Capability router — pick capabilities, enable services, install modules, activate skills

This is a lean universal app that grows on demand. Your first job for any build request is to route: figure out which capabilities the request needs, then turn on only those. Don't build everything; build toward what the user asked for.

The procedure

1. Classify the request into one or more capabilities using the matrix below. Most requests need 1–2 packs. When in doubt, start with the smallest set and grow later — you can always route again on the next turn.
2. For each chosen pack, in order: 0. If the pack ships a pack.json, scaffold it in one command — npm run pack:add -- <pack> enables the service, installs the pinned modules, copies the kit, and wires scripts in one idempotent pass (see pack-manifest.md). Today analytics ships one, so that whole path is a single command — then jump straight to reading the pack skill. Otherwise, do the manual steps below.
   1. Enable the service — edit rayfin/rayfin.yml (see the pack's row). Auth + data + static hosting are already on.
   2. Install the modules — npm install <…> for that pack. Install just what the pack needs; skip modules already in package.json. (Manifest packs install their own modules; a manual npm install is fine for the rest.)
   3. Scaffold the code — create the entities / wiring / files the pack calls for (the pack's row says what; the pack's SKILL.md has the patterns).
   4. Read the pack skill — open .agents/skills/<pack>/SKILL.md and follow it for the real implementation details. Don't duplicate its guidance here.
3. Keep it building, then deploy with rayfin up when you're ready to see it on Fabric (see AGENTS.md).

Capability matrix

Notes on routing

• App-building vs analytics are different shapes. The app-building packs (authentication, data-modeling, graphein-visuals) build a normal interactive app over Rayfin data, with data enabled. The analytics pack builds a read-only dashboard over an external Power BI semantic model (data disabled, its own dashboard kit). If the user wants charts over their own app's data, use graphein-visuals; if they want a dashboard over an existing Power BI dataset/report, use analytics.
• Charts everywhere. graphein-visuals composes with the app-building packs (e.g. data-modeling for the data + graphein-visuals for the chart).
• Row-level security lives inside data-modeling — route there when the user says "each user only sees their own …".
• Data implies auth. Rayfin data is always accessed as an authenticated user (no anonymous access on Fabric), so any request that stores or reads app data — data-modeling especially — must also wire authentication; route to both. A static page over public data needs neither. (Analytics is separate: its Power BI model is read through the Fabric embed proxy, which Fabric authenticates — no app AuthProvider needed.)
• Grow incrementally. Ship the core of what was asked, let it deploy, then add the next capability. You don't have to wire every pack up front.