Ember App Onboard

Starts a new Ember project, brings an existing repository up to the standard, and requests a sandbox when your project is ready for other people to use.

When to Use

• You are starting a new application.
• You have an existing repository that should follow the Ember standard.
• Your project works on your machine and you want it in the shared sandbox, so reviewers and testers can reach it.
• You want to know where your project stands.

What to Say

• "Start a new Ember project."
• "Onboard my app" or "Retrofit this repo to Ember."
• "Promote this project to sandbox."
• "What's the status of this project?"

What Happens

New project. The agent asks a few questions, one group at a time:

• name, slug, purpose, and owner
• which surfaces you need: Render, Supabase, Vercel
• who uses it (internal or mixed-audience) and whether the airport network is required
• your data classification, with an attestation that only synthetic or public data is used
• which agents you use

It shows the folder tree before writing anything. After you confirm, it:

• creates ~/gitroot/<slug> with a Next.js application on Render and a Supabase backend
• builds in the Ember guardrails: Cloudflare Access sign-in, accounts keyed on your Entra ID, a staff-only admin page, row-level security that denies by default, and synthetic seed data
• writes the docs folders, CI, and a pre-commit hook
• runs git init and writes the evidence index for AiRB readiness
• confirms the new repository passes the context linter and the guardrail checks

It commits nothing.

Retrofit. The agent reports what is missing and sorts it into three kinds: safe additions, git setup, and manual steps. It applies only what you confirm, and never overwrites a file you already have.

Promote to sandbox. The agent checks the sandbox gate:

• owner, purpose, and an expiry date at most 180 days out
• your team's GitHub logins (no emails)
• synthetic data only
• a clean working tree, clean context lint, and a clean secret scan

When everything passes and you confirm, it:

• records the request in docs/operations/YYYY-MM-DD-sandbox-request.md
• adds render.yaml if Render is a surface
• commits those files
• opens a Sandbox request issue for the sandbox operator, after you push and confirm

When the operator closes the issue, run promote again and it moves your project to the sandbox tier.

What It Never Does

• Overwrite your existing files, or put secrets or real environment values anywhere. .env.example holds names only.
• Commit, push, or open an issue without your confirmation.
• Create anything in Supabase, Render, Vercel, Cloudflare, or GitHub settings. Only the sandbox operator provisions.
• Treat a passed gate as accreditation or production access.

What It Changes

Run It Without an Agent

node ~/gitroot/ember-platform-skills/skills/ember-app-onboard/scripts/onboard.mjs --help

new, promote, and retrofit show what they would do and write nothing until you add --confirm, or --apply for retrofit.

Common Problems