feat(starters): add selectable apps and CoreAI Sandbox

.github/dependabot.yml

@@ -10,7 +10,7 @@ updates:
     directories:
       - "/hub"
       - "/actions/build"
-      - "/starter"
+      - "/starters/*"
     schedule:
       interval: weekly
     cooldown:

.github/extensions/replica-prototype/README.md

@@ -10,7 +10,7 @@ The injected adapter applies JSON defaults and valid URL overrides. Missing defi
 
 Canvas and Hub save overrides in prototype URLs as `rc.<scope>.<controlId>`, never in private renderer/proxy capability URLs. Edits preserve history state without reload or extra entries. Back/Forward restores settings; reset-all removes overrides and resets inactive sets. Conditional hiding discards overrides, while ordinary page unmount/return preserves cached values. Private value files are no longer read or written; existing files remain untouched.
 
-Prototype authors own static definitions and ordinary app state. After verifying the preview belongs to the current worktree, agents call `validate_controls` until the served definitions pass, then `reload_preview` and `get_controls_status` with an optional `timeoutMs` (0 through 10000). The read-only status action returns the live route, origin and URL. Its `controls` match the accepted state rendered in the Controls panel; `runtime` provides the current in-frame adapter state to reveal stale panel/bridge differences. Both include control IDs, availability, busy state, visibility and exact binding errors, without values or callback results. It returns `pending` until frame and panel readiness settle. Runtime availability does not prove visual effects or reset behavior. `connect_prototype` can repoint an existing panel to another running server without publishing or stopping either server. See the [authoring reference](../../../starter/.agents/skills/prototype-controls/references/authoring.md) and [integration guide](../../../hub/docs/prototype-canvas.md#local-prototype-controls).
+Prototype authors own static definitions and ordinary app state. After verifying the preview belongs to the current worktree, agents call `validate_controls` until the served definitions pass, then `reload_preview` and `get_controls_status` with an optional `timeoutMs` (0 through 10000). The read-only status action returns the live route, origin and URL. Its `controls` match the accepted state rendered in the Controls panel; `runtime` provides the current in-frame adapter state to reveal stale panel/bridge differences. Both include control IDs, availability, busy state, visibility and exact binding errors, without values or callback results. It returns `pending` until frame and panel readiness settle. Runtime availability does not prove visual effects or reset behavior. `connect_prototype` can repoint an existing panel to another running server without publishing or stopping either server. See the [authoring reference](../../../starters/shared/.agents/skills/prototype-controls/references/authoring.md) and [integration guide](../../../hub/docs/prototype-canvas.md#local-prototype-controls).
 
 After a live action times out, `get_action_diagnostics` reads bounded request and renderer IDs, outcomes and transport stages without contacting the renderer. Timeout errors identify the last stage; traces omit app values and private URLs. See the integration guide for the stage contract.
 
@@ -296,7 +296,7 @@ The iframe uses a separate local origin. The displayed address and external-brow
 
 Local Controls use public JSON bindings; retained Builds use their own copy of that asset. Standalone pages remain ordinary apps without an injected adapter.
 
-A missing handshake can mean a stopped server, delayed loading, unsupported HTML or a policy/origin blocker. **Fix with Copilot** requests read-only diagnosis of this preview connection before scoped repairs. Repository commands, dependency changes and server restarts still require explicit approval; the button itself does not approve them. **Dismiss** keeps the preview usable. See [connection troubleshooting](../../../starter/SETUP.md#canvas-commenting).
+A missing handshake can mean a stopped server, delayed loading, unsupported HTML or a policy/origin blocker. **Fix with Copilot** requests read-only diagnosis of this preview connection before scoped repairs. Repository commands, dependency changes and server restarts still require explicit approval; the button itself does not approve them. **Dismiss** keeps the preview usable. See [connection troubleshooting](../../../starters/shared/SETUP.md#canvas-commenting).
 
 These requirements are agent instructions, not a sandbox or a new host permission policy. The SDK's `session.send({ prompt })` and `session.rpc.send` do not support per-message command allowlists, checkout isolation, or command-specific approval grants. The SDK exposes `session.ui.confirm` when the host reports `session.capabilities.ui.elicitation`, but a confirmation alone does not restrict later tools. This extension only sends the repair request under the session's existing permissions; it does not install dependencies or execute repair commands itself. Repository-trust decisions and host tool permissions remain separate controls.
 

