@appsforgood/next-supabase-kit 0.4.4 → 0.4.5

package/examples/next-supabase-installed/.agent-kit/manifest.json

@@ -18,22 +18,22 @@
   ],
   "templateHashes": {
     "AGENTS.md": "10a63cd533136555b5cd3b0a189fcd4091339918e62236f20b6dcd7628885369",
-    "USER_GUIDE.md": "3948a5ef1d9b4b1e58853aa0bb0d6fa85168964bac97a7b673c40956ba10c4af",
-    "USER_GUIDE.html": "344229e19becf962fa1aabd5e9ec32474171782cfc49bd3b894d751810a2b31a"
+    "USER_GUIDE.md": "84895d123f7c83cff0d8b16c79a7346bed45aa884aac8c1e512871b5461ed041",
+    "USER_GUIDE.html": "5b818d83fabf31beaeb66e97f78a46e7f675e0a0afba8f9a98bcf57713265bac"
   },
   "assetHashes": {
     "AGENTS.md": "10a63cd533136555b5cd3b0a189fcd4091339918e62236f20b6dcd7628885369",
-    "USER_GUIDE.md": "3948a5ef1d9b4b1e58853aa0bb0d6fa85168964bac97a7b673c40956ba10c4af",
-    "USER_GUIDE.html": "344229e19becf962fa1aabd5e9ec32474171782cfc49bd3b894d751810a2b31a",
+    "USER_GUIDE.md": "84895d123f7c83cff0d8b16c79a7346bed45aa884aac8c1e512871b5461ed041",
+    "USER_GUIDE.html": "5b818d83fabf31beaeb66e97f78a46e7f675e0a0afba8f9a98bcf57713265bac",
     ".cursor/rules/cursor-agent-kit.mdc": "850026beea86067d95925eea15eb447365d6a956e0f7f475ebd7fef89043d44b",
     "CLAUDE.md": "d5095edff182babe5c13717bb16cadcd95569d9e4abd37ceb307bb1448b65557",
     ".cursor/agents/planner.md": "90676313078391848072fd3a4dc24d8479a7911aa8e7f68a38f46b73074aa6d4",
-    ".cursor/agents/app-engineer.md": "e37f6a4f03eb4f66021b5a599657468e9cb33d11abd86a83df02fe198e471b12",
-    ".cursor/agents/security.md": "d71de67a6c66198c02db47357b9a91d86601659c843835ecb481e9edc651a238",
+    ".cursor/agents/app-engineer.md": "42cf21d73f19c5a2e81336ccdf9a226bd7c16717097b2293e8e8406399ffe98c",
+    ".cursor/agents/security.md": "9953931cc36edbd783f99291544347e4e9e7470aaea0174b5ae8acf0c476e85a",
     ".cursor/agents/design.md": "0e9568eec2312c8eae94bf0ab74c4e60f99f546d72609910e86194fc0d1f9df3",
-    ".cursor/agents/qa.md": "fc978f65c920610628731eb5f709ba72de6cb6568803450ff036474beed18736",
+    ".cursor/agents/qa.md": "bbedbcdb1a0630f97305c69064ebdb14366feaf4d0470df023b6ec35389f93a9",
     ".cursor/agents/copy.md": "11e7df36d16221d71e3290dc5ba07711df7320895ad2215eeebec5afcf43bf21",
-    ".cursor/skills/planning/SKILL.md": "3d472a6477c8e075a25b83105180199294a6aca60d6a06a827c382f7dba952b7",
+    ".cursor/skills/planning/SKILL.md": "85f5363f667218d66cf06152fd8abf6664937ef4e42cbc411caca26291b3aae4",
     ".cursor/skills/nextjs-app-router/SKILL.md": "79f5ef6cccf5d675cc8ee6a95dc2e98d86b92b2b60edbc759b7017506d7c9c44",
     ".cursor/skills/supabase-auth-rls/SKILL.md": "dc449f156b74a59110f5fc49a684ecf061b757a4805b3849b10771a92972f914",
     ".cursor/skills/postgres-migrations/SKILL.md": "453245cd5b4e3d652fe7e5e84fcfb24e64f26ff5da4fd2309c1692c7e6de763e",
@@ -44,18 +44,18 @@
     ".cursor/skills/testing-qa/SKILL.md": "a9840dd5dba27cd2990e9c58aee7238ac7e4666bf57d11700f4d4d8b1f9d3427",
     ".cursor/skills/product-copy/SKILL.md": "2f1982ac949ed32690046f516dfefa1ca85bfb51318b403822696bd12bb982c4",
     ".cursor/skills/deslop/SKILL.md": "cd8ef7f6bdcff86f78ef9d4a94b944a585077629144184d854d6e29ff1569823",
-    ".cursor/skills/ship/SKILL.md": "ac426092a1868dd1deb01689dc2f5591dbe40acb2fceec559adce41602bb8d6f",
+    ".cursor/skills/ship/SKILL.md": "3df7002b2117f9ea9b859a156cfe0d87bc9dacec416a38959302c98818eb6ee4",
     ".claude/agents/planner.md": "90676313078391848072fd3a4dc24d8479a7911aa8e7f68a38f46b73074aa6d4",
-    ".claude/agents/app-engineer.md": "e37f6a4f03eb4f66021b5a599657468e9cb33d11abd86a83df02fe198e471b12",
-    ".claude/agents/security.md": "d71de67a6c66198c02db47357b9a91d86601659c843835ecb481e9edc651a238",
+    ".claude/agents/app-engineer.md": "42cf21d73f19c5a2e81336ccdf9a226bd7c16717097b2293e8e8406399ffe98c",
+    ".claude/agents/security.md": "9953931cc36edbd783f99291544347e4e9e7470aaea0174b5ae8acf0c476e85a",
     ".claude/agents/design.md": "0e9568eec2312c8eae94bf0ab74c4e60f99f546d72609910e86194fc0d1f9df3",
-    ".claude/agents/qa.md": "fc978f65c920610628731eb5f709ba72de6cb6568803450ff036474beed18736",
+    ".claude/agents/qa.md": "bbedbcdb1a0630f97305c69064ebdb14366feaf4d0470df023b6ec35389f93a9",
