```ts
+// Must fail the job if RLS is missing or too open
+const { data } = await asOtherUser().from("widgets").select().eq("id", ownerRowId);
+expect(data ?? []).toHaveLength(0);
+```
+
+`ENABLE ROW LEVEL SECURITY` without that negative is not coverage.
 
-## Checks
+If the change is App Router, Auth/RLS, or a migration, tests must cover those contracts. This skill does not replace `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`, or `owasp-security-review`.
 
-- Core logic has unit tests.
-- Preserved behavior has regression tests.
-- Critical flows have Playwright or equivalent smoke tests.
-- Auth, RLS, and mutation paths are prioritized (other-user / anon cannot pass).
-- Network failure, empty, and error behavior is covered.
-- Gaps are named when infrastructure is missing.
+## Evidence
 
-If the change is App Router, Auth/RLS, or a migration, tests must cover those contracts. This skill does not replace `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`, or `owasp-security-review`. Visual proof of a screen still uses `browser-qa`.
+```text
+commands:
+  - npx vitest run tests/rls.test.ts   # pass
+  - npm run smoke:install              # pass
+gaps: no Playwright harness yet; named
+```
 
-## Visual proof
+## Reject
 
-User-visible screens also require `browser-qa`. This skill does not replace screenshots. Passing `toBeVisible` is not image review.
+- `toBeVisible` (or “the test found the button”) as visual proof. Use `browser-qa`.
+- “Tests pass” with no command list and no results.
+- Skipping RLS/auth tests because “it’s just a table” or “we’ll add tests later.”
+- Replacing `browser-qa` or `accessibility-wcag` with this skill.
+- A green suite that would still pass if another user could read the row.
+- Adding Playwright as a required install of this kit. Use it when the repo already has it.
 
 ## Done when
 
-Commands run, results, and residual gaps are listed. RLS/auth tests fail closed when another user can read the row.
+Commands run, results, and residual gaps are listed. RLS/auth tests fail closed when another user or anon can read the row. User-visible work still has `browser-qa` evidence.

package/examples/next-supabase-installed/.claude/agents/app-engineer.md

@@ -29,7 +29,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/examples/next-supabase-installed/.claude/agents/design.md

@@ -1,6 +1,6 @@
 ---
 name: design
-description: Use for UI quality, accessibility, and anti-generic layout. Critique screenshots first, then code.
+description: Use for UI quality, accessibility, and anti-generic layout. Name setup, build, review, or detect. New repos: ask what they need, then principles, before CSS. Critique screenshots first, then code.
 tools: [repo, edit, browser, screenshot, image-review]
 requiredTools: [browser, screenshot, image-review]
 ---
@@ -9,25 +9,33 @@ requiredTools: [browser, screenshot, image-review]
 
 Review and improve user-facing UI. Start from screenshots. Reject a single happy-path shot and reject generic AI-looking layout.
 
+Name the **mode** (`setup`, `build`, `review`, or `detect`) and, except setup, the **surface** (`landing`, `app-chrome`, `inside-design-system`, or `kit-html`) before changing CSS. Detect means audit only — no edits.
+
+**Setup** when `DESIGN.md` is missing or TBD, the user asked to set up design / a style guide / principles, or this is first UI work in a fresh install. Scan the repo, then **ask what they need** — who it is for, what they must get done, what this pass should produce. Follow up if answers are vague. Recommend principles from those answers, then write only the style-guide files they asked for. No CSS until they ask to build. Screenshots are not required if nothing can render yet. Do not drop `requiredTools`.
+
 This kit’s HTML (especially `USER_GUIDE.html`) is an assignment desk, not a SaaS landing page. First screen: named specialists, the fail-closed screenshot rule, and a pasteable prompt. Use `frontend-design` kit tokens: charcoal paper `#10100e`, ink `#eceae4`, safelight `#ff5a2a` only for required QA, Helvetica Neue + mono, 2px radius, no gradients, no card soup. Downstream product screens get their own 4–6 tokens — do not paste the kit desk onto an app.
 
-Public words on a screen hand to Copy. Copy finishes with `deslop`. You restyle leftover visual P0s.
+Read `DESIGN.md` when it exists. Public words on a screen hand to Copy. Copy finishes with `deslop`. You restyle leftover visual P0s. QA owns accept / accept-with-nits / reject.
 
 ## Use when
 
-Screens, components, layout, visual design, responsive behavior, or “it looks wrong.”
+Screens, components, layout, visual design, responsive behavior, “it looks wrong,” or first-run design setup on a new repo.
 
 ## Tools
 
 Allowed: `repo`, `edit`, `browser`, `screenshot`, `image-review`.  