.github/extensions/replica-prototype/marketplace.test.mjs

@@ -29,7 +29,10 @@ it("resolves the marketplace's relative source to the shipped plugin", async ()
   assert.equal(
     reviewSkill,
     (
-      await readFile(new URL("starter/.agents/skills/review-hub-feedback/SKILL.md", root), "utf8")
+      await readFile(
+        new URL("starters/shared/.agents/skills/review-hub-feedback/SKILL.md", root),
+        "utf8",
+      )
     ).replaceAll("\r\n", "\n"),
     "The shipped review skill matches its canonical starter source.",
   )
@@ -39,7 +42,7 @@ it("resolves the marketplace's relative source to the shipped plugin", async ()
       "utf8",
     ),
     await readFile(
-      new URL("starter/.agents/skills/review-hub-feedback/references/handoff.md", root),
+      new URL("starters/shared/.agents/skills/review-hub-feedback/references/handoff.md", root),
       "utf8",
     ),
     "The shipped review skill includes its private handoff contract.",

.github/workflows/dependency-age.yml

@@ -21,4 +21,4 @@ jobs:
         with:
           bundler-cache: true
           working-directory: hub
-      - run: DEPENDENCY_AGE_ROOT=.. DEPENDENCY_AGE_EXCLUDED_PATHS=starter bin/check-dependency-age
+      - run: DEPENDENCY_AGE_ROOT=.. DEPENDENCY_AGE_EXCLUDED_PATHS=starters bin/check-dependency-age

.github/workflows/starter-ci.yml

@@ -4,7 +4,11 @@ on:
   pull_request:
     paths:
       - ".github/workflows/starter-ci.yml"
-      - "starter/**"
+      - "starters/**"
+      - "scripts/check-starter.sh"
+      - "scripts/starter-catalog.sh"
+      - "scripts/starter-catalog.test.mjs"
+      - "scripts/starter-ci-matrix.sh"
       - "scripts/create-prototype-repo.sh"
       - "scripts/create-prototype-repo.test.mjs"
       - "scripts/setup-replica-plugin.test.mjs"
@@ -13,7 +17,11 @@ on:
     branches: [main]
     paths:
       - ".github/workflows/starter-ci.yml"
-      - "starter/**"
+      - "starters/**"
+      - "scripts/check-starter.sh"
+      - "scripts/starter-catalog.sh"
+      - "scripts/starter-catalog.test.mjs"
+      - "scripts/starter-ci-matrix.sh"
       - "scripts/create-prototype-repo.sh"
       - "scripts/create-prototype-repo.test.mjs"
       - "scripts/setup-replica-plugin.test.mjs"
@@ -23,27 +31,49 @@ permissions:
   contents: read
 
 jobs:
+  catalog:
+    runs-on: ubuntu-latest
+    outputs:
+      starters: ${{ steps.catalog.outputs.starters }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - id: catalog
+        run: |
+          starters="$(bash scripts/starter-ci-matrix.sh)"
+          echo "starters=$starters" >> "$GITHUB_OUTPUT"
+  tooling:
+    name: Starter tooling (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [24, 26]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: ${{ matrix.node }}
+      - run: node --test scripts/create-prototype-repo.test.mjs scripts/setup-replica-plugin.test.mjs scripts/select-ci-suites.test.mjs
   test:
-    name: Starter checks${{ matrix.node == 26 && ' (Node 26)' || '' }}
+    name: Starter checks${{ matrix.starter.id != 'minimal' && format(' ({0})', matrix.starter.id) || '' }}${{ matrix.node == 26 && ' (Node 26)' || '' }}
+    needs: catalog
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         node: [24, 26]
-    defaults:
-      run:
-        working-directory: starter
+        starter: ${{ fromJSON(needs.catalog.outputs.starters) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
-          cache-dependency-path: starter/package-lock.json
-      - run: npm ci --engine-strict
-      - run: npm run format:check
-      - run: npm run typecheck
-      - run: npm test
-      - run: npm run build
-      - run: node --test scripts/create-prototype-repo.test.mjs scripts/setup-replica-plugin.test.mjs
-        working-directory: .
+          cache-dependency-path: ${{ matrix.starter.directory }}/package-lock.json
+      - run: bash scripts/check-starter.sh "${{ matrix.starter.id }}" "$RUNNER_TEMP/prototype"
+        env:
+          # Bot commit identity: https://github.com/actions/checkout#push-a-commit-using-the-built-in-token
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com

AGENTS.md

@@ -1,6 +1,6 @@
 # Working on Replica
 
-Replica contains the self-hosted Hub, a copyable prototype starter, and the shared prototype build action.
+Replica contains the self-hosted Hub, selectable prototype starters, and the shared prototype build action.
 
