@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/plan-security-audit/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: plan-security-audit
+description: >
+  Plan-only OWASP Top 10 and Supabase-first hardening burndown. Use when
+  "security audit plan", "OWASP audit", "hardening plan", or "security
+  burndown". Auth flows → audit-auth-flows. RLS → plan-rls-audit. Keys →
+  plan-secrets-audit.
+license: MIT
+effort: high
+---
+
+# Security Audit + Hardening Plan
+
+**Degree of freedom: MIXED** — OWASP mapping and severity are judgment; RLS
+enumeration, secret scan, and `npm audit` run exactly. Stay **plan-only**.
+No patches or destructive testing.
+
+**Role:** Senior application security engineer.
+
+**Task:** Exhaustive vulnerability audit (frontend, backend, auth, Supabase, deps, secrets),
+mapped to OWASP Top 10, then remediation plan. **Audit & plan only — no code changes, no
+destructive testing.**
+
+## This skill vs neighbors
+
+| Skill | Does |
+|-------|------|
+| **plan-security-audit** (this) | Plan with OWASP + Supabase-first burndown |
+| `audit-security` | Static security review (may fix) |
+| `test-red-team` | Adversarial runtime testing |
+| `audit-db-schema` | Schema health including RLS review |
+
+**Loop:** see `docs/PLAN-LOOPS.md` — after `plan-test-coverage`, parallel with `plan-perf-audit`, before `plan-docs-sync`
+
+## How to reason (every plan item)
+
+1. **Propose** — RLS, secret rotation, auth enforcement, dep bump, or header/CSP
+2. **Risk** — data exposure, auth bypass, or a leaked key that bypasses RLS
+3. **Keep-working** — controls that already enforce server-side
+4. **Phase** — Critical → High → Med-Low (do not execute)
+
+## Worked example
+
+> **Propose:** enable RLS on `public.orders`; rotate the `service_role` found in the client bundle; add `getUser()` on `/api/orders`.
+> **Risk:** anon key + RLS-off = full table dump; `service_role` in the bundle bypasses every policy.
+> **Keep-working:** `/dashboard` layout already calls `getUser()` on the server.
+> **Phase:** Critical — RLS + secret rotation first.
+> **Report:** `lib/supabase.ts:12` service_role (type only — never the value). Table RLS detail → `plan-rls-audit`.
+
+---
+
+## ⛔ Preservation Contract
+
+Read `references/preservation-contract.md`. Acknowledge in output #1.
+
+**Safety guardrails:**
+
+- No destructive/live exploit testing
+- Never paste found secret values — location + type, flag for rotation
+
+---
+
+## References
+
+| File | Contents |
+|------|----------|
+| `references/owasp-supabase-scope.md` | OWASP map, RLS-first methodology, scans |
+| `references/output-templates.md` | Burndown, phased hardening, secrets list |
+
+---
+
+## Phase flow
+
+```
+1. Stack fingerprint
+2. RLS-first pass (Supabase MCP if available)
+3. Bundle/secret scan (no value echo)
+4. Auth-path trace
+5. Dependency CVE scan
+6. OWASP remainder (injection, headers, misconfig)
+7. Burndown + phased hardening plan
+8. Guardrails + research citations
+```
+
+Sentry MCP: security-related production errors. Firecrawl: current OWASP + Supabase patterns.
+
