Kit manifest

Every piece of the starter kit, the decision it has already made, the measured phase it removes from a three-hour run, and what it costs to keep current. This page is the durable one — lessons are read once, this gets reopened every time the kit changes or a drill comes due.

Each item passes the inclusion test from Decisions you have already made: it encodes a decision made a hundred times, never one the next prototype should be free to make. The exclusions at the bottom matter more than the inclusions, and are the half of a manifest that normally goes unwritten.

Read this first

Every version and command below was checked against vendor documentation in early September 2026, and some of it is wrong by now. Where this page disagrees with a page it links to, the linked page is right. That is not a disclaimer — it is a live demonstration of the maintenance tax, on a document about the maintenance tax.

Foundation

The part with no agentic content at all. Highest decay rate in the kit, lowest intellectual interest — which is exactly the combination that makes it worth automating and dangerous to leave alone.

App scaffold — Next.js, App Router, TypeScript strict
Decision it encodes
A prototype is a React app with file-system routing and a server boundary available if it turns out to be needed. This has never once been reconsidered under a clock.
Phase it removes from the clock
Project scaffold + a running app
Cost to keep current
The heaviest item in the kit. Next.js 16 alone renamed middleware to proxy, removed synchronous params/cookies/headers access and next lint, made Turbopack the default and made a custom webpack config a build failure — see the upgrade guide. Budget a real session per major, and run the official codemod before touching anything by hand.
Styling — Tailwind, tokens imported once
Decision it encodes
Utilities on JSX, values from tokens, no per-component stylesheet. Settled across every project you have shipped.
Phase it removes from the clock
Design system / styling wired
Cost to keep current
Tailwind v4 removed the config file, the init command and the @tailwind directives; setup is now an @import "tailwindcss" plus a PostCSS plugin per the current install guide. Cheap to keep current, but any v3-era snippet you paste in will be silently wrong.
Component layer — your design system, plus shadcn as gap-filler
Decision it encodes
Primitives are not redesigned under a three-hour clock. The component layer is a settled preference and a genuine strength; the kit should not make you re-express it.
Phase it removes from the clock
Design system / styling wired
Cost to keep current
Owned copies do not receive upstream fixes — that is the trade shadcn makes deliberately, and why its CLI ships migrate subcommands (CLI reference). Low urgency: a stale button does not stop a demo.
Lint, format, type-check, and one commit hook
Decision it encodes
The quality gate is not a per-project decision. Configuring it during a timed run is pure yak-shaving.
Phase it removes from the clock
Yak-shaving
Cost to keep current
Low, but it moves with the framework — Next.js 16 removed next lint entirely and now expects ESLint or Biome invoked directly. Check it whenever the scaffold moves a major.

The fake backend

The layer that buys the most clock time, because standing up a real agent graph is the single slowest way to get something on the other end of a stream. Built in the fake-backend module; listed here so the manifest is complete.

Scripted mock agent — a run as a sequence of events
Decision it encodes
A prototype demonstrates a surface, not a model. The backend is scripted, deterministic and replayable; nothing in the kit ever calls a real provider.
Phase it removes from the clock
Fake agent backend
Cost to keep current
The mock only decays against the protocol it imitates. Its real risk is drift — it stops resembling the system it stands in for, and you keep designing against the fake. Re-check it against one real stream per quarter.
Stream transport — one protocol, one shape
Decision it encodes
The surface consumes a stream of typed events. Which transport carries them is settled; what the events mean is not.
Phase it removes from the clock
Streaming / run-state plumbing
Cost to keep current
High, and easy to miss. The Vercel AI SDK is on v7, where the helpers are toUIMessageStream and createUIMessageStreamResponse (stream protocol docs) — earlier majors used different names, so any code you recall or paste from a tutorial is likely calling a function that no longer exists. Vendor documentation of its own product.
Latency, tool-call pauses, and one injectable failure
Decision it encodes
A mock that returns instantly and always succeeds produces a UI that falls apart on contact with a real model. Faking the cadence honestly is settled.
Phase it removes from the clock
Streaming / run-state plumbing
Cost to keep current
Near zero — it is your own code with no external surface. The only maintenance is honesty: when a real run teaches you the shape is wrong, fix the mock rather than the memory.

The agentic surface

The two components every agentic prototype needs and nobody has time to build under a clock. Both go in as generic shells — the shell is settled, the semantics are not.

Trace view — a rendered account of what the agent did
Decision it encodes
Every agentic surface needs a way to see the run. That it exists is settled; what it should show for a given product is not, and the kit ships a shell rather than an opinion.
Phase it removes from the clock
Trace view
Cost to keep current
Low and self-inflicted. It moves when the mock protocol moves, which is the reason both live in the same kit and get changed in the same commit.
Review gate — a human approval step in front of an action
Decision it encodes
Nothing consequential fires without a human yes. This is the pattern you already shipped in HouseWarm, and it is the one thing about agentic UX that is genuinely settled for you.
Phase it removes from the clock
Review gate
Cost to keep current
Low. The risk is not decay but scope creep: every prototype wants to add its own field semantics into the shell, and each addition makes the shell less usable by the next one.
Auth stub — fake session, user switcher, no identity provider
Decision it encodes
A prototype never authenticates for real. Settled only because production is out of scope; in a production kit this answer inverts.
Phase it removes from the clock
Auth stub
Cost to keep current
Effectively zero, because it depends on nothing. The best-behaved item in the kit and the model for what a kit item should look like.