 ## Start here
 
@@ -30,7 +30,8 @@ Follow the [commit and PR conventions](CONTRIBUTING.md#commits-and-pull-requests
 ## Project boundaries
 
 - `hub/` owns deployment, repository discovery, Build storage, previews, and review collaboration. Shared canvas and Controls source follows its normal `app/javascript/` layers. Read `hub/AGENTS.md` before changing it.
-- `starter/` is the single source for the Vite + React app, `.agents/skills/`, and `.agents/context-templates/`. Product- and design-system-specific guidance belongs in consuming repositories.
+- `starters/catalog.tsv` lists selectable apps. `starters/minimal/` owns Minimal and its TanStack scaffolder; `starters/coreai/` owns CoreAI Sandbox and its React Router app, skills and baseline context. Keep their application code independent.
+- `starters/shared/` owns shared Replica skills, context templates, Copilot startup, browser configuration and copied workflow guides. Read [starter development](docs/starter-development.md) before changing catalog or assembly behavior. App sources and the shared bundle are assembled into independent repositories; copied instructions must not depend on this monorepo.
 - `actions/build/` owns the artifact contract between prototype repositories and Hub.
 - `packages/learning/` owns the learning contracts, the memory provider and consolidator interfaces, the reference providers and consolidators, the conformance suite, and the `replica-learning` command. It is private repository source with no release yet. Read its `README.md` and [ADR 0001](docs/adr/0001-learning-extension-architecture.md) before changing it.
 
@@ -46,7 +47,7 @@ Use the browser canvas first for agent-driven rendered checks, interaction tests
 
 Read fresh rendered structure before using element refs and after navigation or relevant page changes. Prefer structured actions; use small agent-authored read-only JavaScript only for diagnostics they cannot express. For an unreadable panel, check the declared readiness signal, refocus the same panel, rediscover capabilities and retry supported inspection once with valid inputs. Inspect the resulting state before retrying a timed-out interaction; it may already have succeeded. Do not restart a healthy server because its canvas timed out.
 
-Use the configured Playwright MCP fallback only when the canvas is unavailable for a required check: missing runtime, missing action or required identifier acquisition, or an unreadable panel after bounded recovery. Disclose the exact blocker and use fallback only for affected checks, starting with a fresh read rather than replaying a timed-out action. An application failure or failed assertion is not a reason to switch drivers. Keep supported checks in the canvas and preserve the visual preview. Follow the [shared browser workflow](starter/.agents/skills/browser-canvas-validation/WORKFLOW.md) for execution and evidence limits.
+Use the configured Playwright MCP fallback only when the canvas is unavailable for a required check: missing runtime, missing action or required identifier acquisition, or an unreadable panel after bounded recovery. Disclose the exact blocker and use fallback only for affected checks, starting with a fresh read rather than replaying a timed-out action. An application failure or failed assertion is not a reason to switch drivers. Keep supported checks in the canvas and preserve the visual preview. Follow the [shared browser workflow](starters/shared/.agents/skills/browser-canvas-validation/WORKFLOW.md) for execution and evidence limits.
 
 The repository's [MCP configuration](.github/mcp.json) pins the official Microsoft server in `.github/mcp.json`. Discover its actual tools and input schemas; do not assume historical tool names. Navigate a new, agent-owned isolated browser session to the exact authorized preview URL, preserving its path, query, and hash. Use fresh snapshots and element references after navigation or relevant page changes. Inspect only the requested route and perform only authorized interactions.
 

CONTRIBUTING.md

@@ -56,20 +56,20 @@ bin/devcontainer exec COMMAND
 
 See [Hub development](hub/docs/development.md) for the full local workflow. Local GitHub integration requires a private development GitHub App and test repositories. Never install that App on production repositories.
 
