From 93aa81d9dc22b202d1294316692cd320aac4a29e Mon Sep 17 00:00:00 2001
From: gaboesquivel <contact@gaboesquivel.com>
Date: Fri, 4 Sep 2026 22:52:18 -0600
Subject: [PATCH 1/2] docs: add MIT license and after-fork Product Ready

---
 .../workflow/onboard-new-developer/SKILL.md   |  2 +-
 .cursor/rules/frontend/e2e-playwright.mdc     |  3 +-
 .github/workflows/web-e2e.yml                 | 10 ----
 LICENSE                                       | 21 ++++++++
 README.md                                     |  5 +-
 _first/basilic/API.md                         |  2 +-
 _first/basilic/ARCHITECTURE.md                |  6 +--
 _first/basilic/DOCUMENTATION.md               |  2 +-
 _first/basilic/JOURNEYS.md                    |  2 +-
 _first/basilic/PIPELINES.md                   |  2 +-
 _first/basilic/PRODUCT.md                     | 15 +++---
 apps/api/.env.defaults.example                | 11 ++--
 apps/api/package.json                         |  2 +-
 apps/docu/content/docs/architecture/ai.mdx    |  2 +-
 apps/docu/content/docs/architecture/index.mdx |  6 +--
 .../content/docs/architecture/portability.mdx | 23 ++++----
 .../docs/deployment/github-actions.mdx        |  2 +-
 .../content/docs/development/after-fork.mdx   | 53 +++++++++++++++++++
 .../content/docs/development/cursor-setup.mdx |  3 --
 apps/docu/content/docs/development/index.mdx  |  7 ++-
 apps/docu/content/docs/development/meta.json  |  1 +
 .../docu/content/docs/testing/e2e-testing.mdx |  2 +-
 .../content/docs/testing/product-ready.mdx    | 13 ++---
 apps/web/.env.development                     |  4 +-
 apps/web/.env.local.example                   |  3 +-
 apps/web/.env.production                      |  2 +-
 apps/web/.env.staging                         |  2 +-
 apps/web/e2e/anthropic-key.ts                 |  5 ++
 apps/web/e2e/chat-assistant.spec.ts           |  2 +
 apps/web/playwright.config.ts                 | 27 ++++++----
 package.json                                  |  1 +
 packages/error/package.json                   |  2 +-
 packages/utils/package.json                   |  2 +-
 tools/eslint/README.md                        |  2 +-
 tools/typescript/README.md                    |  2 +-
 tools/typescript/package.json                 |  2 +-
 36 files changed, 166 insertions(+), 85 deletions(-)
 create mode 100644 LICENSE
 create mode 100644 apps/docu/content/docs/development/after-fork.mdx
 create mode 100644 apps/web/e2e/anthropic-key.ts

diff --git a/.agents/skills/workflow/onboard-new-developer/SKILL.md b/.agents/skills/workflow/onboard-new-developer/SKILL.md
index 27042cec..287f7e5f 100644
--- a/.agents/skills/workflow/onboard-new-developer/SKILL.md
+++ b/.agents/skills/workflow/onboard-new-developer/SKILL.md
@@ -12,7 +12,7 @@ Comprehensive onboarding process to get a new developer up and running quickly.
 4. **Start local Postgres**: `pnpm --filter @repo/api db:start` (`setup` does not start Supabase)
 5. **Reset and seed**: `pnpm reset` from repo root (Supabase reset + Drizzle migrate + seed). See `apps/api/README.md` and ADR 008
 6. **Run web/API**: `pnpm dev` (API + Next.js)
-7. **First login**: Magic link, or `ALLOW_TEST=true` + `test@test.ai`. Signed-in home is `/`
+7. **First login**: Copied env has `ALLOW_TEST=true`. Use `test@test.ai`. Signed-in home is `/`. Resend is optional.
 8. **Run mobile (optional)**: `pnpm --filter @repo/mobile start` (or `start:localhost` / `start:tunnel` for remote). See `apps/docu/content/docs/development/dev-environments.mdx`
 9. **Verify**: Web loads, API `GET /health` succeeds, simulator/device can reach the API if running mobile
 10. **Project familiarization**: Review `_first/basilic/PRODUCT.md` and architecture MDX; run tests when changing code; submit first PR
diff --git a/.cursor/rules/frontend/e2e-playwright.mdc b/.cursor/rules/frontend/e2e-playwright.mdc
index 17cc53ff..0bb21309 100644
--- a/.cursor/rules/frontend/e2e-playwright.mdc
+++ b/.cursor/rules/frontend/e2e-playwright.mdc
@@ -18,13 +18,14 @@ alwaysApply: false
 - Confirm dialogs use `getByRole('alertdialog')` (shadcn AlertDialog), not `dialog`
 
 ## Projects (dependency graph)
-`public` → `auth` → `setup` → `{chromium, security, passkey-login}`; `chromium` → `chat`
+`public` → `auth` → `setup` → `{chromium, security, passkey-login}`; `chromium` → `chat` (chat omitted without a real Anthropic key)
 
 - **public**: no storageState
 - **auth**: empty storageState; numbered `01-`…`06-` specs (file-name order is the convention — `testMatch` only selects files, it does not impose execution order)
 - **setup**: `auth.setup.ts` writes `test-results/.auth/user.json` (depends on auth)
 - **chromium** / **security** / **chat**: `storageState` from setup file
 - **passkey-login**: empty storageState; dedicated `e2e-passkey@test.ai`
+- **chat**: omitted when `hasRealAnthropicKey()` is false (`e2e/anthropic-key.ts`; empty, `sk-ant-xxx`, `sk-ant-dummy*`)
 
 ## Session model
 - Setup project logs in once; authed projects reuse `user.json` with a **new context per test**
diff --git a/.github/workflows/web-e2e.yml b/.github/workflows/web-e2e.yml
index 56738eff..57ed8893 100644
--- a/.github/workflows/web-e2e.yml
+++ b/.github/workflows/web-e2e.yml
@@ -59,16 +59,6 @@ jobs:
       - name: Build
         run: pnpm turbo run build --filter=@repo/web...
       - uses: ./.github/actions/setup-playwright
-      - name: Verify ANTHROPIC_API_KEY for E2E (AI_PROVIDER=anthropic)
-        shell: bash
-        env:
-          AI_PROVIDER: ${{ env.AI_PROVIDER }}
-          ANTHROPIC_API_KEY: ${{ env.ANTHROPIC_API_KEY }}
-        run: |
-          if [[ "${AI_PROVIDER}" == "anthropic" && -z "${ANTHROPIC_API_KEY}" ]]; then
-            echo "::error::AI_PROVIDER is anthropic but ANTHROPIC_API_KEY is empty or unset. Set the ANTHROPIC_API_KEY repository secret; required before E2E tests (local)." >&2
-            exit 1
-          fi
       - name: E2E tests (local)
         env:
           SKIP_BUILD: '1'
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 00000000..6038d2f7
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gabo Esquivel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index 93f250c9..f4606a88 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Fork-and-run developer starter: typed SDKs, self-hosted auth, a portable architecture, Cursor-first workflow, and a thin web demo. Fastify • OpenAPI • Next.js • Expo scaffold — one stack, multiple clients.
 
-> 🚧 **Active development** — Explore, fork, and contribute. 🏗️
+MIT licensed. Start a product with GitHub **Use this template**, or fork to contribute back. First successful use is [Product Ready](https://basilic-docs.vercel.app/docs/testing/product-ready) (`pnpm setup`, `db:start`, `pnpm reset`, `pnpm dev`, `test@test.ai`). After you own the copy: [After fork](https://basilic-docs.vercel.app/docs/development/after-fork).
 
 ## Features
 
@@ -95,8 +95,9 @@ Run with `pnpm <script>`.
 