     ".claude/agents/copy.md": "11e7df36d16221d71e3290dc5ba07711df7320895ad2215eeebec5afcf43bf21",
     ".codex/agents/planner.toml": "f55f218778ae76942e6c7ea9a159e89dc5c13466b0effa0c43935b29d8182d11",
-    ".codex/agents/app-engineer.toml": "f76f6f9a531974becdd863bfb4a0bf1b6810e966d31b7fb6a4f41f8791a8fb59",
-    ".codex/agents/security.toml": "9e202a8125ddce38d84487a59d7c7cd7328acb8c441704f670b8331042be15f0",
+    ".codex/agents/app-engineer.toml": "f85fd4ae4ca3387082853ad328260077f0043e5f756b19b938210b65d17f45b5",
+    ".codex/agents/security.toml": "a74e129582bbffb872af33c94bb5ded9e404461740708c5155f7f335740cda87",
     ".codex/agents/design.toml": "30b24febb56e398007e1b0daaf4b499f60e5d74efc6d0a5888960d007c7829ab",
-    ".codex/agents/qa.toml": "b53d2491a339a872f1c775f636025bf35c8fb81c5a3b199cb20ada86ac786889",
+    ".codex/agents/qa.toml": "b08c28b7c74c1c71cbd19453089cbff48833c42892b8b1df75c064896730e96c",
     ".codex/agents/copy.toml": "76e0b1e54139a6d4dc5140f7214aceaa72f186e45f561c6708e1263747ac07fd",
     ".github/copilot-instructions.md": "f5d26cc16aebd5b82f5fb75b85a59e17b802ddb444e50cc25e61a37c616e738f",
     ".antigravity/agent-kit/plugin.json": "e2f156fdd68ca706dd289152722bfd07ebb0c29a16afadcfdf178a723ecb6a90",
@@ -65,8 +65,8 @@
     ".antigravity/agent-kit/commands/frontend.toml": "4e31d698779d6fd6383a349b3483413e862d98eb79f7e812789dc26091b5b421",
     ".antigravity/agent-kit/commands/copy.toml": "40ad093163915a9f000bf8344e49c37dc2d735ab404e84430323502af0bf031e",
     ".antigravity/agent-kit/commands/test.toml": "5b230c0e4343bec71e9da36c02bb1f533479f1a87700ea8ceeabbfcc72a2f5c0",
-    ".antigravity/agent-kit/commands/ship.toml": "dfa8a6bc654e7bfbf06ad1af59f122a8b116b84008b5ab9325ce21eba3eab9ef",
-    ".antigravity/runtime-skills/planning/SKILL.md": "3d472a6477c8e075a25b83105180199294a6aca60d6a06a827c382f7dba952b7",
+    ".antigravity/agent-kit/commands/ship.toml": "a6229045cbe1aaf0a4f449a21fe82158137d3f2cb6c29a336ce4110d3de1e549",
+    ".antigravity/runtime-skills/planning/SKILL.md": "85f5363f667218d66cf06152fd8abf6664937ef4e42cbc411caca26291b3aae4",
     ".antigravity/runtime-skills/nextjs-app-router/SKILL.md": "79f5ef6cccf5d675cc8ee6a95dc2e98d86b92b2b60edbc759b7017506d7c9c44",
     ".antigravity/runtime-skills/supabase-auth-rls/SKILL.md": "dc449f156b74a59110f5fc49a684ecf061b757a4805b3849b10771a92972f914",
     ".antigravity/runtime-skills/postgres-migrations/SKILL.md": "453245cd5b4e3d652fe7e5e84fcfb24e64f26ff5da4fd2309c1692c7e6de763e",
@@ -77,8 +77,8 @@
     ".antigravity/runtime-skills/testing-qa/SKILL.md": "a9840dd5dba27cd2990e9c58aee7238ac7e4666bf57d11700f4d4d8b1f9d3427",
     ".antigravity/runtime-skills/product-copy/SKILL.md": "2f1982ac949ed32690046f516dfefa1ca85bfb51318b403822696bd12bb982c4",
     ".antigravity/runtime-skills/deslop/SKILL.md": "cd8ef7f6bdcff86f78ef9d4a94b944a585077629144184d854d6e29ff1569823",
-    ".antigravity/runtime-skills/ship/SKILL.md": "ac426092a1868dd1deb01689dc2f5591dbe40acb2fceec559adce41602bb8d6f",
-    "skills/planning/SKILL.md": "3d472a6477c8e075a25b83105180199294a6aca60d6a06a827c382f7dba952b7",
+    ".antigravity/runtime-skills/ship/SKILL.md": "3df7002b2117f9ea9b859a156cfe0d87bc9dacec416a38959302c98818eb6ee4",
+    "skills/planning/SKILL.md": "85f5363f667218d66cf06152fd8abf6664937ef4e42cbc411caca26291b3aae4",
     "skills/nextjs-app-router/SKILL.md": "79f5ef6cccf5d675cc8ee6a95dc2e98d86b92b2b60edbc759b7017506d7c9c44",
     "skills/supabase-auth-rls/SKILL.md": "dc449f156b74a59110f5fc49a684ecf061b757a4805b3849b10771a92972f914",
     "skills/postgres-migrations/SKILL.md": "453245cd5b4e3d652fe7e5e84fcfb24e64f26ff5da4fd2309c1692c7e6de763e",
@@ -89,6 +89,6 @@
     "skills/testing-qa/SKILL.md": "a9840dd5dba27cd2990e9c58aee7238ac7e4666bf57d11700f4d4d8b1f9d3427",
     "skills/product-copy/SKILL.md": "2f1982ac949ed32690046f516dfefa1ca85bfb51318b403822696bd12bb982c4",
     "skills/deslop/SKILL.md": "cd8ef7f6bdcff86f78ef9d4a94b944a585077629144184d854d6e29ff1569823",
-    "skills/ship/SKILL.md": "ac426092a1868dd1deb01689dc2f5591dbe40acb2fceec559adce41602bb8d6f"
+    "skills/ship/SKILL.md": "3df7002b2117f9ea9b859a156cfe0d87bc9dacec416a38959302c98818eb6ee4"
   }
 }

