@growthub/cli 0.7.9 → 0.8.1

package/assets/worker-kits/growthub-agency-portal-starter-v1/helpers/README.md

@@ -0,0 +1,49 @@
+# `helpers/` — safe shell tool layer (primitive #6)
+
+A **helper** is a small, deterministic script an agent invokes via one shell call instead of reconstructing a raw pipeline inline. Helpers are:
+
+- **Reviewable.** They live in the repo; diffs are inspectable.
+- **Deterministic.** Pinned inputs and outputs; no hidden state.
+- **Safer.** Agents call `bash helpers/<verb>.sh <args>` instead of re-assembling a 4-line `ffmpeg` / `grep` / `python` pipeline every session.
+
+Helpers are **not** capability nodes, and they do not cross policy boundaries. Anything that requires auth, hosted execution, or network reach lives in the CLI (`growthub <verb>`) or in MCP routing — not here.
+
+## Convention
+
+```
+helpers/
+├── README.md                 # this file
+├── <verb>.sh                 # short, single-purpose shell scripts
+├── <verb>.mjs                # optional: Node-based helper when shell is too weak
+└── <verb>.py                 # optional: Python-based helper for CSV / data work
+```
+
+Every helper ships with:
+
+1. A one-line comment at the top: what it does + the one command that invokes it.
+2. `set -euo pipefail` (or the language equivalent) — no silent failures.
+3. A matching row in the parent `SKILL.md`'s `helpers[]` frontmatter array:
+   ```yaml
+   helpers:
+     - path: helpers/grep-hooks.sh
+       description: 3-pass hook-library search against the frozen 500-hook CSV
+   ```
+4. A matching entry in `skills.md` pointing to the helper at the place the agent should invoke it (no duplicated shell bodies).
+
+## When to promote an inline snippet into a helper
+
+Promote when any of these are true:
+
+- The same snippet appears in `skills.md` more than once.
+- The snippet has fragile quoting or path interpolation.
+- The snippet calls a side-effecting binary (`ffmpeg`, `git`, `gh`, `osascript`, `npm install`).
+- Multiple sub-skills invoke the same snippet.
+
+## Agency portal helper policy
+
+This kit intentionally keeps helper scripts minimal. Local validation currently uses first-party setup scripts:
+
+- `bash setup/check-deps.sh`
+- `node setup/verify-env.mjs`
+
+Do not add helpers that read provider secrets, call the hosted GH app, or mutate fork authority. Those flows belong to Growthub CLI commands or the configured Growthub bridge adapter.