+Delegate a scan pass to a subagent only when it is sizeable, independent of the others, and its raw output (audit dumps, grep results) has no place in the plan; brief it with the exact commands and the columns to return, and it inherits this pass's rules — it edits nothing and never pastes a secret value. Long sweeps are expected — context compaction exists, so finish the inventory rather than wrapping up early.
+
+---
+
+## Phase 2 — RLS-first (Supabase)  [LOW freedom — run exactly]
+
+Enumerate every `public` table:
+
+- RLS enabled?
+- Policies scope rows correctly?
+- `WITH CHECK` on writes?
+- Realtime respects SELECT policies?
+
+**#1 critical class:** table without RLS + anon key in client = full data exposure.
+
+Detail: `references/owasp-supabase-scope.md`
+
+---
+
+## Phase 3 — Bundle/secret scan  [LOW freedom — run exactly]
+
+Inspect client bundle + source for:
+
+- `service_role` key (Critical — full RLS bypass)
+- Hardcoded API keys, DSNs
+- `.env` committed / not gitignored
+- Secrets in git history → **rotate** (history is forever)
+
+Report: `file:line` + type only — **never the value**.
+
+---
+
+## Phase 4–6 — Auth, deps, OWASP  [HIGH freedom]
+
+- Every protected route/endpoint → server-side enforcement?
+- `npm audit`, lockfile versions vs CVE databases — every CVE ID cited comes from scan output or an advisory lookup, never from memory
+- XSS, SQLi, SSRF, headers/CSP, rate limits
+
+Map each finding to OWASP category.
+
+---
+
+## Burndown + hardening plan  [HIGH freedom — plan only]
+
+Template: `references/output-templates.md`
+
+Phases: Critical → High → Med/Low. Each remediation + "what must keep working".
+
+Re-scan proposed after fixes (second pass).
+
+## Self-critique before the burndown  [LOW freedom — do not skip]
+
+1. **evidenced-not-assumed** — every finding cites file:line or scan output; unconfirmed → `[NEEDS VERIFICATION]`
+2. **plan-only** — no patches, no live/destructive exploit testing
+3. **severity/phase justified** — RLS-off + anon key and client `service_role` are Critical
+4. **right-owner** — table-by-table RLS → `plan-rls-audit`; key rotation → `plan-secrets-audit`; app-layer auth flows → `audit-auth-flows`; LLM attacks → `audit-llm-security`
+5. **no-false-safety** — never paste secret values; never fabricate CVEs; confirmed vuln ≠ hardening suggestion
+
+---
+
+## Required output (in order)
+
+1. Preservation-contract acknowledgment
+2. Stack fingerprint + scope
+3. Per-area finding inventory
+4. Burndown table (OWASP + evidence + severity)
+5. Hardening + enhancement plan, phased
+6. Guardrails/tooling (SCA CI, secrets manager, RLS tests)
+7. Research notes + citations
+8. Open questions / `[NEEDS VERIFICATION]` + secrets-to-rotate (locations only)
+
+End the turn with a standalone recap in chat: the two or three highest-impact confirmed findings (locations only for secrets) and the first phase to approve. The plan is the deliverable — write it before the recap.
+
+---
+
+## Rules
+
+- Plan only — no patches, no live/destructive testing.
+- Every finding cites real evidence. Unconfirmed → `[NEEDS VERIFICATION]`.
+- Never paste secret values.
+- Never fabricate CVEs or exploits.
+- Separate confirmed vulnerability vs hardening recommendation.

