create-ailk 0.24.0 → 0.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ailk",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Scaffolder for AI Launch Kit — `pnpm create ailk@latest <dir>` produces a starter repo consuming @working-theory/* from npm (per ADR 0007).",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "tar": "^7.5.21"
   },
   "devDependencies": {
-    "@working-theory/schema": "0.45.0",
-    "@working-theory/templates": "0.45.0"
+    "@working-theory/schema": "0.48.0",
+    "@working-theory/templates": "0.48.0"
   },
   "repository": {
     "type": "git",

package/release-scope.json

@@ -17,9 +17,9 @@
     "docs-blog": "released",
     "scheduling": "released",
     "signal-collectors": "released",
-    "workspace": "gated",
+    "workspace": "released",
     "multi-tenant": "gated",
     "commerce": "gated"
   },
-  "levels": { "free": "released", "pro": "released", "pro-plus": "gated" }
+  "levels": { "free": "deferred", "pro": "released", "pro-plus": "gated" }
 }

package/site-templates/marketing-site/TEMPLATE-MANIFEST.json

@@ -1,6 +1,12 @@
 {
   "template": "marketing-site",
-  "requires": ["marketing", "docs-blog", "scheduling", "signal-collectors"],
+  "requires": [
+    "marketing",
+    "docs-blog",
+    "scheduling",
+    "signal-collectors",
+    "workspace"
+  ],
   "categories": [
     "accounting",
     "legal",
@@ -17,7 +23,7 @@
   ],
   "shape": "organization-product",
   "design": "standard",
-  "generatedHash": "f4a8f11aba42a071794585c4563015bd1c99cbe6917a36ee0629d37c6f5f476c",
+  "generatedHash": "d58492d416674a21b1358858d285b7050d14618f5e2bed2f0ae20bdbc5267d5a",
   "layout": {
     "nav": "full",
     "footer": "columns",

package/site-templates/marketing-site/TEMPLATE-MANIFEST.md

@@ -6,7 +6,7 @@
 | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Template               | `marketing-site`                                                                                                                                                                                                                                                                                                                                                     |
 | Level                  | Pro                                                                                                                                                                                                                                                                                                                                                                  |
-| `requires`             | `[marketing, docs-blog, scheduling, signal-collectors]` (spec 5462 D12/D15, settled by Sam 2026-09-14)                                                                                                                                                                                                                                                               |
+| `requires`             | `[marketing, docs-blog, scheduling, signal-collectors, workspace]` (spec 5462 D12/D15, settled by Sam 2026-09-14; `workspace` since #9696)                                                                                                                                                                                                                           |
 | Delivery               | licence-checked module bundle (#5441); never in the Free tarball. Composed base → modules → template (#5618): `/pricing`, `/privacy`, `/terms` arrive from the `_base` layer it `extends`, every module sample from the docs-blog and signal-collectors bundles its `requires` names, and this tree ships one copy override (blog post 05 onto `launching-ailk.mdx`) |
 | Sample content posture | every sample report, post and flow in the demo is **public**                                                                                                                                                                                                                                                                                                         |
 
@@ -513,7 +513,7 @@ Everything in the Free manifest § 2a applies. Pro adds:
 
 ```
 marketing-site:
-  requires: [marketing, docs-blog, scheduling, signal-collectors]
+  requires: [marketing, docs-blog, scheduling, signal-collectors, workspace]
   categories: [accounting, legal, consulting, hvac, roofing, plumbing, electrical, landscaping, auto-repair, real-estate, technology, medical-specialty]