 Full docs: [basilic-docs.vercel.app](https://basilic-docs.vercel.app/docs)
 
-- [Getting Started](https://basilic-docs.vercel.app/docs/development) — clone, `pnpm setup`, `db:start`, `pnpm reset`, `pnpm dev`
+- [Getting Started](https://basilic-docs.vercel.app/docs/development) — clone or Use this template, `pnpm setup`, `db:start`, `pnpm reset`, `pnpm dev`
 - [Product Ready](https://basilic-docs.vercel.app/docs/testing/product-ready) — fork-and-run bar (not CI green)
+- [After fork](https://basilic-docs.vercel.app/docs/development/after-fork) — template vs fork, what to replace, CI secrets
 - Maintainers: [`_first/basilic/PRODUCT.md`](_first/basilic/PRODUCT.md) — intent, feature map, roadmap
 - [Dev Environments](https://basilic-docs.vercel.app/docs/development/dev-environments) — Local vs remote (ports 3000, 3001, 8081; `start:localhost`, `start:tunnel`)
 - FIRST factory (stations, overlays): [`_first/`](_first/README.md) — load `_first/AGENTS.md` then `_first/ABOUT.md` then `_first/FIRST.md`. See [AI Workflow](https://basilic-docs.vercel.app/docs/development/ai-workflow)
diff --git a/_first/basilic/API.md b/_first/basilic/API.md
index defef372..7056e2bf 100644
--- a/_first/basilic/API.md
+++ b/_first/basilic/API.md
@@ -23,7 +23,7 @@ Meaningful boundaries have explicit inputs, outputs, errors, and references to a
 - **Fact:** `createClient` modes: no-auth, JWT (`getAuthToken` / refresh), apiKey (`bask_…`)
 - **Fact:** Drift check: `pnpm generate && git diff --exit-code -- apps/api/openapi/openapi.json packages/core/src/gen` (also `api-e2e.yml`)
 - **Fact:** Generation how-to: [openapi-generation.mdx](../../apps/docu/content/docs/development/openapi-generation.mdx)
-- **Drift:** Architecture index “API as source of truth” vs routes/TypeBox generate OpenAPI. Follow TypeBox. ADR 009 already says Fastify routes are the source.
+- **Fact:** Architecture index matches this overlay: TypeBox on Fastify routes generate OpenAPI. ADR 009: Fastify routes are the source.
 - **Unresolved:** public versioning/idempotency policy beyond regenerate-on-change; MCP server as a shipped app; GraphQL secondary interface (ADR 009 optional)
 