package/skills/plan-security-audit/references/output-templates.md

@@ -0,0 +1,36 @@
+# Output Templates
+
+## Stack fingerprint
+
+```markdown
+- DB: Supabase / Postgres / other
+- Auth: …
+- Hosting: …
+- Client: web / RN / both
+```
+
+## Finding inventory checklist
+
+| Area | RLS | Secrets | Auth | Injection | Deps | Headers | Audited |
+
+## Burndown
+
+| Area | Finding | OWASP | Evidence (path:line/config/dep@ver) | Severity | Effort | Risk-of-fix | Remediation |
+
+Severity: Critical / High / Med / Low  
+Critical = RLS-off, service_role exposed, auth bypass, data exposure
+
+Quantify: e.g. "3 tables without RLS, 1 service_role in bundle, 5 high CVE deps"
+
+## Phased hardening plan
+
+1. **Critical** — RLS-off, exposed secrets, auth bypass
+2. **High** — injection, broken access control, CVE deps
+3. **Med/Low** — headers, logging, hardening
+
+Per finding: remediation + "what must keep working"
+
+## Secrets-to-rotate list (locations only — never values)
+
+| Location | Type | Notes |
+|----------|------|-------|

package/skills/plan-security-audit/references/owasp-supabase-scope.md

@@ -0,0 +1,55 @@
+# OWASP Scope & Supabase-First Methodology
+
+## OWASP Top 10 mapping
+
+| Area | Checks |
+|------|--------|
+| A01 Access control | Missing auth, IDOR, client-only checks, admin routes, least privilege |
+| A02 Crypto / exposure | TLS, PII in logs/Sentry, sensitive client storage |
+| A03 Injection | SQLi, XSS/`dangerouslySetInnerHTML`, command injection |
+| A05 Misconfiguration | Headers, CSP, SRI, SSRF, open redirects |
+| A06 Vulnerable deps | CVEs, transitive, `npm audit`, SBOM |
+| A07 Auth/session | Session handling, rate limits on login/reset, token storage, MFA |
+
+## Supabase-specific (front-loaded — highest yield)
+
+Research pattern: majority of incidents = **tables without RLS** (anon key → full read/write/delete).
+
+| Finding class | Check |
+|---------------|-------|
+| **No RLS** | Every `public` table — RLS enabled? |
+| **service_role in client** | Bundle/source scan — full RLS bypass = Critical |
+| **Permissive RLS** | Missing `WITH CHECK`, policies don't scope rows |
+| **RPC auth** | Functions callable without auth |
+| **Realtime** | Rows beyond SELECT policy |
+| **Key usage** | anon vs authenticated; service_role server-side only |
+
+Use Supabase MCP when available: `list_tables`, policies, `get_advisors`, security advisors.
+
+## Methodology (order)
+
+1. **Fingerprint stack** — DB, auth, hosting, integrations
+2. **RLS-first pass** — enumerate public tables + policies
+3. **Bundle/secret scan** — client bundle + source for keys, service_role
+4. **Auth-path trace** — protected routes/endpoints → server-side enforcement?
+5. **Dependency scan** — versions vs CVEs, transitive
+6. **Map finding → OWASP category**
+
+## Secret scan patterns
+
+```
+Grep: "service_role|SUPABASE_SERVICE|sk_live|sk_test|api_key" glob "*.{ts,tsx,js,env*}" -i
+Grep: "dangerouslySetInnerHTML" glob "*.{tsx,jsx}"
+Grep: "eval\\(|new Function" glob "*.{ts,js}"
+```
+
+**Never echo matched secret values in output.**
+
+## Guardrails (research-backed)
+
+- RLS on every public table; test with non-owner user
+- `WITH CHECK` on writes; service_role server-side only
+- Secrets manager; rotate any ever-committed key
+- SCA in CI (Dependabot/Renovate, `npm audit`), SBOM
+- CSP/SRI/security headers, rate limiting, audit logging
+- Re-scan after remediation

package/skills/plan-security-audit/references/preservation-contract.md

@@ -0,0 +1,18 @@
+# Preservation Contract
+
+## Never do in this pass
+
+- **Fabricate** vulnerabilities, CVEs, or exploit claims. Unconfirmed → `[NEEDS VERIFICATION]`.
+- **Destructive testing** — no live exploits, table drops, prod data mutation.
+- **Paste secret values** in output — location (`file:line`) + type only. Flag for rotation (git history is forever).
+- **Remove features/code** unilaterally to "fix" security.
+- **Patch** in this pass. Remediations proposed on approval.
+
+## Before any change proposal
+
+One line: **what currently works here that must keep working** (especially auth flows).
+
+## Buckets
+
+- **Confirmed vulnerability** — evidence in path:line/config/dep version
+- **Hardening recommendation** — best practice, not proven exploitable

