# One app, six stages

Open this folder in Codex. Use Node.js 24, Python 3.12, Git and Chromium.
The app is a synthetic local task list. No signup, backend or deployment.

## Set up

```sh
npm ci
npx playwright install chromium
npm test
```

The starter deliberately fails validation tests. The finished archive passes.
Install AgentBay using https://agentbay.io/#agentbay-install-title.
The walkthrough names one pinned upstream skill per stage; install only those you need.
Start a fresh Codex chat, confirm the skill appears in Skills and ask Codex to read its SKILL.md.
The test used supplied upstream sources, not a catalogue search.

## Follow the six stages

Use the article at https://agentbay.io/skills/workflows/onboarding/.
`source-map.json` records exact upstream files, revisions and installed hashes.
`prompts/` contains the bounded tasks used in this run.
Brainstorming writes a brief. UX writes a disposable prototype. Architecture reviews it.
Planning produces three tasks. Analyze audits the documents without changing them.
The implementation stage changes only index.html, src/app.js and src/task.js.

To let Codex inspect the actual local app, run `node browser-tool.mjs` in a separate terminal.
It writes a local, random MCP URL to artifacts/browser-config.json. Add that URL as the
`fixture` MCP server in your agent's local configuration, then start a fresh session.
The integration exposes only inspect_prototype and inspect_app: no URL or command inputs.
Alternatively run the browser checks below yourself and give the agent the report/screenshots.
Stop the tool with Ctrl-C when finished. Do not publish the generated endpoint or configuration.

```sh
npm run verify:prototype
npm test
npm run verify:ui
```

All browser runs use a fresh context, fixture files only and no external requests.
The checks cover keyboard focus, labels, retained input, failure/retry, persistence,
text rendering and widths 320 / 390 / 1280. The pure validator has eight cases.
The plan also calls for manual checks of rapid submissions, busy-state navigation,
81-character titles and long unbroken text; inspect those in the browser.

## Guardrails

`python3 setup-guardrails.py` downloads toolkit v2.3.3 from its official release,
checks its pinned SHA-256, previews setup and installs local Proof plus prepare-safe-change.
It does not install GitHub workflows, set GitHub variables or deploy anything.

Initialize a local Git repository if this is not already one. Configure your own
commit identity, commit the starter, then configure before implementing:

```sh
python3 .proof/configure.py --set unit-tests=enforced --operation change
```

Commit that policy before testing. In a clean committed checkout, run:

```sh
PROOF_UNIT_TEST_COMMAND="npm test" python3 .toolkit-cache/ai-toolkit.pyz check --target . --base-ref HEAD --json
```

The starter blocks. After implementing and committing the fixed app, run the same
command with --base-ref HEAD~1. The unit-test gate allows the corrected revision.
Other controls keep their modes and report their own missing or failed evidence.
An allow decision does not commit, merge or deploy.
`doctor` reports installed/configured components, not a passing scan; it also reports
missing optional GitHub workflow configuration because this example deliberately uses none.

## Inspect the result

The finished ZIP includes the brief, prototype, architecture, plan, audit and app.
It excludes installed upstream skills, Git history, dependencies, local MCP endpoints
and toolkit runtime. Reinstall exact sources from source-map.json and use the setup script.
Codex CLI 0.163.0 completed this series. Node 24.22.2 independently ran the checks;
the native agent shell used Node 26.5.1. Codex desktop and Claude execution were not tested.
Upstream skill licenses remain with their publishers; inspect each source before copying it.