   shape: organization-product
   design: standard

package/site-templates/marketing-site/ailk-template.json

@@ -1,6 +1,12 @@
 {
   "name": "marketing-site",
-  "requires": ["marketing", "docs-blog", "scheduling", "signal-collectors"],
+  "requires": [
+    "marketing",
+    "docs-blog",
+    "scheduling",
+    "signal-collectors",
+    "workspace"
+  ],
   "extends": "_base",
   "$comment": "Pro template (#5464). installMap: bundle-relative source -> scaffold-relative destination; the stager reads only installMap/postInstall/patches. After #5618 D6 this tree holds compositions and copy overrides only: the base pages (/pricing, /privacy, /terms) arrive from the _base layer it extends, and every module sample (the blog listing and posts 01-04, the three docs pages, the projects, thank-you, flow, waitlist and report samples) ships in the docs-blog and signal-collectors bundles its requires names. Its one content file, post 05, is deliberately mapped ONTO apps/web/content/en/blog/launching-ailk.mdx (D6.2a): the template lands last and can overwrite but never remove the module's own seed post, so this is Rule B's copy-override clause with a real instance (a template-owned replacement of a seed row is a docs-blog gap on #5467, spec 5618 s7 finding 9). Unmapped content/en/** would land at the scaffold root's content/, exactly as marketing-site-free's does; today nothing is unmapped.",
   "installMap": {

package/site-templates/marketing-site/provenance.json

@@ -1,4 +1,10 @@
 {
   "template": "marketing-site",
-  "requires": ["marketing", "docs-blog", "scheduling", "signal-collectors"]
+  "requires": [
+    "marketing",
+    "docs-blog",
+    "scheduling",
+    "signal-collectors",
+    "workspace"
+  ]
 }

package/site-templates/saas-product/ailk-template.json

@@ -5,6 +5,7 @@
     "docs-blog",
     "scheduling",
     "signal-collectors",
+    "workspace",
     "multi-tenant"
   ],
   "extends": "_base",
@@ -12,5 +13,5 @@
   "installMap": {
     "provenance.json": ".ailk-template.json"
   },
-  "postInstall": "Template saas-product installed. Its Pro Plus modules - docs-blog, scheduling, signal-collectors and multi-tenant (the authed apps/admin app) - are delivered by their own module bundles. This template's own page compositions, copy and demo data are pending under #5470; until they land it contributes the provenance record and its requires cross-check only, and the scaffold renders each module's own seed content."
+  "postInstall": "Template saas-product installed. Its Pro Plus modules - docs-blog, scheduling, signal-collectors, workspace (the /admin settings pages) and multi-tenant (the authed apps/admin app) - are delivered by their own module bundles. This template's own page compositions, copy and demo data are pending under #5470; until they land it contributes the provenance record and its requires cross-check only, and the scaffold renders each module's own seed content."
 }

package/site-templates/saas-product/provenance.json

@@ -5,6 +5,7 @@
     "docs-blog",
     "scheduling",
     "signal-collectors",
+    "workspace",
     "multi-tenant"
   ]
 }

package/templates/.claude/cloudparity-repo-hooks.json

@@ -1,5 +1,10 @@
 {
   "hooks": [
+    {
+      "event": "PreToolUse",
+      "matcher": "Edit|Write",
+      "command": "bash .claude/hooks/template-guard.sh"
+    },
     {
       "event": "PostToolUse",
       "matcher": "Edit|Write",

package/templates/.claude/hooks/template-guard.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# PreToolUse (Edit|Write): refuse an unrecorded edit to a template-owned file.
+# A code file under apps/ that .ailk-template-files.json records, whose bytes
+# still match the template's sha256, is refused (exit 2) unless an entry in
+# customizations.yaml names it; the refusal on stderr names the file, the
+# entry to add and the upstream route. An edited, unrecorded or manifest-named
+# file passes. A site with no record warns and passes. Pure bash, grep, awk
+# and sha256sum/shasum — nothing a scaffold has to install. Registered in
+# .claude/settings.json and declared in .claude/cloudparity-repo-hooks.json;
+# keep the two in step.
+export LC_ALL=C
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+IFS= read -r -d '' input
+[[ $input =~ \"file_path\"[[:space:]]*:[[:space:]]*\"([^\"\\]*)\" ]] || exit 0
+rel=${BASH_REMATCH[1]}
+case $rel in
+  "$PWD"/*) rel=${rel#"$PWD"/} ;;
+  /*) exit 0 ;;
+  ./*) rel=${rel#./} ;;
+esac
+# Only a code file under one of the three recordable roots can be template-owned.