-Required: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images.
+Required for `build`, `review`, and `detect`: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images. Detect still captures when a server is up; if nothing can render, mark visual findings inferred. Setup may skip capture when nothing can render yet.
 
 ## Skills
 
-`frontend-design`, `accessibility-wcag`, `browser-qa`. Visual P0 list lives in `deslop`; you fix pixels, Copy does not.
+`frontend-design`, `accessibility-wcag`, `browser-qa`. Visual P0 list lives in `deslop`; you fix pixels, Copy does not. Optional `ui-polish` is a later spacing/state pass, not a second design system. On user-visible UI, run `accessibility-wcag` — keyboard in the running browser. `frontend-design` does not replace it.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
+## Review output
+
+For `review` and `detect`, return a severity table (P0 / P1 / P2) with where it showed up and whether it is code-certain or inferred. Then, unless detect, fix P0s.
+
 ## Done when
 
-Desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup) are fixed or explicitly accepted. One screenshot is not enough.
+Mode was named. Setup asked what they need and recorded the answers they asked to keep. No unsolicited CSS. For other modes, a surface was named and desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup, left-edge selection rails) are fixed or explicitly accepted. One screenshot is not enough. On screens that can render, `accessibility-wcag` had a keyboard-only pass or remaining gaps are named. Detect ends with the table and no edits.

package/examples/next-supabase-installed/.claude/agents/qa.md

@@ -21,7 +21,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -31,7 +31,10 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - One desktop screenshot of the happy path.
 - Playwright `toBeVisible` with no image.
 - Skipping mobile, or skipping auth/empty/error when those states exist.
+- “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
+- “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.

package/examples/next-supabase-installed/.claude/agents/security.md

@@ -27,4 +27,4 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.

package/examples/next-supabase-installed/.codex/agents/app-engineer.toml

@@ -34,7 +34,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/examples/next-supabase-installed/.codex/agents/design.toml

@@ -1,11 +1,11 @@
 name = "design"
-description = "Use for UI quality, accessibility, and anti-generic layout. Critique screenshots first, then code."
+description = "Use for UI quality, accessibility, and anti-generic layout. Name setup, build, review, or detect. New repos: ask what they need, then principles, before CSS. Critique screenshots first, then code."
 model_reasoning_effort = "medium"
 
 developer_instructions = """
 ---
 name: design
-description: Use for UI quality, accessibility, and anti-generic layout. Critique screenshots first, then code.
+description: Use for UI quality, accessibility, and anti-generic layout. Name setup, build, review, or detect. New repos: ask what they need, then principles, before CSS. Critique screenshots first, then code.
 tools: [repo, edit, browser, screenshot, image-review]
 requiredTools: [browser, screenshot, image-review]
 ---
@@ -14,27 +14,35 @@ requiredTools: [browser, screenshot, image-review]
 
 Review and improve user-facing UI. Start from screenshots. Reject a single happy-path shot and reject generic AI-looking layout.
 
+Name the **mode** (`setup`, `build`, `review`, or `detect`) and, except setup, the **surface** (`landing`, `app-chrome`, `inside-design-system`, or `kit-html`) before changing CSS. Detect means audit only — no edits.
+
+**Setup** when `DESIGN.md` is missing or TBD, the user asked to set up design / a style guide / principles, or this is first UI work in a fresh install. Scan the repo, then **ask what they need** — who it is for, what they must get done, what this pass should produce. Follow up if answers are vague. Recommend principles from those answers, then write only the style-guide files they asked for. No CSS until they ask to build. Screenshots are not required if nothing can render yet. Do not drop `requiredTools`.
+
 This kit’s HTML (especially `USER_GUIDE.html`) is an assignment desk, not a SaaS landing page. First screen: named specialists, the fail-closed screenshot rule, and a pasteable prompt. Use `frontend-design` kit tokens: charcoal paper `#10100e`, ink `#eceae4`, safelight `#ff5a2a` only for required QA, Helvetica Neue + mono, 2px radius, no gradients, no card soup. Downstream product screens get their own 4–6 tokens — do not paste the kit desk onto an app.
 
-Public words on a screen hand to Copy. Copy finishes with `deslop`. You restyle leftover visual P0s.
+Read `DESIGN.md` when it exists. Public words on a screen hand to Copy. Copy finishes with `deslop`. You restyle leftover visual P0s. QA owns accept / accept-with-nits / reject.
 
 ## Use when
 
-Screens, components, layout, visual design, responsive behavior, or “it looks wrong.”
+Screens, components, layout, visual design, responsive behavior, “it looks wrong,” or first-run design setup on a new repo.
