Handover kit
One GitHub repository and one Supabase project per firm. StoryC can install the kit for you; after handover it keeps no way to read your leads, your engagements or the prompts in force.
Install, in six steps
Supabase project
Create it in your firm's organisation, in the EU (Ireland or London). The firm is the owner from the first minute.
GitHub repository
Create a private repository from the StoryC template: pages, migrations, the function, the tests. No key is in it.
Install
Link the project, push the migration, deploy the function, set the secrets in the dashboard: the service role stays in Supabase;
RESEND_API_KEYand the sending address for the report email;TURNSTILE_SECRETfor the form;ORIGINATION_MODEL_KEYonly if the firm wants the model-drafted brief;ORIGINATION_ADVISER_KEYif advisers sign through the function rather than the dashboard.Connections
Your domain; a sending subdomain with SPF, DKIM and DMARC; the advisers' sign-in (magic link for founders, your Entra tenant for advisers); the Turnstile site key.
Content and tests
Load your firm's config (below), your consent wording and version, and your adviser register. Run the acceptance rehearsal until every probe passes.
Handover
Remove StoryC from the Supabase organisation and the GitHub repository. Rotate the service role and every function secret. Keep the audit log; it is append-only by design.
Config, not a fork
Scoring, row-level security and the send-report path stay upstream. The firm edits this pack and nothing else. The form below writes a preview to this browser so you can see your branding on the pages; the real values go in origination/config.json on your repository.
Acceptance rehearsal
The probes run inside your own database through the function's self test (the same checks as kit/supabase/tests/rls-negative.sql) and roll back; they open no StoryC database and leave no row behind.
What is in the template
| Path | What it is |
|---|---|
kit/README.md | the install and revoke runbook, the secrets list, what StoryC can and cannot see |
kit/LICENCE.md | the licence terms frame: what is licensed, for how long, what the firm may not do; the price is set per firm |
kit/config/firm.example.json | branding, consent version, regulatory mode, retention, the function URL |
kit/supabase/migrations/001_schema.sql | the tables, row-level security, the sign-off trigger, the report cap, the investor lock, the append-only audit, the self test |
kit/supabase/functions/send-report/index.ts | the only public write path: score, record with consent, queue or send the report, draft the brief by rule, the probes |
kit/supabase/tests/rls-negative.sql | anonymous cannot read leads; the brief is invisible until signed; three reports per email; the investor route locked; the audit log append-only |
kit/prompts/origination-brief.v1.md | the locked prompt for the model-drafted brief, on the firm's key only, signed on activation |
origination/ | the four pages, the stylesheet, the runtime and the generated instruments |
The model, when used: a Claude model on the firm's own key, under the locked prompt above, drafting only; a named adviser signs every brief whether a rule or the model drafted it.