package/examples/next-supabase-installed/.antigravity/agent-kit/commands/ship.toml

@@ -2,5 +2,5 @@ name = "ship"
 description = "Release go / no-go."
 
 prompt = """
-Use the ship skill. Confirm env, migrations, rollback, and browser-qa evidence for user-visible changes.
+Use the ship skill. Go or no-go. Name env, migration order, rollback, and commands run (testing-qa). User-visible changes need browser-qa screenshot paths. Reject LGTM, ship it.
 """

package/examples/next-supabase-installed/.antigravity/runtime-skills/planning/SKILL.md

@@ -17,7 +17,7 @@ Planning, roadmaps, “what should we do,” or any request that needs an owner.
    - App engineer: `nextjs-app-router` and, if data/auth, `supabase-auth-rls` / `postgres-migrations`
    - Security: `owasp-security-review` + `supabase-auth-rls`
    - Design: `frontend-design` (name setup, build, review, or detect) and, for screens, `accessibility-wcag`
-   - QA: `browser-qa` (screens), `testing-qa` (commands), and `accessibility-wcag` for user-facing screens
+   - QA: `browser-qa` (screens), `testing-qa` (commands), `accessibility-wcag` for user-facing screens, and `ship` for a release go/no-go
    - Copy: `product-copy` then `deslop` last
 4. If the work is user-visible and `DESIGN.md` is missing, TBD, or the user asked for a style guide / principles: owner is Design in `setup` first. Design must ask what they need before inventing tokens. Do not let App engineer invent tokens.
 5. Add extra reviewers: Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
@@ -29,4 +29,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS.
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS. Skipping `ship` because “LGTM, ship it.”

package/examples/next-supabase-installed/.antigravity/runtime-skills/ship/SKILL.md

