feat(wow): portable frontend agent skill with safe Commerce Factory dry run (#141)

[EagleFox31]

Context

Closes #141. Builds on #139 (versioned read-only source inventory) and #140 (central approval/provenance policy), without copying third-party UI code.

Added

• skills/wow-frontend/SKILL.md: portable agent workflow — audit → art direction → search before build → compose → intentional motion → render before done → provenance.
• Actionable references: source selection, visual composition, motion/reduced-motion and browser/visual QA.
• skills/wow-frontend/README.md: direct reading or manual installation options, with honest discovery limitations.
• skills/wow-frontend/examples/commerce-factory.brief.json: grounded brownfield example from read-only inspection of the actual React 19/Vite + CSS, FR/EN Commerce Factory repo.
• scripts/wow-frontend-plan.mjs: deterministic offline/readonly CLI; validates the brief/consumer, reuses previewWowSources() and wowSourceDisposition(), lists source legal status and stack research-fit. It never writes files, installs packages, fetches network content or calls a renderer.
• test/wow-frontend-skill.test.mjs: skill/frontmatter/reference checks, CLI smoke, required guardrails, untrusted source/mode denial, no-op on disabled config and a second non-React product fixture.
• Existing npm run test:ui-registry includes the new tests via test/ui-registry.test.mjs.

Truth and security constraints

• Current source policy has zero approvals; reference-only sources remain uncopiable/uninstallable.
• The planner always returns operationsAllowed:false, with builds, screenshots, accessibility and performance listed as NOT RUN and deployment NOT VERIFIED.
• Future actual visual/browser QA is owned by Project Automation fix: distinguish missing Hyperdrive database profiles #99; a successful CLI plan is not proof of visual quality.
• No production code, native component registry, existing blueprints, Cloudflare, npm dependencies, runtime APIs or PostgreSQL PR Add PostgreSQL migration gate to Worker releases #74 changed.

Verification

Expected Impact-Aware CI: core test:ui-registry + webapp smoke. Merge only after the checks are green.

Follow-ups

• [Feature] Add curated UI source adapters and stack compatibility resolver #142 source adapters/compatibility.
• Project Automation fix: distinguish missing Hyperdrive database profiles #99 screenshot/performance gate.
• Landing Template fix: preserve runtime variables across Wrangler deploys #6 production motion recipes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	appfactory-api	23c7031	Commit Preview URL Branch Preview URL	Oct 09 2026, 09:36 PM