@growthub/cli 0.7.9 → 0.8.1

package/assets/worker-kits/growthub-agency-portal-starter-v1/templates/self-eval.md

@@ -0,0 +1,67 @@
+# Self-evaluation template — v1 primitive (Growthub, capability-agnostic)
+
+A skill's `selfEval` contract declares **what good looks like** (`criteria[]`) and **the retry ceiling** (`maxRetries`). The agent drives the loop; this file is the pattern the agent follows at every unit of work.
+
+The contract is defined in `@growthub/api-contract/skills::SkillSelfEval` and is **capability-agnostic** — the same primitive applies to code edits, copy drafts, CRM rules, API payloads, asset renders, audit passes, and every other domain. The "unit of work" is the smallest reversible change the skill operates on; concrete boundaries are defined in the kit's own `skills.md` operator runbook, not here.
+
+## Loop
+
+```
+for attempt in 1..maxRetries:          # default maxRetries = 3
+  generate       — produce a proposal (whatever the skill produces)
+  apply          — materialise the proposal against the fork
+  self-evaluate  — for each criterion in skill.selfEval.criteria:
+                     check → pass / fail / needs-confirmation
+  record         — append to project.md (human) + trace.jsonl (machine)
+
+  if all criteria pass: break
+  if attempt == maxRetries: park with needs_confirmation note. Stop.
+```
+
+## What each attempt writes
+
+### Human row — append to `.growthub-fork/project.md` "Session log"
+
+```md
+### 2026-04-23 18:40 UTC · <skill-slug>
+- **Plan.** What you intend to do this unit of work.
+- **Changes.** Material change applied (must correspond to a trace event).
+- **Self-eval.** attempt 2/3 — criterion "<one of skill.selfEval.criteria>" ✗ (<note>). Retrying.
+- **Outcome.** retry-pending / pass / parked.
+- **Next.** What the next attempt (or next session) should pick up.
+```
+
+### Machine row — append to `.growthub-fork/trace.jsonl` (via `appendKitForkTraceEvent`)
+
+```json
+{
+  "ts": "2026-04-23T18:40:00.000Z",
+  "forkId": "<fork-id>",
+  "kitId": "<kit-id>",
+  "type": "self_eval_recorded",
+  "summary": "attempt 2/3 failed on <criterion>",
+  "detail": {
+    "skill": "<skill-slug>",
+    "attempt": 2,
+    "maxRetries": 3,
+    "criterion": "<one of skill.selfEval.criteria>",
+    "outcome": "fail",
+    "notes": "<short explanation>"
+  }
+}
+```
+
+## Hard rules
+
+1. **Never exceed `maxRetries`.** At the ceiling, park with a `needs_confirmation` note and stop. Do not loop forever.
+2. **Record every attempt.** Even the first pass. Continuity depends on a complete journal.
+3. **Keep `project.md` and `trace.jsonl` in sync.** One without the other is a protocol violation.
+4. **Preserve prior entries.** Append-only. Never rewrite history.
+
+## Bound the blast radius
+
+Evaluate at the smallest unit of work the skill operates on, not only at the end of a multi-step run. The retry ceiling applies to that unit — so a bad attempt does not sink the whole job.
+
+What counts as a "unit of work" is **kit-specific** and lives in that kit's `skills.md` operator runbook — not in this agnostic template. A kit picks its own smallest reversible boundary and documents it in `skills.md`; this template does not prescribe one.
+
+The agnostic SDK (`@growthub/api-contract/skills::SkillSelfEval`) does not encode any domain-specific boundaries — it only carries `criteria[]`, `maxRetries`, and `traceTo`. See `SKILL.md::selfEval.criteria` in this kit for the concrete checks, and `skills.md` for the kit-specific unit of work.

package/assets/worker-kits/growthub-agency-portal-starter-v1/templates/supabase-setup-plan.md