 Who may call is Security. This station owns how credentials and denial appear on the contract.
diff --git a/_first/basilic/ARCHITECTURE.md b/_first/basilic/ARCHITECTURE.md
index c3a66250..0ffceb9a 100644
--- a/_first/basilic/ARCHITECTURE.md
+++ b/_first/basilic/ARCHITECTURE.md
@@ -22,8 +22,8 @@ The system has an inspectable structural model at the level its scale requires.
 - **Fact:** Apps depend on packages, never the reverse. `react` depends on `core`. Clients call Fastify over HTTP.
 - **Fact:** Store: PostgreSQL via `DATABASE_URL`. PGLite when `PGLITE=true`. Supabase is the managed host, not the auth SDK.
 - **Fact:** Externals: Vercel, Resend, OAuth IdPs, AI providers, Sentry/GlitchTip, EAS, scanners
-- **Drift:** Architecture index says “API as source of truth.” [api.mdx](../../apps/docu/content/docs/architecture/api.mdx) and [ADR 009](../../apps/docu/content/docs/adrs/009-api-architecture.mdx) say Fastify routes / TypeBox generate OpenAPI. Follow TypeBox/routes.
-- **Drift:** [portability.mdx](../../apps/docu/content/docs/architecture/portability.mdx) describes host-anywhere. Shipped path is Vercel + Supabase.
+- **Fact:** Contract source is TypeBox on Fastify routes; OpenAPI is generated ([api.mdx](../../apps/docu/content/docs/architecture/api.mdx), [ADR 009](../../apps/docu/content/docs/adrs/009-api-architecture.mdx))
+- **Fact:** Shipped deploy path is Vercel + Supabase ([portability.mdx](../../apps/docu/content/docs/architecture/portability.mdx))
 - **Unresolved:** GCP/AWS as first-class deploy targets; mobile as an API consumer
 
 ```mermaid
@@ -64,7 +64,7 @@ flowchart LR
 ## Validation
 
 - A new contributor can name apps, packages, responsibilities, and dependency direction from architecture MDX.
-- Diagrams match code and deployment, or discrepancies are named (mobile, PostHog, portability).
+- Diagrams match code and deployment, or discrepancies are named (mobile, PostHog).
 - New dependencies follow apps → packages; generated client from OpenAPI; no app-to-app imports.
 - Consequential choices have ADRs, not only a technology name.
 - Architecture stays proportional to a starter toolkit.
diff --git a/_first/basilic/DOCUMENTATION.md b/_first/basilic/DOCUMENTATION.md
index 871e57ff..c357fec1 100644
--- a/_first/basilic/DOCUMENTATION.md
+++ b/_first/basilic/DOCUMENTATION.md
@@ -23,7 +23,7 @@ Consequential decisions, conventions, setup steps, and domain context live in di
 - **Fact:** Portable factory: vendored `../AGENTS.md`, `../ABOUT.md`, `../templates/`. Station specs: `/f-*` from `npx skills add blockmatic/first`. This folder is the Basilic adoption pack, not a second docs site. Essays live in [`blockmatic/first`](https://github.com/blockmatic/first/tree/main/_first/articles).
 - **Fact:** Same-change rule: update matching MDX when behavior, commands, or conventions change; update [PRODUCT.md](PRODUCT.md) when goals, feature map, or horizons change
 - **Fact:** `__dev/` is gitignored scratch. Do not treat it as Fact or as the backlog. Remembered technical decisions go in `apps/docu` or ADRs. Product decisions go in [PRODUCT.md](PRODUCT.md).
-- **Drift:** named in sibling instances (PostHog, “API as source of truth”, portability vs Vercel). Fix MDX in the same work when you change the fact; do not leave load-bearing drift only in chat.
+- **Fact:** Architecture MDX matches this overlay: TypeBox on Fastify generates OpenAPI; shipped path is Vercel + Supabase; PostHog is chosen not installed. Named remaining drift: mobile vs web, PostHog not in the runtime.
 
 ## Minimum Useful Artifact
 
diff --git a/_first/basilic/JOURNEYS.md b/_first/basilic/JOURNEYS.md
index 3f41e91b..0328d5c8 100644
--- a/_first/basilic/JOURNEYS.md
+++ b/_first/basilic/JOURNEYS.md
@@ -16,7 +16,7 @@ Actors, entry points, happy paths, alternates, error paths, permission gates, an
 
 - **Fact:** [authentication.mdx](../../apps/docu/content/docs/architecture/authentication.mdx), [account-linking.mdx](../../apps/docu/content/docs/architecture/account-linking.mdx)
 - **Fact:** Web gate: [`../../apps/web/proxy.ts`](../../apps/web/proxy.ts). Public: `/auth/login`, `/auth/callback/*`, `/auth/logout`, `/auth/session/revoke`, `/terms`, `/privacy`, `/images/auth-login-hero.webp`. Unauthenticated → login. Authenticated on login → `/`. Token refresh on navigation.
-- **Fact:** Adopter first-success: [product-ready.mdx](../../apps/docu/content/docs/testing/product-ready.mdx) (`db:start` + `pnpm reset` + `pnpm dev` + first login). Not CI green.
+- **Fact:** Adopter first-success: [product-ready.mdx](../../apps/docu/content/docs/testing/product-ready.mdx) (`db:start` + `pnpm reset` + `pnpm dev` + `ALLOW_TEST` + `test@test.ai`). Not CI green. After they own the copy: [after-fork.mdx](../../apps/docu/content/docs/development/after-fork.mdx).
 - **Fact:** Actors: web end user; adopting developer; CLI/agent with API key; CI/CodeRabbit/DeepSec; mobile user (**deferred**)
 - **Fact:** Login methods: magic link (`token`+`verificationId` or `token`+`email`); OAuth GitHub/Google/Facebook/Twitter; passkey; Web3 EIP-155/Solana on the API. TOTP is 2FA only.
 - **Fact:** E2E magic link: `test@test.ai` when `ALLOW_TEST=true`
diff --git a/_first/basilic/PIPELINES.md b/_first/basilic/PIPELINES.md
index 27ebb1b1..9fe1d004 100644
--- a/_first/basilic/PIPELINES.md
+++ b/_first/basilic/PIPELINES.md
@@ -21,7 +21,7 @@ Changes flow through an automated path: format → lint → typecheck → test 
 - **Fact:** Mobile: `mobile-build.yml`, `mobile-preview.yml`, `mobile-pr-preview.yml` ([mobile-cicd.mdx](../../apps/docu/content/docs/deployment/mobile-cicd.mdx))
 - **Fact:** Local: `pnpm qa` via [`../../scripts/run-qa.mjs`](../../scripts/run-qa.mjs) — checktypes → lint → generate + drift → build → unit → e2e (`SKIP_BUILD=1`)
 - **Fact:** Vercel git deploys web/api/docu ([vercel.mdx](../../apps/docu/content/docs/deployment/vercel.mdx)). CI does **not** deploy. Preview migrate gated unless `RUN_PG_MIGRATE=true`.
-- **Fact:** `web-e2e` needs `ANTHROPIC_API_KEY`
+- **Fact:** `web-e2e` chat project runs only when `ANTHROPIC_API_KEY` is set; auth/dashboard E2E still run on forks
 - **Fact:** R0 is documentation alignment. It does not require a GitHub Release or a version bump. Preview deploys still run from git as usual.
 - **Unresolved:** commit-stage artifact identity and promote-without-rebuild (hosts rebuild from git)
 
diff --git a/_first/basilic/PRODUCT.md b/_first/basilic/PRODUCT.md
index a988f368..6bc31413 100644
--- a/_first/basilic/PRODUCT.md
+++ b/_first/basilic/PRODUCT.md
@@ -15,10 +15,10 @@ The project has an inspectable answer to what, why, and how we will know. Non-go
 ## Artifacts
 
 - **Fact:** This file is the canonical product brief (Brief, Feature map, Roadmap below). Do not put Basilic intent, feature map, or horizons in `apps/docu`
-- **Fact:** [`../../README.md`](../../README.md) — fork-and-run TypeScript fullstack starter (Fastify, OpenAPI, Next, Expo scaffold). No Wagmi, no first-class OpenAI SDK, no web wallet UI
+- **Fact:** [`../../README.md`](../../README.md) — MIT fork-and-run TypeScript fullstack starter (Fastify, OpenAPI, Next, Expo scaffold). No Wagmi, no first-class OpenAI SDK, no web wallet UI
 - **Fact:** [`../../apps/docu/content/docs/`](../../apps/docu/content/docs/) — adopter technical docs (architecture, ADRs, development, testing, deployment). Not a product site
 - **Fact:** Two audiences: **adopters** (developers using the starter) and **demo users** (web markets `/`, headlines strip, settings, in-shell assistant; auth is the shipped job)
-- **Fact:** GTM: clone + [Getting Started](../../apps/docu/content/docs/development/index.mdx) (`db:start`, `pnpm reset`) + first local login. Bar: [Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx). Finance **N/A** (toolkit)
+- **Fact:** GTM: clone or GitHub **Use this template** + [Getting Started](../../apps/docu/content/docs/development/index.mdx) (`db:start`, `pnpm reset`) + first local login (`ALLOW_TEST` + `test@test.ai`). Bar: [Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx). After you own the copy: [After fork](../../apps/docu/content/docs/development/after-fork.mdx). Finance **N/A** (toolkit)
 - **Fact:** Owner: Gabo Esquivel
 - **Fact:** New-device sign-in alerts are transactional email via Fastify `emailProvider` + `@repo/email`, not a notification product
 - **Fact:** Not a billed SaaS in files. Do not invent TAM/LTV
@@ -36,7 +36,7 @@ The project has an inspectable answer to what, why, and how we will know. Non-go
 - users: adopting developers; demo end users on web auth and dashboard
 - goal: portable starter with self-hosted Web2 auth and Cursor-first workflow (Web3 on API only)
 - non-goals: Brief → Non-goals (R0) in this file
-- audience/channel/first use: clone + Getting Started (`db:start`, `pnpm reset`) + first local login ([Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx))
+- audience/channel/first use: clone or Use this template + Getting Started (`db:start`, `pnpm reset`) + first local login (`ALLOW_TEST` + `test@test.ai`) ([Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx))
 - metrics: auth and assistant jobs **instrumented, not collected**
 - events: `auth_succeeded`, `auth_failed`, `assistant_turn` — specified + instrumented, no sink
 - owners: Gabo Esquivel
@@ -56,7 +56,7 @@ The project has an inspectable answer to what, why, and how we will know. Non-go
 
 - A new maintainer can answer what we are building from this file + README without `__dev/` or Fumadocs Product pages
 - Success metrics can fail. They are not CI green. Auth/assistant remain unmeasured (no sink)
-- GTM is clone + Getting Started. Product Ready is that path, not CI green. Finance N/A
+- GTM is clone or Use this template + Getting Started. Product Ready is that path, not CI green. Finance N/A
 - No silent product decisions in code without a note or open question
 
 ## Definition of Done
@@ -93,7 +93,7 @@ Owner until this file says otherwise: **Gabo Esquivel**.
 
 ### Two audiences
 
-**Adopters** clone the repo, run the stack locally, and copy patterns. First successful use is [Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx): clone → [Getting Started](../../apps/docu/content/docs/development/index.mdx) (`db:start`, `pnpm reset`, `pnpm dev`) → magic-link (or `ALLOW_TEST` + `test@test.ai`) to `/`.
+**Adopters** clone the repo or use GitHub **Use this template**, run the stack locally, and copy patterns. First successful use is [Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx): clone → [Getting Started](../../apps/docu/content/docs/development/index.mdx) (`db:start`, `pnpm reset`, `pnpm dev`) → `ALLOW_TEST` + `test@test.ai` to `/`. After they own the copy: [After fork](../../apps/docu/content/docs/development/after-fork.mdx).
 
 **Demo users** sign in to the web app. The shipped job is auth (sessions, API keys, settings). Markets, a headlines strip, and the in-shell assistant are demo chrome. See Feature map below.
 
@@ -129,7 +129,7 @@ Status is what the tree does today, not a wish list. Horizons: Roadmap below.
 Must work after clone → `pnpm setup` → `db:start` → `pnpm reset` → `pnpm dev`.
 
 - Fastify TypeBox API → generated OpenAPI → `@repo/core` / handwritten `@repo/react`
-- Auth: magic link (Resend **or** `ALLOW_TEST` + `test@test.ai`) → cookies → `/`
+- Auth: magic link (Resend **or** copied local `ALLOW_TEST=true` + `test@test.ai`) → cookies → `/`
 - Optional OAuth (unconfigured = disabled / 503)
 - Passkeys, sessions, API keys `bask_`, Settings profile and security
 - Next 16 web app gated by `apps/web/proxy.ts`
@@ -171,7 +171,8 @@ R0 is **documentation alignment**. It does not need a semver bump or a GitHub Re
 
 - This file: what Basilic is, feature map, this roadmap
 - Honesty in README and auth docs (starter, not wallet/OpenAI template)
-- [Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx): `db:start` + `pnpm reset` before `pnpm dev`
+- MIT `LICENSE`; GitHub Template; [After fork](../../apps/docu/content/docs/development/after-fork.mdx)
+- [Product Ready](../../apps/docu/content/docs/testing/product-ready.mdx): `db:start` + `pnpm reset` before `pnpm dev`; copied env `ALLOW_TEST=true`
 
 ### R-demo — Markets + GenAI artifacts
 
diff --git a/apps/api/.env.defaults.example b/apps/api/.env.defaults.example
index 16a2b7d9..6a1df2d8 100644
--- a/apps/api/.env.defaults.example
+++ b/apps/api/.env.defaults.example
@@ -36,12 +36,14 @@ DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:54322/postgres
 # SENTRY_ENVIRONMENT=
 
 # -----------------------------------------------------------------------------
-# AI (at least one provider path for chat features)
+# AI (assistant is optional — paid key or local Ollama, not a placeholder)
 # -----------------------------------------------------------------------------
-ANTHROPIC_API_KEY=sk-ant-xxx
+# Unset so the resolver can fall through to Ollama when it is running.
+# A truthy placeholder (sk-ant-xxx) selects Anthropic and the chat job fails.
+# ANTHROPIC_API_KEY=
 # OPEN_ROUTER_API_KEY=sk-or-v1-xxxxxxxxxxxxxxxxxx
 # OLLAMA_BASE_URL=http://localhost:11434
-# AI_PROVIDER=anthropic
+# AI_PROVIDER=ollama
 # AI_DEFAULT_MODEL=claude-haiku-4-5
 # AI_UPSTREAM_TIMEOUT_MS=120000
 # AI_TOOL_MAX_STEPS=5
@@ -70,7 +72,8 @@ ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000
 # -----------------------------------------------------------------------------
 # Testing / features
 # -----------------------------------------------------------------------------
-# ALLOW_TEST=false
+# Local Product Ready: test@test.ai without Resend. Production refuses this.
+ALLOW_TEST=true
 
 # -----------------------------------------------------------------------------
 # OAuth — optional (routes return 503 when unset)
diff --git a/apps/api/package.json b/apps/api/package.json
index 5d2bf695..79f0f3d5 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -43,7 +43,7 @@
   },
   "keywords": [],
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "dependencies": {
     "@ai-sdk/anthropic": "^4.0.45",
     "@faker-js/faker": "^10.6.0",
diff --git a/apps/docu/content/docs/architecture/ai.mdx b/apps/docu/content/docs/architecture/ai.mdx
index f6269882..5b95fd5c 100644
--- a/apps/docu/content/docs/architecture/ai.mdx
+++ b/apps/docu/content/docs/architecture/ai.mdx
@@ -89,7 +89,7 @@ Pre-stream failures map to catalog codes: 401, 400, 402 (`INSUFFICIENT_CREDITS`)
 ## Testing
 
 - **API Vitest** (`ai.spec.ts`, `lib/ai/provider.spec.ts`): `test/utils/ai-remote.ts` skips **402** only when the response is `INSUFFICIENT_CREDITS` (quota is infra). Skips 502/504/connection only when `ANTHROPIC_API_KEY` is missing or placeholder `sk-ant-xxx`. A real key → 502 fails the suite.
-- **Web E2E** (`chat-assistant.spec.ts`): still soft-passes on 402/upstream/502 when the provider is down. See [E2E Testing](/docs/testing/e2e-testing).
+- **Web E2E** (`chat-assistant.spec.ts`): Playwright omits the chat project when `hasRealAnthropicKey()` is false (empty, `sk-ant-xxx`, `sk-ant-dummy*`). With a real key, skips 402/quota. See [E2E Testing](/docs/testing/e2e-testing).
 
 ## Related
 
diff --git a/apps/docu/content/docs/architecture/index.mdx b/apps/docu/content/docs/architecture/index.mdx
index 1f0e5c63..29ca4efc 100644
--- a/apps/docu/content/docs/architecture/index.mdx
+++ b/apps/docu/content/docs/architecture/index.mdx
@@ -3,7 +3,7 @@ title: "Architecture Overview"
 description: "Technical stack and design decisions."
 ---
 
-Principles: composability, API as source of truth, multiple clients, no vendor lock-in, tooling with long-term support.
+Principles: composability, TypeBox on Fastify routes generate OpenAPI, multiple clients, documented Vercel + Supabase path, tooling with long-term support.
 