package/assets/worker-kits/growthub-agency-portal-starter-v1/kit.json

@@ -0,0 +1,156 @@
+{
+  "schemaVersion": 2,
+  "kit": {
+    "id": "growthub-agency-portal-starter-v1",
+    "version": "1.0.0",
+    "name": "Growthub Agency Portal Starter Kit",
+    "description": "First-party governed workspace starter for composable agency portals. Built from the custom workspace starter primitives, preserving the local-first Vite operator shell while adding a Vercel-ready portal app with thin persistence, auth, and payment adapter contracts for Postgres, Qstash KV, and provider-managed deployments.",
+    "type": "worker",
+    "visibility": "public-open-source",
+    "sourceRepo": "growthub-local",
+    "family": "studio"
+  },
+  "entrypoint": {
+    "workerId": "agency-portal-operator",
+    "path": "workers/agency-portal-operator/CLAUDE.md"
+  },
+  "workerIds": [
+    "agency-portal-operator"
+  ],
+  "agentContractPath": "workers/agency-portal-operator/CLAUDE.md",
+  "brandTemplatePath": "brands/_template/brand-kit.md",
+  "publicExampleBrandPaths": [
+    "brands/growthub/brand-kit.md"
+  ],
+  "frozenAssetPaths": [
+    "QUICKSTART.md",
+    ".env.example",
+    "SKILL.md",
+    "skills.md",
+    "output-standards.md",
+    "runtime-assumptions.md",
+    "validation-checklist.md",
+    "workers/agency-portal-operator/CLAUDE.md",
+    "brands/_template/brand-kit.md",
+    "brands/growthub/brand-kit.md",
+    "brands/NEW-CLIENT.md",
+    "setup/verify-env.mjs",
+    "setup/check-deps.sh",
+    "output/README.md",
+    "templates/workspace-brief.md",
+    "templates/portal-brief.md",
+    "templates/client-onboarding-plan.md",
+    "templates/agent-contract.md",
+    "templates/deployment-plan.md",
+    "templates/deployment-handoff.md",
+    "templates/supabase-setup-plan.md",
+    "templates/project.md",
+    "templates/self-eval.md",
+    "helpers/README.md",
+    "skills/README.md",
+    "examples/workspace-sample.md",
+    "examples/portal-brief-sample.md",
+    "docs/starter-kit-overview.md",
+    "docs/fork-sync-integration.md",
+    "docs/vite-ui-shell-guide.md",
+    "docs/governed-workspace-primitives.md",
+    "docs/adapter-contracts.md",
+    "docs/vercel-serverless-deployment.md",
+    "studio/index.html",
+    "studio/package.json",
+    "studio/package-lock.json",
+    "studio/vite.config.js",
+    "studio/serve.mjs",
+    "studio/src/main.jsx",
+    "studio/src/App.jsx",
+    "studio/src/app.css",
+    "apps/agency-portal/README.md",
+    "apps/agency-portal/.env.example",
+    "apps/agency-portal/package.json",
+    "apps/agency-portal/package-lock.json",
+    "apps/agency-portal/next.config.js",
+    "apps/agency-portal/postcss.config.mjs",
+    "apps/agency-portal/vercel.json",
+    "apps/agency-portal/app/layout.jsx",
+    "apps/agency-portal/app/page.jsx",
+    "apps/agency-portal/app/globals.css",
+    "apps/agency-portal/app/settings/integrations/page.jsx",
+    "apps/agency-portal/app/api/workspace/route.js",
+    "apps/agency-portal/app/api/settings/integrations/route.js",
+    "apps/agency-portal/lib/domain/portal.js",
+    "apps/agency-portal/lib/domain/integrations.js",
+    "apps/agency-portal/lib/adapters/env.js",
+    "apps/agency-portal/lib/adapters/auth/index.js",
+    "apps/agency-portal/lib/adapters/integrations/index.js",
+    "apps/agency-portal/lib/adapters/integrations/growthub-connection-normalizer.js",
+    "apps/agency-portal/lib/adapters/payments/index.js",
+    "apps/agency-portal/lib/adapters/persistence/index.js",
+    "apps/agency-portal/lib/adapters/persistence/postgres.js",
+    "apps/agency-portal/lib/adapters/persistence/qstash-kv.js",
+    "apps/agency-portal/lib/adapters/persistence/provider-managed.js",
+    "growthub-meta/README.md",
+    "growthub-meta/kit-standard.md"
+  ],
+  "setupPaths": {
+    "quickstart": "QUICKSTART.md",
+    "setupDir": "setup/",
+    "outputDir": "output/"
+  },
+  "outputStandard": {
+    "type": "working-directory",
+    "description": "Exported folder is a governed Growthub workspace. The local-first Vite operator shell remains under studio/. The Vercel-ready agency portal app lives under apps/agency-portal/ and depends on thin adapter contracts selected by environment variables.",
+    "requiredPaths": [
+      "QUICKSTART.md",
+      "kit.json",
+      ".env.example",
+      "bundles/growthub-agency-portal-starter-v1.json",
+      "SKILL.md",
+      "skills.md",
+      "workers/agency-portal-operator/CLAUDE.md",
+      "brands/_template/brand-kit.md",
+      "brands/growthub/brand-kit.md",
+      "brands/NEW-CLIENT.md",
+      "setup/verify-env.mjs",
+      "setup/check-deps.sh",
+      "output/README.md",
+      "studio",
+      "studio/package-lock.json",
+      "apps/agency-portal",
+      "apps/agency-portal/package-lock.json",
+      "apps/agency-portal/next.config.js",
+      "apps/agency-portal/lib/adapters",
+      "templates",
+      "templates/project.md",
+      "templates/self-eval.md",
+      "templates/portal-brief.md",
+      "templates/deployment-handoff.md",
+      "helpers",
+      "helpers/README.md",
+      "skills",
+      "skills/README.md",
+      "docs",
+      "docs/governed-workspace-primitives.md",
+      "docs/adapter-contracts.md",
+      "docs/vercel-serverless-deployment.md",
+      "growthub-meta"
+    ]
+  },
+  "bundles": [
+    {
+      "id": "growthub-agency-portal-starter-v1",
+      "version": "1.0.0",
+      "path": "bundles/growthub-agency-portal-starter-v1.json"
+    }
+  ],
+  "executionMode": "export",
+  "activationModes": [
+    "export"
+  ],
+  "compatibility": {
+    "cliMinVersion": "0.4.0"
+  },
+  "provenance": {
+    "sourceRepo": "growthub-local",
+    "frozenAt": "2026-04-23T00:00:00.000Z"
+  }
+}