@@ -0,0 +1,26 @@
+# Database Provider Setup Plan
+
+This file name is retained for compatibility with older agency portal notes. The v1 worker-kit contract is not Supabase-specific.
+
+Use `AGENCY_PORTAL_DATA_ADAPTER` to select persistence:
+
+- `postgres` with `DATABASE_URL`
+- `qstash-kv` with `QSTASH_KV_REST_URL` and `QSTASH_KV_REST_TOKEN`
+- `provider-managed` for a hosted database surface outside this kit
+
+Supabase may be used only as one Postgres-compatible provider behind `DATABASE_URL`. Do not add Supabase SDK dependencies or Supabase-only assumptions to the starter unless a user explicitly chooses that provider in their own fork.
+
+## Selected Provider
+
+- Adapter:
+- Provider:
+- Required env:
+- Migration owner:
+- Backup owner:
+
+## Validation
+
+```bash
+node setup/verify-env.mjs
+cd apps/agency-portal && npm run build
+```

package/assets/worker-kits/growthub-agency-portal-starter-v1/templates/workspace-brief.md

@@ -0,0 +1,11 @@
+# Workspace Brief — Template
+
+Use this template to capture what a new custom workspace is for.
+
+- Client:
+- Project slug:
+- Goals (3 bullets max):
+- Surface area (which worker kits this workspace composes):
+- Out of scope:
+- Success criteria:
+- First heal checkpoint:

package/assets/worker-kits/growthub-agency-portal-starter-v1/validation-checklist.md

@@ -0,0 +1,32 @@
+# Agency Portal Starter — Validation Checklist
+
+- [ ] `kit.json` is schema-v2 valid and identifies `growthub-agency-portal-starter-v1`.
+- [ ] Every path in `kit.json.frozenAssetPaths` exists.
+- [ ] `SKILL.md`, `templates/project.md`, `templates/self-eval.md`, `helpers/README.md`, and `skills/README.md` are present.
+- [ ] `studio/` builds with `npm run build`.
+- [ ] `apps/agency-portal/` builds with `npm run build`.
+- [ ] `node setup/verify-env.mjs` validates the selected adapters.
+- [ ] Vercel root is `apps/agency-portal`.
+- [ ] Persistence adapter is documented as `postgres`, `qstash-kv`, or `provider-managed`.
+- [ ] Auth and payment adapters are documented without provider lock-in.
+- [ ] Integration adapter is documented as `static`, `growthub-bridge`, or `byo-api-key`.
+- [ ] `/settings/integrations` renders a dedicated sidebar nav page, not home-page integration content.
+- [ ] Data pipeline objects are explicit: Windsor AI, Google Sheets blended data, Google Analytics, Shopify, Meta Facebook/Instagram.
+- [ ] MCP connection integrations are explicit: Asana, Slack, GoHighLevel, Google Drive, Notion.
+- [ ] Growthub bridge mode shows active/connected status when normalized MCP account rows are returned by the bridge.
+- [ ] `growthub-connection-normalizer.js` accepts both SDK/profile-style `integrations[]` and GH app MCP `accounts[]` payloads.
+- [ ] Unknown active MCP providers are preserved as discovered workspace integrations instead of being dropped.
+- [ ] BYO API key mode works from `AGENCY_PORTAL_BYO_CONNECTIONS_JSON` using the same object shape.
+- [ ] Windsor BYO mode works with `WINDSOR_API_KEY` alone and renders Windsor AI as connected.
+- [ ] Windsor API key path is supported as `WINDSOR_API_KEY` and represented as a first-class data pipeline object.
+- [ ] CLI discovery/list/export path succeeds:
+  ```bash
+  growthub kit list --family studio --json
+  growthub kit download growthub-agency-portal-starter-v1 --out /tmp/agency-portal-qa --yes
+  ```
+- [ ] Fork registration/status path succeeds on an exported workspace:
+  ```bash
+  growthub kit fork register /tmp/agency-portal-qa/growthub-agent-worker-kit-agency-portal-starter-v1
+  growthub kit fork status <fork-id>
+  ```
+- [ ] Governed forks record material changes to `.growthub-fork/project.md` and `.growthub-fork/trace.jsonl`.

package/assets/worker-kits/growthub-agency-portal-starter-v1/workers/agency-portal-operator/CLAUDE.md

