@appsforgood/next-supabase-kit 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.4.5
+
+- Uplift `ship` to the playbook bar: go / no-go, named env, migration order, rollback, commands run (`testing-qa`). Reject “LGTM, ship it.” User-visible still needs `browser-qa` screenshot paths. `/ship` agrees with the skill.
+
 ## 0.4.4
 
 - Uplift `frontend-design` and the Design agent from a 2026-09-12 GitHub scan (structure only): name `build` / `review` / `detect`, pick a surface profile, read `DESIGN.md` tokens, tag findings as code-certain or inferred. Do not install a design MCP or canvas CLI. Kit charcoal tokens stay off downstream apps.

package/USER_GUIDE.html

@@ -622,7 +622,7 @@ Act as design. This is a new repo. Scan what is already here, then ask me what w
             </tr>
             <tr>
               <td><code>ship</code></td>
-              <td>Release, env, rollback</td>
+              <td>Go / no-go. Env, rollback, commands. UI needs screenshot paths</td>
             </tr>
           </tbody>
         </table>
@@ -734,6 +734,17 @@ Act as design. This is a new repo. Scan what is already here, then ask me what w
         </div>
         <h3>Copy pass</h3>
         <p>Copy reviews the <em>rendered</em> words in screenshots, not strings in TSX. Run <code>product-copy</code>, then <code>deslop</code> last.</p>
+        <h3>Release / ship</h3>
+        <p>Before you promote or deploy, paste to QA:</p>
+        <pre id="ship-prompt">
+Run ship. Go or no-go. Name env, migration order, rollback, commands run. User-visible needs browser-qa screenshot paths. Reject LGTM, ship it.</pre>
+        <div class="copy-row">
+          <button class="copy" type="button" data-copy-from="ship-prompt">Copy ship prompt</button>
+        </div>
+        <p>
+          QA names the verdict. App engineer names env and the app rollback. Security names secrets and RLS. Missing screenshot paths on a user-visible release
+          is a no-go.
+        </p>
       </section>
 
       <section id="qa">

package/USER_GUIDE.md

@@ -100,7 +100,7 @@ Do not ask one chat to be all six. Planner names the next specialist. It does no
 | `testing-qa` | Unit / regression / smoke. List commands run. Not screenshots |
 | `product-copy` | Headlines and CTAs |
 | `deslop` | Last copy pass. Copy always runs this |
-| `ship` | Release, env, rollback |
+| `ship` | Go / no-go. Env, rollback, commands. UI needs screenshot paths |
 
 QA of a screen always uses `browser-qa`, not `testing-qa` alone. User-facing screens also run `accessibility-wcag` (keyboard in the browser, not a contrast guess from the screenshot). Each agent file names the skills it must run, then points at `catalog.json` for the rest.
 
@@ -146,6 +146,16 @@ Run accessibility-wcag. Open the changed flow. Keyboard-only pass. Do not accept
 
 Copy reviews **rendered** screenshots, not just strings in TSX. Run `product-copy`, then **`deslop` last**. Do not hand off after the first draft.
 
+### Release / ship
+
+Before you promote or deploy, paste to QA:
+
+```text
+Run ship. Go or no-go. Name env, migration order, rollback, commands run. User-visible needs browser-qa screenshot paths. Reject LGTM, ship it.
+```
+
+QA names the verdict. App engineer names env and the app rollback. Security names secrets and RLS. Missing screenshot paths on a user-visible release is a no-go.
+
 ## QA screenshot loop
 
 Bad request (reject this):

package/agents/app-engineer/agent.md

@@ -29,7 +29,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/agents/optional/deploy/agent.md

@@ -7,7 +7,7 @@ requiredTools: [repo]
 
 # Deploy (optional)
 
-Confirm release order, env vars, and rollback. Use the `ship` skill.
+Confirm release order, env vars, and rollback. Use the `ship` skill. Go or no-go. Reject “LGTM, ship it.” User-visible still needs `browser-qa` paths.
 
 ## Skills
 

package/agents/qa/agent.md

@@ -21,7 +21,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -33,7 +33,8 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - Skipping mobile, or skipping auth/empty/error when those states exist.
 - “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
 - “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.

package/agents/security/agent.md

@@ -27,4 +27,4 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.

package/dist/index.js

@@ -328,7 +328,7 @@ function generateAntigravityCommands(cwd, force, collector) {
     {
       name: "ship",
       description: "Release go / no-go.",
-      prompt: "Use the ship skill. Confirm env, migrations, rollback, and browser-qa evidence for user-visible changes."
+      prompt: "Use the ship skill. Go or no-go. Name env, migration order, rollback, and commands run (testing-qa). User-visible changes need browser-qa screenshot paths. Reject LGTM, ship it."
     }
   ];
   writeGenerated(
@@ -429,7 +429,7 @@ import { join as join7 } from "path";
 
 // src/config/defaults.ts
 var PACKAGE_NAME = "@appsforgood/next-supabase-kit";
-var PACKAGE_VERSION = "0.4.4";
+var PACKAGE_VERSION = "0.4.5";
 var ROOT_DOCS = ["AGENTS.md", "USER_GUIDE.md", "USER_GUIDE.html"];
 var CURSOR_RULE_FILE = {
   source: "assistant-adapters/cursor-agent-kit.mdc",