@@ -1,22 +1,67 @@
 ---
 name: ship
-description: Use before release. Check env vars, migration order, smoke, and rollback. User-visible releases still need browser-qa evidence.
+description: Use before deploy, promote, rollback, or when someone says LGTM, ship it. Go or no-go. Name env, migration order, rollback, commands run. User-visible still needs browser-qa screenshot paths.
 ---
 
 # Ship
 
+This skill is **go / no-go**. Commands live in `testing-qa`. Screenshots live in `browser-qa`. Keyboard pass lives in `accessibility-wcag`. Policies live in `supabase-auth-rls`. Schema order lives in `postgres-migrations`. Secrets and OWASP live in `owasp-security-review`. This skill does not replace those.
+
 ## Use when
 
-Preparing to deploy, promote, or roll back.
+Preparing to deploy, promote, roll back, or cut a production release. Also when someone says “ship it”, “LGTM”, “is this ready?”, “promote preview”, or “rollback”.
+
+Not a substitute for writing the feature. Run this **after** the owning specialists finish. QA names the verdict; App engineer names env and the app rollback; Security names secrets and RLS.
+
+## Do
+
+1. Name the target (`preview` / `production` / named env) and what commit or deployment is going out.
+2. List production-critical **env var names** (not values). Confirm they exist on that target. Flag any `NEXT_PUBLIC_` secret or service role on the client.
+3. Name migration order. If schema changed, say whether the migration already ran and how to reverse it (`postgres-migrations`). Do not drop a column the live app still reads.
+4. Run `testing-qa`: list commands actually run. Smoke of the primary path is required for a go.
+5. If anything user-visible changed: attach `browser-qa` desktop + mobile paths. For screens, `accessibility-wcag` already ran. Missing paths are a no-go.
+6. Return **go** or **no-go** with gaps. Do not imply go by omitting the word.
 
 ## Checks
 
-- Production-critical env vars are named.
-- Migration order and rollback are explicit.
-- Smoke of the primary path passed.
-- User-visible changes have desktop and mobile screenshot evidence from `browser-qa`.
-- Secrets are not in the repo or client bundle.
+| Area | Pass |
+| --- | --- |
+| Target | Preview vs production (or named env) is explicit. |
+| Env | Critical names listed. Values are not pasted into the verdict. |
+| Secrets | No secrets in git, `NEXT_PUBLIC_*`, client bundle, or logs. Service role stays server-only. |
+| Migrations | Order named. Rollback named, or expand/contract reverse named. Empty “N/A” only if schema did not change. |
+| Commands | `testing-qa` list with results. Smoke of the primary path (login or the workflow being released). |
+| UI | User-visible changes have `qa-evidence/<date>-<slug>/desktop.png` and `mobile.png`. |
+| Host | If this app is on Vercel (or similar), name preview vs production and how to restore the previous deployment. Do not require a Vercel CLI install from this kit. |
+
+## Evidence
+
+```text
+verdict: go | no-go
+target: preview | production
+commands:
+  - npx vitest run                 # pass
+  - npm run smoke                  # pass
+env: NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY set; SERVICE_ROLE not in client
+migrations: 0012_widgets applied; rollback = reverse 0012 / expand-contract reverse
+rollback:
+  app: previous production deployment / git revert <sha>
+  db: do not drop 0012 in this release if the app still reads it
+browser-qa: qa-evidence/2026-09-13-settings/desktop.png, mobile.png
+gaps: none | named
+```
+
+## Reject
+
+- “LGTM, ship it” (or “looks good, deploy”) with no env list, no rollback, and no commands.
+- User-visible release without `browser-qa` screenshot **paths**.
+- “We’ll set env in the dashboard later” or shipping with placeholder secrets.
+- `SUPABASE_SERVICE_ROLE_KEY` (or any secret) in `NEXT_PUBLIC_*`, the repo, or a client bundle.
+- Skipping rollback because “it’s a small change” or “we can just migrate forward.”
+- Treating `toBeVisible` or “tests pass” as the ship gate. Use `testing-qa` and, for UI, `browser-qa`.
+- Replacing `testing-qa`, `browser-qa`, `postgres-migrations`, `supabase-auth-rls`, or `owasp-security-review` with this skill.
+- Pasting secret **values** into the go/no-go note.
 