@@ -0,0 +1,75 @@
+# Agency Portal Operator — Agent Operating Instructions
+
+**Kit:** `growthub-agency-portal-starter-v1`  
+**Worker ID:** `agency-portal-operator`  
+**Version:** `1.0.0`
+
+## Role
+
+You operate the Agency Portal Starter as a governed workspace built from the custom workspace starter primitive. Keep the Growthub local-first Vite shell in `studio/`; operate the deployable Vercel/serverless portal under `apps/agency-portal/`.
+
+## Source Of Truth
+
+1. `.growthub-fork/project.md`
+2. `SKILL.md`
+3. `skills.md`
+4. `docs/governed-workspace-primitives.md`
+5. `docs/adapter-contracts.md`
+6. `docs/vercel-serverless-deployment.md`
+7. `docs/vite-ui-shell-guide.md`
+8. `validation-checklist.md`
+
+## Hard Rules
+
+- Do not collapse the kit into the Vercel app. The kit root is the governed workspace; `studio/` is the local-first Vite operator shell; `apps/agency-portal/` is the serverless app payload.
+- Do not hardcode one database provider into the worker-kit contract. Persistence is selected by adapter env: `postgres`, `qstash-kv`, or `provider-managed`.
+- Do not hardcode payments. Payments are selected by `AGENCY_PORTAL_PAYMENT_ADAPTER`.
+- Do not move third-party provider tokens into source. Growthub bridge mode consumes hosted GH app connection state; BYO mode references env names and normalized metadata only.
+- Do not place integration lists on the home dashboard. Use the dedicated sidebar route `/settings/integrations`.
+- Do not collapse data pipelines and operational integrations into one opaque bucket. Data pipeline objects and MCP connection integrations stay distinct under the unified integrations page.
+- Do not treat cloud deployment as the local runtime. Local Growthub operation stays first; Vercel is the clean serverless deployment lane.
+- Every material change in a governed fork records to `.growthub-fork/project.md` and `.growthub-fork/trace.jsonl`.
+
+## Integration Model
+
+Model the GH app primitive without importing the GH app runtime:
+
+- Catalog metadata: `id`, `provider`, `name`, `description`, `category`, `authType`.
+- User connection state: `isConnected`, `isActive`, `connectionId`, `connectionMetadata`.
+- Worker-kit lane: `lane`, `objectType`, `authPath`, `setupMode`.
+
+Data pipeline objects:
+
+- Windsor AI
+- Google Sheets blended data
+- Google Analytics
+- Shopify
+- Meta Facebook/Instagram
+
+MCP connection integrations:
+
+- Asana
+- Slack
+- GoHighLevel
+- Google Drive
+- Notion
+
+`growthub-bridge` means hosted GH app authority resolves active connections. `byo-api-key` means the exported workspace owns explicit setup through env vars and `AGENCY_PORTAL_BYO_CONNECTIONS_JSON`.
+
+## Verification
+
+```bash
+bash setup/check-deps.sh
+node setup/verify-env.mjs
+cd studio && npm install && npm run build
+cd apps/agency-portal && npm install && npm run build
+```
+
+CLI export/fork verification:
+
+```bash
+growthub kit list --family studio --json
+growthub kit download growthub-agency-portal-starter-v1 --out /tmp/agency-portal-qa --yes
+growthub kit fork register /tmp/agency-portal-qa/growthub-agent-worker-kit-agency-portal-starter-v1
+growthub kit fork status <fork-id>
+```