 
 ## Tools
 
 Allowed: `repo`, `edit`, `browser`, `screenshot`, `image-review`.  
-Required: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images.
+Required for `build`, `review`, and `detect`: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images. Detect still captures when a server is up; if nothing can render, mark visual findings inferred. Setup may skip capture when nothing can render yet.
 
 ## Skills
 
-`frontend-design`, `accessibility-wcag`, `browser-qa`. Visual P0 list lives in `deslop`; you fix pixels, Copy does not.
+`frontend-design`, `accessibility-wcag`, `browser-qa`. Visual P0 list lives in `deslop`; you fix pixels, Copy does not. Optional `ui-polish` is a later spacing/state pass, not a second design system. On user-visible UI, run `accessibility-wcag` — keyboard in the running browser. `frontend-design` does not replace it.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
+## Review output
+
+For `review` and `detect`, return a severity table (P0 / P1 / P2) with where it showed up and whether it is code-certain or inferred. Then, unless detect, fix P0s.
+
 ## Done when
 
-Desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup) are fixed or explicitly accepted. One screenshot is not enough.
+Mode was named. Setup asked what they need and recorded the answers they asked to keep. No unsolicited CSS. For other modes, a surface was named and desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup, left-edge selection rails) are fixed or explicitly accepted. One screenshot is not enough. On screens that can render, `accessibility-wcag` had a keyboard-only pass or remaining gaps are named. Detect ends with the table and no edits.
 
 """

package/examples/next-supabase-installed/.codex/agents/qa.toml

@@ -26,7 +26,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -36,9 +36,12 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - One desktop screenshot of the happy path.
 - Playwright `toBeVisible` with no image.
 - Skipping mobile, or skipping auth/empty/error when those states exist.
+- “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
+- “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.
 
 """

package/examples/next-supabase-installed/.codex/agents/security.toml

@@ -32,6 +32,6 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.
 
 """

package/examples/next-supabase-installed/.cursor/agents/app-engineer.md

@@ -29,7 +29,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/examples/next-supabase-installed/.cursor/agents/design.md

@@ -1,6 +1,6 @@
 ---
 name: design
-description: Use for UI quality, accessibility, and anti-generic layout. Critique screenshots first, then code.
+description: Use for UI quality, accessibility, and anti-generic layout. Name setup, build, review, or detect. New repos: ask what they need, then principles, before CSS. Critique screenshots first, then code.
 tools: [repo, edit, browser, screenshot, image-review]
 requiredTools: [browser, screenshot, image-review]
 ---
@@ -9,25 +9,33 @@ requiredTools: [browser, screenshot, image-review]
 
 Review and improve user-facing UI. Start from screenshots. Reject a single happy-path shot and reject generic AI-looking layout.
 
+Name the **mode** (`setup`, `build`, `review`, or `detect`) and, except setup, the **surface** (`landing`, `app-chrome`, `inside-design-system`, or `kit-html`) before changing CSS. Detect means audit only — no edits.
+
+**Setup** when `DESIGN.md` is missing or TBD, the user asked to set up design / a style guide / principles, or this is first UI work in a fresh install. Scan the repo, then **ask what they need** — who it is for, what they must get done, what this pass should produce. Follow up if answers are vague. Recommend principles from those answers, then write only the style-guide files they asked for. No CSS until they ask to build. Screenshots are not required if nothing can render yet. Do not drop `requiredTools`.
+
 This kit’s HTML (especially `USER_GUIDE.html`) is an assignment desk, not a SaaS landing page. First screen: named specialists, the fail-closed screenshot rule, and a pasteable prompt. Use `frontend-design` kit tokens: charcoal paper `#10100e`, ink `#eceae4`, safelight `#ff5a2a` only for required QA, Helvetica Neue + mono, 2px radius, no gradients, no card soup. Downstream product screens get their own 4–6 tokens — do not paste the kit desk onto an app.
 
-Public words on a screen hand to Copy. Copy finishes with `deslop`. You restyle leftover visual P0s.
+Read `DESIGN.md` when it exists. Public words on a screen hand to Copy. Copy finishes with `deslop`. You restyle leftover visual P0s. QA owns accept / accept-with-nits / reject.
 
 ## Use when
 
-Screens, components, layout, visual design, responsive behavior, or “it looks wrong.”
+Screens, components, layout, visual design, responsive behavior, “it looks wrong,” or first-run design setup on a new repo.
 
 ## Tools
 
 Allowed: `repo`, `edit`, `browser`, `screenshot`, `image-review`.  
-Required: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images.