package/assets/worker-kits/growthub-agency-portal-starter-v1/output/README.md

@@ -0,0 +1,13 @@
+# Output Directory
+
+All artifacts produced for a given project land here at `output/<client-slug>/<project-slug>/`. This directory is intentionally empty in the starter; the agent will create the first sub-folder on its first run.
+
+Expected first-run files:
+
+- `portal-brief.md`
+- `client-onboarding-plan.md`
+- `adapter-plan.md`
+- `deployment-handoff.md`
+- `trace-summary.md`
+
+Keep generated artifacts out of `studio/` and `apps/agency-portal/` unless the user explicitly asks for implementation changes.

package/assets/worker-kits/growthub-agency-portal-starter-v1/output-standards.md

@@ -0,0 +1,25 @@
+# Agency Portal Starter — Output Standards
+
+Generated planning and implementation artifacts write to:
+
+```text
+output/<client-slug>/<project-slug>/
+```
+
+Required artifacts per production customization:
+
+- `portal-brief.md` — business requirements, client scope, data pipeline objects, and MCP integration needs.
+- `client-onboarding-plan.md` — first client setup, settings, roles, and source connection plan.
+- `adapter-plan.md` — persistence/auth/payment/reporting adapter selections.
+- `deployment-handoff.md` — local validation, Vercel root/env, GitHub/Vercel CI handoff, and bridge/BYO integration decision.
+- `trace-summary.md` — human-readable summary of governed fork events.
+
+Application source changes belong in `apps/agency-portal/` or `studio/` according to runtime surface. Do not write generated artifacts into app source directories.
+
+Every handoff must explicitly state:
+
+- whether integrations use `growthub-bridge`, `byo-api-key`, or `static`;
+- whether Windsor AI is connected through hosted authority or explicit `WINDSOR_API_KEY`;
+- which data pipeline objects are active;
+- which MCP connection integrations are active;
+- which fork id was validated with `growthub kit fork status`.

package/assets/worker-kits/growthub-agency-portal-starter-v1/runtime-assumptions.md

@@ -0,0 +1,15 @@
+# Agency Portal Starter — Runtime Assumptions
+
+- **Node**: >= v20 for Growthub CLI parity and Next.js/Vite local development.
+- **Git**: required on PATH for fork-sync and remote operations.
+- **Local-first shell**: `studio/` uses Vite + React and must remain runnable without Vercel.
+- **Cloud app**: `apps/agency-portal/` is the Vercel/serverless app payload.
+- **Persistence**: selected by `AGENCY_PORTAL_DATA_ADAPTER`, not by kit identity.
+- **Auth**: selected by `AGENCY_PORTAL_AUTH_ADAPTER`.
+- **Payments**: selected by `AGENCY_PORTAL_PAYMENT_ADAPTER`.
+- **Integrations**: selected by `AGENCY_PORTAL_INTEGRATION_ADAPTER` as `static`, `growthub-bridge`, or `byo-api-key`.
+- **Growthub bridge**: the first-party hosted path reads normalized connection state from GH app MCP authority. The starter never queries `mcp_connections` directly and never stores raw provider tokens in source.
+- **BYO API key**: supported through `AGENCY_PORTAL_BYO_CONNECTIONS_JSON` and named env vars, using the same normalized integration object shape as the bridge path.
+- **Windsor AI**: first-class data pipeline object. It is not a database adapter. Google Sheets blended data is modeled as a companion data pipeline destination.
+- **Fork registration**: exported workspaces carry `.growthub-fork/fork.json`, `policy.json`, `project.md`, and `trace.jsonl`.
+- **Bundled sources**: paths in `kit.json.frozenAssetPaths` are upstream-owned and reviewed by fork sync.

package/assets/worker-kits/growthub-agency-portal-starter-v1/setup/check-deps.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Starter kit — dependency check. Verifies the local runtime is ready.
+set -euo pipefail
+
+have() { command -v "$1" >/dev/null 2>&1; }
+
+missing=0
+for cmd in node npm git; do
+  if ! have "$cmd"; then
+    echo "  [check-deps] MISSING: $cmd"
+    missing=1
+  else
+    echo "  [check-deps] ok: $cmd ($(command -v "$cmd"))"
+  fi
+done
+
+if [ "$missing" -ne 0 ]; then
+  exit 1
+fi
+echo "  [check-deps] All prerequisites satisfied."