 ## Done when
 
-Go / no-go is explicit, with commands run and rollback named.
+Go or no-go is explicit. Commands run, env names, migration order, and rollback are named. User-visible work has `browser-qa` screenshot paths. Secrets were not written into the verdict.

package/examples/next-supabase-installed/.claude/agents/app-engineer.md

@@ -29,7 +29,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/examples/next-supabase-installed/.claude/agents/qa.md

@@ -21,7 +21,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -33,7 +33,8 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - Skipping mobile, or skipping auth/empty/error when those states exist.
 - “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
 - “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.

package/examples/next-supabase-installed/.claude/agents/security.md

@@ -27,4 +27,4 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.

package/examples/next-supabase-installed/.codex/agents/app-engineer.toml

@@ -34,7 +34,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/examples/next-supabase-installed/.codex/agents/qa.toml

@@ -26,7 +26,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -38,9 +38,10 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - Skipping mobile, or skipping auth/empty/error when those states exist.
 - “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
 - “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.
 
 """

package/examples/next-supabase-installed/.codex/agents/security.toml

@@ -32,6 +32,6 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.
 
 """

package/examples/next-supabase-installed/.cursor/agents/app-engineer.md

@@ -29,7 +29,7 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Handoff
 
-Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`.
+Security reviews auth/data/secret changes. Design reviews user-facing screens. QA always reviews behavior or UI changes with `browser-qa`. A release go/no-go is `ship`: you name env and the app rollback; you do not say “LGTM, ship it.”
 
 ## Done when
 

package/examples/next-supabase-installed/.cursor/agents/qa.md

@@ -21,7 +21,7 @@ Hard fail if the only evidence is a file diff.
 
 ## Skills
 
-`browser-qa`, `testing-qa`, `accessibility-wcag`.
+`browser-qa`, `testing-qa`, `accessibility-wcag`. For a release, also `ship`.
 
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
@@ -33,7 +33,8 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 - Skipping mobile, or skipping auth/empty/error when those states exist.
 - “Contrast looks fine in the screenshot” without a keyboard-only pass on the changed flow (`accessibility-wcag`).
 - “Tests pass” with no command list (`testing-qa`).
+- “LGTM, ship it” without env names, rollback, commands, and `browser-qa` paths for UI (`ship`).
 
 ## Done when
 
-You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess.
+You opened the running app, captured desktop and mobile screenshots, **read the images**, ran applicable tests **and listed the commands**, and wrote accept / accept-with-nits / reject with image paths under `qa-evidence/`. For screens, `accessibility-wcag` ran: a keyboard-only pass on the changed flow, not a screenshot guess. A release also has a `ship` go or no-go.

package/examples/next-supabase-installed/.cursor/agents/security.md

@@ -27,4 +27,4 @@ Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start w
 
 ## Done when
 
-Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only.
+Access control is enforced in Postgres or the server, not only in the UI. Login, redirect, and denied states were checked in the browser when they exist. Secrets stay server-only. For a release, contribute env and RLS checks to `ship`; do not treat “LGTM, ship it” as a go.

package/examples/next-supabase-installed/.cursor/skills/planning/SKILL.md

@@ -17,7 +17,7 @@ Planning, roadmaps, “what should we do,” or any request that needs an owner.
    - App engineer: `nextjs-app-router` and, if data/auth, `supabase-auth-rls` / `postgres-migrations`
    - Security: `owasp-security-review` + `supabase-auth-rls`
    - Design: `frontend-design` (name setup, build, review, or detect) and, for screens, `accessibility-wcag`
-   - QA: `browser-qa` (screens), `testing-qa` (commands), and `accessibility-wcag` for user-facing screens
+   - QA: `browser-qa` (screens), `testing-qa` (commands), `accessibility-wcag` for user-facing screens, and `ship` for a release go/no-go
    - Copy: `product-copy` then `deslop` last
 4. If the work is user-visible and `DESIGN.md` is missing, TBD, or the user asked for a style guide / principles: owner is Design in `setup` first. Design must ask what they need before inventing tokens. Do not let App engineer invent tokens.
 5. Add extra reviewers: Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
@@ -29,4 +29,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS.
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS. Skipping `ship` because “LGTM, ship it.”

package/examples/next-supabase-installed/.cursor/skills/ship/SKILL.md

@@ -1,22 +1,67 @@
 ---
 name: ship
-description: Use before release. Check env vars, migration order, smoke, and rollback. User-visible releases still need browser-qa evidence.
+description: Use before deploy, promote, rollback, or when someone says LGTM, ship it. Go or no-go. Name env, migration order, rollback, commands run. User-visible still needs browser-qa screenshot paths.
 ---
 
 # Ship
 
+This skill is **go / no-go**. Commands live in `testing-qa`. Screenshots live in `browser-qa`. Keyboard pass lives in `accessibility-wcag`. Policies live in `supabase-auth-rls`. Schema order lives in `postgres-migrations`. Secrets and OWASP live in `owasp-security-review`. This skill does not replace those.
+
 ## Use when
 