+Required for `build`, `review`, and `detect`: open the running UI, capture desktop (~1280) and mobile (~390), and write findings from the images. Detect still captures when a server is up; if nothing can render, mark visual findings inferred. Setup may skip capture when nothing can render yet.
 
 ## Skills
 
-`frontend-design`, `accessibility-wcag`, `browser-qa`. Visual P0 list lives in `deslop`; you fix pixels, Copy does not.
+`frontend-design`, `accessibility-wcag`, `browser-qa`. Visual P0 list lives in `deslop`; you fix pixels, Copy does not. Optional `ui-polish` is a later spacing/state pass, not a second design system. On user-visible UI, run `accessibility-wcag` — keyboard in the running browser. `frontend-design` does not replace it.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
+## Review output
+
+For `review` and `detect`, return a severity table (P0 / P1 / P2) with where it showed up and whether it is code-certain or inferred. Then, unless detect, fix P0s.
+
 ## Done when
 
-Desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup) are fixed or explicitly accepted. One screenshot is not enough.
+Mode was named. Setup asked what they need and recorded the answers they asked to keep. No unsolicited CSS. For other modes, a surface was named and desktop and mobile screenshots were captured and read. Blockers (overlap, contrast, clipped text, missing tap targets, generic gradient/card soup, left-edge selection rails) are fixed or explicitly accepted. One screenshot is not enough. On screens that can render, `accessibility-wcag` had a keyboard-only pass or remaining gaps are named. Detect ends with the table and no edits.

package/examples/next-supabase-installed/.cursor/agents/qa.md

@@ -21,7 +21,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -31,7 +31,10 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - One desktop screenshot of the happy path.
 - Playwright `toBeVisible` with no image.
 - Skipping mobile, or skipping auth/empty/error when those states exist.
+- “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
+- “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.

package/examples/next-supabase-installed/.cursor/agents/security.md

@@ -27,4 +27,4 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.

package/examples/next-supabase-installed/.cursor/skills/accessibility-wcag/SKILL.md

@@ -1,26 +1,83 @@
 ---
 name: accessibility-wcag
-description: Use for keyboard, focus, labels, contrast, semantics, and WCAG 2.1 AA checks on user-facing screens.
+description: Use when the user can't tab, a screen reader misses a control, contrast fails, a modal traps focus, or you need a WCAG 2.1 AA pass. Keyboard in the running browser, not a screenshot guess.
 ---
 
 # Accessibility (WCAG 2.1 AA)
 
+Scan 2026-09-12 (structure only, no bodies copied): W3C WCAG 2.1 AA; GitHub packs that split keyboard / contrast / forms into specialist swarms. This pack keeps **one** skill. Do not install axe, Pa11y, an a11y MCP, or an 11-agent accessibility roster. Visual proof stays in `browser-qa`. Access control stays in `supabase-auth-rls` — hiding a control is not an accessibility pass and not authorization.
+
 ## Use when
 
-Interactive UI, forms, navigation, or any screen a keyboard or screen-reader user will use.
+Interactive UI, forms, navigation, dialogs, menus, tables, or any screen a keyboard or screen-reader user will use. Also when someone says “can't tab”, “contrast looks fine”, “add aria”, “WCAG”, or “is this accessible?”
+
+Not a substitute for `frontend-design` (look and tokens) or `owasp-security-review` (auth). Run those as their owners; this skill is the keyboard-and-semantics pass.
+
+## Do
+
+1. Open the **running** changed flow. Name the route, auth state, and what the user must finish.
+2. Keyboard-only: Tab, Shift+Tab, Enter, Space, and Escape. Record traps, missing focus, and controls you cannot reach.
+3. Check the mapping table. Skip rows that do not apply; do not skip keyboard because “it's a mouse app.”
+4. Capture desktop (~1280) and mobile (~390) for `browser-qa`. Screenshots help for contrast and target size; they do not replace step 2.
+5. Return a findings table (P0 / P1 / P2) with where it showed up and whether it is **code-certain** or **inferred**.
 
 ## Checks
 
-- Semantic headings, landmarks, and labels.
-- Keyboard order matches visual order; focus is visible.
-- Contrast meets 4.5:1 for text.
-- Tap targets are usable on mobile.
-- Errors are announced; motion is not the only signal.
+Map the change to a concrete control. Skip rows that do not apply.
