How generated apps stay green

A boilerplate has a brutal failure mode: the template drifts, and every app scaffolded after the drift is born broken. geenius-mvp treats this as the central engineering problem. The invariant is simple to state — the template must always compile with everything on — and everything below is machinery to enforce it.

The 14-shape matrix

pnpm test scaffolds fourteen real apps — every shape the CLI can produce — and verifies each one. The matrix covers webapp-all (every Convex feature on), webapp-min (every feature off), webapp-macos and webapp-windows (feature subsets on the desktop layouts), supabase-all and supabase-min, the four react site shapes from website to single-page, and the four static-stack shapes down to static-single. React shapes must pass tsc --noEmit clean; representative shapes also do a full vite build; static shapes are verified for structure, key files, and zero leaked tokens. Convex shapes share one throwaway _generated from a single local codegen, so the matrix stays fast enough to run before every template commit.

The -all and -min pairing is the important design choice. All-features-on catches integrations that break each other; all-features-off catches marker blocks that were not truly optional. If both extremes compile, the feature axes are genuinely independent.

The leak-guard: no broken app left behind

The template is full of markers — __APP_SLUG__ tokens, @feature: blocks the scaffolder keeps or strips. The failure you fear is one of them surviving into the output, where it becomes a confusing compile error in an app the user believes is theirs. So after generating, the scaffolder scans every emitted file for marker patterns. If anything leaks, it does not warn — it deletes the entire scaffold and exits nonzero:

if (leaks.length) {
  fs.rmSync(dest, { recursive: true, force: true }); // never leave a broken app behind
  …
}

A missing directory plus a clear error beats a half-built app every time — especially for an agent, which would otherwise start debugging generated code when the bug is in the generator. The self-test applies the same scan to static output: any __ACCENT, __MODE__, or @site: residue fails the shape.

The smoke test: a user, simulated

Type-checking proves the app compiles; pnpm smoke <slug> proves it works. Playwright loads the marketing page, clicks through to auth, signs up as a fresh user, and waits for the authed shell — on any of the four layouts. Then it gets thorough: it reads every nav destination from the live DOM (.lab-navlink or .lab-dock-item, layouts being an axis here too) and visits each one, failing on any page error or console error. If the example feature is present it round-trips an item create. If records is present, it runs the nine-view round-trip: create a record, then switch through all eight other views and confirm each renders it. A 404 check closes it out.

Why the invariant is the product

None of these gates test your app. They test the generator — so that the thousandth scaffold is as sound as the first. Repo policy makes it non-optional: any template or scaffolder change runs the full matrix and a smoke before it lands, and AGENTS.md says so in the rules section.

The template always compiles with everything on. Everything else is enforcement.

When pnpm test prints all 14 shapes green, that sentence is not a slogan; it is a measurement.