-Preparing to deploy, promote, or roll back.
+Preparing to deploy, promote, roll back, or cut a production release. Also when someone says “ship it”, “LGTM”, “is this ready?”, “promote preview”, or “rollback”.
+
+Not a substitute for writing the feature. Run this **after** the owning specialists finish. QA names the verdict; App engineer names env and the app rollback; Security names secrets and RLS.
+
+## Do
+
+1. Name the target (`preview` / `production` / named env) and what commit or deployment is going out.
+2. List production-critical **env var names** (not values). Confirm they exist on that target. Flag any `NEXT_PUBLIC_` secret or service role on the client.
+3. Name migration order. If schema changed, say whether the migration already ran and how to reverse it (`postgres-migrations`). Do not drop a column the live app still reads.
+4. Run `testing-qa`: list commands actually run. Smoke of the primary path is required for a go.
+5. If anything user-visible changed: attach `browser-qa` desktop + mobile paths. For screens, `accessibility-wcag` already ran. Missing paths are a no-go.
+6. Return **go** or **no-go** with gaps. Do not imply go by omitting the word.
 
 ## Checks
 
-- Production-critical env vars are named.
-- Migration order and rollback are explicit.
-- Smoke of the primary path passed.
-- User-visible changes have desktop and mobile screenshot evidence from `browser-qa`.
-- Secrets are not in the repo or client bundle.
+| Area | Pass |
+| --- | --- |
+| Target | Preview vs production (or named env) is explicit. |
+| Env | Critical names listed. Values are not pasted into the verdict. |
+| Secrets | No secrets in git, `NEXT_PUBLIC_*`, client bundle, or logs. Service role stays server-only. |
+| Migrations | Order named. Rollback named, or expand/contract reverse named. Empty “N/A” only if schema did not change. |
+| Commands | `testing-qa` list with results. Smoke of the primary path (login or the workflow being released). |
+| UI | User-visible changes have `qa-evidence/<date>-<slug>/desktop.png` and `mobile.png`. |
+| Host | If this app is on Vercel (or similar), name preview vs production and how to restore the previous deployment. Do not require a Vercel CLI install from this kit. |
+
+## Evidence
+
+```text
+verdict: go | no-go
+target: preview | production
+commands:
+  - npx vitest run                 # pass
+  - npm run smoke                  # pass
+env: NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY set; SERVICE_ROLE not in client
+migrations: 0012_widgets applied; rollback = reverse 0012 / expand-contract reverse
+rollback:
+  app: previous production deployment / git revert <sha>
+  db: do not drop 0012 in this release if the app still reads it
+browser-qa: qa-evidence/2026-09-13-settings/desktop.png, mobile.png
+gaps: none | named
+```
+
+## Reject
+
+- “LGTM, ship it” (or “looks good, deploy”) with no env list, no rollback, and no commands.
+- User-visible release without `browser-qa` screenshot **paths**.
+- “We’ll set env in the dashboard later” or shipping with placeholder secrets.
+- `SUPABASE_SERVICE_ROLE_KEY` (or any secret) in `NEXT_PUBLIC_*`, the repo, or a client bundle.
+- Skipping rollback because “it’s a small change” or “we can just migrate forward.”
+- Treating `toBeVisible` or “tests pass” as the ship gate. Use `testing-qa` and, for UI, `browser-qa`.
+- Replacing `testing-qa`, `browser-qa`, `postgres-migrations`, `supabase-auth-rls`, or `owasp-security-review` with this skill.
+- Pasting secret **values** into the go/no-go note.
 
 ## Done when
 
-Go / no-go is explicit, with commands run and rollback named.
+Go or no-go is explicit. Commands run, env names, migration order, and rollback are named. User-visible work has `browser-qa` screenshot paths. Secrets were not written into the verdict.

package/examples/next-supabase-installed/USER_GUIDE.html

@@ -622,7 +622,7 @@ Act as design. This is a new repo. Scan what is already here, then ask me what w
             </tr>
             <tr>
               <td><code>ship</code></td>
-              <td>Release, env, rollback</td>
+              <td>Go / no-go. Env, rollback, commands. UI needs screenshot paths</td>
             </tr>
           </tbody>
         </table>
@@ -734,6 +734,17 @@ Act as design. This is a new repo. Scan what is already here, then ask me what w
         </div>
         <h3>Copy pass</h3>
         <p>Copy reviews the <em>rendered</em> words in screenshots, not strings in TSX. Run <code>product-copy</code>, then <code>deslop</code> last.</p>
+        <h3>Release / ship</h3>
+        <p>Before you promote or deploy, paste to QA:</p>
+        <pre id="ship-prompt">
+Run ship. Go or no-go. Name env, migration order, rollback, commands run. User-visible needs browser-qa screenshot paths. Reject LGTM, ship it.</pre>
+        <div class="copy-row">
+          <button class="copy" type="button" data-copy-from="ship-prompt">Copy ship prompt</button>
+        </div>
+        <p>
+          QA names the verdict. App engineer names env and the app rollback. Security names secrets and RLS. Missing screenshot paths on a user-visible release
+          is a no-go.
+        </p>
       </section>
 