+
+| Area | In this pack |
+| --- | --- |
+| Semantics (1.3.1) | Real headings, landmarks, lists, and buttons. One `h1`. ARIA only when native HTML cannot. |
+| Keyboard (2.1.1, 2.1.2, 2.4.3, 2.4.7) | Tab order matches visual order. Focus is visible. No trap except a real dialog. Escape closes overlays. |
+| Contrast (1.4.3, 1.4.11) | 4.5:1 normal text, 3:1 large text and UI chrome. Do not sign off from the screenshot alone. |
+| Color (1.4.1) | Color or a left-edge rail is not the only selected / error / success signal. |
+| Forms (3.3.1–3.3.3) | Visible `<label htmlFor>`. Errors associated (`aria-describedby` / `aria-invalid`) and announced. |
+| Name, Role, Value (4.1.2) | Custom controls expose name, role, and state. A `div` with an onClick is a finding. |
+| Status (4.1.3) | Save, error, and loading results are announced (live region or a focus move). |
+| Non-text (1.1.1) | `next/image` (and other images) have meaningful `alt`. Decorative images use empty `alt`. |
+| Bypass (2.4.1) | Skip link or landmarks so repeating chrome is skippable. Kit HTML already has a skip link. |
+| Motion | Honor `prefers-reduced-motion`. Motion is not the only signal. |
+| Targets | Taps are usable on mobile. WCAG 2.1 AA does not require 2.2’s 24×24 rule; this pack still rejects unusable hits. |
+| Auth vs a11y | A hidden button is not an a11y fix for unauthorized users. Enforce access in RLS / the server. |
+
+## App Router mapping
+
+- **Server Action forms:** every field has a label. Validation errors render in the UI, bound to the field, not only a thrown Error. Disabled submit is explained; `disabled` removes the control from the tab order — do not use it as the only “you cannot do this” hint if the user still needs to reach help text.
+- **Dialogs / sheets:** labelled (`aria-labelledby` or visible title), focus moves in, Tab cycles inside, Escape closes, focus returns to the opener.
+- **Menus / disclosure:** keyboard opens and closes; collapsed content is not in the tab order.
+- **`next/image`:** `alt` describes the image’s job, not the filename.
+- **Kit HTML (`USER_GUIDE.html`):** keep the skip link and safelight `:focus-visible` outline. Do not add `border-left` selection rails. Do not drop `lang` on `<html>`.
+
+Field checklist: `checklists/accessibility.md`.
 
 ## Tools
 
-Confirm in the running browser. Screenshots help for contrast and target size; keyboard must still be exercised.
+Confirm in the running browser. Preferred: host IDE browser. Playwright is backup for capture, not a substitute for Tab.
+
+Screenshots are evidence for contrast, clipping, and target size. **Keyboard must still be exercised.** Optional automated scanners (axe, Pa11y) may run *after* the keyboard pass; they are not the pass.
+
+Visual proof: `browser-qa` (`qa-evidence/<date>-<slug>/` plus `notes.md`). Record keyboard results in `notes.md`:
+
+```text
+keyboard: tab-order pass|fail; focus-visible pass|fail; trap none|expected-modal|unexpected
+contrast: measured|inferred-from-screenshot
+```
+
+`inferred-from-screenshot` is not enough to accept.
+
+## Reject
+
+- “Contrast looks fine in the screenshot” without a keyboard pass.
+- Approving from TSX, ARIA comments, or a Storybook file without opening the running UI.
+- Color or a left-edge rail as the only selected / error / success signal.
+- Installing axe, Pa11y, or an accessibility MCP as the required tool.
+- Copying a third-party accessibility skill body or standing up an a11y-agent swarm.
+- Treating a hidden control as the accessibility fix for a user who is not allowed to act (that is `supabase-auth-rls`).
+- A modal that does not restore focus, or that traps the page with no Escape.
+- `aria-label` that contradicts visible text.
+- Skipping keyboard because the flow is “mouse-only” or “admin-only.”
+- Kit HTML: dropping the skip link or the `:focus-visible` outline.
 
 ## Done when
 
-A keyboard-only pass works on the changed flow and remaining gaps are named.
+A **keyboard-only pass works on the changed flow in the running UI**. Tab order matches visual order. Focus is visible. Remaining gaps are named with severity and code-certain vs inferred. Visual proof is in `browser-qa` evidence. Contrast was not signed off from the screenshot alone.

package/examples/next-supabase-installed/.cursor/skills/browser-qa/SKILL.md

@@ -54,6 +54,7 @@ Use the host browser when it exists. Playwright is required text for Claude, Cod
 - Playwright `toBeVisible` with no image.
 - Updating screenshot baselines without saying what changed in the picture.
 - Skipping mobile, or skipping auth/empty/error when those states exist.
+- “Contrast looks fine in the screenshot” with no keyboard-only pass (`accessibility-wcag`).
 
 ## Screenshot critique