 ```mermaid
 sequenceDiagram
@@ -28,12 +28,12 @@ sequenceDiagram
 - [AI](/docs/architecture/ai) — Providers, `/ai/chat`, `/ai/generate`, web assistant
 - [Authentication](/docs/architecture/authentication) — Magic link, OAuth, Web3
 - [Account linking](/docs/architecture/account-linking) — Email change, OAuth, wallets
-- [Frontend](/docs/architecture/frontend) — Next.js 16, React 19, Tailwind 4, Web3 hooks
+- [Frontend](/docs/architecture/frontend) — Next.js 16, React 19, Tailwind 4. No wallet UI in `apps/web`.
 - [Error handling](/docs/architecture/error-handling) — `@repo/error`, log-only capture (Sentry installed, inactive)
 - [Logging](/docs/architecture/logging) — Pino / console, `reqId`
 - [Product analytics](/docs/architecture/analytics) — PostHog chosen, not shipped; web instrumented, not collected
 - [Security](/docs/architecture/security) — Secrets, CVE scans, DeepSec
 - [ESM & TypeScript](/docs/architecture/esm-strategy) — TypeScript 7, dual-mode exports
-- [Portability](/docs/architecture/portability) — Host anywhere
+- [Portability](/docs/architecture/portability) — shipped Vercel + Supabase; GCP/AWS not first-class
 
 Decisions: [ADRs](/docs/adrs).
diff --git a/apps/docu/content/docs/architecture/portability.mdx b/apps/docu/content/docs/architecture/portability.mdx
index 3aa0e17e..bfc66dfc 100644
--- a/apps/docu/content/docs/architecture/portability.mdx
+++ b/apps/docu/content/docs/architecture/portability.mdx
@@ -1,24 +1,19 @@
 ---
 title: "Portability Strategy"
-description: "Zero vendor lock-in architecture designed for rapid iteration and deployments without code changes."
+description: "Shipped deploy path is Vercel + Supabase. The stack is standard HTTP, Node, and Postgres so you can move later."
 ---
 
-This stack is built on standard, widely supported technologies so you can move between deployment platforms without code changes. 
-Start with Vercel + Supabase for speed, then migrate to Google Cloud or AWS when you need stronger production security controls.
+The **shipped** path is [Vercel](/docs/deployment/vercel) + Supabase. GCP and AWS are not first-class deploy targets (product non-goal). The runtime is still ordinary Node, Fastify HTTP, Next.js, and PostgreSQL, so a later move is a host change, not a rewrite.
 
-Portability keeps options open as requirements change: you can pick the right provider for security (KMS/VPC/HSM), cost, and compliance without rewriting the system.
+Do not read this page as “configure GCP or AWS from this repo.” Those remain unresolved.
 
+## What is portable
 
-Technology choices for portability: 
-
-- **Runtime (Node.js 24.x, LTS Krypton)**: Runs on Vercel, GCP, AWS, or on-prem with no platform-specific code.
-- **API (Fastify)**: Standard HTTP service that can be deployed as a serverless function, container, or VM.
-- **Web (Next.js)**: Runs on Vercel or self-hosted Node.js; avoid vendor-only features if you need easy migration.
-- **Database (PostgreSQL + Drizzle)**: Standard Postgres and plain SQL; migration is typically switching `DATABASE_URL`.
-
+- **Runtime (Node.js 24.x, LTS Krypton)**: Runs on Vercel, a VPS, or a container with no platform-specific application code.
+- **API (Fastify)**: Standard HTTP. Serverless function, container, or VM.
+- **Web (Next.js)**: Vercel or self-hosted Node. Avoid vendor-only features if you expect to leave Vercel.
+- **Database (PostgreSQL + Drizzle)**: Switch `DATABASE_URL`. Local Product Ready uses Supabase CLI Postgres.
 