package/skills/plan-stub-checker/SKILL.md

@@ -0,0 +1,216 @@
+---
+name: plan-stub-checker
+description: >
+  Plan-only sweep for stubs, dead buttons, fake components, unwired handlers,
+  and dead links, then a wiring plan. Use when "find dead buttons", "stub
+  checker", "fake components", "unwired handlers", or "dead links".
+license: MIT
+effort: high
+---
+
+# Stub, Dead-Link & Fake-Component Checker + Wiring Plan
+
+**Degree of freedom: MIXED** — wiring plan is judgment; detection
+passes and MCP/live probes run exactly. Stay **plan-only**. No wiring until approved.
+
+**Role:** Senior full-stack engineer + reliability auditor.
+
+**Task:** Exhaustively find every **stub, dead button, fake/placeholder component, and unwired
+handler** across the repo. Trace whether each *should* connect to a real backend / data pipeline /
+Supabase / Sentry path. Produce a burndown + wiring plan. **Audit & plan only — do not implement.**
+
+## This skill vs neighbors
+
+| Skill | Does |
+|-------|------|
+| **plan-stub-checker** (this) | Plan only — inventory, burndown, wiring roadmap |
+| `debug-fe-be-integration` | Diagnose and fix FE-BE mismatches |
+| `audit-fe-api` | Audit API calls vs backend contracts |
+| `test-qa` | Live QA — may find dead buttons during crawl |
+| `debug-sentry-monitor` | Triage production Sentry errors |
+| `workflow-fix-and-ship` | Fix → verify → PR after you approve |
+
+**Chain:** `plan-stub-checker` → approval → `plan-test-coverage` → … see `docs/PLAN-LOOPS.md`  
+**Execute:** `debug-fe-be-integration` / `workflow-fix-and-ship` → `test-playwright`
+
+## How to reason (every plan item)
+
+1. **Propose** — wiring, target, contract, or instrumentation gap
+2. **Risk** — silent failure, dead control, or a fabricated target
+3. **Keep-working** — already-wired controls and live data paths
+4. **Phase** — silent-failure P0 → mock-to-live → orphan → instrumentation (do not execute)
+
+## Worked example
+
+> **Propose:** wire Settings → Export to the existing `POST /api/export` action; add loading/error/empty.
+> **Risk:** `onClick={() => {}}` — user thinks export ran; no request, no error.
+> **Keep-working:** Settings → Save profile already hits the server action.
+> **Phase:** Phase 1 — silent-failure P0.
+> **Cite:** `app/settings/page.tsx:84`. Missing action → `[NEEDS REAL TARGET]`.
+
+---
+
+## ⛔ Preservation Contract
+
+Read `references/preservation-contract.md` before Phase 1.
+
+**Acknowledge in output #1** — restate what you will NOT do:
+
+- No removal of features/routes/screens/handlers/props
+- No fabricated endpoints, tables, env keys, or DSNs
+- Every claim cites file path + line
+- Preserve I/O boundaries unless wiring is proposed + approved
+- No silent breaking changes
+- **Plan, don't build**
+
+---
+
+## References
+
+| File | Contents |
+|------|----------|
+| `references/detection-taxonomy.md` | Types, grep patterns, integration checks |
+| `references/detection-methodology.md` | Six-pass methodology + linkage tracing |
+| `references/output-templates.md` | Burndown, inventory, phased plan templates |
+
+---
+
+## Phase flow
+
+```
+1. Auto-detect stack (routes, data layer, integrations)
+2. Entry-point + static analysis sweep
+3. Handler-binding + data-flow trace
+4. False-positive filter (dynamic invocation pass)
+5. Integration linkage (API, Supabase, Sentry, pipeline)
+6. Burndown + phased wiring plan
+7. Research + guardrails (current year)
+```
+
+---
+
+## Phase 1 — Auto-detect stack  [HIGH freedom]
+
+Read `package.json` and config:
+
+| Signal | Layer |
+|--------|-------|
+| `@supabase/supabase-js` | Supabase — find `createClient`, `supabase/migrations` |
+| `@sentry/*` | Sentry — find init, instrumentation config |
+| `react-query` / `@tanstack/react-query` | Data fetching |
+| `next/server` actions | Server actions |
+| `trpc` / `graphql` | API style |
+
+Record: route manifest paths, API client location, env example file.
+
+---
+
+## Phase 2–4 — Detection passes  [LOW freedom — run exactly]
+
+Execute all passes in `references/detection-methodology.md`:
+
+1. Entry-point trace (reachable vs orphan candidates)
+2. Static analysis (unused exports, dead branches)
+3. Handler-binding (every interactive control → real effect?)
+4. Data-flow (display components → live source?)
+5. **Dynamic-invocation filter** — uncertain → `Review required`
+6. Config/env trace (integrations actually initialized?)
+
+Taxonomy: `references/detection-taxonomy.md`