package/assets/worker-kits/growthub-ai-website-cloner-v1/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: growthub-ai-website-cloner-v1
+description: "Self-contained workspace for cloning any website into a clean Next.js 16 + shadcn/ui + Tailwind CSS v4 codebase. Use when the user says: \"clone this site\", \"next.js rebuild\", \"website cloner\". Session memory tracks source URL, DOM-scrape milestones, and component extraction self-eval outcomes."
+triggers:
+  - ai website cloner
+  - fork growthub-ai-website-cloner-v1
+progressiveDisclosure: true
+sessionMemory:
+  path: .growthub-fork/project.md
+selfEval:
+  criteria:
+    - Operator contract (workers/ai-website-cloner-operator/CLAUDE.md) read before any material change.
+    - .growthub-fork/project.md appended to at each material change.
+    - .growthub-fork/trace.jsonl receives a typed event for each material change.
+    - Kit-specific QUICKSTART / runtime-assumptions / output-standards honoured.
+  maxRetries: 3
+  traceTo: .growthub-fork/trace.jsonl
+helpers: []
+subSkills: []
+mcpTools: []
+---
+
+# Growthub Agent Worker Kit — AI Website Cloner
+
+Discovery entry + routing menu for the `growthub-ai-website-cloner-v1` worker kit. Family: `studio`. Agent contract: `workers/ai-website-cloner-operator/CLAUDE.md`.
+
+## When to use this skill
+
+When the user's intent matches any of the triggers above — or when an agent has been dropped into a fork whose `.growthub-fork/fork.json` declares `kitId: "growthub-ai-website-cloner-v1"`.
+
+## Decision tree
+
+```
+Fork exists (this directory contains .growthub-fork/fork.json)?
+├── No  → run: growthub starter init --out <path>   (or import-repo / import-skill)
+│         then: growthub kit download growthub-ai-website-cloner-v1 --out <path>
+│
+└── Yes → read in this order:
+          1. .growthub-fork/project.md                         — session memory (primitive #3)
+          2. SKILL.md  (this file)                             — routing menu  (primitive #1)
+          3. skills.md                                         — operator runbook
+          4. workers/ai-website-cloner-operator/CLAUDE.md                              — agent contract
+          5. QUICKSTART.md                                     — first-run steps
+          6. runtime-assumptions.md                            — host expectations
+          7. .growthub-fork/policy.json                        — what you may touch
+          8. .growthub-fork/trace.jsonl (tail 20)              — recent machine history
+```
+
+## The six primitives (same shape across every Growthub worker kit)
+
+1. **`SKILL.md`** — this file.
+2. **Symlinked pointer** — repo-root `AGENTS.md` is authoritative.
+3. **`.growthub-fork/project.md`** — session memory, seeded by the CLI from `templates/project.md` at init/import time.
+4. **Self-evaluation** — generate → apply → evaluate → record; retry up to `selfEval.maxRetries` (default 3); mirrors the Fork Sync Agent's preview → apply → trace loop (primitive #4). Contract: `@growthub/api-contract/skills::SkillSelfEval`.
+5. **`skills/`** — nested sub-skills for parallel sub-agents on heavy / narrow work.
+6. **`helpers/`** — safe shell tool layer. Promote inline shell here whenever the same snippet is re-used.
+
+## Self-evaluation (primitive #4)
+
+Enforce `selfEval.maxRetries: 3`. At the ceiling, park with a `needs_confirmation` note in `project.md` and stop. Record every attempt to both `project.md` and `trace.jsonl`.
+
+## Session memory (primitive #3)
+
+`.growthub-fork/project.md` is the only cross-session continuity surface for this fork. Append at every material change, approval boundary, and self-eval outcome.
+
+## Sub-skills (primitive #5)
+
+(None declared at the baseline; populate `skills/` and the frontmatter `subSkills[]` array as specialist lanes emerge.)
+
+## Helpers (primitive #6)
+
+(None declared at the baseline; populate `helpers/` and the frontmatter `helpers[]` array as inline shell matures.)
+
+## MCP routing (optional)
+
+List concrete MCP tool IDs in `mcpTools[]` when a fork runs an MCP server for auth-heavy actions. Declarative only at v1.
+
+## Related files
+
+- `skills.md` — operator runbook (deep)
+- `QUICKSTART.md` — first-run steps
+- `runtime-assumptions.md` — host expectations
+- `output-standards.md` — output locations + manifest shape
+- `validation-checklist.md` — pre-flight checklist (if present)
+- `templates/project.md` — session-memory template
+- `templates/self-eval.md` — self-evaluation template
+- `helpers/README.md` — safe shell tool layer convention
+- `skills/README.md` — sub-skill convention
+- `workers/ai-website-cloner-operator/CLAUDE.md` — agent contract

package/assets/worker-kits/growthub-ai-website-cloner-v1/bundles/growthub-ai-website-cloner-v1.json