 ## Deployment options
 
-Vercel and Supabase are supported out of the box. Configure environment variables and deploy via the standard Vercel or Supabase flows.
-
-{/* Future targets: Google Cloud / AWS with Pulumi */} 
\ No newline at end of file
+Configure environment variables and deploy via the documented Vercel and Supabase flows. Preview migrate stays gated unless `RUN_PG_MIGRATE=true`.
diff --git a/apps/docu/content/docs/deployment/github-actions.mdx b/apps/docu/content/docs/deployment/github-actions.mdx
index df64020d..ee65904c 100644
--- a/apps/docu/content/docs/deployment/github-actions.mdx
+++ b/apps/docu/content/docs/deployment/github-actions.mdx
@@ -11,7 +11,7 @@ Path filters are used only for test workflows (app E2E and package unit tests) s
 
 ### Web (`web-e2e.yml`)
 
-Build → E2E. Triggers on pull request when `apps/web/**`, API routes the suite exercises (`auth`, `account`, `ai`, `health`, `test`), shared packages, OpenAPI, or the workflow/action files change. Single job: build (with localhost API URL), then E2E via `test:e2e:local` with `SKIP_BUILD=1` (spawns Fastify + Next with `ALLOW_TEST=true`, `RATE_LIMIT_MAX=10000`, and `WEBAUTHN_RP_NAME=Test App`). Requires `ANTHROPIC_API_KEY` for the chat E2E project. `cancel-in-progress: true`. Sets `TURBO_TOKEN` / `TURBO_TEAM` when configured.
+Build → E2E. Triggers on pull request when `apps/web/**`, API routes the suite exercises (`auth`, `account`, `ai`, `health`, `test`), shared packages, OpenAPI, or the workflow/action files change. Single job: build (with localhost API URL), then E2E via `test:e2e:local` with `SKIP_BUILD=1` (spawns Fastify + Next with `ALLOW_TEST=true`, `RATE_LIMIT_MAX=10000`, and `WEBAUTHN_RP_NAME=Test App`). The chat Playwright project runs only with a real `ANTHROPIC_API_KEY` (empty and `sk-ant-xxx` omit it); forks without that secret still run auth and dashboard E2E. `cancel-in-progress: true`. Sets `TURBO_TOKEN` / `TURBO_TEAM` when configured.
 
 ### API (`api-e2e.yml`)
 
diff --git a/apps/docu/content/docs/development/after-fork.mdx b/apps/docu/content/docs/development/after-fork.mdx
new file mode 100644
index 00000000..4590ca91
--- /dev/null
+++ b/apps/docu/content/docs/development/after-fork.mdx
@@ -0,0 +1,53 @@
+---
+title: After fork
+description: Template vs fork, Product Ready, and what to replace when the copy is your product.
+---
+
+Basilic stays the starter brand. This page is for after GitHub **Use this template** or a fork. First run is still [Product Ready](/docs/testing/product-ready). There is no rename script.
+
+Enable **Template repository** in GitHub settings so **Use this template** appears. Maintainers do that; agents cannot. Clone still works without the flag.
+
+## Template vs fork
+
+- **Use this template** — start a product. New history, no obligation to merge upstream.
+- **Fork** — contribute back to Basilic. Keep the upstream remote.
+
+## Run
+
+Follow [Getting Started](/docs/development): `pnpm setup`, `db:start`, `pnpm reset`, `pnpm dev`. Copied env sets `ALLOW_TEST=true`. Sign in with `test@test.ai`. Production refuses `ALLOW_TEST`.
+
+The in-shell assistant is optional. Leave Anthropic unset so Ollama can be the free path, or set a real key. Do not use a truthy placeholder.
+
+## Replace when you ship as you
+
+Keep Basilic names until you care. Then:
+
+- `APP_NAME`, `WEB_APP_URL`, `EMAIL_FROM` in API env
+- OAuth client ids (unconfigured providers stay 503)
+- [`.cursor/mcp.json`](https://github.com/blockmatic/basilic/blob/main/.cursor/mcp.json) Vercel MCP URLs (`mcp.vercel.com/gaboesquivel/basilic-*`) — comment them out until you have your own projects
+- Mobile `appId` `com.blockmatic.basilic`
+- DeepSec `githubUrl` in `.deepsec/deepsec.config.ts`
+
+Do not sweep every `blockmatic` docs URL. Those point at the upstream starter.
+
+## FIRST
+
+`_first/basilic/` is this starter’s filled instance. Keep it as the example, or copy [`_first/templates/`](https://github.com/blockmatic/basilic/tree/main/_first/templates) to `_first/<your-product>/` and retarget [`_first/FIRST.md`](https://github.com/blockmatic/basilic/blob/main/_first/FIRST.md). Do not add a 13th station. Specs stay `/f-*` from `npx skills add blockmatic/first`.
+
+## CI secrets
+
+Lint, `security.yml`, package tests, and API unit/Scalar E2E run without org secrets. Fork PRs do not get upstream secrets.
+
+- **Chat E2E** (`web-e2e` chat project) skips when `ANTHROPIC_API_KEY` is empty. Set the secret later if you want that project.
+- **DeepSec** already skips untrusted and fork PRs.
+- Vercel and EAS are not Product Ready.
+
+## License
+
+MIT. Root [`LICENSE`](https://github.com/blockmatic/basilic/blob/main/LICENSE). Keep the copyright notice in copies.
+
+## Related
+
+- [Product Ready](/docs/testing/product-ready)
+- [Getting Started](/docs/development)
+- [GitHub Actions](/docs/deployment/github-actions)
diff --git a/apps/docu/content/docs/development/cursor-setup.mdx b/apps/docu/content/docs/development/cursor-setup.mdx
index ed634887..4798c9f3 100644
--- a/apps/docu/content/docs/development/cursor-setup.mdx
+++ b/apps/docu/content/docs/development/cursor-setup.mdx
@@ -24,9 +24,6 @@ Cursor can index external docs (Fastify, Next.js, Viem, …) under Settings →
    - [v0](https://vercel.com/docs/v0) (`https://vercel.com/docs/v0`)
    - [Vercel AI SDK](https://sdk.vercel.ai/docs) (`https://sdk.vercel.ai/docs`)
    - [Viem](https://viem.sh/docs) (`https://viem.sh/docs`)
-   - [Wagmi](https://wagmi.sh/react/getting-started) (`https://wagmi.sh/react/getting-started`)
-   - [Ponder](https://ponder.sh/docs/) (`https://ponder.sh/docs/`)
-   - [Dynamic](https://docs.dynamic.xyz/) (`https://docs.dynamic.xyz/`)
    - [Alchemy](https://docs.alchemy.com/) (`https://docs.alchemy.com/`)
    - [React Email](https://react.email/docs) (`https://react.email/docs`)
    - [ahooks](https://ahooks.js.org/) (`https://ahooks.js.org/`)
diff --git a/apps/docu/content/docs/development/index.mdx b/apps/docu/content/docs/development/index.mdx
index f841694a..5df7c193 100644
--- a/apps/docu/content/docs/development/index.mdx
+++ b/apps/docu/content/docs/development/index.mdx
@@ -23,7 +23,9 @@ cd <project-name>
 pnpm run setup
 ```
 
-`setup` installs dependencies, git hooks, security tools, and database **tooling**. It also copies `.env.<qualifier>.example` templates to gitignored dest files when those dest files are missing. Edit the copied files to set secrets. `setup` does **not** start Postgres.
+Or GitHub **Use this template**, then clone your new repo. [After fork](/docs/development/after-fork) lists what to replace when the copy is your product.
+
+`setup` installs dependencies, git hooks, security tools, and database **tooling**. It also copies `.env.<qualifier>.example` templates to gitignored dest files when those dest files are missing. Copied local env sets `ALLOW_TEST=true` so `test@test.ai` works without Resend. Edit the copied files to set paid secrets. `setup` does **not** start Postgres.
 