+
+Keep **Confirmed** vs **Review required** separate.
+
+Optional live click pass: `protocol-browser-anti-stall` + your own named session (`-s=…`) before playwright-cli.
+
+Delegate a detection pass to a subagent only when it is sizeable, independent of the others, and its raw output (grep dumps, route manifests) has no place in the plan; brief it with the exact commands and the columns to return. It edits nothing, like this pass. Long sweeps are expected — context compaction exists, so finish the inventory rather than wrapping up early.
+
+---
+
+## Phase 5 — Backend / pipeline / integration linkage  [HIGH freedom]
+
+For every stub that *should* be live, map:
+
+- **API:** endpoint or server action — exists? contract? auth? → `[NEEDS REAL TARGET]` if missing
+- **Pipeline:** ingest → transform → store → read — which hop is broken?
+- **Supabase:** client role, table/view, **RLS** (missing = silent break or leak), types, realtime
+- **Sentry:** instrumented? swallowed catches? context/tags/release/env/source maps/PII
+- **Analytics / flags / i18n:** real sink, flag resolution, key resolution
+
+Use MCP when available:
+
+| MCP | Use |
+|-----|-----|
+| Supabase | `list_tables`, policies, advisors — verify tables/RLS exist |
+| Sentry | Production errors on related routes — swallowed failures |
+| Firecrawl | Current-year Supabase RLS + Sentry instrumentation patterns |
+| Playwright | Click dead-looking controls; observe network/nav |
+
+Never invent table names or endpoints.
+
+---
+
+## Phase 6 — Burndown + wiring plan  [HIGH freedom — plan only]
+
+Burndown columns:
+
+`Surface | Element | Type | Classification | Intended target | Wiring gap | Severity P0–P3 | Effort S/M/L | Risk | File:line`
+
+Group by page/screen. Quantify totals.
+
+**Phased wiring plan:**
+
+1. **Silent-failure P0s** — dead controls, swallowed errors, missing RLS
+2. **Mock → live data** — replace fixtures with real queries
+3. **Orphan cleanup** — proposals only, dependency checks
+4. **Instrumentation gaps** — Sentry, analytics, loading/error/empty states
+
+Per confirmed stub: proposed wiring (target, contract, auth, states) + one-line "what must keep working."
+
+**Industry-standard enhancements** (cite current year via Firecrawl):
+
+- Typed Supabase client + generated types; RLS on every public table; test as non-owner
+- Replace empty `catch` with handling + Sentry capture; breadcrumbs/tags/release
+- Loading/error/empty UI for every newly-wired data path
+- Guardrails: lint empty handlers, CI orphan/mock checks, PR checklist
+
+Each phase independently reviewable + revertible.
+
+## Self-critique before the burndown  [LOW freedom — do not skip]
+
+1. **evidenced-not-assumed** — every stub cites file:line; no invented endpoints
+2. **plan-only** — no wiring, no handler edits, no fabricated tables
+3. **severity/phase justified** — silent-failure and missing RLS are P0, not polish
+4. **right-owner** — empty/error rendering of a wired control → `audit-ui-states`; live QA crawl → `test-qa`
+5. **no-false-safety** — `Review required` stays uncertain until the dynamic-invocation pass
+
+---
+
+## Required output (in order)
+
+1. Preservation-contract acknowledgment
+2. Detection taxonomy results (counts per type)
+3. Per-surface stub/dead/fake inventory (checklist — nothing skipped)
+4. Burndown table (classification + intended-target + risk)
+5. Backend/Supabase/Sentry/pipeline linkage map
+6. Wiring + enhancement plan, phased
+7. Guardrails / tooling recommendations
+8. Research notes + citations
+9. Open questions / `[NEEDS REAL TARGET]` list
+
+Deliver as markdown or canvas for large repos, then end the turn with a standalone recap in chat: the two or three highest-impact stubs and the first phase to approve. The document is the deliverable — write it before the recap. **Do not implement wiring** unless user approves in a follow-up.
+
+---
+
+## Rules
+
+- **Plan only — do not implement.** User approves before wiring.
+- **Trace before flagging** (entry-point + dynamic-invocation pass).
+- **Never fabricate** endpoints, tables, env, or behavior.
+- Missing target/integration/env → say so, don't guess.
+- Before proposing any file change: one line on what must keep working.
+
+## Related
+
+- `audit-ui-states` — empty/error/offline rendering (wired controls that still look broken)
+- `debug-fe-be-integration` / `audit-fe-api` / `test-qa` / `workflow-fix-and-ship`
+