@@ -42,12 +42,19 @@
     "docs/parallel-builder-dispatch.md",
     "docs/design-token-system.md",
     "growthub-meta/README.md",
-    "growthub-meta/kit-standard.md"
+    "growthub-meta/kit-standard.md",
+    "SKILL.md",
+    "templates/project.md",
+    "templates/self-eval.md",
+    "helpers/README.md",
+    "skills/README.md"
   ],
   "optionalPresets": [],
   "export": {
     "folderName": "growthub-agent-worker-kit-ai-website-cloner-v1",
     "zipFileName": "growthub-agent-worker-kit-ai-website-cloner-v1.zip"
   },
-  "activationModes": ["export"]
+  "activationModes": [
+    "export"
+  ]
 }

package/assets/worker-kits/growthub-ai-website-cloner-v1/helpers/README.md

@@ -0,0 +1,29 @@
+# `helpers/` — safe shell tool layer (primitive #6)
+
+A **helper** is a small, deterministic script an agent invokes via one shell call instead of reconstructing a raw pipeline inline. Helpers are reviewable, deterministic, and safer than raw commands.
+
+## Convention
+
+```
+helpers/
+├── README.md                 # this file
+├── <verb>.sh                 # single-purpose shell scripts
+├── <verb>.mjs                # optional: Node-based helper
+└── <verb>.py                 # optional: Python-based helper
+```
+
+Every helper:
+
+1. Carries a one-line header comment: what it does + how to invoke it.
+2. Uses `set -euo pipefail` (or equivalent) — no silent failures.
+3. Has a matching row in the parent `SKILL.md`'s `helpers[]` frontmatter.
+4. Is referenced from `skills.md` at the step the agent should invoke it (no duplicated shell bodies).
+
+## When to promote an inline snippet
+
+- Appears more than once in `skills.md`.
+- Has fragile quoting or path interpolation.
+- Calls a side-effecting binary (ffmpeg, git, gh, npm install).
+- Multiple sub-skills invoke it.
+
+See the parent `SKILL.md` `helpers[]` array for the current roster.

package/assets/worker-kits/growthub-ai-website-cloner-v1/kit.json

@@ -54,7 +54,12 @@
     "docs/parallel-builder-dispatch.md",
     "docs/design-token-system.md",
     "growthub-meta/README.md",
-    "growthub-meta/kit-standard.md"
+    "growthub-meta/kit-standard.md",
+    "SKILL.md",
+    "templates/project.md",
+    "templates/self-eval.md",
+    "helpers/README.md",
+    "skills/README.md"
   ],
   "setupPaths": {
     "quickstart": "QUICKSTART.md",
@@ -81,7 +86,14 @@
       "output/README.md",
       "templates",
       "docs",
-      "growthub-meta"
+      "growthub-meta",
+      "SKILL.md",
+      "templates/project.md",
+      "templates/self-eval.md",
+      "helpers",
+      "helpers/README.md",
+      "skills",
+      "skills/README.md"
     ]
   },
   "bundles": [

package/assets/worker-kits/growthub-ai-website-cloner-v1/skills/README.md

@@ -0,0 +1,23 @@
+# `skills/` — nested sub-skill convention (primitive #5)
+
+A **sub-skill** is a full `SKILL.md`-addressable lane that a parent skill can spawn as a parallel sub-agent.
+
+## Convention
+
+```
+skills/
+├── README.md                        # this file
+└── <slug>/                          # kebab-case; matches the SKILL.md name
+    ├── SKILL.md                     # frontmatter + routing body (≤ 500 lines)
+    ├── references/                  # optional — long docs loaded on demand
+    ├── templates/                   # optional — reusable text/JS templates
+    └── scripts/                     # optional — deterministic helpers
+```
+
+Each sub-skill's frontmatter follows `@growthub/api-contract/skills::SkillManifest`. Sub-skills share the parent's `.growthub-fork/project.md` journal — they do not branch it.
+
+## Parallelism
+
+Spawn a sub-skill sub-agent when (a) the sub-skill's work is fully scoped by its own criteria, and (b) the parent's next step does not depend on intermediate state from the sub-skill. Each sub-skill run appends a row to `project.md::subSkillRuns` so the parent can read the outcome on return.
+
+See the parent `SKILL.md` `subSkills[]` array for the current roster.

