@next-friday/create-app 2.1.9 → 4.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.9",
+  "version": "4.0.0",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.agents/agents.json

@@ -0,0 +1,7 @@
+{
+  "verifier": {
+    "description": "Runs the app and checks the change works before the session reports done",
+    "readonly": true,
+    "tools": ["Bash", "Read"]
+  }
+}

package/templates/base/.agents/hooks/agent-format-after-edit.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+input=$(cat)
+cd "${CLAUDE_PROJECT_DIR:-${CURSOR_PROJECT_DIR:-$PWD}}" || exit 0
+path=$(jq -r '.tool_input.file_path // .tool_input.notebook_path // .file_path // empty' <<< "$input")
+[[ -n $path && -f $path ]] || exit 0
+
+case $path in
+  *.ts | *.tsx | *.js | *.jsx | *.mjs | *.cjs)
+    pnpm exec eslint --fix --cache --max-warnings=0 --no-warn-ignored --no-inline-config "$path" > /dev/null 2>&1
+    ;;
+esac
+pnpm exec prettier --write --cache --ignore-unknown "$path" > /dev/null 2>&1
+exit 0

package/templates/base/.agents/hooks/agent-production-gate.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Production deploys require a named release authorization
+cmd=$(jq -r '.tool_input.command // .command' < /dev/stdin)
+if [[ "$cmd" == *"deploy"* && "$cmd" == *"production"* ]]; then
+  if [ -z "$RELEASE_APPROVAL" ]; then
+    echo "Production deploys need a release authorization." >&2
+    exit 2 # exit 2 blocks the action; the message goes to Claude
+  fi
+fi
+exit 0

package/templates/base/.agents/hooks/agent-test-edit-gate.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"permission":"allow"}'
+  exit 0
+}
+
+block() {
+  jq -n --arg message "$1" '{permission:"deny",user_message:$message,agent_message:$message}'
+  printf 'agent-test-edit-gate: %s\n' "$1" >&2
+  exit 2
+}
+
+trap 'block ".agents/hooks/agent-test-edit-gate.sh failed. Stop and report this error to the user; agents may not edit the gate."' ERR
+command -v jq > /dev/null || block "jq is required to read the hook input. Install it: https://jqlang.org/download/"
+input=$(cat)
+project=${CLAUDE_PROJECT_DIR:-${CURSOR_PROJECT_DIR:-$PWD}}
+[[ -e "$project/.git/bug-fix-in-progress" ]] || allow
+path=$(jq -r '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // .file_path // empty' <<< "$input")
+[[ -n $path ]] || allow
+if [[ $path =~ (\.test\.|\.spec\.|\.e2e\.test\.|(^|/)tests?/) ]]; then
+  block "A bug fix is in progress (.git/bug-fix-in-progress), so $path cannot change. Fix the code, not the test."
+fi
+allow

package/templates/base/.agents/review.md

@@ -0,0 +1,21 @@
+# Review instructions
+
+## Passes
+
+Run three passes and tag each finding with its pass:
+
+- Bugs: logic errors, broken edge cases, subtle regressions
+- Security: injection risks, authentication gaps, PII in logs
+- Compliance: the change matches spec.md, plan.md and our design principles
+
+## What Important means here
+
+Reserve Important for findings that would break behavior, leak data or breach a policy. Style and naming are nits.
+
+## Cap the nits
+
+Report at most five nits per review; summarize the rest as a count.
+
+## Do not report
+
+Generated files under src/gen/ and anything CI already enforces.

package/templates/base/.agents/rules/no-suppression.md

@@ -2,6 +2,6 @@
 
 Fix what a linter, type checker, or scanner reports, including the replacement it suggests. Comments a tool requires follow `code-comments.md`.
 