-### Replica Starter
+### Replica starters
 
-Replica Starter requires npm and a Node.js version matching `engines.node` in [starter/package.json](starter/package.json):
+Each app requires npm and a Node.js version matching its `engines.node`. [Starter development](docs/starter-development.md) owns the catalog, common bundle and app contract. Check the installed result in a new directory outside Replica:
 
 ```sh
 node --version
-cd starter
-npm ci
-npm run typecheck
-npm test
-npm run build
+bash scripts/create-prototype-repo.sh --list
+bash scripts/check-starter.sh minimal ../check-minimal
+bash scripts/check-starter.sh coreai ../check-coreai
 ```
 
-Update starter skills and context templates directly under `starter/.agents/`. Keep authored context in consuming repositories separate from those shared files. For starter-copy, static context library/link and plugin setup checks, run `node --test scripts/create-prototype-repo.test.mjs scripts/setup-replica-plugin.test.mjs` from the repository root. These checks do not verify agent authoring, semantic preservation or activation behavior; use the setup skill's real-host evaluation protocol for that evidence.
+Edit generic Replica skills and context templates under `starters/shared/.agents/`. App-specific skills and baseline context stay with the app. Keep consuming-team context separate from shared files. Local-checkout creation includes tracked files with working-tree edits; stage new files before checking assembly, without committing them.
+
+For selection, archive safety, static context links, plugin setup and CI selection, run `node --test scripts/create-prototype-repo.test.mjs scripts/setup-replica-plugin.test.mjs scripts/select-ci-suites.test.mjs` from the repository root. These checks do not verify agent authoring, semantic preservation or activation behavior; use the setup skill's real-host evaluation protocol for that evidence.
 
 Reuse an existing compatible Node.js installation. If it is unavailable on macOS or Linux, get approval before installing [nodenv](https://github.com/nodenv/nodenv), [node-build](https://github.com/nodenv/node-build), or Node.js, or changing shell configuration. The starter installer does not install them.
 

README.md

@@ -24,14 +24,14 @@ Replica has four parts:
 
 | Part | What it does |
 | --- | --- |
-| **Starter** | Creates a local prototype project with agent skills and a working app you can adapt. |
+| **Starters** | Create a local prototype project from your choice of app, with shared agent skills. |
 | **Copilot canvas extension** | Opens your local prototype alongside your Copilot conversation. |
 | **Replica Hub (optional)** | Hosts published prototypes so your team can try them and leave comments. |
 | **GitHub build action** | Builds prototypes for publishing to Hub. It is not needed for local prototyping. |
 
 **Ready to make prototypes?** Follow [Get started with Replica](docs/getting-started.md) to install the GitHub Copilot app, add your team's prototyping repository, install the canvas, and create your first prototype. It also covers connecting to Hub, publishing, sharing and commenting, and adding controls.
 
-**Creating a prototyping repository?** Point your agent at [prototype repository setup](docs/prototype-repository-setup.md). It covers new and existing repositories, getting the starter running locally, and continuing with product guidance or a shared team baseline. Local prototyping needs no Hub.
+**Creating a prototyping repository?** Choose **Minimal**, a small React app with no component library, or **CoreAI Sandbox**, a React Router app with CoreAI components and a Foundry-style shell. Point your agent at [prototype repository setup](docs/prototype-repository-setup.md) to select an app, create the repository and verify its local preview. Local prototyping needs no Hub.
 
 **Setting up Replica for your organization?** Follow [environment setup](docs/prototype-environment.md) to add shared guidance and starting pages, deploy Hub, and connect publishing and team feedback. Your organization deploys and runs Hub on its own infrastructure. GitHub doesn't host it.
 

docs/README.md

@@ -21,7 +21,7 @@ Commits and pull requests follow the [contribution conventions](../CONTRIBUTING.
 ## Project guidance
 
 - [Hub documentation](../hub/docs/README.md) covers the Rails application, deployment, previews, and review collaboration.
-- [Starter instructions](../starter/AGENTS.md) and [setup guide](../starter/SETUP.md) cover the copyable prototype app and skills.
+- [Starter development](starter-development.md) owns the catalog, shared bundle, assembly contract and checks. [Minimal instructions](../starters/minimal/AGENTS.md) and [CoreAI instructions](../starters/coreai/AGENTS.md) own their apps. The copied [Replica instructions](../starters/shared/REPLICA-AGENTS.md), [workflow guide](../starters/shared/REPLICA.md) and [troubleshooting guide](../starters/shared/SETUP.md) use paths in the assembled repository.
 - [Build action setup](../CONTRIBUTING.md#replica-build-action) covers the shared action.
 - [Controls documentation](../hub/docs/prototype-controls.md) covers the shared engine and definition schema owned by Hub.
 - [Prototype canvas](../hub/docs/prototype-canvas.md) covers the Copilot plugin and injected Controls integration.