+case $rel in
+  *.d.ts) exit 0 ;;
+  apps/web/*|apps/api/*|apps/mcp/*)
+    case $rel in
+      *.ts|*.tsx|*.js|*.jsx|*.mts|*.cts|*.mjs|*.cjs) ;;
+      *) exit 0 ;;
+    esac ;;
+  *) exit 0 ;;
+esac
+case "/$rel/" in
+  */./*|*/../*|*//*) exit 0 ;;
+esac
+
+record=.ailk-template-files.json
+if [ ! -f "$record" ]; then
+  printf '%s\n' '{"systemMessage":"template-guard: warning — no .ailk-template-files.json, so template files cannot be told from site files and edits under apps/ are not guarded; run create-ailk update to write it"}'
+  exit 0
+fi
+# The record is written by serializeTemplateRecord only: one `    "<path>": {`
+# line per file, its `"sha256"` on the next.
+row=$(grep -F -x -A1 -- "    \"$rel\": {" "$record") || exit 0
+[[ $row =~ \"sha256\":[[:space:]]*\"([0-9a-f]{64})\" ]] || exit 0
+template=${BASH_REMATCH[1]}
+[ -f "$rel" ] || exit 0
+
+if command -v sha256sum >/dev/null 2>&1; then
+  disk=$(sha256sum -- "$rel")
+elif command -v shasum >/dev/null 2>&1; then
+  disk=$(shasum -a 256 -- "$rel")
+else
+  printf '%s\n' '{"systemMessage":"template-guard: warning — neither sha256sum nor shasum is on PATH, so edits to template files are not guarded"}'
+  exit 0
+fi
+# Edited already (update's own rule): the owner's file, a three-way-merge target.
+[ "${disk%% *}" = "$template" ] || exit 0
+
+# Named by a customizations.yaml pattern? Read lexically: every quoted scalar
+# and every `- <plain>` item outside a comment that starts `apps/`, matched as
+# a glob where `**` spans segments, `*` stays inside one and all else is literal.
+if [ -f customizations.yaml ] && awk -v rel="$rel" -v sq="'" '
+  function matches(pat,    n, seg, i, j, c, re, s) {
+    if (pat !~ /^apps\//) return 0
+    n = split(pat, seg, "/")
+    re = "^"
+    for (i = 1; i <= n; i++) {
+      s = seg[i]
+      if (s == "**") { re = re (i == n ? ".*" : "([^/]+/)*"); continue }
+      for (j = 1; j <= length(s); j++) {
+        c = substr(s, j, 1)
+        if (c == "*") re = re "[^/]*"
+        else if (c == "]") re = re "[]]"
+        else if (c == "^") re = re "\\^"
+        else if (c == "\\") re = re "\\\\"
+        else if (index(".[()+?{}|$", c)) re = re "[" c "]"
+        else re = re c
+      }
+      if (i < n) re = re "/"
+    }
+    return rel ~ (re "$")
+  }
+  /^[ \t]*#/ { next }
+  {
+    line = $0; n = length(line); quote = ""; cut = n
+    for (i = 1; i <= n; i++) {
+      c = substr(line, i, 1)
+      if (quote != "") { if (c == quote) quote = ""; continue }
+      if (c == "\"" || c == sq) { quote = c; continue }
+      if (c == "#" && (i == 1 || substr(line, i - 1, 1) ~ /[ \t]/)) { cut = i - 1; break }
+    }
+    line = substr(line, 1, cut)
+    rest = line
+    while (match(rest, "\"[^\"]*\"|" sq "[^" sq "]*" sq)) {
+      if (matches(substr(rest, RSTART + 1, RLENGTH - 2))) { found = 1; exit }
+      rest = substr(rest, RSTART + RLENGTH)
+    }
+    if (match(line, /^[ \t]*- /)) {
+      item = substr(line, RLENGTH + 1)
+      sub(/[ \t]+$/, "", item)
+      if (matches(item)) { found = 1; exit }
+    }
+  }
+  END { exit !found }
+' customizations.yaml; then
+  exit 0
+fi
+
+# The seed id (#9223's rule) and the issue title, percent-encoded byte by byte.