-Record an accepted risk only in that tool's central file, with an owner, a reason, and an expiry date: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
+Record an accepted risk only in that tool's central file, with an owner and a reason: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
 
 When a finding looks wrong, stop and cite the tool's documentation to the user. Report a finding as fixed only when the tool passes, with any accepted risk in that central file.

package/templates/base/.agents/skills/babysit-pr/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: babysit-pr
+description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+---
+
+# Babysit a pull request
+
+Sweep the unresolved review comments and failing checks on the pull request, address them, and push the fixes. Repeat until the pull request is green and waiting only on code owner approval. Never approve or merge it.

package/templates/base/.agents/skills/brand-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: brand-policy
+description: Apply the organization's brand policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Brand policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/compliance-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: compliance-policy
+description: Apply the organization's compliance policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Compliance policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/{.cursor/rules/git-workflow.mdc → .agents/skills/git-workflow/SKILL.md}

@@ -1,6 +1,6 @@
 ---
-description: "Git workflow: trunk-based branches, commits, and pull requests"
-alwaysApply: true
+name: git-workflow
+description: Trunk-based branches, commits, and pull requests. Use when creating a branch, committing, pushing, or opening, updating, or merging a pull request.
 ---
 
 # Git Workflow

package/templates/base/{.cursor/rules/script-driven-changes.mdc → .agents/skills/script-driven-changes/SKILL.md}

@@ -1,6 +1,6 @@
 ---
-description: "Scripts: apply a repeated edit across many files with a script"
-alwaysApply: true
+name: script-driven-changes
+description: Change many files with a script, not by hand. Use when a change repeats one pattern across more than a few files, or needs a one-off script.
 ---
 
 # Scripts

package/templates/base/.agents/skills/security-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: security-policy
+description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Security policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/ux-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: ux-policy
+description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# UX policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/write-intent/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: write-intent
+description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+---
+
+# Write intent.md
+
+1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
+2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
+3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
+4. Ask the originator to correct anything you misunderstood.
+5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by closing it.
+
+## Template
+
+```markdown
+# Intent: <title>
+
+Author: <name> (<team>). Status: draft.
+
+## Problem
+
+## Proposed outcome
+
+## Affected users and systems
+
+## Constraints
+
+## Open questions
+```

package/templates/base/.agents/skills/write-spec/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: write-spec
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+---
+
+# Write spec.md
+
+Read the `intent.md` the user names, and follow this prompt:
+
+> Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
+
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.

package/templates/base/.claude/managed-settings.example.json

@@ -0,0 +1,26 @@
+{
+  "permissions": {
+    "deny": ["Read(.env*)", "Read(./secrets/**)", "WebFetch", "Bash(curl *)", "Bash(wget *)"],
+    "allow": ["Bash(git *)", "Bash(make build)", "Bash(make test)", "Bash(make lint)"],
+    "disableBypassPermissionsMode": "disable"
+  },
+  "allowManagedPermissionRulesOnly": true,
+  "sandbox": {
+    "enabled": true,
+    "failIfUnavailable": true,
+    "allowUnsandboxedCommands": false,
+    "network": {"allowedDomains": ["git.internal.example.com", "registry.npmjs.org"]},
+    "credentials": {
+      "files": [
+        {"path": "~/.ssh", "mode": "deny"},
+        {"path": "~/.aws/credentials", "mode": "deny"}
+      ],
+      "envVars": [{"name": "GITHUB_TOKEN", "mode": "deny"}]
+    }
+  },
+  "allowManagedHooksOnly": true,
+  "disableSideloadFlags": true,
+  "allowManagedMcpServersOnly": true,
+  "strictKnownMarketplaces": [{"source": "github", "repo": "example-corp/approved-plugins"}],
+  "requiredMinimumVersion": "2.1.193"
+}

package/templates/base/.claude/settings.json

@@ -1,6 +1,15 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
+    "defaultMode": "plan",
+    "allow": [
+      "Bash(git *)",
+      "Bash(pnpm build)",
+      "Bash(pnpm test)",
+      "Bash(pnpm test:coverage)",
+      "Bash(pnpm verify:static)",
+      "Bash(pnpm verify)"
+    ],
     "deny": [
       "Edit(./.agents/rules/**)",
       "Edit(./.claude/rules/**)",
@@ -45,6 +54,12 @@
             "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-suppression-gate.sh",
             "timeout": 10,
             "onFailure": "block"
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-test-edit-gate.sh",
+            "timeout": 10,
+            "onFailure": "block"
           }
         ]
       },
@@ -56,6 +71,22 @@
             "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-shell-gate.sh",
             "timeout": 10,
             "onFailure": "block"
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-production-gate.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-format-after-edit.sh"
           }
         ]
       }

package/templates/base/.claude/skills/babysit-pr/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: babysit-pr
+description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+---
+
+# Babysit a pull request
+
+Sweep the unresolved review comments and failing checks on the pull request, address them, and push the fixes. Repeat until the pull request is green and waiting only on code owner approval. Never approve or merge it.