package/skills/plan-stub-checker/references/detection-methodology.md

@@ -0,0 +1,75 @@
+# Detection Methodology
+
+Run all six passes. **Trace before flagging** — conservative on deletion, aggressive on finding.
+
+## 1. Entry-point trace
+
+From routes / `main` / app root, trace reachable components + handlers.
+
+```
+Glob: **/app/**/page.{tsx,jsx}
+Glob: **/routes/**/*.{tsx,jsx}
+Glob: **/screens/**/*.{tsx,jsx}
+Glob: **/navigation/**/*.{tsx,jsx}
+```
+
+Unreached exports/components = **orphan** candidates (not confirmed until pass 5).
+
+## 2. Static analysis
+
+Trace imports, calls, instantiations, references, exports.
+
+- Never-called functions after export
+- Code after unconditional `return`
+- Impossible branches
+- Unused exports (`grep` + import graph)
+
+## 3. Handler-binding check
+
+Every interactive element → does handler reach a real effect (network / state / nav)?
+
+Empty, `console.log`, or mock-only → **stub** or **dead-btn**.
+
+Optional Playwright pass: read `protocol-browser-anti-stall` + session coordination; click controls, confirm no network/nav effect.
+
+## 4. Data-flow check
+
+Every data-displaying component → trace source to query/fetch/prop chain.
+
+Hardcoded/mock/fixture in prod path → **fake** or **unwired-data**.
+
+```
+Grep: "useQuery|useMutation|fetch\\(|axios\\.|supabase\\.from" glob "*.{tsx,jsx}"
+```
+
+## 5. Dynamic-invocation filter (false-positive pass)
+
+Before confirming dead/orphan, rule out:
+
+- Event handlers registered at runtime
+- Callback props from parents
+- String-based / reflection calls
+- Feature-flag-gated code paths
+- Registry / plugin / inheritance patterns
+
+**Uncertain → `Review required`, not `Confirmed`.**
+
+## 6. Config / env trace
+
+```
+Glob: **/.env.example **/env.{ts,js}
+Grep: "createClient|@sentry|Sentry\\.init|analytics" glob "*.{ts,tsx}"
+```
+
+Confirm referenced integrations have client init + env wiring. Missing → **severed**.
+
+## Backend / pipeline linkage
+
+For each stub that *should* be live, map:
+
+- Intended endpoint or server action — exists? contract? auth?
+- Data pipeline hop (ingest → transform → store → read) — which hop is broken?
+- Supabase table + RLS — use Supabase MCP `list_tables`, `pg_policies` when available
+- Sentry — use Sentry MCP for production errors on related paths when available
+
+Missing target → `[NEEDS REAL TARGET]` — never invent.