 ```bash
 pnpm --filter @repo/api db:start
@@ -32,7 +34,7 @@ pnpm dev
 ```
 
 - API: http://localhost:3001 (`GET /health`, `/reference`)
-- Web: http://localhost:3000
+- Web: http://localhost:3000 — first login is `/auth/login` with `test@test.ai` (copied env has `ALLOW_TEST=true`; Resend optional)
 - Docs: `pnpm --filter @repo/docu dev` (http://localhost:3002)
 - Mobile: `pnpm --filter @repo/mobile start`
 
@@ -45,6 +47,7 @@ Local Postgres is Supabase CLI. `db:start` then **`pnpm reset`** (repo root) bef
 ## Next
 
 - [Product Ready](/docs/testing/product-ready) — fork-and-run bar (not CI green)
+- [After fork](/docs/development/after-fork) — template vs fork, identity, CI secrets, FIRST overlays
 - [Dev Environments](/docs/development/dev-environments) — ports, remote, Expo
 - [AI Workflow](/docs/development/ai-workflow) — Cursor-first; FIRST / `_first/` load order
 - FIRST adopter pack: repo `_first/README.md` (stations and overlays; not a second docs site)
diff --git a/apps/docu/content/docs/development/meta.json b/apps/docu/content/docs/development/meta.json
index bde72c47..a88e2827 100644
--- a/apps/docu/content/docs/development/meta.json
+++ b/apps/docu/content/docs/development/meta.json
@@ -2,6 +2,7 @@
   "title": "Development",
   "pages": [
     "index",
+    "after-fork",
     "dev-environments",
     "dev-tooling",
     "ai-workflow",
diff --git a/apps/docu/content/docs/testing/e2e-testing.mdx b/apps/docu/content/docs/testing/e2e-testing.mdx
index a3dd1a1c..3e511e5b 100644
--- a/apps/docu/content/docs/testing/e2e-testing.mdx
+++ b/apps/docu/content/docs/testing/e2e-testing.mdx
@@ -41,7 +41,7 @@ test('shows dashboard when authenticated', async ({ page }) => {
 })
 ```
 
-Chat E2E needs `ANTHROPIC_API_KEY` (in-app Claude Haiku 4.5 by default). CI and web `test:e2e:local` set `AI_PROVIDER=anthropic` and verify the secret before E2E. API Scalar E2E (`pnpm --filter @repo/api test:e2e:local`) does not call AI and does not require Anthropic. Web chat (`chat-assistant.spec.ts`) skips on provider infra failures (402, upstream/5xx, network errors). API remote tests (`ai.spec.ts`) use `test/utils/ai-remote.ts`: skip 402 always; skip 502/503/504 only with placeholder/missing key — real key fails on 502. See [AI Architecture](/docs/architecture/ai).
+Chat E2E needs a real `ANTHROPIC_API_KEY` (in-app Claude Haiku 4.5 by default). Playwright **omits** the chat project when `hasRealAnthropicKey()` is false (empty, `sk-ant-xxx`, `sk-ant-dummy*`), so fork CI without org secrets still runs auth and dashboard E2E. When the key is set, `chat-assistant.spec.ts` skips on provider infra failures (402, upstream/5xx, network errors). API Scalar E2E (`pnpm --filter @repo/api test:e2e:local`) does not call AI and does not require Anthropic. API remote tests (`ai.spec.ts`) use `test/utils/ai-remote.ts`: skip 402 always; skip 502/503/504 only with placeholder/missing key — real key fails on 502. See [AI Architecture](/docs/architecture/ai).
 
 ## Test helpers
 
diff --git a/apps/docu/content/docs/testing/product-ready.mdx b/apps/docu/content/docs/testing/product-ready.mdx
index c5b9d411..93c36623 100644
--- a/apps/docu/content/docs/testing/product-ready.mdx
+++ b/apps/docu/content/docs/testing/product-ready.mdx
@@ -3,21 +3,21 @@ title: Product Ready
 description: Fork-and-run bar for Basilic. CI green is Pipelines, not this bar.
 ---
 
-**Product Ready** is a local fork that a new developer can clone, start, and sign into without tribal knowledge. It is **not** “CI is green.” Pipelines prove the repo on GitHub Actions. This page is the adopter bar.
+**Product Ready** is a local clone or template that a new developer can start and sign into without tribal knowledge. It is **not** “CI is green.” Pipelines prove the repo on GitHub Actions. This page is the adopter bar.
 
-Canonical commands: [Getting Started](/docs/development). Playbook: `/onboard-new-developer`.
+Canonical commands: [Getting Started](/docs/development). After you own the copy: [After fork](/docs/development/after-fork). Playbook: `/onboard-new-developer`.
 
 ## Checklist
 
 Do these in order. `pnpm setup` installs tools and copies env templates. It does **not** start Postgres.
 
 1. **Node 24 + pnpm** — `.nvmrc` / `packageManager` (`11.24.0`). `corepack enable` then `corepack prepare pnpm@11.24.0 --activate`.
-2. **Clone** the repo.
-3. **`pnpm setup`** at the repo root (install, hooks, scanners, env templates, Docker/Supabase CLI, Playwright Chromium).
+2. **Clone** the repo, or GitHub **Use this template**.
+3. **`pnpm setup`** at the repo root (install, hooks, scanners, env templates, Docker/Supabase CLI, Playwright Chromium). Copied API/web env sets `ALLOW_TEST=true` for local login. Setup copies templates only when dest files are **missing**; an existing `apps/api/.env` / `apps/web/.env.local` is left alone — set `ALLOW_TEST=true` yourself if those files predate this default.
 4. **`pnpm --filter @repo/api db:start`** — local Supabase Postgres. One instance per host; `pnpm db:stop` before changing `project_id`.
 5. **`pnpm reset`** at the repo root — Supabase reset + Drizzle migrate + seed. See [ADR 008](/docs/adrs/008-database) and `apps/api/README.md`.
 6. **`pnpm dev`** — API at http://localhost:3001 (`GET /health`, `/reference`), web at http://localhost:3000.
-7. **First login** — magic link, or `ALLOW_TEST=true` and `test@test.ai`. Land on `/`.
+7. **First login** — copied env has `ALLOW_TEST=true`. Use `test@test.ai` on `/auth/login`. Land on `/`. Resend is optional for real mail. Production refuses `ALLOW_TEST`.
 8. **Optional mobile** — `pnpm --filter @repo/mobile start`. Not required for Product Ready.
 
 Stop if any step fails. Do not skip `db:start` or `pnpm reset` and treat a hanging API as a product bug.
@@ -28,8 +28,9 @@ Stop if any step fails. Do not skip `db:start` or `pnpm reset` and treat a hangi
 - Production deploy, Sentry, or PostHog
 - Wallet UI or a mobile `@repo/core` client
 - Coverage floors
+- In-shell assistant (needs a real Anthropic/OpenRouter key or local Ollama)
 
-Those are Pipelines, later bets, or non-goals.
+Those are Pipelines, later bets, optional demo chrome, or non-goals.
 