+out=$(awk -v rel="$rel" '
+  BEGIN {
+    id = tolower(rel); gsub(/[^a-z0-9]+/, "-", id); sub(/^-/, "", id); sub(/-$/, "", id)
+    for (i = 1; i < 256; i++) ord[sprintf("%c", i)] = i
+    s = "Template change: " rel
+    for (i = 1; i <= length(s); i++) {
+      c = substr(s, i, 1)
+      title = title (c ~ /[A-Za-z0-9._~-]/ ? c : sprintf("%%%02X", ord[c]))
+    }
+    print id; print title
+  }')
+id=${out%%$'\n'*}
+title=${out#*$'\n'}
+
+printf '%s\n' >&2 \
+  "template-guard: $rel is a template file, unchanged since create-ailk wrote it, and no customizations.yaml entry names it." \
+  "A template file takes its fixes from create-ailk update; change it here only once the change is recorded." \
+  "Fix, one of:" \
+  "  1. Record it: add this entry under customizations: in customizations.yaml, fill in request and decision, then retry." \
+  "       - id: $id" \
+  "         paths:" \
+  "           - \"$rel\"" \
+  "         request: \"<owner>/<repo>#<issue>\"" \
+  "         decision: \"build-in: site — <decider>, <YYYY-MM-DD>, <reason>\"" \
+  "     decision is one of: build-in: ailk#<N> | build-in: site — <decider>, <YYYY-MM-DD>, <reason> | undecided (only while undecided_ok_until is in the future)." \
+  "  2. File it upstream, so AILK builds it in and this site takes it as a version bump:" \
+  "       https://github.com/working-theory-labs/ai-launch-kit/issues/new?title=$title"
+exit 2

package/templates/.claude/rules/extending.md

@@ -0,0 +1,106 @@
+# Extending the Site
+
+## The five extension points
+
+This site stays upgradeable because it changes in five sanctioned ways,
+and only five. From the program decision, with the manifest named:
+
+> site config and content; the design package and theme; a section swap through the sections registry; wrapping a published component from an app; a site-authored file recorded in `customizations.yaml` with a build-in decision.
+
+Everything else files upstream. The manifest's `undecided_ok_until`
+grace is the only escape valve.
+
+## Why this matters
+
+- Every `@working-theory/*` package and every template-owned file is
+  replaced on upgrade. A change made anywhere else is a change the next
+  `create-ailk update` either overwrites or has to merge by hand.
+- The five points are the places an upgrade preserves. Work done through
+  them survives a bump without a merge.
+- A site that drifts outside them is a fork in all but name, and a fork
+  stops getting fixes.
+
+## How to apply
+
+Find the point your change belongs to, in this order, and use the first
+that fits:
+
+1. **Site config and content.** The site's name, identity entity, `theme:`
+   and `brand:` are `content/_site.mdx`; every page is an MDX file under
+   `content/<locale>/<TypeName>/`. New copy, a new page, a changed nav
+   label, which section a page renders and where it stands in the page's
+   `sections:` list: all content.
+2. **The design package and theme.** The locked look is `DESIGN.md` plus
+   the `theme:` block in `_site.mdx`. A different look is
+   `pnpm create ailk@latest apply-design <name|path>`, which keeps
+   `brand:`; the owner's colours and fonts are the `brand:` block.
+3. **A section swap through the sections registry.** When a section
+   needs different markup, the site registers a local component for that
+   section name in place of the published one (ADR 0007): the registry
+   seam is `registerSliceRenderer` from `@working-theory/ui`, and it
+   accepts only the keys the runtime offers for a swap (today `booker` and
+   `payment-receipt`); any other key is refused, not swapped. The local
+   component is site-authored code under `apps/`, so it is also recorded
+   under point five. A section the runtime offers no swap for is an
+   upstream request, not a component you write into the app.
+4. **Wrapping a published component from an app.** When a published
+   component must behave differently here, wrap it in a file of this
+   site's and import the wrapper: never edit the package, patch it, or
+   copy its source in. The wrapper is site-authored code under `apps/`, so
+   it is also recorded under point five.