package/skills/plan-stub-checker/references/detection-taxonomy.md

@@ -0,0 +1,34 @@
+# Detection Taxonomy
+
+Flag and classify each finding by **type**:
+
+| Type | Signals |
+|------|---------|
+| **dead-btn** | `onClick`/`onPress` missing, `() => {}`, `console.log`, `// TODO`, `alert("coming soon")`, `href="#"`, `disabled` with no enable path, nav to non-existent route |
+| **stub** | Handler returns hardcoded/mock, `throw new Error("not implemented")`, `return null` placeholder, empty `try/catch`, early `return` skipping real logic |
+| **fake** | Static/mock/seed data in prod UI, hardcoded arrays, lorem, `mockData`, fixture imports in prod bundle, skeleton that never resolves |
+| **unwired-data** | UI expects data but no fetch/query; form submits nowhere; mutation without backend; optimistic update with no server call |
+| **dead-link** | Link/redirect to undefined route, 404 target, orphaned page with no inbound nav |
+| **orphan** | Exported but never imported/mounted |
+| **severed** | Supabase/Sentry/analytics referenced but client uninitialized, env missing, or disabled flag |
+
+## Static grep patterns (adapt to stack)
+
+```
+Grep: "not implemented|NOT_IMPLEMENTED|coming soon|TODO:" glob "*.{ts,tsx,js,jsx}" -i
+Grep: "onClick=\\{\\s*\\(\\)\\s*=>\\s*\\{\\s*\\}" glob "*.{tsx,jsx}"
+Grep: "onClick=\\{console\\.log" glob "*.{tsx,jsx}"
+Grep: "href=[\"']#[\"']" glob "*.{tsx,jsx}"
+Grep: "mockData|MOCK_|fixture|lorem ipsum" glob "*.{ts,tsx}" -i
+Grep: "catch\\s*\\(\\s*\\)\\s*\\{\\s*\\}" glob "*.{ts,tsx}"
+Grep: "catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}" glob "*.{ts,tsx}"
+```
+
+## Integration wiring checks
+
+| Integration | Verify |
+|-------------|--------|
+| **Supabase** | Client init (anon vs service_role — never service_role client-side); table/view exists; RLS on public tables; typed client; realtime respects RLS; errors not swallowed |
+| **Sentry** | SDK initialized; empty catches aren't hiding failures; context/tags/breadcrumbs; release/env; source maps; no PII leakage |
+| **API / server actions** | Endpoint exists; request/response contract; auth |
+| **Analytics / flags / i18n** | Events reach real sink; flag-gated stubs have resolution path; i18n keys resolve |

package/skills/plan-stub-checker/references/output-templates.md

@@ -0,0 +1,63 @@
+# Output Templates
+
+## Taxonomy counts (output #2)
+
+```markdown
+| Type | Confirmed | Potential | Review required |
+|------|-----------|-----------|-----------------|
+| dead-btn | … | … | … |
+| stub | … | … | … |
+| fake | … | … | … |
+| unwired-data | … | … | … |
+| dead-link | … | … | … |
+| orphan | … | … | … |
+| severed | … | … | … |
+```
+
+## Per-surface inventory checklist
+
+| Surface | dead-btn | stub | fake | unwired | dead-link | orphan | severed | Audited |
+|---------|----------|------|------|---------|-----------|--------|---------|---------|
+
+## Burndown table
+
+| Surface | Element | Type | Classification | Intended target | Wiring gap | Severity | Effort | Risk | File:line |
+|---------|---------|------|----------------|-----------------|------------|----------|--------|------|-----------|
+
+**Severity:** P0 = looks functional but does nothing / silent data loss / swallowed errors · P3 = cosmetic placeholder behind flag  
+**Intended target:** backend / Supabase / Sentry / pipeline / none  
+**Quantify:** e.g. "12 dead buttons, 7 mock-data components, 3 missing RLS policies"
+
+## Linkage map (output #5)
+
+```markdown
+### [Surface / feature]
+- UI element: …
+- Intended: Supabase `public.orders` SELECT via RLS
+- Gap: no RLS policy for anon; fetch uses hardcoded mock
+- Sentry: errors swallowed in empty catch at …
+```
+
+## Phased wiring plan
+
+```markdown
+### Phase 1 — Silent-failure P0s
+Dead controls, swallowed errors, missing RLS
+
+### Phase 2 — Mock → live data
+Replace fixtures with real queries/mutations
+
+### Phase 3 — Orphan cleanup (proposals only)
+Unused exports with dependency check
+
+### Phase 4 — Instrumentation gaps
+Sentry, analytics, loading/error/empty states
+```
+
+## Guardrails checklist
+
+- [ ] Lint: empty handlers, `href="#"`, `not implemented`
+- [ ] CI: orphaned exports, mock-data imports in prod paths
+- [ ] PR checklist: "no dead controls shipped"
+- [ ] Typed Supabase client + generated types
+- [ ] RLS test with non-owner user