chore(template): sync README.md

README.md

@@ -1,3 +1,62 @@
-# templates.AdminDashboard
+# Admin Dashboard / CRM — W4C project template
 
-An internal back-office app: data tables, filters, record forms, roles and an audit trail.
+A W4C **project template**. Creating a project from it generates a private copy of this
+repository in your namespace and starts the **Startup Creator** agent, which drives the build
+from this brief.
+
+This repository is deliberately a **brief, not a finished app**: it ships the product
+specification, the project metadata and the seed assets; the tech stack chosen in the creation
+dialog decides the scaffold. Read [`SPEC.md`](SPEC.md) for the full product contract — roles,
+routes, data model, flows, functional and non-functional requirements, and the acceptance
+criteria the work is checked against.
+
+## What ships in this repository
+
+| Path | Purpose |
+|------|---------|
+| `README.md` | This file: how the template is wired and how to work in the project. |
+| `SPEC.md` | The product specification and acceptance criteria — the contract to build. |
+| `.w4c/template.json` | Template manifest: dialog fields, starter prompt, element list (templates only). |
+| `.w4c/project.json` | Project metadata committed with the repository. |
+| `.w4c/diagrams/` | Excalidraw architecture diagram. |
+| `.w4c/boards/roadmap.json` | Board columns and the seed tasks for the build. |
+| `.w4c/workflows/` | The CI workflow (`ci-build.yaml` + `ci-build.sh`) to import into the workflows module. |
+
+See [`.w4c/README.md`](.w4c/README.md) for the full `.w4c/` contract.
+
+## Stack
+
+The creation dialog records the chosen stack (and its skill pair `stack-*` +
+`stack-*-quality`), the database and the auth provider. Scaffold with those skills and hold the
+work to their conventions and quality gates. The stack is not fixed here on purpose: the same
+brief is built on React + Vite, Next.js, Vue 3 + Quasar, Laravel + Vue, Phoenix, … without
+changing `SPEC.md`.
+
+## Build order
+
+Work **top-down**, one layer at a time, and verify each layer before starting the next:
+
+1. **Scaffold** the stack and get the empty shell running (install → dev server → commit).
+2. **Auth & roles** — the role→permission model, server-side enforcement and the seeded admin.
+3. **Entity metadata + generic table** from `SPEC.md` §3–§4 (registry, migrations, seeded rows).
+4. **Generic record form** — typed inputs, validation, relations, bulk actions.
+5. **Audit trail** — atomic writes for every mutation, change history, `/audit`.
+6. **Dashboard + global search** — KPIs, recent activity, cross-entity search.
+7. **Import / export** — streaming CSV export, mapped import with dry-run.
+8. **Quality** — tests, CI, README quickstart, `.env.example`, accessibility.
+
+The full rationale and the acceptance criteria live in `SPEC.md` §8–§9.
+
+## Working rules
+
+- One concern per commit, conventional messages (`feat:`, `fix:`, `chore:`, `docs:`, `test:`).
+- The CRUD surface is **generated from entity metadata** — add a field in the registry, never a
+  new per-entity screen.
+- Authorize every entity+action on the server; never only in the UI; keep every list query
+  paginated and bounded.
+- Write the audit record **atomically** with the mutation it describes; never update or delete an
+  audit event.
+- Runtime data is real typed records — never floating-point for money/quantities and never a
+  schemaless blob where a `FieldDefinition` should drive validation.
+- Never commit secrets — document them in `.env.example` instead.
+- Keep `docs/PLAN.md`, the board and `.w4c/project.json` in sync as the project evolves.