+5. **A site-authored file recorded in `customizations.yaml` with a
+   build-in decision.** Source under `apps/` that none of the first four
+   points covers is the exception, and the exception is recorded before
+   it is written. One entry per customization:
+
+   ```yaml
+   undecided_ok_until: 2027-01-31 # optional; YYYY-MM-DD
+   customizations: # required; may be []
+     - id: booking-embed # required; unique; /^[a-z0-9][a-z0-9-]*$/
+       paths: # required; ≥1; each starts "apps/"; no ".." segment
+         - "apps/web/components/booking/**"
+       request: "salessmyth/wendihenry#12" # /^([\w.-]+\/[\w.-]+)?#\d+$/; required unless undecided
+       decision: "build-in: ailk#9300 — removed when the bump lands"
+   ```
+
+   `decision` is exactly one of:
+
+   - `undecided`
+   - `build-in: ailk#<N>`, optionally followed by ` — <text>`
+   - `build-in: site — <decider>, <YYYY-MM-DD>, <reason>`
+
+   AILK builds a customization in unless it decides not to. `build-in:
+ailk#N` means AILK ships it and this site's copy, tests included, goes
+   when the bump lands. `build-in: site` means AILK decided not to, and
+   the site keeps the file with the decider, the date and the reason.
+   `pnpm architecture` refuses site code with no entry.
+
+## Everything else files upstream
+
+A change that fits none of the five is a request to AI Launch Kit, not an
+edit here. Open an issue at
+<https://github.com/working-theory-labs/ai-launch-kit/issues> describing
+what the site needs and why the five points do not cover it, and record
+the request's issue in the manifest entry. Do not edit a template-owned
+file, do not patch or pin off a `@working-theory/*` package (the
+architecture rule already refuses each), and do not carry the change as
+an unrecorded file.
+
+## The one escape valve
+
+An `undecided` entry passes the lint only while `undecided_ok_until` is a
+date strictly after today (UTC). It exists so a site can be seeded, or a
+request can be filed and decided, without going red the same day. It is
+a deadline, not a state: when the date passes, record the decision or
+move it with the request's owner.
+
+## Escalation
+
+Stop and surface the question rather than decide alone if:
+
+- A change seems to need a sixth way in: an edit to a template-owned
+  file, a package patch, a copied source tree.
+- The right point is unclear between four and five, or between three and
+  an upstream request.
+- An `undecided` entry is about to go out of grace with no decision on
+  its request.

package/templates/.claude/rules/loop-contract.md

@@ -70,8 +70,8 @@ result on the PR.
 
 For PRs touching specific surfaces:
 
-- `database/` schema changes — also run `pnpm db:migrate` locally if
-  you added a migration.
+- `database/` — never add a migration or a schema file; bump
+  `@working-theory/database` and run `pnpm db:migrate:deploy`.
 
 ## Commit + PR
 

package/templates/.claude/settings.json

@@ -1,5 +1,16 @@
 {
   "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/template-guard.sh"
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Edit|Write",

package/templates/.env.example

@@ -148,7 +148,7 @@ CONTENT_ADAPTER=mdx
 # ── Site id (apps/api, apps/web) ─────────────────────────────────────────────
 # The scope captured rows are stamped with. Lead, WaitlistExperiment and
 # ProjectListing carry `siteId`, which defaults to the literal "default"
-# (apps/api/src/lib/site.ts), while tenancy scopes reads by WORKSPACE id.
+# (packages/api/src/lib/site.ts), while tenancy scopes reads by WORKSPACE id.
 # A single-tenant deployment should set this to the default workspace
 # sentinel so the two agree:
 # AILK_SITE_ID=wksp_00000000-0000-7000-8000-000000000001
@@ -188,6 +188,13 @@ CONTENT_ADAPTER=mdx
 # config declares a `followUps` block.
 # AILK_FOLLOWUP_EMAIL_FROM=
 #
+# The inbox's sender (#9690): an Admin reply emailed to the client, and the
+# Invite to sign up email. Optional — falls back to
+# AILK_LEAD_NOTIFICATION_FROM when unset; with neither, a reply is still saved
+# (its email is `not_configured`) and an invitation is refused. The links
+# start at FRONTEND_URL (https only outside development).