 ## After first login
 
diff --git a/apps/web/.env.development b/apps/web/.env.development
index b5a7b97b..6027c4a7 100644
--- a/apps/web/.env.development
+++ b/apps/web/.env.development
@@ -7,8 +7,8 @@
 NEXT_PUBLIC_API_URL=http://localhost:3001
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 
-# Google One Tap (client-side). Same value as Fastify GOOGLE_CLIENT_ID.
-NEXT_PUBLIC_GOOGLE_CLIENT_ID=767744818103-5vme8soap4h1p6hmactlv4gr54n0qvbd.apps.googleusercontent.com
+# Google One Tap — optional. Unconfigured OAuth returns 503.
+# NEXT_PUBLIC_GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
 
 NEXT_PUBLIC_LOG_ENABLED=true
 NEXT_PUBLIC_LOG_LEVEL=debug
diff --git a/apps/web/.env.local.example b/apps/web/.env.local.example
index 64fe5065..64d376ea 100644
--- a/apps/web/.env.local.example
+++ b/apps/web/.env.local.example
@@ -25,7 +25,8 @@ JWT_SECRET=default-jwt-secret-min-32-chars-for-dev
 # JWT_ISSUER=api.yourapp.com
 # JWT_AUDIENCE=api.yourapp.com
 # AUTH_COOKIE_NAME=api.session
-# ALLOW_TEST=false
+# Local Product Ready: test@test.ai without Resend. Production must not set this.
+ALLOW_TEST=true
 # NEWSAPI_KEY=
 # SENTRY_DSN=
 # SENTRY_ENVIRONMENT=
diff --git a/apps/web/.env.production b/apps/web/.env.production
index 9824dd1c..8c1df692 100644
--- a/apps/web/.env.production
+++ b/apps/web/.env.production
@@ -6,7 +6,7 @@
 # -----------------------------------------------------------------------------
 # CI/CD validation fails if this stays a placeholder — set real API origin.
 NEXT_PUBLIC_API_URL=https://basilic-fastify.vercel.app
-NEXT_PUBLIC_GOOGLE_CLIENT_ID=767744818103-5vme8soap4h1p6hmactlv4gr54n0qvbd.apps.googleusercontent.com
+# NEXT_PUBLIC_GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
 # NEXT_PUBLIC_APP_URL=https://your-app.vercel.app
 
 # -----------------------------------------------------------------------------
diff --git a/apps/web/.env.staging b/apps/web/.env.staging
index f626bf2d..9c42d309 100644
--- a/apps/web/.env.staging
+++ b/apps/web/.env.staging
@@ -4,7 +4,7 @@
 # Client (NEXT_PUBLIC_*)
 # -----------------------------------------------------------------------------
 NEXT_PUBLIC_API_URL=https://basilic-fastify.vercel.app
-NEXT_PUBLIC_GOOGLE_CLIENT_ID=767744818103-5vme8soap4h1p6hmactlv4gr54n0qvbd.apps.googleusercontent.com
+# NEXT_PUBLIC_GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
 # NEXT_PUBLIC_APP_URL=https://your-app.vercel.app
 
 # -----------------------------------------------------------------------------
diff --git a/apps/web/e2e/anthropic-key.ts b/apps/web/e2e/anthropic-key.ts
new file mode 100644
index 00000000..cc2266cc
--- /dev/null
+++ b/apps/web/e2e/anthropic-key.ts
@@ -0,0 +1,5 @@
+/** Same placeholder rules as `apps/api/test/utils/ai-remote.ts` `hasRealAnthropicKey`. */
+export function hasRealAnthropicKey() {
+  const key = process.env.ANTHROPIC_API_KEY?.trim() ?? ''
+  return Boolean(key) && key !== 'sk-ant-xxx' && !key.startsWith('sk-ant-dummy')
+}
diff --git a/apps/web/e2e/chat-assistant.spec.ts b/apps/web/e2e/chat-assistant.spec.ts
index 215d0748..5919827e 100644
--- a/apps/web/e2e/chat-assistant.spec.ts
+++ b/apps/web/e2e/chat-assistant.spec.ts
@@ -1,8 +1,10 @@
 import { expect, test } from '@playwright/test'
+import { hasRealAnthropicKey } from './anthropic-key'
 
 const isCi = !!process.env.CI
 
 test.describe('Chat Assistant', () => {
+  test.skip(!hasRealAnthropicKey(), 'ANTHROPIC_API_KEY unset or placeholder — chat E2E omitted')
   test.setTimeout(90_000)
 
   test('should send message via Who am I? and show assistant response', async ({ page }) => {
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index 857a2f20..c7adfef3 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -1,5 +1,6 @@
 import path from 'node:path'
 import { defineConfig, devices } from '@playwright/test'
+import { hasRealAnthropicKey } from './e2e/anthropic-key'
 
 const isCi = !!process.env.CI
 const appUrl =
@@ -82,16 +83,20 @@ export default defineConfig({
       use: { ...devices['Desktop Chrome'], storageState: emptyStorage },
       dependencies: ['setup'],
     },
-    {
-      name: 'chat',
-      testMatch: ['**/chat-assistant.spec.ts'],
-      timeout: 90_000,
-      use: {
-        ...devices['Desktop Chrome'],
-        storageState: authFile,
-        viewport: { width: 375, height: 667 },
-      },
-      dependencies: ['chromium'],
-    },
+    ...(hasRealAnthropicKey()
+      ? [
+          {
+            name: 'chat',
+            testMatch: ['**/chat-assistant.spec.ts'],
+            timeout: 90_000,
+            use: {
+              ...devices['Desktop Chrome'],
+              storageState: authFile,
+              viewport: { width: 375, height: 667 },
+            },
+            dependencies: ['chromium'],
+          },
+        ]
+      : []),
   ],
 })
diff --git a/package.json b/package.json
index 8386f6a3..6979d173 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,7 @@
 {
   "name": "basilic",
   "private": true,
+  "license": "MIT",
   "scripts": {
     "build": "turbo run build",
     "generate": "turbo run generate --filter=@repo/core",
diff --git a/packages/error/package.json b/packages/error/package.json
index 467bae7c..14105476 100644
--- a/packages/error/package.json
+++ b/packages/error/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "private": true,
   "description": "Error reporting and utilities",
-  "license": "PROPRIETARY",
+  "license": "MIT",
   "exports": {
     ".": {
       "types": "./src/utils/index.ts",
diff --git a/packages/utils/package.json b/packages/utils/package.json
index 0336cddf..fa2df312 100644
--- a/packages/utils/package.json
+++ b/packages/utils/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "private": true,
   "description": "Shared utility functions and helpers",
-  "license": "PROPRIETARY",
+  "license": "MIT",
   "exports": {
     ".": {
       "types": "./src/index.ts",
diff --git a/tools/eslint/README.md b/tools/eslint/README.md
index f8569234..845c7e6d 100644
--- a/tools/eslint/README.md
+++ b/tools/eslint/README.md
@@ -297,4 +297,4 @@ If you need to allow default exports elsewhere, override the rule in your local
 
 ## License
 
-PROPRIETARY
+MIT. See the repository root `LICENSE`.
diff --git a/tools/typescript/README.md b/tools/typescript/README.md
index 41d9baca..857fbc03 100644
--- a/tools/typescript/README.md
+++ b/tools/typescript/README.md
@@ -226,4 +226,4 @@ Packages that don't override `include` will automatically get `reset.d.ts` from
 
 ## License
 
-PROPRIETARY
+MIT. See the repository root `LICENSE`.
diff --git a/tools/typescript/package.json b/tools/typescript/package.json
index dd11691f..0a984d13 100644
--- a/tools/typescript/package.json
+++ b/tools/typescript/package.json
@@ -2,7 +2,7 @@
   "name": "@repo/typescript-config",
   "version": "0.0.0",
   "private": true,
-  "license": "PROPRIETARY",
+  "license": "MIT",
   "publishConfig": {
     "access": "public"
   },

From 0b563e2a2ad806af44b8918b2cfb16361e454376 Mon Sep 17 00:00:00 2001
From: gaboesquivel <contact@gaboesquivel.com>
Date: Sat, 5 Sep 2026 07:32:28 -0600
Subject: [PATCH 2/2] docs: align chat e2e key and preview migrate facts