       <section id="qa">

package/examples/next-supabase-installed/USER_GUIDE.md

@@ -100,7 +100,7 @@ Do not ask one chat to be all six. Planner names the next specialist. It does no
 | `testing-qa` | Unit / regression / smoke. List commands run. Not screenshots |
 | `product-copy` | Headlines and CTAs |
 | `deslop` | Last copy pass. Copy always runs this |
-| `ship` | Release, env, rollback |
+| `ship` | Go / no-go. Env, rollback, commands. UI needs screenshot paths |
 
 QA of a screen always uses `browser-qa`, not `testing-qa` alone. User-facing screens also run `accessibility-wcag` (keyboard in the browser, not a contrast guess from the screenshot). Each agent file names the skills it must run, then points at `catalog.json` for the rest.
 
@@ -146,6 +146,16 @@ Run accessibility-wcag. Open the changed flow. Keyboard-only pass. Do not accept
 
 Copy reviews **rendered** screenshots, not just strings in TSX. Run `product-copy`, then **`deslop` last**. Do not hand off after the first draft.
 
+### Release / ship
+
+Before you promote or deploy, paste to QA:
+
+```text
+Run ship. Go or no-go. Name env, migration order, rollback, commands run. User-visible needs browser-qa screenshot paths. Reject LGTM, ship it.
+```
+
+QA names the verdict. App engineer names env and the app rollback. Security names secrets and RLS. Missing screenshot paths on a user-visible release is a no-go.
+
 ## QA screenshot loop
 
 Bad request (reject this):

package/examples/next-supabase-installed/skills/planning/SKILL.md

@@ -17,7 +17,7 @@ Planning, roadmaps, “what should we do,” or any request that needs an owner.
    - App engineer: `nextjs-app-router` and, if data/auth, `supabase-auth-rls` / `postgres-migrations`
    - Security: `owasp-security-review` + `supabase-auth-rls`
    - Design: `frontend-design` (name setup, build, review, or detect) and, for screens, `accessibility-wcag`
-   - QA: `browser-qa` (screens), `testing-qa` (commands), and `accessibility-wcag` for user-facing screens
+   - QA: `browser-qa` (screens), `testing-qa` (commands), `accessibility-wcag` for user-facing screens, and `ship` for a release go/no-go
    - Copy: `product-copy` then `deslop` last
 4. If the work is user-visible and `DESIGN.md` is missing, TBD, or the user asked for a style guide / principles: owner is Design in `setup` first. Design must ask what they need before inventing tokens. Do not let App engineer invent tokens.
 5. Add extra reviewers: Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
@@ -29,4 +29,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS.
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS. Skipping `ship` because “LGTM, ship it.”

package/examples/next-supabase-installed/skills/ship/SKILL.md

@@ -1,22 +1,67 @@
 ---
 name: ship
-description: Use before release. Check env vars, migration order, smoke, and rollback. User-visible releases still need browser-qa evidence.
+description: Use before deploy, promote, rollback, or when someone says LGTM, ship it. Go or no-go. Name env, migration order, rollback, commands run. User-visible still needs browser-qa screenshot paths.
 ---
 
 # Ship
 
+This skill is **go / no-go**. Commands live in `testing-qa`. Screenshots live in `browser-qa`. Keyboard pass lives in `accessibility-wcag`. Policies live in `supabase-auth-rls`. Schema order lives in `postgres-migrations`. Secrets and OWASP live in `owasp-security-review`. This skill does not replace those.
+
 ## Use when
 
-Preparing to deploy, promote, or roll back.
+Preparing to deploy, promote, roll back, or cut a production release. Also when someone says “ship it”, “LGTM”, “is this ready?”, “promote preview”, or “rollback”.
+
+Not a substitute for writing the feature. Run this **after** the owning specialists finish. QA names the verdict; App engineer names env and the app rollback; Security names secrets and RLS.
+
+## Do
+
+1. Name the target (`preview` / `production` / named env) and what commit or deployment is going out.
+2. List production-critical **env var names** (not values). Confirm they exist on that target. Flag any `NEXT_PUBLIC_` secret or service role on the client.
+3. Name migration order. If schema changed, say whether the migration already ran and how to reverse it (`postgres-migrations`). Do not drop a column the live app still reads.
+4. Run `testing-qa`: list commands actually run. Smoke of the primary path is required for a go.
+5. If anything user-visible changed: attach `browser-qa` desktop + mobile paths. For screens, `accessibility-wcag` already ran. Missing paths are a no-go.
+6. Return **go** or **no-go** with gaps. Do not imply go by omitting the word.
 