+# AILK_INBOX_FROM=
+#
 # The Resend Contacts audience the #4732 follow-up sweep checks before
 # sending — a lead found unsubscribed in this audience is suppressed.
 # Optional: unset degrades to "cannot verify — proceed" (never to "block all
@@ -381,7 +388,7 @@ CONTENT_ADAPTER=mdx
 
 # ── E2E test-auth seam (pre-OSS — never set in production) ───────────────────
 # These two env vars enable the test-auth route at POST /api/test/auth/session
-# (apps/api/src/routes/test/auth/session.ts) so an e2e harness can mint a
+# (packages/api/src/routes/test/auth/session.ts) so an e2e harness can mint a
 # Better Auth session for a seeded test user WITHOUT going through Google
 # OAuth, GitHub OAuth, or magic-link email.
 #
@@ -396,7 +403,7 @@ CONTENT_ADAPTER=mdx
 #
 # Allowlist format: comma-separated user IDs (exact-match strings; no regex,
 # no wildcard). Empty entries between commas are trimmed.
-# Run `pnpm --filter @working-theory/database db:seed:test` to seed three test users
+# Run `pnpm db:seed:test` to seed three test users
 # (user_00000000-0000-7000-8000-0000000000e1 / …e2 / …e3 — reserved-range
 # prefixed ids per ADR-0031, distinguished by the Better Auth `role` field).
 # The seed script itself refuses to run unless
@@ -446,6 +453,14 @@ CONTENT_ADAPTER=mdx
 # that database. Rotation and the rekey bin: apps/api/.env.example.
 # STRIPE_CONNECTION_KEY=
 # STRIPE_CONNECTION_KEY_PREVIOUS=
+# The key each Organization's Slack connection is encrypted under (#9748),
+# and the key it replaced during a rotation: 32 random bytes each, `openssl
+# rand -base64 32`, distinct from each other and from SCHEDULING_CREDENTIAL_KEY
+# and both Stripe connection keys. Unset = a connection cannot be written and
+# reads as not connected, but can be removed; any other shape stops the API.
+# No rekey walk: rotation and the leaked-key rule in apps/api/.env.example.
+# SLACK_CONNECTION_KEY=
+# SLACK_CONNECTION_KEY_PREVIOUS=
 # The Organization that owns STRIPE_SECRET_KEY (#9285): with the multi-tenant
 # module only the Organization whose id is named here sells through it; unset
 # means nobody. Without the module the single Organization owns it.
@@ -533,7 +548,7 @@ CONTENT_ADAPTER=mdx
 # pre-#5040 in-process Map, which does not. Default: `database` when
 # DATABASE_URL is set, else `memory`. A database failure or a 1s-slow call
 # falls back to the in-process Map for that request rather than letting it
-# through uncounted. Run `pnpm --filter @working-theory/api rate-limit:probe
+# through uncounted. Run `pnpm --filter @working-theory/app-api rate-limit:probe
 # --origin <https origin>` against a live deployment to check which store it
 # selected and whether a burst holds — see
 # docs/runbooks/site-configuration.md.
@@ -547,7 +562,7 @@ CONTENT_ADAPTER=mdx
 #
 # Hub and spokes — a spoke's reads and writes resolve to ITS OWN workspace
 # (#7532). A hub holding one workspace per spoke registers each spoke in its
-# database (`pnpm --filter @working-theory/api spokes register --workspace
+# database (`pnpm --filter @working-theory/app-api spokes register --workspace
 # <wksp_id> --name <label>`), which prints the spoke's key once. The spoke
 # sends it on every server-side call, and the hub resolves meeting types, the
 # three lead writes, bookings and public content reads to that spoke's

package/templates/.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
 
 jobs:
   ci:
+    # Posted as the `preflight` status check — the one to make required on the
+    # default branch (project.yaml `ci.required_checks`, CLAUDE.md § Checks).
+    name: preflight
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -46,10 +49,10 @@ jobs:
       # real lockfile has been committed.
       - run: pnpm install
 
-      # Prisma's generated client (database/generated/) is a build artifact,
-      # not part of the scaffold — type-check/build/test all resolve
-      # `@working-theory/database`'s generated types, and `prisma generate` needs
-      # no DATABASE_URL (it reads only the schema file, no live DB).