---
 _first/basilic/PIPELINES.md                          | 2 +-
 apps/docu/content/docs/architecture/portability.mdx  | 4 ++--
 apps/docu/content/docs/deployment/github-actions.mdx | 2 +-
 apps/docu/content/docs/testing/e2e-testing.mdx       | 2 +-
 apps/web/e2e/anthropic-key.ts                        | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/_first/basilic/PIPELINES.md b/_first/basilic/PIPELINES.md
index 9fe1d004..fa4b5b8a 100644
--- a/_first/basilic/PIPELINES.md
+++ b/_first/basilic/PIPELINES.md
@@ -21,7 +21,7 @@ Changes flow through an automated path: format → lint → typecheck → test 
 - **Fact:** Mobile: `mobile-build.yml`, `mobile-preview.yml`, `mobile-pr-preview.yml` ([mobile-cicd.mdx](../../apps/docu/content/docs/deployment/mobile-cicd.mdx))
 - **Fact:** Local: `pnpm qa` via [`../../scripts/run-qa.mjs`](../../scripts/run-qa.mjs) — checktypes → lint → generate + drift → build → unit → e2e (`SKIP_BUILD=1`)
 - **Fact:** Vercel git deploys web/api/docu ([vercel.mdx](../../apps/docu/content/docs/deployment/vercel.mdx)). CI does **not** deploy. Preview migrate gated unless `RUN_PG_MIGRATE=true`.
-- **Fact:** `web-e2e` chat project runs only when `ANTHROPIC_API_KEY` is set; auth/dashboard E2E still run on forks
+- **Fact:** `web-e2e` chat project runs only when a non-placeholder Anthropic key is present (`hasRealAnthropicKey()`: empty, `sk-ant-xxx`, and `sk-ant-dummy*` omit it); auth/dashboard E2E still run on forks
 - **Fact:** R0 is documentation alignment. It does not require a GitHub Release or a version bump. Preview deploys still run from git as usual.
 - **Unresolved:** commit-stage artifact identity and promote-without-rebuild (hosts rebuild from git)
 
diff --git a/apps/docu/content/docs/architecture/portability.mdx b/apps/docu/content/docs/architecture/portability.mdx
index bfc66dfc..6db0c5c4 100644
--- a/apps/docu/content/docs/architecture/portability.mdx
+++ b/apps/docu/content/docs/architecture/portability.mdx
@@ -12,8 +12,8 @@ Do not read this page as “configure GCP or AWS from this repo.” Those remain
 - **Runtime (Node.js 24.x, LTS Krypton)**: Runs on Vercel, a VPS, or a container with no platform-specific application code.
 - **API (Fastify)**: Standard HTTP. Serverless function, container, or VM.
 - **Web (Next.js)**: Vercel or self-hosted Node. Avoid vendor-only features if you expect to leave Vercel.
-- **Database (PostgreSQL + Drizzle)**: Switch `DATABASE_URL`. Local Product Ready uses Supabase CLI Postgres.
+- **Database (PostgreSQL + Drizzle)**: Switch `DATABASE_URL`. Local Product Ready uses Supabase CLI Postgres. Preview migrations require `RUN_PG_MIGRATE=true` and an isolated `DATABASE_URL`; they cannot target a shared database.
 
 ## Deployment options
 
-Configure environment variables and deploy via the documented Vercel and Supabase flows. Preview migrate stays gated unless `RUN_PG_MIGRATE=true`.
+Preview migrate requires `RUN_PG_MIGRATE=true` and an isolated `DATABASE_URL`. Configure environment variables and deploy via the documented Vercel and Supabase flows.
diff --git a/apps/docu/content/docs/deployment/github-actions.mdx b/apps/docu/content/docs/deployment/github-actions.mdx
index ee65904c..766fedb0 100644
--- a/apps/docu/content/docs/deployment/github-actions.mdx
+++ b/apps/docu/content/docs/deployment/github-actions.mdx
@@ -11,7 +11,7 @@ Path filters are used only for test workflows (app E2E and package unit tests) s
 
 ### Web (`web-e2e.yml`)
 
-Build → E2E. Triggers on pull request when `apps/web/**`, API routes the suite exercises (`auth`, `account`, `ai`, `health`, `test`), shared packages, OpenAPI, or the workflow/action files change. Single job: build (with localhost API URL), then E2E via `test:e2e:local` with `SKIP_BUILD=1` (spawns Fastify + Next with `ALLOW_TEST=true`, `RATE_LIMIT_MAX=10000`, and `WEBAUTHN_RP_NAME=Test App`). The chat Playwright project runs only with a real `ANTHROPIC_API_KEY` (empty and `sk-ant-xxx` omit it); forks without that secret still run auth and dashboard E2E. `cancel-in-progress: true`. Sets `TURBO_TOKEN` / `TURBO_TEAM` when configured.
+Build → E2E. Triggers on pull request when `apps/web/**`, API routes the suite exercises (`auth`, `account`, `ai`, `health`, `test`), shared packages, OpenAPI, or the workflow/action files change. Single job: build (with localhost API URL), then E2E via `test:e2e:local` with `SKIP_BUILD=1` (spawns Fastify + Next with `ALLOW_TEST=true`, `RATE_LIMIT_MAX=10000`, and `WEBAUTHN_RP_NAME=Test App`). The chat Playwright project runs only when a non-placeholder Anthropic key is present (`hasRealAnthropicKey()`: empty, `sk-ant-xxx`, and `sk-ant-dummy*` omit it); forks without that secret still run auth and dashboard E2E. `cancel-in-progress: true`. Sets `TURBO_TOKEN` / `TURBO_TEAM` when configured.
 
 ### API (`api-e2e.yml`)
 
diff --git a/apps/docu/content/docs/testing/e2e-testing.mdx b/apps/docu/content/docs/testing/e2e-testing.mdx
index 3e511e5b..4f3df56d 100644
--- a/apps/docu/content/docs/testing/e2e-testing.mdx
+++ b/apps/docu/content/docs/testing/e2e-testing.mdx
@@ -41,7 +41,7 @@ test('shows dashboard when authenticated', async ({ page }) => {
 })
 ```
 
-Chat E2E needs a real `ANTHROPIC_API_KEY` (in-app Claude Haiku 4.5 by default). Playwright **omits** the chat project when `hasRealAnthropicKey()` is false (empty, `sk-ant-xxx`, `sk-ant-dummy*`), so fork CI without org secrets still runs auth and dashboard E2E. When the key is set, `chat-assistant.spec.ts` skips on provider infra failures (402, upstream/5xx, network errors). API Scalar E2E (`pnpm --filter @repo/api test:e2e:local`) does not call AI and does not require Anthropic. API remote tests (`ai.spec.ts`) use `test/utils/ai-remote.ts`: skip 402 always; skip 502/503/504 only with placeholder/missing key — real key fails on 502. See [AI Architecture](/docs/architecture/ai).
+Chat E2E needs a real `ANTHROPIC_API_KEY` (in-app Claude Haiku 4.5 by default). Playwright **omits** the chat project when `hasRealAnthropicKey()` is false (empty, `sk-ant-xxx`, `sk-ant-dummy*`), so fork CI without org secrets still runs auth and dashboard E2E. When the key is set, `chat-assistant.spec.ts` skips only quota or credit errors; upstream 5xx and network failures fail the test run. API Scalar E2E (`pnpm --filter @repo/api test:e2e:local`) does not call AI and does not require Anthropic. API remote tests (`ai.spec.ts`) use `test/utils/ai-remote.ts`: skip 402 always; skip 502/503/504 only with placeholder/missing key — real key fails on 502. See [AI Architecture](/docs/architecture/ai).
 
 ## Test helpers
 
diff --git a/apps/web/e2e/anthropic-key.ts b/apps/web/e2e/anthropic-key.ts
index cc2266cc..dcf54bfb 100644
--- a/apps/web/e2e/anthropic-key.ts
+++ b/apps/web/e2e/anthropic-key.ts
@@ -1,5 +1,5 @@
 /** Same placeholder rules as `apps/api/test/utils/ai-remote.ts` `hasRealAnthropicKey`. */
-export function hasRealAnthropicKey() {
+export function hasRealAnthropicKey(): boolean {
   const key = process.env.ANTHROPIC_API_KEY?.trim() ?? ''
   return Boolean(key) && key !== 'sk-ant-xxx' && !key.startsWith('sk-ant-dummy')
 }