 ## Checks
 
-- Production-critical env vars are named.
-- Migration order and rollback are explicit.
-- Smoke of the primary path passed.
-- User-visible changes have desktop and mobile screenshot evidence from `browser-qa`.
-- Secrets are not in the repo or client bundle.
+| Area | Pass |
+| --- | --- |
+| Target | Preview vs production (or named env) is explicit. |
+| Env | Critical names listed. Values are not pasted into the verdict. |
+| Secrets | No secrets in git, `NEXT_PUBLIC_*`, client bundle, or logs. Service role stays server-only. |
+| Migrations | Order named. Rollback named, or expand/contract reverse named. Empty “N/A” only if schema did not change. |
+| Commands | `testing-qa` list with results. Smoke of the primary path (login or the workflow being released). |
+| UI | User-visible changes have `qa-evidence/<date>-<slug>/desktop.png` and `mobile.png`. |
+| Host | If this app is on Vercel (or similar), name preview vs production and how to restore the previous deployment. Do not require a Vercel CLI install from this kit. |
+
+## Evidence
+
+```text
+verdict: go | no-go
+target: preview | production
+commands:
+  - npx vitest run                 # pass
+  - npm run smoke                  # pass
+env: NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY set; SERVICE_ROLE not in client
+migrations: 0012_widgets applied; rollback = reverse 0012 / expand-contract reverse
+rollback:
+  app: previous production deployment / git revert <sha>
+  db: do not drop 0012 in this release if the app still reads it
+browser-qa: qa-evidence/2026-09-13-settings/desktop.png, mobile.png
+gaps: none | named
+```
+
+## Reject
+
+- “LGTM, ship it” (or “looks good, deploy”) with no env list, no rollback, and no commands.
+- User-visible release without `browser-qa` screenshot **paths**.
+- “We’ll set env in the dashboard later” or shipping with placeholder secrets.
+- `SUPABASE_SERVICE_ROLE_KEY` (or any secret) in `NEXT_PUBLIC_*`, the repo, or a client bundle.
+- Skipping rollback because “it’s a small change” or “we can just migrate forward.”
+- Treating `toBeVisible` or “tests pass” as the ship gate. Use `testing-qa` and, for UI, `browser-qa`.
+- Replacing `testing-qa`, `browser-qa`, `postgres-migrations`, `supabase-auth-rls`, or `owasp-security-review` with this skill.
+- Pasting secret **values** into the go/no-go note.
 
 ## Done when
 
-Go / no-go is explicit, with commands run and rollback named.
+Go or no-go is explicit. Commands run, env names, migration order, and rollback are named. User-visible work has `browser-qa` screenshot paths. Secrets were not written into the verdict.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsforgood/next-supabase-kit",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Agents, skills, and a user guide for Next.js and Supabase projects. QA reviews screenshots, not code alone.",
   "type": "module",
   "repository": {

package/skills/planning/SKILL.md

@@ -17,7 +17,7 @@ Planning, roadmaps, “what should we do,” or any request that needs an owner.
    - App engineer: `nextjs-app-router` and, if data/auth, `supabase-auth-rls` / `postgres-migrations`
    - Security: `owasp-security-review` + `supabase-auth-rls`
    - Design: `frontend-design` (name setup, build, review, or detect) and, for screens, `accessibility-wcag`
-   - QA: `browser-qa` (screens), `testing-qa` (commands), and `accessibility-wcag` for user-facing screens
+   - QA: `browser-qa` (screens), `testing-qa` (commands), `accessibility-wcag` for user-facing screens, and `ship` for a release go/no-go
    - Copy: `product-copy` then `deslop` last
 4. If the work is user-visible and `DESIGN.md` is missing, TBD, or the user asked for a style guide / principles: owner is Design in `setup` first. Design must ask what they need before inventing tokens. Do not let App engineer invent tokens.
 5. Add extra reviewers: Security for auth/data/secrets, Design for UI, QA for behavior/UI, Copy for public words.
@@ -29,4 +29,4 @@ Owner, extra reviewers, required skills, preserved behavior, and required screen
 
 ## Reject
 
-Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS.
+Implementing in the planning pass. Asking one chat to play every role. Skipping `supabase-auth-rls` because “it’s just a table.” Skipping `nextjs-app-router` because the route is small. Skipping Design `setup` on a new product UI because “we’ll pick colors in CSS.” Skipping `accessibility-wcag` because “contrast looks fine in the screenshot.” Skipping `testing-qa` because “we’ll add tests later” on auth/RLS. Skipping `ship` because “LGTM, ship it.”