Distribution and upkeep

How the kit gets from the repository into a prototype, and what keeps it from rotting between prototypes.

A GitHub template repository
Decision it encodes
Each prototype is a disposable, independent copy that owes nothing back. Settled by the nature of prototypes.
Phase it removes from the clock
Project scaffold + a running app
Cost to keep current
The load-bearing constraint of the whole kit. A generated repo starts from a single commit with an unrelated history, so you cannot merge between it and the template. Fixes made while building a prototype never flow back. The kit is only ever improved deliberately.
A one-line clone path
Decision it encodes
Starting a prototype is a command, not a procedure. Settled, and worth verifying rather than assuming.
Phase it removes from the clock
Yak-shaving
Cost to keep current
create-next-app takes a GitHub URL directly — pnpm create next-app --example "https://github.com/..." my-app (CLI reference). degit is the framework-agnostic alternative and is actively maintained. Both need re-checking whenever the scaffold moves a major.
Automated dependency updates
Decision it encodes
The kit is updated on a schedule rather than when it breaks. Settled the moment you accept that a kit between prototypes is a codebase nobody is touching.
Phase it removes from the clock
Nothing directly — it protects everything else
Cost to keep current
Pick one, not both: Dependabot version updates or Renovate. Both are vendors documenting their own products, and neither claims an outcome. Necessary, and not sufficient — see the drill below.

Deliberately out

A missing item costs minutes once, in one prototype, and announces itself immediately. A wrong item costs minutes in every prototype forever and never announces itself at all. The test is biased toward exclusion for that reason, and this list is where the bias is recorded.

A domain model, or any product schema
Why out: The next portfolio company has a different one. This is not a decision you have made a hundred times; it is a decision you have made differently every time.
What including it would cost: Every prototype starts by deleting yours, which is slower than starting from nothing and considerably more irritating.
The agent’s tool set and its actual behaviour
Why out: This is the product question the prototype exists to ask. A kit that answers it has answered the wrong question in advance.
What including it would cost: You demo your kit’s assumptions back to a stakeholder who wanted to see theirs.
A canonical run-state machine
Why out: Whether a run can be paused, resumed, partially rejected or rolled back differs per product. It looks like infrastructure and is a product decision wearing infrastructure’s name — the most common way a kit turns into a framework.
What including it would cost: The prototype whose product needs resumable runs either fights the state machine or forks it, and both cost more than the forty minutes it saved elsewhere.
Real persistence
Why out: A three-hour prototype has no data worth surviving a restart, and a database is a decision with schema, migration and hosting attached.
What including it would cost: Migration plumbing during a timed run, in service of durability nobody in the demo will ever test.
Real auth, real evals, deployment hardening
Why out: Production concerns. Each is a settled decision in a production context and an unsettled one here — the kit is scoped to prototypes precisely so these stay out.
What including it would cost: A prototype that takes a day, which is the exact failure this whole course is arranged to prevent.
Anything that has appeared in only one timed run
Why out: One run measures the target and the mood. Two, against different domains, start measuring the work.
What including it would cost: A kit shaped by whichever domain you happened to practise against first, permanently, with no signal that it happened.

The upkeep contract

Four commitments. The first three are cheap and insufficient; the fourth is the one that measures anything.

A stated pinning position. Lockfile-pinned or floating ranges, written down, with the trade named. Pinned drifts further from current; floating can break with no change of yours. Semver does not settle this for you — 44% of breaking changes that manifested in npm client packages arrived in minor and patch releases.
A freshness budget as a number. An unstated budget is always “however stale it currently is.” Libyears are a reasonable unit and a bad verdict — use the number to decide when to look, never as a score to defend.
Automated update PRs on a schedule. Necessary. Not evidence of anything, because nothing in a bump PR walks the path a new prototype takes.
The cold-clone drill, on a calendared date. Clone from cold on an unprepared machine and time the walk to a running app with the mock backend responding. That elapsed time is the maintenance health of the kit. Since a generated repo has no merge path back to its template, the template is never exercised by the prototypes built from it — if you do not run it deliberately, nobody does.

What earns a change to this page

An addition needs the same candidate to have appeared in the “what the kit should have had” column of two separate runs in learning/prototyping-velocity/PRACTICE-LOG.md, against two different target domains.
A removal needs one appearance in “what the kit had that got in the way.” Removals are cheaper to justify than additions on purpose — a kit that only grows becomes a framework, and it gets there through individually reasonable additions rather than any single bad one.
A version bump recorded here needs the vendor page it links to actually opened, not recalled. That rule is the reason this page is worth trusting at all, and the reason it will be wrong the moment it stops being followed.

Every claim on these pages links to its source. If a source looks wrong or out of date, check the resource list and tell your teaching agent — the course is meant to be corrected.