package/assets/worker-kits/growthub-ai-website-cloner-v1/templates/project.md

@@ -0,0 +1,48 @@
+---
+# .growthub-fork/project.md — session memory primitive (v1)
+#
+# Written by the CLI at init/import time. Append-only, human-readable; sits
+# alongside the machine-readable `trace.jsonl`. Approvals, self-eval outcomes,
+# and sub-skill runs all record here.
+#
+# Replaceable tokens (seeded at init time):
+#   {{KIT_ID}}   {{FORK_ID}}   {{STARTED_AT}}   {{SOURCE}}   {{SOURCE_REF}}
+
+kitId: "{{KIT_ID}}"
+forkId: "{{FORK_ID}}"
+startedAt: "{{STARTED_AT}}"
+source: "{{SOURCE}}"
+sourceRef: "{{SOURCE_REF}}"
+skillManifestVersion: 1
+approvals: []
+selfEvalHistory: []
+subSkillRuns: []
+---
+
+# Project journal — fork `{{FORK_ID}}`
+
+Baseline primitive: `{{KIT_ID}}`. Seeded at `{{STARTED_AT}}` from `{{SOURCE}}` (`{{SOURCE_REF}}`).
+
+This is your cross-session continuity surface. Read the last few entries before every session; append after every material change, approval, and self-eval boundary.
+
+## How to use this file
+
+1. **Session start.** Read the last 3 entries + tail 20 events in `.growthub-fork/trace.jsonl`. State your plan.
+2. **Material change.** Record as a dated bullet (what, why, outcome). Simultaneously append a typed event to `trace.jsonl` via the Fork Sync Agent — never bypass.
+3. **Approval boundary.** Add a row to `approvals` in the frontmatter (verbatim decision).
+4. **Self-eval boundary.** Append to `selfEvalHistory`: `attempt`, `criteria`, `outcome`, `notes`. Enforce `maxRetries: 3`.
+5. **Sub-skill spawn.** Append to `subSkillRuns`: `subSkill`, `startedAt`, `result`.
+
+## Session log
+
+<!-- Append newest entries at the bottom. Format:
+
+### {{YYYY-MM-DD HH:mm UTC}} · {{skill-slug}}
+- **Plan.** What you intend to do.
+- **Changes.** Material changes (each must correspond to a trace event).
+- **Outcome.** Pass / fail / parked. Reference self-eval criteria.
+- **Next.** What the next session should pick up.
+
+-->
+
+_No sessions recorded yet. Populated as the fork is operated._