package/assets/worker-kits/growthub-agency-portal-starter-v1/setup/verify-env.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// Agency Portal Starter — adapter-first env verification.
+import process from "node:process";
+
+const allowed = {
+  AGENCY_PORTAL_DATA_ADAPTER: ["postgres", "qstash-kv", "provider-managed"],
+  AGENCY_PORTAL_AUTH_ADAPTER: ["oidc", "clerk", "authjs", "provider-managed"],
+  AGENCY_PORTAL_PAYMENT_ADAPTER: ["stripe", "polar", "none"],
+  AGENCY_PORTAL_INTEGRATION_ADAPTER: ["growthub-bridge", "byo-api-key", "static"],
+  AGENCY_PORTAL_DEPLOY_TARGET: ["vercel"],
+};
+
+const defaults = {
+  AGENCY_PORTAL_DATA_ADAPTER: "provider-managed",
+  AGENCY_PORTAL_AUTH_ADAPTER: "provider-managed",
+  AGENCY_PORTAL_PAYMENT_ADAPTER: "none",
+  AGENCY_PORTAL_INTEGRATION_ADAPTER: "static",
+  AGENCY_PORTAL_DEPLOY_TARGET: "vercel",
+  AGENCY_PORTAL_APP_ROOT: "apps/agency-portal",
+};
+
+let errors = 0;
+
+function value(key) {
+  return process.env[key] || defaults[key] || "";
+}
+
+function fail(message) {
+  console.error(`[verify-env] ${message}`);
+  errors += 1;
+}
+
+for (const [key, values] of Object.entries(allowed)) {
+  const actual = value(key);
+  if (!values.includes(actual)) {
+    fail(`${key} must be one of: ${values.join(", ")}`);
+  } else {
+    console.log(`[verify-env] ok: ${key}=${actual}`);
+  }
+}
+
+const dataAdapter = value("AGENCY_PORTAL_DATA_ADAPTER");
+if (dataAdapter === "postgres" && !process.env.DATABASE_URL) {
+  fail("DATABASE_URL is required when AGENCY_PORTAL_DATA_ADAPTER=postgres");
+}
+if (dataAdapter === "qstash-kv") {
+  if (!process.env.QSTASH_KV_REST_URL) fail("QSTASH_KV_REST_URL is required when AGENCY_PORTAL_DATA_ADAPTER=qstash-kv");
+  if (!process.env.QSTASH_KV_REST_TOKEN) fail("QSTASH_KV_REST_TOKEN is required when AGENCY_PORTAL_DATA_ADAPTER=qstash-kv");
+}
+
+const authAdapter = value("AGENCY_PORTAL_AUTH_ADAPTER");
+if (authAdapter === "oidc") {
+  for (const key of ["AUTH_SECRET", "AUTH_ISSUER", "AUTH_CLIENT_ID", "AUTH_CLIENT_SECRET"]) {
+    if (!process.env[key]) fail(`${key} is required when AGENCY_PORTAL_AUTH_ADAPTER=oidc`);
+  }
+}
+
+const paymentAdapter = value("AGENCY_PORTAL_PAYMENT_ADAPTER");
+if ((paymentAdapter === "stripe" || paymentAdapter === "polar") && !process.env.PAYMENT_SECRET_KEY) {
+  fail("PAYMENT_SECRET_KEY is required when a payment adapter is enabled");
+}
+
+const integrationAdapter = value("AGENCY_PORTAL_INTEGRATION_ADAPTER");
+if (integrationAdapter === "growthub-bridge") {
+  if (!process.env.GROWTHUB_BRIDGE_BASE_URL) fail("GROWTHUB_BRIDGE_BASE_URL is required when AGENCY_PORTAL_INTEGRATION_ADAPTER=growthub-bridge");
+  if (!process.env.GROWTHUB_BRIDGE_ACCESS_TOKEN) fail("GROWTHUB_BRIDGE_ACCESS_TOKEN is required when AGENCY_PORTAL_INTEGRATION_ADAPTER=growthub-bridge");
+}
+if (integrationAdapter === "byo-api-key") {
+  const raw = process.env.AGENCY_PORTAL_BYO_CONNECTIONS_JSON;
+  const hasWindsorKey = Boolean(process.env.WINDSOR_API_KEY);
+  if (!raw && !hasWindsorKey) {
+    fail("AGENCY_PORTAL_BYO_CONNECTIONS_JSON or WINDSOR_API_KEY is required when AGENCY_PORTAL_INTEGRATION_ADAPTER=byo-api-key");
+  } else {
+    if (raw) {
+      try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed) && (!parsed || typeof parsed !== "object")) {
+          fail("AGENCY_PORTAL_BYO_CONNECTIONS_JSON must be a JSON array or object");
+        }
+      } catch {
+        fail("AGENCY_PORTAL_BYO_CONNECTIONS_JSON must be valid JSON");
+      }
+    }
+  }
+}
+
+console.log(`[verify-env] app root: ${value("AGENCY_PORTAL_APP_ROOT")}`);
+console.log(`[verify-env] reporting adapter: ${process.env.AGENCY_PORTAL_REPORTING_ADAPTER || "(unset)"}`);
+console.log(`[verify-env] integration adapter: ${integrationAdapter}`);
+console.log(`[verify-env] windsor api key: ${process.env.WINDSOR_API_KEY ? "set" : "(unset)"}`);
+
+process.exit(errors > 0 ? 1 : 0);