package/templates/base/.claude/skills/brand-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: brand-policy
+description: Apply the organization's brand policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Brand policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/compliance-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: compliance-policy
+description: Apply the organization's compliance policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Compliance policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/{.agents/rules/git-workflow.md → .claude/skills/git-workflow/SKILL.md}

@@ -1,3 +1,8 @@
+---
+name: git-workflow
+description: Trunk-based branches, commits, and pull requests. Use when creating a branch, committing, pushing, or opening, updating, or merging a pull request.
+---
+
 # Git Workflow
 
 The repository uses trunk-based development.

package/templates/base/{.agents/rules/script-driven-changes.md → .claude/skills/script-driven-changes/SKILL.md}

@@ -1,3 +1,8 @@
+---
+name: script-driven-changes
+description: Change many files with a script, not by hand. Use when a change repeats one pattern across more than a few files, or needs a one-off script.
+---
+
 # Scripts
 
 When a change repeats one pattern across more than a few files, run a script. Derive facts from the toolchain (TypeScript compiler API, `git`), not by reading files by eye. Edit by hand when the change needs judgment in one place.

package/templates/base/.claude/skills/security-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: security-policy
+description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Security policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/ux-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: ux-policy
+description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# UX policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/write-intent/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: write-intent
+description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+---
+
+# Write intent.md
+
+1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
+2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
+3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
+4. Ask the originator to correct anything you misunderstood.
+5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by closing it.
+
+## Template
+
+```markdown
+# Intent: <title>
+
+Author: <name> (<team>). Status: draft.
+
+## Problem
+
+## Proposed outcome
+
+## Affected users and systems
+
+## Constraints
+
+## Open questions
+```

package/templates/base/.claude/skills/write-spec/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: write-spec
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+---
+
+# Write spec.md
+
+Read the `intent.md` the user names, and follow this prompt:
+
+> Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
+
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.

package/templates/base/.cursor/BUGBOT.md

@@ -2,6 +2,7 @@
 
 Review pull requests against the project's agent guide and rules:
 
+- [Review instructions](../.agents/review.md)
 - [Agent guide](../AGENTS.md)
 - [Agent-Owned Work](../.agents/rules/agent-owned-work.md)
 - [Owned Checks](../.agents/rules/automation-owned-checks.md)
@@ -15,10 +16,10 @@ Review pull requests against the project's agent guide and rules:
 - [Test Admission](../.agents/rules/deterministic-testing.md)
 - [Diagnostics](../.agents/rules/diagnostics-and-error-handling.md)
 - [Evidence](../.agents/rules/evidence-before-claims.md)
-- [Git Workflow](../.agents/rules/git-workflow.md)
+- [Git Workflow](../.agents/skills/git-workflow/SKILL.md)
 - [Findings](../.agents/rules/no-suppression.md)
 - [Platform and Library First](../.agents/rules/platform-and-library-first.md)
-- [Scripts](../.agents/rules/script-driven-changes.md)
+- [Scripts](../.agents/skills/script-driven-changes/SKILL.md)
 - [Sibling Style](../.agents/rules/single-author-style.md)
 - [Logging](../.agents/rules/structured-logging.md)
 - [TypeScript-First](../.agents/rules/typescript-first.md)