package/assets/worker-kits/growthub-ai-website-cloner-v1/templates/self-eval.md

@@ -0,0 +1,67 @@
+# Self-evaluation template — v1 primitive (Growthub, capability-agnostic)
+
+A skill's `selfEval` contract declares **what good looks like** (`criteria[]`) and **the retry ceiling** (`maxRetries`). The agent drives the loop; this file is the pattern the agent follows at every unit of work.
+
+The contract is defined in `@growthub/api-contract/skills::SkillSelfEval` and is **capability-agnostic** — the same primitive applies to code edits, copy drafts, CRM rules, API payloads, asset renders, audit passes, and every other domain. The "unit of work" is the smallest reversible change the skill operates on; concrete boundaries are defined in the kit's own `skills.md` operator runbook, not here.
+
+## Loop
+
+```
+for attempt in 1..maxRetries:          # default maxRetries = 3
+  generate       — produce a proposal (whatever the skill produces)
+  apply          — materialise the proposal against the fork
+  self-evaluate  — for each criterion in skill.selfEval.criteria:
+                     check → pass / fail / needs-confirmation
+  record         — append to project.md (human) + trace.jsonl (machine)
+
+  if all criteria pass: break
+  if attempt == maxRetries: park with needs_confirmation note. Stop.
+```
+
+## What each attempt writes
+
+### Human row — append to `.growthub-fork/project.md` "Session log"
+
+```md
+### 2026-04-23 18:40 UTC · <skill-slug>
+- **Plan.** What you intend to do this unit of work.
+- **Changes.** Material change applied (must correspond to a trace event).
+- **Self-eval.** attempt 2/3 — criterion "<one of skill.selfEval.criteria>" ✗ (<note>). Retrying.
+- **Outcome.** retry-pending / pass / parked.
+- **Next.** What the next attempt (or next session) should pick up.
+```
+
+### Machine row — append to `.growthub-fork/trace.jsonl` (via `appendKitForkTraceEvent`)
+
+```json
+{
+  "ts": "2026-04-23T18:40:00.000Z",
+  "forkId": "<fork-id>",
+  "kitId": "<kit-id>",
+  "type": "self_eval_recorded",
+  "summary": "attempt 2/3 failed on <criterion>",
+  "detail": {
+    "skill": "<skill-slug>",
+    "attempt": 2,
+    "maxRetries": 3,
+    "criterion": "<one of skill.selfEval.criteria>",
+    "outcome": "fail",
+    "notes": "<short explanation>"
+  }
+}
+```
+
+## Hard rules
+
+1. **Never exceed `maxRetries`.** At the ceiling, park with a `needs_confirmation` note and stop. Do not loop forever.
+2. **Record every attempt.** Even the first pass. Continuity depends on a complete journal.
+3. **Keep `project.md` and `trace.jsonl` in sync.** One without the other is a protocol violation.
+4. **Preserve prior entries.** Append-only. Never rewrite history.
+
+## Bound the blast radius
+
+Evaluate at the smallest unit of work the skill operates on, not only at the end of a multi-step run. The retry ceiling applies to that unit — so a bad attempt does not sink the whole job.
+
+What counts as a "unit of work" is **kit-specific** and lives in that kit's `skills.md` operator runbook — not in this agnostic template. A kit picks its own smallest reversible boundary and documents it in `skills.md`; this template does not prescribe one.
+
+The agnostic SDK (`@growthub/api-contract/skills::SkillSelfEval`) does not encode any domain-specific boundaries — it only carries `criteria[]`, `maxRetries`, and `traceTo`. See `SKILL.md::selfEval.criteria` in this kit for the concrete checks, and `skills.md` for the kit-specific unit of work.

package/assets/worker-kits/growthub-ai-website-cloner-v1/workers/ai-website-cloner-operator/CLAUDE.md

@@ -254,3 +254,25 @@ Append a deliverable line in the active brand kit:
 5. `BuilderDispatchPlan`
 6. `VisualQAChecklist`
 7. `PlatformHandoff`
+
+---
+
+## Governed-workspace primitives (v1.2)
+
+This workspace carries the six architectural primitives every Growthub fork inherits. The contract is capability-agnostic (`@growthub/api-contract/skills::SkillManifest`); kit-specific specialisation lives in `skills.md` above.
+
+1. **`SKILL.md`** at the kit root — the discovery entry / routing menu. Read before `skills.md`.
+2. **Repo-root `AGENTS.md` pointer** — Cursor / Claude / Codex all read the same contract.
+3. **`.growthub-fork/project.md`** — session memory, seeded at init/import from `templates/project.md`. Append a dated entry after every material change.
+4. **Self-evaluation (`selfEval.criteria` + `maxRetries`)** — generate → apply → evaluate → record; retry up to 3; every attempt writes to both `project.md` (human) and `trace.jsonl` (machine). Use `recordSelfEval` (`cli/src/skills/self-eval.ts`); never bypass the fork-trace primitive.
+5. **Nested `skills/<slug>/SKILL.md`** — sub-skill lanes for parallel sub-agents on heavy or narrow work.
+6. **`helpers/<verb>.{sh,mjs,py}`** — safe shell tool layer; promote any inline shell that gets used twice.
+
+Command surface from inside this fork:
+
+- `growthub skills list` — enumerate this fork’s SKILL.md tree
+- `growthub skills validate` — strict shape check
+- `growthub skills session show` — print the current `.growthub-fork/project.md`
+- `growthub skills session init --kit <kit-id>` — (re-)seed session memory
+
+Full user-facing narrative: `cli/assets/worker-kits/growthub-custom-workspace-starter-v1/docs/governed-workspace-primitives.md` (also shipped into any workspace forked from the starter kit).