A current ShipFoundry Engineering Spike with evidence, missing proof, a bounded agent packet, and outcome checks.

This sample shows the shape of an Engineering Spike: the opportunity is real, but local implementation proof is incomplete. It is illustrative, not a claim that ShipFoundry has inspected a real repository for this exact update.

Use This As The Bar

A strong Engineering Spike separates evidence from recommendation, names the decision it must unlock, gives an agent a bounded inspection path, and defines a stop condition before implementation begins.

Scenario

A product tracks Supabase Auth, Next.js, and Stripe. ShipFoundry finds a Supabase Auth update that changes email confirmation behavior and may affect signup, login, and account setup.

Brief Summary

Field	Example
Update	Supabase Auth changes email confirmation and redirect behavior.
Matched Product Area	Signup, login, account bootstrap, and password reset.
Output Lane	Engineering Spike.
Readiness	Needs Repo Check.
Best Next Step	Ask a user-owned coding agent to inspect auth routes, callback handling, safe redirects, and account-bootstrap behavior.
Primary Risk	Shipping a behavior change without checking local redirect and account-creation assumptions.

What Changed

Supabase published an Auth update that affects how confirmation, redirect, or recovery flows should be handled. The source update is relevant because the product uses Supabase Auth and has custom account setup after authentication.

Why It Matched

The product depends on Supabase Auth.
The product has signup, confirmation, callback, login, password reset, and account bootstrap flows.
The product uses safe redirect helpers and account-scoped setup after auth.
A change in provider auth behavior can create broken onboarding, redirect loops, or missed account initialization.

Evidence Available

Evidence Type	Example Evidence
Source Evidence	Official Supabase Auth update summary and canonical source URL.
Product Context	Product uses Supabase Auth, email/password signup, confirmation, reset flows, and account bootstrap.
Repo Evidence	The repository connection is required. ShipFoundry cites small file-path snippets only when the bounded check finds applicable proof, such as auth routes or callback handlers.
Prior Decisions	Email/password auth is first; OAuth and magic links are deferred.

Evidence Missing

Whether the current repo uses the changed Supabase behavior.
Whether callback routes already handle the new redirect shape.
Whether account bootstrap is idempotent after the changed flow.
Whether tests cover signup, confirmation, reset, and safe redirects.

Trust And Readiness

State	Meaning
Source Confirmed	The upstream update is real and tied to a canonical source.
Product Relevant	The tracked product uses the affected provider and flow.
Repo Proof Needed	Local files must be inspected before implementation.
Not Implementation-Ready	The brief should drive investigation first, not code changes.

Agent Handoff Packet

Use this prompt when handing the brief to a user-owned agent:

Investigate whether the Supabase Auth update affects this product.

Scope:
- Inspect auth signup, login, callback, confirmation, reset, safe redirect, and account-bootstrap code paths.
- Check tests or smoke coverage for these flows.
- Report whether implementation is needed.

Do not:
- Modify auth behavior yet.
- Change provider configuration.
- Add OAuth or magic links.
- Touch billing, dashboard, or unrelated account settings.

Return:
- Files inspected.
- Whether the update applies.
- Evidence found.
- Missing proof.
- Recommended next action.
- Acceptance checks if implementation is needed.
- Stop after the investigation and request approval before implementation.

Acceptance Checks

If the investigation finds implementation is needed, the final work should prove:

Signup still reaches confirmation or session state correctly.
Callback handling lands on a safe local path.
Account/profile bootstrap stays idempotent.
Password reset still works.
Existing auth tests or smoke checks cover the changed behavior.
No direct provider SDK imports or unsafe redirects were added outside approved facades.

Outcome Labels

Outcome	Use When
Adopted	The repo needed and received a concrete change.
Deferred	The update is relevant but not urgent.
Investigated	The update was inspected and no implementation was needed yet.
Not Relevant	The update did not apply to this product.
False Positive	The match was wrong and should reduce future noise.

What This Example Does Not Claim

It does not claim ShipFoundry can implement the change automatically.
It does not claim GitHub evidence exists unless GitHub is connected and a focused scan has run.
It does not authorize broad auth refactors.
It is not a Hand To Agent implementation packet.
It does not replace local verification by the user's coding agent.

Core artifact: Investigation Briefs
Safety states: Trust And Readiness
Per-match repo proof: GitHub Repo Evidence
Agent workflow: MCP
Choosing and delivering briefs: Agent Workflows

Was This Page Useful?

Send a short note if this page is unclear, overclaims a capability, or is missing the proof you expected.

Send Docs Feedback

Sample Engineering Spike