package/assets/worker-kits/growthub-agency-portal-starter-v1/skills/README.md

@@ -0,0 +1,55 @@
+# `skills/` — nested sub-skill convention (primitive #5)
+
+A **sub-skill** is a full `SKILL.md`-addressable lane that a parent skill can spawn as a parallel sub-agent. Use sub-skills when work is:
+
+- **Heavy** — isolating the context keeps the parent lean (e.g. frame extraction, Manim render, PIL compositing).
+- **Narrow** — a specialist lane is clearer than a generalist lane (e.g. hook-library lookup, scene-module assembly).
+
+Sub-skills are **not** CLI commands and **not** capability nodes. They are local-to-the-kit Claude/Cursor/Codex skills, discovered by walking the tree.
+
+## Convention
+
+```
+skills/
+├── README.md                        # this file
+└── <slug>/                          # kebab-case; matches the SKILL.md `name`
+    ├── SKILL.md                     # frontmatter + routing body (≤ 500 lines)
+    ├── references/                  # optional — long docs loaded on demand
+    ├── templates/                   # optional — reusable text/JS templates
+    └── scripts/                     # optional — deterministic helpers
+```
+
+Each sub-skill's `SKILL.md` follows the same shape as the parent (see `@growthub/api-contract/skills::SkillManifest`):
+
+```yaml
+---
+name: <slug>
+description: <trigger + capability, <=1024 chars>
+triggers: [ ... ]
+sessionMemory:
+  path: .growthub-fork/project.md      # same fork journal — sub-skills do not branch the journal
+selfEval:
+  criteria: [ ... ]
+  maxRetries: 3
+  traceTo: .growthub-fork/trace.jsonl
+helpers: []
+mcpTools: []
+---
+```
+
+## Parallelism
+
+A parent skill spawns a sub-skill sub-agent when (a) the sub-skill's work is fully scoped by its own criteria, and (b) the parent's next step does not depend on intermediate state from the sub-skill. Each sub-skill run appends a row to the fork's `project.md::subSkillRuns` frontmatter so the parent can read the outcome on return.
+
+Example wiring:
+
+```
+creative-strategist-v1/
+└── skills/
+    └── frame-analysis/
+        └── SKILL.md   — parent delegates Step 2b (ffprobe + ffmpeg + frame read)
+```
+
+## Baseline ships zero sub-skills on purpose
+
+The starter kit carries the convention only. Individual worker kits populate `skills/` as they discover specialist lanes during operation.

