Say only what the AI App Starter does

The root README's Codex badge now says untested, matching the README
and release v1.0.0. The production line says the agent holds no hosted
keys and the owner pushes and deploys; the deny list is a backstop.
Both READMEs say the starter is instructions with no code: the agent
builds the environment guard, the CI checks and the pipeline.
FUNDING.yml keeps only the buy_me_a_coffee line, and GROWTH-PLAN.md
leaves the public .gitignore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/FUNDING.yml

@@ -1,15 +1 @@
-# These are supported funding model platforms
-
-# github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-# patreon: # Replace with a single Patreon username
-# open_collective: # Replace with a single Open Collective username
-# ko_fi: # Replace with a single Ko-fi username
-# tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-# community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-# liberapay: # Replace with a single Liberapay username
-# issuehunt: # Replace with a single IssueHunt username
-# lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-# polar: # Replace with a single Polar username
 buy_me_a_coffee: technomad
-# thanks_dev: # Replace with a single thanks.dev username
-# custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.gitignore

@@ -1,3 +1,2 @@
 codebase_export.ps1
 output.txt
-GROWTH-PLAN.md

README.md

@@ -6,14 +6,14 @@
 
 [![MIT license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
 ![Works with Claude Code](https://img.shields.io/badge/works%20with-Claude%20Code-D97757)
-[![Works with Codex (beta)](https://img.shields.io/badge/works%20with-Codex%20(beta)-412991)](./starters/nextjs-supabase-vercel/README.md#tested-so-far)
+[![Codex: untested](https://img.shields.io/badge/Codex-untested-lightgrey)](./starters/nextjs-supabase-vercel/README.md#tested-so-far)
 
 </div>
 
 | | What it is | Use it when |
 | --- | --- | --- |
 | **[Planning prompts](#planning-prompts)** | Guided prompts that interview you, then write your plan. Any AI chat. | You have an idea and want a solid plan |
-| **[AI App Starter](#ai-app-starter)** | A project your coding agent builds with you, step by step, up to launch. | You want to build and launch a web app |
+| **[AI App Starter](#ai-app-starter)** | Instructions your coding agent follows to build a web app with you, step by step, up to launch. | You want to build and launch a web app |
 | **[Skills](#skills)** | The planning prompts and the AI App Starter as commands, plus one that makes short product videos in code. Installed with one line. | You use Claude Code or Codex |
 | **[Agent configurations](#agent-configurations)** | Working instructions for Claude Code. | You code with Claude Code every day |
 
@@ -43,6 +43,8 @@ More: the [planning prompts guide](./planning-prompts/README.md), and why this a
 
 The [AI App Starter](./starters/nextjs-supabase-vercel/) turns your AI coding agent into a guide that builds a Next.js, Supabase and Vercel app with you, from idea to launch. You don't need to know the process: it leads, and you answer in plain words.
 
+The starter contains no code: it's stage-by-stage instructions, permission rules, and the test and CI requirements the agent follows. The agent writes the app, its tests and its checks.
+
 **1.** Open your agent in a new, empty folder.
 
 | You use | How |
@@ -61,7 +63,7 @@ Set up this folder with the AI App Starter: clone https://github.com/TechNomadCo
 
 ### Why use it
 
-- **It can't break production.** It works only on your computer, with a local database and stand-in payment and email services. It never holds keys, not even test keys, and pushing and deploying are blocked.
+- **It can't touch production directly.** It works only on your computer, with a local database and stand-in payment and email services. It never holds hosted keys, not even test keys, and you push and start production deploys yourself. Its list of blocked commands is only a backstop.
 - **It leads, in plain language.** It asks only what the next piece of work needs, does every local step itself, and hands you one command or a few clicks for the rest.
 - **It stays organized.** One plan, one decisions file, one list of known issues, and new ideas go into the plan instead of derailing the work.
 

starters/nextjs-supabase-vercel/README.md

@@ -1,6 +1,6 @@
 # AI App Starter: Next.js + Supabase + Vercel
 
-Build and launch a web app with an AI coding agent that leads the way. It can't touch production, keeps the project organized, and always tells you what's next.
+Build and launch a web app with an AI coding agent that leads the way. It never holds production keys, keeps the project organized, and always tells you what's next.
 
 ## Start
 
@@ -92,14 +92,16 @@ your-project/
 ├── docs/product/          your PRD, MVP scope and UX flow
 ├── KNOWN-ISSUES.md        open problems
 ├── .kit/stages/           one instruction file per stage, read only while it's current
-├── .kit/modules/          payments, email and background jobs: questions, rules and tests
+├── .kit/modules/          payments, email and background jobs: questions, rules and required tests
 ├── .kit/planning/         the PRD, UX and MVP interview prompts from this toolkit
-├── .claude/settings.json  blocks pushing, deploying and hosted commands (Claude Code)
-└── .codex/rules/          the same blocks for Codex
+├── .claude/settings.json  denies pushing, deploying and hosted commands (Claude Code)
+└── .codex/rules/          the same denials for Codex
 ```
 
-- **The agent can't reach production.** You develop against a local database with stand-in payment and email services. An environment guard refuses to run against anything else. Staging and production change only through CI or through you, and their credentials never sit on your computer.
-- **Database changes before code.** Staging follows your main branch by itself, and production changes only when you start it. In both, the database is updated before the new code runs, and only the production domain can be indexed by search engines.
+That's all setup copies: Markdown instructions and permission rules, no code. The agent writes the app, its tests, the environment guard and the CI checks, following the stage files.
+
+- **The agent can't reach production.** You develop against a local database with stand-in payment and email services. In stage 3 the agent builds an environment guard that refuses to run against anything else. Staging and production change only through CI or through you, and their credentials never sit on your computer.
+- **Database changes before code.** In the pipeline the agent sets up, staging follows your main branch by itself, and production changes only when you start it. In both, the database is updated before the new code runs, and only the production domain can be indexed by search engines.
 - **Each question when it matters.** Choices that shape the code are settled before any code. Everything else sits under *Deferred* in `docs/decisions.md` with a due moment. The agent checks that list before each stage and each piece of work.
 - **Rules, not recipes.** The kit says what must be true and how to check it. The agent looks up how today's tools do it and writes the chosen setup, with its sources, into the `AGENTS.md` of the folder it concerns.
 - **Everything has one place.** `docs/plan.md` holds the stage, where you are and the pieces of work. `docs/decisions.md` holds the choices, and `KNOWN-ISSUES.md` the open problems. Git holds the history.