package/templates/base/.cursor/hooks.json

@@ -13,6 +13,12 @@
         "matcher": "Write|StrReplace|Delete",
         "timeout": 10,
         "failClosed": true
+      },
+      {
+        "command": ".agents/hooks/agent-test-edit-gate.sh",
+        "matcher": "Write|StrReplace",
+        "timeout": 10,
+        "failClosed": true
       }
     ],
     "beforeShellExecution": [
@@ -20,6 +26,15 @@
         "command": ".agents/hooks/agent-shell-gate.sh",
         "timeout": 10,
         "failClosed": true
+      },
+      {
+        "command": ".agents/hooks/agent-production-gate.sh",
+        "timeout": 10
+      }
+    ],
+    "afterFileEdit": [
+      {
+        "command": ".agents/hooks/agent-format-after-edit.sh"
       }
     ]
   }

package/templates/base/.cursor/rules/no-suppression.mdc

@@ -7,6 +7,6 @@ alwaysApply: true
 
 Fix what a linter, type checker, or scanner reports, including the replacement it suggests. Comments a tool requires follow `code-comments.md`.
 
-Record an accepted risk only in that tool's central file, with an owner, a reason, and an expiry date: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
+Record an accepted risk only in that tool's central file, with an owner and a reason: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
 
 When a finding looks wrong, stop and cite the tool's documentation to the user. Report a finding as fixed only when the tool passes, with any accepted risk in that central file.

package/templates/base/.cursor/skills/babysit-pr/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: babysit-pr
+description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+---
+
+# Babysit a pull request
+
+Sweep the unresolved review comments and failing checks on the pull request, address them, and push the fixes. Repeat until the pull request is green and waiting only on code owner approval. Never approve or merge it.

package/templates/base/.cursor/skills/brand-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: brand-policy
+description: Apply the organization's brand policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Brand policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/compliance-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: compliance-policy
+description: Apply the organization's compliance policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Compliance policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/git-workflow/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: git-workflow
+description: Trunk-based branches, commits, and pull requests. Use when creating a branch, committing, pushing, or opening, updating, or merging a pull request.
+---
+
+# Git Workflow
+
+The repository uses trunk-based development.
+
+- Branch from the latest `origin/main`, in a worktree or a new branch named `<type>/<short-description>`. `main` is the only long-lived branch. The Git hooks block commits and pushes on it, except the first commit and push that create `main` in a new repository.
+- Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. The `commit-msg` hook rejects anything else.
+- When work ends in a pull request, push its branch and open the pull request ready for review without asking. CI skips drafts. Work that does not end in one, such as an investigation or a prototype, opens none.
+- Fill the pull request body from `.github/pull_request_template.md`.
+- After you open a pull request, report its URL and continue. Drive it to merge-ready only when the user asks, and watch the checks with `gh pr checks --watch`. Merge only when the user asks to merge, land, or ship. Merge with `--squash`, bottom-up for a stack.
+- Rebase and `git push --force-with-lease` only branches you own.

package/templates/base/.cursor/skills/script-driven-changes/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: script-driven-changes
+description: Change many files with a script, not by hand. Use when a change repeats one pattern across more than a few files, or needs a one-off script.
+---
+
+# Scripts
+
+When a change repeats one pattern across more than a few files, run a script. Derive facts from the toolchain (TypeScript compiler API, `git`), not by reading files by eye. Edit by hand when the change needs judgment in one place.
+
+Commit a script when a reviewer needs to rerun it or when the work outlives the session, and add it as a `package.json` script so knip counts it as an entry. Keep any other one-off script in a temporary directory outside the repository, and remove a committed script when its workflow ends. Fail on unmapped input. Back up before a destructive run.
+
+Print summaries: counts, first errors. Verify what owned checks omit, such as the running app.

package/templates/base/.cursor/skills/security-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: security-policy
+description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Security policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/ux-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: ux-policy
+description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# UX policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/write-intent/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: write-intent
+description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+---
+
+# Write intent.md
+
+1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
+2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
+3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
+4. Ask the originator to correct anything you misunderstood.
+5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by closing it.
+
+## Template
+
+```markdown
+# Intent: <title>
+
+Author: <name> (<team>). Status: draft.
+
+## Problem
+
+## Proposed outcome
+
+## Affected users and systems
+
+## Constraints
+
+## Open questions
+```

package/templates/base/.cursor/skills/write-spec/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: write-spec
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+---
+
+# Write spec.md
+
+Read the `intent.md` the user names, and follow this prompt:
+
+> Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
+
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.