+      # The Prisma client ships prebuilt in the installed @working-theory/database;
+      # `db:generate` (through database/prisma.config.ts) is the cheapest proof
+      # that the installed schema loads under this site's own Prisma CLI, and it
+      # needs no DATABASE_URL (it reads only the schema files, no live DB).
       - run: pnpm db:generate
 
       - run: pnpm type-check

package/templates/CLAUDE.md

@@ -19,7 +19,7 @@ CloudParity block goes just above it.
 apps/web/         Next.js app — visitor-facing UX
 apps/api/         Fastify HTTP API — lead capture, checkout, webhooks
 apps/mcp/         MCP server — agent-callable tools
-database/         Prisma schema + migrations
+database/         Prisma config + seed; schema and migrations ship in @working-theory/database
 content/          Site settings (_site.mdx) and MDX pages (en/<TypeName>/)
 .claude/          Rules, the agent definition and settings for Claude Code
 tools/            This repo's own checks (architecture, CLAUDE.md drift)
@@ -29,6 +29,10 @@ You consume `@working-theory/*` packages from npm: read a README or types,
 not the source. Build on one by composing, wrapping or configuring it via
 its documented extension points. Never copy it out of `node_modules`, fork,
 patch or pin it: a copy stops taking fixes. `pnpm architecture` refuses each.
+
+Before you write a new source file under `apps/`, record it in `customizations.yaml`:
+its paths, the request issue, and the build-in decision. AILK builds a customization
+in unless it decides not to. `pnpm architecture` refuses site code with no entry.
 <!-- /ailk:template id="repo-shape" -->
 
 <!-- ailk:template id="architecture" -->
@@ -123,6 +127,12 @@ For design work, the third-party impeccable plugin is optional:
 | `pnpm test`              | Failing unit tests                                       |
 | `/ailk:check-site` skill | Missing or invalid JSON-LD, weak citation-readiness      |
 
+`.github/workflows/ci.yml` runs the preflight checks and `pnpm test` on every
+pull request as the `preflight` status check. One step is yours: make
+`preflight` a required status check on your default branch (GitHub: Settings →
+Branches), so a change that fails it — an AI Launch Kit upgrade included —
+cannot merge.
+
 <!-- /ailk:template id="checks" -->
 
 <!-- ailk:template id="workflow" -->

package/templates/CONVENTIONS.md

@@ -96,13 +96,12 @@ decision — write a short rationale in `docs/` first.
 
 If you've enabled the optional database layer:
 
-- **Prisma is the source of truth.** Schema lives in
-  `prisma/schema.prisma`; migrations are generated with
-  `pnpm db:migrate`.
-- **Migrations are forward-only.** Never edit a migration that has
-  already been applied. Write a corrective migration instead.
-- **No raw SQL outside the migrations folder.** All runtime data
-  access goes through Prisma.
+- **The schema and the migrations ship in `@working-theory/database`.**
+  This site carries neither: `database/prisma.config.ts` points Prisma at
+  the installed package. Take new ones by bumping that dependency and
+  running `pnpm db:migrate:deploy`. Never write a migration or a `.prisma`
+  file here.
+- **No raw SQL; all runtime data access goes through Prisma.**
 - **`@map` for snake_case ↔ camelCase.** DB columns are snake_case;
   TS field names are camelCase.
 - **Index every query you ship.** Add `@@index([...])` for any field
@@ -117,9 +116,8 @@ If you've enabled the optional database layer:
 
 ## Testing
 
-- **Jest + ts-jest** for unit tests, co-located. Each app and `database/`
-  ships its own Jest config; the root `pnpm test` fans out via
-  `pnpm -r test`.
+- **Jest + ts-jest** for unit tests, co-located. Each app ships its own
+  Jest config; the root `pnpm test` fans out via `pnpm -r test`.
   - Source: `Foo.tsx` → tests: `__tests__/Foo.test.tsx`.
   - Run: `pnpm --filter <pkg> test`.
 - **Playwright** for end-to-end (root `e2e/` once you add it).