package/assets/worker-kits/growthub-agency-portal-starter-v1/skills.md

@@ -0,0 +1,133 @@
+# Agency Portal Starter — Operator Runbook
+
+This runbook specializes the custom workspace starter into an agnostic agency portal worker kit.
+
+## Non-negotiable architecture
+
+1. The governed workspace is the root artifact.
+2. The Vite shell in `studio/` remains the local-first Growthub operator surface.
+3. The Vercel app lives in `apps/agency-portal/`.
+4. Persistence, auth, payments, and reporting are selected through thin adapters and environment variables.
+5. Integration state is resolved through a static local catalog or Growthub GH app MCP bridge, never by moving provider secrets into this starter.
+6. BYO API key setup is supported, but it must normalize into the same object contract as Growthub bridge output.
+7. Prior app examples are reference material only; this kit contract is defined by the governed workspace primitives and adapter model.
+
+## Capability map
+
+The portal starter must preserve these business capabilities:
+
+- Dashboard: revenue, tasks, health, and alerts.
+- Clients: profiles, contacts, status, notes, onboarding, targets.
+- Pipeline: leads, opportunities, stages, won/lost state.
+- Content: calendar, platform, owner, status.
+- Tasks: priorities, recurring templates, due dates.
+- Finance: invoices, expenses, payment state.
+- Reports: performance report generation and review.
+- Metrics: period-based agency health.
+- Operations: SOPs, links, internal docs.
+- Settings: profile, workspace, adapters, deployment.
+- Settings integrations: data sources and workspace integrations resolved through static local catalog or Growthub bridge authority.
+
+## Adapter model
+
+### Persistence
+
+Use `AGENCY_PORTAL_DATA_ADAPTER`:
+
+- `postgres` with `DATABASE_URL`
+- `qstash-kv` with `QSTASH_KV_REST_URL` and `QSTASH_KV_REST_TOKEN`
+- `provider-managed` for a hosted database surface outside the kit
+
+### Auth
+
+Use `AGENCY_PORTAL_AUTH_ADAPTER`:
+
+- `oidc`
+- `clerk`
+- `authjs`
+- `provider-managed`
+
+### Payments
+
+Use `AGENCY_PORTAL_PAYMENT_ADAPTER`:
+
+- `none`
+- `stripe`
+- `polar`
+
+### Integrations
+
+Use `AGENCY_PORTAL_INTEGRATION_ADAPTER`:
+
+- `static` for local starter catalog output.
+- `growthub-bridge` for hosted authority through the Growthub GH app MCP connection bridge.
+- `byo-api-key` for explicit workspace-owned provider setup through `AGENCY_PORTAL_BYO_CONNECTIONS_JSON`, with `WINDSOR_API_KEY` supported directly for the Windsor data pipeline object.
+
+Keep the lanes distinct:
+
+- Data sources: Windsor AI, Google Sheets blended data, Google Analytics, Shopify, Meta Facebook/Instagram.
+- Workspace integrations: Asana, Slack, GoHighLevel, Google Drive, Notion.
+
+The GH app owns user auth, provider tokens, account IDs, scopes, verification, and MCP connection metadata. The starter consumes normalized bridge output only.
+
+The normalized object mirrors the GH app integration primitive and adds worker-kit lane metadata:
+
+- `id`, `name`, `label`, `icon`
+- `provider`
+- `description`
+- `category`
+- `authType`
+- `isConnected`
+- `isActive`
+- `connectionId`
+- `connectionMetadata`
+- `lane`
+- `objectType`
+- `status`
+- `authPath`
+- `setupMode`
+
+Use `growthub-bridge` when the user has existing hosted connections. Use `byo-api-key` only when the user explicitly needs local/provider-owned setup; that path is more manual but still composable. Windsor BYO setup is intentionally direct: set `WINDSOR_API_KEY` and the Windsor AI data pipeline object renders as connected.
+
+## Real-world QA script
+
+Run these before calling the kit v1-ready:
+
+```bash
+growthub kit list --family studio --json
+growthub kit download growthub-agency-portal-starter-v1 --out /tmp/agency-portal-qa --yes
+growthub kit fork register /tmp/agency-portal-qa/growthub-agent-worker-kit-agency-portal-starter-v1
+growthub kit fork status <fork-id>
+cd /tmp/agency-portal-qa/growthub-agent-worker-kit-agency-portal-starter-v1
+bash setup/check-deps.sh
+node setup/verify-env.mjs
+cd studio && npm install && npm run build
+cd ../apps/agency-portal && npm install && npm run build
+```
+
+Then open the app and verify `/settings/integrations`.
+
+## Local-first workflow
+
+```bash
+bash setup/check-deps.sh
+node setup/verify-env.mjs
+cd studio && npm install && npm run dev
+```
+
+The local operator shell must work without cloud deployment.
+
+## Vercel workflow
+
+```bash
+cd apps/agency-portal
+npm install
+npm run dev
+npm run build
+```
+
+Vercel root directory: `apps/agency-portal`.
+
+## Self-evaluation unit
+
+The unit of work is one adapter contract change, one portal capability change, one deployment surface change, or one governed primitive change. Enforce `SKILL.md` `maxRetries: 3`.

package/assets/worker-kits/growthub-agency-portal-starter-v1/studio/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Growthub Custom Workspace Starter</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.jsx"></script>
+  </body>
+</html>